@burdenoff/website-sdk 2026.1101.4 → 2026.1102.1

package/README.md

@@ -298,8 +298,9 @@ publishes audio, video or data, and it sends the avatar nothing to say.
       live: {
         site: 'healthybowl',
         load: () => import('@burdenoff/website-sdk/avatar-live'),
-        turnstileSiteKey: TURNSTILE_SITE_KEY,
         manifestVersion: 'hb-en-1', // the version of `suggestedQuestions`
+        // Optional: used only where the server checks for bots (see "The bot check is the server's setting").
+        turnstileSiteKey: TURNSTILE_SITE_KEY,
       },
     }}
   />
@@ -339,7 +340,24 @@ publishes audio, video or data, and it sends the avatar nothing to say.
 - **Needs the panel under an `ExploreChatProvider`.** The live avatar reads the
   provider's conversation. Without a provider, on a shared (read-only)
   conversation, in a locale whose strings have not been reviewed yet (English
-  only, for now), or with an incomplete `live`, the Avatar view stays as it was.
+  only, for now), or with an incomplete `live` (no `site`, `load` or
+  `manifestVersion`, or a `turnstileSiteKey` or `allowTestSiteKey` of the wrong
+  shape), the Avatar view stays as it was.
+- **The bot check is the server's setting (web API contract v1.2, additive).**
+  The availability answer says whether the server checks for bots when a
+  session is created: `"botCheck": {"mode": "off"}` or
+  `{"mode": "turnstile"}`. With `off`, Start loads the room module and creates
+  the session, and nothing else: no Cloudflare script, no widget, no WebCrypto
+  needed and no `x-web-avatar-bot-token` header; the server's own guards and
+  caps decide. With `turnstile`, Start runs the Cloudflare Turnstile check with
+  the page's own `turnstileSiteKey`, as before; without a key the page may use
+  (none, or one of Cloudflare's test keys where `allowTestSiteKey` is `false`)
+  the Avatar view stays as it was. A server older than v1.2 sends no `botCheck`
+  and always checks, so it is read as `turnstile`. Any other `botCheck` (an
+  unknown mode, another field, another shape) leaves the view as it was. So
+  turning the bot check on or off is a server config change: a site needs no
+  new build for it, as long as its build carries a site key for `turnstile` and
+  its CSP allows Cloudflare (below).
 - **One answer: the first, to a suggested question.** The avatar service
   accepts a conversation only when it holds exactly two messages: the first user
   message (a suggested question) and the first assistant answer, completed. The
@@ -356,8 +374,8 @@ publishes audio, video or data, and it sends the avatar nothing to say.
   the conversation has its first answer, a consent card explains what happens
   and links to `/privacy#live-avatar`; with no answer yet, the view asks the
   visitor to choose a suggested question in Chat first. Start runs a
-  Cloudflare Turnstile check (action `avatar_start`), creates the session and
-  joins its room: the video, the captions, an "AI avatar · not a real person"
+  Cloudflare Turnstile check (action `avatar_start`) where the server checks
+  for bots, creates the session and joins its room: the video, the captions, an "AI avatar · not a real person"
   badge, a countdown, Stop and Continue in Chat. Where a browser holds sound
   back (Safari, iOS), a "Tap to turn on sound" button appears. A refusal (busy,
   limits, region, language, paused, a question the avatar cannot read) is one
@@ -379,6 +397,14 @@ publishes audio, video or data, and it sends the avatar nothing to say.
   digest for all of them (the card's title, intro, processing, storage and
   privacy-link lines, each ending with a line feed: 760 bytes, SHA-256
   `2e02b051ceb1163c14bc58fa63a954a12c0d1f2695029a6d4805922d74c793f7`).
+  `web-consent-2026-11-03` is the same card without "When you start,
+  Cloudflare checks for bots.", for a server whose bot check is `off` (716
+  bytes, SHA-256
+  `bb7516df3cf3a910c6ec1623391f859e6c48e7e7d305d4fb333f18d4115da203`).
+  Each version says which bot check its words describe, and the card is shown
+  only where the server's `botCheck` is the same: a server that runs no bot
+  check must name `web-consent-2026-11-03`, and one that checks must name a
+  version that says so, or the view stays as it was.
   `web-consent-2026-10-31` (which names the product, "a suggested Healthy Bowl
   question") and `web-consent-2026-11` stay, unchanged, for servers that still
   name them.
@@ -389,22 +415,24 @@ publishes audio, video or data, and it sends the avatar nothing to say.
   apps-first hand-over, so it does not say which.
 - **Requests.** All three go to the gateway without credentials. The create
   request carries `content-type: application/json`, `idempotency-key` (a UUID
-  v4) and `x-web-avatar-bot-token` (the Turnstile token, which the gateway
-  verifies and does not forward); the availability request and the end request
-  carry no header of the SDK's own. The conversation token is sent in the create
+  v4) and, only where the server checks for bots, `x-web-avatar-bot-token` (the
+  Turnstile token, which the gateway verifies and does not forward); the
+  availability request and the end request carry no header of the SDK's own. The conversation token is sent in the create
   body only. Neither it, nor the session's end secret, nor the room token, nor
   the bot check's token is ever written into the page, the console or storage by
   the live avatar (the chat keeps its own copy of the conversation in
   `localStorage`, as it always has).
-- **Bot-check binding (web API contract v1.1, additive).** The Turnstile widget
+- **Bot-check binding (web API contract v1.1, additive; `turnstile` mode
+  only).** The Turnstile widget
   is rendered with `cData` set to
   `base64url_nopad(SHA-256(UTF-8("boff-web-avatar-cdata/v1\n" + site + "\n" + locale + "\n" + conversationToken + "\n" + messageId)))`,
   made with WebCrypto from the exact values the create body then carries, before
   the widget is rendered, so the gateway can check that the token was minted for
   this request. The action stays `avatar_start`, and nothing else in v1
-  changes. A browser without WebCrypto (a page that is not a secure context)
-  cannot start the live avatar: Start loads neither the room module nor the bot
-  check's script there, and shows the view as it was. Pinned vector: site
+  changes. Where the server checks for bots, a browser without WebCrypto (a
+  page that is not a secure context) cannot start the live avatar: Start loads
+  neither the room module nor the bot check's script there, and shows the view
+  as it was. Pinned vector: site
   `healthybowl`, locale `en`, conversation token
   `ct_vector_0123456789abcdefghijklmnopqrstuvwx`, message id
   `11111111-2222-4333-8444-555555555555` give
@@ -418,7 +446,9 @@ publishes audio, video or data, and it sends the avatar nothing to say.
   preflight.
 - **Your page's headers.** A site with a Content Security Policy must allow:
   - `script-src` and `frame-src`: `https://challenges.cloudflare.com` (the
-    Turnstile bot check);
+    Turnstile bot check). Only needed where the server's bot check is
+    `turnstile`; keep it anyway, so that turning the bot check on later is a
+    server change and not a new release of the site;
   - `connect-src`, the gateway origin (the three requests);
   - `connect-src`, the media room: `wss://<project>.livekit.cloud`. For a
     LiveKit Cloud room the media library also asks
@@ -587,14 +617,23 @@ A site adds these lines.
    usual place whenever the banner is not on screen.
 
