studio-engine 0.73.0 → 0.74.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 60486d6f2711eb8d61d258fa6305f05cfd2d85910858aacc1506dee587f3c114
-  data.tar.gz: beb3d3a69e3c01fca35a1196e37065b56b9b563696e2d7d3c6d15d5718440fd1
+  metadata.gz: d056d9eddc4bd13c863b5ec0f3e239e7591fc16ddd2170ac5192537f5a190326
+  data.tar.gz: 289b7050571718689aa567db5f0434be21c41ee7074b4b49d26969f16b07a815
 SHA512:
-  metadata.gz: c668f68df4d51e460a58a3bfb6b8608acb943b9ab75558b7676c9ed79489219e686249e45c20593ec97c70401ed34c9b8ce78fafb927201912c1d0e87012fd1e
-  data.tar.gz: f9f13b69c48bd71d7ad127e1229245a7079dd0155dcfd731fe3044b25fcd439217e6dd61ca3f33b4c73b065cd8d5629dacd500218ac1b27cd02270f528f78e3a
+  metadata.gz: 15c2e97be72e8fe2e4e67719a569f6d456f82e961fd36b11d0c5062d8ace97836316398eef5058bf9436cdec7ec4ed33aca31ca7decf70bcfe3569dd8665e693
+  data.tar.gz: 6dd53cf3747fdb36271afaea5a76c0dc2ee615e25f394083b3219476a5222991999edf97474e1022e9f2f584350ba05b04cbfaa01d5fe0f28ce2995f3a06d6fa

data/CHANGELOG.md

@@ -4,6 +4,156 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+### Fixed
+
+- **A quote in a host local can no longer close an Alpine attribute and turn the
+  rest of the element into markup.** Four partials built an attribute — its OWN
+  QUOTES included — as a Ruby String and marked it `html_safe`, which is the one
+  shape ERB's attribute escaping can never reach: the marking tells ERB to stand
+  down, so a double quote in the local ended the attribute and the HTML parser read
+  the remainder as new attributes. Measured, not reasoned: one hostile
+  `auto_redirect_seconds` turned the success card's root into an element carrying
+  attributes named `quote"`, `\`, `<` and `script`, with its `class` swallowed
+  whole. This is strictly worse than the JS-string-literal class fixed in
+  *Host-supplied locals can no longer brick an Alpine component* below, which at
+  least stayed inside its attribute.
+
+  **THE REPAIR IS NOT ESCAPING.** These locals are Alpine EXPRESSIONS by contract —
+  the caller is handing the engine JS on purpose — so `escape_javascript` would
+  break the feature it was protecting. The partials stop writing the quotes and let
+  ActionView write them: `tag.attributes("x-init": expr.html_safe)`. `tag_option`
+  runs `gsub('"', "&quot;")` on the finished value UNCONDITIONALLY, on the line
+  AFTER the escape branch it skips for a marked String, so the expression keeps its
+  apostrophes, angle brackets and backslashes byte-for-byte and still cannot end the
+  attribute. `blocks/_rail_row:112` already did exactly this and was the worked
+  example.
+
+  **WHAT MOVED — twelve splices in four files.** `blocks/_success_card` (the
+  Ruby-built `x-data` countdown object, and the `x-init` call list that splices
+  `auto_redirect_url_key`), `blocks/_processing_card` (one assembled `x-data`/`x-init`
+  pair carrying TWO locals — `resolve_expr` and `min_duration`, which only LOOKS
+  numeric because just its guard calls `.to_i`), `blocks/_leveling_activity` (the
+  Next Quest `@click`, plus `minlength` / `maxlength` / `pattern` / `title` on the
+  form input), and `components/_sidebar_panel` (`@click.outside`,
+  `@keydown.escape.window` and `@turbo:before-cache.window` on the root of the shell
+  every link menu hangs from). No default or in-repo value contains a character tag
+  encoding touches, so every shipped page renders byte-for-byte what it did — a
+  render-level test asserts that directly.
+
+  **THE MARKING NOW FOLLOWS WHAT THE VALUE IS.** Code stays `html_safe` and reaches
+  the browser unchanged; CONTENT does not. The four input constraint attributes are
+  a length, a regex and a tooltip, so they take the full escaping a content
+  attribute is owed — which also closes a second latent bug the marking carried, a
+  bare `&` in a `title` or `pattern` reaching the browser as the start of an entity.
+
+  **TWO OF THE SIX SITES ON THE ORIGINAL LIST WERE ALREADY SAFE and were left
+  alone.** `blocks/_rail_row:112` routes its handler through `content_tag`, and
+  `board/_card_shell:54` escapes both halves of its arbitrary-attribute passthrough
+  through ERB. Both were re-verified by rendering them with a hostile value, not by
+  reading them. Filing a fix for either would have bought a guard that can never
+  bite.
+
+  **HOW THE GUARDS ASSERT.** `test/views/assembled_attribute_locals_test.rb` reads
+  every seam through Nokogiri's HTML5 parser — the algorithm a browser runs — and
+  asserts on the DECODED attribute value, never on the template's output bytes,
+  because ERB entity-escapes an unmarked value too and a raw-markup structural
+  assertion therefore cannot fail. (HTML5 rather than HTML4 on purpose: HTML4
+  silently drops an `@click`, so every Alpine assertion made through it reads nil on
+  a correct page.) Each seam makes two claims — the element carries exactly the
+  attributes a benign value gives it, and the browser recovers the whole expression
+  — plus a non-vacuity control that fails if the partial ever stops splicing the
+  local at all. All twelve were mutated back to their assembled form ONE AT A TIME
+  and each was killed by its own test; the shared `_processing_card` call was also
+  mutated per-local. `test/lib/studio/attribute_encoding_contract_test.rb` pins the
+  ActionView property the whole repair stands on, so a future Rails moving that
+  `gsub` reports itself as one dependency change rather than twelve partial bugs.
+
