studio-engine 0.62.0 → 0.62.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3af6e5f7754c621df6bba0ef0972d018d48f0a08ede302530b5d5922e43328cf
-  data.tar.gz: e54f8c9cfbbd02cf9473e7e68ac6150a3a7c8da4ab861070da662184e1ee082d
+  metadata.gz: 822c72023af8d108848e67535194fa5a115443b4faaeebd7d9adc931ffcc7678
+  data.tar.gz: a1ef68303215291461d2e07b5237506c57fc6ab83e4fd8b9edc9f18a39e19e51
 SHA512:
-  metadata.gz: '08ae8d20d1a6e862e6985a2589221a87207d0ed562d0a6b696563b34d301cc77e6eef0bbc828074b09f104550041cbab78e529d8e553253b4b0de7dc5cb38432'
-  data.tar.gz: 1b785c9cab657acc47e1fd8d56109d91727086bf8b2aeb98bf0ebc1938bf550c3f6233fd4daa885daeab35a4b2a77b04b8f842cb14c10b7fec7f6cdcaab745b9
+  metadata.gz: dac77f69b4c34943fe3bd8f8a790dbbadfd8ebbc4e80a17595af78fff7f054e9321ea92062769c474ae56b70da09d051a9d45801f0f0aff2197fedc794deaaba
+  data.tar.gz: 723edaf2959e13979ede94523e578ce1d612cbe9911dfd4f1340de8a77b73fa2a2a2ee2c866f3f8078a780455af3baeafd5f369fb232a90a024987ed409a84e1

data/app/views/studio/modals/_crop_photo.html.erb

@@ -30,7 +30,7 @@
   <h3 class="text-heading font-bold text-lg text-center mb-4">Crop Photo</h3>
 
   <template x-if="error">
-    <p class="text-red-400 text-sm mb-3 text-center" x-text="error"></p>
+    <p role="alert" class="text-red-400 text-sm mb-3 text-center" x-text="error"></p>
   </template>
 
   <input type="file" x-ref="filePicker" @change="onFilePicked($event)" accept="image/*" class="hidden">

data/app/views/studio/modals/_web3_step_up.html.erb

@@ -261,7 +261,7 @@
   </template>
 
   <template x-if="error">
-    <p class="text-red-400 text-sm mt-3 text-center" x-text="error"></p>
+    <p role="alert" class="text-red-400 text-sm mt-3 text-center" x-text="error"></p>
   </template>
 
   <%# SECONDARY — always reachable, so a user whose remembered wallet is the

data/app/views/studio/modals/auth/_resend_footer.html.erb

@@ -21,5 +21,5 @@
     <span x-text="props.submitting === 'magic-link' ? 'Resending…' : ((props.resendCooldown || 0) > 0 ? ('Resend available in ' + props.resendCooldown + 's') : 'Resend link')"></span>
   </span>
 </button>
-<p x-show="props.resendError" x-cloak class="text-xs text-red-400 mt-3 text-center" x-text="props.resendError"></p>
+<p role="alert" x-show="props.resendError" x-cloak class="text-xs text-red-400 mt-3 text-center" x-text="props.resendError"></p>
 <button @click="$store.<%= modal_store %>.close()" class="block mx-auto mt-3 text-sm text-secondary hover:text-heading transition">Close</button>

data/app/views/studio/modals/blocks/_birthday.html.erb

@@ -112,7 +112,7 @@
         A refusal is not an error, and showing them in the same red paragraph is
         what let the dead end hide. %>
     <template x-if="error">
-      <p class="text-red-400 text-sm mb-3" x-text="error"></p>
+      <p role="alert" class="text-red-400 text-sm mb-3" x-text="error"></p>
     </template>
 
     <%# Disabled ONLY for an incomplete date or an in-flight submit. It used to be

data/app/views/studio/modals/blocks/_entry_confirmed.html.erb

@@ -51,6 +51,13 @@
     seeds_total_key  — Alpine expr: new seeds total. Default "props.seedsTotal".
     seeds_per_level  — Integer seeds per level. Default 100.
     free_entry_label — reward copy on a level-up. Default "Free Entry Earned 🎟️".
+    secondary_label  — optional secondary action label under the CTA (e.g.
+                       "Dismiss"). Forwarded to _success_card, which renders a
+                       button dispatching secondary_event.
+    secondary_event  — window event name for that button. BOTH are required or
+                       NEITHER renders, matching how _success_card and _error_card
+                       already gate the pair — a label with no event is a button
+                       that does nothing.
 %>
 <%
   modal_store      = local_assigns.fetch(:modal_store, "modals")
@@ -70,6 +77,8 @@
   seeds_total_key  = local_assigns.fetch(:seeds_total_key, "props.seedsTotal")
   seeds_per_level  = local_assigns.fetch(:seeds_per_level, 100)
   free_entry_label = local_assigns.fetch(:free_entry_label, "Free Entry Earned 🎟️")
+  secondary_label  = local_assigns[:secondary_label]
+  secondary_event  = local_assigns[:secondary_event]
 
