@burdenoff/website-sdk 2026.1104.4 → 2026.1105.2

package/dist/{types-CXqaLlNB.d.mts → types-CTUJNvQu.d.mts}

@@ -38,6 +38,16 @@ type ReceiveOnlyEvent =
  | {
     type: "speech-ended";
 }
+/**
+ * Whether the avatar worker's voice is heard now, as the room server reports its active speakers (BOFF-9797 Stage D):
+ * told each time it changes. The server reports a speaker only to its subscribers, which this viewer is for the worker,
+ * and a pause between sentences reports it quiet too. A session that reads several answers keeps the server's speaker
+ * in the room between them, so the end of each answer is told by this and not by `speech-ended`.
+ */
+ | {
+    type: "speaking";
+    speaking: boolean;
+}
 /**
  * The room connection closed without the panel asking. `byServer` when the server closed it (the room was deleted
  * or closed, or this viewer removed); otherwise the connection was lost.

package/dist/{types-CXqaLlNB.d.ts → types-CTUJNvQu.d.ts}

@@ -38,6 +38,16 @@ type ReceiveOnlyEvent =
  | {
     type: "speech-ended";
 }
+/**
+ * Whether the avatar worker's voice is heard now, as the room server reports its active speakers (BOFF-9797 Stage D):
+ * told each time it changes. The server reports a speaker only to its subscribers, which this viewer is for the worker,
+ * and a pause between sentences reports it quiet too. A session that reads several answers keeps the server's speaker
+ * in the room between them, so the end of each answer is told by this and not by `speech-ended`.
+ */
+ | {
+    type: "speaking";
+    speaking: boolean;
+}
 /**
  * The room connection closed without the panel asking. `byServer` when the server closed it (the room was deleted
  * or closed, or this viewer removed); otherwise the connection was lost.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/website-sdk",
-  "version": "2026.1104.4",
+  "version": "2026.1105.2",
   "description": "Shared SDK for Burdenoff product websites - reusable React components, utilities, and configurations",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",

package/dist/chunk-7MSB3EUI.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/components/explore-avatar-live-config.ts"],"names":[],"mappings":";AAgFO,IAAM,mBAAA,GAAsB,oBAAA;AAEnC,IAAM,IAAA,GAAO,wBAAA;AACb,IAAM,OAAA,GAAU,wBAAA;AAChB,IAAM,QAAA,GAAW,wBAAA;AAKjB,IAAM,aAAA,GAAgB,wBAAA;AAMtB,IAAM,aAAA,GAAgB,0BAAA;AACtB,IAAM,iCAAiB,IAAI,GAAA,CAAI,CAAC,WAAA,EAAa,WAAA,EAAa,OAAO,CAAC,CAAA;AAG3D,SAAS,aAAa,KAAA,EAAwB;AACnD,EAAA,OAAO,IAAA,CAAK,KAAK,KAAK,CAAA;AACxB;AAGO,SAAS,gBAAgB,KAAA,EAAwB;AACtD,EAAA,OAAO,OAAA,CAAQ,KAAK,KAAK,CAAA;AAC3B;AAOO,SAAS,cAAc,UAAA,EAA+C;AAC3E,EAAA,IAAI,CAAC,YAAY,OAAO,IAAA;AACxB,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,UAAU,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,KAAA,GACJ,IAAI,QAAA,KAAa,OAAA,IAAW,eAAe,GAAA,CAAI,GAAA,CAAI,QAAA,CAAS,WAAA,EAAa,CAAA;AAC3E,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,QAAA,IAAY,CAAC,OAAO,OAAO,IAAA;AAChD,EAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,mBAAmB,CAAA,CAAA;AAC5C;AAGO,SAAS,uBAAuB,GAAA,EAAsB;AAC3D,EAAA,OAAO,cAAc,IAAA,CAAK,GAAG,KAAK,CAAC,aAAA,CAAc,KAAK,GAAG,CAAA;AAC3D;AAMO,SAAS,mBAAmB,IAAA,EAAuC;AACxE,EAAA,MAAM,MAAe,IAAA,CAAK,gBAAA;AAC1B,EAAA,MAAM,YAAqB,IAAA,CAAK,gBAAA;AAChC,EAAA,MAAM,gBAAyB,IAAA,CAAK,aAAA;AACpC,EAAA,OACE,OAAO,IAAA,CAAK,IAAA,KAAS,UAAA,IACrB,OAAO,