+  **STILL OPEN, and named rather than quietly folded in:**
+  `studio/mailers/_layered_banner:69,100` assemble `background=` and `bgcolor=` the
+  same way. Same shape, different family — email attributes, no Alpine, no JS — so
+  they are left for their own ticket rather than widened into this one.
+
+- **The Rails guard sweep really is finished now, and a test says so instead of a
+  comment.** Fixing `Studio::S3` left THREE sites still guarding a Rails method
+  call on a bare `defined?(Rails)`: both keyword defaults in
+  `Studio::MailTransport.configure!` (`rails_env:` reading `Rails.env`, `logger:`
+  reading `Rails.logger`) and the developer-desk route guard in
+  `Studio.routes`. All three now ask `Rails.respond_to?` first.
+
+  **THE MAIL TRANSPORT ONE WAS ARMED, not theoretical.** `lib/studio.rb` requires
+  `studio/js_literal` (line 11) — whose first line is `require "action_view"`,
+  which is what defines the namespace-only `module Rails` — BEFORE it requires
+  `studio/mail_transport` (line 25). Measured at this branch's head, a bare
+  `Studio::MailTransport.configure!(env: {}, action_mailer: mailer)` died with
+  `NoMethodError: undefined method 'env' for module Rails`. No shipped app can
+  reach it (every host configures mail from an initializer, where `Rails.env`
+  exists, and all four in-repo callers pass `rails_env:` explicitly) — the cost
+  lands on the next gem unit test that omits the kwarg, which is the same
+  half-hour the `Studio::S3` fix already paid once.
+
+  **THE TWO DEFAULTS ARE SEPARATE STRAGGLERS**, and the first hid the second: Ruby
+  evaluates only the defaults a caller omitted, and `rails_env:` is declared above
+  `logger:`, so a bare call raised out of `Rails.env` and never reached
+  `Rails.logger`. `test/lib/studio/mail_transport_namespace_only_rails_test.rb`
+  supplies one argument and omits the other in each test, so each guard is pinned
+  independently rather than behind its neighbour.
+
+  **THE ROUTE GUARD IS PINNED BY A SCAN, deliberately.** `Studio.routes` only
+  loads inside a real Rails application, where `Rails.env` exists — so the
+  condition under test cannot be constructed where the file loads, and no
+  behavioural test can reach it. `test/lib/studio/rails_guard_sweep_test.rb` is
+  the tree-wide net instead, and it asserts both that it really read the files and
+  that its predicate still flags the original shape, so it cannot pass for free.
+
+  **The completeness claim itself was the other half of the bug.** `lib/studio/s3.rb`
+  and this changelog both said that fix "was the straggler" — while one of the
+  remaining three sat in `lib/studio.rb`, the very file the comment cited as
+  already clean. Both claims are corrected, and the comment now points at the test
+  rather than restating that the sweep is done.
+
+- **The app census in these comments was short by the most important app.** Ten
+  sites said this engine is mounted by SIX apps and that THREE of them bundle no
+  `solana-studio`. Measured 2026-09-07 by the criterion that reproduces it — a
+  checkout whose own `config/routes.rb` calls `Studio.routes(self)`. A Gemfile
+  grep returns seven instead, catching `solana-studio`'s dev-group pin and the
+  `mcritchie-studio-ai-builder-cache` clone of the hub. **Five** apps mount it —
+  `mcritchie-studio`, `turf-monster`, `acquisition-studio`,
+  `mcritchie-industries`, `moms-app` — and **four** of those bundle no
+  `solana-studio`. `turf-monster` is the only one that does.
+
+  **The omission was the HUB.** Every roster of BASE consumers named
+  `acquisition-studio`, `mcritchie-industries` and `moms-app` and left out
+  `mcritchie-studio` — the app a developer reading those comments is most likely
+  to be sitting in, and one whose `/admin/style` is exactly what the
+  missing-template gate protects. The error ran in the direction that
+  UNDERSTATES the risk the comments exist to explain.
+
+  **Two near misses are what make a naive count wrong.** `chain-ops` bundles
+  `solana-studio` and NOT this engine, so it is not in this set at all;
+  `acquisition-studio` is a retired prototype whose `Gemfile` still pins the
+  engine, so it is. `rolio` bundles neither and is not a consumer.
+
+  **Corrected at every site, because a partial correction is a contradiction:**
+  `app/views/style/_modals.html.erb`, `test/dummy/config/application.rb`,
+  `Gemfile`, `test/views/style_web3_specimens_test.rb`,
+  `test/views/style_host_section_test.rb` (both sites),
+  `app/views/layouts/_navbar.html.erb`,
+  `app/assets/tailwind/studio_engine/engine.css`,
+  `test/views/nav_collapse_contract_test.rb`, `test/lib/vendored_alpine_test.rb`,
+  `test/lib/vendored_montserrat_test.rb`, and two earlier Unreleased entries
+  below. The navbar-fork claim rides the same denominator — three of FIVE fork
+  it, not three of six, and the named three are unchanged — and the
+  Sprockets/propshaft split is two of five rather than "exactly half the fleet",
+  a phrase that encoded an even total no census supports.
+
+  **What was already right, and stays.** The five-consumer roster in
+  `lib/studio.rb`'s `draw_profile_routes` note (each checked 2026-08-14) named
+  the correct five all along; this change brings the rest of the repo to it. The
+  "all six consumer DATABASES" figures elsewhere in this file are three apps
+  times two environments, not an app count.
+
+  Comment and prose only. No behaviour changes.
+
 ### Added
 
