@justai/cuts 0.3.2 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justai/cuts",
-  "version": "0.3.2",
+  "version": "0.5.0",
   "description": "A persona's named parts — the page shell that holds them, and the cuts themselves.",
   "license": "UNLICENSED",
   "repository": {
@@ -16,10 +16,13 @@
     "./Base.astro": "./src/Base.astro"
   },
   "peerDependencies": {
-    "astro": ">=5",
-    "@justai/ui": ">=0.2.0"
+    "@justai/ui": ">=0.2.0",
+    "astro": ">=5"
   },
   "publishConfig": {
     "access": "public"
+  },
+  "dependencies": {
+    "@justai/core": "^0.1.0"
   }
 }

package/src/Base.astro

@@ -26,6 +26,9 @@
  * The dictionaries. Same reason, stronger: the machinery is shared, the CONTENT is the persona's.
  */
 import { dir as dirOf } from "@justai/ui/locale";
+// The load-bearing behaviour is framework-free and lives in @justai/core, so `feed` (Next) injects the
+// SAME strings instead of hand-copying them. This binding just decides where they go in an Astro head.
+import { AUTH_CAPTURE_JS, JS_CLASS_JS, REVEAL_CSS } from "@justai/core";
 
 interface Props {
   lang: string;
@@ -40,8 +43,11 @@ interface Props {
   /** Defaults are the fleet majority, measured. Override when the persona genuinely differs. */
   themeDark?: string;
   themeLight?: string;
-  /** app.zone's property. justai.pro is its own apex and passes its own. */
-  gaId?: string;
+  /** app.zone's property by default. justai.pro passes its own. Pass `null` for a persona that runs
+   *  NO analytics at all — the whole GA block and the consent banner are then not rendered. The
+   *  privacy/terms sub-personas use this: the surface that proves it collects nothing by running
+   *  nothing. */
+  gaId?: string | null;
 }
 
 const {
@@ -68,15 +74,15 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
          current hash onto the next locale's URL (LangPicker), which would PROPAGATE the raw token
          into a new page and into history. Capturing first defeats both. Move this and sign-in breaks
          silently — no error, the visitor simply lands back signed out. */}
-    <script is:inline>(function(){try{var h=location.hash||"";var m=h.match(/(?:^#|&)auth_token=([^&]+)/);if(m){localStorage.setItem("justai_token",decodeURIComponent(m[1]))}else if(/(?:^#|&)auth_signout=1\b/.test(h)){localStorage.removeItem("justai_token")}else{return}history.replaceState(null,"",location.pathname+location.search)}catch(e){}})();</script>
-    <script is:inline>document.documentElement.classList.add("js")</script>
+    <script is:inline set:html={AUTH_CAPTURE_JS} />
+    <script is:inline set:html={JS_CLASS_JS} />
     {/* Reveal only after a page marks itself ready — gated behind .js so the page is always visible
          if JS is off, and no scroll flash before we position at the Kernel. This style is a TRAP as
          much as a feature, and the warning must stay beside it: ANY page using this layout without a
          kernel script that sets body.ready stays invisible FOREVER. The 404 is the page that keeps
          falling into this — it carries its own inline body.classList.add("ready") for exactly this
          reason. Nothing errors; the page is simply never shown. */}
-    <style is:inline>html.js body{opacity:0}html.js body.ready{opacity:1}</style>
+    <style is:inline set:html={REVEAL_CSS} />
     {/* The locale list is INJECTED, never typed. It used to be a literal array here — a second
          declaration beside src/i18n/index.ts, kept in agreement by hand, in the one place where
          being wrong is invisible: a locale missing from this list simply never auto-routes, and
@@ -170,6 +176,13 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
          has no access to component scope, so a bare `gaId` here would be undefined at runtime and
          every persona would report to a property that does not exist — silently, with no failed
          request and no console error, which is the only kind of analytics bug nobody finds. */}
+    {/* gaId can be null: a persona that measures NOTHING. Pass gaId={null} and the entire analytics
+        block below and the consent banner in the body are simply not rendered — no gtag, no cookie,
+        no request. The privacy/terms sub-personas run this way, and it is not an exception but their
+        character: the one surface that can prove it collects nothing by running nothing (doctrine 15).
+        The default stays app.zone's property, so every existing persona is unchanged — this costs the
+        ten that measure themselves exactly nothing. */}
+    {gaId && (
     <script is:inline define:vars={{ gaId }}>
       window.dataLayer = window.dataLayer || [];
       function gtag() { dataLayer.push(arguments); }
@@ -196,11 +209,15 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
         });
       });
     </script>
+    )}
   </head>
   <body>
     <slot />
     {/* Consent banner — shown only to European-timezone visitors with no stored choice. The
-         Consent Mode region default already denies analytics for the EEA/UK until "Allow". */}
+         Consent Mode region default already denies analytics for the EEA/UK until "Allow". Gated on
+         gaId with the analytics block above: a persona that runs no analytics has nothing to consent
+         to, so it renders no banner. */}
+    {gaId && (
     <div id="cc" class="cc" role="dialog" aria-label={t.chromePrivacy}>
       <div class="cc-card">
         <p class="cc-text">{t.consentText}</p>
@@ -246,5 +263,6 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
         } catch (_) {}
       })();
     </script>
+    )}
   </body>
 </html>