@voqalize/avatar 0.6.3 → 0.7.0

package/README.md

@@ -6,7 +6,7 @@ and shows the state of the call: listening, thinking, being interrupted.
 
 This package is the loader. The avatar itself (the characters, the renderer and
 everything that follows the call) is the Voqalize avatar runtime, which this
-package imports from `https://avatar.voqalize.com` when the first avatar mounts.
+package imports from `https://cdn.voqalize.com` when the first avatar mounts.
 Each release of this package is pinned to the runtime it was released with, so
 upgrading the package is how you upgrade the avatar.
 
@@ -124,20 +124,41 @@ the `<div>` the avatar renders into.
 
 ## Content Security Policy
 
-If your page sets a Content-Security-Policy, add these sources:
+If your page sets a Content-Security-Policy, add our host to these directives:
 
-- `script-src https://avatar.voqalize.com`, because the runtime is a module
-  imported from there.
-- `connect-src https://avatar.voqalize.com blob:`, because the runtime fetches
-  the character from there and decodes the character's textures from `blob:`
-  URLs.
-- `img-src https://avatar.voqalize.com blob:`. The asset host serves the
-  still photograph shown where a browser has no WebGL 2, as a call whose other
-  side has turned their camera off; without it that tile shows an empty circle.
-  `blob:` is for Safari before 17 and Firefox before 98, which decode the
-  character's textures through an image element.
+```
+script-src  https://cdn.voqalize.com
+connect-src https://cdn.voqalize.com
+img-src     https://cdn.voqalize.com
+```
 
-The runtime needs nothing else: no workers, no inline styles and no `eval`.
+- `script-src`, because the runtime is a module imported from there.
+- `connect-src`, because the runtime fetches the character from there.
+- `img-src`, for the still photograph shown where a browser has no WebGL 2,
+  as a call whose other side has turned their camera off. Without it that
+  tile shows an empty circle; nothing else is affected.
+
+The runtime needs nothing else: no `blob:`, no `data:`, no workers, no inline
+styles and no `eval`. Safari before 17 and Firefox before 98 try one image from
+a `blob:` URL first; the policy refuses it, the face draws all the same, and a
+policy with a `report-to` gets one report from each such page. Your page's own call (its `connect-src` for the voice
+service, its microphone permission) is not part of this list.
+
+A policy applies to the page that sends it, so only the pages that mount an
+avatar need these lines. To try them before you enforce them, send the policy
+as `Content-Security-Policy-Report-Only`: the browser reports what it would
+refuse and refuses nothing.
+
+### Upgrading from 0.6
+
+Releases before 0.7 load from `https://avatar.voqalize.com` and asked for
+`blob:` as well. That host serves the same files and stays up, and a policy
+written for it keeps working with this release: the runtime is imported from
+whichever name your policy allows (if your policy has a
+`report-to`, expect one report for the name it refuses). Change your policy after you
+upgrade the package, not before: a 0.6 package under the policy above is
+refused its runtime. Once every page runs 0.7 or later you can drop
+`avatar.voqalize.com` and `blob:` from your policy.
 
 ## Bundlers
 
@@ -149,4 +170,4 @@ avatars mount.
 ## Licence
 
 This package is MIT; see [LICENSE](./LICENSE). The runtime it loads is not open
-source. Its terms are at https://avatar.voqalize.com/LICENSE.
+source. Its terms are at https://cdn.voqalize.com/LICENSE.

package/dist/index.d.ts

@@ -15,16 +15,17 @@
  *
  * This package is the loader and nothing else. The avatar itself — the
  * characters, the renderer and everything that reads the call — is the
- * Voqalize avatar runtime, which this module imports from
- * `avatar.voqalize.com` at the version it was released with and which is
- * licensed separately. `createAvatar` returns at once; the face appears when
- * the runtime and the character have arrived.
+ * Voqalize avatar runtime, which this module imports from `cdn.voqalize.com`
+ * at the version it was released with and which is licensed separately.
+ * `createAvatar` returns at once; the face appears when the runtime and the
+ * character have arrived.
  *
- * A page with a Content-Security-Policy needs `https://avatar.voqalize.com` in
+ * A page with a Content-Security-Policy needs `https://cdn.voqalize.com` in
  * `script-src` (the runtime), `connect-src` (the character it fetches) and
- * `img-src` (the camera-off still, where there is no WebGL 2), and `blob:` in
- * `connect-src` (the character's textures are decoded from blob URLs;
- * `img-src` too on Safari before 17 and Firefox before 98).
+ * `img-src` (the camera-off still, where there is no WebGL 2), and nothing
+ * else. A policy written for a release before 0.7 names
+ * `avatar.voqalize.com`, the same host under its old name, and keeps working:
+ * a runtime the page refuses from one name is imported from the other.
  */
 import type { PipecatClient } from "@pipecat-ai/client-js";
 /** Amplitude, 0..2. `1` is as authored. */