   sc_locals = {
     large_title:           true,
@@ -89,6 +98,17 @@
   else
     sc_locals[:message] = subtitle
   end
+
+  # BOTH OR NEITHER, deliberately. sc_locals was a FIXED hash, so a consumer
+  # adopting this card in place of its own fork lost any secondary action it had
+  # SILENTLY — there was no error, the button simply stopped existing. That is
+  # what blocked turf-monster's entry-confirmed defork: its card ends in a
+  # "Dismiss" link, and the call site sits inside a <template x-if>, which takes
+  # ONE root, so the button cannot be kept outside the block either.
+  if secondary_label.present? && secondary_event.present?
+    sc_locals[:secondary_label] = secondary_label
+    sc_locals[:secondary_event] = secondary_event
+  end
 %>
 <%# props getter + clusterParam live on the root scope so _success_card's nested
     Alpine expressions (props.txSignature, props.lobbyUrl, clusterParam) resolve up

data/app/views/studio/modals/blocks/_error_card.html.erb

@@ -25,7 +25,11 @@
   icon_emoji = local_assigns[:icon_emoji] || "⏳"   # ⏳
   cta_label  = local_assigns[:cta_label]  || 'Refresh'
 %>
-<div class="text-center py-6">
+<%# role="alert" on the CARD, not on its message: the message is server-rendered
+    static text, so it never "changes" for a live region to notice. The modal host
+    renders content through <template x-if>, so this whole card ENTERS the DOM when
+    the failure happens — which is the event a screen reader can announce. %>
+<div role="alert" class="text-center py-6">
   <div class="text-5xl mb-4 leading-none"><%= icon_emoji %></div>
   <p class="text-sm text-heading font-semibold mb-2"><%= title %></p>
 

data/app/views/studio/modals/blocks/_leveling_activity.html.erb

@@ -131,7 +131,7 @@
         <% end %>
 
         <template x-if="error">
-          <p class="text-red-400 text-sm mb-3" x-text="error"></p>
+          <p role="alert" class="text-red-400 text-sm mb-3" x-text="error"></p>
         </template>
 
         <form @submit.prevent="save()" class="space-y-4">

data/app/views/studio/modals/blocks/_rail_row.html.erb

@@ -78,8 +78,22 @@
   tile_style    = icon_bg.present? ? "background-color:#{icon_bg}" : nil
   tile_bg_class = icon_bg.present? ? nil : "bg-primary"
 %>
+<%# on_click is marked html_safe because it is CODE, not content. content_tag
+    escapes through ERB::Util.unwrapped_html_escape, which no-ops on an html_safe
+    String, so the handler reaches the attribute exactly as the caller wrote it:
+    f('a'), not the entity-escaped form. A browser recovered from the escaped
+    version and Alpine fired either way, so this was invisible on screen; what it
+    broke was every consumer test that reads the markup.
+
+    IT IS STILL SAFE FOR DOUBLE QUOTES. content_tag quote-escapes an attribute
+    VALUE regardless of html_safe, so a double-quoted expression is entity-encoded
+    and still works. An earlier attempt emitted the handler through raw in literal
+    ERB instead, which had no such protection: it broke out of the attribute and
+    silently narrowed the contract to single quotes only.
+
+    Everything else here stays escaped, because everything else is content. %>
 <%= content_tag(soon ? :div : :button, type: (soon ? nil : "button"),
-      "@click": on_click,
+      "@click": on_click&.html_safe,
       class: "w-full flex items-center gap-4 p-4 rounded-xl #{border_class} bg-inset#{soon ? '' : ' transition text-left'}",
       data: data_attrs.presence) do %>
   <span class="shrink-0 w-10 h-10 rounded-lg flex items-center justify-center <%= icon_class %> <%= tile_bg_class %>"

data/app/views/studio/modals/onboarding/_first_name.html.erb

@@ -122,7 +122,7 @@
              class="input-field">
     </div>
     <template x-if="error">
-      <p class="text-red-400 text-xs mb-3" x-text="error"></p>
+      <p role="alert" class="text-red-400 text-xs mb-3" x-text="error"></p>
     </template>
     <button type="submit" :disabled="submitting"
             class="btn btn-primary btn-lg w-full gap-2 disabled:cursor-wait">

data/app/views/studio/modals/shared/_age_attestation.html.erb

@@ -28,7 +28,7 @@
       state (18+ in most states; 19+ in AL/NE; 21+ in IA/MA/VA).
     </span>
   </label>
-  <p x-show="<%= error_model %>" x-cloak class="text-xs text-red-400 mt-1.5 ml-6">
+  <p role="alert" x-show="<%= error_model %>" x-cloak class="text-xs text-red-400 mt-1.5 ml-6">
     Please confirm you are of legal age to continue.
   </p>
 </div>