KAAK,IAAA,KAAS,QAAA,IACrB,YAAA,CAAa,IAAA,CAAK,IAAI,CAAA,IACtB,OAAO,KAAK,eAAA,KAAoB,QAAA,IAChC,gBAAgB,IAAA,CAAK,eAAe,CAAA,KACnC,GAAA,KAAQ,UACP,GAAA,KAAQ,EAAA,IACP,OAAO,GAAA,KAAQ,QAAA,IAAY,SAAS,IAAA,CAAK,GAAG,CAAA,CAAA,KAC9C,SAAA,KAAc,UAAa,OAAO,SAAA,KAAc,eAChD,aAAA,KAAkB,MAAA,IAAa,OAAO,aAAA,KAAkB,SAAA,CAAA;AAE7D;AAMO,SAAS,mBACd,IAAA,EACe;AACf,EAAA,MAAM,MAAM,IAAA,CAAK,gBAAA;AACjB,EAAA,IAAI,OAAO,QAAQ,QAAA,IAAY,CAAC,SAAS,IAAA,CAAK,GAAG,GAAG,OAAO,IAAA;AAC3D,EAAA,IAAI,KAAK,gBAAA,KAAqB,KAAA,IAAS,CAAC,sBAAA,CAAuB,GAAG,CAAA,EAAG;AACnE,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,GAAA;AACT;AAMA,IAAM,QAAA,mBAAuC,IAAI,GAAA,CAAmB,CAAC,IAAI,CAAC,CAAA;AAGnE,SAAS,2BAA2B,MAAA,EAAgC;AACzE,EAAA,OAAO,QAAA,CAAS,IAAI,MAAM,CAAA;AAC5B","file":"chunk-7MSB3EUI.mjs","sourcesContent":["/**\n * BOFF-9797. The small part of the live avatar that the panel itself needs, whether or not it is ever opened: what a\n * host's `avatar.live` is, whether the live avatar can run on this page at all, and where its requests go.\n *\n * Everything else (the view, its state machine, the requests, the words, the bot check) is a separate chunk that a\n * site only downloads when its visitor first opens the Avatar view (see `explore-avatar-live.tsx`). That is why this\n * file is separate and kept to a few lines: it is the only part of the live avatar in the package root for a site that\n * does not pass `avatar.live`, and the part of it that decides, without loading anything, whether the chunk is wanted.\n * Types only, plus plain functions: nothing here imports a component, a context or a string table.\n */\nimport type { ExploreLocale } from \"./explore-i18n\";\nimport type { AvatarLiveModule } from \"../avatar-live/types\";\nimport type { UseExploreChatResult } from \"../hooks/use-explore-chat\";\n\n/**\n * BOFF-9797. A host's opt-in to the live avatar on its panel's Avatar tab. `site`, `load` and `manifestVersion` are\n * required; a config that is incomplete, or has an optional field of the wrong shape, leaves the tab as it was (and a\n * warning in the console).\n */\nexport interface ExplorePanelAvatarLive {\n  /** The site, as the live avatar service knows it: `healthybowl`. */\n  site: string;\n  /**\n   * Loads the live avatar's room module: `() => import('@burdenoff/website-sdk/avatar-live')`. Called only after the\n   * visitor presses Start on the consent card, never on page load or on opening the tab. That entry needs the\n   * package's optional peer dependency for media rooms (see the README).\n   */\n  load: () => Promise<AvatarLiveModule>;\n  /**\n   * The site's Cloudflare Turnstile site key, for the bot check that runs when the visitor presses Start. Used only when\n   * the server says it checks for bots (its availability's `botCheck`, contract v1.2), or says nothing of it (a server\n   * older than v1.2, which always checks): such a server's live avatar then needs a key, and without one the tab stays\n   * as it was. A server that runs no bot check needs none, and no Cloudflare script is loaded for it, key or not.\n   */\n  turnstileSiteKey?: string;\n  /**\n   * Whether `turnstileSiteKey` may be one of Cloudflare's test keys (`1x00000000000000000000AA` and keys of their\n   * shape). `websiteAvatarLive` sets it: true on alpha only, false everywhere else, so a production page never runs a\n   * test widget. Unset (a config made by hand): any key of a valid shape, as before.