# Site Runtime Config

The frontend can read optional runtime flags from a global config object:

```html
<script>
window.__M7_SITE_CONFIG__ = {
  showLoadingDuringProtectedSessionRefresh: true,
  showLoadingDuringApiSessionRefresh: true
};
</script>
```

These flags are optional. If a flag is omitted, the current default behavior is `true`.

## Flags

`showLoadingDuringProtectedSessionRefresh`

- Used by SPA page navigation in `/shared/script/at-conf/site-nav.js`
- When a protected SPA route under `/members` is clicked and `session_token` is missing, the shell loading modal is shown while `session.getSession()` runs before the page fetch

`showLoadingDuringApiSessionRefresh`

- Used by the shared shell API token wrapper in `/shared/script/shell/api/sessionToken.js`
- When an API request needs a session refresh because the readable `session_token` is missing, the shell loading modal is shown while the refresh request runs

## Notes

- This config is frontend-only and is read from `window.__M7_SITE_CONFIG__`
- The older alias `window.__M7_SITE_NAV_CONFIG__` is still accepted as a fallback for backward compatibility
- Current API refresh behavior is still "refresh when token is missing", not true expiry-aware refresh