@burdenoff/website-sdk 2026.1101.3 → 2026.1102.1

package/README.md

@@ -298,8 +298,9 @@ publishes audio, video or data, and it sends the avatar nothing to say.
       live: {
         site: 'healthybowl',
         load: () => import('@burdenoff/website-sdk/avatar-live'),
-        turnstileSiteKey: TURNSTILE_SITE_KEY,
         manifestVersion: 'hb-en-1', // the version of `suggestedQuestions`
+        // Optional: used only where the server checks for bots (see "The bot check is the server's setting").
+        turnstileSiteKey: TURNSTILE_SITE_KEY,
       },
     }}
   />
@@ -339,7 +340,24 @@ publishes audio, video or data, and it sends the avatar nothing to say.
 - **Needs the panel under an `ExploreChatProvider`.** The live avatar reads the
   provider's conversation. Without a provider, on a shared (read-only)
   conversation, in a locale whose strings have not been reviewed yet (English
-  only, for now), or with an incomplete `live`, the Avatar view stays as it was.
+  only, for now), or with an incomplete `live` (no `site`, `load` or
+  `manifestVersion`, or a `turnstileSiteKey` or `allowTestSiteKey` of the wrong
+  shape), the Avatar view stays as it was.
+- **The bot check is the server's setting (web API contract v1.2, additive).**
+  The availability answer says whether the server checks for bots when a
+  session is created: `"botCheck": {"mode": "off"}` or
+  `{"mode": "turnstile"}`. With `off`, Start loads the room module and creates
+  the session, and nothing else: no Cloudflare script, no widget, no WebCrypto
+  needed and no `x-web-avatar-bot-token` header; the server's own guards and
+  caps decide. With `turnstile`, Start runs the Cloudflare Turnstile check with
+  the page's own `turnstileSiteKey`, as before; without a key the page may use
+  (none, or one of Cloudflare's test keys where `allowTestSiteKey` is `false`)
+  the Avatar view stays as it was. A server older than v1.2 sends no `botCheck`
+  and always checks, so it is read as `turnstile`. Any other `botCheck` (an
+  unknown mode, another field, another shape) leaves the view as it was. So
+  turning the bot check on or off is a server config change: a site needs no
+  new build for it, as long as its build carries a site key for `turnstile` and
+  its CSP allows Cloudflare (below).
 - **One answer: the first, to a suggested question.** The avatar service
   accepts a conversation only when it holds exactly two messages: the first user
   message (a suggested question) and the first assistant answer, completed. The
@@ -356,8 +374,8 @@ publishes audio, video or data, and it sends the avatar nothing to say.
   the conversation has its first answer, a consent card explains what happens
   and links to `/privacy#live-avatar`; with no answer yet, the view asks the
   visitor to choose a suggested question in Chat first. Start runs a
-  Cloudflare Turnstile check (action `avatar_start`), creates the session and
-  joins its room: the video, the captions, an "AI avatar · not a real person"
+  Cloudflare Turnstile check (action `avatar_start`) where the server checks
+  for bots, creates the session and joins its room: the video, the captions, an "AI avatar · not a real person"
   badge, a countdown, Stop and Continue in Chat. Where a browser holds sound
   back (Safari, iOS), a "Tap to turn on sound" button appears. A refusal (busy,
   limits, region, language, paused, a question the avatar cannot read) is one
@@ -379,6 +397,14 @@ publishes audio, video or data, and it sends the avatar nothing to say.
   digest for all of them (the card's title, intro, processing, storage and
   privacy-link lines, each ending with a line feed: 760 bytes, SHA-256
   `2e02b051ceb1163c14bc58fa63a954a12c0d1f2695029a6d4805922d74c793f7`).
+  `web-consent-2026-11-03` is the same card without "When you start,
+  Cloudflare checks for bots.", for a server whose bot check is `off` (716
+  bytes, SHA-256
+  `bb7516df3cf3a910c6ec1623391f859e6c48e7e7d305d4fb333f18d4115da203`).
+  Each version says which bot check its words describe, and the card is shown
+  only where the server's `botCheck` is the same: a server that runs no bot
+  check must name `web-consent-2026-11-03`, and one that checks must name a
+  version that says so, or the view stays as it was.
