Still cooking · Nash\x3c/title>' + '<link rel="icon" type="image/svg+xml" href="/favicon.svg">' + '<link rel="preconnect" href="https://fonts.googleapis.com">' + '<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>' + '<link href="https://fonts.googleapis.com/css2?family=Host+Grotesk:wght@400;500&display=swap" rel="stylesheet">' + '<style>' + 'html,body{margin:0;padding:0;height:100%;background:#01051E;color:#E6EEF8;font-family:"Host Grotesk",-apple-system,BlinkMacSystemFont,sans-serif;visibility:visible!important;}' + '.wrap{position:fixed;inset:0;display:grid;place-items:center;padding:24px;}' + '.backdrop{position:absolute;inset:0;background:rgba(1,5,30,.72);backdrop-filter:blur(8px);-webkit-backdrop-filter:blur(8px);}' + '.card{position:relative;width:min(460px,90vw);padding:40px 32px 32px;border-radius:18px;background:rgba(15,21,42,.92);border:1px solid rgba(255,255,255,.12);text-align:center;box-shadow:0 24px 80px rgba(1,5,30,.5);}' + '.emoji{font-size:38px;line-height:1;margin-bottom:16px;}' + 'h1{font-size:26px;font-weight:500;letter-spacing:-.01em;margin:0 0 10px;}' + 'p{font-size:16px;line-height:1.55;color:rgba(230,238,248,.8);margin:0 0 22px;}' + 'em{font-style:italic;color:#c9ff00;}' + 'button.btn{display:inline-block;color:#01051E;background:#F5F6FA;padding:10px 18px;border-radius:999px;font-size:12px;font-weight:600;text-decoration:none;border:0;font-family:inherit;cursor:pointer;}' + 'button.btn:hover{background:#fff;}' + '\x3c/style>' + '\x3c/head>' + '<body>' + '<div class="wrap">' + '<div class="backdrop">\x3c/div>' + '<div class="card">' + '<div class="emoji" aria-hidden="true">\u{1F90C}\x3c/div>' + '<h1>Still cooking.\x3c/h1>' + '<p>We’re hard at work in the kitchen. When it’s plated, it’s going to have <em>taste.\x3c/em>\x3c/p>' + '<button class="btn" id="nash-gate-back">Now scram!\x3c/button>' + '\x3c/div>' + '\x3c/div>' + '\x3c/body>'; // Wire up the back button. We use a real button + JS instead of an // <a href="javascript:..."> so CSP-strict pages can still render us. var btn = document.getElementById('nash-gate-back'); if (btn) btn.addEventListener('click', goBack); } })(); </article></body></html>

// Nash Review Portal — page-level access gate // // Why this exists: the wrapper at /review/view.html only enforces access on // pages it iframes. If a reviewer types a restricted URL directly into the // browser, or follows a deep link outside the portal, the wrapper isn't // involved and there's nothing stopping them. // // This script runs on every marketing page (auto-injected by serve.py as the // first thing in ). It: // 1. Reads the reviewer set in localStorage (if any). // 2. Checks the current path against the same access list view.html uses. // 3. If the reviewer isn't allowed, hides the document immediately and // replaces it with the "Still cooking." card so they never see the // restricted content flash through. // // Public visitors (no reviewer set) skip the gate entirely — the marketing // site stays public for anyone who hasn't picked a character. // // Honor-system only: anyone who clears localStorage or types a different // reviewer in DevTools can bypass it. That's fine for an internal review // portal; the goal is to keep work-in-progress out of casual sight, not // to lock it behind real auth. (function () { 'use strict'; // ─── Cross-origin handoff (platform demo) ──────────────────────────────── // The marketing-site wrapper iframes the platform demo on a different // origin. localStorage is per-origin, so the reviewer identity doesn't // carry over automatically. To bridge it, the wrapper appends ?nashRev= // (URI-encoded JSON of the reviewer object) when navigating to a // platform-demo URL. We capture it here, save to this origin's // localStorage, then strip it from the URL so the param doesn't leak // into bookmarks / shares. try { var qs = new URLSearchParams(location.search); var token = qs.get('nashRev'); if (token) { try { var parsed = JSON.parse(decodeURIComponent(token)); if (parsed && parsed.id) { localStorage.setItem('nash-reviewer', JSON.stringify(parsed)); } } catch (e) { /* malformed token, ignore */ } // Strip nashRev (and the cache-buster _rv) from the URL bar so the // identity isn't visible after the handoff. qs.delete('nashRev'); qs.delete('_rv'); var rest = qs.toString(); var newUrl = location.pathname + (rest ? '?' + rest : '') + location.hash; try { window.history.replaceState(null, '', newUrl); } catch (e) {} } } catch (e) { /* URL parse failed, ignore */ } // Honor-system page gate. Only the marketing site uses it — the platform // demo treats every page as open to any reviewer who made it through the // marketing-side gate, so we bail out early