@burdenoff/website-sdk 2026.1105.2 → 2026.1106.1

package/README.md

@@ -420,6 +420,139 @@ publishes audio, video or data, and it sends the avatar nothing to say.
   site's main bundle and the view's chunk carry none of it. On alpha, a browser
   WebSocket cannot carry Cloudflare Access service-token headers, so the
   stream needs the Access cookie for the gateway host.
+- **The mic through the browser's own speech recognition (BOFF-9797 Stage C,
+  the operator's decision of 2026-11-05, dark).** The same `mic: true` opt-in
+  (default unset: no mic); the server's availability decides how the mic works.
+  Where the last `ok` answer carries `mic: {"mode": "browser",
+  "maxPressSeconds": 30}` (contract v1.6, the avatar service's
+  `AVATAR_WEB_MIC=browser`; read strictly: any other value is `unreadable` and
+  means no mic) and the consent version's words describe it (the new
+  `AvatarConsentCopy.micNotice`), the mic uses `SpeechRecognition` /
+  `webkitSpeechRecognition`, as the product assistant does: the browser's own
+  speech service turns the voice into text, and **nothing of a press reaches
+  our server**; the text goes into the box and leaves only on Send. Offered
+  only in a secure context with a recognizer, and never in Firefox (`Firefox/`,
+  `FxiOS/`: desktop Firefox gains an on-device recognizer in release 160) or
+  Brave (`navigator.brave`: no speech service behind its recognizer). The
+  gateway's stream is never offered beside a `mic` the server sent (readable or
+  not), nor under words that name a `micNotice`; without a `mic` it is offered
+  exactly as before. The first tap shows the notice the words name,
+  `web-mic-2026-11-21-c` (714 bytes, SHA-256 `0a15bf5d…8e06de8f`); agreement is
+  kept per notice version, so another version is shown again. Two new consent
+  versions, DRAFTS for the privacy review that no server names yet:
+  `web-consent-2026-11-21-c` (bot check `turnstile`, 1,761 bytes, SHA-256
+  `824f389a…111790db`) and `web-consent-2026-11-22-c` (bot check `off`, 1,717
+  bytes, SHA-256 `d84a038b…1eb6200c`), Stage D's words with the mic's sentences
+  added. Tap to start, tap to stop on every platform: the recognizer
+  (`en-IN`, one `en-US` retry on `language-not-supported`, interim results,
+  `continuous` except on a touch device) starts inside the tap where the
+  browser reports the microphone granted; otherwise the tap first opens the
+  microphone and releases it at once (`getUserMedia`, nothing kept or sent),
+  which is what raises the permission prompt on Android Chrome and iOS, and
+  the recognizer starts 250 ms later (the Chat dictation's mobile handling,
+  `use-speech-input`). The 30 s limit counts from its `onstart`, and an engine
+  that ends by itself (a pause, a phone's single utterance, `no-speech`) is
+  replaced in the same press, its words joined: at once on a computer, after
+  120 ms on a touch device, after a 2 s cooldown after a throw (or, on a
+  computer, an instant end); only 8 instant ends in a row, or 60 recognizers
+  in all, end a press by itself. The last words after `stop()` are waited for
+  (3 s), and a tap meanwhile does nothing. A refused microphone
+  (`NotAllowedError`, or `not-allowed` where the microphone was not
+  confirmed) says it is blocked (the mic stays); a refusal right after a grant
+  is retried once after 350 ms; refused again, or `service-not-allowed`,
+  `audio-capture`, no microphone, or a second `network` in a row, it says it
+  can't be used here and goes for the page. Words heard before any failure are
+  kept. Inside a Stage D session a tap while the avatar speaks sends
+  `interrupt`, recording sends `listening` marks from `onstart`, never within
+  5 s of the one before (at most 12 a minute, within the session's 30 turns a
+  minute); the mic goes the moment a question is sent and is back once its
+  answer has gone to the session, so the avatar never starts an answer into
+  an open microphone (a tap while it speaks sends `interrupt` first; how fast
+  the cut lands, and whether to mute the avatar locally on that tap, are open
+  Stage D items). What is heard and the box carry rrweb's `rr-block`/`rr-mask` (the box also `rr-ignore`), so a site's
+  session replay records none of it before Send, and nothing in the mic calls
+  the site's analytics. **Before alpha is switched on:** each of the four sites'
+  session replay must be off, or honour those classes, and each privacy notice
+  (`/privacy#live-avatar`) needs its microphone paragraph.
+- **The voice conversation (BOFF-9797 Stage C2/C3, the operator's decisions of
+  2026-11-06, dark).** The same `mic: true` opt-in; the server decides. Only
+  where the last `ok` answer's `mic` carries a pause, `{"mode": "browser",
+  "maxPressSeconds": 30, "pauseMs": N}` (contract v1.7, the avatar service's
+  `AVATAR_WEB_MIC_PAUSE_MS`; N a whole number from 2000 to 2500, read strictly,
+  anything else `unreadable`), under the version whose entry declares no notice
+  and a question sent by itself after about two seconds of silence
+  (`AvatarNoNoticeCopy`: `notice: "none"`, `voice: { pauseMs: 2000 }`;
+  `web-voice-2026-11-25-n`, typed questions, Stage B's three minutes, Stage D's
+  answers after the first, no bot check: alpha and prod both run it with
+  `AVATAR_WEB_BOT_CHECK=off`). A pause under any other version, or that version
+  without a pause, is no mic at all. The notice versions of the earlier
+  first-use dialog (`web-consent-2026-11-23-v`, `-24-v`), which no environment
+  ran, are retired: this SDK has no copy for them, so a server naming one gets
+  the tab as it was. The mic slot becomes a labelled **Talk** button: tap Talk, speak,
+  and the question goes through the box's own Send once no word has changed
+  for the pause (twice that after one word, fillers aside: "So, ragi" is one;