   `web-consent-2026-10-31` (which names the product, "a suggested Healthy Bowl
   question") and `web-consent-2026-11` stay, unchanged, for servers that still
   name them.
@@ -389,22 +415,24 @@ publishes audio, video or data, and it sends the avatar nothing to say.
   apps-first hand-over, so it does not say which.
 - **Requests.** All three go to the gateway without credentials. The create
   request carries `content-type: application/json`, `idempotency-key` (a UUID
-  v4) and `x-web-avatar-bot-token` (the Turnstile token, which the gateway
-  verifies and does not forward); the availability request and the end request
-  carry no header of the SDK's own. The conversation token is sent in the create
+  v4) and, only where the server checks for bots, `x-web-avatar-bot-token` (the
+  Turnstile token, which the gateway verifies and does not forward); the
+  availability request and the end request carry no header of the SDK's own. The conversation token is sent in the create
   body only. Neither it, nor the session's end secret, nor the room token, nor
   the bot check's token is ever written into the page, the console or storage by
   the live avatar (the chat keeps its own copy of the conversation in
   `localStorage`, as it always has).
-- **Bot-check binding (web API contract v1.1, additive).** The Turnstile widget
+- **Bot-check binding (web API contract v1.1, additive; `turnstile` mode
+  only).** The Turnstile widget
   is rendered with `cData` set to
   `base64url_nopad(SHA-256(UTF-8("boff-web-avatar-cdata/v1\n" + site + "\n" + locale + "\n" + conversationToken + "\n" + messageId)))`,
   made with WebCrypto from the exact values the create body then carries, before
   the widget is rendered, so the gateway can check that the token was minted for
   this request. The action stays `avatar_start`, and nothing else in v1
-  changes. A browser without WebCrypto (a page that is not a secure context)
-  cannot start the live avatar: Start loads neither the room module nor the bot
-  check's script there, and shows the view as it was. Pinned vector: site
+  changes. Where the server checks for bots, a browser without WebCrypto (a
+  page that is not a secure context) cannot start the live avatar: Start loads
+  neither the room module nor the bot check's script there, and shows the view
+  as it was. Pinned vector: site
   `healthybowl`, locale `en`, conversation token
   `ct_vector_0123456789abcdefghijklmnopqrstuvwx`, message id
   `11111111-2222-4333-8444-555555555555` give
@@ -418,7 +446,9 @@ publishes audio, video or data, and it sends the avatar nothing to say.
   preflight.
 - **Your page's headers.** A site with a Content Security Policy must allow:
   - `script-src` and `frame-src`: `https://challenges.cloudflare.com` (the
-    Turnstile bot check);
+    Turnstile bot check). Only needed where the server's bot check is
+    `turnstile`; keep it anyway, so that turning the bot check on later is a
+    server change and not a new release of the site;
   - `connect-src`, the gateway origin (the three requests);
   - `connect-src`, the media room: `wss://<project>.livekit.cloud`. For a
     LiveKit Cloud room the media library also asks
@@ -446,10 +476,200 @@ Testing hooks (`data-boff-explore`): `avatar-live` (with `data-phase`),
 `avatar-live-captions`, `avatar-live-countdown`, `avatar-live-sound`,
 `avatar-live-continue`, `avatar-live-back`, `avatar-live-bot-check`.
 
+#### Site assistant dock (`SiteAssistantDock`, every product site)
+
+`SiteAssistantDock` is the site-wide assistant in one component: the floating
+"Ask AI" button, which opens the assistant panel (`ExplorePanel`) over the
+current page, and that panel, with the site's product scope and its avatar. It
+replaces `<ExploreCta variant="floating" />` in a site's layout. The behaviour
+is HealthyBowl's, as approved there (BOFF-9697, BOFF-9796):
+
+- The button is still a real link to `/explore`: a modified click (new tab) and
+  a visitor without JavaScript reach the page; a plain click opens the compact
+  panel without leaving the page.
+- Expand and Restore keep the same conversation, and so do closing, reopening
+  and going to `/explore` and back: the panel and `/explore` share the
+  provider's one conversation. Nothing is asked of a server until the first
+  opening; the dock starts the provider's conversation then.
