studio-engine 0.49.0 → 0.50.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5cfb0ff6698fde0520d0d6e081ffd49d99801473831f92c18e86a9cb9dc177a1
-  data.tar.gz: 2a96a7e242ff9211d0307326e77258136b725a99d5d749a9664e5194336af72c
+  metadata.gz: e29528d33a9e256697398f86592a44caa7631acee8034148bd1eb3d5c5a877ec
+  data.tar.gz: 62d6f242a0d5f147d99ef0fa378d0f79ec0b11b84af51928ae3a4fddbc5d4862
 SHA512:
-  metadata.gz: d142923e12b84afc01d96afda2cdaf578ef422a6e34f480cad0917671140ad99bf5eb73d70b0283eed6ba4a5eece21f98ea356662a963c504fdef758ccf3b857
-  data.tar.gz: 657e2a9742b8e92317a3128593fe50663cb2fd09ca004a1700d0dc0e0a4c6916d7f0d024c28b6098a93e6424cfacb174bdf46878cadcf9dab953b5532725e520
+  metadata.gz: 359a84187b7b63daba90c5ee89e5dc25c52291b922e05ad6e991d1bc0da141b58e096b8a1ceb0b293c19faf0e35dd272bdd5c31b0e3dc2358dda82876e526c7d
+  data.tar.gz: d22644b76b30889cd712c02a188b63d0d7287ed368c40c27a797afc48058eca1cd4e97a60dc1e38e2321f31e4cab95acb5029112420f4a0f1953c1ae53362ed5

data/CHANGELOG.md

@@ -4,6 +4,41 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+### Added
+
+- **The link sidebar leads with a Profile link, shipped by the engine.** The
+  engine ships `/profile`, so it now ships the way in rather than asking five
+  apps to declare the same entry and watching them drift in wording and emoji.
+  `Studio::SidebarSections.resolve` prepends a `You` section; a host's own
+  sections follow in their declared order.
+
+  Two gates, both load-bearing:
+
+  - **`Studio.draw_profile_routes`** — an app that turned the page off must not
+    be handed a menu item pointing at a route that does not exist.
+  - **signed in** — `/profile` requires authentication, so offering it to a
+    signed-out visitor bounces them to login from something that looked like
+    navigation. Same shape as the existing `admin:` rule.
+
+  **WHO ACTUALLY RECEIVES THIS — check before assuming your app does.** The
+  trigger renders from `layouts/_navbar`, and two consumers fork that partial:
+
+  | Consumer | Effect |
+  |---|---|
+  | mcritchie-studio | Profile link added to the top of its existing sidebar |
+  | mcritchie-industries | same |
+  | acquisition-studio | **gains a sidebar it did not have** — it declared no sections, and now has one |
+  | turf-monster, moms-app | **no change** — both fork `layouts/_navbar` and render no sidebar trigger, so a bump does not deliver this |
+
+  That last row is the standing rule in this engine: a host view shadows the
+  engine's, so a partial change reaches only the apps that still render the
+  engine's copy.
+
+  **`studio_sidebar?` is now true in any signed-in app** that renders the engine
+  navbar, where it previously depended on the host declaring something. That is
+  the intended consequence — the sidebar always has at least the viewer's own
+  profile in it — but it is a visible change to a navbar every consumer inherits.
+
 ### Fixed
 
 - **`Studio.profile_sections`' `if:` gate no longer fails open on a Symbol.**
@@ -17,15 +52,44 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ### Added
 
