@burdenoff/fe-libs 2026.922.2 → 2026.922.3

package/dist/shared/assistant/speech/createSpeechEngine.d.ts

@@ -35,9 +35,35 @@ export declare function configureSpeechEngine(options: {
 /**
  * Read the rollout config.
  *
- * Order matters: explicit runtime configuration, then a global the host can set
- * before the bundle loads, and only then the build-time variable — which is
- * eliminated in the published package and therefore useful for local dev only.
+ * Order matters: explicit runtime configuration, then the build-time variable —
+ * which is eliminated in the published package and therefore useful for local
+ * dev only.
+ *
+ * ★★★ `window.__HB_TTS_ENDPOINT__` IS DELIBERATELY NOT READ (BOFF-7730).
+ *
+ * It used to be honoured here, and `getHeaders` rode along with it, so the
+ * config returned `{ endpoint: <whatever that global said>, getHeaders:
+ * liveHeaders }` — and `liveHeaders` yields `{ authorization: 'Bearer
+ * <accessToken>' }`. Anything able to write one global before this ran got the
+ * signed-in user's live token POSTed cross-origin to a URL of its choosing.
+ * That needs script execution on the page first, so it was not a hole by
+ * itself; it was a clean, low-noise exfiltration channel handed to any
+ * injection that found one, shipping in all four products.
+ *
+ * Two things made removal the right fix rather than a guard:
+ *
+ *  1. NOTHING SET IT. An org-wide search found six references and not one
+ *     writer — this module, its test, and four comments describing the old
+ *     three-source order.
+ *  2. THE DOCS SAID IT WAS SAFE. Both
+ *     `healthybowl-specs/.../13-ai-assistant-integration.md` and
+ *     microfe-healthybowl's `HealthyBowlContext` told readers the global
+ *     "carries no headers" and could only enable an anonymous POST. True once;
+ *     when headers were attached to every source the docs were never updated,
+ *     so a reader reasoning from them concluded the opposite of what ran.
+ *
+ * Local development already has a first-precedence, header-carrying path in
+ * `configureSpeechEngine()`, which every product calls, so nothing is lost.
  */
 export declare function readSpeechEngineConfig(): SpeechEngineConfig;
 /**

package/dist/shared/assistant/speech/createSpeechEngine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createSpeechEngine.d.ts","sourceRoot":"","sources":["../../../../src/shared/assistant/speech/createSpeechEngine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAyB,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAEzF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAqBD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C,GAAG,IAAI,CA2BP;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,kBAAkB,CAY3D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,GAAE,kBAA6C,GAAG;IAC1F,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACnC,CASA;AAiBD,wBAAgB,eAAe,IAAI,YAAY,CAO9C;AAqBD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAKtE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CASxC"}
+{"version":3,"file":"createSpeechEngine.d.ts","sourceRoot":"","sources":["../../../../src/shared/assistant/speech/createSpeechEngine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAyB,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAEzF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAqBD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C,GAAG,IAAI,CA2BP;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,sBAAsB,IAAI,kBAAkB,CAO3D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,GAAE,kBAA6C,GAAG;IAC1F,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACnC,CASA;AAiBD,wBAAgB,eAAe,IAAI,YAAY,CAO9C;AAqBD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAKtE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CASxC"}

package/dist/shared/assistant/speech/createSpeechEngine.js

@@ -12,18 +12,10 @@ function o(e) {
 	r = t, i = e.getHeaders, _();
 }
 function s() {
-	if (r) return {
+	return r ? {
 		endpoint: r,
 		getHeaders: a
-	};
-	if (typeof window < "u") {
-		let e = window.__HB_TTS_ENDPOINT__;
-		if (e) return {
-			endpoint: e,
-			getHeaders: a
-		};
-	}
-	return { endpoint: (void 0)?.trim() || null };
+	} : { endpoint: (void 0)?.trim() || null };
 }
 function c(n = s()) {
 	return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/fe-libs",
-  "version": "2026.922.2",
+  "version": "2026.922.3",
   "description": "Burdenoff frontend primitives and domain libraries",
   "type": "module",
   "bin": {