@burdenoff/website-sdk 2026.1031.1 → 2026.1031.3

package/README.md

@@ -339,7 +339,13 @@ publishes audio, video or data, and it sends the avatar nothing to say.
   page unloads. The server ends sessions on its own deadlines as well.
 - **Consent copy is versioned.** The panel shows a consent card only when it
   holds reviewed copy for exactly the version the server names (the current
-  English copy is `web-consent-2026-11`); otherwise the view stays as it was.
+  English copy is `web-consent-2026-10-31`, and `web-consent-2026-11` stays for
+  servers that still name it); otherwise the view stays as it was.
+- **How a session ended.** When the worker leaves, the server closes the room,
+  or the session's time runs out with the room still open, the view says only
+  "The live avatar has ended." (key `finished`). The browser
+  cannot tell the avatar reading to the end from a server-side stop or an
+  apps-first hand-over, so it does not say which.
 - **Requests.** All three go to the gateway without credentials. The create
   request carries `content-type: application/json`, `idempotency-key` (a UUID
   v4) and `x-web-avatar-bot-token` (the Turnstile token, which the gateway

package/dist/analytics/index.d.mts

@@ -24,4 +24,44 @@ interface RybbitAnalyticsProps {
  */
 declare function RybbitAnalytics({ siteId, scriptUrl, enabled, }: RybbitAnalyticsProps): null;
 
-export { RybbitAnalytics, type RybbitAnalyticsProps };
+/**
+ * Website analytics events (Rybbit custom events).
+ *
+ * Product websites load the Rybbit script, which records pageviews on its own.
+ * Funnel facts that are not a pageview (for example a successful waitlist
+ * signup) are sent through `trackWebsiteEvent`, which calls `window.rybbit.event`
+ * when the script is present and does nothing otherwise.
+ *
+ * Privacy rules (BOFF-3167):
+ * - Event names come from the closed `WebsiteEventName` union.
+ * - Properties are short, low-cardinality strings, numbers or booleans. Strings
+ *   longer than `MAX_PROPERTY_LENGTH`, values that look like an email address,
+ *   and any other value type are dropped, so a caller cannot leak an email,
+ *   name or free text into the analytics provider by mistake.
+ * - Tracking never throws: analytics must not break a signup.
+ */
+/** Custom events product websites emit. */
+type WebsiteEventName = "waitlist.signed_up";
+type WebsiteEventPropertyValue = string | number | boolean;
+type WebsiteEventProperties = Record<string, WebsiteEventPropertyValue>;
+declare global {
+    interface Window {
+        /** Set by the Rybbit tracking script (https://app.rybbit.io/api/script.js). */
+        rybbit?: {
+            event?: (name: string, properties?: Record<string, WebsiteEventPropertyValue>) => void;
+        };
+    }
+}
+/** Longest string property value that is forwarded. */
+declare const MAX_PROPERTY_LENGTH = 64;
+/**
+ * Keeps only short, non-identifying primitive values. Exported for tests.
+ */
+declare function sanitizeWebsiteEventProperties(properties: WebsiteEventProperties | undefined): WebsiteEventProperties;
+/**
+ * Sends a custom event to Rybbit when the tracking script is loaded.
+ * Returns true when the event was handed to Rybbit.
+ */
+declare function trackWebsiteEvent(name: WebsiteEventName, properties?: WebsiteEventProperties): boolean;
+
+export { MAX_PROPERTY_LENGTH, RybbitAnalytics, type RybbitAnalyticsProps, type WebsiteEventName, type WebsiteEventProperties, type WebsiteEventPropertyValue, sanitizeWebsiteEventProperties, trackWebsiteEvent };

package/dist/analytics/index.d.ts

@@ -24,4 +24,44 @@ interface RybbitAnalyticsProps {
  */
 declare function RybbitAnalytics({ siteId, scriptUrl, enabled, }: RybbitAnalyticsProps): null;
 
-export { RybbitAnalytics, type RybbitAnalyticsProps };
+/**
+ * Website analytics events (Rybbit custom events).
+ *
+ * Product websites load the Rybbit script, which records pageviews on its own.
+ * Funnel facts that are not a pageview (for example a successful waitlist
+ * signup) are sent through `trackWebsiteEvent`, which calls `window.rybbit.event`
+ * when the script is present and does nothing otherwise.
+ *
+ * Privacy rules (BOFF-3167):
+ * - Event names come from the closed `WebsiteEventName` union.
+ * - Properties are short, low-cardinality strings, numbers or booleans. Strings
+ *   longer than `MAX_PROPERTY_LENGTH`, values that look like an email address,
+ *   and any other value type are dropped, so a caller cannot leak an email,
+ *   name or free text into the analytics provider by mistake.
+ * - Tracking never throws: analytics must not break a signup.
+ */
+/** Custom events product websites emit. */
+type WebsiteEventName = "waitlist.signed_up";
+type WebsiteEventPropertyValue = string | number | boolean;
+type WebsiteEventProperties = Record<string, WebsiteEventPropertyValue>;
+declare global {
+    interface Window {
+        /** Set by the Rybbit tracking script (https://app.rybbit.io/api/script.js). */
+        rybbit?: {
+            event?: (name: string, properties?: Record<string, WebsiteEventPropertyValue>) => void;
+        };
+    }
+}
+/** Longest string property value that is forwarded. */
+declare const MAX_PROPERTY_LENGTH = 64;
+/**
+ * Keeps only short, non-identifying primitive values. Exported for tests.
+ */
+declare function sanitizeWebsiteEventProperties(properties: WebsiteEventProperties | undefined): WebsiteEventProperties;
+/**
+ * Sends a custom event to Rybbit when the tracking script is loaded.
+ * Returns true when the event was handed to Rybbit.
+ */
+declare function trackWebsiteEvent(name: WebsiteEventName, properties?: WebsiteEventProperties): boolean;
+
+export { MAX_PROPERTY_LENGTH, RybbitAnalytics, type RybbitAnalyticsProps, type WebsiteEventName, type WebsiteEventProperties, type WebsiteEventPropertyValue, sanitizeWebsiteEventProperties, trackWebsiteEvent };