-- **`/profile` gains the Email row — changeable from any signed-in session.**
-  `PATCH /profile/email` (`profile_email_path`) applies the change directly.
+- **`/profile` splits into a read page and an edit page.** `/profile` is now "you
+  at a glance" — the identity header, and the rows you look at rather than type
+  into. `/profile/edit` (`edit_profile_path`) holds the fields, in ONE form with
+  ONE save.
+
+  A section declares which page it belongs to with **`page:`** — `:show` or
+  `:edit`. A row that says nothing defaults to `:edit`, because someone adding a
+  row is usually adding a field, and the read page is a curated surface. Existing
+  hosts need no change: `Studio.profile_sections_for(view)` without a `page:`
+  still returns every row.
+
+  **The identity header** (avatar, display name, address) renders on both pages
+  and is where the avatar now lives — it stopped being a row when it stopped
+  looking like one. On the read page the whole card is the link through to
+  editing, and its badge glyph fades in on hover; on the edit page the badge is a
+  button that opens the cropper.
+
+  **The save bar is sticky**, so it never depends on where the reader is in the
+  scroll, and it stays out of the way until a field is actually dirty. Without
+  JavaScript it renders as a plain always-visible submit — the form still saves.
+
+  **The header morphs on scroll.** Once the card leaves the viewport a compact
+  bar takes its place beneath the navbar, matched to the card's own width, so who
+  you are stays on screen down a long page. It is `aria-hidden` and
+  non-interactive: it duplicates what is already in the document rather than
+  adding a second copy for a screen reader to read out. Honors
+  `prefers-reduced-motion`.
+
+- **`/profile` gains the Email field — changeable from any signed-in session.**
+  It saves with the rest of the edit form through `PATCH /profile`.
 
   **THE GOOGLE EXCEPTION.** An account with a linked Google identity **cannot**
   change its email: Google is the authoritative source for that address, and
   letting the two drift means the next OAuth sign-in either re-links to a
-  stranger's row or cannot find its own. The row shows the address with the
-  reason instead of a field, and the endpoint refuses independently — a disabled
-  input is a courtesy, and anyone can POST.
+  stranger's row or cannot find its own. The locked branch renders **no input at
+  all** — it shows the address, the reason, and a link to the read page where the
+  unlink control lives. The server refuses the change independently of what the
+  page drew, because anyone can POST.
 
   **What a direct change trades away, stated so nobody rediscovers it:** a
   hijacked session can move the account to another inbox, and the old address has

data/app/controllers/studio/profiles_controller.rb

@@ -33,146 +33,81 @@ module Studio
     MAX_FIRST_NAME = Studio::FIRST_NAME_MAX_LENGTH
 
     def show
-      @profile_sections = Studio.profile_sections_for(view_context)
+      @profile_sections = Studio.profile_sections_for(view_context, page: :show)
     end
 
-    # PATCH /profile — the scalar fields. Today that is the first name.
+    # GET /profile/edit — the form. Read and edit are separate pages (operator's
+    # call, 2026-08-14): /profile is "you at a glance", this is where you change
+    # things.
+    def edit
+      @profile_sections = Studio.profile_sections_for(view_context, page: :edit)
+    end
+
+    # PATCH /profile — every editable field, in one request.
+    #
+    # ONE FORM, ONE SAVE (operator's call). Email used to be its own action, and
+    # needed to be only while it was out-of-band; now that it applies directly
+    # there is no reason for a second mechanism on the same page. Its side
+    # effects stay here rather than moving into the form.
+    #
+    # Each field is applied only if its ROW would render — the same resolver the
+    # page uses — so a host that cannot serve a field cannot have one posted into
+    # it either.
     def update
-      return unsupported("name") unless row_rendered?(:first_name)
+      attrs = {}
+      attrs.merge!(name_attributes)     if row_rendered?(:name)
+      attrs.merge!(birthday_attributes) if row_rendered?(:birthday)
 
-      value = normalized_first_name
+      # May redirect (the Google lock); if it did, we are done.
+      prepare_email_change(attrs) if row_rendered?(:email)
+      return if performed?
 
-      if value.blank?
-        return redirect_to profile_path, alert: "Enter your first name.", status: :see_other
+      if attrs.empty?
+        return redirect_to edit_profile_path, alert: "Nothing to save.", status: :see_other
       end
 
