@absolutejs/voice 0.0.22-beta.211 → 0.0.22-beta.213

package/README.md

@@ -589,6 +589,255 @@ The UI should show `/voice/campaigns`, `/voice/campaigns/observability`, `/api/v
 
 This recipe covers the hosted-platform expectations that matter for campaign outreach: recipient import evidence, consent/dedupe checks, scheduling policy, worker-safe attempts, carrier dry-run proof, webhook outcome mapping, queue observability, readiness gating, and call-log replacement links.
 
+## Use-Case Recipe: Meeting Recorder
+
+Use this path when the product needs a browser recorder for meetings, interviews, demos, or internal calls: capture microphone audio, persist transcripts and traces, generate a post-call review, expose a replayable operations record, and keep retention/export controls inside the app. This is not a hosted meeting bot; it is a set of recorder primitives your AbsoluteJS UI can own.
+
+The production shape is:
+
+1. Mount a browser voice route with persistent session, trace, review, task, and audit-capable storage.
+2. Use framework stream/controller helpers for the microphone, transcript, reconnect state, and recording status.
+3. Persist a review artifact on completion with transcript, summary, latency, outcome, and recommended follow-up.
+4. Mount trace timelines, operations records, production readiness, and data-control routes.
+5. Gate release with the `meeting-recorder` readiness profile so reconnect, barge-in/interruption, provider routing, latency, and session-health proof stay visible.
+
+```ts
+import { Elysia } from 'elysia';
+import {
+	createVoiceDataControlRoutes,
+	createVoiceFileRuntimeStorage,
+	createVoiceOperationsRecordRoutes,
+	createVoiceProductionReadinessRoutes,
+	createVoiceReadinessProfile,
+	createVoiceTraceTimelineRoutes,
+	voice,
+	voiceComplianceRedactionDefaults
+} from '@absolutejs/voice';
+import { deepgram } from '@absolutejs/voice-deepgram';
+
+const runtime = createVoiceFileRuntimeStorage({
+	directory: '.voice-runtime/meeting-recorder'
+});
+
+const app = new Elysia()
+	.use(
+		voice({
+			path: '/voice/meeting-recorder',
+			preset: 'reliability',
+			session: runtime.session,
+			stt: deepgram({
+				apiKey: process.env.DEEPGRAM_API_KEY!,
+				model: 'flux-general-en'
+			}),
+			trace: runtime.traces,
+			async onTurn({ turn }) {
+				return {
+					assistantText: '',
+					metadata: {
+						recorder: true,
+						transcript: turn.text
+					}
+				};
+			},
+			onComplete: async () => {},
+			ops: {
+				events: runtime.events,
+				reviews: runtime.reviews,
+				tasks: runtime.tasks,
+				buildReview: ({ session }) => ({
+					errors: [],
+					latencyBreakdown: [],
+					notes: ['Generated by the self-hosted meeting recorder path.'],
+					postCall: {
+						label: 'Meeting summary',
+						recommendedAction: 'Review the transcript and share action items.',
+						summary: 'Review transcript, decisions, and follow-up owners.'
+					},
+					summary: {
+						outcome: 'completed',
+						pass: true,
+						turnCount: session.turns.length
+					},
+					title: `Meeting recorder review for ${session.id}`,
+					timeline: [],
+					transcript: {
+						actual: session.turns
+							.map((turn) => turn.text)
+							.filter(Boolean)
+							.join('\n')
+					}
+				})
+			}
+		})
+	)
+	.use(
+		createVoiceTraceTimelineRoutes({
+			htmlPath: '/traces',
+			path: '/api/voice-traces',
+			store: runtime.traces
+		})
+	)
+	.use(
+		createVoiceOperationsRecordRoutes({
+			htmlPath: '/voice-operations/:sessionId',
+			integrationEvents: runtime.events,
+			path: '/api/voice-operations/:sessionId',
