Compliance monitoring
for GPT-Live.

// Node.js 22+. Server-side only. No npm dependencies.
// Start GPT-Live with store: true; wait for session.closed and recording finalization.
import { writeFile } from "node:fs/promises";
import { pathToFileURL } from "node:url";
import { setTimeout as sleep } from "node:timers/promises";

export async function run(env = process.env, { request = fetch, pause = sleep } = {}) {
  const required = (name) => {
    if (!env[name]) throw new Error(`Set ${name} on your server.`);
    return env[name];
  };
  const auth = { Authorization: `Bearer ${required("PYAI_API_KEY")}` };
  const jobs = "https://api.pyai.com/v1/transcription/jobs";
  async function checked(url, options = {}) {
    const response = await request(url, {
      ...options, redirect: "error", signal: AbortSignal.timeout(120_000),
    });
    if (!response.ok) {
      // Do not log provider response bodies, credentials or signed URLs.
      throw new Error(`HTTP ${response.status} from ${new URL(url).host}. Check access, entitlement and recording readiness.`);
    }
    return response;
  }

  // Resume an existing job after a polling interruption instead of paying twice.
  let jobId = env.PYAI_JOB_ID;
  if (!jobId) {
    const sessionId = required("GPT_LIVE_SESSION_ID");
    const recording = await checked(
      `https://api.openai.com/v1/live/sessions/${encodeURIComponent(sessionId)}/content`,
      { headers: { Authorization: `Bearer ${required("OPENAI_API_KEY")}` } },
    );
    // Bound memory for this example. Stream large recordings in your production worker.
    const chunks = [];
    let bytes = 0;
    for await (const chunk of recording.body) {
      bytes += chunk.length;
      if (bytes > 64 * 1024 * 1024) throw new Error("Example limit: 64 MiB recording.");
      chunks.push(chunk);
    }
    if (!bytes) throw new Error("The stored recording is empty.");
    const form = new FormData();
    form.set("audio", new Blob(chunks, { type: "audio/wav" }), "gpt-live.wav");
    form.set("trace", "true");
    form.set("numerals", "true");
    // Hear mixes both channels for this path. Do not set channel or diarize.
    // fetch supplies the multipart boundary; do not set Content-Type yourself.
    // This multipart POST has no documented idempotency support: never auto-retry it.
    const created = await (await checked(jobs, { method: "POST", headers: auth, body: form })).json();
    jobId = created.job_id;
    if (typeof jobId !== "string" || !jobId) throw new Error("Missing job_id.");
    console.log(`Submitted ${jobId}. To resume, set PYAI_JOB_ID=${jobId}.`);
  }

  for (let attempt = 0; attempt < 450; attempt++) {
    const job = await (await checked(`${jobs}/${encodeURIComponent(jobId)}`, { headers: auth })).json();
    if (job.status === "failed" || job.status === "cancelled") {
      throw new Error(`Job ${jobId} ${job.status}. Inspect its error in your secured backend.`);
    }
    if (job.status === "completed") {
      let result = job.result;
      if (!result && job.result_url) {
        const url = new URL(job.result_url);
        if (url.protocol !== "https:" || url.username || url.password) throw new Error("Invalid result URL.");
        // A signed storage URL needs no API key. Never forward either provider's key.
        result = await (await checked(url.href)).json();
      }
      if (typeof result?.text !== "string" || !result.trace ||
          typeof result.trace.verdict !== "string" ||
          !Number.isInteger(result.trace.n_pii) || result.trace.n_pii < 0 ||
          typeof result.trace.redacted !== "boolean") {
        throw new Error("Completed job is missing a valid Trace result.");
      }
      return { job_id: jobId, ...result };
    }
    if (!["queued", "running"].includes(job.status)) throw new Error("Unknown job status.");
    await pause(2_000);
  }
  throw new Error(`Polling limit reached. Resume with PYAI_JOB_ID=${jobId}; do not resubmit.`);
}

if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
  try {
    const result = await run();
    const output = `trace-result-${Date.now()}.json`;
    await writeFile(output, JSON.stringify(result, null, 2), { mode: 0o600, flag: "wx" });
    console.log(`Saved ${output}. PII matches: ${result.trace.n_pii}.`);
    // result.text is the scanned transcript; result.trace holds verdict/n_pii/redacted.
    // Review coverage: unmatched sensitive data can remain; source audio is not redacted.
  } catch (error) {
    console.error(error.message);
    process.exitCode = 1;
  }
}