studio-engine 0.72.3 → 0.74.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 13abdd4ef0f10262a6560c40b2bed302c16d9f3b3b21582f3569cf0a7517cdf8
-  data.tar.gz: 6f47a52a0ba75d8be96ff6200b75d30a1ff49d76db401581a17a0ea88b2dcd6c
+  metadata.gz: 6a6961114226763cef0af1b1500c982609412516d95c78c0985f63012882e92e
+  data.tar.gz: 4694c467547769140156eac7824a72fd0d510d84f0c30637cba40a87c3344187
 SHA512:
-  metadata.gz: 4b82e9d95ec946a5ce8fdc2d82269eadd8e300bfe21e146163aa0105a3a96254065ac10b26dd6f87a29cff5a402de1ca6d9cb0cdb53ef7119604ee0102b841d5
-  data.tar.gz: f03181c1586eb6c147b50778614df087115b27d1e76eb0dee7236f6e73c68a4509dadde3448d04cb84ea16cad4d20ffbe9eef8fcb7e96eca4be34dbd4c080d52
+  metadata.gz: 509affb42c8bf58a11289e0e0c16cfb2b298625456284b0d56775373fba4ac225c9bc6ba6bd695acb028a44a517836989204dfbb97bd96b1ed69ca2f1e9e7023
+  data.tar.gz: 36ed3258453f8025f591335348f989e333a6d805de78979e325c2a005a197d74c17f04995c6fcf6776bbebb2dae9d4404c483f0effe1e095bf29f2e02947ca83

data/CHANGELOG.md

@@ -4,6 +4,51 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+### Fixed
+
+- **The app census in these comments was short by the most important app.** Ten
+  sites said this engine is mounted by SIX apps and that THREE of them bundle no
+  `solana-studio`. Measured 2026-09-07 by the criterion that reproduces it — a
+  checkout whose own `config/routes.rb` calls `Studio.routes(self)`. A Gemfile
+  grep returns seven instead, catching `solana-studio`'s dev-group pin and the
+  `mcritchie-studio-ai-builder-cache` clone of the hub. **Five** apps mount it —
+  `mcritchie-studio`, `turf-monster`, `acquisition-studio`,
+  `mcritchie-industries`, `moms-app` — and **four** of those bundle no
+  `solana-studio`. `turf-monster` is the only one that does.
+
+  **The omission was the HUB.** Every roster of BASE consumers named
+  `acquisition-studio`, `mcritchie-industries` and `moms-app` and left out
+  `mcritchie-studio` — the app a developer reading those comments is most likely
+  to be sitting in, and one whose `/admin/style` is exactly what the
+  missing-template gate protects. The error ran in the direction that
+  UNDERSTATES the risk the comments exist to explain.
+
+  **Two near misses are what make a naive count wrong.** `chain-ops` bundles
+  `solana-studio` and NOT this engine, so it is not in this set at all;
+  `acquisition-studio` is a retired prototype whose `Gemfile` still pins the
+  engine, so it is. `rolio` bundles neither and is not a consumer.
+
+  **Corrected at every site, because a partial correction is a contradiction:**
+  `app/views/style/_modals.html.erb`, `test/dummy/config/application.rb`,
+  `Gemfile`, `test/views/style_web3_specimens_test.rb`,
+  `test/views/style_host_section_test.rb` (both sites),
+  `app/views/layouts/_navbar.html.erb`,
+  `app/assets/tailwind/studio_engine/engine.css`,
+  `test/views/nav_collapse_contract_test.rb`, `test/lib/vendored_alpine_test.rb`,
+  `test/lib/vendored_montserrat_test.rb`, and two earlier Unreleased entries
+  below. The navbar-fork claim rides the same denominator — three of FIVE fork
+  it, not three of six, and the named three are unchanged — and the
+  Sprockets/propshaft split is two of five rather than "exactly half the fleet",
+  a phrase that encoded an even total no census supports.
+
+  **What was already right, and stays.** The five-consumer roster in
+  `lib/studio.rb`'s `draw_profile_routes` note (each checked 2026-08-14) named
+  the correct five all along; this change brings the rest of the repo to it. The
+  "all six consumer DATABASES" figures elsewhere in this file are three apps
+  times two environments, not an app count.
+
+  Comment and prose only. No behaviour changes.
+
 ### Added
 
 - **The first-name card now says WHICH path finished it, and can type its
@@ -80,7 +125,7 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
   that ships no such partial gets **nothing** — no pill, no heading, no
   container — and that is asserted as a whole-document comparison rather than a
   handful of refutes: the page an app WITH a section gets, minus that section
-  and its pill, must equal the page a base app gets. Five of the six apps
+  and its pill, must equal the page a base app gets. Four of the five apps
   mounting this engine will ship no host section, and their page is unchanged.
 