package/dist/analytics/index.js

@@ -31,6 +31,46 @@ function RybbitAnalytics({
   return null;
 }
 
+// src/analytics/events.ts
+var MAX_PROPERTY_LENGTH = 64;
+var EMAIL_LIKE = /[^\s@]+@[^\s@]+/;
+function sanitizeWebsiteEventProperties(properties) {
+  const safe = {};
+  if (!properties) return safe;
+  for (const [key, value] of Object.entries(properties)) {
+    if (typeof value === "boolean") {
+      safe[key] = value;
+    } else if (typeof value === "number") {
+      if (Number.isFinite(value)) safe[key] = value;
+    } else if (typeof value === "string") {
+      const trimmed = value.trim();
+      if (trimmed.length > 0 && trimmed.length <= MAX_PROPERTY_LENGTH && !EMAIL_LIKE.test(trimmed)) {
+        safe[key] = trimmed;
+      }
+    }
+  }
+  return safe;
+}
+function trackWebsiteEvent(name, properties) {
+  if (typeof window === "undefined") return false;
+  try {
+    const rybbit = window.rybbit;
+    if (typeof rybbit?.event !== "function") return false;
+    const safe = sanitizeWebsiteEventProperties(properties);
+    if (Object.keys(safe).length > 0) {
+      rybbit.event(name, safe);
+    } else {
+      rybbit.event(name);
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+exports.MAX_PROPERTY_LENGTH = MAX_PROPERTY_LENGTH;
 exports.RybbitAnalytics = RybbitAnalytics;
+exports.sanitizeWebsiteEventProperties = sanitizeWebsiteEventProperties;
+exports.trackWebsiteEvent = trackWebsiteEvent;
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/analytics/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/analytics/rybbit.tsx"],"names":["useEffect"],"mappings":";;;;AAoDO,SAAS,eAAA,CAAgB;AAAA,EAC9B,MAAA;AAAA,EACA,SAAA,GAAY,+CAAA;AAAA,EACZ,OAAA,GAAU;AACZ,CAAA,EAAyB;AACvB,EAAAA,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,OAAA,IAAW,CAAC,MAAA,EAAQ;AAGzB,IAAA,MAAM,iBAAiB,QAAA,CAAS,aAAA;AAAA,MAC9B,wBAAwB,MAAM,CAAA,EAAA;AAAA,KAChC;AACA,IAAA,IAAI,cAAA,EAAgB;AAQpB,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,IAAA,MAAA,CAAO,GAAA,GAAM,SAAA;AACb,IAAA,MAAA,CAAO,KAAA,GAAQ,IAAA;AACf,IAAA,MAAA,CAAO,WAAA,GAAc,WAAA;AACrB,IAAA,MAAA,CAAO,YAAA,CAAa,gBAAgB,MAAM,CAAA;AAC1C,IAAA,QAAA,CAAS,IAAA,CAAK,YAAY,MAAM,CAAA;AAGhC,IAAA,OAAO,MAAM;AACX,MAAA,MAAM,iBAAiB,QAAA,CAAS,aAAA;AAAA,QAC9B,wBAAwB,MAAM,CAAA,EAAA;AAAA,OAChC;AACA,MAAA,IAAI,cAAA,EAAgB;AAClB,QAAA,QAAA,CAAS,IAAA,CAAK,YAAY,cAAc,CAAA;AAAA,MAC1C;AAAA,IACF,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,MAAA,EAAQ,SAAA,EAAW,OAAO,CAAC,CAAA;AAG/B,EAAA,OAAO,IAAA;AACT","file":"index.js","sourcesContent":["/**\n * Rybbit Analytics Component\n *\n * Injects the Rybbit tracking script into the page head.\n * Works with both Vite (CSR) and Next.js (SSR/CSR) applications.\n *\n * @example\n * ```tsx\n * // In your app layout or root component\n * import { RybbitAnalytics } from '@burdenoff/website-sdk/analytics'\n *\n * function App() {\n *   return (\n *     <>\n *       <RybbitAnalytics siteId=\"1\" />\n *       <Router>...</Router>\n *     </>\n *   )\n * }\n * ```\n */\n\"use client\";\n\nimport { useEffect } from \"react\";\n\nexport interface RybbitAnalyticsProps {\n  /**\n   * Rybbit site ID (obtained from the Rybbit dashboard)\n   */\n  siteId: string;\n\n  /**\n   * Rybbit script URL (defaults to the self-hosted instance)\n   * @default \"https://analytics.burdenoff.com/api/script.js\"\n   */\n  scriptUrl?: string;\n\n  /**\n   * Whether to enable tracking (useful for disabling in development)\n   * @default true\n   */\n  enabled?: boolean;\n}\n\n/**\n * RybbitAnalytics - Embeds the Rybbit analytics tracking script.\n *\n * The script is loaded asynchronously with `defer` to avoid blocking page load.\n * It automatically tracks page views and user interactions.\n *\n * In development mode (when `enabled` is false), no script is loaded.\n */\nexport function RybbitAnalytics({\n  siteId,\n  scriptUrl = \"https://analytics.burdenoff.com/api/script.js\",\n  enabled = true,\n}: RybbitAnalyticsProps) {\n  useEffect(() => {\n    if (!enabled || !siteId) return;\n\n    // Check if script already exists\n    const existingScript = document.querySelector(\n      `script[data-site-id=\"${siteId}\"]`,\n    );\n    if (existingScript) return;\n\n    // Create and inject the script. `crossOrigin=\"anonymous\"` puts the\n    // request in CORS-no-credentials mode so the browser does not include\n    // any third-party cookies the visitor may have on the analytics origin\n    // (e.g. `app.rybbit.io`'s own dashboard session cookie). Without this,\n    // Lighthouse `third-party-cookies` audit flags the page even though we\n    // never read those cookies ourselves.