@justai/cuts 0.3.1 → 0.3.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@justai/cuts",
-  "version": "0.3.1",
-  "description": "A persona's named parts \u2014 the page shell that holds them, and the cuts themselves.",
+  "version": "0.3.2",
+  "description": "A persona's named parts — the page shell that holds them, and the cuts themselves.",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",

package/src/Base.astro

@@ -61,19 +61,28 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
     <link rel="preconnect" href="https://api.justai.pro" crossorigin />
-    <!-- detail: reveal only after we've positioned at the Kernel — no scroll flash.
-         Gated behind .js so it's always visible if JS is off. -->
-    <!-- justai auth: capture the SSO token here, synchronously, BEFORE the scroll-spy rewrites the hash
-         to #kernel — otherwise it clobbers #auth_token before the deferred sdk.js can read it. -->
+    {/* justai auth: capture the SSO token here, synchronously, BEFORE anything else can touch the
+         hash. Its position in the head is LOAD-BEARING, not stylistic, because two later scripts
+         would otherwise take the token: the scroll-spy rewrites the hash to #kernel and CLOBBERS
+         #auth_token before the deferred sdk.js can read it; and the language picker copies the
+         current hash onto the next locale's URL (LangPicker), which would PROPAGATE the raw token
+         into a new page and into history. Capturing first defeats both. Move this and sign-in breaks
+         silently — no error, the visitor simply lands back signed out. */}
     <script is:inline>(function(){try{var h=location.hash||"";var m=h.match(/(?:^#|&)auth_token=([^&]+)/);if(m){localStorage.setItem("justai_token",decodeURIComponent(m[1]))}else if(/(?:^#|&)auth_signout=1\b/.test(h)){localStorage.removeItem("justai_token")}else{return}history.replaceState(null,"",location.pathname+location.search)}catch(e){}})();</script>
     <script is:inline>document.documentElement.classList.add("js")</script>
+    {/* Reveal only after a page marks itself ready — gated behind .js so the page is always visible
+         if JS is off, and no scroll flash before we position at the Kernel. This style is a TRAP as
+         much as a feature, and the warning must stay beside it: ANY page using this layout without a
+         kernel script that sets body.ready stays invisible FOREVER. The 404 is the page that keeps
+         falling into this — it carries its own inline body.classList.add("ready") for exactly this
+         reason. Nothing errors; the page is simply never shown. */}
     <style is:inline>html.js body{opacity:0}html.js body.ready{opacity:1}</style>
-    <!-- The locale list is INJECTED, never typed. It used to be a literal array here — a second
+    {/* The locale list is INJECTED, never typed. It used to be a literal array here — a second
          declaration beside src/i18n/index.ts, kept in agreement by hand, in the one place where
          being wrong is invisible: a locale missing from this list simply never auto-routes, and
          nothing anywhere goes red. The same shape in astro.config had already drifted (twelve
          listed while /it/ was live), which is why this one is wired to the real list instead of
-         being checked against it. -->
+         being checked against it. */}
     <script is:inline define:vars={{ supported: locales, def: defaultLocale }}>
       // Auto-route to the visitor's language: a saved choice wins; otherwise the browser
       // language on first visit. Only on the default (en) root — explicit /xx/ links are
@@ -130,7 +139,7 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
       rel="icon"
       href={favicon}
     />
-    <!-- PWA: Workbox service worker (precache + offline) + installable manifest -->
+    {/* PWA: Workbox service worker (precache + offline) + installable manifest */}
     <link rel="manifest" href="/manifest.webmanifest" />
     <link rel="apple-touch-icon" href="/icon-192.png" />
     {import.meta.env.DEV ? (
@@ -153,14 +162,14 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
         if ("serviceWorker" in navigator) addEventListener("load", () => navigator.serviceWorker.register("/sw.js"));
       </script>
     )}
-    <!-- Google Analytics 4 — anonymous (ad signals + personalization OFF), lazy-loaded after idle.
+    {/* Google Analytics 4 — anonymous (ad signals + personalization OFF), lazy-loaded after idle.
          analytics_storage granted: direct user counting (cookieless modeling needs high traffic to
          surface, so it shows nothing at low/launch volume).
 
          gaId comes through define:vars because this script runs in the BROWSER. An is:inline block
          has no access to component scope, so a bare `gaId` here would be undefined at runtime and
          every persona would report to a property that does not exist — silently, with no failed
-         request and no console error, which is the only kind of analytics bug nobody finds. -->
+         request and no console error, which is the only kind of analytics bug nobody finds. */}
     <script is:inline define:vars={{ gaId }}>
       window.dataLayer = window.dataLayer || [];
       function gtag() { dataLayer.push(arguments); }
@@ -190,8 +199,8 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
   </head>
   <body>
     <slot />
-    <!-- Consent banner — shown only to European-timezone visitors with no stored choice. The
-         Consent Mode region default already denies analytics for the EEA/UK until "Allow". -->
+    {/* Consent banner — shown only to European-timezone visitors with no stored choice. The
+         Consent Mode region default already denies analytics for the EEA/UK until "Allow". */}
     <div id="cc" class="cc" role="dialog" aria-label={t.chromePrivacy}>
       <div class="cc-card">
         <p class="cc-text">{t.consentText}</p>