+- Escape and the phone's Back go expanded, then compact, then closed, through
+  history entries of the panel's own (the same URL, so the router stays put).
+  Closing stops the microphone and reading aloud, and focus goes back to the
+  button, which carries `aria-controls` and `aria-expanded`.
+- On `/explore` (`explorePath`, matched as the router matches it: ignoring case
+  and a trailing slash) there is no button and the panel hides; an open panel
+  shows again on the way out.
+- The panel keeps `bottomOffset` clear at the bottom of the window, so it never
+  covers the cookie banner's controls, and the floating button sits that much
+  higher (`calc(1.25rem + bottomOffset)`), so the banner does not cover the
+  button before the visitor answers it. Unset, the button is where it always was.
+- One dock, one panel, one conversation: render it once, in the layout every
+  route shares. A second dock mounted while one is there renders nothing, in
+  every build (a development build also logs an error); if the first one
+  unmounts, the second takes over.
+
+It **needs an `ExploreChatProvider` above it**. Without one a development build
+throws `SiteAssistantDock must be rendered under an ExploreChatProvider`, and a
+production build logs that error and renders the plain floating link to
+`/explore` that sites had before the dock.
+
+A site adds these lines.
+
+1. **The provider, at the app root**, inside the router and around the routes.
+   The dock starts it on the first opening, so `enabled` is for `/explore` only:
+
+   ```tsx
+   import { ExploreChatProvider, normalizeRoutePath } from '@burdenoff/website-sdk'
+
+   function SiteShell() {
+     const { pathname, search } = useLocation()
+     const onExplore = normalizeRoutePath(pathname) === '/explore'
+     // A shared conversation is /explore?c=<token> and nothing else.
+     const shareToken = onExplore ? new URLSearchParams(search).get('c') : null
+     const pageUrl =
+       typeof window === 'undefined' ? undefined : new URL(`${pathname}${search}`, window.location.origin).href
+     return (
+       <ExploreChatProvider
+         key={shareToken ?? ''}
+         enabled={onExplore}
+         productSlug={PRODUCT_SLUG}
+         locale={ASSISTANT.locale}
+         pageUrl={pageUrl}
+         shareToken={shareToken}
+       >
+         <AppRoutes />
+       </ExploreChatProvider>
+     )
+   }
+   ```
+
+2. **The config objects** (`src/config/assistant.ts`), built once at module
+   scope so the panel's memoised prompt list is not rebuilt on every render:
+
+   ```ts
+   import { websiteAvatarLive } from '@burdenoff/website-sdk'
+   import manifest from '@/data/avatar-manifest.<site>.en.json'
+
+   export const ASSISTANT = {
+     productSlug: PRODUCT_SLUG,
+     scope: 'product',
+     productName: 'Healthy Bowl', // the brand as a reader sees it
+     examplePrompts: PROBLEMS.map(({ problem }) => problem), // the questions the manifest lists
+     locale: import.meta.env.VITE_DEPLOY_ENV === 'alpha' ? 'en' : undefined,
+   } as const
+
+   export const AVATAR = {
+     src: '/avatar-faces/av_stock_001.webp',
+     live: websiteAvatarLive({
+       deployEnv: import.meta.env.VITE_DEPLOY_ENV,
+       siteKey: import.meta.env.VITE_AVATAR_TURNSTILE_SITE_KEY,
+       site: '<site>', // as the live avatar service knows it: `healthybowl`
+       manifestVersion: manifest.version,
+       load: () => import('@burdenoff/website-sdk/avatar-live'),
+     }),
+   }
+   ```
+
+3. **The dock in the layout**, in place of `<ExploreCta variant="floating" />`:
+
+   ```tsx
+   import { SiteAssistantDock } from '@burdenoff/website-sdk'
+
+   const { pathname } = useLocation()
+   const navigate = useNavigate()
+
+   <SiteAssistantDock
+     {...ASSISTANT}
+     avatar={AVATAR}
+     currentPath={pathname}
+     onNavigate={(path) => navigate(path)}
+     bottomOffset="var(--hb-cookie-banner-height, 0px)" // YOUR banner's variable, see below
+   />
+   ```
+
+   `bottomOffset` must name **the site's own cookie banner's height
+   variable**. The SDK sets no such variable and there is no shared name:
+   HealthyBowl's banner publishes `--hb-cookie-banner-height`, and another
+   site passes whatever its banner publishes. A banner that publishes none
+   leaves the panel and the button under it. We recommend every site's banner
+   publish its height as a CSS variable on `<html>` while it shows, and remove
+   it when it goes:
+
+   ```tsx
+   // In the site's cookie banner component.