package/dist/index.js

@@ -15,23 +15,63 @@
  *
  * This package is the loader and nothing else. The avatar itself — the
  * characters, the renderer and everything that reads the call — is the
- * Voqalize avatar runtime, which this module imports from
- * `avatar.voqalize.com` at the version it was released with and which is
- * licensed separately. `createAvatar` returns at once; the face appears when
- * the runtime and the character have arrived.
+ * Voqalize avatar runtime, which this module imports from `cdn.voqalize.com`
+ * at the version it was released with and which is licensed separately.
+ * `createAvatar` returns at once; the face appears when the runtime and the
+ * character have arrived.
  *
- * A page with a Content-Security-Policy needs `https://avatar.voqalize.com` in
+ * A page with a Content-Security-Policy needs `https://cdn.voqalize.com` in
  * `script-src` (the runtime), `connect-src` (the character it fetches) and
- * `img-src` (the camera-off still, where there is no WebGL 2), and `blob:` in
- * `connect-src` (the character's textures are decoded from blob URLs;
- * `img-src` too on Safari before 17 and Firefox before 98).
+ * `img-src` (the camera-off still, where there is no WebGL 2), and nothing
+ * else. A policy written for a release before 0.7 names
+ * `avatar.voqalize.com`, the same host under its old name, and keeps working:
+ * a runtime the page refuses from one name is imported from the other.
  */
 import { PROTOCOL, RUNTIME_URL } from "./pin.js";
+/**
+ * Each avatar host's other name: one bucket, served under both. The runtime
+ * keeps the same pairs for the files it fetches (`client/hosts.ts` in the
+ * private source; a test holds the copies equal).
+ */
+const TWIN_HOSTS = {
+    "cdn.voqalize.com": "avatar.voqalize.com",
+    "avatar.voqalize.com": "cdn.voqalize.com",
+    "cdn.dev.voqalize.com": "avatar.dev.voqalize.com",
+    "avatar.dev.voqalize.com": "cdn.dev.voqalize.com",
+};
+/** The pinned runtime on the host's other name, or `null` where it has none. */
+function aliasOf(url) {
+    try {
+        const parsed = new URL(url);
+        const other = TWIN_HOSTS[parsed.host];
+        if (!other)
+            return null;
+        parsed.host = other;
+        return parsed.href;
+    }
+    catch {
+        return null;
+    }
+}
+const importRuntime = (url) => import(/* @vite-ignore */ /* webpackIgnore: true */ url);
 let runtime;
 function load() {
     // One import per page, however many avatars mount; a failure is forgotten so
-    // the next mount tries again rather than inheriting a dead promise.
-    runtime ??= import(/* @vite-ignore */ /* webpackIgnore: true */ RUNTIME_URL).catch((error) => {
+    // the next mount tries again rather than inheriting a dead promise. A page
+    // whose policy names the host's other name — every policy written for a
+    // release before 0.7 — refuses the pinned URL, and gets the same file from
+    // the name it allows. Where that fails too, the first failure is the one
+    // reported: a runtime that threw while it ran says why, not the alias.
+    runtime ??= importRuntime(RUNTIME_URL)
+        .catch((error) => {
+        const alias = aliasOf(RUNTIME_URL);
+        if (!alias)
+            throw error;
+        return importRuntime(alias).catch(() => {
+            throw error;
+        });
+    })
+        .catch((error) => {
         runtime = undefined;
         throw error;
     });

package/dist/pin.d.ts

@@ -1,2 +1,2 @@
-export declare const RUNTIME_URL = "https://avatar.voqalize.com/runtime/runtime.TMD2YTCC.js";
+export declare const RUNTIME_URL = "https://cdn.voqalize.com/runtime/runtime.5MKLUNW6.js";
 export declare const PROTOCOL = 1;

package/dist/pin.js

@@ -1,3 +1,3 @@
 // Written by scripts/build-runtime.mjs — the runtime this shim is released with.
-export const RUNTIME_URL = "https://avatar.voqalize.com/runtime/runtime.TMD2YTCC.js";
+export const RUNTIME_URL = "https://cdn.voqalize.com/runtime/runtime.5MKLUNW6.js";
 export const PROTOCOL = 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voqalize/avatar",
-  "version": "0.6.3",
+  "version": "0.7.0",
   "description": "A talking head for AI voice calls that embodies your pipecat client. This package loads the Voqalize avatar runtime.",
   "license": "MIT",
   "author": "Voqalize",