\n   */\n  allowTestSiteKey?: boolean;\n  /** The version of the suggested-question list the panel shows (its `examplePrompts`), such as `hb-en-1`. */\n  manifestVersion: string;\n  /**\n   * End a session nobody is attending to (BOFF-9797 stage A). A session keeps playing behind the Chat tab and on a\n   * hidden page, so the answer under way is heard to its end; with this set, out of sight it also ends:\n   *\n   * - **once its answer has played out**, at once: the idle tail after an answer runs only while the Avatar view is in\n   *   sight (the shared lifecycle rule; see `AvatarLiveView`'s `attend`);\n   * - **when the browser holds its sound back** (autoplay refused, or the audio context suspended), after a short grace:\n   *   the \"Tap to turn on sound\" button that would let it play is out of sight, so nobody hears it.\n   *\n   * Both end it with reason `user`. Unset or false: such a session plays on to the end the server planned for it, as\n   * before.\n   */\n  endUnattended?: boolean;\n}\n\n/**\n * What the live avatar reads of the panel's conversation: the transcript, whether it is read-only and the token, and\n * `reset` (the chat's own New chat) for its New chat button where the conversation can never be read. Where the server\n * reads typed questions too (contract v1.3), the Avatar tab's own question box asks through the same conversation:\n * `send` (with `surface: \"AVATAR\"`), and `canSend`, `phase`, `activity` and `catalog` to say when it can and what the\n * answer is doing, and `resent` to follow a question asked there that Chat's Retry sent again.\n */\nexport type AvatarConversation = Pick<\n  UseExploreChatResult,\n  | \"messages\"\n  | \"isSharedView\"\n  | \"getConversationToken\"\n  | \"reset\"\n  | \"send\"\n  | \"canSend\"\n  | \"phase\"\n  | \"activity\"\n  | \"catalog\"\n  | \"resent\"\n>;\n\n/** The web branch's routes, under the gateway's origin. */\nexport const AVATAR_WEB_API_PATH = \"/api/web-avatar/v1\";\n\nconst SITE = /^[a-z][a-z0-9-]{1,31}$/;\nconst VERSION = /^[A-Za-z0-9._-]{1,32}$/;\nconst SITE_KEY = /^[A-Za-z0-9_-]{1,128}$/;\n/**\n * The shape of Cloudflare's dummy site keys: a digit, `x`, a run of zeros and two letters (`1x00000000000000000000AA`,\n * `2x00000000000000000000AB`, `3x00000000000000000000FF`, …). Also catches an all-zero `0x…` placeholder.\n */\nconst TEST_SITE_KEY = /^\\dx0{16,}[A-Za-z]{2}$/;\n/**\n * A real-looking site key. Cloudflare documents no format for real keys; every key it issues starts `0x` (in practice\n * `0x4AAAAAAA…`, about 24 characters), in letters, digits, `_` and `-`. The length is kept loose (18 to 64 in all) so a\n * longer key Cloudflare might issue later still passes, and the charset matches what the panel accepts.\n */\nconst REAL_SITE_KEY = /^0x[A-Za-z0-9_-]{16,62}$/;\nconst LOOPBACK_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"[::1]\"]);\n\n/** A site slug the contract accepts (`healthybowl`). */\nexport function isAvatarSite(value: string): boolean {\n  return SITE.test(value);\n}\n\n/** A consent or manifest version the contract accepts (`hb-en-1`). */\nexport function isAvatarVersion(value: string): boolean {\n  return VERSION.test(value);\n}\n\n/**\n * The web branch's base URL on the SDK's configured gateway: the gateway URL's origin, plus\n * {@link AVATAR_WEB_API_PATH}. Null for anything that is not an `https:` URL (or `http:` on this machine, for local\n * development).