\n    const script = document.createElement(\"script\");\n    script.src = scriptUrl;\n    script.defer = true;\n    script.crossOrigin = \"anonymous\";\n    script.setAttribute(\"data-site-id\", siteId);\n    document.head.appendChild(script);\n\n    // Cleanup on unmount\n    return () => {\n      const scriptToRemove = document.querySelector(\n        `script[data-site-id=\"${siteId}\"]`,\n      );\n      if (scriptToRemove) {\n        document.head.removeChild(scriptToRemove);\n      }\n    };\n  }, [siteId, scriptUrl, enabled]);\n\n  // This component renders nothing - it only manages the script tag\n  return null;\n}\n"]}
+{"version":3,"sources":["../../src/analytics/rybbit.tsx","../../src/analytics/events.ts"],"names":["useEffect"],"mappings":";;;;AAoDO,SAAS,eAAA,CAAgB;AAAA,EAC9B,MAAA;AAAA,EACA,SAAA,GAAY,+CAAA;AAAA,EACZ,OAAA,GAAU;AACZ,CAAA,EAAyB;AACvB,EAAAA,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,OAAA,IAAW,CAAC,MAAA,EAAQ;AAGzB,IAAA,MAAM,iBAAiB,QAAA,CAAS,aAAA;AAAA,MAC9B,wBAAwB,MAAM,CAAA,EAAA;AAAA,KAChC;AACA,IAAA,IAAI,cAAA,EAAgB;AAQpB,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,IAAA,MAAA,CAAO,GAAA,GAAM,SAAA;AACb,IAAA,MAAA,CAAO,KAAA,GAAQ,IAAA;AACf,IAAA,MAAA,CAAO,WAAA,GAAc,WAAA;AACrB,IAAA,MAAA,CAAO,YAAA,CAAa,gBAAgB,MAAM,CAAA;AAC1C,IAAA,QAAA,CAAS,IAAA,CAAK,YAAY,MAAM,CAAA;AAGhC,IAAA,OAAO,MAAM;AACX,MAAA,MAAM,iBAAiB,QAAA,CAAS,aAAA;AAAA,QAC9B,wBAAwB,MAAM,CAAA,EAAA;AAAA,OAChC;AACA,MAAA,IAAI,cAAA,EAAgB;AAClB,QAAA,QAAA,CAAS,IAAA,CAAK,YAAY,cAAc,CAAA;AAAA,MAC1C;AAAA,IACF,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,MAAA,EAAQ,SAAA,EAAW,OAAO,CAAC,CAAA;AAG/B,EAAA,OAAO,IAAA;AACT;;;ACvDO,IAAM,mBAAA,GAAsB;AAEnC,IAAM,UAAA,GAAa,iBAAA;AAKZ,SAAS,+BACd,UAAA,EACwB;AACxB,EAAA,MAAM,OAA+B,EAAC;AACtC,EAAA,IAAI,CAAC,YAAY,OAAO,IAAA;AACxB,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,EAAG;AACrD,IAAA,IAAI,OAAO,UAAU,SAAA,EAAW;AAC9B,MAAA,IAAA,CAAK,GAAG,CAAA,GAAI,KAAA;AAAA,IACd,CAAA,MAAA,IAAW,OAAO,KAAA,KAAU,QAAA,EAAU;AACpC,MAAA,IAAI,OAAO,QAAA,CAAS,KAAK,CAAA,EAAG,IAAA,CAAK,GAAG,CAAA,GAAI,KAAA;AAAA,IAC1C,CAAA,MAAA,IAAW,OAAO,KAAA,KAAU,QAAA,EAAU;AACpC,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAK;AAC3B,MAAA,IACE,OAAA,CAAQ,MAAA,GAAS,CAAA,IACjB,OAAA,CAAQ,MAAA,IAAU,uBAClB,CAAC,UAAA,CAAW,IAAA,CAAK,OAAO,CAAA,EACxB;AACA,QAAA,IAAA,CAAK,GAAG,CAAA,GAAI,OAAA;AAAA,MACd;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,iBAAA,CACd,MACA,UAAA,EACS;AACT,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AACtB,IAAA,IAAI,OAAO,MAAA,EAAQ,KAAA,KAAU,UAAA,EAAY,OAAO,KAAA;AAChD,IAAA,MAAM,IAAA,GAAO,+BAA+B,UAAU,CAAA;AACtD,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,SAAS,CAAA,EAAG;AAChC,MAAA,MAAA,CAAO,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,IACzB,CAAA,MAAO;AACL,MAAA,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,IACnB;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAEN,IAAA,OAAO,KAAA;AAAA,EACT;AACF","file":"index.js","sourcesContent":["/**\n * Rybbit Analytics Component\n *\n * Injects the Rybbit tracking script into the page head.\n * Works with both Vite (CSR) and Next.js (SSR/CSR) applications.\n *\n * @example\n * ```tsx\n * // In your app layout or root component\n * import { RybbitAnalytics } from '@burdenoff/website-sdk/analytics'\n *\n * function App() {\n *   return (\n *     <>\n *       <RybbitAnalytics siteId=\"1\" />\n *       <Router>...</Router>\n *     </>\n *   )\n * }\n * ```\n */\n\"use client\";\n\nimport { useEffect } from \"react\";\n\nexport interface RybbitAnalyticsProps {\n  /**\n   * Rybbit site ID (obtained from the Rybbit dashboard)\n   */\n  siteId: string;\n\n  /**\n   * Rybbit script URL (defaults to the self-hosted instance)\n   * @default \"https://analytics.burdenoff.com/api/script.js\"\n   */\n  scriptUrl?: string;\n\n  /**\n   * Whether to enable tracking (useful for disabling in development)\n   * @default true\n   */\n  enabled?: boolean;\n}\n\n/**\n * RybbitAnalytics - Embeds the Rybbit analytics tracking script.\n *\n * The script is loaded asynchronously with `defer` to avoid blocking page load.\n * It automatically tracks page views and user interactions.\n *\n * In development mode (when `enabled` is false), no script is loaded.