 4. **The build env var** `VITE_AVATAR_TURNSTILE_SITE_KEY`: the site's
-   Cloudflare Turnstile site key. `websiteAvatarLive` returns `undefined` (the
-   still picture and "Live avatar coming soon", no live avatar) when it is
-   unset or empty; on alpha (`VITE_DEPLOY_ENV=alpha`) it accepts Cloudflare's
-   always-pass test key `1x00000000000000000000AA` (the alpha gateway runs
-   Turnstile in dummy mode) or a real key; everywhere else, production
-   included, only a real-looking key (`0x…`, letters, digits, `_` and `-`, 18
-   to 64 characters) that is not one of Cloudflare's test keys (`1x…AA`,
-   `2x…AB`, `1x…BB`, `2x…BB`, `3x…FF`, or anything of their shape). Install
+   Cloudflare Turnstile site key, used only where the server checks for bots
+   (its availability's `botCheck` is `turnstile`). The server decides whether
+   the live avatar is offered on the site (its reviewed site list, its pause,
+   its caps) and whether it checks for bots, so the key is no longer the
+   opt-in: when it is unset or empty, `websiteAvatarLive` returns the live
+   config without a key, which runs where the server's bot check is `off` and
+   stays the still picture where it is `turnstile`. On alpha
+   (`VITE_DEPLOY_ENV=alpha`) it accepts Cloudflare's always-pass test key
+   `1x00000000000000000000AA` (the alpha gateway runs Turnstile in dummy mode)
+   or a real key; everywhere else, production included, only a real-looking key
+   (`0x…`, letters, digits, `_` and `-`, 18 to 64 characters) that is not one of
+   Cloudflare's test keys (`1x…AA`, `2x…AB`, `1x…BB`, `2x…BB`, `3x…FF`, or
+   anything of their shape). A key that is set but refused returns `undefined`
+   (the still picture and "Live avatar coming soon"), never a live avatar
+   without it. It also sets `allowTestSiteKey` (true on alpha only), so the
+   view itself refuses a test key on any other build. Pass `enabled: false` to
+   keep the still picture on a build whatever the server offers. Install
    `livekit-client` on the site (see [Live avatar](#live-avatar-opt-in-receive-only)),
    and declare the variable in `vite-env.d.ts`.
    `websiteAvatarLive` trusts `VITE_DEPLOY_ENV`, so a production build must