+      previous_email = current_user.email.to_s if current_user.respond_to?(:email)
+
       rescue_and_log(target: current_user) do
-        attrs = { first_name: value }
-        # Backfill `name` when it is blank so the display-name chain has
-        # something better than an email prefix to show. Same rule as the
-        # onboarding step, which writes this column from the other direction.
-        attrs[:name] = value if current_user.respond_to?(:name) && current_user.name.blank?
-
-        if current_user.update(attrs)
-          # Read back rather than trusting the write. A host whose before_save
-          # DERIVES first_name from name (turf-monster's set_name_parts does
-          # exactly that) would silently discard the value, and a flash saying
-          # "Saved" over a discarded write is worse than a plain failure.
-          # Reporting what actually persisted keeps the page honest on a host the
-          # engine has not met yet.
-          persisted = current_user.reload.first_name.to_s
-
-          if persisted == value
-            redirect_to profile_path, notice: "Name updated."
-          else
-            redirect_to profile_path,
-                        alert: "This app derives your name from another field — it saved as #{persisted.presence || "blank"}.",
-                        status: :see_other
-          end
-        else
-          redirect_to profile_path,
-                      alert: current_user.errors.full_messages.to_sentence.presence || "Could not save that name.",
-                      status: :see_other
+        unless current_user.update(attrs)
+          next redirect_to edit_profile_path, status: :see_other,
+                           alert: current_user.errors.full_messages.to_sentence.presence ||
+                                  "Could not save those changes."
         end
+
+        after_email_change(previous_email) if attrs.key?(:email)
+
+        redirect_to profile_path, notice: "Profile updated."
       end
     end
 
     # PATCH /profile/avatar — the picture, on its own route.
     #
     # SEPARATE FROM #update deliberately: an attachment param submitted empty
-    # PURGES the attachment, so a combined form that carried both would delete
-    # someone's avatar every time they edited their name. turf-monster learned
-    # this and branched inside its own #update; a separate route is the same
-    # lesson expressed so the trap cannot be reintroduced.
+    # PURGES the attachment, so a combined form carrying both would delete
+    # someone's photo every time they saved a name. A separate route makes that
+    # unreachable rather than merely avoided.
+    #
+    # GUARDED DIFFERENTLY FROM THE FIELD ROWS, and the difference is real: the
+    # avatar stopped being a row when it moved into the identity header, so
+    # "would its row render?" has no answer for it. The MODEL gate is the right
+    # question here — can this host's user hold an attachment at all.
     def avatar
-      return unsupported("profile photo") unless row_rendered?(:avatar)
+      return unsupported("profile photo") unless avatar_supported?
 
       file = params.dig(:profile, :avatar)
 
       if file.blank?
-        return redirect_to profile_path, alert: "Choose an image first.", status: :see_other
+        return redirect_to edit_profile_path, alert: "Choose an image first.", status: :see_other
       end
 
       unless Studio::ProfileImage.acceptable?(file)
-        return redirect_to profile_path, alert: Studio::ProfileImage::MESSAGE, status: :see_other
+        return redirect_to edit_profile_path, alert: Studio::ProfileImage::MESSAGE, status: :see_other
       end
 
