@justai/cuts 0.16.0 → 0.17.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justai/cuts",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "A persona's named parts — the page shell that holds them, and the cuts themselves.",
   "license": "UNLICENSED",
   "repository": {

package/src/Base.astro

@@ -184,6 +184,18 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
         ten that measure themselves exactly nothing. */}
     {gaId && (
     <script is:inline define:vars={{ gaId }}>
+      // A non-production page measures NOTHING. Found by the first read through the analytics MCP:
+      // 127.0.0.1 + localhost were the property's TOP "persona" (562 fake users in 28 days — local
+      // dev, plus every headless verification sweep loading the built HTML). The guard also covers
+      // the edge's dev- preview hosts: previews are rehearsals, not visits. gtag is still defined
+      // (as the same queue-stub) even on a silenced host, so the consent script can never hit
+      // "gtag is not defined" — the exact trap documented below. The whole block sits in an if
+      // rather than behind an early return: Astro 7's compiler rejects a top-level `return` in an
+      // inline script at BUILD time (the define:vars IIFE only exists later, at runtime).
+      window.gtag = window.gtag || function () { (window.dataLayer = window.dataLayer || []).push(arguments); };
+      var __h = location.hostname;
+      var __nonprod = __h === "localhost" || __h === "127.0.0.1" || __h === "::1" || __h === "[::1]" || __h.indexOf("dev-") === 0;
+      if (!__nonprod) {
       window.dataLayer = window.dataLayer || [];
       // gtag is put on WINDOW, not declared as `function gtag`, and this is load-bearing: `define:vars`
       // wraps this inline script in an IIFE to scope the injected `gaId`, so a `function gtag` here
@@ -213,6 +225,7 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
           document.head.appendChild(s);
         });
       });
+      }
     </script>
     )}
   </head>
@@ -263,6 +276,9 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
     <script is:inline>
       (function () {
         try {
+          // same non-production guard as the analytics block: no measurement → nothing to consent to
+          var h = location.hostname;
+          if (h === "localhost" || h === "127.0.0.1" || h === "::1" || h === "[::1]" || h.indexOf("dev-") === 0) return;
           if (localStorage.getItem("consent")) return;
           if (!document.getElementById("kernel")) return; // no kernel = not a content page (e.g. 404) — don't ask for consent on a dead end
           if ((Intl.DateTimeFormat().resolvedOptions().timeZone || "").indexOf("Europe/") !== 0) return;