package/dist/avatar-live-view/index.d.mts

@@ -1,6 +1,6 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { E as ExplorePanelAvatarLive, a as ExploreLocale, A as AvatarConversation } from '../explore-avatar-live-config-BGsGwbcq.mjs';
+import { E as ExplorePanelAvatarLive, a as ExploreLocale, A as AvatarConversation } from '../explore-avatar-live-config-D-hO90-A.mjs';
 import '../types-CndbmBK-.mjs';
 import '../use-explore-chat-zRuoAin6.mjs';
 import '../explore-types-Bb2Ih3d8.mjs';

package/dist/avatar-live-view/index.d.ts

@@ -1,6 +1,6 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { E as ExplorePanelAvatarLive, a as ExploreLocale, A as AvatarConversation } from '../explore-avatar-live-config-B171o1Yo.js';
+import { E as ExplorePanelAvatarLive, a as ExploreLocale, A as AvatarConversation } from '../explore-avatar-live-config-C1ILEcY8.js';
 import '../types-CndbmBK-.js';
 import '../use-explore-chat-DunjG-3p.js';
 import '../explore-types-Bb2Ih3d8.js';

package/dist/avatar-live-view/index.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunk23H4JUL4_js = require('../chunk-23H4JUL4.js');
+var chunkOIQHIGGU_js = require('../chunk-OIQHIGGU.js');
 var chunkO4GS3XPZ_js = require('../chunk-O4GS3XPZ.js');
 var chunkC6OJIHNO_js = require('../chunk-C6OJIHNO.js');
 require('../chunk-ZSTFX7FV.js');
@@ -35,6 +35,20 @@ var AVAILABILITY_REASONS = /* @__PURE__ */ new Map([
   ["busy", "busy"],
   ["limits", "limits"]
 ]);
+var BOT_CHECK_MODES = /* @__PURE__ */ new Set([
+  "off",
+  "turnstile"
+]);
+function readBotCheck(value) {
+  if (value === void 0) return "turnstile";
+  if (!isRecord(value)) return null;
+  const keys = Object.keys(value);
+  const { mode } = value;
+  if (keys.length !== 1 || keys[0] !== "mode" || typeof mode !== "string" || !BOT_CHECK_MODES.has(mode)) {
+    return null;
+  }
+  return mode === "off" ? "off" : "turnstile";
+}
 function readAvailability(status, body) {
   if (status !== 200 || !isRecord(body)) return INERT;
   const { available, reason } = body;
@@ -43,10 +57,14 @@ function readAvailability(status, body) {
   }
   if (reason === "ok") {
     const { consentVersion, maxSessionSeconds } = body;
-    if (available !== true || typeof consentVersion !== "string" || !chunk23H4JUL4_js.isAvatarVersion(consentVersion) || typeof maxSessionSeconds !== "number" || !Number.isInteger(maxSessionSeconds) || maxSessionSeconds < 1) {
+    const botCheck = readBotCheck(body.botCheck);
+    if (available !== true || typeof consentVersion !== "string" || !chunkOIQHIGGU_js.isAvatarVersion(consentVersion) || typeof maxSessionSeconds !== "number" || !Number.isInteger(maxSessionSeconds) || maxSessionSeconds < 1 || botCheck === null) {
       return INERT;
     }
-    return { kind: "available", offer: { consentVersion, maxSessionSeconds } };
+    return {
+      kind: "available",
+      offer: { consentVersion, maxSessionSeconds, botCheck }
+    };
   }
   const meaning = available ? void 0 : AVAILABILITY_REASONS.get(reason);
   return meaning === void 0 || meaning === "inert" ? INERT : { kind: "refused", reason: meaning };
@@ -128,7 +146,7 @@ function deadline(timeoutMs, outer) {
   };
 }
 async function requestAvailability(target) {
-  if (!chunk23H4JUL4_js.isAvatarSite(target.site) || !LOCALE.test(target.locale)) return INERT;
+  if (!chunkOIQHIGGU_js.isAvatarSite(target.site) || !LOCALE.test(target.locale)) return INERT;
   const query = new URLSearchParams({
     site: target.site,
     locale: target.locale
@@ -169,7 +187,7 @@ async function requestCreate(target) {
         ...target.headers,
         "Content-Type": "application/json",
         "Idempotency-Key": target.idempotencyKey,
-        "x-web-avatar-bot-token": target.botToken
+        ...target.botToken === void 0 ? {} : { "x-web-avatar-bot-token": target.botToken }
       },
       body: payload,
       signal: timer.signal
@@ -457,7 +475,8 @@ var CONSENT = /* @__PURE__ */ new Map([
         intro: "This is an AI avatar, not a real person. It reads the assistant's first eligible answer to a suggested question aloud for up to a minute. The answer is AI-generated and can be wrong.",
