@justai/cuts 0.3.0 → 0.3.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@justai/cuts",
-  "version": "0.3.0",
-  "description": "A persona's named parts \u2014 the page shell that holds them, and the cuts themselves.",
+  "version": "0.3.2",
+  "description": "A persona's named parts — the page shell that holds them, and the cuts themselves.",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",

package/src/Base.astro

@@ -61,19 +61,28 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
     <link rel="preconnect" href="https://api.justai.pro" crossorigin />
-    <!-- detail: reveal only after we've positioned at the Kernel — no scroll flash.
-         Gated behind .js so it's always visible if JS is off. -->
-    <!-- justai auth: capture the SSO token here, synchronously, BEFORE the scroll-spy rewrites the hash
-         to #kernel — otherwise it clobbers #auth_token before the deferred sdk.js can read it. -->
+    {/* justai auth: capture the SSO token here, synchronously, BEFORE anything else can touch the
+         hash. Its position in the head is LOAD-BEARING, not stylistic, because two later scripts
+         would otherwise take the token: the scroll-spy rewrites the hash to #kernel and CLOBBERS
+         #auth_token before the deferred sdk.js can read it; and the language picker copies the
+         current hash onto the next locale's URL (LangPicker), which would PROPAGATE the raw token
+         into a new page and into history. Capturing first defeats both. Move this and sign-in breaks
+         silently — no error, the visitor simply lands back signed out. */}
     <script is:inline>(function(){try{var h=location.hash||"";var m=h.match(/(?:^#|&)auth_token=([^&]+)/);if(m){localStorage.setItem("justai_token",decodeURIComponent(m[1]))}else if(/(?:^#|&)auth_signout=1\b/.test(h)){localStorage.removeItem("justai_token")}else{return}history.replaceState(null,"",location.pathname+location.search)}catch(e){}})();</script>
     <script is:inline>document.documentElement.classList.add("js")</script>
+    {/* Reveal only after a page marks itself ready — gated behind .js so the page is always visible
+         if JS is off, and no scroll flash before we position at the Kernel. This style is a TRAP as
+         much as a feature, and the warning must stay beside it: ANY page using this layout without a
+         kernel script that sets body.ready stays invisible FOREVER. The 404 is the page that keeps
+         falling into this — it carries its own inline body.classList.add("ready") for exactly this
+         reason. Nothing errors; the page is simply never shown. */}
     <style is:inline>html.js body{opacity:0}html.js body.ready{opacity:1}</style>
-    <!-- The locale list is INJECTED, never typed. It used to be a literal array here — a second
+    {/* The locale list is INJECTED, never typed. It used to be a literal array here — a second
          declaration beside src/i18n/index.ts, kept in agreement by hand, in the one place where
          being wrong is invisible: a locale missing from this list simply never auto-routes, and
          nothing anywhere goes red. The same shape in astro.config had already drifted (twelve
          listed while /it/ was live), which is why this one is wired to the real list instead of
-         being checked against it. -->
+         being checked against it. */}
     <script is:inline define:vars={{ supported: locales, def: defaultLocale }}>
       // Auto-route to the visitor's language: a saved choice wins; otherwise the browser
       // language on first visit. Only on the default (en) root — explicit /xx/ links are
@@ -130,7 +139,7 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
       rel="icon"
       href={favicon}
     />
-    <!-- PWA: Workbox service worker (precache + offline) + installable manifest -->
+    {/* PWA: Workbox service worker (precache + offline) + installable manifest */}
     <link rel="manifest" href="/manifest.webmanifest" />
     <link rel="apple-touch-icon" href="/icon-192.png" />
     {import.meta.env.DEV ? (
@@ -153,14 +162,14 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
         if ("serviceWorker" in navigator) addEventListener("load", () => navigator.serviceWorker.register("/sw.js"));
       </script>
     )}
-    <!-- Google Analytics 4 — anonymous (ad signals + personalization OFF), lazy-loaded after idle.
+    {/* Google Analytics 4 — anonymous (ad signals + personalization OFF), lazy-loaded after idle.
          analytics_storage granted: direct user counting (cookieless modeling needs high traffic to
          surface, so it shows nothing at low/launch volume).
 
          gaId comes through define:vars because this script runs in the BROWSER. An is:inline block
          has no access to component scope, so a bare `gaId` here would be undefined at runtime and
          every persona would report to a property that does not exist — silently, with no failed
-         request and no console error, which is the only kind of analytics bug nobody finds. -->
+         request and no console error, which is the only kind of analytics bug nobody finds. */}
     <script is:inline define:vars={{ gaId }}>
       window.dataLayer = window.dataLayer || [];
       function gtag() { dataLayer.push(arguments); }
@@ -169,7 +178,15 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
       // EEA + UK + CH: deny analytics until the visitor consents (the banner below grants it).
       gtag("consent", "default", { region: ["AT","BE","BG","HR","CY","CZ","DK","EE","FI","FR","DE","GR","HU","IE","IT","LV","LT","LU","MT","NL","PL","PT","RO","SK","SI","ES","SE","IS","LI","NO","GB","CH"], ad_storage: "denied", ad_user_data: "denied", ad_personalization: "denied", analytics_storage: "denied" });
       try { var cc0 = localStorage.getItem("consent"); if (cc0) gtag("consent", "update", { analytics_storage: cc0 }); } catch (e) {}
-      gtag("config", gaId, { cookie_expires: 60 * 60 * 24 * 60, /* two months — matches the GA data retention; the cookie must not outlive the data it labels (foundations/15) */ allow_google_signals: false, allow_ad_personalization_signals: false });
+      // page_title is PINNED to the title as it is at load, before anything can touch it. Only one
+      // persona mutates document.title today — time shows a live clock in the tab — and without this
+      // its analytics reports "13:32 · Amsterdam" as the page name instead of the page. For every
+      // other persona it captures the same string the title already has, so it costs nothing and
+      // removes a trap the next persona that animates its tab would otherwise walk into.
+      //
+      // Found by migration: it existed only in time, and the extraction dropped it silently. Nothing
+      // errored — the analytics would simply have been wrong from that day on.
+      gtag("config", gaId, { cookie_expires: 60 * 60 * 24 * 60, page_title: document.title, /* two months — matches the GA data retention; the cookie must not outlive the data it labels (foundations/15) */ allow_google_signals: false, allow_ad_personalization_signals: false });
       addEventListener("load", function () {
         (window.requestIdleCallback || function (f) { setTimeout(f, 1200); })(function () {
           var s = document.createElement("script");
@@ -182,8 +199,8 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
   </head>
   <body>
     <slot />
-    <!-- Consent banner — shown only to European-timezone visitors with no stored choice. The
-         Consent Mode region default already denies analytics for the EEA/UK until "Allow". -->
+    {/* Consent banner — shown only to European-timezone visitors with no stored choice. The
+         Consent Mode region default already denies analytics for the EEA/UK until "Allow". */}
     <div id="cc" class="cc" role="dialog" aria-label={t.chromePrivacy}>
       <div class="cc-card">
         <p class="cc-text">{t.consentText}</p>