\n */\nexport function avatarApiBase(gatewayUrl: string | undefined): string | null {\n  if (!gatewayUrl) return null;\n  let url: URL;\n  try {\n    url = new URL(gatewayUrl);\n  } catch {\n    return null;\n  }\n  const local =\n    url.protocol === \"http:\" && LOOPBACK_HOSTS.has(url.hostname.toLowerCase());\n  if (url.protocol !== \"https:\" && !local) return null;\n  return `${url.origin}${AVATAR_WEB_API_PATH}`;\n}\n\n/** A real-looking Turnstile site key: `0x…`, and not of the shape of Cloudflare's test keys. */\nexport function isRealTurnstileSiteKey(key: string): boolean {\n  return REAL_SITE_KEY.test(key) && !TEST_SITE_KEY.test(key);\n}\n\n/**\n * Whether a host's `avatar.live` has everything the live avatar needs, in the shapes the contract accepts. The site\n * key is optional (an empty one is none), and checked only when it is there.\n */\nexport function liveConfigComplete(live: ExplorePanelAvatarLive): boolean {\n  const key: unknown = live.turnstileSiteKey;\n  const allowTest: unknown = live.allowTestSiteKey;\n  const endUnattended: unknown = live.endUnattended;\n  return (\n    typeof live.load === \"function\" &&\n    typeof live.site === \"string\" &&\n    isAvatarSite(live.site) &&\n    typeof live.manifestVersion === \"string\" &&\n    isAvatarVersion(live.manifestVersion) &&\n    (key === undefined ||\n      key === \"\" ||\n      (typeof key === \"string\" && SITE_KEY.test(key))) &&\n    (allowTest === undefined || typeof allowTest === \"boolean\") &&\n    (endUnattended === undefined || typeof endUnattended === \"boolean\")\n  );\n}\n\n/**\n * The site key a bot check at Start may use, or null when there is none: no key, one of no valid shape, or one of\n * Cloudflare's test keys where `allowTestSiteKey` is false.\n */\nexport function turnstileSiteKeyOf(\n  live: ExplorePanelAvatarLive,\n): string | null {\n  const key = live.turnstileSiteKey;\n  if (typeof key !== \"string\" || !SITE_KEY.test(key)) return null;\n  if (live.allowTestSiteKey === false && !isRealTurnstileSiteKey(key)) {\n    return null;\n  }\n  return key;\n}\n\n/**\n * The locales whose live-avatar strings have been reviewed. The live avatar runs only in these; see\n * `explore-avatar-i18n.ts`. English only, until a named reviewer signs off on another.\n */\nconst REVIEWED: ReadonlySet<ExploreLocale> = new Set<ExploreLocale>([\"en\"]);\n\n/** Whether the live avatar may run in `locale`: its strings have been reviewed. */\nexport function isAvatarLiveLocaleReviewed(locale: ExploreLocale): boolean {\n  return REVIEWED.has(locale);\n}\n"]}

package/dist/chunk-WSEQ2I6I.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/components/explore-avatar-live-config.ts"],"names":[],"mappings":";;;AAgFO,IAAM,mBAAA,GAAsB,oBAAA;AAEnC,IAAM,IAAA,GAAO,wBAAA;AACb,IAAM,OAAA,GAAU,wBAAA;AAChB,IAAM,QAAA,GAAW,wBAAA;AAKjB,IAAM,aAAA,GAAgB,wBAAA;AAMtB,IAAM,aAAA,GAAgB,0BAAA;AACtB,IAAM,iCAAiB,IAAI,GAAA,CAAI,CAAC,WAAA,EAAa,WAAA,EAAa,OAAO,CAAC,CAAA;AAG3D,SAAS,aAAa,KAAA,EAAwB;AACnD,EAAA,OAAO,IAAA,CAAK,KAAK,KAAK,CAAA;AACxB;AAGO,SAAS,gBAAgB,KAAA,EAAwB;AACtD,EAAA,OAAO,OAAA,CAAQ,KAAK,KAAK,CAAA;AAC3B;AAOO,SAAS,cAAc,UAAA,EAA+C;AAC3E,EAAA,IAAI,CAAC,YAAY,OAAO,IAAA;AACxB,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