       rescue_and_log(target: current_user) do
         current_user.avatar.attach(file)
-        redirect_to profile_path, notice: "Photo updated."
-      end
-    end
-
-    # PATCH /profile/email — change the address, from any signed-in session.
-    #
-    # DIRECT, not out-of-band (operator's call, 2026-08-14). An earlier build
-    # mailed a confirmation link to the current address and applied the change
-    # only when the holder of that inbox clicked it. That is the stronger flow and
-    # it is gone on purpose: the session is now the authority.
-    #
-    # What that trades away, stated so nobody has to rediscover it: a hijacked
-    # session can move the account to another inbox, and the old address no
-    # longer gets a veto. Two things are kept BECAUSE the veto is gone —
-    #
-    #   * the OLD address is mailed after every change (OPSEC-046), so a change
-    #     nobody made is visible to the person losing the account, and
-    #   * every OTHER session is invalidated (OPSEC-045), so a hijacker holding a
-    #     second cookie loses it the moment the address moves.
-    #
-    # THE GOOGLE EXCEPTION. An account with a linked Google identity cannot
-    # change its email here: Google is the authoritative source for that address,
-    # and letting the two drift means the next OAuth sign-in either re-links to a
-    # stranger's row or fails to find its own. Unlink Google first, then change it.
-    def email
-      return unsupported("email") unless row_rendered?(:email)
-
-      if Studio::OauthIdentity.google_linked?(current_user)
-        return redirect_to profile_path, status: :see_other,
-                           alert: "Your email comes from your linked Google account. " \
-                                  "Unlink Google first if you want to change it."
-      end
-
-      value = params.dig(:profile, :email).to_s.strip
-      current = current_user.email.to_s
-
-      return redirect_to profile_path, alert: "Enter an email address.", status: :see_other if value.blank?
-
-      if value.casecmp?(current)
-        return redirect_to profile_path, alert: "That is already your email address.", status: :see_other
-      end
-
-      rescue_and_log(target: current_user) do
-        unless current_user.update(email: value)
-          next redirect_to profile_path, status: :see_other,
-                           alert: current_user.errors.full_messages.to_sentence.presence ||
-                                  "Could not save that address."
-        end
-
-        # The new address has not been proved yet; the host's own verification
-        # flow picks it up from here.
-        current_user.update_columns(email_verified_at: nil) if current_user.respond_to?(:email_verified_at)
-
-        # ROTATE FIRST, MAIL SECOND — the order matters and it was the other way
-        # round. Studio::Email.deliver can raise (a host's delivery record is a
-        # create! plus perform_later with no rescue at that level), and a mail
-        # failure between the write and the rotation would leave the address
-        # changed with every other session still live. That is the exact window
-        # OPSEC-045 exists to close, so it closes before anything that can throw.
-        # turf-monster's own apply_email_change rotates first for the same reason.
-        if current_user.respond_to?(:regenerate_session_token!)
-          current_user.regenerate_session_token!
-          # Re-establish THIS session. Rotating without it signs out the very
-          # person who just made the change — correct when the actor arrived from
-          # a confirmation link, wrong now that the actor IS the session.
-          session[:session_token] = current_user.session_token if current_user.respond_to?(:session_token)
-        end
-
-        if current.present?
-          Studio::Email.deliver(Studio::ProfileMailer, :email_change_notification,
-                                current_user, current, value, to: current, user: current_user)
-        end
-
-        redirect_to profile_path, notice: "Email changed to #{value}."
+        redirect_to edit_profile_path, notice: "Photo updated."
       end
     end
 
@@ -233,6 +168,11 @@ module Studio
       profile_rows.any? { |section| section[:key] == key.to_sym }
     end
 
+    # The avatar is not a row, so it asks the MODEL gate directly — see #avatar.
+    def avatar_supported?
+      Studio::ProfileSections.served_by?(current_user, :avatar)
+    end
+
     # Memoized per request: a host's `if:` may be a lambda doing real work, and a
     # write should not pay for it more than once.
     def profile_rows
@@ -248,10 +188,103 @@ module Studio
                   status: :see_other
     end
 