+			reviews: runtime.reviews,
+			store: runtime.traces,
+			tasks: runtime.tasks
+		})
+	)
+	.use(
+		createVoiceDataControlRoutes({
+			...runtime,
+			audit: runtime.audit,
+			auditDeliveries: runtime.auditDeliveries,
+			redact: voiceComplianceRedactionDefaults,
+			traceDeliveries: runtime.traceDeliveries
+		})
+	)
+	.use(
+		createVoiceProductionReadinessRoutes({
+			...createVoiceReadinessProfile('meeting-recorder', {
+				explain: true
+			}),
+			links: {
+				dataControl: '/data-control',
+				operationsRecords: '/voice-operations/:sessionId',
+				traces: '/traces'
+			},
+			store: runtime.traces
+		})
+	);
+```
+
+The UI should show a clear recording button, elapsed time, live transcript, reconnect state, recording status, a stop/finalize action, and links to `/voice-operations/:sessionId`, `/traces`, `/production-readiness`, and `/data-control`. Use `useVoiceStream(...)`, `useVoiceController(...)`, `createVoiceStream(...)`, `VoiceStreamService`, or the HTML/HTMX client helpers depending on the framework; the route and trace/review stores stay the same.
+
+For customer-facing exports, use the same redaction/export primitives as support workflows: render trace Markdown or audit Markdown with `voiceComplianceRedactionDefaults`, then deliver it through file, webhook, or S3 delivery runtimes. For sensitive recordings, start with a retention dry run through `/data-control/retention/plan` before applying deletion.
+
+This recipe covers the hosted-platform expectations that matter for meeting recorders: browser mic capture, live transcript UI, reconnect visibility, post-call review, transcript/debug record, readiness proof, customer-owned storage, retention controls, and redacted export paths.
+
+## Use-Case Recipe: Compliance-Sensitive Calls
+
+Use this path when the voice app handles sensitive customer support, healthcare-adjacent intake, financial workflows, internal investigations, or regulated customer data. AbsoluteJS Voice can provide self-hosted controls and evidence: customer-owned storage, provider-key ownership, redaction defaults, audit trails, guarded deletion, zero-retention policy helpers, redacted exports, and deploy gates. It does not certify the app for HIPAA, SOC 2, GDPR, or any other legal regime by itself.
+
+The production shape is:
+
+1. Use customer-owned runtime storage, preferably Postgres for production records and S3/webhook delivery for exported evidence.
+2. Keep provider keys in the app owner environment, not in a hosted voice dashboard.
+3. Pass `audit` into agents/tools/squads so provider calls, tool executions, handoffs, retention runs, and operator actions are recorded.
+4. Mount data-control routes for redacted audit export, retention dry-runs, guarded deletion, zero-retention planning, and provider-key recommendations.
+5. Make audit evidence, recent retention-policy evidence, and audit/trace delivery health part of production readiness.
+
+```ts
+import { Elysia } from 'elysia';
+import {
+	applyVoiceDataRetentionPolicy,
+	buildVoiceDataRetentionPlan,
+	createVoiceAuditLogger,
+	createVoiceDataControlRoutes,
+	createVoiceOperationsRecordRoutes,
+	createVoicePostgresRuntimeStorage,
+	createVoiceProductionReadinessRoutes,
+	createVoiceZeroRetentionPolicy,
+	exportVoiceAuditTrail,
+	renderVoiceAuditMarkdown,
+	voiceComplianceRedactionDefaults
+} from '@absolutejs/voice';
+
+const runtime = createVoicePostgresRuntimeStorage({
+	connectionString: process.env.DATABASE_URL!,
+	schemaName: 'voice_ops',
+	tablePrefix: 'sensitive'
+});
+
+const audit = createVoiceAuditLogger(runtime.audit);
+