+   const bannerRef = useRef<HTMLDivElement>(null)
+   useLayoutEffect(() => {
+     const banner = bannerRef.current
+     if (!banner) return
+     const root = document.documentElement
+     const publish = () =>
+       root.style.setProperty('--<site>-cookie-banner-height', `${banner.offsetHeight}px`)
+     publish()
+     const observer = new ResizeObserver(publish) // wrapping text, a resized window
+     observer.observe(banner)
+     return () => {
+       observer.disconnect()
+       root.style.removeProperty('--<site>-cookie-banner-height') // answered: nothing to keep clear
+     }
+   }, [])
+   ```
+
+   and keep the `, 0px` fallback in `bottomOffset`, so the dock sits at its
+   usual place whenever the banner is not on screen.
+
+4. **The build env var** `VITE_AVATAR_TURNSTILE_SITE_KEY`: the site's
+   Cloudflare Turnstile site key, used only where the server checks for bots
+   (its availability's `botCheck` is `turnstile`). The server decides whether
+   the live avatar is offered on the site (its reviewed site list, its pause,
+   its caps) and whether it checks for bots, so the key is no longer the
+   opt-in: when it is unset or empty, `websiteAvatarLive` returns the live
+   config without a key, which runs where the server's bot check is `off` and
+   stays the still picture where it is `turnstile`. On alpha
+   (`VITE_DEPLOY_ENV=alpha`) it accepts Cloudflare's always-pass test key
+   `1x00000000000000000000AA` (the alpha gateway runs Turnstile in dummy mode)
+   or a real key; everywhere else, production included, only a real-looking key
+   (`0x…`, letters, digits, `_` and `-`, 18 to 64 characters) that is not one of
+   Cloudflare's test keys (`1x…AA`, `2x…AB`, `1x…BB`, `2x…BB`, `3x…FF`, or
+   anything of their shape). A key that is set but refused returns `undefined`
+   (the still picture and "Live avatar coming soon"), never a live avatar
+   without it. It also sets `allowTestSiteKey` (true on alpha only), so the
+   view itself refuses a test key on any other build. Pass `enabled: false` to
+   keep the still picture on a build whatever the server offers. Install
+   `livekit-client` on the site (see [Live avatar](#live-avatar-opt-in-receive-only)),
+   and declare the variable in `vite-env.d.ts`.
+   `websiteAvatarLive` trusts `VITE_DEPLOY_ENV`, so a production build must
+   never be labelled `alpha` (that would let a test key through the check);
+   the production gateway's real Turnstile secret would still reject a test
+   token, so the live avatar would fail to start rather than run unchecked.
+
+5. **The privacy anchor** `/privacy#live-avatar`: the live avatar's consent
+   card links there, so the site's privacy page needs an element with
+   `id="live-avatar"` describing the live avatar.
+
+6. **The still picture** `public/avatar-faces/av_stock_001.webp`: the approved
+   avatar picture the Avatar view shows (and shows instead of the live avatar
+   when it is off), copied from HealthyBowl's website.