data/app/views/style/_modals.html.erb

@@ -566,7 +566,7 @@
 
   <%# 1. AUTH suite %>
   <%# ===================================================================== %>
-  <section class="space-y-5">
+  <section id="modals-auth" class="space-y-5">
     <div class="space-y-1">
       <h3 class="text-xl font-bold text-heading">Auth</h3>
       <p class="text-muted text-sm">
@@ -650,7 +650,7 @@
       owns: the person's name, their birthday, their picture. Grouping by
       subject rather than by moment also stops the guide claiming a chain it
       cannot show, now that the wallet step lives with the wallet cards. %>
-  <section class="space-y-5">
+  <section id="modals-profile" class="space-y-5">
     <div class="space-y-1">
       <h3 class="text-xl font-bold text-heading">Profile</h3>
       <p class="text-muted text-sm">
@@ -838,7 +838,7 @@
       "Quest N of N" counter — the with/without fork is gone. The two "updated"
       cards open the same modal id straight at the celebrate state (props.celebrate),
       exactly like the Auth cards open a given step. %>
-  <section class="space-y-5">
+  <section id="modals-profile-leveling" class="space-y-5">
     <div class="space-y-1">
       <div class="flex flex-wrap items-center gap-3">
         <h3 class="text-xl font-bold text-heading">Profile Leveling</h3>
@@ -1046,7 +1046,7 @@
   <%# 2. WEB3 — the wallet + on-chain modals, in the order a player meets them. %>
   <%# Gated by :web3; off = disabled-but-present-yet-openable. %>
   <%# ===================================================================== %>
-  <section class="space-y-5">
+  <section id="modals-web3" class="space-y-5">
     <div class="space-y-1">
       <div class="flex flex-wrap items-center gap-3">
         <h3 class="text-xl font-bold text-heading">Web3</h3>
@@ -1447,7 +1447,7 @@
   <%# 3. CONTEST ENTRY & ELIGIBILITY — moved directly under Web3. The %>
   <%# walked entry flow (glow follows), plus the honest web2/web3 map. %>
   <%# ===================================================================== %>
-  <section class="space-y-5">
+  <section id="modals-contest-entry" class="space-y-5">
     <div class="space-y-1">
       <div class="flex flex-wrap items-center gap-3">
         <h3 class="text-xl font-bold text-heading">Contest entry &amp; eligibility</h3>
@@ -1597,7 +1597,7 @@
   <%# ===================================================================== %>
   <%# 5. SYSTEM AND STATUS (reusable card blocks) %>
   <%# ===================================================================== %>
-  <section class="space-y-5">
+  <section id="modals-system-status" class="space-y-5">
     <div class="space-y-1">
       <h3 class="text-xl font-bold text-heading">System &amp; status</h3>
       <p class="text-muted text-sm">
@@ -1713,7 +1713,7 @@
   <%# ===================================================================== %>
   <%# 6. TEMPLATES (copy-from archetypes) %>
   <%# ===================================================================== %>
-  <section class="space-y-5">
+  <section id="modals-templates" class="space-y-5">
     <div class="space-y-1">
       <h3 class="text-xl font-bold text-heading">Templates</h3>
       <p class="text-muted text-sm">
@@ -1747,7 +1747,7 @@
   <%# ===================================================================== %>
   <%# 7. REWARDS / leveling (gated by Studio.feature?(:leveling)) %>
   <%# ===================================================================== %>
-  <section class="space-y-5">
+  <section id="modals-rewards" class="space-y-5">
     <div class="space-y-1">
       <div class="flex flex-wrap items-center gap-3">
         <h3 class="text-xl font-bold text-heading">Rewards</h3>

data/app/views/style/modals/_auth.html.erb

@@ -164,7 +164,7 @@
         <span x-text="props.submitting === 'google' ? 'Waiting for Google…' : 'Google'"></span>
       </button>
       <template x-if="props.googleError">
-        <p class="text-red-400 text-xs -mt-2 mb-3" x-text="props.googleError"></p>
+        <p role="alert" class="text-red-400 text-xs -mt-2 mb-3" x-text="props.googleError"></p>
       </template>
 
       <%# 2. Solana — progresses to the Connect Wallet picker modal. Gated on
@@ -200,7 +200,7 @@
                 disabled_expr: "!!props.submitting" %>
         </div>
         <template x-if="props.formError">
-          <p class="text-red-400 text-xs mb-3" x-text="props.formError"></p>
+          <p role="alert" class="text-red-400 text-xs mb-3" x-text="props.formError"></p>
         </template>
         <button type="submit" :disabled="!!props.submitting"
                 class="btn btn-neutral btn-lg w-full gap-2 disabled:cursor-wait">

data/app/views/style/modals/_wallet_connect.html.erb

@@ -166,7 +166,7 @@
   </div>
 
   <template x-if="error">
-    <p class="text-red-400 text-sm mt-3 text-center" x-text="error"></p>
+    <p role="alert" class="text-red-400 text-sm mt-3 text-center" x-text="error"></p>
   </template>
 
   <button type="button" @click="back()" :disabled="connecting"

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.62.0"
+  VERSION = "0.62.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.62.0
+  version: 0.62.2
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-26 00:00:00.000000000 Z
+date: 2026-08-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails