@burdenoff/website-sdk 2026.1101.3 → 2026.1102.1

package/dist/avatar-live-view/index.mjs

@@ -1,4 +1,4 @@
-import { isAvatarSite, isAvatarLiveLocaleReviewed, isAvatarVersion } from '../chunk-BX2USEWF.mjs';
+import { turnstileSiteKeyOf, isAvatarSite, isAvatarLiveLocaleReviewed, isAvatarVersion } from '../chunk-QOHPLTGT.mjs';
 import { fill } from '../chunk-TT3MHN42.mjs';
 import { cn } from '../chunk-R7G6TWIS.mjs';
 import '../chunk-VNS5WDWO.mjs';
@@ -33,6 +33,20 @@ var AVAILABILITY_REASONS = /* @__PURE__ */ new Map([
   ["busy", "busy"],
   ["limits", "limits"]
 ]);
+var BOT_CHECK_MODES = /* @__PURE__ */ new Set([
+  "off",
+  "turnstile"
+]);
+function readBotCheck(value) {
+  if (value === void 0) return "turnstile";
+  if (!isRecord(value)) return null;
+  const keys = Object.keys(value);
+  const { mode } = value;
+  if (keys.length !== 1 || keys[0] !== "mode" || typeof mode !== "string" || !BOT_CHECK_MODES.has(mode)) {
+    return null;
+  }
+  return mode === "off" ? "off" : "turnstile";
+}
 function readAvailability(status, body) {
   if (status !== 200 || !isRecord(body)) return INERT;
   const { available, reason } = body;
@@ -41,10 +55,14 @@ function readAvailability(status, body) {
   }
   if (reason === "ok") {
     const { consentVersion, maxSessionSeconds } = body;
-    if (available !== true || typeof consentVersion !== "string" || !isAvatarVersion(consentVersion) || typeof maxSessionSeconds !== "number" || !Number.isInteger(maxSessionSeconds) || maxSessionSeconds < 1) {
+    const botCheck = readBotCheck(body.botCheck);
+    if (available !== true || typeof consentVersion !== "string" || !isAvatarVersion(consentVersion) || typeof maxSessionSeconds !== "number" || !Number.isInteger(maxSessionSeconds) || maxSessionSeconds < 1 || botCheck === null) {
       return INERT;
     }
-    return { kind: "available", offer: { consentVersion, maxSessionSeconds } };
+    return {
+      kind: "available",
+      offer: { consentVersion, maxSessionSeconds, botCheck }
+    };
   }
   const meaning = available ? void 0 : AVAILABILITY_REASONS.get(reason);
   return meaning === void 0 || meaning === "inert" ? INERT : { kind: "refused", reason: meaning };
@@ -167,7 +185,7 @@ async function requestCreate(target) {
         ...target.headers,
         "Content-Type": "application/json",
         "Idempotency-Key": target.idempotencyKey,
-        "x-web-avatar-bot-token": target.botToken
+        ...target.botToken === void 0 ? {} : { "x-web-avatar-bot-token": target.botToken }
       },
       body: payload,
       signal: timer.signal
@@ -455,7 +473,8 @@ var CONSENT = /* @__PURE__ */ new Map([
         intro: "This is an AI avatar, not a real person. It reads the assistant's first eligible answer to a suggested question aloud for up to a minute. The answer is AI-generated and can be wrong.",
         processing: "When you start, Cloudflare checks for bots. The answer text goes to Google to create the voice. Your browser connects to LiveKit, which sees your IP address. LiveKit fetches our temporary audio file and passes the voice to Protoface, which makes the avatar video streamed through LiveKit.",
         storage: "Your microphone and camera are not used. We do not record the live session. We temporarily store the generated voice file and keep a record of this consent. The privacy notice explains our safeguards, storage periods and the providers' processing. For people aged eighteen and over.",
-        privacyLink: "How we handle this"
+        privacyLink: "How we handle this",
+        botCheck: "turnstile"
       }
     }
   ],
@@ -469,7 +488,8 @@ var CONSENT = /* @__PURE__ */ new Map([
         intro: "This is an AI avatar, not a real person. It reads the assistant's first eligible answer to a suggested question aloud for up to a minute. The answer is AI-generated and can be wrong.",
         processing: "When you start, Cloudflare checks for bots. The answer text goes to Google to create the voice. Our server sends that voice through LiveKit to Protoface, which makes the avatar video streamed through LiveKit. Your browser connects to LiveKit, which sees your IP address.",
         storage: "Your microphone and camera are not used. We do not record the live session or store the generated voice. We keep a record of this consent. The privacy notice explains our safeguards, storage periods and the providers' processing. For people aged eighteen and over.",
-        privacyLink: "How we handle this"
+        privacyLink: "How we handle this",
+        botCheck: "turnstile"
       }
     }
   ],
@@ -484,7 +504,24 @@ var CONSENT = /* @__PURE__ */ new Map([
         intro: "This is an AI avatar, not a real person. It reads the assistant's first eligible answer to a suggested question aloud for up to a minute. The answer is AI-generated and can be wrong.",
         processing: "When you start, Cloudflare checks for bots. The answer text goes to Google to create the voice. Our server sends that voice through LiveKit to Protoface, which makes the avatar video streamed through LiveKit. Your browser connects to LiveKit, which sees your IP address.",
         storage: "Your microphone and camera are not used. We do not record the live session or store the generated voice. We keep a record of this consent. The privacy notice explains our safeguards, storage periods and the providers' processing. For people aged eighteen and over.",
-        privacyLink: "How we handle this"
+        privacyLink: "How we handle this",
+        botCheck: "turnstile"
+      }
+    }
+  ],
+  [
+    // The words of web-consent-2026-11-02 without "When you start, Cloudflare checks for bots.", for a server that runs
+    // no bot check (its availability's botCheck is `off`). Product-neutral too: one notice and one digest for every site.