         processing: "When you start, Cloudflare checks for bots. The answer text goes to Google to create the voice. Your browser connects to LiveKit, which sees your IP address. LiveKit fetches our temporary audio file and passes the voice to Protoface, which makes the avatar video streamed through LiveKit.",
         storage: "Your microphone and camera are not used. We do not record the live session. We temporarily store the generated voice file and keep a record of this consent. The privacy notice explains our safeguards, storage periods and the providers' processing. For people aged eighteen and over.",
-        privacyLink: "How we handle this"
+        privacyLink: "How we handle this",
+        botCheck: "turnstile"
       }
     }
   ],
@@ -471,7 +490,8 @@ var CONSENT = /* @__PURE__ */ new Map([
         intro: "This is an AI avatar, not a real person. It reads the assistant's first eligible answer to a suggested question aloud for up to a minute. The answer is AI-generated and can be wrong.",
         processing: "When you start, Cloudflare checks for bots. The answer text goes to Google to create the voice. Our server sends that voice through LiveKit to Protoface, which makes the avatar video streamed through LiveKit. Your browser connects to LiveKit, which sees your IP address.",
         storage: "Your microphone and camera are not used. We do not record the live session or store the generated voice. We keep a record of this consent. The privacy notice explains our safeguards, storage periods and the providers' processing. For people aged eighteen and over.",
-        privacyLink: "How we handle this"
+        privacyLink: "How we handle this",
+        botCheck: "turnstile"
       }
     }
   ],
@@ -486,13 +506,30 @@ var CONSENT = /* @__PURE__ */ new Map([
         intro: "This is an AI avatar, not a real person. It reads the assistant's first eligible answer to a suggested question aloud for up to a minute. The answer is AI-generated and can be wrong.",
         processing: "When you start, Cloudflare checks for bots. The answer text goes to Google to create the voice. Our server sends that voice through LiveKit to Protoface, which makes the avatar video streamed through LiveKit. Your browser connects to LiveKit, which sees your IP address.",
         storage: "Your microphone and camera are not used. We do not record the live session or store the generated voice. We keep a record of this consent. The privacy notice explains our safeguards, storage periods and the providers' processing. For people aged eighteen and over.",
-        privacyLink: "How we handle this"
+        privacyLink: "How we handle this",
+        botCheck: "turnstile"
+      }
+    }
+  ],
+  [
+    // The words of web-consent-2026-11-02 without "When you start, Cloudflare checks for bots.", for a server that runs
+    // no bot check (its availability's botCheck is `off`). Product-neutral too: one notice and one digest for every site.
+    "web-consent-2026-11-03",
+    {
+      en: {
+        title: "Live AI avatar (beta)",
+        introProduct: null,
+        intro: "This is an AI avatar, not a real person. It reads the assistant's first eligible answer to a suggested question aloud for up to a minute. The answer is AI-generated and can be wrong.",
+        processing: "The answer text goes to Google to create the voice. Our server sends that voice through LiveKit to Protoface, which makes the avatar video streamed through LiveKit. Your browser connects to LiveKit, which sees your IP address.",
+        storage: "Your microphone and camera are not used. We do not record the live session or store the generated voice. We keep a record of this consent. The privacy notice explains our safeguards, storage periods and the providers' processing. For people aged eighteen and over.",
+        privacyLink: "How we handle this",
+        botCheck: "off"
       }
     }
   ]
 ]);
 function avatarConsentCopy(version, locale) {
-  if (!chunk23H4JUL4_js.isAvatarLiveLocaleReviewed(locale)) return null;
+  if (!chunkOIQHIGGU_js.isAvatarLiveLocaleReviewed(locale)) return null;
   return CONSENT.get(version)?.[locale] ?? null;
 }
 