+
+**`SiteAssistantDock` props**
+
+| Prop | Default | What it does |
+|---|---|---|
+| `productSlug`, `scope`, `productName`, `examplePrompts`, `locale` | – | Passed to the panel's chat unchanged. See [One product's own assistant](#one-products-own-assistant). |
+| `avatar` | – | `{ src, name?, live? }`: the Avatar view's still picture, and `live` (from `websiteAvatarLive`) to opt in to the live avatar. Absent: no Avatar view. |
+| `onNavigate` | – | The router's navigate, for links in the conversation. |
+| `bottomOffset` | `0px` | A CSS length kept clear at the bottom: the site's own cookie banner's height variable (HealthyBowl: `var(--hb-cookie-banner-height, 0px)`). The panel keeps it clear and the floating button sits that much higher. |
+| `className` | – | Extra classes for the floating button. |
+| `panelClassName` | – | Extra classes for the panel. |
+| `currentPath` | `window.location.pathname` | The router's path. Pass it: the fallback cannot see `pushState` navigations. |
+| `explorePath` | `/explore` | The button's link, the route the dock hides on, and the panel's share links. |
+| `label` | `Ask AI` | The button's label and accessible name. |
+| `id` | `boff-explore-panel` | The panel's id, for the button's `aria-controls`. |
+| `zIndex` | `50` | The panel's `z-index`. |
+
 **`ExploreCta` props**: `variant` (`'header' \| 'mobile' \| 'floating'`, required),
 `href` (default `/explore`), `label` (default `Ask AI`), `className`,
-`onNavigate`, `onClick`, `currentPath`. The `floating` variant hides itself on
-`/explore`. Pass `currentPath` from your router — the fallback
+`onNavigate`, `onClick`, `currentPath`, and, for `floating` only,
+`bottomOffset` (a CSS length to lift the bubble by, as on the dock). The
+`floating` variant hides itself on `/explore`. Pass `currentPath` from your router — the fallback
 (`window.location.pathname` + `popstate`) cannot observe SPA `pushState`
 navigations.
 

package/dist/avatar-live-view/index.d.mts

@@ -1,6 +1,6 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { E as ExplorePanelAvatarLive, a as ExploreLocale, A as AvatarConversation } from '../explore-avatar-live-config-BGsGwbcq.mjs';
+import { E as ExplorePanelAvatarLive, a as ExploreLocale, A as AvatarConversation } from '../explore-avatar-live-config-D-hO90-A.mjs';
 import '../types-CndbmBK-.mjs';
 import '../use-explore-chat-zRuoAin6.mjs';
 import '../explore-types-Bb2Ih3d8.mjs';

package/dist/avatar-live-view/index.d.ts

@@ -1,6 +1,6 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { E as ExplorePanelAvatarLive, a as ExploreLocale, A as AvatarConversation } from '../explore-avatar-live-config-B171o1Yo.js';
+import { E as ExplorePanelAvatarLive, a as ExploreLocale, A as AvatarConversation } from '../explore-avatar-live-config-C1ILEcY8.js';
 import '../types-CndbmBK-.js';
 import '../use-explore-chat-DunjG-3p.js';
 import '../explore-types-Bb2Ih3d8.js';

package/dist/avatar-live-view/index.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunk23H4JUL4_js = require('../chunk-23H4JUL4.js');
+var chunkOIQHIGGU_js = require('../chunk-OIQHIGGU.js');
 var chunkO4GS3XPZ_js = require('../chunk-O4GS3XPZ.js');
 var chunkC6OJIHNO_js = require('../chunk-C6OJIHNO.js');
 require('../chunk-ZSTFX7FV.js');
@@ -35,6 +35,20 @@ var AVAILABILITY_REASONS = /* @__PURE__ */ new Map([
   ["busy", "busy"],
   ["limits", "limits"]
 ]);
+var BOT_CHECK_MODES = /* @__PURE__ */ new Set([
+  "off",
+  "turnstile"
+]);
+function readBotCheck(value) {
+  if (value === void 0) return "turnstile";
+  if (!isRecord(value)) return null;
+  const keys = Object.keys(value);
+  const { mode } = value;
+  if (keys.length !== 1 || keys[0] !== "mode" || typeof mode !== "string" || !BOT_CHECK_MODES.has(mode)) {
+    return null;
+  }
+  return mode === "off" ? "off" : "turnstile";
+}
 function readAvailability(status, body) {
   if (status !== 200 || !isRecord(body)) return INERT;
   const { available, reason } = body;
@@ -43,10 +57,14 @@ function readAvailability(status, body) {
   }
   if (reason === "ok") {
     const { consentVersion, maxSessionSeconds } = body;
-    if (available !== true || typeof consentVersion !== "string" || !chunk23H4JUL4_js.isAvatarVersion(consentVersion) || typeof maxSessionSeconds !== "number" || !Number.isInteger(maxSessionSeconds) || maxSessionSeconds < 1) {
+    const botCheck = readBotCheck(body.botCheck);
+    if (available !== true || typeof consentVersion !== "string" || !chunkOIQHIGGU_js.isAvatarVersion(consentVersion) || typeof maxSessionSeconds !== "number" || !Number.isInteger(maxSessionSeconds) || maxSessionSeconds < 1 || botCheck === null) {
