https://simuland.ai/shared/get-started/boot.js?v=20260623-ai-picker-caa8165

1/*! Spenta invite bootstrap — gated loader for the "Start with Spenta" launcher.
2 *
3 * The marketing page references THIS file, not get-started.js directly, so the
4 * public surface stays clean: without a key it makes one same-origin mode
5 * probe, then stays inert on public production. On the Cloudflare Access-gated
6 * access site, that probe is the activation signal and the launcher loads.
7 *
8 * With an invite key — either ?key=… in the URL or a prior /start?key=… visit
9 * remembered in localStorage — it also remembers the key and drops a
10 * same-origin cookie so the server-side invite gate can see it.
11 */
12(function () {
13  "use strict";
14
15  var STORAGE_KEY = "spenta_invite";
16  var ASSET_VERSION = "20260623-ai-picker-caa8165";
17
18  function resolveKey() {
19    try {
20      var q = new URL(window.location.href).searchParams.get("key");
21      if (q && q.trim()) return q.trim();
22    } catch (e) {
23      /* URL unavailable — fall through */
24    }
25    try {
26      var s = window.localStorage.getItem(STORAGE_KEY);
27      if (s && s.trim()) return s.trim();
28    } catch (e) {
29      /* storage blocked — fall through */
30    }
31    return "";
32  }
33
34  function inject() {
35    var widget = document.createElement("script");
36    widget.defer = true;
37    widget.src = "/shared/get-started/get-started.js?v=" + encodeURIComponent(ASSET_VERSION);
38    (document.head || document.documentElement).appendChild(widget);
39  }
40
41  var key = resolveKey();
42  if (!key) {
43    // No key — but on the access site the visitor already passed the
44    // Cloudflare Access email wall, and that IS the activation: the site
45    // should change for them with no key in the link. One tiny same-origin
46    // probe answers which deployment this is; on public production it says
47    // test_version:false and nothing loads — the public surface stays clean
48    // (the gated load the launch-readiness guardrail demands).
49    var MODE_CACHE = "spenta_site_mode";
50    var cached = null;
51    try { cached = window.sessionStorage.getItem(MODE_CACHE); } catch (e) {}
52    if (cached === "test") { inject(); return; }
53    if (cached === "public") return;
54    try {
55      window.fetch("/api/invite/state", { credentials: "same-origin" })
56        .then(function (r) { return r.json(); })
57        .then(function (d) {
58          var test = !!(d && d.test_version);
59          try { window.sessionStorage.setItem(MODE_CACHE, test ? "test" : "public"); } catch (e) {}
60          if (test) inject();
61        })
62        .catch(function () { /* unreachable API — stay public */ });
63    } catch (e) { /* no fetch — stay public */ }
64    return;
65  }
66
67  try {
68    window.localStorage.setItem(STORAGE_KEY, key);
69  } catch (e) {
70    /* ignore */
71  }
72  try {
73    document.cookie =
74      STORAGE_KEY +
75      "=" +
76      encodeURIComponent(key) +
77      "; Path=/; Max-Age=1800; SameSite=Lax";
78  } catch (e) {
79    /* ignore */
80  }
81
82  inject();
83})();