,UAAU,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,KAAA,GACJ,IAAI,QAAA,KAAa,OAAA,IAAW,eAAe,GAAA,CAAI,GAAA,CAAI,QAAA,CAAS,WAAA,EAAa,CAAA;AAC3E,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,QAAA,IAAY,CAAC,OAAO,OAAO,IAAA;AAChD,EAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,mBAAmB,CAAA,CAAA;AAC5C;AAGO,SAAS,uBAAuB,GAAA,EAAsB;AAC3D,EAAA,OAAO,cAAc,IAAA,CAAK,GAAG,KAAK,CAAC,aAAA,CAAc,KAAK,GAAG,CAAA;AAC3D;AAMO,SAAS,mBAAmB,IAAA,EAAuC;AACxE,EAAA,MAAM,MAAe,IAAA,CAAK,gBAAA;AAC1B,EAAA,MAAM,YAAqB,IAAA,CAAK,gBAAA;AAChC,EAAA,MAAM,gBAAyB,IAAA,CAAK,aAAA;AACpC,EAAA,OACE,OAAO,IAAA,CAAK,IAAA,KAAS,UAAA,IACrB,OAAO,KAAK,IAAA,KAAS,QAAA,IACrB,YAAA,CAAa,IAAA,CAAK,IAAI,CAAA,IACtB,OAAO,KAAK,eAAA,KAAoB,QAAA,IAChC,gBAAgB,IAAA,CAAK,eAAe,CAAA,KACnC,GAAA,KAAQ,UACP,GAAA,KAAQ,EAAA,IACP,OAAO,GAAA,KAAQ,QAAA,IAAY,SAAS,IAAA,CAAK,GAAG,CAAA,CAAA,KAC9C,SAAA,KAAc,UAAa,OAAO,SAAA,KAAc,eAChD,aAAA,KAAkB,MAAA,IAAa,OAAO,aAAA,KAAkB,SAAA,CAAA;AAE7D;AAMO,SAAS,mBACd,IAAA,EACe;AACf,EAAA,MAAM,MAAM,IAAA,CAAK,gBAAA;AACjB,EAAA,IAAI,OAAO,QAAQ,QAAA,IAAY,CAAC,SAAS,IAAA,CAAK,GAAG,GAAG,OAAO,IAAA;AAC3D,EAAA,IAAI,KAAK,gBAAA,KAAqB,KAAA,IAAS,CAAC,sBAAA,CAAuB,GAAG,CAAA,EAAG;AACnE,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,GAAA;AACT;AAMA,IAAM,QAAA,mBAAuC,IAAI,GAAA,CAAmB,CAAC,IAAI,CAAC,CAAA;AAGnE,SAAS,2BAA2B,MAAA,EAAgC;AACzE,EAAA,OAAO,QAAA,CAAS,IAAI,MAAM,CAAA;AAC5B","file":"chunk-WSEQ2I6I.js","sourcesContent":["/**\n * BOFF-9797. The small part of the live avatar that the panel itself needs, whether or not it is ever opened: what a\n * host's `avatar.live` is, whether the live avatar can run on this page at all, and where its requests go.\n *\n * Everything else (the view, its state machine, the requests, the words, the bot check) is a separate chunk that a\n * site only downloads when its visitor first opens the Avatar view (see `explore-avatar-live.tsx`). That is why this\n * file is separate and kept to a few lines: it is the only part of the live avatar in the package root for a site that\n * does not pass `avatar.live`, and the part of it that decides, without loading anything, whether the chunk is wanted.\n * Types only, plus plain functions: nothing here imports a component, a context or a string table.\n */\nimport type { ExploreLocale } from \"./explore-i18n\";\nimport type { AvatarLiveModule } from \"../avatar-live/types\";\nimport type { UseExploreChatResult } from \"../hooks/use-explore-chat\";\n\n/**\n * BOFF-9797. A host's opt-in to the live avatar on its panel's Avatar tab. `site`, `load` and `manifestVersion` are\n * required; a config that is incomplete, or has an optional field of the wrong shape, leaves the tab as it was (and a\n * warning in the console).\n */\nexport interface ExplorePanelAvatarLive {\n  /** The site, as the live avatar service knows it: `healthybowl`. */\n  site: string;\n  /**\n   * Loads the live avatar's room module: `() => import('@burdenoff/website-sdk/avatar-live')`. Called only after the\n   * visitor presses Start on the consent card, never on page load or on opening the tab. That entry needs the\n   * package's optional peer dependency for media rooms (see the README).