   **A host specimen drives `$store.modals`, not `dsModals`, and the distinction
@@ -272,6 +317,57 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ### Fixed
 
+- **A host's apostrophe no longer kills the card it was passed to — now across the
+  blocks, not just the first-name step.** The same defect
+  `onboarding/_first_name` fixed one release ago turns out to be an engine-wide
+  idiom: a host-supplied local interpolated into a JS string literal inside a
+  JS-evaluating attribute. Repaired at eleven more splices.
+
+  **WHY IT IS WORTH A CHANGELOG LINE WHEN NOTHING VISIBLE CHANGES.** The failure
+  mode is silent. A bare apostrophe closes the JS literal, the whole expression
+  becomes a SyntaxError, and Alpine mounts the component as a NO-OP that still
+  renders every element — a card that looks perfect and whose buttons do nothing.
+  There is no error on screen, nothing in the server log, and no markup assertion
+  that can see it. Every value in every consumer resolves to a source literal or a
+  frozen constant today, so this is latent cover rather than a live fix; it is
+  worth doing because the next local to carry prose will look like an ordinary
+  change to whoever writes it.
+
+  **WHAT MOVED.** `blocks/_success_card` (`cta_event` at both CTA branches,
+  `secondary_event`), `blocks/_error_card` (`cta_event`, `secondary_event`),
+  `blocks/_entry_confirmed` and `blocks/_solana_tx_link` (`cluster_param`),
+  `modals/_crop_photo` (`store`), `studio/emails/show` (the two upload filenames
+  and the success sentence), and `profiles/_birthday_fields` (the date value).
+  No default or in-repo value contains a character either escaper touches, so
+  every shipped card renders byte-for-byte what it did.
+
+  **THE MECHANISM NOW HAS ONE HOME AND ONE GUARD.** `Studio::JsLiteral.in_attribute`
+  replaces the four inline copies in `_first_name`. TWO escapers have to run — one
+  for the JS literal, one for the HTML attribute — and the second only runs on a
+  value ERB still believes is unsafe, which is why the value is interpolated before
+  it is escaped. That subtlety was re-derived at every call site and had no test
+  anywhere; deleting it used to leave the suite green.
+
+  **NOT A FIX FOR IDENTIFIER POSITION, deliberately.** A local spliced in as a bare
+  NAME — `$store.<name>.close()` — must be VALIDATED, never escaped, because
+  `escape_javascript` also escapes `$` and mangles a legal store name. That fleet
+  (about 36 splices across 19 partials) and a third class found alongside it —
+  Ruby-ASSEMBLED JS emitted into an attribute, some of it already `html_safe` — are
+  scoped OUT of this change and carry their own tickets. The SHAPE of the splice
+  decides the repair, never the name of the local.
+
+- **`Studio::S3` no longer mistakes a Rails NAMESPACE for a Rails application.**
+  `environment` guarded on `defined?(Rails)` and then called `Rails.env`.
+  rails-html-sanitizer — a transitive dependency of `action_view`, which arrives
+  long before any application does — ships a namespace-only `module Rails` with no
+  singleton methods, so that guard reads true and the next call raises
+  `NoMethodError: undefined method 'env' for module Rails`. It now asks
+  `Rails.respond_to?(:env)`, which is the form `lib/studio.rb` already uses in three
+  places; this was the straggler. No shipped app can reach it — every host boots a
+  real application — but the engine's own pure-Ruby unit lane can, and it did:
+  adding one `require` for a file that needs `action_view` turned an untouched
+  `email_catalog_test` red with two errors about email uploads.
+
 - **The style guide's two "Sign Wallet" thumbnails no longer crown themselves
   with a padlock the card stopped drawing, and the guide's lock no longer trails
   the release that removed it.** solana-studio 0.6.1 replaced the step-up card's
@@ -606,7 +702,7 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
   **The band table shipped from the wrong file.** The `.nav-shell` `--nav-*`
   sizes were inline in `layouts/_navbar.html.erb`, so only an app rendering that
-  partial got them — and **three of six apps fork the navbar**
+  partial got them — and **three of five apps fork the navbar**
   (`turf-monster`, `mcritchie-studio`, `moms-app`), each left to hand-write its
   own. That is precisely how four independent copies of this collapse came to
   exist. They now ship from `engine.css`, which every engine-consuming app

data/Gemfile

@@ -40,8 +40,9 @@ end
 #
 # DEVELOPMENT AND TEST ONLY, and deliberately NOT a gemspec runtime dependency.
 # Declaring it there would push a Solana stack onto every BASE consumer
-# (acquisition-studio, mcritchie-industries, moms-app mount this engine and
-# bundle no solana-studio), which is precisely the coupling the split removed.
+# (mcritchie-studio, acquisition-studio, mcritchie-industries and moms-app all
+# mount this engine and bundle no solana-studio — four of the five consumers,
+# the hub included), which is precisely the coupling the split removed.
 # It is here so the DUMMY app can resolve the gem's partials and the style guide
 # renders the real shipped cards rather than a fork of them.
 #

data/app/assets/tailwind/studio_engine/engine.css

@@ -415,7 +415,7 @@ body.modal-open .studio-app-banner {
 /* === THE NAVBAR COLLAPSE BAND TABLE =====================================
    LAYER 2 OF THE PRIMITIVE, and it lives here rather than in
    layouts/_navbar.html.erb for one reason: every engine-consuming app imports
-   this stylesheet, but only some render that partial. Three of six FORK the
+   this stylesheet, but only some render that partial. Three of five FORK the
    navbar (turf-monster, mcritchie-studio, moms-app), and while the table sat
    inline each fork had to hand-write its own — which is exactly how four
    independent copies of this collapse came to exist.