+    # --- field assembly ---------------------------------------------------------
+
+    def name_attributes
+      attrs = {}
+      first = normalized_name(params.dig(:profile, :first_name))
+      attrs[:first_name] = first if first.present?
+
+      if current_user.respond_to?(:last_name)
+        last = normalized_name(params.dig(:profile, :last_name))
+        attrs[:last_name] = last if last.present?
+      end
+
+      # Backfill `name` when it is blank so the display-name chain has something
+      # better than an email prefix to show. Same rule as the onboarding step.
+      if attrs[:first_name].present? && current_user.respond_to?(:name) && current_user.name.blank?
+        attrs[:name] = [attrs[:first_name], attrs[:last_name]].compact_blank.join(" ")
+      end
+
+      attrs
+    end
+
+    # ONE date input, THREE integer columns. The split is deliberate upstream —
+    # it keeps "how old are they" and "whose birthday is today" both cheap — so
+    # the form joins them and this takes them apart again.
+    #
+    # A blank date CLEARS all three rather than being ignored: someone deleting
+    # their birthday means it, and leaving a stale year behind would be the
+    # wrong answer to both questions above.
+    def birthday_attributes
+      raw = params.dig(:profile, :birthday)
+      return {} if raw.nil?
+
+      if raw.to_s.strip.blank?
+        return { birth_year: nil, birth_month: nil, birth_day: nil }
+      end
+
+      date = begin
+        Date.iso8601(raw.to_s)
+      rescue ArgumentError, TypeError
+        nil
+      end
+      return {} if date.nil? || date > Date.current
+
+      { birth_year: date.year, birth_month: date.month, birth_day: date.day }
+    end
+
+    # Adds :email to attrs, or REDIRECTS when the change must be refused — the
+    # caller checks performed? rather than a return value.
+    def prepare_email_change(attrs)
+      value = params.dig(:profile, :email).to_s.strip
+      return nil if value.blank?
+      return nil if value.casecmp?(current_user.email.to_s)
+
+      # THE GOOGLE EXCEPTION. Google is the authoritative source for a linked
+      # account's address; letting the two drift means the next OAuth sign-in
+      # either re-links to a stranger's row or cannot find its own. The field is
+      # locked in the row and refused here — a disabled input is a courtesy, and
+      # anyone can POST.
+      if Studio::OauthIdentity.google_linked?(current_user)
+        redirect_to edit_profile_path, status: :see_other,
+                    alert: "Your email comes from your linked Google account. " \
+                           "Unlink Google on your profile first if you want to change it."
+        return
+      end
+
+      attrs[:email] = value
+      nil
+    end
+
+    # The two protections kept BECAUSE a direct change leaves the old address no
+    # veto: tell it, and invalidate every other session.
+    def after_email_change(previous_email)
+      current_user.update_columns(email_verified_at: nil) if current_user.respond_to?(:email_verified_at)
+
+      # ROTATE FIRST, MAIL SECOND. Studio::Email.deliver can raise, and a mail
+      # failure between the write and the rotation would leave the address
+      # changed with every other session still live — the exact window OPSEC-045
+      # exists to close, so it closes before anything that can throw.
+      # turf-monster's own apply_email_change rotates first for the same reason.
+      if current_user.respond_to?(:regenerate_session_token!)
+        current_user.regenerate_session_token!
+        # Re-establish THIS session. Rotating without it signs out the very
+        # person who just made the change.
+        session[:session_token] = current_user.session_token if current_user.respond_to?(:session_token)
+      end
+
+      return if previous_email.blank?
+
+      Studio::Email.deliver(Studio::ProfileMailer, :email_change_notification,
+                            current_user, previous_email, current_user.email,
+                            to: previous_email, user: current_user)
+    end
+
     # Collapse runs of whitespace and cap the length. Done here rather than in a
     # model validation because the engine does not own the host's User class.
-    def normalized_first_name
-      params.dig(:profile, :first_name).to_s.strip.gsub(/\s+/, " ")[0, MAX_FIRST_NAME].to_s
+    def normalized_name(raw)
+      raw.to_s.strip.gsub(/\s+/, " ")[0, MAX_FIRST_NAME].to_s
     end
   end
 end

data/app/mailers/studio/profile_mailer.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Studio
-  # The two emails an email change sends.
+  # The one email an email change sends.
   #
   # NAMESPACED, and that is load-bearing rather than tidiness. `app/mailers` is an
   # autoload path and this engine is not isolated, so a host that defines a

data/app/views/studio/profiles/_birthday_fields.html.erb

@@ -0,0 +1,31 @@
+<%# Birthday — ONE date input over THREE integer columns.
+
+    Locals: user (required).
+
+    The split is deliberate in the standard-columns migration and worth not
+    undoing: birth_day / birth_month / birth_year keep the two questions apps
+    actually ask cheap and separable — how old is this person (needs the year,
+    and the month and day for the boundary case) and whose birthday is today
+    (needs month and day, and no year at all). A single date column answers the
+    second one badly.
+
+    So the UI joins them and ProfilesController#update splits them again. A
+    native date input is used rather than three selects because a date is one
+    idea to the person entering it, and the browser already knows how to enter
+    one on every platform.
+
+    The row renders only when the host has all three columns, so nothing here
+    re-checks.
+%>
+<%
+  y = user.birth_year
+  m = user.birth_month
+  d = user.birth_day
+  value = (y.present? && m.present? && d.present?) ? format("%04d-%02d-%02d", y, m, d) : nil
+%>
+<label class="block text-sm text-secondary mb-2 font-medium" for="profile_birthday">Date of birth</label>
+<input type="date" name="profile[birthday]" id="profile_birthday"
+       value="<%= value %>" class="input-field"
+       autocomplete="bday" max="<%= Date.current.iso8601 %>"
+       x-model="fields.birthday">
+<p class="text-muted text-xs mt-2">Stored as day, month and year — we use it for birthdays and age checks.</p>