+const app = new Elysia()
+	.use(
+		createVoiceDataControlRoutes({
+			...runtime,
+			audit: runtime.audit,
+			auditDeliveries: runtime.auditDeliveries,
+			path: '/data-control',
+			redact: voiceComplianceRedactionDefaults,
+			title: 'Sensitive Voice Data Control',
+			traceDeliveries: runtime.traceDeliveries
+		})
+	)
+	.use(
+		createVoiceOperationsRecordRoutes({
+			audit: runtime.audit,
+			htmlPath: '/voice-operations/:sessionId',
+			integrationEvents: runtime.events,
+			path: '/api/voice-operations/:sessionId',
+			reviews: runtime.reviews,
+			store: runtime.traces,
+			tasks: runtime.tasks
+		})
+	)
+	.use(
+		createVoiceProductionReadinessRoutes({
+			audit: {
+				require: [
+					{ type: 'provider.call' },
+					{ type: 'operator.action' },
+					{ type: 'retention.policy', maxAgeMs: 7 * 24 * 60 * 60 * 1000 }
+				],
+				store: runtime.audit
+			},
+			auditDeliveries: runtime.auditDeliveries,
+			links: {
+				audit: '/audit',
+				auditDeliveries: '/audit/deliveries',
+				dataControl: '/data-control',
+				operationsRecords: '/voice-operations/:sessionId',
+				traceDeliveries: '/traces/deliveries'
+			},
+			store: runtime.traces,
+			traceDeliveries: runtime.traceDeliveries
+		})
+	);
+
+await audit.operatorAction({
+	action: 'retention.policy.reviewed',
+	actor: { id: 'ops-admin', type: 'operator' },
+	outcome: 'ok',
+	resource: { id: 'zero-retention-policy', type: 'voice.retention' }
+});
+
+const zeroRetentionPolicy = createVoiceZeroRetentionPolicy({
+	...runtime,
+	audit: runtime.audit,
+	auditDeliveries: runtime.auditDeliveries,
+	traceDeliveries: runtime.traceDeliveries
+});
+
+const retentionPlan = await buildVoiceDataRetentionPlan(zeroRetentionPolicy);
+
+if (retentionPlan.deletedCount > 0) {
+	await applyVoiceDataRetentionPolicy({
+		...zeroRetentionPolicy,
+		dryRun: false
+	});
+}
+
+const auditExport = await exportVoiceAuditTrail({
+	redact: voiceComplianceRedactionDefaults,
+	store: runtime.audit
+});
+
+const redactedAuditMarkdown = renderVoiceAuditMarkdown(auditExport.events, {
+	title: 'Sensitive Voice Audit Export'
+});
+```
+
+For the actual agent or squad, pass the same `audit` logger into `createVoiceAgent(...)`, `createVoiceAgentSquad(...)`, or `createVoiceAssistant(...)` with explicit `auditProvider` and `auditModel` labels. That makes provider usage and tool execution visible in `/data-control/audit.md`, `/audit`, readiness checks, and operations records.
+
+The UI should expose `/data-control`, `/data-control.json`, `/data-control/audit.md`, `/data-control/retention/plan`, `/production-readiness`, and `/voice-operations/:sessionId`. Destructive retention application should remain a server-side operator action that first reviews the dry-run plan and then posts `confirm: "apply-retention-policy"`.
+
+This recipe covers the hosted-platform expectations that matter for compliance-sensitive voice apps: customer-owned records, provider-key ownership, redacted exports, audit evidence, guarded retention, zero-retention planning, deploy gates, and a clear boundary that the package supplies controls and proof artifacts, not legal certification.
+
 ## How This Differs From Hosted Voice Platforms
 
 Hosted voice-agent platforms are strongest when you want a managed dashboard, phone-number provisioning, hosted orchestration, and campaign tooling out of the box.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@absolutejs/voice",
-	"version": "0.0.22-beta.211",
+	"version": "0.0.22-beta.213",
 	"description": "Voice primitives and Elysia plugin for AbsoluteJS",
 	"repository": {
 		"type": "git",