https://maticintake.com/certs.js?v=mtknjo2h

1/*
2 * Consent certification loaders: TrustedForm and Jornaya.
3 *
4 * ── Why this is a file and not an inline script ─────────────────────────────
5 *
6 * The page is served with `script-src 'self' https://api.trustedform.com` and no
7 * 'unsafe-inline'. An inline <script> is therefore BLOCKED by the browser —
8 * silently, unless somebody opens the console.
9 *
10 * That is not theoretical: TrustedForm's loader was inline, so it never ran, and
11 * every lead this page produced reached the CRM with an empty certificate field.
12 * The form worked, the leads arrived, and the one thing that makes them sellable
13 * was missing. Nothing surfaced it because a blocked script fails quietly.
14 *
15 * Served from our own origin, this file is allowed by 'self'. It then inserts
16 * TrustedForm's real script from api.trustedform.com, which the policy also
17 * allows. The strict policy stays exactly as strict.
18 *
19 * ── Configuration ───────────────────────────────────────────────────────────
20 *
21 * Read from data- attributes on <body>, because attributes are data and cannot
22 * be executed. No configuration is inlined as code.
23 */
24(function () {
25  'use strict';
26
27  var body = document.body;
28  if (!body) return;
29
30  /** Insert a third-party script tag before the first script already on the page. */
31  function loadScript(src, id) {
32    if (id && document.getElementById(id)) return;
33    var script = document.createElement('script');
34    script.type = 'text/javascript';
35    script.async = true;
36    script.src = src;
37    if (id) script.id = id;
38    var first = document.getElementsByTagName('script')[0];
39    if (first && first.parentNode) first.parentNode.insertBefore(script, first);
40    else document.head.appendChild(script);
41  }
42
43  // ── TrustedForm ──────────────────────────────────────────────────────────
44  // Records the session and writes a certificate URL into the hidden
45  // xxTrustedFormCertUrl field, which the server passes to the CRM untouched.
46  if (body.getAttribute('data-trustedform') === '1') {
47    loadScript(
48      'https://api.trustedform.com/trustedform.js'
49        + '?field=xxTrustedFormCertUrl&ping_field=xxTrustedFormPingUrl&l='
50        + new Date().getTime() + Math.random(),
51      'trustedform-script',
52    );
53  }
54
55  // ── Jornaya / LeadiD ─────────────────────────────────────────────────────
56  var jornayaCampaign = body.getAttribute('data-jornaya-campaign');
57  if (jornayaCampaign) {
58    loadScript(
59      'https://create.lidstatic.com/campaign/' + jornayaCampaign + '.js?snippet_version=2',
60      'LeadiDscript_campaign',
61    );
62  }
63})();