studio-engine 0.129.0 → 0.131.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed5be658c4ba3547da2294995bc7c13e7181bccbd5710fd07d84c7fb0af95a2c
-  data.tar.gz: d48d2fbebaee5b7e33a22c16bc2f6d40b1afc161d0dacb6eb42d51a8e36cd4fe
+  metadata.gz: f090aa3b8a00d7e7a62e7395fdc02fff3c0fdf4063350a492e1e835932dc5b26
+  data.tar.gz: 6d2ae853a4bb64281147c1a67721d93e1a8c38b5d3fb43e6897df85c7be964c7
 SHA512:
-  metadata.gz: 99e6c74a4c11320449ee3b58d89b56712067f02bc6b2228d602f4ec942b06617b77960e05d8d29dc03dda95e5c92868d4da18bd67922494fbe84abb40b6e308f
-  data.tar.gz: 353b2199a4a651ee65a0d00c448c8273731b9a4bebbb5c5eff97fe97ba57177ae8f1a47ab0fa6d4b9f2f99856c46a8992c62c84d4319db28116b0dd557c05adf
+  metadata.gz: 7cc84fc8fad2d0b18b53e41b96e8d11bc878d8cdad732bc4a02b3581466fdafb927f3fbec54984e0ca04c839c85417008bef31f6efe21b347ebe4fce7ad7672b
+  data.tar.gz: 2b005e75062ef195f1178074f97efc738d798e69ee9dccbfb58cd88f1155760f4cbc1712da6bbd8de624673fce6d76a2f0982a0b8b3a58d615add5fc2f626c87

data/CHANGELOG.md

@@ -4,6 +4,198 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+## 0.131.0 — 2026-11-05
+
+### Added
+
+- **`.studio-border-glow--clear`.** The border glow on a clear button: no fill, only the
+  moving rainbow ring and its halo, with the heading ink as the label (16:1 light, 18:1 dark,
+  measured). `<button class="btn studio-border-glow studio-border-glow--clear">`. Under
+  reduced motion the ring and halo of every `.studio-border-glow` stand still.
+- **The loader family: the eight ways a page says wait, in one place.** From the
+  reel Alex McRitchie shared (task `engine-loader-family`). `studio_loader` takes
+  three plain styles that draw no icon: `style: :spinner`, `style: :dots` and
+  `style: :bar` (a progressbar; `percent:` is its value, and with none it sweeps).
+  They wrap the canonical `.spinner`, `.loading-dots` and `.progress-meter` rules,
+  so there is one set of rules; an app's own `config.loader` still refuses them.
+  New: `studio_skeleton` (`:lines`, `:avatar`, `:card`, `:media`; aria-busy, shapes
+  hidden from assistive tech, a shimmer that stops under reduced motion),
+  `studio_infinite_scroll` (the next page loads in a Turbo frame as the list's end
+  nears, "Load more" stays visible, and a polite status line counts what came) and
+  `studio_pull_to_refresh` (phones with touch only). `/admin/style` has a Loaders
+  section with all eight, and a live infinite scroll from an admin-only demo feed
+  (`/admin/style/loaders_feed`). Busy buttons can show their busy words with
+  `data-loader-busy`. Docs: `docs/LOADER.md`, "The family".
+- **Agent replies show a small, safe Markdown subset.** In `studio/agent_chat`, an agent
+  turn's `**bold**`, `*italics*`, `` `code` ``, http(s) links, `- ` and `1. ` lists and
+  line breaks render as such, and a leading `> ` is dropped. The nodes are built with
+  `createElement` and text nodes, never HTML; any other markup, and any link that is not
+  http or https, shows as its own characters. A visitor's words stay plain text. Detail:
+  `docs/AGENT_CHAT.md`, "The page's script".
+- **A spotlight style for the carousel: `studio/_carousel`, `style: :spotlight`.** The
+  same carousel, arrows, dots and keys, but each slide snaps to the centre. The centred
+  slide is full size and colour, with an optional `caption:` line under it (a callable on
+  the item); its neighbours are smaller (0.75), faded and grey, and the next ones peek at
+  the edges. An arrow or key moves one slide, and every slide gets a dot. Where the browser
+  has scroll-driven animations (`animation-timeline: view()`), each slide's own view
+  timeline drives the look, so it follows the finger; elsewhere the controller marks the
+  centred slide `data-current` and CSS transitions it. Reduced motion scales and greys
+  nothing: the neighbours are only dimmed. An unknown `style:` raises. Specimen on
+  `/admin/style`, Tricks.
