@justai/cuts 0.4.0 → 0.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justai/cuts",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "A persona's named parts — the page shell that holds them, and the cuts themselves.",
   "license": "UNLICENSED",
   "repository": {
@@ -16,10 +16,13 @@
     "./Base.astro": "./src/Base.astro"
   },
   "peerDependencies": {
-    "astro": ">=5",
-    "@justai/ui": ">=0.2.0"
+    "@justai/ui": ">=0.2.0",
+    "astro": ">=5"
   },
   "publishConfig": {
     "access": "public"
+  },
+  "dependencies": {
+    "@justai/core": "^0.1.0"
   }
 }

package/src/Base.astro

@@ -26,6 +26,9 @@
  * The dictionaries. Same reason, stronger: the machinery is shared, the CONTENT is the persona's.
  */
 import { dir as dirOf } from "@justai/ui/locale";
+// The load-bearing behaviour is framework-free and lives in @justai/core, so `feed` (Next) injects the
+// SAME strings instead of hand-copying them. This binding just decides where they go in an Astro head.
+import { AUTH_CAPTURE_JS, JS_CLASS_JS, REVEAL_CSS } from "@justai/core";
 
 interface Props {
   lang: string;
@@ -71,15 +74,15 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
          current hash onto the next locale's URL (LangPicker), which would PROPAGATE the raw token
          into a new page and into history. Capturing first defeats both. Move this and sign-in breaks
          silently — no error, the visitor simply lands back signed out. */}
-    <script is:inline>(function(){try{var h=location.hash||"";var m=h.match(/(?:^#|&)auth_token=([^&]+)/);if(m){localStorage.setItem("justai_token",decodeURIComponent(m[1]))}else if(/(?:^#|&)auth_signout=1\b/.test(h)){localStorage.removeItem("justai_token")}else{return}history.replaceState(null,"",location.pathname+location.search)}catch(e){}})();</script>
-    <script is:inline>document.documentElement.classList.add("js")</script>
+    <script is:inline set:html={AUTH_CAPTURE_JS} />
+    <script is:inline set:html={JS_CLASS_JS} />
     {/* Reveal only after a page marks itself ready — gated behind .js so the page is always visible
          if JS is off, and no scroll flash before we position at the Kernel. This style is a TRAP as
          much as a feature, and the warning must stay beside it: ANY page using this layout without a
          kernel script that sets body.ready stays invisible FOREVER. The 404 is the page that keeps
          falling into this — it carries its own inline body.classList.add("ready") for exactly this
          reason. Nothing errors; the page is simply never shown. */}
-    <style is:inline>html.js body{opacity:0}html.js body.ready{opacity:1}</style>
+    <style is:inline set:html={REVEAL_CSS} />
     {/* The locale list is INJECTED, never typed. It used to be a literal array here — a second
          declaration beside src/i18n/index.ts, kept in agreement by hand, in the one place where
          being wrong is invisible: a locale missing from this list simply never auto-routes, and
@@ -182,7 +185,12 @@ const localePath = (l: string) => (l === defaultLocale ? "/" : `/${l}/`);
     {gaId && (
     <script is:inline define:vars={{ gaId }}>
       window.dataLayer = window.dataLayer || [];
-      function gtag() { dataLayer.push(arguments); }
+      // gtag is put on WINDOW, not declared as `function gtag`, and this is load-bearing: `define:vars`
+      // wraps this inline script in an IIFE to scope the injected `gaId`, so a `function gtag` here
+      // would be trapped in that IIFE — and the consent banner's own inline script (in the body) calls
+      // gtag, giving "gtag is not defined" the moment a European visitor clicks Allow/Decline (the
+      // choice is never applied, the banner never closes). Global on window, both scripts see it.
+      window.gtag = window.gtag || function () { window.dataLayer.push(arguments); };
       gtag("js", new Date());
       gtag("consent", "default", { ad_storage: "denied", ad_user_data: "denied", ad_personalization: "denied", analytics_storage: "granted" });
       // EEA + UK + CH: deny analytics until the visitor consents (the banner below grants it).