\n */\nexport function RybbitAnalytics({\n  siteId,\n  scriptUrl = \"https://analytics.burdenoff.com/api/script.js\",\n  enabled = true,\n}: RybbitAnalyticsProps) {\n  useEffect(() => {\n    if (!enabled || !siteId) return;\n\n    // Check if script already exists\n    const existingScript = document.querySelector(\n      `script[data-site-id=\"${siteId}\"]`,\n    );\n    if (existingScript) return;\n\n    // Create and inject the script. `crossOrigin=\"anonymous\"` puts the\n    // request in CORS-no-credentials mode so the browser does not include\n    // any third-party cookies the visitor may have on the analytics origin\n    // (e.g. `app.rybbit.io`'s own dashboard session cookie). Without this,\n    // Lighthouse `third-party-cookies` audit flags the page even though we\n    // never read those cookies ourselves.\n    const script = document.createElement(\"script\");\n    script.src = scriptUrl;\n    script.defer = true;\n    script.crossOrigin = \"anonymous\";\n    script.setAttribute(\"data-site-id\", siteId);\n    document.head.appendChild(script);\n\n    // Cleanup on unmount\n    return () => {\n      const scriptToRemove = document.querySelector(\n        `script[data-site-id=\"${siteId}\"]`,\n      );\n      if (scriptToRemove) {\n        document.head.removeChild(scriptToRemove);\n      }\n    };\n  }, [siteId, scriptUrl, enabled]);\n\n  // This component renders nothing - it only manages the script tag\n  return null;\n}\n","/**\n * Website analytics events (Rybbit custom events).\n *\n * Product websites load the Rybbit script, which records pageviews on its own.\n * Funnel facts that are not a pageview (for example a successful waitlist\n * signup) are sent through `trackWebsiteEvent`, which calls `window.rybbit.event`\n * when the script is present and does nothing otherwise.\n *\n * Privacy rules (BOFF-3167):\n * - Event names come from the closed `WebsiteEventName` union.\n * - Properties are short, low-cardinality strings, numbers or booleans. Strings\n *   longer than `MAX_PROPERTY_LENGTH`, values that look like an email address,\n *   and any other value type are dropped, so a caller cannot leak an email,\n *   name or free text into the analytics provider by mistake.\n * - Tracking never throws: analytics must not break a signup.\n */\n\n/** Custom events product websites emit. */\nexport type WebsiteEventName = \"waitlist.signed_up\";\n\nexport type WebsiteEventPropertyValue = string | number | boolean;\n\nexport type WebsiteEventProperties = Record<string, WebsiteEventPropertyValue>;\n\ndeclare global {\n  interface Window {\n    /** Set by the Rybbit tracking script (https://app.rybbit.io/api/script.js). */\n    rybbit?: {\n      event?: (\n        name: string,\n        properties?: Record<string, WebsiteEventPropertyValue>,\n      ) => void;\n    };\n  }\n}\n\n/** Longest string property value that is forwarded. */\nexport const MAX_PROPERTY_LENGTH = 64;\n\nconst EMAIL_LIKE = /[^\\s@]+@[^\\s@]+/;\n\n/**\n * Keeps only short, non-identifying primitive values. Exported for tests.\n */\nexport function sanitizeWebsiteEventProperties(\n  properties: WebsiteEventProperties | undefined,\n): WebsiteEventProperties {\n  const safe: WebsiteEventProperties = {};\n  if (!properties) return safe;\n  for (const [key, value] of Object.entries(properties)) {\n    if (typeof value === \"boolean\") {\n      safe[key] = value;\n    } else if (typeof value === \"number\") {\n      if (Number.isFinite(value)) safe[key] = value;\n    } else if (typeof value === \"string\") {\n      const trimmed = value.trim();\n      if (\n        trimmed.length > 0 &&\n        trimmed.length <= MAX_PROPERTY_LENGTH &&\n        !EMAIL_LIKE.test(trimmed)\n      ) {\n        safe[key] = trimmed;\n      }\n    }\n  }\n  return safe;\n}\n\n/**\n * Sends a custom event to Rybbit when the tracking script is loaded.\n * Returns true when the event was handed to Rybbit.\n */\nexport function trackWebsiteEvent(\n  name: WebsiteEventName,\n  properties?: WebsiteEventProperties,\n): boolean {\n  if (typeof window === \"undefined\") return false;\n  try {\n    const rybbit = window.rybbit;\n    if (typeof rybbit?.event !== \"function\") return false;\n    const safe = sanitizeWebsiteEventProperties(properties);\n    if (Object.keys(safe).length > 0) {\n      rybbit.event(name, safe);\n    } else {\n      rybbit.event(name);\n    }\n    return true;\n  } catch {\n    // Analytics is best-effort and must never break the page.\n    return false;\n  }\n}\n"]}