+- **Talk to an agent in a modal: `studio/agent_chat/_talk_modal`.** Render it once on a page,
+  then mark any link with `studio_talk_to_agent_link(label, href:, soul:, topic:, opener:)`. A
+  click opens the shared agent chat in a card on the page-scoped modal host and sends the
+  opener as the visitor's first message once the thread loads, so the agent is already
+  answering while the card opens. A new answer types itself in. It is the same chat and the
+  same hub thread as `studio/agent_chat/chat`, not a second one. The opener goes once per soul
+  and topic per tab. A modified click, a page with no modal, or a viewer
+  `agent_chat_allowed` refuses follows the link's `href`. The chat takes two new section
+  attributes, `data-agent-chat-opener` (with `-opener-key`) and `data-agent-chat-reveal`, and
+  the partial takes `compact: true`. Detail: `docs/AGENT_CHAT.md`, "Talk to an agent in a
+  modal".
+- **A crumb trail on the page header, from one parent map.** `studio/_page_header` takes
+  `crumbs:` (the page's ancestors, root first) and `crumb_label:`. The trail sits above the
+  title: muted ancestor links, the page itself bold, a chevron between. Below 40rem it gives
+  way to one "‹ Parent" link. An app names each parent page once in `Studio.crumbs.draw`
+  (`page :deployments, "Deployments", :deployments_path, parent: :admin`), and a view calls
+  `studio_crumbs(:key)` or `studio_crumbs(parent: :key)`. The row also takes `links:`, the
+  page's other links on a line at its foot that sticks with it, and renders `actions_html`
+  after the tabs when it has both. Detail: `docs/PAGE_HEADER.md`.
+- **The gliding pill.** The page header's open tab is one pill, anchored by CSS anchor
+  positioning to the tab with `aria-current`, so it glides to the next tab when the scroll spy
+  or a click moves `aria-current`. No script measures it. Reduced motion jumps. A browser
+  without anchor positioning keeps each tab's own fill.
+
+- **A carousel standard for the apps: `studio/_carousel`.** Render it as a layout, with
+  `label:` and `items:`, and the block draws each slide, so a slide is any block content.
+  The track is a native scroll-snap row: a swipe, a trackpad and a focused link move it with
+  no script. A wide row shows `per_view:` slides (default 3), a medium row up to two and a
+  phone one, each with a sliver of the next; the widths come from container queries on the
+  region, not the window. The lazy `carousel` controller adds the edge fade, arrows that
+  set `aria-disabled` at an end, dots that hide past the last stop, the arrow keys with Home
+  and End, and a polite status line after a press. It follows the APG carousel pattern:
+  a labelled region with `aria-roledescription="carousel"`, and each slide a labelled
+  group (`slide_label:` names it from its item). It honours `prefers-reduced-motion`, and
+  its arrows take the card fill, so they are glass under the glass surfaces. Until the
+  controller connects, the controls stay hidden and the row keeps a thin scrollbar. New
+  classes: `carousel`, `carousel-track`, `carousel-slide`, `carousel-controls`,
+  `carousel-dots`, `carousel-dot`, `carousel-arrows` and `carousel-button`. `/admin/style`
+  shows it under Tricks.
+
+### Changed
+
+- **Back plays the app's page move the other way.** Browser Back (a Turbo restore that Turbo
+  marks `back`, or a full load that traverses to an earlier entry) and a click on a link with
+  `data-page-transition-back` (every ancestor crumb and the phone's parent link) play the
+  reverse direction in the same style: a `:left` slide goes back as `slide-right`, an
+  `:unfold` with `:right` as `unfold-right`. Forward keeps the app's own direction. Detail:
+  `docs/PAGE_TRANSITIONS.md`, "Back".
+- **The page header's title is the type scale's h2 from 40rem** (30px, weight 800), Alex
+  McRitchie's "H2 header"; a phone keeps 1.5x the base. It is still the page's one `h1`.