 - **The first-name card now says WHICH path finished it, and can type its
@@ -80,7 +230,7 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
   that ships no such partial gets **nothing** — no pill, no heading, no
   container — and that is asserted as a whole-document comparison rather than a
   handful of refutes: the page an app WITH a section gets, minus that section
-  and its pill, must equal the page a base app gets. Five of the six apps
+  and its pill, must equal the page a base app gets. Four of the five apps
   mounting this engine will ship no host section, and their page is unchanged.
 
   **A host specimen drives `$store.modals`, not `dsModals`, and the distinction
@@ -272,6 +422,59 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ### Fixed
 
+- **A host's apostrophe no longer kills the card it was passed to — now across the
+  blocks, not just the first-name step.** The same defect
+  `onboarding/_first_name` fixed one release ago turns out to be an engine-wide
+  idiom: a host-supplied local interpolated into a JS string literal inside a
+  JS-evaluating attribute. Repaired at eleven more splices.
+
+  **WHY IT IS WORTH A CHANGELOG LINE WHEN NOTHING VISIBLE CHANGES.** The failure
+  mode is silent. A bare apostrophe closes the JS literal, the whole expression
+  becomes a SyntaxError, and Alpine mounts the component as a NO-OP that still
+  renders every element — a card that looks perfect and whose buttons do nothing.
+  There is no error on screen, nothing in the server log, and no markup assertion
+  that can see it. Every value in every consumer resolves to a source literal or a
+  frozen constant today, so this is latent cover rather than a live fix; it is
+  worth doing because the next local to carry prose will look like an ordinary
+  change to whoever writes it.
+
+  **WHAT MOVED.** `blocks/_success_card` (`cta_event` at both CTA branches,
+  `secondary_event`), `blocks/_error_card` (`cta_event`, `secondary_event`),
+  `blocks/_entry_confirmed` and `blocks/_solana_tx_link` (`cluster_param`),
+  `modals/_crop_photo` (`store`), `studio/emails/show` (the two upload filenames
+  and the success sentence), and `profiles/_birthday_fields` (the date value).
+  No default or in-repo value contains a character either escaper touches, so
+  every shipped card renders byte-for-byte what it did.
+
+  **THE MECHANISM NOW HAS ONE HOME AND ONE GUARD.** `Studio::JsLiteral.in_attribute`
+  replaces the four inline copies in `_first_name`. TWO escapers have to run — one
+  for the JS literal, one for the HTML attribute — and the second only runs on a
+  value ERB still believes is unsafe, which is why the value is interpolated before
+  it is escaped. That subtlety was re-derived at every call site and had no test
+  anywhere; deleting it used to leave the suite green.
+
+  **NOT A FIX FOR IDENTIFIER POSITION, deliberately.** A local spliced in as a bare
+  NAME — `$store.<name>.close()` — must be VALIDATED, never escaped, because
+  `escape_javascript` also escapes `$` and mangles a legal store name. That fleet
+  (about 36 splices across 19 partials) and a third class found alongside it —
+  Ruby-ASSEMBLED JS emitted into an attribute, some of it already `html_safe` — are
+  scoped OUT of this change and carry their own tickets. The SHAPE of the splice
+  decides the repair, never the name of the local.
+
+- **`Studio::S3` no longer mistakes a Rails NAMESPACE for a Rails application.**
+  `environment` guarded on `defined?(Rails)` and then called `Rails.env`.
+  rails-html-sanitizer — a transitive dependency of `action_view`, which arrives
+  long before any application does — ships a namespace-only `module Rails` with no
+  singleton methods, so that guard reads true and the next call raises
+  `NoMethodError: undefined method 'env' for module Rails`. It now asks
+  `Rails.respond_to?(:env)`, which is the form `lib/studio.rb` already uses in three
+  places. **This entry originally called it "the straggler"; that was wrong** —
+  three more sites carried the bare form, swept in *The Rails guard sweep really is
+  finished now* above. No shipped app can reach it — every host boots a
+  real application — but the engine's own pure-Ruby unit lane can, and it did:
+  adding one `require` for a file that needs `action_view` turned an untouched
+  `email_catalog_test` red with two errors about email uploads.
+
 - **The style guide's two "Sign Wallet" thumbnails no longer crown themselves
   with a padlock the card stopped drawing, and the guide's lock no longer trails
   the release that removed it.** solana-studio 0.6.1 replaced the step-up card's
@@ -606,7 +809,7 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
   **The band table shipped from the wrong file.** The `.nav-shell` `--nav-*`
   sizes were inline in `layouts/_navbar.html.erb`, so only an app rendering that
-  partial got them — and **three of six apps fork the navbar**
+  partial got them — and **three of five apps fork the navbar**
   (`turf-monster`, `mcritchie-studio`, `moms-app`), each left to hand-write its
   own. That is precisely how four independent copies of this collapse came to
   exist. They now ship from `engine.css`, which every engine-consuming app

data/Gemfile

@@ -40,8 +40,9 @@ end
 #
 # DEVELOPMENT AND TEST ONLY, and deliberately NOT a gemspec runtime dependency.
 # Declaring it there would push a Solana stack onto every BASE consumer
-# (acquisition-studio, mcritchie-industries, moms-app mount this engine and
-# bundle no solana-studio), which is precisely the coupling the split removed.
+# (mcritchie-studio, acquisition-studio, mcritchie-industries and moms-app all
+# mount this engine and bundle no solana-studio — four of the five consumers,
+# the hub included), which is precisely the coupling the split removed.
 # It is here so the DUMMY app can resolve the gem's partials and the style guide
 # renders the real shipped cards rather than a fork of them.
 #

data/app/assets/tailwind/studio_engine/engine.css

@@ -415,7 +415,7 @@ body.modal-open .studio-app-banner {
 /* === THE NAVBAR COLLAPSE BAND TABLE =====================================
    LAYER 2 OF THE PRIMITIVE, and it lives here rather than in
    layouts/_navbar.html.erb for one reason: every engine-consuming app imports
-   this stylesheet, but only some render that partial. Three of six FORK the
+   this stylesheet, but only some render that partial. Three of five FORK the
    navbar (turf-monster, mcritchie-studio, moms-app), and while the table sat
    inline each fork had to hand-write its own — which is exactly how four
    independent copies of this collapse came to exist.

data/app/views/components/_sidebar_panel.html.erb

@@ -34,9 +34,19 @@
   <% if id.present? %>id="<%= id %>"<% end %>
   x-cloak
   x-show="<%= open %>"
-  <%= %(#{outside_action.present? ? "@click.outside=\"#{outside_action}\"" : ""}).html_safe %>
-  <%= %(#{escape_action.present? ? "@keydown.escape.window=\"#{escape_action}\"" : ""}).html_safe %>
-  <%= %(#{close_action.present? ? "@turbo:before-cache.window=\"#{close_action}\"" : ""}).html_safe %>
+  <%# THE THREE DISMISSAL HANDLERS, EMITTED BY tag.attributes. Each was built as
+      %(@name="#{action}").html_safe — the attribute's OWN quotes assembled in Ruby
+      and then marked safe, which is the one shape ERB's escaping can never reach. A
+      double quote in any of the three actions closed the attribute and everything
+      after it became markup on the panel's root element.
+
+      The actions stay html_safe: they are Alpine EXPRESSIONS the host wrote (see the
+      @click at the close button below, and `open` above). tag_option's
+      gsub('"', "&quot;") runs on the finished value whether or not it is marked, so
+      the expression reaches Alpine unchanged and cannot end the attribute. %>
+  <%= tag.attributes("@click.outside": outside_action.html_safe) if outside_action.present? %>
+  <%= tag.attributes("@keydown.escape.window": escape_action.html_safe) if escape_action.present? %>
+  <%= tag.attributes("@turbo:before-cache.window": close_action.html_safe) if close_action.present? %>
   x-transition:enter="transition ease-out duration-300"
   x-transition:enter-start="translate-x-full"
   x-transition:enter-end="translate-x-0"

data/app/views/layouts/_navbar.html.erb

@@ -71,7 +71,7 @@
     @media (min-width: 400px) { .user-nav-col { width: 15rem; } .user-nav-fit { max-width: 15rem; } }
     @media (min-width: 768px) { .user-nav-col { width: 20rem; } .user-nav-fit { max-width: 20rem; } }
     /* The COLLAPSE band table used to live here, which meant only an app
-       rendering THIS partial got it. Three of six apps fork the navbar, so each
+       rendering THIS partial got it. Three of five apps fork the navbar, so each
        was left to hand-write its own — the way four independent copies happened
        in the first place. It ships from engine.css now (every consuming app
        imports it), so a forking app OPTS IN with `nav-shell` +