data/app/views/studio/profiles/_editable_identity.html.erb

@@ -0,0 +1,35 @@
+<%# The identity header on the EDIT page, wrapped in the uploader's Alpine scope.
+
+    Locals: user (required).
+
+    ONE COMPONENT, and it has to be: the header's badge button calls
+    `$refs.filePicker`, and Alpine resolves $refs only within the same x-data.
+    Rendering the header and the picker as siblings — which is how this was first
+    written — leaves the badge pointing at a ref that does not exist in its
+    scope, so clicking it does nothing at all. Silently.
+
+    The avatar SAVES ON ITS OWN, outside the field form. An attachment param
+    submitted empty PURGES the attachment, so an avatar input inside the bulk
+    form would delete someone's photo every time they saved a name. Nesting
+    forms is invalid HTML anyway; this sits alongside.
+%>
+<div x-data="imageUploadHost({
+       store: 'profileModals',
+       aspectRatio: 1,
+       filename: 'avatar.png',
+       saving: 'Saving photo…',
+       toast: false
+     })"
+     @crop-photo-confirmed.window="onCropConfirmed($event.detail)">
+
+  <%= render "studio/profiles/identity", user: user, editable: true %>
+
+  <%# Auto-submitted once a crop is confirmed; the person never touches it. %>
+  <%= form_with url: profile_avatar_path, method: :patch, scope: :profile, multipart: true,
+                html: { "x-ref": "form", class: "hidden" } do %>
+    <input type="file" name="profile[avatar]" x-ref="fileInput">
+  <% end %>
+
+  <input type="file" x-ref="filePicker" @change="onFileSelected($event)"
+         accept="<%= Studio::ProfileImage::ALLOWED_CONTENT_TYPES.join(",") %>" class="hidden">
+</div>

data/app/views/studio/profiles/_email_fields.html.erb

@@ -0,0 +1,37 @@
+<%# Email field.
+
+    Locals: user (required).
+
+    LOCKED WHEN GOOGLE IS LINKED, and the message points at /profile — because
+    that is where the unlink lives. The two surfaces work in conjunction: Google
+    is read-level and visible on the read page, and unlinking it there is what
+    frees this field. A lock that does not say where the key is is just a wall.
+
+    Changing this address has consequences the form does not show: the old
+    address is told, and every other session is signed out. The line underneath
+    says so, because a field that quietly logs out your other devices is a
+    surprise worth spending two lines on.
+%>
+<% locked = Studio::OauthIdentity.google_linked?(user) %>
+
+<% if locked %>
+  <p class="text-heading font-semibold mb-2 break-all"><%= user.email %></p>
+  <div class="rounded-lg p-3 flex items-start gap-2" style="background: var(--color-surface-alt);">
+    <span aria-hidden="true">🔒</span>
+    <p class="text-muted text-xs">
+      This comes from your linked Google account.
+      <%= link_to "Unlink Google on your profile", profile_path, class: "text-primary hover:underline" %>
+      to change it.
+    </p>
+  </div>
+<% else %>
+  <input type="email" name="profile[email]" id="profile_email"
+         value="<%= user.email %>" class="input-field"
+         autocomplete="email" placeholder="you@example.com"
+         x-model="fields.email">
+  <% if user.email.present? %>
+    <p class="text-muted text-xs mt-2">
+      Changing this tells <span class="font-semibold"><%= user.email %></span> and signs out your other devices.
+    </p>
+  <% end %>
+<% end %>