package/dist/analytics/index.mjs

@@ -29,6 +29,43 @@ function RybbitAnalytics({
   return null;
 }
 
-export { RybbitAnalytics };
+// src/analytics/events.ts
+var MAX_PROPERTY_LENGTH = 64;
+var EMAIL_LIKE = /[^\s@]+@[^\s@]+/;
+function sanitizeWebsiteEventProperties(properties) {
+  const safe = {};
+  if (!properties) return safe;
+  for (const [key, value] of Object.entries(properties)) {
+    if (typeof value === "boolean") {
+      safe[key] = value;
+    } else if (typeof value === "number") {
+      if (Number.isFinite(value)) safe[key] = value;
+    } else if (typeof value === "string") {
+      const trimmed = value.trim();
+      if (trimmed.length > 0 && trimmed.length <= MAX_PROPERTY_LENGTH && !EMAIL_LIKE.test(trimmed)) {
+        safe[key] = trimmed;
+      }
+    }
+  }
+  return safe;
+}
+function trackWebsiteEvent(name, properties) {
+  if (typeof window === "undefined") return false;
+  try {
+    const rybbit = window.rybbit;
+    if (typeof rybbit?.event !== "function") return false;
+    const safe = sanitizeWebsiteEventProperties(properties);
+    if (Object.keys(safe).length > 0) {
+      rybbit.event(name, safe);
+    } else {
+      rybbit.event(name);
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export { MAX_PROPERTY_LENGTH, RybbitAnalytics, sanitizeWebsiteEventProperties, trackWebsiteEvent };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map