data/app/views/studio/board/_card_shell.html.erb

@@ -32,6 +32,20 @@
     attrs:         Hash of extra root attributes ({ "x-data" => "…", "data-foo" => 1 }),
                    values are HTML-escaped — the rebase seam for a card that carries
                    its own Alpine/data-* on the root.
+
+                   NOT A CANDIDATE FOR THE ASSEMBLED-ATTRIBUTE SWEEP: nothing here is
+                   marked html_safe, so ERB escapes both halves. A double quote in a
+                   VALUE becomes " and the parser decodes it back — the value half
+                   cannot break out. Verified 2026-09-08 by rendering, not reading.
+
+                   THE NAME HALF IS A DIFFERENT QUESTION, and entity decoding is not
+                   what answers it. html_escape does not touch a SPACE, and a space
+                   ENDS an attribute name: a name of `data-y=1 x-init` renders as
+                   `data-y=1 x-init="…"` and the parser builds a real SECOND attribute
+                   — measured, an injected x-init Alpine will run. What makes this seam
+                   safe today is that nothing passes attrs: at all — zero call sites in
+                   studio-engine, turf-monster and mcritchie-studio. Its first caller
+                   owes an allow-list on the NAME before this emits it.
 %>
 <%
   id            = local_assigns.fetch(:id)

data/app/views/studio/emails/show.html.erb

@@ -197,6 +197,17 @@
 
   <%# ROW TWO — the pictures, and the words that ride on them. %>
   <div class="grid gap-6 md:grid-cols-2 mb-6">
+    <%# THE FILENAMES AND THE LABEL ARE ESCAPED ON THE WAY INTO THIS x-data. All
+        three come off the email REGISTRY entry rather than a form, so nothing
+        reaches them with a quote today — but they are the only values in the
+        attribute that are not authored right here, and bare interpolation of one
+        would close its JS literal and mount the whole upload host as a silent
+        no-op: an image picker that opens, crops, and never saves.
+
+        successMessage previously used the BARE `j` form. That is correct only
+        while the label is a plain String — `j` preserves an html_safe marking, and
+        a safe value would skip ERB's attribute-escaping half and let a raw double
+        quote out of the attribute. Studio::JsLiteral removes that condition. %>
     <section class="card p-4"
       <% if @uploads_available %>
         x-data="imageUploadHost({
@@ -205,10 +216,10 @@
           maxWidth: <%= max_width %>,
           transparent: false,
           allowGifs: true,
-          filename: '<%= @entry.key %>.png',
+          filename: '<%= Studio::JsLiteral.in_attribute(@entry.key) %>.png',
           saving: 'Saving banner…',
           success: 'Banner updated',
-          successMessage: '<%= j @entry.label %> now uses this app\'s own image.',
+          successMessage: '<%= Studio::JsLiteral.in_attribute(@entry.label) %> now uses this app\'s own image.',
           failure: 'Couldn\'t save the banner'
         })"
         @crop-photo-confirmed.window="onCropConfirmed($event.detail)"
@@ -513,7 +524,7 @@
            maxWidth: 600,
            transparent: true,
            allowGifs: false,
-           filename: '<%= @entry.key %>-logo.png',
+           filename: '<%= Studio::JsLiteral.in_attribute(@entry.key) %>-logo.png',
            saving: 'Saving logo…',
            success: 'Logo updated',
            successMessage: 'This email now uses its own logo.',

data/app/views/studio/modals/_crop_photo.html.erb

@@ -26,7 +26,13 @@
   The living style guide passes store: "dsModals" for its page-scoped host.
 %>
 <% crop_store = local_assigns.fetch(:store, "modals") %>
-<div x-data="cropPhotoModal({ store: '<%= crop_store %>' })">
+<%# STRING position, so it is ESCAPED rather than validated: the store name is
+    handed to cropPhotoModal as a JS string argument, not spliced in as a bare
+    identifier. An apostrophe would close that literal and mount the modal as a
+    silent no-op that still renders every element below. Studio::JsLiteral carries
+    why both escapers have to run. %>
+<% crop_store_js = Studio::JsLiteral.in_attribute(crop_store) %>
+<div x-data="cropPhotoModal({ store: '<%= crop_store_js %>' })">
   <h3 class="text-heading font-bold text-lg text-center mb-4">Crop Photo</h3>
 
   <template x-if="error">

data/app/views/studio/modals/blocks/_entry_confirmed.html.erb

@@ -71,6 +71,12 @@
   subtitle_key     = local_assigns[:subtitle_key]
   tx_signature_key = local_assigns.fetch(:tx_signature_key, "props.txSignature")
   cluster_param    = local_assigns.fetch(:cluster_param, "")
+  # STRING position — clusterParam is a JS string on the root scope that
+  # _success_card's tx-link concatenates into a URL. An apostrophe closes the
+  # literal and the whole x-data becomes a SyntaxError, which mounts this card and
+  # every nested block as a silent no-op. props_expr one line up is the OPPOSITE
+  # shape (an Alpine expression by contract) and is deliberately left alone.
+  cluster_param_js = Studio::JsLiteral.in_attribute(cluster_param)
   lobby_url_key    = local_assigns.fetch(:lobby_url_key, "props.lobbyUrl")
   cta_label        = local_assigns.fetch(:cta_label, "Continue")
   seeds_earned_key = local_assigns.fetch(:seeds_earned_key, "props.seedsEarned")
@@ -113,7 +119,7 @@
 <%# props getter + clusterParam live on the root scope so _success_card's nested
     Alpine expressions (props.txSignature, props.lobbyUrl, clusterParam) resolve up
     the scope chain. clusterParam feeds _success_card's branded tx-link URL. %>
-<div x-data="{ get props() { return <%= props_expr %>; }, clusterParam: '<%= cluster_param %>' }">
+<div x-data="{ get props() { return <%= props_expr %>; }, clusterParam: '<%= cluster_param_js %>' }">
   <%= render "studio/modals/blocks/success_card", sc_locals do %>
     <%# The app's own enrichment, above the seeds bar. turf puts its kickoff
         countdown here — "when does it start" reads before the celebratory seeds

data/app/views/studio/modals/blocks/_error_card.html.erb

@@ -24,6 +24,15 @@
 <%
   icon_emoji = local_assigns[:icon_emoji] || "⏳"   # ⏳
   cta_label  = local_assigns[:cta_label]  || 'Refresh'
+  # THE TWO EVENT NAMES ARE THE ONLY LOCALS HERE THAT LAND INSIDE JS. Both sit in a
+  # single-quoted literal inside a double-quoted @click, so an apostrophe in either
+  # closes the literal, the handler becomes a SyntaxError, and the button renders
+  # perfectly and does NOTHING when clicked — no error, no log, nothing a markup
+  # assertion can see. Escaped, not validated: an event name is a STRING to
+  # $dispatch, and any character is legal in one. Studio::JsLiteral says why the
+  # interpolated form is load-bearing.
+  cta_event_js       = Studio::JsLiteral.in_attribute(local_assigns[:cta_event])
+  secondary_event_js = Studio::JsLiteral.in_attribute(local_assigns[:secondary_event])
 %>
 <%# role="alert" on the CARD, not on its message: the message is server-rendered
     static text, so it never "changes" for a live region to notice. The modal host
@@ -42,11 +51,11 @@
   <% if local_assigns[:cta_reload] %>
     <button @click="window.location.reload()" class="btn btn-outline btn-sm"><%= cta_label %></button>
   <% elsif local_assigns[:cta_event] %>
-    <button @click="$dispatch('<%= cta_event %>')" class="btn btn-outline btn-sm"><%= cta_label %></button>
+    <button @click="$dispatch('<%= cta_event_js %>')" class="btn btn-outline btn-sm"><%= cta_label %></button>
   <% end %>
 