\n   */\n  load: () => Promise<AvatarLiveModule>;\n  /**\n   * The site's Cloudflare Turnstile site key, for the bot check that runs when the visitor presses Start. Used only when\n   * the server says it checks for bots (its availability's `botCheck`, contract v1.2), or says nothing of it (a server\n   * older than v1.2, which always checks): such a server's live avatar then needs a key, and without one the tab stays\n   * as it was. A server that runs no bot check needs none, and no Cloudflare script is loaded for it, key or not.\n   */\n  turnstileSiteKey?: string;\n  /**\n   * Whether `turnstileSiteKey` may be one of Cloudflare's test keys (`1x00000000000000000000AA` and keys of their\n   * shape). `websiteAvatarLive` sets it: true on alpha only, false everywhere else, so a production page never runs a\n   * test widget. Unset (a config made by hand): any key of a valid shape, as before.\n   */\n  allowTestSiteKey?: boolean;\n  /** The version of the suggested-question list the panel shows (its `examplePrompts`), such as `hb-en-1`. */\n  manifestVersion: string;\n  /**\n   * End a session nobody is attending to (BOFF-9797 stage A). A session keeps playing behind the Chat tab and on a\n   * hidden page, so the answer under way is heard to its end; with this set, out of sight it also ends:\n   *\n   * - **once its answer has played out**, at once: the idle tail after an answer runs only while the Avatar view is in\n   *   sight (the shared lifecycle rule; see `AvatarLiveView`'s `attend`);\n   * - **when the browser holds its sound back** (autoplay refused, or the audio context suspended), after a short grace:\n   *   the \"Tap to turn on sound\" button that would let it play is out of sight, so nobody hears it.\n   *\n   * Both end it with reason `user`. Unset or false: such a session plays on to the end the server planned for it, as\n   * before.\n   */\n  endUnattended?: boolean;\n}\n\n/**\n * What the live avatar reads of the panel's conversation: the transcript, whether it is read-only and the token, and\n * `reset` (the chat's own New chat) for its New chat button where the conversation can never be read. Where the server\n * reads typed questions too (contract v1.3), the Avatar tab's own question box asks through the same conversation:\n * `send` (with `surface: \"AVATAR\"`), and `canSend`, `phase`, `activity` and `catalog` to say when it can and what the\n * answer is doing, and `resent` to follow a question asked there that Chat's Retry sent again.\n */\nexport type AvatarConversation = Pick<\n  UseExploreChatResult,\n  | \"messages\"\n  | \"isSharedView\"\n  | \"getConversationToken\"\n  | \"reset\"\n  | \"send\"\n  | \"canSend\"\n  | \"phase\"\n  | \"activity\"\n  | \"catalog\"\n  | \"resent\"\n>;\n\n/** The web branch's routes, under the gateway's origin. */\nexport const AVATAR_WEB_API_PATH = \"/api/web-avatar/v1\";\n\nconst SITE = /^[a-z][a-z0-9-]{1,31}$/;\nconst VERSION = /^[A-Za-z0-9._-]{1,32}$/;\nconst SITE_KEY = /^[A-Za-z0-9_-]{1,128}$/;\n/**\n * The shape of Cloudflare's dummy site keys: a digit, `x`, a run of zeros and two letters (`1x00000000000000000000AA`,\n * `2x00000000000000000000AB`, `3x00000000000000000000FF`, …). Also catches an all-zero `0x…` placeholder.\n */\nconst TEST_SITE_KEY = /^\\dx0{16,}[A-Za-z]{2}$/;\n/**\n * A real-looking site key. Cloudflare documents no format for real keys; every key it issues starts `0x` (in practice\n * `0x4AAAAAAA…`, about 24 characters), in letters, digits, `_` and `-`. The length is kept loose (18 to 64 in all) so a\n * longer key Cloudflare might issue later still passes, and the charset matches what the panel accepts.