+    "web-consent-2026-11-03",
+    {
+      en: {
+        title: "Live AI avatar (beta)",
+        introProduct: null,
+        intro: "This is an AI avatar, not a real person. It reads the assistant's first eligible answer to a suggested question aloud for up to a minute. The answer is AI-generated and can be wrong.",
+        processing: "The answer text goes to Google to create the voice. Our server sends that voice through LiveKit to Protoface, which makes the avatar video streamed through LiveKit. Your browser connects to LiveKit, which sees your IP address.",
+        storage: "Your microphone and camera are not used. We do not record the live session or store the generated voice. We keep a record of this consent. The privacy notice explains our safeguards, storage periods and the providers' processing. For people aged eighteen and over.",
+        privacyLink: "How we handle this",
+        botCheck: "off"
       }
     }
   ]
@@ -755,7 +792,11 @@ function AvatarLiveView({
         return;
       }
       const copy = avatarConsentCopy(result.offer.consentVersion, locale2);
-      if (copy === null) {
+      if (copy === null || copy.botCheck !== result.offer.botCheck) {
+        go(INERT2);
+        return;
+      }
+      if (result.offer.botCheck === "turnstile" && turnstileSiteKeyOf(live2) === null) {
         go(INERT2);
         return;
       }
@@ -851,11 +892,12 @@ function AvatarLiveView({
     if (current.name !== "consent") return;
     const { live: live2, base: base2, headers: headers2 } = latest.current;
     if (base2 === null) return;
-    if (!canBindBotCheck()) {
+    const { offer, messageId } = current;
+    const siteKey = offer.botCheck === "turnstile" ? turnstileSiteKeyOf(live2) : null;
+    if (offer.botCheck === "turnstile" && (siteKey === null || !canBindBotCheck())) {
       go(INERT2);
       return;
     }
-    const { offer, messageId } = current;
     const conversationToken = conversationRef.current?.getConversationToken() ?? null;
     const idempotencyKey = newIdempotencyKey();
     if (conversationToken === null || !isAvatarConversationToken(conversationToken) || idempotencyKey === null) {
@@ -872,31 +914,36 @@ function AvatarLiveView({
     };
     const run = { cancelled: null, turnstile: null };
     startRef.current = run;
-    go({ name: "bot-check", offer, messageId });
     const module = loadModule(live2.load);
-    const turnstile = runTurnstile(
-      botBoxRef.current,
-      live2.turnstileSiteKey,
-      "avatar_start",
-      avatarBotBinding(body2)
-    );
-    run.turnstile = turnstile;
+    let turnstile = null;
+    if (siteKey === null) {
+      go({ name: "creating" });
+    } else {
+      go({ name: "bot-check", offer, messageId });
+      turnstile = runTurnstile(
+        botBoxRef.current,
+        siteKey,
+        "avatar_start",
+        avatarBotBinding(body2)
+      );
+      run.turnstile = turnstile;
+    }
     void (async () => {
       let loaded;
       let botToken;
       try {
-        [loaded, botToken] = await Promise.all([module, turnstile.token]);
+        [loaded, botToken] = await Promise.all([module, turnstile?.token]);
       } catch {
-        turnstile.cancel();
+        turnstile?.cancel();
         if (run.cancelled === null) {
           startRef.current = null;
           go(INERT2);
         }
         return;
       }
-      turnstile.cancel();
+      turnstile?.cancel();
       if (run.cancelled !== null) return;
-      go({ name: "creating" });
+      if (turnstile !== null) go({ name: "creating" });
       const result = await requestCreate({
         base: base2,
         headers: headers2,