+
+### Fixed
+
+- **Review follow-ups on the sidebar, the carousel and the page header** (/tasks/engine-ui-polish-follow-ups).
+  The link sidebar's focus ring (its rows, close button, Log out, trigger and geo rows) is
+  `ring-primary-ink`, a new ring colour from the theme's primary ink: measured 5.4 to 8.9:1
+  beside every surface in dark, light and glass on five palettes, from 1.3 to 2.0:1 for
+  `ring-primary/40`. A carousel arrow or key that goes nowhere scrolls and announces nothing;
+  keys inside a slider, listbox, combobox, tab list, other arrow-key widget or nested carousel
+  stay theirs; and the focusable track is a group named "<label> slides". The page header row
+  is now always a `<div>`: with tabs, the tabs are their own `<nav>` named by `label`, beside
+  the crumb and links navs, so no landmark nests in another (a host test that found the row by
+  `nav[aria-label=…]` now finds the tabs). The `/admin/style` specimen adds no landmark.
+  The current link under the title is bold as well as coloured, and the pill's track sets
+  `anchor-scope`. `studio_crumbs` with a key the map lacks still raises in development and
+  test; elsewhere it logs to ErrorLog and draws no trail, not a 500. The dead redirect guard
+  in `studio/page_transitions` is gone.
+- **`/admin/style`: Tricks is second, and nothing in the header is cut off.** The sections and
+  their pills run Theme, Tricks, Loaders, Modals, Tasks, Components (a host's own modals still
+  follow Modals). The tab scroller gives its pills 4px of room on every side, so their shadow, lit
+  edge and focus ring show, and the last pill's right edge too; phones still scroll sideways.
+  Each specimen card has one Copy (the snippet's, or the class name's when there is no
+  snippet), and the code wraps clear of it.
+- **The talk modal's opener is never dropped.** A visitor who sent a message before the
+  thread first loaded lost the opener: `studio/agent_chat` marked it sent, then the
+  post returned early because the visitor's send was in flight. Now a send made
+  before the load posts the opener first, then the visitor's words; a send made while
+  the opener is in flight waits for it; and the tab remembers the opener only as its
+  POST starts, forgetting it if the POST fails. It is never sent twice.
+- **`e2e/talk_to_agent.spec.js`'s modified-click spec no longer flakes.** It waited for
+  the new tab a Ctrl+click opens, which on CI's headless Linux Chromium stayed at
+  `about:blank` (it read "blank", and a wait for its URL timed out), so it measured the
+  browser rather than the modal. It now asserts what the modal owes a modified click:
+  the click is not prevented (the browser follows the `href`) and no card opens.
+- **A signup that cannot send its email no longer fails silently.** `RegistrationsController#create`
+  ended in a `rescue StandardError` that logged nothing and rendered `registrations/new`. On a
+  passwordless app `@user` was never set, so a failed link mint or mail raised `NoMethodError` on
+  nil in that view, and no ErrorLog row named the first failure. Now a passwordless failure is
+  logged through `rescue_and_log` and redirects to `/signup` with one friendly alert for every
+  address, so it reveals nothing about which emails have accounts. The account is still created
+  only when the link is used. A password signup re-renders the form on a validation error and
+  writes no ErrorLog row. A POST with no `user` params gets the form too, not a
+  `ParameterMissing`. Any other raise is logged once and goes to the catch-all. The rescue no
+  longer names the unsaved user as its target: ErrorLog's `belongs_to` autosaved it, which ran the
+  failing save again inside the logger. That second raise skipped the logged mark, so the
+  catch-all wrote the same failure twice.
+- **`rescue_and_log` writes one ErrorLog row per failure, also for an unsaved target.** It
+  linked `target:` with ErrorLog's `belongs_to`, which saves a new record. With an unsaved
+  record, the logger ran the failing save a second time. That raise skipped the logged mark,
+  so the catch-all wrote the same failure again, and a save that could pass created the
+  record. Now an unsaved target or parent is named on the row by its slug (else
+  `unsaved User`) and not linked. This covers the SSO, wallet and link sign-ups and the theme save. When the
+  ErrorLog write itself fails, in `rescue_and_log` or in the catch-all, `Rails.logger.error`
+  records both errors. `rescue_and_log` still raises the original error, and the catch-all
+  still gives its friendly reply. Before, the logger's error replaced both.
