@justai/cuts 0.25.1 → 0.26.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@justai/cuts",
-  "version": "0.25.1",
-  "description": "A persona's named parts — the page shell that holds them, and the cuts themselves.",
+  "version": "0.26.1",
+  "description": "A persona's named parts \u2014 the page shell that holds them, and the cuts themselves.",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",
@@ -29,6 +29,6 @@
     "access": "public"
   },
   "dependencies": {
-    "@justai/core": "^0.3.0"
+    "@justai/core": "^0.4.1"
   }
 }

package/src/Base.astro

@@ -29,7 +29,7 @@
 import { dir as dirOf } from "@justai/ui/locale";
 // The load-bearing behaviour is framework-free and lives in @justai/core, so `feed` (Next) injects the
 // SAME strings instead of hand-copying them. This binding just decides where they go in an Astro head.
-import { AUTH_CAPTURE_JS, JS_CLASS_JS, REVEAL_CSS, analyticsJs, consentCopy } from "@justai/core";
+import { AUTH_CAPTURE_JS, CONSENT_JS, JS_CLASS_JS, REVEAL_CSS, analyticsJs, consentCopy } from "@justai/core";
 // The consent ask IS a confirmation — a moment of trust — so it rides the fleet's ONE dialog
 // rather than keeping a private dialect. One anatomy for "are you sure?" and "may I count you?".
 import ConfirmSheet from "./ConfirmSheet.astro";
@@ -217,73 +217,7 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
     <ConfirmSheet id="consent" ask body={consent.consentText}
                   actionLabel={consent.consentAllow} cancelLabel={consent.consentDecline} cancelValue="denied"
                   data-choice-label={consent.consentChoice} />
-    <script is:inline>
-      (function () {
-        try {
-          // same non-production guard as the analytics block: no measurement → nothing to consent to
-          var h = location.hostname;
-          if (h === "localhost" || h === "127.0.0.1" || h === "::1" || h === "[::1]" || h.indexOf("dev-") === 0) return;
-          var el = document.getElementById("consent"); if (!el || !el.showModal) return;
-          // returnValue survives a close, so reset before every open or a stale answer replays.
-          var open = function () { if (!el.open) { el.returnValue = ""; el.showModal(); } };
-          el.addEventListener("close", function () {
-            var rv = el.returnValue;
-            // "confirm" = the ❤️. "denied" = a CHOSEN "Stay invisible" (the sheet's cancelValue).
-            // Anything else (Escape, a backdrop tap) is NOT an answer, and ONLY A CHOICE MAY BE
-            // REMEMBERED AS A CHOICE (founder's law, 2026-07-24 — an earlier draft recorded the
-            // slip-away as a "quiet no", i.e. an answer the visitor never gave). A slip-away
-            // stores nothing: analytics stays at the regional default and the ask RETURNS on the
-            // next visit; the session flag below just keeps THIS visit quiet — one dodge buys one
-            // visit of peace, not an answer.
-            var v = rv === "confirm" ? "granted" : rv === "denied" ? "denied" : null;
-            if (v) {
-              gtag("consent", "update", { analytics_storage: v });
-              try { localStorage.setItem("consent", v); } catch (_) {}
-            } else {
-              try { sessionStorage.setItem("consent-later", "1"); } catch (_) {}
-            }
-          });
-          // THE CHANGE-YOUR-MIND DOOR — and it is universal, not a consent-region courtesy. Trust is
-          // the choice staying reachable: the Posts cut's footer carries a hidden anchor
-          // ([data-consent-open]); this script labels it, reveals it, and wires it to reopen the
-          // sheet for ANY visitor in ANY region, stored choice or not. A non-EEA visitor gets a real
-          // opt-out they were never offered before; an EEA visitor can reverse either answer. The
-          // auto-ask below keeps its narrow gates — the DOOR has none.
-          var doors = document.querySelectorAll("[data-consent-open]");
-          for (var i = 0; i < doors.length; i++) {
-            var a = doors[i];
-            if (!a.textContent) a.textContent = el.getAttribute("data-choice-label") || "privacy choice";
-            a.hidden = false;
-            var w = a.closest("[data-consent-door]"); if (w) w.hidden = false;
-            a.addEventListener("click", function (ev) { ev.preventDefault(); open(); });
-          }
-          // auto-ask: no stored CHOICE, not already dodged THIS visit, only where consent is
-          // legally asked, only on a content page
-          if (localStorage.getItem("consent")) return;
-          try { if (sessionStorage.getItem("consent-later")) return; } catch (_) {}
-          if (!document.getElementById("kernel")) return; // no kernel = not a content page (e.g. 404) — don't ask for consent on a dead end
-          // WHERE CONSENT IS LEGALLY ASKED — and a timezone is a PROXY for that, never the thing
-          // itself. `Europe/` carries almost all of the region list in the head, but not all of it:
-          // an EEA country can sit in another continent's zone entirely, and those visitors were
-          // DENIED by the regional default while never being offered the dialog — no path to
-          // consent at all. Twelve zones, measured, listed here with the country that owns them.
-          // The two lists are siblings: if the region array up there ever changes, this changes too.
-          var tz = Intl.DateTimeFormat().resolvedOptions().timeZone || "";
-          var asked = tz.indexOf("Europe/") === 0 || [
-            "Asia/Nicosia", "Asia/Famagusta",                              // Cyprus
-            "Atlantic/Canary",                                             // Spain — Canary Islands
-            "Atlantic/Azores", "Atlantic/Madeira",                         // Portugal
-            "Atlantic/Reykjavik",                                          // Iceland
-            "Arctic/Longyearbyen",                                         // Norway — Svalbard
-            "America/Guadeloupe", "America/Martinique", "America/Cayenne", // France — outermost
-            "Indian/Reunion", "Indian/Mayotte"                             //   regions; EU law applies
-          ].indexOf(tz) >= 0;
-          if (!asked) return;
-          // the first second belongs to the kernel; the question arrives on the second beat
-          setTimeout(open, 700);
-        } catch (_) {}
-      })();
-    </script>
+    <script is:inline set:html={CONSENT_JS} />
     )}
   </body>
 </html>