+  or after a word a sentence goes on after: "the", "of", "and", "what", "is"…,
+  or a filler; never sooner than 1.5 s after the recognizer listening now
+  started, never between two recognizers; fillers and stalls such as "um",
+  "okay", "hello", such words alone ("the", "what is the") and a lone pronoun
+  ("you") never make a question). The avatar answers aloud, and once that
+  answer has played out (its voice quiet for 2.5 s, nothing accepted still to
+  be heard, read when it would listen) the mic listens again by itself, never
+  while the avatar speaks (the avatar's voice coming back drops a press the
+  conversation started, words and all), and not with less than 20 s of the
+  session left (a press under way still finishes). Only a press the
+  conversation started by itself is checked for the avatar's own words heard
+  back; the visitor's own Talk is their question, whatever it repeats.
+  **Stop listening** stops at once (the recognizer released, its words into
+  the box, unsent). The session's Stop, its own end (the idle end, the three
+  minutes), a question past 30 s from its first word, a failure after words and
+  typing (after what was typed) put the words heard so far into the box the
+  same way; 30 s with no question ends with nothing heard; leaving the tab or
+  the page releases the mic and drops what it heard. None of them ever sends. A
+  Talk while the avatar speaks interrupts it and mutes it here in that same
+  tap, until its voice has been quiet for 2.5 s after the tap (counted from the
+  tap where it was already quiet) or the next answer is accepted; the mute
+  holds against the room's own unmuting (LiveKit's playback resume, from "Tap
+  to turn on sound" or an iPhone's page shown again, and a track attached
+  again); where an answer is still to be heard at the tap (the first before
+  any voice, or one accepted), only a voice heard after the tap, quiet for the
+  hold, or the next answer accepted ends it. **Nothing of consent in the tab**
+  (Stage C3, the operator's final decision of 2026-11-06, "nothing at all"): no
+  consent card, no dialog, no mic notice and no privacy text, not even the line
+  under the box ("Answers are AI-generated and can be wrong. Don't include
+  personal details." stays under every version with words, word for word);
+  speech processing and the question sent by itself are the site's privacy
+  policy's to describe. The box asking in text under the server's `limits`
+  refusal has no line either: every availability answer names the server's
+  version, a refusal's too (read leniently: `AvatarAvailability`'s refused
+  `consentVersion`), and the tab goes by the last version named. A refusal
+  that names none changes nothing, and a tab that has heard of no version yet
+  keeps the line.
+  Talk starts the recognizer and lets the avatar's sound play inside its own
+  tap (only the browser's own permission prompt may come first; the mic is
+  made ready while Talk is offered, so the recognizer can start in the tap).
+  A new chat's first question, spoken or typed (Talk, Send or a chip), arms
+  the start of its session in its own tap (single use: bound to its question,
+  site, locale, page, version and bot check), and the avatar answers aloud once
+  the answer is ready, with no Start; a start called off (Cancel, the page or
+  the version changed) shows Start alone, with no words. The recording
+  indicator, Stop listening, the session's Stop and the live avatar's "AI
+  avatar · not a real person" label (a label, not a notice) stay. Nothing of
+  consent is kept in this browser, no consent and no acceptance of anything:
+  the only avatar key written is the existing day's note
+  `boff.explore.avatarUsedOn`, at a session's start, as under every version.
+  The create still names the version the server named, as the contract's
+  token: the server must record no consent for it.
+  `listening` marks go only while speech is heard, so an open, silent mic keeps
+  no session from its idle end. Under this version the box never switches to
+  text on this browser's note of a session today (a visitor may have several a
+  day: the server's per-visitor limit decides, and its `limits` refusal still
+  switches the box to text); after a session, "New chat for the avatar" offers
+  the next one, and words heard as it ended wait in its box. **PROD waits for
+  the privacy/legal reviewer's approval** of this no-notice experience; should
+  they require a pre-use disclosure, it would be one short line under Talk, as
+  a version of its own (`AvatarConsentCopy` has room for another kind of
+  notice), never a change to this one.
 - **The answers after the first (BOFF-9797 Stage D, dark).** Only where the
   create's 201 carries `followUps: {maxAnswers, idleSeconds,
   maxAnswerWaitSeconds}` (the avatar service adds it only under its

package/dist/avatar-live-view/index.d.mts

@@ -1,6 +1,6 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { E as ExplorePanelAvatarLive, a as ExploreLocale, A as AvatarConversation } from '../explore-avatar-live-config-BL8FTm0I.mjs';
+import { E as ExplorePanelAvatarLive, a as ExploreLocale, A as AvatarConversation } from '../explore-avatar-live-config-D2PGF8fG.mjs';
 import '../types-CTUJNvQu.mjs';
 import '../use-explore-chat-CbfohA9O.mjs';
 import '../explore-types-Ol1Mm3dW.mjs';

package/dist/avatar-live-view/index.d.ts

@@ -1,6 +1,6 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { E as ExplorePanelAvatarLive, a as ExploreLocale, A as AvatarConversation } from '../explore-avatar-live-config-auLKxSzx.js';
+import { E as ExplorePanelAvatarLive, a as ExploreLocale, A as AvatarConversation } from '../explore-avatar-live-config-CJstiSAN.js';
 import '../types-CTUJNvQu.js';
 import '../use-explore-chat-B3dOOvJN.js';
 import '../explore-types-Ol1Mm3dW.js';