+- **`POST /magic_link` answers a failed mint or mail the same way for every address.** The
+  raise went to the catch-all: "Something went wrong" on the home page, or a JSON 500. Now
+  the failure is logged once and the visitor goes back to `/login` with one alert. JSON gets
+  `503` with `{ success: false, error: "delivery_failed", message: … }`: the input was
+  fine and a retry can work, so it is not a 4xx. The body does not carry the internal
+  message, and the action never looks an account up, so it reveals nothing about which
+  emails have accounts. `Studio::MagicLinkIssuing::DELIVERY_FAILED` holds the words.
+
+## 0.130.0 — 2026-11-05
+
+### Added
+
+- **Section headers that stack under the page header: `studio/_section_header`.** Render it
+  as the first child of a `<section>`. The title sticks directly under the page row, takes a
+  bar (solid in light and dark, glass under glass), and the next section's header takes its
+  place, by CSS sticky and no scroll script. `/admin/style` uses it on every section,
+  including a host's own. It joins the pinned stack as one layer, `section`: a new
+  `data-pin-section`, and `--pin-section-top`, `-h` and `-bottom`. Only the stuck header
+  counts, so `--pin-stack-bottom` and a table's sticky header sit under it. New classes:
+  `section-header`, `section-target` and `section-subtarget`, which
+  replace a hand-written `scroll-margin-top`. The publisher now reads the layers once more after
+  a settle and after a layer's top moves, so a layer under a layer does not keep a stale line.
+  Detail: `docs/PAGE_HEADER.md`.
+### Changed
+
+- **A lit button's gradient centers on its own colour.** Every lit variant steps lightness 0.06 up
+  and 0.06 down from its fill, with chroma and hue unchanged, so the painted midpoint is the token.
+  The lit primary now centers on `--color-cta`, the violet a `text-primary` word paints, instead of
+  sitting darker and more saturated. White on the default primary is about 3.1:1 at the midpoint;
+  Alex McRitchie accepted that so the button and the brand word read as one purple. The semantic
+  fills still hold 4.5:1 there. `/lab/hero_button` shows a `text-primary` word beside the button.
+
+- **Tricks starts with the buttons, then what you can add to them.** A new Button tricks group
+  sits directly under Buttons: rotating edge glow, border glow, sheen, pulse, fizz, hold to confirm,
+  confetti burst and cannons. Each sits on a real `.btn` or fires from one, with its code to copy.
+  The other groups keep their order, with one short sentence each at most.
+- **`.studio-team-glow` is now `.edge-rotate-glow`, with `--edge-rotate-glow-*` knobs.** The old class
+  and knobs are a deprecated alias and paint the same, so no host has to change.
+- **Fizz works around any button.** `render layout: "studio/fizz", locals: { seed: "save" }` wraps a
+  button in a `.fizz-stack`. The hold button's markup and selectors are unchanged. The only tie was
+  the `.hold-stack` selector.
+- **Trial: a dark, full-size lit button's fill drops from 0.94 to 0.85 alpha** (`--lit-fill-alpha`).
+
+### Fixed
+
+- **The button tricks keep a lit button lit.** A lit button's `::after` closed the hole in the glow's
+  bloom, which washed its whole face. The sheen clipped the top highlight, and the pulse dropped the
+  lit shadow. `.studio-border-glow` on a button no longer ends its halo on a hard box edge.
+
 ## 0.129.0 — 2026-11-05
 
 ### Changed

data/README.md

@@ -31,7 +31,7 @@ resolved.
 ## What It Provides
 
 - **Authentication**: Passwordless magic-link auth, optional password auth, Google OAuth via OmniAuth (ships ready: strategy, default `User.from_omniauth` and a setup modal until the OAuth client is set; docs/GOOGLE_AUTH_SETUP.md), Solana wallet sign-in, and optional one-way SSO patterns
-- **Error handling**: `Studio::ErrorHandling` concern with `rescue_and_log`, `ErrorLog` model with `capture!`, error log viewer at `/error_logs`
+- **Error handling**: `Studio::ErrorHandling` concern with `rescue_and_log`, `ErrorLog` model with `capture!`, error log viewer at `/error_logs`. `rescue_and_log` writes one row per failure: an unsaved `target:` or `parent:` is named on the row by its slug (else `unsaved User`), never linked, so the logger never saves it. If the row itself cannot be written, the original error still raises and `Rails.logger.error` records both.