\n */\nconst REAL_SITE_KEY = /^0x[A-Za-z0-9_-]{16,62}$/;\nconst LOOPBACK_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"[::1]\"]);\n\n/** A site slug the contract accepts (`healthybowl`). */\nexport function isAvatarSite(value: string): boolean {\n  return SITE.test(value);\n}\n\n/** A consent or manifest version the contract accepts (`hb-en-1`). */\nexport function isAvatarVersion(value: string): boolean {\n  return VERSION.test(value);\n}\n\n/**\n * The web branch's base URL on the SDK's configured gateway: the gateway URL's origin, plus\n * {@link AVATAR_WEB_API_PATH}. Null for anything that is not an `https:` URL (or `http:` on this machine, for local\n * development).\n */\nexport function avatarApiBase(gatewayUrl: string | undefined): string | null {\n  if (!gatewayUrl) return null;\n  let url: URL;\n  try {\n    url = new URL(gatewayUrl);\n  } catch {\n    return null;\n  }\n  const local =\n    url.protocol === \"http:\" && LOOPBACK_HOSTS.has(url.hostname.toLowerCase());\n  if (url.protocol !== \"https:\" && !local) return null;\n  return `${url.origin}${AVATAR_WEB_API_PATH}`;\n}\n\n/** A real-looking Turnstile site key: `0x…`, and not of the shape of Cloudflare's test keys. */\nexport function isRealTurnstileSiteKey(key: string): boolean {\n  return REAL_SITE_KEY.test(key) && !TEST_SITE_KEY.test(key);\n}\n\n/**\n * Whether a host's `avatar.live` has everything the live avatar needs, in the shapes the contract accepts. The site\n * key is optional (an empty one is none), and checked only when it is there.\n */\nexport function liveConfigComplete(live: ExplorePanelAvatarLive): boolean {\n  const key: unknown = live.turnstileSiteKey;\n  const allowTest: unknown = live.allowTestSiteKey;\n  const endUnattended: unknown = live.endUnattended;\n  return (\n    typeof live.load === \"function\" &&\n    typeof live.site === \"string\" &&\n    isAvatarSite(live.site) &&\n    typeof live.manifestVersion === \"string\" &&\n    isAvatarVersion(live.manifestVersion) &&\n    (key === undefined ||\n      key === \"\" ||\n      (typeof key === \"string\" && SITE_KEY.test(key))) &&\n    (allowTest === undefined || typeof allowTest === \"boolean\") &&\n    (endUnattended === undefined || typeof endUnattended === \"boolean\")\n  );\n}\n\n/**\n * The site key a bot check at Start may use, or null when there is none: no key, one of no valid shape, or one of\n * Cloudflare's test keys where `allowTestSiteKey` is false.\n */\nexport function turnstileSiteKeyOf(\n  live: ExplorePanelAvatarLive,\n): string | null {\n  const key = live.turnstileSiteKey;\n  if (typeof key !== \"string\" || !SITE_KEY.test(key)) return null;\n  if (live.allowTestSiteKey === false && !isRealTurnstileSiteKey(key)) {\n    return null;\n  }\n  return key;\n}\n\n/**\n * The locales whose live-avatar strings have been reviewed. The live avatar runs only in these; see\n * `explore-avatar-i18n.ts`. English only, until a named reviewer signs off on another.\n */\nconst REVIEWED: ReadonlySet<ExploreLocale> = new Set<ExploreLocale>([\"en\"]);\n\n/** Whether the live avatar may run in `locale`: its strings have been reviewed. */\nexport function isAvatarLiveLocaleReviewed(locale: ExploreLocale): boolean {\n  return REVIEWED.has(locale);\n}\n"]}