   <% if local_assigns[:secondary_label] && local_assigns[:secondary_event] %>
-    <button @click="$dispatch('<%= secondary_event %>')"
+    <button @click="$dispatch('<%= secondary_event_js %>')"
             class="block mx-auto mt-3 text-xs text-secondary hover:text-heading underline underline-offset-2">
       <%= secondary_label %>
     </button>

data/app/views/studio/modals/blocks/_leveling_activity.html.erb

@@ -138,10 +138,23 @@
           <% if input %>
             <input type="<%= input_type %>" x-model="value" class="input-field w-full"
                    placeholder="<%= placeholder %>"
-                   <%= "minlength=\"#{min_length}\"".html_safe if min_length.to_i.positive? %>
-                   <%= "maxlength=\"#{max_length}\"".html_safe if max_length.present? %>
-                   <%= "pattern=\"#{pattern}\"".html_safe if pattern.present? %>
-                   <%= "title=\"#{pattern_title}\"".html_safe if pattern_title.present? %>
+                   <%# FOUR CONSTRAINT ATTRIBUTES, ENCODED AND — unlike the Alpine
+                       handlers in this file — DELIBERATELY NOT html_safe. Each was
+                       assembled as `attr="#{value}"`.html_safe, which handed ERB a
+                       String it must not touch, so a double quote in any of the four
+                       closed the attribute and the rest became markup. minlength
+                       looks numeric and is not: only the GUARD calls .to_i, the
+                       interpolation splices the local raw.
+
+                       These are CONTENT, not code — a length, a regex, a tooltip
+                       sentence — so they take the full escaping a content attribute
+                       is owed and the parser decodes it back. That also repairs a
+                       second latent bug the marking carried: a bare & in a title or
+                       pattern used to reach the browser as the start of an entity. %>
+                   <%= tag.attributes(minlength: min_length) if min_length.to_i.positive? %>
+                   <%= tag.attributes(maxlength: max_length) if max_length.present? %>
+                   <%= tag.attributes(pattern: pattern) if pattern.present? %>
+                   <%= tag.attributes(title: pattern_title) if pattern_title.present? %>
                    autofocus>
           <% end %>
           <% if consent_label.present? %>
@@ -180,7 +193,12 @@
       </div>
 
       <% if next_label.present? && next_open.present? %>
-        <button type="button" @click="<%= next_open %>" class="btn btn-primary btn-lg w-full">
+        <%# next_open is html_safe (:102) because it is a developer-authored Alpine
+            EXPRESSION — so ERB steps aside here and a double quote in it used to
+            close the @click attribute outright. tag.attributes writes the quotes and
+            entity-encodes any of its own that appear in the value, leaving the
+            expression otherwise byte-identical. %>
+        <button type="button" <%= tag.attributes("@click": next_open) %> class="btn btn-primary btn-lg w-full">
           <%= next_label %>
         </button>
       <% end %>

data/app/views/studio/modals/blocks/_processing_card.html.erb

@@ -41,8 +41,27 @@
   # JS sides of the convention agree on the same floor.
   min_duration = local_assigns[:min_duration] || 1400
   resolve_expr = local_assigns[:resolve_expr]
+
+  # THE AUTO-RESOLVE PAIR, ENCODED RATHER THAN ASSEMBLED. This line used to build
+  # ` x-data="{}" x-init="…"` as one html_safe String, quotes and all, so ERB had
+  # nothing left to escape: a double quote in EITHER local — min_duration as much as
+  # resolve_expr, since min_duration is interpolated raw and only its GUARD calls
+  # .to_i — closed the attribute and turned the remainder into markup.
+  #
+  # tag.attributes writes the quotes instead. The x-init value stays html_safe
+  # because it is CODE the caller handed us, and tag_option's unconditional
+  # gsub('"', """) still fires on an html_safe value, so the JS arrives intact
+  # and the attribute cannot end early. safe_join supplies the separating space
+  # without a second hand-marked String.
+  resolve_attrs =
+    if resolve_expr
+      safe_join([" ", tag.attributes(
+        "x-data": "{}",
+        "x-init": "window.StudioModals.holdAtLeast(#{min_duration}).then(() => { #{resolve_expr} })".html_safe
+      )])
+    end
 %>
-<div class="text-center py-6"<%= " x-data=\"{}\" x-init=\"window.StudioModals.holdAtLeast(#{min_duration}).then(() => { #{resolve_expr} })\"".html_safe if resolve_expr %>>
+<div class="text-center py-6"<%= resolve_attrs %>>
   <div class="mx-auto <%= spinner_class %> rounded-full border-<%= color %>/30 border-t-<%= color %> animate-spin mb-5"></div>
   <% if local_assigns[:title_key] %>
     <p class="text-base font-bold text-heading mb-1" x-text="<%= title_key %>"></p>

data/app/views/studio/modals/blocks/_solana_tx_link.html.erb

@@ -17,10 +17,15 @@
 <%
   tx_signature_key = local_assigns.fetch(:tx_signature_key)
   cluster_param    = local_assigns.fetch(:cluster_param, "")
+  # STRING position, inside the :href expression below. tx_signature_key beside it
+  # is an Alpine EXPRESSION by contract and is spliced in bare; this one is a
+  # literal suffix, so an apostrophe would close it and turn the whole :href
+  # binding into a SyntaxError — the link then renders with no href at all.
+  cluster_param_js = Studio::JsLiteral.in_attribute(cluster_param)
 %>
 <template x-if="(<%= tx_signature_key %>)">
   <div class="text-center mb-3 -mt-1">
-    <a :href="'https://explorer.solana.com/tx/' + (<%= tx_signature_key %>) + '<%= cluster_param %>'"
+    <a :href="'https://explorer.solana.com/tx/' + (<%= tx_signature_key %>) + '<%= cluster_param_js %>'"
        target="_blank" rel="noopener"
        class="inline-flex items-center gap-2 px-3 py-1.5 rounded-lg border border-subtle hover:border-primary/50 transition group no-underline"
        style="background: rgb(var(--color-primary-500-rgb) / 0.06);">

data/app/views/studio/modals/blocks/_success_card.html.erb

@@ -106,12 +106,42 @@
     }
   }".gsub(/\s+/, ' ').html_safe
 
+  # THE TWO EVENT NAMES, ESCAPED FOR THE @click THEY ARE SPLICED INTO. Each sits in
+  # a JS single-quoted literal inside a double-quoted attribute, so an apostrophe in
+  # either closes the literal and the handler becomes a SyntaxError — a CTA that
+  # renders exactly right and does nothing when clicked. This is the engine's
+  # most-rendered block, so it is also the widest reach that failure has.
+  #
+  # ESCAPED, NOT VALIDATED: an event name is a STRING argument to $dispatch and any
+  # character is legal in one. Contrast cta_href_key / props_expr below, which are
+  # Alpine EXPRESSIONS by contract and must not be touched. Studio::JsLiteral
+  # carries why the interpolated form is load-bearing.
+  cta_event_js       = Studio::JsLiteral.in_attribute(local_assigns[:cta_event])
+  secondary_event_js = Studio::JsLiteral.in_attribute(local_assigns[:secondary_event])
+
   init_calls = []
   init_calls << "fireConfetti()" if fire_confetti
   init_calls << "startCountdown(#{local_assigns[:auto_redirect_url_key]})" if has_redirect
+  init_expr = init_calls.join("; ").html_safe
 %>
-<div x-data="<%= data_attr %>"
-     <%= "x-init=\"#{init_calls.join('; ')}\"".html_safe if init_calls.any? %>
+<%# BOTH ALPINE ATTRIBUTES ARE EMITTED BY tag.attributes, NOT ASSEMBLED BY HAND.
+    Each carries Ruby-built JS that splices a host local — redirect_secs into the
+    x-data object, auto_redirect_url_key into startCountdown() — and both blobs are
+    html_safe, because they are CODE and the caller is owed the JS it wrote.
+
+    THAT MARKING USED TO BE THE HOLE. html_safe tells ERB to step aside, so a double
+    quote in either local closed the ATTRIBUTE and everything after it became markup:
+    x-data="{ _remaining: it's a " quote" …  — measured, not reasoned.
+
+    tag.attributes closes it without touching the JS. ActionView's tag_option runs
+    gsub('"', "&quot;") on the finished value UNCONDITIONALLY, outside the escape
+    branch it skips for an html_safe string (actionview tag_helper.rb, the line after
+    the escape ternary), so the attribute cannot be closed early and the HTML parser
+    decodes the entity back before Alpine ever sees it. Every other character reaches
+    the attribute byte-for-byte as it does today. blocks/_rail_row:112 is the same
+    move on a whole tag and its comment carries the rest of the reasoning. %>
+<div <%= tag.attributes("x-data": data_attr) %>
+     <%= tag.attributes("x-init": init_expr) if init_calls.any? %>
      class="text-center py-6">
 
   <%# Icon — emoji takes priority over the default circular green check %>
@@ -229,7 +259,7 @@
         <span class="relative z-10"><%= cta_label %></span>
       </a>
     <% elsif use_drain && local_assigns[:cta_event] %>
-      <button @click="$dispatch('<%= cta_event %>')"
+      <button @click="$dispatch('<%= cta_event_js %>')"
               class="btn btn-primary btn-lg w-full relative overflow-hidden no-underline">
         <div class="absolute inset-0 pointer-events-none origin-left"
              style="background: rgba(255,255,255,0.18);"
@@ -246,12 +276,12 @@
     <% elsif local_assigns[:cta_href_key] %>
       <a :href="<%= cta_href_key %>" class="btn btn-primary btn-lg w-full"><%= cta_label %></a>
     <% elsif local_assigns[:cta_event] %>
-      <button @click="$dispatch('<%= cta_event %>')" class="btn btn-primary btn-lg w-full"><%= cta_label %></button>
+      <button @click="$dispatch('<%= cta_event_js %>')" class="btn btn-primary btn-lg w-full"><%= cta_label %></button>
     <% end %>
   <% end %>
 
   <% if local_assigns[:secondary_label] && local_assigns[:secondary_event] %>
-    <button @click="$dispatch('<%= secondary_event %>')"
+    <button @click="$dispatch('<%= secondary_event_js %>')"
             class="block mx-auto mt-3 text-xs text-secondary hover:text-heading underline underline-offset-2">
       <%= secondary_label %>
     </button>

data/app/views/studio/modals/onboarding/_first_name.html.erb

@@ -94,11 +94,11 @@
     STRING position — empty_error, submit_path, skip_path, done_event — each sits
       inside a JS SINGLE-quoted literal. A bare apostrophe closes the literal, the
       expression becomes a SyntaxError, and the card is that silent no-op. Repair:
-      escape_javascript, in the INTERPOLATED form. The wrapper is load-bearing:
-      escape_javascript(SafeBuffer) answers true to html_safe, so ERB would skip
-      its own attribute-escaping half and a raw double quote could still close the
-      attribute. Wrapping the value in a plain interpolation first strips the safe
-      marking, so both escapers run.
+      Studio::JsLiteral.in_attribute, which is where the mechanism now lives and is
+      tested. Two escapers have to run — one for the JS literal, one for the
+      attribute — and the second only runs on a value ERB still believes is unsafe.
+      This card used to spell that out inline at four sites; the engine has eleven
+      more of them, so it is one method with one guard now.
 
     IDENTIFIER position — modal_store — is spliced in as a bare NAME, at three
       sites: the props getter, finish's close, and the Ruby-built dismiss_action
@@ -145,15 +145,15 @@
   # apostrophes. Interpolated raw, an error reading "We'll need a name" would
   # close the JS single-quoted string, make the whole expression a SyntaxError,
   # and mount the component as a SILENT NO-OP that still renders every element
-  # below. escape_javascript covers the apostrophe, the double quote, the
-  # backslash and the newline; the interpolation around it first strips any
-  # html_safe marking, because a safe string would skip ERB's own attribute
-  # escaping and could smuggle a raw double quote in — the exact failure the
-  # CRITICAL note above describes.
+  # below. Studio::JsLiteral.in_attribute covers the apostrophe, the double quote,
+  # the backslash and the newline, AND hands ERB a value it still believes is
+  # unsafe so the attribute's own escaping runs too — a safe string would skip that
+  # half and could smuggle a raw double quote in, the exact failure the CRITICAL
+  # note above describes.
   #
   # INERT ON BOTH DEFAULTS. Neither default string contains a character either
   # escaper touches, so the shipped card is byte-for-byte what it was.
-  empty_error_js = escape_javascript("#{empty_error}")
+  empty_error_js = Studio::JsLiteral.in_attribute(empty_error)
   placeholder = local_assigns.fetch(:placeholder, "Alex")
   # OFF unless a host passes a non-empty array. Normalised to nil so that an
   # empty list behaves exactly like an absent local rather than emitting the
@@ -201,11 +201,11 @@
   # Alpine mounts the component as a SILENT NO-OP that still renders every element
   # — perfect-looking markup, dead card.
   #
-  # THE INTERPOLATED FORM IS LOAD-BEARING, not a style choice:
-  # escape_javascript(SafeBuffer).html_safe? is TRUE, so ERB would skip its own
-  # attribute-escaping half and a raw double quote could still close the
-  # double-quoted x-data. Wrapping in "#{}" first strips the html_safe marking, so
-  # both escapers run: escape_javascript for the JS literal, ERB for the attribute.
+  # WHY A METHOD RATHER THAN escape_javascript AT EACH SITE: the second escaper is
+  # conditional. ERB skips a value that answers true to html_safe, and
+  # escape_javascript preserves its argument's marking, so the naive call silently
+  # loses the attribute half. Studio::JsLiteral.in_attribute owns that, and owns the
+  # single test that fails when it is removed.
   #
   # INERT ON EVERY DEFAULT. Two paths, an event name and a store name carry no
   # character either escaper touches, so the shipped card is byte-for-byte what it
@@ -213,9 +213,9 @@
   # host supplies these as prose today, but empty_error established that prose does
   # belong in this attribute, and the next local to carry an apostrophe will look
   # like an ordinary change to whoever writes it.
-  submit_path_js = escape_javascript("#{submit_path}")
-  skip_path_js   = escape_javascript("#{skip_path}")
-  done_event_js  = escape_javascript("#{done_event}")
+  submit_path_js = Studio::JsLiteral.in_attribute(submit_path)
+  skip_path_js   = Studio::JsLiteral.in_attribute(skip_path)
+  done_event_js  = Studio::JsLiteral.in_attribute(done_event)
   field_id    = local_assigns.fetch(:id, "onboarding-first-name")
   # The × mirrors the skip affordance it sits beside: it SKIPS while the step is
   # skippable, and merely CLOSES once it is required. Resolved here rather than in

data/app/views/studio/profiles/_birthday_fields.html.erb

@@ -37,9 +37,16 @@
   m = user.birth_month
   d = user.birth_day
   value = (y.present? && m.present? && d.present?) ? format("%04d-%02d-%02d", y, m, d) : nil
+  # ESCAPED FOR THE x-data BELOW. format() cannot produce a quote today, so this is
+  # latent cover rather than a live fix — but the local is read off a USER record,
+  # and the guard has to sit on the splice rather than on today's formatter. Bare,
+  # an apostrophe would close the JS literal and studioBirthdayFields would never
+  # evaluate, leaving three selects that render and never save. The <input value="">
+  # copy below needs no such treatment: ERB already escapes it, and it is not JS.
+  value_js = Studio::JsLiteral.in_attribute(value)
 %>
 
-<div x-data="studioBirthdayFields('<%= value %>')">
+<div x-data="studioBirthdayFields('<%= value_js %>')">
   <%# --- the JS-less path ------------------------------------------------- %>
   <template x-if="!alpine">
     <input type="date" name="profile[birthday]" id="profile_birthday"

data/app/views/style/_modals.html.erb

@@ -43,13 +43,30 @@
   # /auth/solana routes, Solana::SessionAuth, the phantom callback) and ships no
   # wallet UI at all.
   #
-  # So resolution is a RUNTIME question here, not a build-time one. Three of the
-  # six apps mounting this engine (acquisition-studio, mcritchie-industries,
-  # moms-app) bundle no solana-studio, and an unconditional render would turn
-  # their /admin/style into a missing-template 500. The gem is a development and
+  # So resolution is a RUNTIME question here, not a build-time one. FOUR of the
+  # five apps mounting this engine (mcritchie-studio, acquisition-studio,
+  # mcritchie-industries, moms-app) bundle no solana-studio — turf-monster is
+  # the only one that does — and an unconditional render would turn their
+  # /admin/style into a missing-template 500. The gem is a development and
   # test dependency of this engine precisely so the guide can show the REAL
   # cards; where it is absent the specimens stay listed but unopenable.
   #
+  # THE EXCEPTION IS THE DURABLE HALF; the count rots the day an app is born.
+  # Derived 2026-09-07 — and the CRITERION is recorded, not just the count,
+  # because the obvious grep does not reproduce it. The five are the checkouts
+  # whose own config/routes.rb calls `Studio.routes(self)`, the same five
+  # lib/studio.rb's draw_profile_routes note names. Grepping Gemfiles for
+  # `gem "studio-engine"` returns SEVEN: it also catches solana-studio, which
+  # pins the engine in `group :development, :test` for its dummy and draws no
+  # routes, and mcritchie-studio-ai-builder-cache, which is the HUB checked out
+  # twice (same Heroku remote; HEAD c7d5d326 is a commit inside
+  # mcritchie-studio) and would double-count it. This line used to read "three
+  # of the six" and to omit the HUB — the app a reader is likeliest to be
+  # sitting in, and one that bundles no solana-studio. Two further near misses:
+  # chain-ops bundles solana-studio WITHOUT this engine, so it is not in this
+  # set at all; acquisition-studio is a retired prototype whose Gemfile still
+  # pins the engine, so it is.
+  #
   # Same three-term lookup_context.exists? the modal host uses for host_extras
   # (studio/modals/_host.html.erb): name, prefixes, partial.
   web3_gem = lookup_context.exists?("wallet_connect", ["solana_studio/modals"], true)

data/lib/studio/js_literal.rb

@@ -0,0 +1,93 @@
+require "action_view"
+
+module Studio
+  # ONE home for the repair that keeps a host-supplied value from bricking an
+  # Alpine component when it is spliced into a JS-evaluating HTML attribute.
+  #
+  # THE FAILURE THIS EXISTS FOR is silent, which is the whole reason it is worth a
+  # module instead of a convention. A local sits inside a JS single-quoted literal
+  # in a double-quoted attribute:
+  #
+  #     <button @click="$dispatch('<%= cta_event %>')">
+  #
+  # A bare apostrophe in `cta_event` closes that literal, the expression becomes a
+  # SyntaxError, and Alpine mounts the component as a NO-OP that still renders
+  # every element. Perfect-looking markup, dead card. Nothing raises, nothing logs
+  # a server-side warning, and every string assertion about the response bytes
+  # still passes — which is how this class of defect survives a review.
+  #
+  # BOTH ESCAPERS HAVE TO RUN, and that is the part a hand-written call gets wrong.
+  # There are two nested contexts, so there are two ways out of the attribute:
+  #
+  #   * out of the JS STRING, with `'` — repaired by escape_javascript
+  #   * out of the HTML ATTRIBUTE, with `"` — repaired by ERB's own escaping
+  #
+  # escape_javascript covers the first. ERB covers the second, but ONLY for a value
+  # it believes is unsafe, and `escape_javascript(SafeBuffer)` answers true to
+  # html_safe?. Hand an html_safe string straight to escape_javascript and ERB
+  # steps aside, a raw double quote reaches the attribute, and the attribute closes
+  # early — the same dead card by a longer route.
+  #
+  # So the interpolation wrapper below is LOAD-BEARING, not a style tic: `"#{value}"`
+  # produces a plain String, escape_javascript therefore returns a plain String, and
+  # ERB does its half on the way into the attribute. That subtlety was re-derived at
+  # every call site before this module existed, and it had no test cover anywhere;
+  # it now has exactly one implementation and one guard
+  # (test/lib/studio/js_literal_test.rb).
+  #
+  # DELIBERATELY NARROW — there is no script-body variant here, and adding one is
+  # not a copy of this method. Inside <script>…</script> the HTML parser does no
+  # entity decoding, so ERB's escaping is not a second layer of safety there, it is
+  # CORRUPTION: `\"` would arrive as `\&quot;` and break the JS this method exists
+  # to protect. A script body wants JS escaping ONLY (escape_javascript, marked
+  # safe). The name says `in_attribute` so that the next person reaching for this in
+  # a <script> has to stop and notice the difference.
+  #
+  # AND IT IS THE WRONG REPAIR FOR AN ATTRIBUTE THE PARTIAL ASSEMBLES ITSELF —
+  # `<%= "x-init=\"#{expr}\"".html_safe %>`, where the attribute's OWN QUOTES are
+  # built in Ruby. Nothing here helps: escaping the value would break the Alpine
+  # EXPRESSION the caller deliberately handed the engine, and the marking has already
+  # told ERB to stand down, so a double quote closes the ATTRIBUTE and the remainder
+  # is parsed as MARKUP. The repair is to stop writing the quotes and let ActionView
+  # write them — `tag.attributes("x-init": expr.html_safe)` — because tag_option
+  # quote-escapes the finished value UNCONDITIONALLY, outside the escape branch it
+  # skips for a marked String. The expression survives byte-for-byte and cannot end
+  # the attribute. modals/blocks/_rail_row:112 and components/_sidebar_panel carry
+  # the worked examples; test/lib/studio/attribute_encoding_contract_test.rb pins the
+  # ActionView behaviour the whole thing rests on.
+  #
+  # AND IT IS THE WRONG REPAIR FOR IDENTIFIER POSITION. A local spliced in as a bare
+  # NAME — `$store.<%= modal_store %>.close()` — must be VALIDATED, never escaped:
+  # escape_javascript also escapes `$`, so a legitimate store name like `dsModals$2`
+  # comes back mangled and the card dies anyway. The SHAPE of the splice decides the
+  # repair, never the name of the local. studio/modals/onboarding/_first_name
+  # carries the worked example of both.
+  module JsLiteral
+    extend ActionView::Helpers::JavaScriptHelper
+
+    module_function
+
+    # Escape +value+ for a JS string literal that lives inside an HTML attribute.
+    #
+    # Returns a plain (NOT html_safe) String on purpose — see the note above. The
+    # caller interpolates it inside the JS quotes, exactly as it would have
+    # interpolated the raw local:
+    #
+    #     cta_event_js = Studio::JsLiteral.in_attribute(cta_event)
+    #     # …
+    #     <button @click="$dispatch('<%= cta_event_js %>')">
+    #
+    # nil becomes "" rather than "nil", because every current caller reaches this
+    # with an optional local and an empty JS string is the honest rendering of an
+    # absent value.
+    # ONE MECHANISM, DELIBERATELY. An earlier draft also re-stripped the marking on
+    # the way out, as belt-and-braces. That made both halves redundant, and a
+    # redundant guard is one that survives being deleted: removing the interpolation
+    # below left every test green, because the second stripper covered for it. There
+    # is one way this works now, and test/lib/studio/js_literal_test.rb fails when it
+    # is removed.
+    def in_attribute(value)
+      JsLiteral.escape_javascript("#{value}")
+    end
+  end
+end

data/lib/studio/mail_transport.rb

@@ -6,9 +6,9 @@ module Studio
 
     class << self
       def configure!(env: ENV,
-                     rails_env: defined?(Rails) ? Rails.env : "development",
+                     rails_env: defined?(Rails) && Rails.respond_to?(:env) ? Rails.env : "development",
                      action_mailer: defined?(ActionMailer) ? ActionMailer::Base : nil,
-                     logger: defined?(Rails) ? Rails.logger : nil,
+                     logger: defined?(Rails) && Rails.respond_to?(:logger) ? Rails.logger : nil,
                      mailer_from: defined?(Studio) && Studio.respond_to?(:mailer_from) ? Studio.mailer_from : nil,
                      resend_loader: method(:load_resend!),
                      resend_configurer: method(:configure_resend!))

data/lib/studio/s3.rb

@@ -123,7 +123,24 @@ module Studio
       def environment
         return "dev" if EnvironmentBanner.qa_environment?
 
-        defined?(Rails) && Rails.env.production? ? "production" : "dev"
+        # ASKS FOR THE METHOD, NOT THE CONSTANT, and the difference is not
+        # theoretical. rails-html-sanitizer — which arrives with action_view, long
+        # before any Rails APPLICATION does — defines a namespace-only `module
+        # Rails` with no singleton methods on it. Against that, a bare
+        # `defined?(Rails)` reads TRUE and the very next call dies with
+        # NoMethodError: undefined method `env` for module Rails. It turned an
+        # unrelated green suite red the first time a unit test pulled action_view
+        # in.
+        #
+        # THIS WAS NOT THE LAST ONE, though it was described that way when it
+        # landed. Three sites still carried the bare form afterwards — both
+        # keyword defaults in lib/studio/mail_transport.rb and the developer-desk
+        # route guard in lib/studio.rb — and the claim that the sweep was finished
+        # is how they survived a second review. The whole tree is swept now, and
+        # test/lib/studio/rails_guard_sweep_test.rb is what keeps it that way; do
+        # not restate completeness here, because a comment cannot notice the next
+        # straggler and that test can.
+        defined?(Rails) && Rails.respond_to?(:env) && Rails.env&.production? ? "production" : "dev"
       end
     end
   end

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.73.0"
+  VERSION = "0.74.1"
 end

data/lib/studio.rb

@@ -8,6 +8,7 @@ require "studio/color_scale"
 require "studio/environment_banner"
 require "studio/theme_resolver"
 require "studio/ui_primitives"
+require "studio/js_literal"
 require "studio/sidebar_sections"
 require "studio/profile_sections"
 require "studio/profile_image"
@@ -855,7 +856,7 @@ module Studio
       # Developer-desk tools. Drawn outside production, and each controller
       # re-checks Studio.local_tool_enabled? per request (loopback only) — the
       # route being absent is the outer gate, not the only one.
-      unless defined?(Rails) && Rails.env.production?
+      unless defined?(Rails) && Rails.respond_to?(:env) && Rails.env.production?
         get "_studio/local_emails", to: "studio/local_emails#index", as: :studio_local_emails
         get "_studio/local_review", to: "studio/local_reviews#show",  as: :studio_local_review
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.73.0
+  version: 0.74.1
 platform: ruby
 authors:
 - Alex McRitchie
@@ -573,6 +573,7 @@ files:
 - lib/studio/geo/lookup.rb
 - lib/studio/image_cache.rb
 - lib/studio/ip_locations.rb
+- lib/studio/js_literal.rb
 - lib/studio/link_resolution.rb
 - lib/studio/link_token.rb
 - lib/studio/log_rotation.rb