studio-engine 0.17.0 → 0.19.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 51c0e518d2b2f2f0868ec4b737e3b6f10a2987a01ab46d34ef49d9c3e7418e01
-  data.tar.gz: 6daa86afc8e098c6245622afa579653f4f24cb89549bb06342bb2603dd209d7e
+  metadata.gz: f49b9ef9699144b785efbe7d4839261bba26035970a6c411f5cd54d0606ea97c
+  data.tar.gz: 3705abb5871fcfaa48b7c55613b0bc430b275c8bf9eb4c1625e43fcf14cfed32
 SHA512:
-  metadata.gz: 5eba2d0865c2d8cadd1eab36aeaf2be50fb44fd9dfc8eb77ff05c4cbc54c17c5127c2deb473c988b0e663b8c8a8d1b4d54297130db01932bb2462d0a9f34400f
-  data.tar.gz: 190ff612d9dbdef59bb7599e018f82c01d3e4d47900bcf4c77ec7cdda0231c71877919da4ae4b0aaf36006f6c72c6db558f39a39ba80838336725e49dd2546c2
+  metadata.gz: 584cbbcdeeb388b1a6b0115a790fb6fa3d1c4ce4c69f42e57f7f0985edb4f6338578db04dcfeb5c60bde65aada69509db87c07151a52aab9f9348739a332cdca
+  data.tar.gz: dbbe745f30a632c21d528e336dd323a21224e71d39f97caf6fc43f68f958d1cb78da1a8660d735393847bdfeb67a79d15c1f12c199446f665c0267ff521c19fd

data/CHANGELOG.md

@@ -2,6 +2,107 @@
 
 The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html) — `MAJOR.MINOR.PATCH`. Consumer Rails apps install the released RubyGems package with `gem "studio-engine", "~> 0.6"`; bumping the gem version and updating consumer lockfiles is a release.
 