data/app/views/studio/profiles/_form_script.html.erb

@@ -0,0 +1,65 @@
+<%# The edit form's Alpine component.
+
+    Its own partial so the page above stays readable and this can be reasoned
+    about as behaviour rather than markup.
+%>
+<script>
+  window.studioProfileForm = function (initial) {
+    return {
+      alpine: true,
+      fields: Object.assign({}, initial),
+      initial: Object.assign({}, initial),
+
+      // Trimmed on both sides: whitespace is not a change, and the controller
+      // trims on the way in too — so the bar agrees with what saving would do.
+      changed(key) {
+        return String(this.fields[key] || "").trim() !== String(this.initial[key] || "").trim();
+      },
+
+      get changeCount() {
+        var self = this;
+        return Object.keys(this.fields).filter(function (k) { return self.changed(k); }).length;
+      },
+
+      get dirty() { return this.changeCount > 0; },
+
+      discard() {
+        this.fields = Object.assign({}, this.initial);
+      },
+
+      init() {
+        var self = this;
+
+        // Guard the exit BOTH ways. beforeunload covers a hard navigation or a
+        // closed tab; turbo:before-visit covers a Turbo Drive visit, which never
+        // fires beforeunload — an app with Turbo on would otherwise drop edits
+        // silently on any in-app link.
+        this._beforeUnload = function (e) {
+          if (!self.dirty) return;
+          e.preventDefault();
+          e.returnValue = "";
+        };
+        window.addEventListener("beforeunload", this._beforeUnload);
+
+        this._beforeVisit = function (e) {
+          if (!self.dirty) return;
+          if (!window.confirm("You have unsaved changes. Leave without saving?")) {
+            e.preventDefault();
+          }
+        };
+        document.addEventListener("turbo:before-visit", this._beforeVisit);
+
+        // Submitting is not leaving. Drop both guards before the form goes, or
+        // saving prompts you about the very changes you just chose to save.
+        this.$refs.form.addEventListener("submit", function () { self.teardown(); });
+      },
+
+      teardown() {
+        window.removeEventListener("beforeunload", this._beforeUnload);
+        document.removeEventListener("turbo:before-visit", this._beforeVisit);
+      },
+
+      destroy() { this.teardown(); }
+    };
+  };
+</script>

data/app/views/studio/profiles/_identity.html.erb

@@ -0,0 +1,41 @@
+<%# The "you at a glance" header — avatar, name, address — at the top of BOTH
+    /profile and /profile/edit.
+
+    Locals:
+      user      (required)
+      editable  (Boolean) — true on the edit page, where the avatar badge opens
+                the crop modal.
+
+    ON THE READ PAGE THE WHOLE CARD IS THE LINK to /profile/edit (operator's
+    call). It began as a badge-only link, then the page heading and the Edit
+    button were removed, and a 28px target became the single route to editing —
+    so the target grew to the thing people actually aim at.
+
+    That is also why the badge is a <span> there: an <a> inside an <a> is invalid,
+    and browsers repair it by closing the outer link early, which would quietly
+    shrink the card's clickable area to whatever preceded the badge.
+
+    THE AVATAR IS OPTIONAL — the guard the registry used to carry. As a ROW the
+    avatar declared `requires: :avatar` and was dropped whole on a host whose
+    model has no attachment; moving it into this header lost that, and the first
+    render against such a model raised `undefined method 'avatar'`.
+%>
+<% editable = local_assigns.fetch(:editable, false) %>
+<% attachable = user.respond_to?(:avatar) && user.avatar.respond_to?(:attached?) %>
+
+<%= render "studio/profiles/identity_styles" %>
+
+<%= render "studio/profiles/identity_mini", user: user %>
+
+<% if editable %>
+  <div data-studio-identity-full class="card p-6 mb-6 text-center">
+    <%= render "studio/profiles/identity_body", user: user, editable: true, attachable: attachable %>
+  </div>
+<% else %>
+  <%= link_to edit_profile_path,
+              class: "studio-identity-card card p-6 mb-6 text-center block no-underline",
+              data: { studio_identity_full: true },
+              aria: { label: "Edit your profile" } do %>
+    <%= render "studio/profiles/identity_body", user: user, editable: false, attachable: attachable %>
+  <% end %>
+<% end %>