package/dist/analytics/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/analytics/rybbit.tsx"],"names":[],"mappings":";;AAoDO,SAAS,eAAA,CAAgB;AAAA,EAC9B,MAAA;AAAA,EACA,SAAA,GAAY,+CAAA;AAAA,EACZ,OAAA,GAAU;AACZ,CAAA,EAAyB;AACvB,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,OAAA,IAAW,CAAC,MAAA,EAAQ;AAGzB,IAAA,MAAM,iBAAiB,QAAA,CAAS,aAAA;AAAA,MAC9B,wBAAwB,MAAM,CAAA,EAAA;AAAA,KAChC;AACA,IAAA,IAAI,cAAA,EAAgB;AAQpB,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,IAAA,MAAA,CAAO,GAAA,GAAM,SAAA;AACb,IAAA,MAAA,CAAO,KAAA,GAAQ,IAAA;AACf,IAAA,MAAA,CAAO,WAAA,GAAc,WAAA;AACrB,IAAA,MAAA,CAAO,YAAA,CAAa,gBAAgB,MAAM,CAAA;AAC1C,IAAA,QAAA,CAAS,IAAA,CAAK,YAAY,MAAM,CAAA;AAGhC,IAAA,OAAO,MAAM;AACX,MAAA,MAAM,iBAAiB,QAAA,CAAS,aAAA;AAAA,QAC9B,wBAAwB,MAAM,CAAA,EAAA;AAAA,OAChC;AACA,MAAA,IAAI,cAAA,EAAgB;AAClB,QAAA,QAAA,CAAS,IAAA,CAAK,YAAY,cAAc,CAAA;AAAA,MAC1C;AAAA,IACF,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,MAAA,EAAQ,SAAA,EAAW,OAAO,CAAC,CAAA;AAG/B,EAAA,OAAO,IAAA;AACT","file":"index.mjs","sourcesContent":["/**\n * Rybbit Analytics Component\n *\n * Injects the Rybbit tracking script into the page head.\n * Works with both Vite (CSR) and Next.js (SSR/CSR) applications.\n *\n * @example\n * ```tsx\n * // In your app layout or root component\n * import { RybbitAnalytics } from '@burdenoff/website-sdk/analytics'\n *\n * function App() {\n *   return (\n *     <>\n *       <RybbitAnalytics siteId=\"1\" />\n *       <Router>...</Router>\n *     </>\n *   )\n * }\n * ```\n */\n\"use client\";\n\nimport { useEffect } from \"react\";\n\nexport interface RybbitAnalyticsProps {\n  /**\n   * Rybbit site ID (obtained from the Rybbit dashboard)\n   */\n  siteId: string;\n\n  /**\n   * Rybbit script URL (defaults to the self-hosted instance)\n   * @default \"https://analytics.burdenoff.com/api/script.js\"\n   */\n  scriptUrl?: string;\n\n  /**\n   * Whether to enable tracking (useful for disabling in development)\n   * @default true\n   */\n  enabled?: boolean;\n}\n\n/**\n * RybbitAnalytics - Embeds the Rybbit analytics tracking script.\n *\n * The script is loaded asynchronously with `defer` to avoid blocking page load.\n * It automatically tracks page views and user interactions.\n *\n * In development mode (when `enabled` is false), no script is loaded.\n */\nexport function RybbitAnalytics({\n  siteId,\n  scriptUrl = \"https://analytics.burdenoff.com/api/script.js\",\n  enabled = true,\n}: RybbitAnalyticsProps) {\n  useEffect(() => {\n    if (!enabled || !siteId) return;\n\n    // Check if script already exists\n    const existingScript = document.querySelector(\n      `script[data-site-id=\"${siteId}\"]`,\n    );\n    if (existingScript) return;\n\n    // Create and inject the script. `crossOrigin=\"anonymous\"` puts the\n    // request in CORS-no-credentials mode so the browser does not include\n    // any third-party cookies the visitor may have on the analytics origin\n    // (e.g. `app.rybbit.io`'s own dashboard session cookie). Without this,\n    // Lighthouse `third-party-cookies` audit flags the page even though we\n    // never read those cookies ourselves.\n    const script = document.createElement(\"script\");\n    script.src = scriptUrl;\n    script.defer = true;\n    script.crossOrigin = \"anonymous\";\n    script.setAttribute(\"data-site-id\", siteId);\n    document.head.appendChild(script);\n\n    // Cleanup on unmount\n    return () => {\n      const scriptToRemove = document.querySelector(\n        `script[data-site-id=\"${siteId}\"]`,\n      );\n      if (scriptToRemove) {\n        document.head.removeChild(scriptToRemove);\n      }\n    };\n  }, [siteId, scriptUrl, enabled]);\n\n  // This component renders nothing - it only manages the script tag\n  return null;\n}\n"]}
+{"version":3,"sources":["../../src/analytics/rybbit.tsx","../../src/analytics/events.ts"],"names":[],"mappings":";;AAoDO,SAAS,eAAA,CAAgB;AAAA,EAC9B,MAAA;AAAA,EACA,SAAA,GAAY,+CAAA;AAAA,EACZ,OAAA,GAAU;AACZ,CAAA,EAAyB;AACvB,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,OAAA,IAAW,CAAC,MAAA,EAAQ;AAGzB,IAAA,MAAM,iBAAiB,QAAA,CAAS,aAAA;AAAA,MAC9B,wBAAwB,MAAM,CAAA,EAAA;AAAA,KAChC;AACA,IAAA,IAAI,cAAA,EAAgB;AAQpB,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,IAAA,MAAA,CAAO,GAAA,GAAM,SAAA;AACb,IAAA,MAAA,CAAO,KAAA,GAAQ,IAAA;AACf,IAAA,MAAA,CAAO,WAAA,GAAc,WAAA;AACrB,IAAA,MAAA,CAAO,YAAA,CAAa,gBAAgB,MAAM,CAAA;AAC1C,IAAA,QAAA,CAAS,IAAA,CAAK,YAAY,MAAM,CAAA;AAGhC,IAAA,OAAO,MAAM;AACX,MAAA,MAAM,iBAAiB,QAAA,CAAS,aAAA;AAAA,QAC9B,wBAAwB,MAAM,CAAA,EAAA;AAAA,OAChC;AACA,MAAA,IAAI,cAAA,EAAgB;AAClB,QAAA,QAAA,CAAS,IAAA,CAAK,YAAY,cAAc,CAAA;AAAA,MAC1C;AAAA,IACF,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,MAAA,EAAQ,SAAA,EAAW,OAAO,CAAC,CAAA;AAG/B,EAAA,OAAO,IAAA;AACT;;;ACvDO,IAAM,mBAAA,GAAsB;AAEnC,IAAM,UAAA,GAAa,iBAAA;AAKZ,SAAS,+BACd,UAAA,EACwB;AACxB,EAAA,MAAM,OAA+B,EAAC;AACtC,EAAA,IAAI,CAAC,YAAY,OAAO,IAAA;AACxB,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,EAAG;AACrD,IAAA,IAAI,OAAO,UAAU,SAAA,EAAW;AAC9B,MAAA,IAAA,CAAK,GAAG,CAAA,GAAI,KAAA;AAAA,IACd,CAAA,MAAA,IAAW,OAAO,KAAA,KAAU,QAAA,EAAU;AACpC,MAAA,IAAI,OAAO,QAAA,CAAS,KAAK,CAAA,EAAG,IAAA,CAAK,GAAG,CAAA,GAAI,KAAA;AAAA,IAC1C,CAAA,MAAA,IAAW,OAAO,KAAA,KAAU,QAAA,EAAU;AACpC,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAK;AAC3B,MAAA,IACE,OAAA,CAAQ,MAAA,GAAS,CAAA,IACjB,OAAA,CAAQ,MAAA,IAAU,uBAClB,CAAC,UAAA,CAAW,IAAA,CAAK,OAAO,CAAA,EACxB;AACA,QAAA,IAAA,CAAK,GAAG,CAAA,GAAI,OAAA;AAAA,MACd;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,iBAAA,CACd,MACA,UAAA,EACS;AACT,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AACtB,IAAA,IAAI,OAAO,MAAA,EAAQ,KAAA,KAAU,UAAA,EAAY,OAAO,KAAA;AAChD,IAAA,MAAM,IAAA,GAAO,+BAA+B,UAAU,CAAA;AACtD,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,SAAS,CAAA,EAAG;AAChC,MAAA,MAAA,CAAO,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,IACzB,CAAA,MAAO;AACL,MAAA,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,IACnB;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAEN,IAAA,OAAO,KAAA;AAAA,EACT;AACF","file":"index.mjs","sourcesContent":["/**\n * Rybbit Analytics Component\n *\n * Injects the Rybbit tracking script into the page head.