@@ -757,7 +794,11 @@ function AvatarLiveView({
         return;
       }
       const copy = avatarConsentCopy(result.offer.consentVersion, locale2);
-      if (copy === null) {
+      if (copy === null || copy.botCheck !== result.offer.botCheck) {
+        go(INERT2);
+        return;
+      }
+      if (result.offer.botCheck === "turnstile" && chunkOIQHIGGU_js.turnstileSiteKeyOf(live2) === null) {
         go(INERT2);
         return;
       }
@@ -853,11 +894,12 @@ function AvatarLiveView({
     if (current.name !== "consent") return;
     const { live: live2, base: base2, headers: headers2 } = latest.current;
     if (base2 === null) return;
-    if (!canBindBotCheck()) {
+    const { offer, messageId } = current;
+    const siteKey = offer.botCheck === "turnstile" ? chunkOIQHIGGU_js.turnstileSiteKeyOf(live2) : null;
+    if (offer.botCheck === "turnstile" && (siteKey === null || !canBindBotCheck())) {
       go(INERT2);
       return;
     }
-    const { offer, messageId } = current;
     const conversationToken = conversationRef.current?.getConversationToken() ?? null;
     const idempotencyKey = newIdempotencyKey();
     if (conversationToken === null || !isAvatarConversationToken(conversationToken) || idempotencyKey === null) {
@@ -874,31 +916,36 @@ function AvatarLiveView({
     };
     const run = { cancelled: null, turnstile: null };
     startRef.current = run;
-    go({ name: "bot-check", offer, messageId });
     const module = loadModule(live2.load);
-    const turnstile = runTurnstile(
-      botBoxRef.current,
-      live2.turnstileSiteKey,
-      "avatar_start",
-      avatarBotBinding(body2)
-    );
-    run.turnstile = turnstile;
+    let turnstile = null;
+    if (siteKey === null) {
+      go({ name: "creating" });
+    } else {
+      go({ name: "bot-check", offer, messageId });
+      turnstile = runTurnstile(
+        botBoxRef.current,
+        siteKey,
+        "avatar_start",
+        avatarBotBinding(body2)
+      );
+      run.turnstile = turnstile;
+    }
     void (async () => {
       let loaded;
       let botToken;
       try {
-        [loaded, botToken] = await Promise.all([module, turnstile.token]);
+        [loaded, botToken] = await Promise.all([module, turnstile?.token]);
       } catch {
-        turnstile.cancel();
+        turnstile?.cancel();
         if (run.cancelled === null) {
           startRef.current = null;
           go(INERT2);
         }
         return;
       }
-      turnstile.cancel();
+      turnstile?.cancel();
       if (run.cancelled !== null) return;
-      go({ name: "creating" });
+      if (turnstile !== null) go({ name: "creating" });
       const result = await requestCreate({
         base: base2,
         headers: headers2,