package/src/ConfirmSheet.astro

@@ -71,10 +71,15 @@ const { id, title, body, actionLabel, cancelLabel, destructive = false, ask = fa
         {title && <strong id={`${id}-t`}>{title}</strong>}
         <span id={`${id}-b`}>{body}</span>
       </div>
-      <button class:list={["confirm-act", { destructive, preferred: ask }]} id={`${id}-act`} value="confirm" autofocus={ask || undefined}>{actionLabel}</button>
+      {/* NO autofocus ATTRIBUTE, deliberately: with a fragment in the URL (/me#profile) Chrome
+           refuses to process the attribute at parse and prints a console warning on every load —
+           on a closed dialog, noise about a focus that was never going to happen. Focus is the
+           OPENER's job now, at showModal time: ask → the invitation (CONSENT_JS does it),
+           destructive → the cancel (the consumer does it). The genre decides, as before. */}
+      <button class:list={["confirm-act", { destructive, preferred: ask }]} id={`${id}-act`} value="confirm">{actionLabel}</button>
       {ask && <button class="confirm-act quiet" id={`${id}-cancel`} value={cancelValue} formnovalidate>{cancelLabel}</button>}
     </div>
-    {!ask && <button class="confirm-act confirm-cancel" id={`${id}-cancel`} value={cancelValue} formnovalidate autofocus>{cancelLabel}</button>}
+    {!ask && <button class="confirm-act confirm-cancel" id={`${id}-cancel`} value={cancelValue} formnovalidate>{cancelLabel}</button>}
   </form>
 </dialog>