there. try { if (/nash-platform-demo/.test(location.hostname)) return; // Don't run inside the review portal frame (view.html does its own check) // or on /review/* pages themselves. if (location.pathname.indexOf('/review/') === 0) return; var raw = localStorage.getItem('nash-reviewer'); if (!raw) return; // public visitor — no gate var reviewer = null; try { reviewer = JSON.parse(raw); } catch (e) { return; } if (!reviewer || !reviewer.id) return; // Gates lifted — every reviewer can access every page. Short-circuit // before any OPEN_PAGES lookup. The wrapper at /review/view.html does // the same. To re-enable per-page gating, drop this return and let // the OPEN_PAGES table below take over again. return; // OPEN_PAGES = visible to anyone who picked a character. Everything else // is default-deny. We accept both the canonical /webflow-playground/* form // and the flat-slug form serve.py rewrites (e.g. /one-platform). var OPEN_PAGES = { // Same-as-everything-else open list — keep in sync with view.html. '/webflow-playground/index.html': 1, '/webflow-playground/agent.html': 1, '/webflow-playground/demo.html': 1, '/webflow-playground/one-platform.html': 1, '/webflow-playground/first-meter.html': 1, '/webflow-playground/middle-mile.html': 1, '/webflow-playground/last-mile.html': 1, '/one-platform.html': 1, '/demo.html': 1, '/first-meter.html': 1, '/middle-mile.html': 1, '/last-mile.html': 1, '/index.html': 1, '/': 1, '/agent': 1, '/demo': 1, '/one-platform': 1, '/first-meter': 1, '/middle-mile': 1, '/last-mile': 1, /* CMS-backed scaffolds (blog, changelog, events) */ '/webflow-playground/blog.html': 1, '/webflow-playground/blog-post.html': 1, '/webflow-playground/changelog.html': 1, '/webflow-playground/events.html': 1, '/blog': 1, '/blog-post': 1, '/changelog': 1, '/events': 1, /* Product pillar pages */ '/webflow-playground/orchestrate.html': 1, '/webflow-playground/planning.html': 1, '/webflow-playground/fleet.html': 1, '/webflow-playground/experience.html': 1, '/orchestrate.html': 1, '/planning.html': 1, '/fleet.html': 1, '/experience.html': 1, '/orchestrate': 1, '/planning': 1, '/fleet': 1, '/experience': 1, /* Industry / vertical / use-case pages — all open */ '/webflow-playground/grocery.html': 1, '/grocery.html': 1, '/grocery': 1, '/webflow-playground/restaurants.html': 1, '/restaurants.html': 1, '/restaurants': 1, '/webflow-playground/retail.html': 1, '/retail.html': 1, '/retail': 1, '/webflow-playground/distribution.html': 1, '/distribution.html': 1, '/distribution': 1, '/webflow-playground/field-services.html': 1, '/field-services.html': 1, '/field-services': 1, '/webflow-playground/healthcare.html': 1, '/healthcare.html': 1, '/healthcare': 1, '/webflow-playground/transportation-logistics.html': 1, '/transportation-logistics.html': 1, '/transportation-logistics': 1, '/webflow-playground/platforms.html': 1, '/platforms.html': 1, '/platforms': 1, /* Network + partner integrations + careers */ '/webflow-playground/network.html': 1, '/network.html': 1, '/network': 1, '/webflow-playground/shopify.html': 1, '/shopify.html': 1, '/shopify': 1, '/webflow-playground/square.html': 1, '/square.html': 1, '/square': 1, '/webflow-playground/careers.html': 1, '/careers.html': 1, '/careers': 1, /* Contact + Gartner LP + inbound thank-you pages */ '/webflow-playground/contact.html': 1, '/contact.html': 1, '/contact': 1, '/contact-us': 1, '/webflow-playground/gartner-lmd-2025.html': 1, '/resources/2025-gartner-market-guide-for-last-mile-delivery-technology-solutions': 1, '/webflow-playground/inbound-next-steps.html': 1, '/inbound-next-steps': 1, '/webflow-playground/inbound-success.html': 1, '/inbound-success': 1, /* Network & integration pages */ '/webflow-playground/network.html': 1, '/network.html': 1, '/network': 1, '/webflow-playground/shopify.html': 1, '/shopify.html': 1, '/shopify': 1, '/webflow-playground/square.html': 1, '/square.html': 1, '/square': 1, '/webflow-playground/platforms.html': 1, '/platforms.html': 1, '/platforms': 1, /* Brand guide + new component demos */ '/webflow-playground/brand.html': 1, '/brand.html': 1, '/provider-grid.html': 1, '/nash-aurora-export.html': 1, '/nash-aurora-export': 1, /* Legal hub — public-facing terms, privacy, security, AI policy */ '/legal': 1, '/legal.html': 1, '/webflow-playground/legal.html': 1, /* Press & News — coverage + recognition */ '/press': 1, '/press.html': 1, '/webflow-playground/press.html': 1 }; var path = location.pathname; if (OPEN_PAGES[path]) return; // Prefix-allowed paths — CMS-backed sub-routes. Each individual blog post // shouldn't need an explicit entry; allow the whole /blog/, /changelog/, /events/ namespaces. var OPEN_PREFIXES = ['/blog/', '/changelog/', '/events/', '/webflow-playground/blog/', '/webflow-playground/changelog/', '/webflow-playground/events/', '/legal/', '/webflow-playground/legal/']; for (var i = 0; i < OPEN_PREFIXES.length; i++) { if (path.indexOf(OPEN_PREFIXES[i]) === 0) return; } // Restricted page + non-privileged reviewer → block. // Hide the document immediately so no restricted content flashes through // before we swap in the still-cooking card. The script runs at the top of // , before the body is parsed, so this style applies to the empty // root element first and then to whatever the parser fills in below. var styleNode = document.createElement('style'); styleNode.id = 'nash-gate-hide'; styleNode.textContent = 'html{visibility:hidden!important;background:#01051E!important}'; (document.head || document.documentElement).appendChild(styleNode); // Wait until the body exists, then swap. We race a microtask + a // DOMContentLoaded listener — whichever fires first replaces the doc. if (document.body) { showStillCooking(); } else { document.addEventListener('DOMContentLoaded', showStillCooking, { once: true }); // Backup: if DOMContentLoaded somehow doesn't fire (rare), swap as // soon as the parser hits the body element. var poll = setInterval(function () { if (document.body) { clearInterval(poll); showStillCooking(); } }, 16); } } catch (e) { // If anything throws, fail open — better to surface the page than to // brick a public visitor with a broken gate. console.warn('[nash-gate] error, failing open:', e); var hide = document.getElementById('nash-gate-hide'); if (hide) hide.remove(); } function goBack(e) { if (e) e.preventDefault(); // Try history.back() first so reviewers return to whatever they were // looking at before clicking the dead link. If back() silently fails // (fresh tab from a Slack link can report history.length === 2 with no // real previous entry), bounce to the review portal homepage so the // button always does something visible. var fallback = '/review/view.html?page=index'; if (window.history.length <= 1) { window.location.href = fallback; return false; } var startUrl = location.href; window.history.back(); setTimeout(function () { if (location.href === startUrl) window.location.href = fallback; }, 150); return false; } function showStillCooking() { // Replace the document with the still-cooking card. Inline everything so // we don't depend on any external CSS/JS — this still works even if the // network drops between gate.js and the rest of the page. document.documentElement.innerHTML = '' + '' + '' + 'Still cooking · Nash\x3c/title>' + '<link rel="icon" type="image/svg+xml" href="/favicon.svg">' + '<link rel="preconnect" href="https://fonts.googleapis.com">' + '<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>' + '<link href="https://fonts.googleapis.com/css2?family=Host+Grotesk:wght@400;500&display=swap" rel="stylesheet">' + '<style>' + 'html,body{margin:0;padding:0;height:100%;background:#01051E;color:#E6EEF8;font-family:"Host Grotesk",-apple-system,BlinkMacSystemFont,sans-serif;visibility:visible!important;}' + '.wrap{position:fixed;inset:0;display:grid;place-items:center;padding:24px;}' + '.backdrop{position:absolute;inset:0;background:rgba(1,5,30,.72);backdrop-filter:blur(8px);-webkit-backdrop-filter:blur(8px);}' + '.card{position:relative;width:min(460px,90vw);padding:40px 32px 32px;border-radius:18px;background:rgba(15,21,42,.92);border:1px solid rgba(255,255,255,.12);text-align:center;box-shadow:0 24px 80px rgba(1,5,30,.5);}' + '.emoji{font-size:38px;line-height:1;margin-bottom:16px;}' + 'h1{font-size:26px;font-weight:500;letter-spacing:-.01em;margin:0 0 10px;}' + 'p{font-size:16px;line-height:1.55;color:rgba(230,238,248,.8);margin:0 0 22px;}' + 'em{font-style:italic;color:#c9ff00;}' + 'button.btn{display:inline-block;color:#01051E;background:#F5F6FA;padding:10px 18px;border-radius:999px;font-size:12px;font-weight:600;text-decoration:none;border:0;font-family:inherit;cursor:pointer;}' + 'button.btn:hover{background:#fff;}' + '\x3c/style>' + '\x3c/head>' + '<body>' + '<div class="wrap">' + '<div class="backdrop">\x3c/div>' + '<div class="card">' + '<div class="emoji" aria-hidden="true">\u{1F90C}\x3c/div>' + '<h1>Still cooking.\x3c/h1>' + '<p>We’re hard at work in the kitchen. When it’s plated, it’s going to have <em>taste.\x3c/em>\x3c/p>' + '<button class="btn" id="nash-gate-back">Now scram!\x3c/button>' + '\x3c/div>' + '\x3c/div>' + '\x3c/body>'; // Wire up the back button. We use a real button + JS instead of an // <a href="javascript:..."> so CSP-strict pages can still render us. var btn = document.getElementById('nash-gate-back'); if (btn) btn.addEventListener('click', goBack); } })(); </article></body></html>