@justai/cuts 0.154.0 → 0.156.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justai/cuts",
-  "version": "0.154.0",
+  "version": "0.156.0",
   "description": "A persona's named parts — the page shell that holds them, and the cuts themselves.",
   "license": "UNLICENSED",
   "repository": {

package/src/Base.astro

@@ -82,6 +82,12 @@ interface Props {
    *  privacy/terms child personas use this: the surface that proves it collects nothing by running
    *  nothing. */
   gaId?: string | null;
+  /** Sign-in, ON by default. Pass `false` for a persona with no accounts: the SSO token capture is
+   *  then not rendered in the head, so nothing reads `#auth_token` or writes `justai_token`. It is
+   *  the head half of the opt-out — pass the same `auth={false}` to Toolbar, which then renders no
+   *  AuthMount and loads no sdk.js. Everything else in the head (language, theme, the service
+   *  worker, analytics as `gaId` decides) is untouched. */
+  auth?: boolean;
   /**
    * queries: kind game · data-kind · my game persona has margins · the game does not fill the screen ·
    *          which storefront lists this persona · persona kind in the layout
@@ -135,6 +141,7 @@ const {
   themeDark,
   themeLight,
   gaId = "G-13L3BP6XCW",
+  auth = true,
   kind = "app",
   page,
 } = Astro.props;
@@ -210,8 +217,10 @@ const ogImage = page?.image
          #auth_token before the deferred sdk.js can read it; and the language picker copies the
          current hash onto the next locale's URL (LangPicker), which would PROPAGATE the raw token
          into a new page and into history. Capturing first defeats both. Move this and sign-in breaks
-         silently — no error, the visitor simply lands back signed out. */}
-    <script is:inline set:html={AUTH_CAPTURE_JS} />
+         silently — no error, the visitor simply lands back signed out.
+         A persona with no accounts (`auth={false}`) has no token to capture, so the script is not
+         rendered at all. */}
+    {auth && <script is:inline set:html={AUTH_CAPTURE_JS} />}
     <script is:inline set:html={JS_CLASS_JS} />
     {/* queries: design grid · x-ray · ?xray · safe area · debug overlay · see the layout ·
         is my content inside the safe area · layout debugging

package/src/Catalogue.astro

@@ -494,7 +494,13 @@ const isNew = (added: string): boolean => { const t0 = Date.parse(added || "");
   .opt.active .tick { visibility: visible; }
   .opt.active .lb { font-weight: 600; }
 
-  .grid { display: grid; grid-template-columns: 1fr; gap: 14px; }
+  /* A SHELF, NOT A STRETCHED LIST (2026-10-14). The column became 1280 and a one-track grid turned every
+     card into a 1220px strip with its line running the width of a desk. The founder's rule for the wide
+     column: it is a room, and the kernel arranges itself in it without losing its mobile soul — so the
+     card stays the PHONE's card (a track never narrower than 340, about a phone's), and the grid simply
+     fits as many of them side by side as the room holds: one on a phone, two on a tablet, three in the
+     1280 column. Intrinsic, so there is no width branch, and on a phone nothing moves. */
+  .grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(min(100%, 340px), 1fr)); gap: 14px; }
   /* no entrance animation — when you walk into the room, everyone is already in their place.
      the cards are simply there on load; the only motion is a whisper on hover. */
   .empty { text-align: center; color: var(--text-dim); padding: 40px 0; }

package/src/Toolbar.astro

@@ -54,9 +54,12 @@ interface Props {
   // translated it yet gets a working, named control rather than an unlabelled icon.
   files?: boolean;
   filesLabel?: string;
-  // The home affordance points at app.zone, so the two apexes suppress it: app.zone IS that
-  // destination, and justai.pro is above it (sending the parent "home" to a child platform is
-  // the wrong direction). Every other persona keeps it.
+  // The home affordance points at the persona's apex (`apex` below), so EVERY apex suppresses it:
+  // app.zone, pin.games and cityinmotion.nl ARE that destination — told their own host, the row
+  // draws their mark as a link to the page it sits on, beside the profile icon that is the same
+  // face (cityinmotion.nl shipped exactly that until 2026-10-15) — and justai.pro is above them
+  // all (sending the parent "home" to a child platform is the wrong direction). Every other
+  // persona keeps it. The template passes `home={false}` for every apex it generates.
   home?: boolean;
   /**
    * Which storefront the home affordance points at. Defaults to app.zone — see BackToZone, which owns
@@ -147,11 +150,25 @@ interface Props {
   // `feed` already reads the host persona's avatar from the registry, and an absolute URL it was
   // given beats a relative one it inferred.
   parent?: { href?: string; label?: string; icon?: string };
+
+  // queries: accountless persona · no sign-in on this persona · turn auth off · auth={false} ·
+  //          the toolbar loads sdk.js on a persona with no accounts · privacy-sensitive persona
+  //
+  // ── SIGN-IN, ON UNLESS A PERSONA SAYS IT HAS NO ACCOUNTS ─────────────────────────────────────
+  //
+  // ON by default, because every persona today is one place in one signed-in ecosystem. Pass
+  // `auth={false}` and the AuthMount is not RENDERED — no mount point, no sdk.js tag,
+  // so no request to auth.justai.pro is ever made. Hiding it would not be the same thing: a hidden
+  // mount still loads a third-party script into the persona's origin, which is the surface an
+  // accountless, privacy-sensitive persona is opting out of.
+  //
+  // Pass the same `auth={false}` to Base, which owns the other half (the token capture in the head).
+  auth?: boolean;
 }
 import BackToZone from "./BackToZone.astro";
 const {
   sectionsLabel, profileLabel, kernelLabel, postsLabel,
-  files = true, filesLabel = "Files", landOn, avatar = "/icon.svg", parent,
+  files = true, filesLabel = "Files", landOn, avatar = "/icon.svg", parent, auth = true,
 } = Astro.props;
 // A child's row answers UP to its parent, not out to the zone, and has no stream of its own — so
 // both default off the moment `parent` is given, rather than each consumer remembering to say so.
@@ -274,7 +291,7 @@ import AuthMount from "./AuthMount.astro";
       <div class="tb-right">
         <slot name="toolbarRight" />
         <slot name="langPicker" />
-        <AuthMount />
+        {auth && <AuthMount />}
       </div>
     </div>
   </header>