From 1f56d9004a35bd4975323b79d0516f888902bfa8 Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Sun, 6 Sep 2026 16:35:12 +0000
Subject: [PATCH] chore: remove the empty runtime-config file and its plumbing

public/config.js assigned an empty object to window.env and nothing ever
read it. Zero matches for window.env or globalThis.env anywhere in the
tracked tree; the app reads Vite's import.meta.env.

index.html loaded it as a blocking script in <head>, so removing it also
drops one request from the critical path of every SPA page load. The 58
prerendered static pages under public/ never referenced it: none of them
carries the script tag, so this leaves no dangling reference behind.

Removes the file and everything that existed only to serve it: the script
tag in index.html, the service-worker app-shell entry, the Vercel and nginx
no-cache rules, the /config.js row in the deployment-config test, and the
now-contradictory .gitignore entry.

Also drops a latent trap in nginx.conf. The JS/CSS caching block carried

    if ($request_uri ~* "config\.js") { return 404; }

which matches on substring, so any hashed bundle whose URI contained
"config.js" would have 404'd. With the file gone the guard has nothing to
protect and is deleted rather than narrowed.

The service worker degrades safely either way: install uses
Promise.allSettled and only caches responses that are ok, so a missing
app-shell entry could never fail installation.

Verified on main fe679fd, from a clean npm ci: docs:check, lint, typecheck,
955 unit tests (main is 956; this removes exactly the one it.each row for
/config.js), 121 edge tests, build, and 126 Chromium e2e tests pass.
`nginx -t` passes against the real nginx:alpine image with this config
mounted.
---
 .gitignore                                |  1 -
 index.html                                |  1 -
 nginx.conf                                | 11 +----------
 public/config.js                          |  6 ------
 public/sw.js                              |  1 -
 src/test/vercel-deployment-config.test.ts |  2 +-
 vercel.json                               |  9 ---------
 7 files changed, 2 insertions(+), 29 deletions(-)
 delete mode 100644 public/config.js

diff --git a/.gitignore b/.gitignore
index ceb9c6836..f770fde4c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -22,7 +22,6 @@ dist-ssr
 *.njsproj
 *.sln
 *.sw?
-public/config.js
 .env
 supabase/.temp/
 coverage/
diff --git a/index.html b/index.html
index 322587c6d..7bf0bd7b5 100644
--- a/index.html
+++ b/index.html
@@ -66,7 +66,6 @@
         ]
       }
     </script>
-    <script src="/config.js"></script>
     <script src="/theme-init.js"></script>
   </head>
 
diff --git a/nginx.conf b/nginx.conf
index 9774afca3..6161bffe1 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -18,12 +18,7 @@ server {
     if ($uri ~ ^/(app(?:/|$)|login$|share/)) { set $robots_tag "noindex, nofollow"; }
     add_header X-Robots-Tag $robots_tag always;
 
-    # Do not cache runtime bootstraps so config and theme behavior update instantly.
-    location = /config.js {
-        expires -1;
-        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
-    }
-
+    # Do not cache the theme bootstrap so theme behavior updates instantly.
     location = /theme-init.js {
         expires -1;
         add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
@@ -84,10 +79,6 @@ server {
 
     # Cache JS/CSS bundles (Vite adds hashes to these, so caching is safe)
     location ~* \.(?:css|js)$ {
-        # But exclude config.js which we handled above
-        if ($request_uri ~* "config\.js") {
-            return 404; # Should not happen due to the = /config.js block above
-        }
         expires 1y;
         add_header Cache-Control "public";
     }
diff --git a/public/config.js b/public/config.js
deleted file mode 100644
index 8cc59350b..000000000
--- a/public/config.js
+++ /dev/null
@@ -1,6 +0,0 @@
-// Runtime configuration for DebateLab
-// Note: API keys are stored securely in the Supabase Edge Function
-// This file only contains non-sensitive frontend configuration
-window.env = {
-  // No API keys needed - all AI calls go through the authenticated Edge Function
-};
\ No newline at end of file
diff --git a/public/sw.js b/public/sw.js
index bbc72146f..4dd9d86be 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -18,7 +18,6 @@ const APP_SHELL = [
   '/app/history',
   '/app/settings',
   '/index.html',
-  '/config.js',
   '/theme-init.js',
   '/manifest.webmanifest',
   '/favicon.ico',
diff --git a/src/test/vercel-deployment-config.test.ts b/src/test/vercel-deployment-config.test.ts
index 6cfe5266f..de3434c4f 100644
--- a/src/test/vercel-deployment-config.test.ts
+++ b/src/test/vercel-deployment-config.test.ts
@@ -127,7 +127,7 @@ describe("Vercel frontend deployment configuration", () => {
     },
   );
 
-  it.each(["/index.html", "/config.js", "/theme-init.js", "/sw.js"])(
+  it.each(["/index.html", "/theme-init.js", "/sw.js"])(
     "prevents stale caching for %s",
     (source) => {
       const config = loadConfig();
diff --git a/vercel.json b/vercel.json
index 343b031a9..d3d7ad814 100644
--- a/vercel.json
+++ b/vercel.json
@@ -84,15 +84,6 @@
         }
       ]
     },
-    {
-      "source": "/config.js",
-      "headers": [
-        {
-          "key": "Cache-Control",
-          "value": "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0"
-        }
-      ]
-    },
     {
       "source": "/theme-init.js",
       "headers": [