https://sellspark.ai/lib/configBootstrap.js?v=8.2.50

1"use strict";
2// Phase 2 v8.2.5 Sub-ship B item #6 — dynamic-eval IIFE refactor.
3//
4// Council convergent (10/12 Path Y unanimous; SG primary owner):
5//   - Replaces the per-HTML inline Function-constructor evaluation pattern that lived in 10
6//     source HTMLs (terms/privacy/refund-policy/cookies/accessibility/support/reset-password/
7//     signup/mfa-verify/dashboard).
8//   - Fetches /api/config/client.json (NEW JSON endpoint added in this ship; see server.js).
9//   - NO fallback to legacy /api/config/client.js JS-eval endpoint — this is the entire point
10//     of Sub-ship B item #6. If JSON endpoint is unreachable, page degrades gracefully using
11//     defaults set by the Step 1 inline IIFE on each HTML.
12//   - Eliminates the unsafe-eval CSP requirement from every HTML using this bootstrap
13//     (precondition for PRE-FLIP-CLUSTER.md item #1; CSP `_headers` change deferred to
14//     2a.flip per Council 10/12 Path Y vote).
15//   - Keeps unsafe-inline CSP requirement until 2a.flip (this script is loaded via <script src>
16//     so it doesn't itself need unsafe-inline; but other inline scripts on each page still do).
17//
18// FA + TypeScript Migration convergent: this is browser-side TS in `lib/*.ts` glob; auto-enrols
19// in `tsconfig.build.json` build scope (zero tsconfig edits required).
20// BTE convergent: `lib/configBootstrap.js` (compiled output) loads via `<script src=>` — no eval.
21(function () {
22    'use strict';
23    // Type-narrow window.__SELLSPARK_CONFIG__ — Step 1 inline IIFE in each HTML sets apiBaseUrl
24    // BEFORE this script loads, so the property is guaranteed present. Defensive guard for
25    // pages that fail to set it (would short-circuit silently rather than crash).
26    var w = window;
27    if (!w.__SELLSPARK_CONFIG__) {
28        w.__SELLSPARK_CONFIG__ = {};
29    }
30    var apiBaseUrl = w.__SELLSPARK_CONFIG__.apiBaseUrl;
31    if (!apiBaseUrl) {
32        console.warn('[SellSpark] configBootstrap: missing apiBaseUrl - Step 1 inline IIFE did not run; aborting');
33        return;
34    }
35    function applyConfig(parsed) {
36        Object.assign(w.__SELLSPARK_CONFIG__, parsed);
37        // Console-disable behavior (preserves the v1.x DISABLE_BROWSER_CONSOLE_LOGS=true env behavior
38        // that previously lived inline in /api/config/client.js JS response).
39        if (parsed.disableConsoleLogs) {
40            var noop = function () {
41                /* no-op for production console silencing */
42            };
43            var originalConsole = {
44                log: console.log,
45                debug: console.debug,
46                info: console.info,
47                dir: console.dir,
48                table: console.table,
49                trace: console.trace,
50                time: console.time,
51                timeEnd: console.timeEnd,
52                group: console.group,
53                groupEnd: console.groupEnd,
54                groupCollapsed: console.groupCollapsed,
55            };
56            console.log = noop;
57            console.debug = noop;
58            console.info = noop;
59            console.dir = noop;
60            console.table = noop;
61            console.trace = noop;
62            console.time = noop;
63            console.timeEnd = noop;
64            console.group = noop;
65            console.groupEnd = noop;
66            console.groupCollapsed = noop;
67            // Restore hook for production debugging.
68            w.__SELLSPARK_RESTORE_CONSOLE__ = function () {
69                console.log = originalConsole.log;
70                console.debug = originalConsole.debug;
71                console.info = originalConsole.info;
72                console.dir = originalConsole.dir;
73                console.table = originalConsole.table;
74                console.trace = originalConsole.trace;
75                console.time = originalConsole.time;
76                console.timeEnd = originalConsole.timeEnd;
77                console.group = originalConsole.group;
78                console.groupEnd = originalConsole.groupEnd;
79                console.groupCollapsed = originalConsole.groupCollapsed;
80                originalConsole.info('[SellSpark] Console methods restored');
81            };

82            originalConsole.info('%c[SellSpark] Browser console logs disabled in ' + (parsed.environment || 'production') + ' mode. ' +
83                'Set DISABLE_BROWSER_CONSOLE_LOGS=false in .env to enable.', 'color: #888; font-style: italic;');
84        }
85        console.log('[SellSpark] Server config loaded successfully (configBootstrap)');
86        // v8.2.50 Option 1 remediation: dispatch a CustomEvent so page-specific
87        // listeners (e.g. lib/testimonialOnboardingBanner.js) can react to the
88        // applied config WITHOUT requiring an inline <script> block in the HTML.
89        // Detail carries the merged config so downstream listeners don't need to
90        // re-read window.__SELLSPARK_CONFIG__.
91        try {
92            window.dispatchEvent(new CustomEvent('sellspark:config-loaded', {
93                detail: w.__SELLSPARK_CONFIG__
94            }));
95        }
96        catch (eventError) {
97            console.warn('[SellSpark] configBootstrap: failed to dispatch sellspark:config-loaded:', eventError);
98        }
99    }
100    // Primary path: JSON endpoint (added v8.2.5 Sub-ship B; CSP-safe, no unsafe-eval required).
101    fetch(apiBaseUrl + '/api/config/client.json', {
102        method: 'GET',
103        credentials: 'include',
104        headers: { 'Accept': 'application/json' },
105    })
106        .then(function (response) {
107        if (!response.ok) {
108            throw new Error('Config JSON fetch failed: ' + response.status);
109        }
110        return response.json();
111    })
112        .then(applyConfig)
113        .catch(function (error) {
114        console.warn('[SellSpark] configBootstrap: JSON endpoint failed (' + error.message + '); using client-side defaults');
115    });
116})();