       return INERT;
     }
-    return { kind: "available", offer: { consentVersion, maxSessionSeconds } };
+    return {
+      kind: "available",
+      offer: { consentVersion, maxSessionSeconds, botCheck }
+    };
   }
   const meaning = available ? void 0 : AVAILABILITY_REASONS.get(reason);
   return meaning === void 0 || meaning === "inert" ? INERT : { kind: "refused", reason: meaning };
@@ -128,7 +146,7 @@ function deadline(timeoutMs, outer) {
   };
 }
 async function requestAvailability(target) {
-  if (!chunk23H4JUL4_js.isAvatarSite(target.site) || !LOCALE.test(target.locale)) return INERT;
+  if (!chunkOIQHIGGU_js.isAvatarSite(target.site) || !LOCALE.test(target.locale)) return INERT;
   const query = new URLSearchParams({
     site: target.site,
     locale: target.locale
@@ -169,7 +187,7 @@ async function requestCreate(target) {
         ...target.headers,
         "Content-Type": "application/json",
         "Idempotency-Key": target.idempotencyKey,
-        "x-web-avatar-bot-token": target.botToken
+        ...target.botToken === void 0 ? {} : { "x-web-avatar-bot-token": target.botToken }
       },
       body: payload,
       signal: timer.signal
@@ -457,7 +475,8 @@ var CONSENT = /* @__PURE__ */ new Map([
         intro: "This is an AI avatar, not a real person. It reads the assistant's first eligible answer to a suggested question aloud for up to a minute. The answer is AI-generated and can be wrong.",
         processing: "When you start, Cloudflare checks for bots. The answer text goes to Google to create the voice. Your browser connects to LiveKit, which sees your IP address. LiveKit fetches our temporary audio file and passes the voice to Protoface, which makes the avatar video streamed through LiveKit.",
         storage: "Your microphone and camera are not used. We do not record the live session. We temporarily store the generated voice file and keep a record of this consent. The privacy notice explains our safeguards, storage periods and the providers' processing. For people aged eighteen and over.",
-        privacyLink: "How we handle this"
+        privacyLink: "How we handle this",
+        botCheck: "turnstile"
       }
     }
   ],
@@ -471,7 +490,8 @@ var CONSENT = /* @__PURE__ */ new Map([
         intro: "This is an AI avatar, not a real person. It reads the assistant's first eligible answer to a suggested question aloud for up to a minute. The answer is AI-generated and can be wrong.",
         processing: "When you start, Cloudflare checks for bots. The answer text goes to Google to create the voice. Our server sends that voice through LiveKit to Protoface, which makes the avatar video streamed through LiveKit. Your browser connects to LiveKit, which sees your IP address.",
         storage: "Your microphone and camera are not used. We do not record the live session or store the generated voice. We keep a record of this consent. The privacy notice explains our safeguards, storage periods and the providers' processing. For people aged eighteen and over.",
-        privacyLink: "How we handle this"
+        privacyLink: "How we handle this",
+        botCheck: "turnstile"
       }
     }
   ],
@@ -486,13 +506,30 @@ var CONSENT = /* @__PURE__ */ new Map([
         intro: "This is an AI avatar, not a real person. It reads the assistant's first eligible answer to a suggested question aloud for up to a minute. The answer is AI-generated and can be wrong.",
         processing: "When you start, Cloudflare checks for bots. The answer text goes to Google to create the voice. Our server sends that voice through LiveKit to Protoface, which makes the avatar video streamed through LiveKit. Your browser connects to LiveKit, which sees your IP address.",
         storage: "Your microphone and camera are not used. We do not record the live session or store the generated voice. We keep a record of this consent. The privacy notice explains our safeguards, storage periods and the providers' processing. For people aged eighteen and over.",
-        privacyLink: "How we handle this"
+        privacyLink: "How we handle this",
+        botCheck: "turnstile"
+      }
+    }
+  ],
+  [
+    // The words of web-consent-2026-11-02 without "When you start, Cloudflare checks for bots.", for a server that runs
+    // no bot check (its availability's botCheck is `off`). Product-neutral too: one notice and one digest for every site.