data/app/views/layouts/_navbar.html.erb

@@ -71,7 +71,7 @@
     @media (min-width: 400px) { .user-nav-col { width: 15rem; } .user-nav-fit { max-width: 15rem; } }
     @media (min-width: 768px) { .user-nav-col { width: 20rem; } .user-nav-fit { max-width: 20rem; } }
     /* The COLLAPSE band table used to live here, which meant only an app
-       rendering THIS partial got it. Three of six apps fork the navbar, so each
+       rendering THIS partial got it. Three of five apps fork the navbar, so each
        was left to hand-write its own — the way four independent copies happened
        in the first place. It ships from engine.css now (every consuming app
        imports it), so a forking app OPTS IN with `nav-shell` +

data/app/views/solana_sessions/phantom_callback.html.erb

@@ -137,6 +137,68 @@
     dbg('  ' + key, truncate(val, 40));
   });
 
+  // === THE REDIRECT TRANSPORT'S RETURN LEG ==============================
+  //
+  // TRIED FIRST, AND EVERYTHING BELOW IS LEFT EXACTLY AS IT WAS. The legacy
+  // block that follows handles ONE step — Phantom's signIn — with keys named
+  // phantom_dl_*, and it is what production mobile sign-in runs on TODAY. It is
+  // not touched, moved, or reworded here: a consumer that has not yet adopted
+  // the new transport must behave identically after this change, and the only
+  // honest way to promise that is to leave its code alone.
+  //
+  // GUARDED THE WAY THIS CODEBASE GUARDS EVERY OPTIONAL CAPABILITY: a host that
+  // does not load solana_studio/wallet_ops.js + wallet_journal.js has no
+  // SolanaStudio.walletOps, so this branch never runs and the legacy path is
+  // the whole program. An absent capability must not default to the permissive
+  // branch — the same rule the wallet picker's canDeepLink learned.
+  //
+  // WHY THE PENDING-JOURNAL CHECK IS PART OF THE GUARD, not just the globals:
+  // a host may load the new scripts while a signIn started under the OLD keys
+  // is still in flight — a user mid-round-trip across a deploy. Requiring an
+  // actual wallet_dl journal means that user finishes on the path they started,
+  // rather than being handed to a resumer with nothing to resume.
+  //
+  // WHAT THIS BRANCH DOES NOT DO: decrypt, verify, or know what the user was
+  // trying to accomplish. walletOps owns the step machine and the registered
+  // intent owns the outcome. This is a seam, and keeping it a seam is what lets
+  // the same callback serve sign-in and a contest entry without learning either.
+  var studio = window.SolanaStudio;
+  var hasResumer = !!(studio && studio.walletOps && typeof studio.walletOps.resume === 'function' &&
+                      studio.walletJournal && typeof studio.walletJournal.peek === 'function');
+
+  if (hasResumer && studio.walletJournal.peek()) {
+    dbg('Transport', 'wallet_dl journal present — resuming through walletOps');
+
+    studio.walletOps.resume(params, {
+      navigate: function(url) { window.location.href = url; }
+    }).then(function(result) {
+      // SUSPENDED means resume already navigated to the next hop; this document
+      // is on its way out and must not also redirect, or the two race.
+      if (result && result.suspended) {
+        dbg('Transport', 'advanced to the next hop');
+        return;
+      }
+      if (result && result.done) {
+        dbg('Transport', 'intent complete');
+        // The registered intent owns where to land — it knows what the user was
+        // doing. Falling back to '/' rather than guessing a wallet-specific
+        // destination, which this file has no business knowing.
+        window.location.href = (result.value && result.value.redirect) || '/';
+        return;
+      }
+      // No pending request is a STATE, not a failure: a stale bookmark, a second
+      // tab, a reload after the journal was consumed. peek() said otherwise a
+      // moment ago, so this is a race, and the honest answer is to start over.
+      showError('No pending wallet request. Redirecting to login...');
+    }, function(err) {
+      // A user rejection arrives here with .rejected set — the wallet's own
+      // words, already mapped. Anything else is a genuine fault.
+      dbg('Transport ERROR', (err && err.message) || String(err));
+      showError((err && err.message) || 'Wallet request failed');
+    });
+    return;
+  }
+
   // Check for Phantom error
   if (params.get('errorCode')) {
     dbg('ERROR', 'errorCode=' + params.get('errorCode'));

data/app/views/studio/emails/show.html.erb

@@ -197,6 +197,17 @@
 
   <%# ROW TWO — the pictures, and the words that ride on them. %>
   <div class="grid gap-6 md:grid-cols-2 mb-6">
+    <%# THE FILENAMES AND THE LABEL ARE ESCAPED ON THE WAY INTO THIS x-data. All
+        three come off the email REGISTRY entry rather than a form, so nothing
+        reaches them with a quote today — but they are the only values in the
+        attribute that are not authored right here, and bare interpolation of one
+        would close its JS literal and mount the whole upload host as a silent
+        no-op: an image picker that opens, crops, and never saves.
+
+        successMessage previously used the BARE `j` form. That is correct only
+        while the label is a plain String — `j` preserves an html_safe marking, and
+        a safe value would skip ERB's attribute-escaping half and let a raw double
+        quote out of the attribute. Studio::JsLiteral removes that condition. %>
     <section class="card p-4"
       <% if @uploads_available %>
         x-data="imageUploadHost({
@@ -205,10 +216,10 @@
           maxWidth: <%= max_width %>,
           transparent: false,
           allowGifs: true,
-          filename: '<%= @entry.key %>.png',
+          filename: '<%= Studio::JsLiteral.in_attribute(@entry.key) %>.png',
           saving: 'Saving banner…',
           success: 'Banner updated',
-          successMessage: '<%= j @entry.label %> now uses this app\'s own image.',
+          successMessage: '<%= Studio::JsLiteral.in_attribute(@entry.label) %> now uses this app\'s own image.',
           failure: 'Couldn\'t save the banner'
         })"
         @crop-photo-confirmed.window="onCropConfirmed($event.detail)"
@@ -513,7 +524,7 @@
            maxWidth: 600,
            transparent: true,
            allowGifs: false,
-           filename: '<%= @entry.key %>-logo.png',
+           filename: '<%= Studio::JsLiteral.in_attribute(@entry.key) %>-logo.png',
            saving: 'Saving logo…',
            success: 'Logo updated',
            successMessage: 'This email now uses its own logo.',

data/app/views/studio/modals/_crop_photo.html.erb

@@ -26,7 +26,13 @@
   The living style guide passes store: "dsModals" for its page-scoped host.
 %>
 <% crop_store = local_assigns.fetch(:store, "modals") %>
-<div x-data="cropPhotoModal({ store: '<%= crop_store %>' })">
+<%# STRING position, so it is ESCAPED rather than validated: the store name is
+    handed to cropPhotoModal as a JS string argument, not spliced in as a bare
+    identifier. An apostrophe would close that literal and mount the modal as a
+    silent no-op that still renders every element below. Studio::JsLiteral carries
+    why both escapers have to run. %>
+<% crop_store_js = Studio::JsLiteral.in_attribute(crop_store) %>
+<div x-data="cropPhotoModal({ store: '<%= crop_store_js %>' })">
   <h3 class="text-heading font-bold text-lg text-center mb-4">Crop Photo</h3>
 
   <template x-if="error">

data/app/views/studio/modals/blocks/_entry_confirmed.html.erb

@@ -71,6 +71,12 @@
   subtitle_key     = local_assigns[:subtitle_key]
   tx_signature_key = local_assigns.fetch(:tx_signature_key, "props.txSignature")
   cluster_param    = local_assigns.fetch(:cluster_param, "")
+  # STRING position — clusterParam is a JS string on the root scope that
+  # _success_card's tx-link concatenates into a URL. An apostrophe closes the
+  # literal and the whole x-data becomes a SyntaxError, which mounts this card and
+  # every nested block as a silent no-op. props_expr one line up is the OPPOSITE
+  # shape (an Alpine expression by contract) and is deliberately left alone.
+  cluster_param_js = Studio::JsLiteral.in_attribute(cluster_param)
   lobby_url_key    = local_assigns.fetch(:lobby_url_key, "props.lobbyUrl")
   cta_label        = local_assigns.fetch(:cta_label, "Continue")
   seeds_earned_key = local_assigns.fetch(:seeds_earned_key, "props.seedsEarned")
@@ -113,7 +119,7 @@
 <%# props getter + clusterParam live on the root scope so _success_card's nested
     Alpine expressions (props.txSignature, props.lobbyUrl, clusterParam) resolve up
     the scope chain. clusterParam feeds _success_card's branded tx-link URL. %>
-<div x-data="{ get props() { return <%= props_expr %>; }, clusterParam: '<%= cluster_param %>' }">
+<div x-data="{ get props() { return <%= props_expr %>; }, clusterParam: '<%= cluster_param_js %>' }">
   <%= render "studio/modals/blocks/success_card", sc_locals do %>
     <%# The app's own enrichment, above the seeds bar. turf puts its kickoff
         countdown here — "when does it start" reads before the celebratory seeds

data/app/views/studio/modals/blocks/_error_card.html.erb

@@ -24,6 +24,15 @@
 <%
   icon_emoji = local_assigns[:icon_emoji] || "⏳"   # ⏳
   cta_label  = local_assigns[:cta_label]  || 'Refresh'
+  # THE TWO EVENT NAMES ARE THE ONLY LOCALS HERE THAT LAND INSIDE JS. Both sit in a
+  # single-quoted literal inside a double-quoted @click, so an apostrophe in either
+  # closes the literal, the handler becomes a SyntaxError, and the button renders
+  # perfectly and does NOTHING when clicked — no error, no log, nothing a markup
+  # assertion can see. Escaped, not validated: an event name is a STRING to
+  # $dispatch, and any character is legal in one. Studio::JsLiteral says why the
+  # interpolated form is load-bearing.
+  cta_event_js       = Studio::JsLiteral.in_attribute(local_assigns[:cta_event])
+  secondary_event_js = Studio::JsLiteral.in_attribute(local_assigns[:secondary_event])
 %>
 <%# role="alert" on the CARD, not on its message: the message is server-rendered
     static text, so it never "changes" for a live region to notice. The modal host
@@ -42,11 +51,11 @@
   <% if local_assigns[:cta_reload] %>
     <button @click="window.location.reload()" class="btn btn-outline btn-sm"><%= cta_label %></button>
   <% elsif local_assigns[:cta_event] %>
-    <button @click="$dispatch('<%= cta_event %>')" class="btn btn-outline btn-sm"><%= cta_label %></button>
+    <button @click="$dispatch('<%= cta_event_js %>')" class="btn btn-outline btn-sm"><%= cta_label %></button>
   <% end %>
 
   <% if local_assigns[:secondary_label] && local_assigns[:secondary_event] %>
-    <button @click="$dispatch('<%= secondary_event %>')"
+    <button @click="$dispatch('<%= secondary_event_js %>')"
             class="block mx-auto mt-3 text-xs text-secondary hover:text-heading underline underline-offset-2">
       <%= secondary_label %>
     </button>

data/app/views/studio/modals/blocks/_solana_tx_link.html.erb

@@ -17,10 +17,15 @@
 <%
   tx_signature_key = local_assigns.fetch(:tx_signature_key)
   cluster_param    = local_assigns.fetch(:cluster_param, "")
+  # STRING position, inside the :href expression below. tx_signature_key beside it
+  # is an Alpine EXPRESSION by contract and is spliced in bare; this one is a
+  # literal suffix, so an apostrophe would close it and turn the whole :href
+  # binding into a SyntaxError — the link then renders with no href at all.
+  cluster_param_js = Studio::JsLiteral.in_attribute(cluster_param)
 %>
 <template x-if="(<%= tx_signature_key %>)">
   <div class="text-center mb-3 -mt-1">
-    <a :href="'https://explorer.solana.com/tx/' + (<%= tx_signature_key %>) + '<%= cluster_param %>'"
+    <a :href="'https://explorer.solana.com/tx/' + (<%= tx_signature_key %>) + '<%= cluster_param_js %>'"
        target="_blank" rel="noopener"
        class="inline-flex items-center gap-2 px-3 py-1.5 rounded-lg border border-subtle hover:border-primary/50 transition group no-underline"
        style="background: rgb(var(--color-primary-500-rgb) / 0.06);">

data/app/views/studio/modals/blocks/_success_card.html.erb

@@ -106,6 +106,19 @@
     }
   }".gsub(/\s+/, ' ').html_safe
 
+  # THE TWO EVENT NAMES, ESCAPED FOR THE @click THEY ARE SPLICED INTO. Each sits in
+  # a JS single-quoted literal inside a double-quoted attribute, so an apostrophe in
+  # either closes the literal and the handler becomes a SyntaxError — a CTA that
+  # renders exactly right and does nothing when clicked. This is the engine's
+  # most-rendered block, so it is also the widest reach that failure has.
+  #
+  # ESCAPED, NOT VALIDATED: an event name is a STRING argument to $dispatch and any
+  # character is legal in one. Contrast cta_href_key / props_expr below, which are
+  # Alpine EXPRESSIONS by contract and must not be touched. Studio::JsLiteral
+  # carries why the interpolated form is load-bearing.
+  cta_event_js       = Studio::JsLiteral.in_attribute(local_assigns[:cta_event])
+  secondary_event_js = Studio::JsLiteral.in_attribute(local_assigns[:secondary_event])
+
   init_calls = []
   init_calls << "fireConfetti()" if fire_confetti
   init_calls << "startCountdown(#{local_assigns[:auto_redirect_url_key]})" if has_redirect
@@ -229,7 +242,7 @@
         <span class="relative z-10"><%= cta_label %></span>
       </a>
     <% elsif use_drain && local_assigns[:cta_event] %>
-      <button @click="$dispatch('<%= cta_event %>')"
+      <button @click="$dispatch('<%= cta_event_js %>')"
               class="btn btn-primary btn-lg w-full relative overflow-hidden no-underline">
         <div class="absolute inset-0 pointer-events-none origin-left"
              style="background: rgba(255,255,255,0.18);"
@@ -246,12 +259,12 @@
     <% elsif local_assigns[:cta_href_key] %>
       <a :href="<%= cta_href_key %>" class="btn btn-primary btn-lg w-full"><%= cta_label %></a>
     <% elsif local_assigns[:cta_event] %>
-      <button @click="$dispatch('<%= cta_event %>')" class="btn btn-primary btn-lg w-full"><%= cta_label %></button>
+      <button @click="$dispatch('<%= cta_event_js %>')" class="btn btn-primary btn-lg w-full"><%= cta_label %></button>
     <% end %>
   <% end %>
 
   <% if local_assigns[:secondary_label] && local_assigns[:secondary_event] %>
-    <button @click="$dispatch('<%= secondary_event %>')"
+    <button @click="$dispatch('<%= secondary_event_js %>')"
             class="block mx-auto mt-3 text-xs text-secondary hover:text-heading underline underline-offset-2">
       <%= secondary_label %>
     </button>

data/app/views/studio/modals/onboarding/_first_name.html.erb

@@ -94,11 +94,11 @@
     STRING position — empty_error, submit_path, skip_path, done_event — each sits
       inside a JS SINGLE-quoted literal. A bare apostrophe closes the literal, the
       expression becomes a SyntaxError, and the card is that silent no-op. Repair:
-      escape_javascript, in the INTERPOLATED form. The wrapper is load-bearing:
-      escape_javascript(SafeBuffer) answers true to html_safe, so ERB would skip
-      its own attribute-escaping half and a raw double quote could still close the
-      attribute. Wrapping the value in a plain interpolation first strips the safe
-      marking, so both escapers run.
+      Studio::JsLiteral.in_attribute, which is where the mechanism now lives and is
+      tested. Two escapers have to run — one for the JS literal, one for the
+      attribute — and the second only runs on a value ERB still believes is unsafe.
+      This card used to spell that out inline at four sites; the engine has eleven
+      more of them, so it is one method with one guard now.
 
     IDENTIFIER position — modal_store — is spliced in as a bare NAME, at three
       sites: the props getter, finish's close, and the Ruby-built dismiss_action
@@ -145,15 +145,15 @@
   # apostrophes. Interpolated raw, an error reading "We'll need a name" would
   # close the JS single-quoted string, make the whole expression a SyntaxError,
   # and mount the component as a SILENT NO-OP that still renders every element
-  # below. escape_javascript covers the apostrophe, the double quote, the
-  # backslash and the newline; the interpolation around it first strips any
-  # html_safe marking, because a safe string would skip ERB's own attribute
-  # escaping and could smuggle a raw double quote in — the exact failure the
-  # CRITICAL note above describes.
+  # below. Studio::JsLiteral.in_attribute covers the apostrophe, the double quote,
+  # the backslash and the newline, AND hands ERB a value it still believes is
+  # unsafe so the attribute's own escaping runs too — a safe string would skip that
+  # half and could smuggle a raw double quote in, the exact failure the CRITICAL
+  # note above describes.
   #
   # INERT ON BOTH DEFAULTS. Neither default string contains a character either
   # escaper touches, so the shipped card is byte-for-byte what it was.
-  empty_error_js = escape_javascript("#{empty_error}")
+  empty_error_js = Studio::JsLiteral.in_attribute(empty_error)
   placeholder = local_assigns.fetch(:placeholder, "Alex")
   # OFF unless a host passes a non-empty array. Normalised to nil so that an
   # empty list behaves exactly like an absent local rather than emitting the
@@ -201,11 +201,11 @@
   # Alpine mounts the component as a SILENT NO-OP that still renders every element
   # — perfect-looking markup, dead card.
   #
-  # THE INTERPOLATED FORM IS LOAD-BEARING, not a style choice:
-  # escape_javascript(SafeBuffer).html_safe? is TRUE, so ERB would skip its own
-  # attribute-escaping half and a raw double quote could still close the
-  # double-quoted x-data. Wrapping in "#{}" first strips the html_safe marking, so
-  # both escapers run: escape_javascript for the JS literal, ERB for the attribute.
+  # WHY A METHOD RATHER THAN escape_javascript AT EACH SITE: the second escaper is
+  # conditional. ERB skips a value that answers true to html_safe, and
+  # escape_javascript preserves its argument's marking, so the naive call silently
+  # loses the attribute half. Studio::JsLiteral.in_attribute owns that, and owns the
+  # single test that fails when it is removed.
   #
   # INERT ON EVERY DEFAULT. Two paths, an event name and a store name carry no
   # character either escaper touches, so the shipped card is byte-for-byte what it
@@ -213,9 +213,9 @@
   # host supplies these as prose today, but empty_error established that prose does
   # belong in this attribute, and the next local to carry an apostrophe will look
   # like an ordinary change to whoever writes it.
-  submit_path_js = escape_javascript("#{submit_path}")
-  skip_path_js   = escape_javascript("#{skip_path}")
-  done_event_js  = escape_javascript("#{done_event}")
+  submit_path_js = Studio::JsLiteral.in_attribute(submit_path)
+  skip_path_js   = Studio::JsLiteral.in_attribute(skip_path)
+  done_event_js  = Studio::JsLiteral.in_attribute(done_event)
   field_id    = local_assigns.fetch(:id, "onboarding-first-name")
   # The × mirrors the skip affordance it sits beside: it SKIPS while the step is
   # skippable, and merely CLOSES once it is required. Resolved here rather than in

data/app/views/studio/profiles/_birthday_fields.html.erb

@@ -37,9 +37,16 @@
   m = user.birth_month
   d = user.birth_day
   value = (y.present? && m.present? && d.present?) ? format("%04d-%02d-%02d", y, m, d) : nil
+  # ESCAPED FOR THE x-data BELOW. format() cannot produce a quote today, so this is
+  # latent cover rather than a live fix — but the local is read off a USER record,
+  # and the guard has to sit on the splice rather than on today's formatter. Bare,
+  # an apostrophe would close the JS literal and studioBirthdayFields would never
+  # evaluate, leaving three selects that render and never save. The <input value="">
+  # copy below needs no such treatment: ERB already escapes it, and it is not JS.
+  value_js = Studio::JsLiteral.in_attribute(value)
 %>
 
-<div x-data="studioBirthdayFields('<%= value %>')">
+<div x-data="studioBirthdayFields('<%= value_js %>')">
   <%# --- the JS-less path ------------------------------------------------- %>
   <template x-if="!alpine">
     <input type="date" name="profile[birthday]" id="profile_birthday"

data/app/views/style/_modals.html.erb

@@ -43,13 +43,30 @@
   # /auth/solana routes, Solana::SessionAuth, the phantom callback) and ships no
   # wallet UI at all.
   #
-  # So resolution is a RUNTIME question here, not a build-time one. Three of the
-  # six apps mounting this engine (acquisition-studio, mcritchie-industries,
-  # moms-app) bundle no solana-studio, and an unconditional render would turn
-  # their /admin/style into a missing-template 500. The gem is a development and
+  # So resolution is a RUNTIME question here, not a build-time one. FOUR of the
+  # five apps mounting this engine (mcritchie-studio, acquisition-studio,
+  # mcritchie-industries, moms-app) bundle no solana-studio — turf-monster is
+  # the only one that does — and an unconditional render would turn their
+  # /admin/style into a missing-template 500. The gem is a development and
   # test dependency of this engine precisely so the guide can show the REAL
   # cards; where it is absent the specimens stay listed but unopenable.
   #
+  # THE EXCEPTION IS THE DURABLE HALF; the count rots the day an app is born.
+  # Derived 2026-09-07 — and the CRITERION is recorded, not just the count,
+  # because the obvious grep does not reproduce it. The five are the checkouts
+  # whose own config/routes.rb calls `Studio.routes(self)`, the same five
+  # lib/studio.rb's draw_profile_routes note names. Grepping Gemfiles for
+  # `gem "studio-engine"` returns SEVEN: it also catches solana-studio, which
+  # pins the engine in `group :development, :test` for its dummy and draws no
+  # routes, and mcritchie-studio-ai-builder-cache, which is the HUB checked out
+  # twice (same Heroku remote; HEAD c7d5d326 is a commit inside
+  # mcritchie-studio) and would double-count it. This line used to read "three
+  # of the six" and to omit the HUB — the app a reader is likeliest to be
+  # sitting in, and one that bundles no solana-studio. Two further near misses:
+  # chain-ops bundles solana-studio WITHOUT this engine, so it is not in this
+  # set at all; acquisition-studio is a retired prototype whose Gemfile still
+  # pins the engine, so it is.
+  #
   # Same three-term lookup_context.exists? the modal host uses for host_extras
   # (studio/modals/_host.html.erb): name, prefixes, partial.
   web3_gem = lookup_context.exists?("wallet_connect", ["solana_studio/modals"], true)

data/lib/studio/js_literal.rb

@@ -0,0 +1,80 @@
+require "action_view"
+
+module Studio
+  # ONE home for the repair that keeps a host-supplied value from bricking an
+  # Alpine component when it is spliced into a JS-evaluating HTML attribute.
+  #
+  # THE FAILURE THIS EXISTS FOR is silent, which is the whole reason it is worth a
+  # module instead of a convention. A local sits inside a JS single-quoted literal
+  # in a double-quoted attribute:
+  #
+  #     <button @click="$dispatch('<%= cta_event %>')">
+  #
+  # A bare apostrophe in `cta_event` closes that literal, the expression becomes a
+  # SyntaxError, and Alpine mounts the component as a NO-OP that still renders
+  # every element. Perfect-looking markup, dead card. Nothing raises, nothing logs
+  # a server-side warning, and every string assertion about the response bytes
+  # still passes — which is how this class of defect survives a review.
+  #
+  # BOTH ESCAPERS HAVE TO RUN, and that is the part a hand-written call gets wrong.
+  # There are two nested contexts, so there are two ways out of the attribute:
+  #
+  #   * out of the JS STRING, with `'` — repaired by escape_javascript
+  #   * out of the HTML ATTRIBUTE, with `"` — repaired by ERB's own escaping
+  #
+  # escape_javascript covers the first. ERB covers the second, but ONLY for a value
+  # it believes is unsafe, and `escape_javascript(SafeBuffer)` answers true to
+  # html_safe?. Hand an html_safe string straight to escape_javascript and ERB
+  # steps aside, a raw double quote reaches the attribute, and the attribute closes
+  # early — the same dead card by a longer route.
+  #
+  # So the interpolation wrapper below is LOAD-BEARING, not a style tic: `"#{value}"`
+  # produces a plain String, escape_javascript therefore returns a plain String, and
+  # ERB does its half on the way into the attribute. That subtlety was re-derived at
+  # every call site before this module existed, and it had no test cover anywhere;
+  # it now has exactly one implementation and one guard
+  # (test/lib/studio/js_literal_test.rb).
+  #
+  # DELIBERATELY NARROW — there is no script-body variant here, and adding one is
+  # not a copy of this method. Inside <script>…</script> the HTML parser does no
+  # entity decoding, so ERB's escaping is not a second layer of safety there, it is
+  # CORRUPTION: `\"` would arrive as `\&quot;` and break the JS this method exists
+  # to protect. A script body wants JS escaping ONLY (escape_javascript, marked
+  # safe). The name says `in_attribute` so that the next person reaching for this in
+  # a <script> has to stop and notice the difference.
+  #
+  # AND IT IS THE WRONG REPAIR FOR IDENTIFIER POSITION. A local spliced in as a bare
+  # NAME — `$store.<%= modal_store %>.close()` — must be VALIDATED, never escaped:
+  # escape_javascript also escapes `$`, so a legitimate store name like `dsModals$2`
+  # comes back mangled and the card dies anyway. The SHAPE of the splice decides the
+  # repair, never the name of the local. studio/modals/onboarding/_first_name
+  # carries the worked example of both.
+  module JsLiteral
+    extend ActionView::Helpers::JavaScriptHelper
+
+    module_function
+
+    # Escape +value+ for a JS string literal that lives inside an HTML attribute.
+    #
+    # Returns a plain (NOT html_safe) String on purpose — see the note above. The
+    # caller interpolates it inside the JS quotes, exactly as it would have
+    # interpolated the raw local:
+    #
+    #     cta_event_js = Studio::JsLiteral.in_attribute(cta_event)
+    #     # …
+    #     <button @click="$dispatch('<%= cta_event_js %>')">
+    #
+    # nil becomes "" rather than "nil", because every current caller reaches this
+    # with an optional local and an empty JS string is the honest rendering of an
+    # absent value.
+    # ONE MECHANISM, DELIBERATELY. An earlier draft also re-stripped the marking on
+    # the way out, as belt-and-braces. That made both halves redundant, and a
+    # redundant guard is one that survives being deleted: removing the interpolation
+    # below left every test green, because the second stripper covered for it. There
+    # is one way this works now, and test/lib/studio/js_literal_test.rb fails when it
+    # is removed.
+    def in_attribute(value)
+      JsLiteral.escape_javascript("#{value}")
+    end
+  end
+end

data/lib/studio/s3.rb

@@ -123,7 +123,16 @@ module Studio
       def environment
         return "dev" if EnvironmentBanner.qa_environment?
 
-        defined?(Rails) && Rails.env.production? ? "production" : "dev"
+        # ASKS FOR THE METHOD, NOT THE CONSTANT, and the difference is not
+        # theoretical. rails-html-sanitizer — which arrives with action_view, long
+        # before any Rails APPLICATION does — defines a namespace-only `module
+        # Rails` with no singleton methods on it. Against that, a bare
+        # `defined?(Rails)` reads TRUE and the very next call dies with
+        # NoMethodError: undefined method `env` for module Rails. lib/studio.rb
+        # already spells the guard this way in three places; this was the
+        # straggler, and it turned an unrelated green suite red the first time a
+        # unit test pulled action_view in.
+        defined?(Rails) && Rails.respond_to?(:env) && Rails.env&.production? ? "production" : "dev"
       end
     end
   end

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.72.3"
+  VERSION = "0.74.0"
 end

data/lib/studio.rb

@@ -8,6 +8,7 @@ require "studio/color_scale"
 require "studio/environment_banner"
 require "studio/theme_resolver"
 require "studio/ui_primitives"
+require "studio/js_literal"
 require "studio/sidebar_sections"
 require "studio/profile_sections"
 require "studio/profile_image"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.72.3
+  version: 0.74.0
 platform: ruby
 authors:
 - Alex McRitchie
@@ -573,6 +573,7 @@ files:
 - lib/studio/geo/lookup.rb
 - lib/studio/image_cache.rb
 - lib/studio/ip_locations.rb
+- lib/studio/js_literal.rb
 - lib/studio/link_resolution.rb
 - lib/studio/link_token.rb
 - lib/studio/log_rotation.rb