 - **Session drift**: every page carries a session stamp and loads `window.StudioSession`, which notices when another tab signs in or out, the session expires, or the server revokes it; `session:changed` / `session:mismatch` events, cross-tab sync, an identity-source plug-in interface, and `expectChange` holds for deliberate switches. The rehydrate endpoint (`GET /session/state`) is opt-in. See [`docs/SESSION_DRIFT.md`](docs/SESSION_DRIFT.md).
 - **Theme system**: Dynamic CSS custom properties generated from 7 role colors (primary, dark, light, success, accent, warning, danger). Dark/light mode toggle. Admin theme editor at `/admin/theme`.
 - **UI primitives**: Shared component partials and CSS primitives such as `components/emoji_swap` for nav/sidebar emoji hover transitions.
@@ -184,7 +184,9 @@ form only when `:password` is enabled and the User has `authenticate`
 sign-in-link form when `:magic_link` is enabled, and the Google button only with
 `:google`. A passwordless signup stores nothing from the form: it mails a link,
 and using the link creates the account. So `registration_params`' `:name` shows a
-Name field only on a password app.
+Name field only on a password app. If the link cannot be minted or mailed, the
+failure is logged to ErrorLog and the visitor goes back to `/signup` with one
+alert, the same for every address.
 
 `POST /login`, the password exchange, is drawn only when `auth_methods` includes
 `:password`. A passwordless app answers it with 404 for every address, so it
@@ -242,7 +244,7 @@ Rails.application.routes.draw do
 end
 ```
 
-This draws the enabled auth routes (`/login`, `/signup`, `/logout`, `POST /magic_link` to request a link, `GET`/`POST /l/:token` for the link itself, Solana routes), OAuth callbacks, optional SSO routes, `/error_logs`, and `/admin/theme`. Set `Studio.draw_geo_routes = true` to add the geo manager (`/admin/geo`) and its public probe (`/geo/check`) — off by default because turf-monster owns those helper names until its adoption lands. Magic-link emails point at the inert `GET /l/:token` confirmation page; the single-use token is burned only by the CSRF-protected `POST` to `link_consume_path`.
+This draws the enabled auth routes (`/login`, `/signup`, `/logout`, `POST /magic_link` to request a link, `GET`/`POST /l/:token` for the link itself, Solana routes), OAuth callbacks, optional SSO routes, `/error_logs`, and `/admin/theme`. Set `Studio.draw_geo_routes = true` to add the geo manager (`/admin/geo`) and its public probe (`/geo/check`) — off by default because turf-monster owns those helper names until its adoption lands. If `POST /magic_link` cannot mint or mail the link, it logs the failure and answers the same for every address: the login page with one alert, or a `503` with `{ success: false, error: "delivery_failed", message: … }` for JSON. Magic-link emails point at the inert `GET /l/:token` confirmation page; the single-use token is burned only by the CSRF-protected `POST` to `link_consume_path`.
 
 Set `Studio.draw_session_routes = true` to add the session-drift rehydrate endpoint (`GET /session/state`) — off by default because it inherits the host's filters, which an app should check first ([`docs/SESSION_DRIFT.md`](docs/SESSION_DRIFT.md)).
 
@@ -252,7 +254,7 @@ Set `Studio.draw_survey_routes = true` to add the public survey pages (`/surveys
 
 **Magic links need the `studio_links` table.** Install it with `bin/rails studio_engine:install:migrations && bin/rails db:migrate` (install all of them) before enabling `:magic_link` — never by hand-copying the migration, which collides with the task's own copy on `class CreateStudioLinks`. Without the table, the first sign-in raises `Studio::Link::MissingTable`.
 
-Set `Studio.agent_chat_souls = %w[alex]` to add the shared agent chat's proxy (`POST /agent_chat/messages`, `GET /agent_chat/turns`), which forwards to the McRitchie Studio hub with the app's `AGENT_CHAT_TOKEN`; then `render "studio/agent_chat/chat", soul: "alex", name: "Alex", portrait: ...` on any page, with `voice: true` for hold to talk in the composer ([`docs/AGENT_CHAT.md`](docs/AGENT_CHAT.md)).
+Set `Studio.agent_chat_souls = %w[alex]` to add the shared agent chat's proxy (`POST /agent_chat/messages`, `GET /agent_chat/turns`), which forwards to the McRitchie Studio hub with the app's `AGENT_CHAT_TOKEN`; then `render "studio/agent_chat/chat", soul: "alex", name: "Alex", portrait: ...` on any page, with `voice: true` for hold to talk in the composer ([`docs/AGENT_CHAT.md`](docs/AGENT_CHAT.md)). To open that chat in a modal from any button, render `studio/agent_chat/talk_modal` once and mark the buttons with `studio_talk_to_agent_link` ([`docs/AGENT_CHAT.md`](docs/AGENT_CHAT.md), "Talk to an agent in a modal").
 
 In non-production local requests, this also draws `/_studio/local_emails`, a local email inbox for agent/worktree proof flows. Set `LOCAL_EMAIL_CAPTURE=1` or run with `AGENT_WORKTREE=1` to record outbox rows without sending real email.
 
@@ -290,15 +292,55 @@ actions; the engine supplies only the banner.
 
 ### The page header — `studio/_page_header`
 
-An admin page's title: a plain header at rest, a bar once stuck under the navbar,
-in the pinned stack so a table's sticky header sits under it
+An admin page's title: a crumb trail from the app's one parent map (`Studio.crumbs`,
+`studio_crumbs`) above an h2-size title, tabs with a gliding pill and one action on the right,
+and the page's other links on a line under it. A plain header at rest, a bar once stuck under
+the navbar, in the pinned stack so a table's sticky header sits under it
 ([`docs/PAGE_HEADER.md`](docs/PAGE_HEADER.md)).
 
+```erb
+<%= render "studio/page_header", title: "Deployments", crumbs: studio_crumbs(:deployments),
+      label: "Views", tabs: [{ label: "Board", href: deployments_path, current: "page" }],
+      actions_html: link_to("New Task", new_task_path, class: "btn btn-sm btn-primary"),
+      links: [{ label: "Epics", href: epics_path }] %>
+```
+
+### The section header — `studio/_section_header`
+
+A section's title that sticks under the page row until the next section's takes its place,
+with a bar once stuck ([`docs/PAGE_HEADER.md`](docs/PAGE_HEADER.md#the-section-header)).
+
 ```erb
 <%= render "studio/page_header", title: "Models", meta: "v1.2.3", label: "Models",
       tabs: [{ label: "Users", href: users_path, current: "page" }, { label: "Teams", href: teams_path }] %>
 ```
 
+### The carousel — `studio/_carousel`
+
+The apps' standard for a set too long to grid: a swipeable scroll-snap row with
+arrows, dots and arrow keys, a peek of the next slide, and an edge fade. Render it
+as a layout; the block draws each slide. `per_view:` is the wide row's count
+(default 3). `/admin/style` shows it under Tricks.
+
+```erb
+<%= render layout: "studio/carousel", locals: { label: "Portfolio", items: @apps, per_view: 3 } do |app| %>
+  <%= render "apps/card", app: app %>
+<% end %>
+```
+
+`style: :spotlight` snaps each slide to the centre: the centred slide is full size and
+colour, with its `caption:` line (a callable on the item) under it, and its neighbours
+are smaller, faded and grey. The arrows and keys move one slide. Where the browser has
+scroll-driven animations the look follows the scroll; elsewhere the controller marks the
+centred slide (`data-current`) and CSS transitions it. Reduced motion only dims.
+
+```erb
+<%= render layout: "studio/carousel",
+      locals: { label: "Team", items: @people, style: :spotlight, caption: ->(person) { person.title } } do |person| %>
+  <%= render "people/card", person: person %>
+<% end %>
+```
+
 ### The "at" time stamp — `at_time_tag`
 
 Stamps WHEN something happened, on the reader's own clock: `at 3:53p`, gaining a