@justai/cuts 0.3.1 → 0.4.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@justai/cuts",
-  "version": "0.3.1",
-  "description": "A persona's named parts \u2014 the page shell that holds them, and the cuts themselves.",
+  "version": "0.4.0",
+  "description": "A persona's named parts — the page shell that holds them, and the cuts themselves.",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",

package/src/Base.astro

@@ -40,8 +40,11 @@ interface Props {
   /** Defaults are the fleet majority, measured. Override when the persona genuinely differs. */
   themeDark?: string;
   themeLight?: string;
-  /** app.zone's property. justai.pro is its own apex and passes its own. */
-  gaId?: string;
+  /** app.zone's property by default. justai.pro passes its own. Pass `null` for a persona that runs
+   *  NO analytics at all — the whole GA block and the consent banner are then not rendered. The
+   *  privacy/terms sub-personas use this: the surface that proves it collects nothing by running
+   *  nothing. */
+  gaId?: string | null;
 }
 
 const {
@@ -61,19 +64,28 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
     <link rel="preconnect" href="https://api.justai.pro" crossorigin />
-    <!-- detail: reveal only after we've positioned at the Kernel — no scroll flash.
-         Gated behind .js so it's always visible if JS is off. -->
-    <!-- justai auth: capture the SSO token here, synchronously, BEFORE the scroll-spy rewrites the hash
-         to #kernel — otherwise it clobbers #auth_token before the deferred sdk.js can read it. -->
+    {/* justai auth: capture the SSO token here, synchronously, BEFORE anything else can touch the
+         hash. Its position in the head is LOAD-BEARING, not stylistic, because two later scripts
+         would otherwise take the token: the scroll-spy rewrites the hash to #kernel and CLOBBERS
+         #auth_token before the deferred sdk.js can read it; and the language picker copies the
+         current hash onto the next locale's URL (LangPicker), which would PROPAGATE the raw token
+         into a new page and into history. Capturing first defeats both. Move this and sign-in breaks
+         silently — no error, the visitor simply lands back signed out. */}
     <script is:inline>(function(){try{var h=location.hash||"";var m=h.match(/(?:^#|&)auth_token=([^&]+)/);if(m){localStorage.setItem("justai_token",decodeURIComponent(m[1]))}else if(/(?:^#|&)auth_signout=1\b/.test(h)){localStorage.removeItem("justai_token")}else{return}history.replaceState(null,"",location.pathname+location.search)}catch(e){}})();</script>
     <script is:inline>document.documentElement.classList.add("js")</script>
+    {/* Reveal only after a page marks itself ready — gated behind .js so the page is always visible
+         if JS is off, and no scroll flash before we position at the Kernel. This style is a TRAP as
+         much as a feature, and the warning must stay beside it: ANY page using this layout without a
+         kernel script that sets body.ready stays invisible FOREVER. The 404 is the page that keeps
+         falling into this — it carries its own inline body.classList.add("ready") for exactly this
+         reason. Nothing errors; the page is simply never shown. */}
     <style is:inline>html.js body{opacity:0}html.js body.ready{opacity:1}</style>
-    <!-- The locale list is INJECTED, never typed. It used to be a literal array here — a second
+    {/* The locale list is INJECTED, never typed. It used to be a literal array here — a second
          declaration beside src/i18n/index.ts, kept in agreement by hand, in the one place where
          being wrong is invisible: a locale missing from this list simply never auto-routes, and
          nothing anywhere goes red. The same shape in astro.config had already drifted (twelve
          listed while /it/ was live), which is why this one is wired to the real list instead of
-         being checked against it. -->
+         being checked against it. */}
     <script is:inline define:vars={{ supported: locales, def: defaultLocale }}>
       // Auto-route to the visitor's language: a saved choice wins; otherwise the browser
       // language on first visit. Only on the default (en) root — explicit /xx/ links are
@@ -130,7 +142,7 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
       rel="icon"
       href={favicon}
     />
-    <!-- PWA: Workbox service worker (precache + offline) + installable manifest -->
+    {/* PWA: Workbox service worker (precache + offline) + installable manifest */}
     <link rel="manifest" href="/manifest.webmanifest" />
     <link rel="apple-touch-icon" href="/icon-192.png" />
     {import.meta.env.DEV ? (
@@ -153,14 +165,21 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
         if ("serviceWorker" in navigator) addEventListener("load", () => navigator.serviceWorker.register("/sw.js"));
       </script>
     )}
-    <!-- Google Analytics 4 — anonymous (ad signals + personalization OFF), lazy-loaded after idle.
+    {/* Google Analytics 4 — anonymous (ad signals + personalization OFF), lazy-loaded after idle.
          analytics_storage granted: direct user counting (cookieless modeling needs high traffic to
          surface, so it shows nothing at low/launch volume).
 
          gaId comes through define:vars because this script runs in the BROWSER. An is:inline block
          has no access to component scope, so a bare `gaId` here would be undefined at runtime and
          every persona would report to a property that does not exist — silently, with no failed
-         request and no console error, which is the only kind of analytics bug nobody finds. -->
+         request and no console error, which is the only kind of analytics bug nobody finds. */}
+    {/* gaId can be null: a persona that measures NOTHING. Pass gaId={null} and the entire analytics
+        block below and the consent banner in the body are simply not rendered — no gtag, no cookie,
+        no request. The privacy/terms sub-personas run this way, and it is not an exception but their
+        character: the one surface that can prove it collects nothing by running nothing (doctrine 15).
+        The default stays app.zone's property, so every existing persona is unchanged — this costs the
+        ten that measure themselves exactly nothing. */}
+    {gaId && (
     <script is:inline define:vars={{ gaId }}>
       window.dataLayer = window.dataLayer || [];
       function gtag() { dataLayer.push(arguments); }
@@ -187,11 +206,15 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
         });
       });
     </script>
+    )}
   </head>
   <body>
     <slot />
-    <!-- Consent banner — shown only to European-timezone visitors with no stored choice. The
-         Consent Mode region default already denies analytics for the EEA/UK until "Allow". -->
+    {/* Consent banner — shown only to European-timezone visitors with no stored choice. The
+         Consent Mode region default already denies analytics for the EEA/UK until "Allow". Gated on
+         gaId with the analytics block above: a persona that runs no analytics has nothing to consent
+         to, so it renders no banner. */}
+    {gaId && (
     <div id="cc" class="cc" role="dialog" aria-label={t.chromePrivacy}>
       <div class="cc-card">
         <p class="cc-text">{t.consentText}</p>
@@ -237,5 +260,6 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
         } catch (_) {}
       })();
     </script>
+    )}
   </body>
 </html>