+## 0.19.0 — 2026-07-27
+
+### Added
+
+- **`GET /_studio/local_review` — the local half of the board's WAITING APPROVAL
+  button.** A magic link signs the recipient into the app that MINTED it: the
+  token lives in that app's store, and `return_to` is sanitized to a same-origin
+  PATH. So a link minted by the production task board could only ever land on
+  production — the operator clicked "review this locally" and arrived, signed in,
+  on `mcritchie.studio`. The board now redirects here instead, to the local
+  server named by the task's `local_url`, which mints in its OWN database and
+  lands the operator signed-in on the page under review
+  (`?email=<who>&return_to=<path>`).
+
+  Like the local email inbox it sits beside, this is a developer-desk tool that
+  hands out sign-in material without authenticating anyone, so it is bound to the
+  same floor: the route is drawn outside production only, and every request is
+  re-checked against `Studio.local_tool_enabled?` — production or non-loopback
+  gets a bare 404.
+
+### Changed
+
+- **`Studio.local_tool_enabled?(request_local:)`** — one spelling of the
+  developer-desk floor (not production, loopback only), now shared by
+  `Studio::LocalEmailsController` and `Studio::LocalReviewsController` so a tool
+  added later cannot quietly ship a weaker gate.
+
+- **`Studio::MagicLinkIssuing`** — the mint (`issue_magic_link`) and the URL that
+  consumes it (`magic_link_url_for`) are two halves of one decision
+  (`Studio.magic_link_store`), extracted from `MagicLinksController` and
+  `UserMailer` into a shared concern. Handing out the wrong URL for the store
+  yields "invalid or expired" on a link that was valid; they can no longer drift
+  apart. No behavior change for either existing caller.
+
+## 0.18.0 — 2026-07-27
+
+### Added
+
+- **Capability features — `Studio.features` / `Studio.feature?(name)`.** A new
+  coarse app-capability switch mirroring the `auth_methods` / `auth_method?`
+  pattern. `mattr_accessor :features` defaults to `[]` (every capability OFF);
+  an app opts in from `config/initializers/studio.rb`, e.g.
+  `config.features = %i[leveling web3]`, and code gates a surface with
+  `Studio.feature?(:leveling)`. Distinct from `auth_methods` (which sign-in
+  methods): features gate whole product surfaces. `feature?` tolerates String or
+  Symbol entries and any Enumerable, so `feature?("web3")` and `feature?(:web3)`
+  agree.
+
+- **`engine-motion.css` — four EFFECT primitives.** Beyond the seven motion
+  primitives, a new visual-effect family (same design rules: plain classes,
+  themed CSS-var knobs, namespaced keyframes): `.text-gradient` (gradient-clipped
+  text fill), `.studio-glow` / `.studio-glow--pulse` (a soft themed glow halo,
+  distinct from the animated rainbow-border `.studio-border-glow`),
+  `.surface-glass` (a frosted, translucent glass panel for overlay chrome via
+  `backdrop-filter` + `color-mix`), and `.conic-surface` (a slow rotating
+  conic-gradient ambient wash). All themed through the role tokens; the animated
+  ones honor `prefers-reduced-motion`.
+
+- **`engine-motion.css` — the LEVELING family (Turf Monster's level badges).**
+  The polished `.level-badge` ladder is lifted verbatim into the engine so any
+  consumer with `Studio.feature?(:leveling)` ships it: the `.level-badge` base +
+  `.level-badge-1 … .level-badge-10` tiers (outline starter → filled green →
+  lifted/glowed/beveled → two-tone → mint → animated mint → holographic Level 10
+  with the 8-stop 400% gradient), the `.level-up-pop` pop + glow burst, the
+  `.nav-level-pop` nav bounce, and the `.badge-with-sheen` one-shot sheen wrapper
+  (ported from TM's `@utility` to a plain class, this layer's convention). The
+  tiers theme off `--color-primary-500-rgb` (emitted by `studio_theme_css_tag`)
+  so they restyle per app; the fixed mint accent is a `--level-mint` /
+  `--level-mint-rgb` knob (`#06d6a0` default). The port uses the modern slash
+  form `rgb(var(...) / a)` throughout — fixing TM's `levelGlow`, which shipped
+  the legacy `rgba(var(--…-rgb), a)` form that silently drops for a
+  space-separated var. The animated tiers honor `prefers-reduced-motion`.
+
+### Changed
+
+- **`admin/style` — the living style guide (renamed from `admin/design_system`).**
+  The page moves to `/admin/style` (`StyleController#index`, helper
+  `admin_style_path`); `/admin/design_system` now **redirects** there and keeps
+  its `admin_design_system_path` helper resolving, so a shipped host sidebar link
+  keeps working. Four sections reached by a sticky section nav, reordered to lead
+  with the color foundation: **Theme (landing) · Modals · Tricks · Tasks**
+  (anchors `#theme · #modals · #tricks · #tasks`), rendered as sibling partials
+  (`_theme`, `_modals`, `_tricks`, `_tasks`).
+  - **Theme** now owns "the colors": it leads with the 7 role tokens/swatches
+    (moved out of the old Style section), folds in the `/admin/theme` editor, and
+    keeps a live dark/light preview. Save + Regenerate now persist **in place** —
+    they submit via `fetch` and `preventDefault` the navigation (the old form
+    posted to `theme_settings#update`, which redirected to `/admin/theme` and
+    bounced the operator off the page), the live preview stays, and the outcome
+    is a toast (the shared `_flash` toast primitive). The standalone
+    `/admin/theme` page's own redirect is unchanged.
+  - **Tricks** (the old "Style" section) is reframed as a board of copy-paste-for-
+    an-agent style tricks: each specimen surfaces its class name prominently with
+    a one-click copy plus the copyable usage snippet. It keeps the Buttons /
+    Surfaces-text-form / Motion / Effects groups, and its **Leveling** group now
+    renders the REAL `.level-badge` tiers (all ten + a chip context + a
+    `.level-up-pop` demo), gated by `Studio.feature?(:leveling)` — greyed and
+    flagged "disabled-but-present" on hosts (like McRitchie Studio) with leveling
+    off, never hidden.
+  - **Modals** is unchanged this pass (its real modal port lands next).
+
 ## 0.17.0 — 2026-07-27
 
 ### Added