\n * Works with both Vite (CSR) and Next.js (SSR/CSR) applications.\n *\n * @example\n * ```tsx\n * // In your app layout or root component\n * import { RybbitAnalytics } from '@burdenoff/website-sdk/analytics'\n *\n * function App() {\n *   return (\n *     <>\n *       <RybbitAnalytics siteId=\"1\" />\n *       <Router>...</Router>\n *     </>\n *   )\n * }\n * ```\n */\n\"use client\";\n\nimport { useEffect } from \"react\";\n\nexport interface RybbitAnalyticsProps {\n  /**\n   * Rybbit site ID (obtained from the Rybbit dashboard)\n   */\n  siteId: string;\n\n  /**\n   * Rybbit script URL (defaults to the self-hosted instance)\n   * @default \"https://analytics.burdenoff.com/api/script.js\"\n   */\n  scriptUrl?: string;\n\n  /**\n   * Whether to enable tracking (useful for disabling in development)\n   * @default true\n   */\n  enabled?: boolean;\n}\n\n/**\n * RybbitAnalytics - Embeds the Rybbit analytics tracking script.\n *\n * The script is loaded asynchronously with `defer` to avoid blocking page load.\n * It automatically tracks page views and user interactions.\n *\n * In development mode (when `enabled` is false), no script is loaded.\n */\nexport function RybbitAnalytics({\n  siteId,\n  scriptUrl = \"https://analytics.burdenoff.com/api/script.js\",\n  enabled = true,\n}: RybbitAnalyticsProps) {\n  useEffect(() => {\n    if (!enabled || !siteId) return;\n\n    // Check if script already exists\n    const existingScript = document.querySelector(\n      `script[data-site-id=\"${siteId}\"]`,\n    );\n    if (existingScript) return;\n\n    // Create and inject the script. `crossOrigin=\"anonymous\"` puts the\n    // request in CORS-no-credentials mode so the browser does not include\n    // any third-party cookies the visitor may have on the analytics origin\n    // (e.g. `app.rybbit.io`'s own dashboard session cookie). Without this,\n    // Lighthouse `third-party-cookies` audit flags the page even though we\n    // never read those cookies ourselves.\n    const script = document.createElement(\"script\");\n    script.src = scriptUrl;\n    script.defer = true;\n    script.crossOrigin = \"anonymous\";\n    script.setAttribute(\"data-site-id\", siteId);\n    document.head.appendChild(script);\n\n    // Cleanup on unmount\n    return () => {\n      const scriptToRemove = document.querySelector(\n        `script[data-site-id=\"${siteId}\"]`,\n      );\n      if (scriptToRemove) {\n        document.head.removeChild(scriptToRemove);\n      }\n    };\n  }, [siteId, scriptUrl, enabled]);\n\n  // This component renders nothing - it only manages the script tag\n  return null;\n}\n","/**\n * Website analytics events (Rybbit custom events).\n *\n * Product websites load the Rybbit script, which records pageviews on its own.\n * Funnel facts that are not a pageview (for example a successful waitlist\n * signup) are sent through `trackWebsiteEvent`, which calls `window.rybbit.event`\n * when the script is present and does nothing otherwise.\n *\n * Privacy rules (BOFF-3167):\n * - Event names come from the closed `WebsiteEventName` union.\n * - Properties are short, low-cardinality strings, numbers or booleans. Strings\n *   longer than `MAX_PROPERTY_LENGTH`, values that look like an email address,\n *   and any other value type are dropped, so a caller cannot leak an email,\n *   name or free text into the analytics provider by mistake.\n * - Tracking never throws: analytics must not break a signup.\n */\n\n/** Custom events product websites emit. */\nexport type WebsiteEventName = \"waitlist.signed_up\";\n\nexport type WebsiteEventPropertyValue = string | number | boolean;\n\nexport type WebsiteEventProperties = Record<string, WebsiteEventPropertyValue>;\n\ndeclare global {\n  interface Window {\n    /** Set by the Rybbit tracking script (https://app.rybbit.io/api/script.js). */\n    rybbit?: {\n      event?: (\n        name: string,\n        properties?: Record<string, WebsiteEventPropertyValue>,\n      ) => void;\n    };\n  }\n}\n\n/** Longest string property value that is forwarded. */\nexport const MAX_PROPERTY_LENGTH = 64;\n\nconst EMAIL_LIKE = /[^\\s@]+@[^\\s@]+/;\n\n/**\n * Keeps only short, non-identifying primitive values. Exported for tests.\n */\nexport function sanitizeWebsiteEventProperties(\n  properties: WebsiteEventProperties | undefined,\n): WebsiteEventProperties {\n  const safe: WebsiteEventProperties = {};\n  if (!properties) return safe;\n  for (const [key, value] of Object.entries(properties)) {\n    if (typeof value === \"boolean\") {\n      safe[key] = value;\n    } else if (typeof value === \"number\") {\n      if (Number.isFinite(value)) safe[key] = value;\n    } else if (typeof value === \"string\") {\n      const trimmed = value.trim();\n      if (\n        trimmed.length > 0 &&\n        trimmed.length <= MAX_PROPERTY_LENGTH &&\n        !EMAIL_LIKE.test(trimmed)\n      ) {\n        safe[key] = trimmed;\n      }\n    }\n  }\n  return safe;\n}\n\n/**\n * Sends a custom event to Rybbit when the tracking script is loaded.\n * Returns true when the event was handed to Rybbit.\n */\nexport function trackWebsiteEvent(\n  name: WebsiteEventName,\n  properties?: WebsiteEventProperties,\n): boolean {\n  if (typeof window === \"undefined\") return false;\n  try {\n    const rybbit = window.rybbit;\n    if (typeof rybbit?.event !== \"function\") return false;\n    const safe = sanitizeWebsiteEventProperties(properties);\n    if (Object.keys(safe).length > 0) {\n      rybbit.event(name, safe);\n    } else {\n      rybbit.event(name);\n    }\n    return true;\n  } catch {\n    // Analytics is best-effort and must never break the page.\n    return false;\n  }\n}\n"]}