+    "web-consent-2026-11-03",
+    {
+      en: {
+        title: "Live AI avatar (beta)",
+        introProduct: null,
+        intro: "This is an AI avatar, not a real person. It reads the assistant's first eligible answer to a suggested question aloud for up to a minute. The answer is AI-generated and can be wrong.",
+        processing: "The answer text goes to Google to create the voice. Our server sends that voice through LiveKit to Protoface, which makes the avatar video streamed through LiveKit. Your browser connects to LiveKit, which sees your IP address.",
+        storage: "Your microphone and camera are not used. We do not record the live session or store the generated voice. We keep a record of this consent. The privacy notice explains our safeguards, storage periods and the providers' processing. For people aged eighteen and over.",
+        privacyLink: "How we handle this",
+        botCheck: "off"
       }
     }
   ]
 ]);
 function avatarConsentCopy(version, locale) {
-  if (!chunk23H4JUL4_js.isAvatarLiveLocaleReviewed(locale)) return null;
+  if (!chunkOIQHIGGU_js.isAvatarLiveLocaleReviewed(locale)) return null;
   return CONSENT.get(version)?.[locale] ?? null;
 }
 
@@ -757,7 +794,11 @@ function AvatarLiveView({
         return;
       }
       const copy = avatarConsentCopy(result.offer.consentVersion, locale2);
-      if (copy === null) {
+      if (copy === null || copy.botCheck !== result.offer.botCheck) {
+        go(INERT2);
+        return;
+      }
+      if (result.offer.botCheck === "turnstile" && chunkOIQHIGGU_js.turnstileSiteKeyOf(live2) === null) {
         go(INERT2);
         return;
       }
@@ -853,11 +894,12 @@ function AvatarLiveView({
     if (current.name !== "consent") return;
     const { live: live2, base: base2, headers: headers2 } = latest.current;
     if (base2 === null) return;
-    if (!canBindBotCheck()) {
+    const { offer, messageId } = current;
+    const siteKey = offer.botCheck === "turnstile" ? chunkOIQHIGGU_js.turnstileSiteKeyOf(live2) : null;
+    if (offer.botCheck === "turnstile" && (siteKey === null || !canBindBotCheck())) {
       go(INERT2);
       return;
     }
-    const { offer, messageId } = current;
     const conversationToken = conversationRef.current?.getConversationToken() ?? null;
     const idempotencyKey = newIdempotencyKey();
     if (conversationToken === null || !isAvatarConversationToken(conversationToken) || idempotencyKey === null) {
@@ -874,31 +916,36 @@ function AvatarLiveView({
     };
     const run = { cancelled: null, turnstile: null };
     startRef.current = run;
-    go({ name: "bot-check", offer, messageId });
     const module = loadModule(live2.load);
-    const turnstile = runTurnstile(
-      botBoxRef.current,
-      live2.turnstileSiteKey,
-      "avatar_start",
-      avatarBotBinding(body2)
-    );
-    run.turnstile = turnstile;
+    let turnstile = null;
+    if (siteKey === null) {
+      go({ name: "creating" });
+    } else {
+      go({ name: "bot-check", offer, messageId });
+      turnstile = runTurnstile(
+        botBoxRef.current,
+        siteKey,
+        "avatar_start",
+        avatarBotBinding(body2)
+      );
+      run.turnstile = turnstile;
+    }
     void (async () => {
       let loaded;
       let botToken;
       try {
-        [loaded, botToken] = await Promise.all([module, turnstile.token]);
+        [loaded, botToken] = await Promise.all([module, turnstile?.token]);
       } catch {
-        turnstile.cancel();
+        turnstile?.cancel();
         if (run.cancelled === null) {
           startRef.current = null;
           go(INERT2);
         }
         return;
       }
-      turnstile.cancel();
+      turnstile?.cancel();
       if (run.cancelled !== null) return;
-      go({ name: "creating" });
+      if (turnstile !== null) go({ name: "creating" });
       const result = await requestCreate({
         base: base2,
         headers: headers2,