package/dist/avatar-live-view/index.js

@@ -269,7 +269,7 @@ var EN = {
   timeLeft: "Time left",
   stop: "Stop",
   tapForSound: "Tap to turn on sound",
-  finished: "The avatar has finished.",
+  finished: "The live avatar has ended.",
   stopped: "You stopped the avatar.",
   failed: "The live avatar couldn't start.",
   interrupted: "The live avatar stopped early.",
@@ -302,7 +302,7 @@ var ZH = {
   timeLeft: "\u5269\u4F59\u65F6\u95F4",
   stop: "\u505C\u6B62",
   tapForSound: "\u70B9\u6309\u4EE5\u5F00\u542F\u58F0\u97F3",
-  finished: "\u865A\u62DF\u5F62\u8C61\u5DF2\u8BB2\u5B8C\u3002",
+  finished: "\u5B9E\u65F6\u865A\u62DF\u5F62\u8C61\u5DF2\u7ED3\u675F\u3002",
   stopped: "\u60A8\u5DF2\u505C\u6B62\u865A\u62DF\u5F62\u8C61\u3002",
   failed: "\u5B9E\u65F6\u865A\u62DF\u5F62\u8C61\u65E0\u6CD5\u542F\u52A8\u3002",
   interrupted: "\u5B9E\u65F6\u865A\u62DF\u5F62\u8C61\u63D0\u524D\u505C\u6B62\u4E86\u3002",
@@ -335,7 +335,7 @@ var HI = {
   timeLeft: "\u092C\u091A\u093E \u0939\u0941\u0906 \u0938\u092E\u092F",
   stop: "\u0930\u094B\u0915\u0947\u0902",
   tapForSound: "\u0906\u0935\u093E\u091C\u093C \u091A\u093E\u0932\u0942 \u0915\u0930\u0928\u0947 \u0915\u0947 \u0932\u093F\u090F \u091F\u0948\u092A \u0915\u0930\u0947\u0902",
-  finished: "\u0905\u0935\u0924\u093E\u0930 \u0928\u0947 \u092A\u0922\u093C\u0928\u093E \u092A\u0942\u0930\u093E \u0915\u0930 \u0932\u093F\u092F\u093E \u0939\u0948\u0964",
+  finished: "\u0932\u093E\u0907\u0935 \u0905\u0935\u0924\u093E\u0930 \u0938\u092E\u093E\u092A\u094D\u0924 \u0939\u094B \u0917\u092F\u093E \u0939\u0948\u0964",
   stopped: "\u0906\u092A\u0928\u0947 \u0905\u0935\u0924\u093E\u0930 \u0915\u094B \u0930\u094B\u0915 \u0926\u093F\u092F\u093E\u0964",
   failed: "\u0932\u093E\u0907\u0935 \u0905\u0935\u0924\u093E\u0930 \u0936\u0941\u0930\u0942 \u0928\u0939\u0940\u0902 \u0939\u094B \u0938\u0915\u093E\u0964",
   interrupted: "\u0932\u093E\u0907\u0935 \u0905\u0935\u0924\u093E\u0930 \u092C\u0940\u091A \u092E\u0947\u0902 \u0939\u0940 \u0930\u0941\u0915 \u0917\u092F\u093E\u0964",
@@ -368,7 +368,7 @@ var ES = {
   timeLeft: "Tiempo restante",
   stop: "Detener",
   tapForSound: "Toca para activar el sonido",
-  finished: "El avatar ha terminado.",
+  finished: "El avatar en vivo ha terminado.",
   stopped: "Has detenido el avatar.",
   failed: "No se pudo iniciar el avatar en vivo.",
   interrupted: "El avatar en vivo se detuvo antes de tiempo.",
@@ -401,7 +401,7 @@ var AR = {
   timeLeft: "\u0627\u0644\u0648\u0642\u062A \u0627\u0644\u0645\u062A\u0628\u0642\u064A",
   stop: "\u0625\u064A\u0642\u0627\u0641",
   tapForSound: "\u0627\u0646\u0642\u0631 \u0644\u062A\u0634\u063A\u064A\u0644 \u0627\u0644\u0635\u0648\u062A",
-  finished: "\u0627\u0646\u062A\u0647\u0649 \u0627\u0644\u0623\u0641\u0627\u062A\u0627\u0631.",
+  finished: "\u0627\u0646\u062A\u0647\u0649 \u0627\u0644\u0623\u0641\u0627\u062A\u0627\u0631 \u0627\u0644\u0645\u0628\u0627\u0634\u0631.",
   stopped: "\u0644\u0642\u062F \u0623\u0648\u0642\u0641\u062A \u0627\u0644\u0623\u0641\u0627\u062A\u0627\u0631.",
   failed: "\u062A\u0639\u0630\u0651\u0631 \u0628\u062F\u0621 \u0627\u0644\u0623\u0641\u0627\u062A\u0627\u0631 \u0627\u0644\u0645\u0628\u0627\u0634\u0631.",
   interrupted: "\u062A\u0648\u0642\u0641 \u0627\u0644\u0623\u0641\u0627\u062A\u0627\u0631 \u0627\u0644\u0645\u0628\u0627\u0634\u0631 \u0642\u0628\u0644 \u0623\u0646 \u064A\u0646\u062A\u0647\u064A.",
@@ -434,7 +434,7 @@ var TA = {
   timeLeft: "\u0BAE\u0BC0\u0BA4\u0BAE\u0BC1\u0BB3\u0BCD\u0BB3 \u0BA8\u0BC7\u0BB0\u0BAE\u0BCD",
   stop: "\u0BA8\u0BBF\u0BB1\u0BC1\u0BA4\u0BCD\u0BA4\u0BC1",
   tapForSound: "\u0B92\u0BB2\u0BBF\u0BAF\u0BC8 \u0B87\u0BAF\u0B95\u0BCD\u0B95\u0BA4\u0BCD \u0BA4\u0B9F\u0BCD\u0B9F\u0BB5\u0BC1\u0BAE\u0BCD",
-  finished: "\u0B85\u0BB5\u0BA4\u0BBE\u0BB0\u0BCD \u0BAA\u0B9F\u0BBF\u0BA4\u0BCD\u0BA4\u0BC1 \u0BAE\u0BC1\u0B9F\u0BBF\u0BA4\u0BCD\u0BA4\u0BA4\u0BC1.",
+  finished: "\u0BA8\u0BC7\u0BB0\u0BB2\u0BC8 \u0B85\u0BB5\u0BA4\u0BBE\u0BB0\u0BCD \u0BAE\u0BC1\u0B9F\u0BBF\u0BB5\u0B9F\u0BC8\u0BA8\u0BCD\u0BA4\u0BA4\u0BC1.",
   stopped: "\u0BA8\u0BC0\u0B99\u0BCD\u0B95\u0BB3\u0BCD \u0B85\u0BB5\u0BA4\u0BBE\u0BB0\u0BC8 \u0BA8\u0BBF\u0BB1\u0BC1\u0BA4\u0BCD\u0BA4\u0BBF\u0BA9\u0BC0\u0BB0\u0BCD\u0B95\u0BB3\u0BCD.",
   failed: "\u0BA8\u0BC7\u0BB0\u0BB2\u0BC8 \u0B85\u0BB5\u0BA4\u0BBE\u0BB0\u0BC8\u0BA4\u0BCD \u0BA4\u0BCA\u0B9F\u0B99\u0BCD\u0B95 \u0BAE\u0BC1\u0B9F\u0BBF\u0BAF\u0BB5\u0BBF\u0BB2\u0BCD\u0BB2\u0BC8.",
   interrupted: "\u0BA8\u0BC7\u0BB0\u0BB2\u0BC8 \u0B85\u0BB5\u0BA4\u0BBE\u0BB0\u0BCD \u0B87\u0B9F\u0BC8\u0BAF\u0BBF\u0BB2\u0BC7\u0BAF\u0BC7 \u0BA8\u0BBF\u0BA9\u0BCD\u0BB1\u0BC1\u0BB5\u0BBF\u0B9F\u0BCD\u0B9F\u0BA4\u0BC1.",
@@ -472,6 +472,20 @@ var CONSENT = /* @__PURE__ */ new Map([
         privacyLink: "How we handle this"
       }
     }
+  ],
+  [
+    // The voice is no longer a stored file: the server holds it in memory and plays it into the LiveKit room for Protoface.
+    "web-consent-2026-10-31",
+    {
+      en: {
+        title: "Live AI avatar (beta)",
+        introProduct: "This is an AI avatar, not a real person. It reads the assistant's first eligible answer to a suggested {product} question aloud for up to a minute. The answer is AI-generated and can be wrong.",
+        intro: "This is an AI avatar, not a real person. It reads the assistant's first eligible answer to a suggested question aloud for up to a minute. The answer is AI-generated and can be wrong.",
+        processing: "When you start, Cloudflare checks for bots. The answer text goes to Google to create the voice. Our server sends that voice through LiveKit to Protoface, which makes the avatar video streamed through LiveKit. Your browser connects to LiveKit, which sees your IP address.",
+        storage: "Your microphone and camera are not used. We do not record the live session or store the generated voice. We keep a record of this consent. The privacy notice explains our safeguards, storage periods and the providers' processing. For people aged eighteen and over.",
+        privacyLink: "How we handle this"
+      }
+    }
   ]
 ]);
 function avatarConsentCopy(version, locale) {