studio-engine 0.74.1 → 0.74.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d056d9eddc4bd13c863b5ec0f3e239e7591fc16ddd2170ac5192537f5a190326
-  data.tar.gz: 289b7050571718689aa567db5f0434be21c41ee7074b4b49d26969f16b07a815
+  metadata.gz: 2719af0f10410f44f1ac53e1a17fe244de4a9c4ecae8eb94715c75a69450839b
+  data.tar.gz: 9c705e4cb7e9816594d2fc13732ea5449f1523e02645a1108bb4b1f1d50d887f
 SHA512:
-  metadata.gz: 15c2e97be72e8fe2e4e67719a569f6d456f82e961fd36b11d0c5062d8ace97836316398eef5058bf9436cdec7ec4ed33aca31ca7decf70bcfe3569dd8665e693
-  data.tar.gz: 6dd53cf3747fdb36271afaea5a76c0dc2ee615e25f394083b3219476a5222991999edf97474e1022e9f2f584350ba05b04cbfaa01d5fe0f28ce2995f3a06d6fa
+  metadata.gz: 18833874f77e97c16f56c20135ecdb897d8f7d47316c2d122947bfdbd71d23117f825d51fe3a62ff417099c1051d6ea0aead4650715f9212aa68b5520d266333
+  data.tar.gz: 85568864c586c37ef1f17edefb9f23776b1f5f2089c09f331139000e88cd2dd1e47db031d01a456c3a9b267f8aced700b9221c04d0d4e1809c4381f4b0e5f020

data/CHANGELOG.md

@@ -6,6 +6,130 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ### Fixed
 
+- **A store name that is not a JS identifier half-worked, silently, in seventeen
+  partials — it now raises.** `$store.<%= modal_store %>.close()` splices the local
+  in as a bare NAME, so `modal_store: "my store"` emitted
+  `$store.my store.close()`: a SyntaxError that Alpine mounts as a no-op which still
+  renders every element. `Studio::JsIdentifier.validate!` is the new shared contract
+  (`/\A[A-Za-z_$][A-Za-z0-9_$]*\z/`), called once per partial at the fetch.
+
+  **THIS IS A BEHAVIOUR TIGHTENING, NOT A REPAIR, and it is breaking.** A host that
+  passed a non-identifier store name got a working page with a dead button; it now
+  gets an `ArgumentError` at render. That is the right trade — loud beats silent —
+  but it is a 500 where there was a 200. **Blast radius is zero, measured:** every
+  explicit store name in mcritchie-studio, turf-monster, rolio and this engine is
+  `modals`, `dsModals`, `emailModals` or `profileModals`, and no consumer app passes
+  one at all. **Rollback is one file:** make `validate!` return its argument instead
+  of raising and every partial is back to the old leniency, with no call site to
+  revisit.
+
+  **ESCAPING IS THE WRONG REPAIR HERE, which is why this is a second module rather
+  than a second method on `Studio::JsLiteral`.** `escape_javascript` also escapes
+  `$`, so the legal name `dsModals$2` comes back as `dsModals\$2` and
+  `$store.dsModals\$2.close()` is a different SyntaxError — the same dead card on a
+  value that was never hostile. A pattern rather than an allowlist, deliberately: an
+  allowlist would be a shared gem enumerating its own consumers, and the next app to
+  mount a page-scoped host would be refused by its own dependency.
+
+  **MEASURED, AND TWO OF THE LISTED SITES WERE LEFT ALONE.** Nineteen partials fetch
+  a store-name local. Counted on the tree: 36 splices of a store name in identifier
+  position — 32 in ERB, 4 assembled in Ruby — across 17 files. Rendering a hostile
+  value through all nineteen (rather than reading them) showed 17 emitting at least
+  one DEAD splice, one already refusing, and one unaffected. Seventeen now carry the
+  guard: 16 new, plus `modals/onboarding/_first_name` moved onto the shared one.
+  `modals/_crop_photo` is the unaffected one — its name is a JS string argument
+  resolved with `$store[name]`, a lookup where a space is as legal as a letter, and
+  it was already escaped, so demanding an identifier would break a host for nothing.
+  `blocks/_birthday` has no splice of its own — it hands the name to `Alpine.store()`
+  and forwards it to `blocks/_shell`, which validates — so a second guard there would
+  have been one that survives deletion.
+
+  **NOTHING MOVED FOR A LEGAL NAME.** All nineteen partials rendered before and
+  after, against the default, `dsModals` and `ds_Modals$2`, are byte-identical
+  (186,310 bytes each): a value matching the pattern carries no character ERB
+  escapes, and the validator returns a plain String so ERB's escaping stays armed
+  for the day the pattern widens. `modals/onboarding/_first_name` carried this
+  regex inline as the worked example and now calls the shared one — same pattern,
+  same error, same message.
+
+- **The email banner assembled two attributes INCLUDING THEIR OWN QUOTES in Ruby,
+  so ERB escaping never ran on them.** `_layered_banner.html.erb` wrote
+  `background="..."` and `bgcolor="..."` as Ruby strings and marked them
+  `html_safe` — the one shape ERB's attribute escaping can never reach. Both now
+  go through `tag.attributes`. This is the EMAIL half of the family PR #303 closed
+  in the modal/Alpine partials.
+
+  **THE RULE IS THE OPPOSITE OF #303'S, and that is the whole point.** There the
+  locals are Alpine EXPRESSIONS: they stay `html_safe` so a handler reaches the
+  browser byte-identical. A background URL and a colour are CONTENT, so they take
+  the FULL escaping a content attribute is owed — the treatment #303 gave the four
+  input constraints. Mark by what the value IS, not by which file it lives in.
+
+  **MEASURED, and worse than the sibling seams.** A double quote in
+  `background_url` did not merely inject an attribute, it ATE the rest of the tag:
+  the cell came back carrying `background`, `quote"`, a lone backslash, `<` and
+  `script`, having LOST `bgcolor`, `width`, `height`, `valign` and `style`
+  outright — five attributes gone from one quote. The failure is
+  a structurally wrecked email — no fallback colour, no dimensions, no
+  background-image CSS — not merely a tainted one.
+
+  **`bgcolor` WAS CLASSIFIED AND CLEARED BEFORE BEING TOUCHED**, because #303's
+  warning was that two of its six candidate sites were already safe.
+  `scrim_solid_hex` formats three integers the model has already clamped to 0-255,
+  so it returns a hash and six hex digits for every input — proven by rendering a
+  hostile scrim, not by reading the method. It is repaired anyway, and the reason
+  is measured: simulating the plausible refactor (the method learning to pass a
+  named colour through) injects an `onload` into every email with the attribute
+  hand-assembled, and merely renders a wrong colour with `tag.attributes` on it.
+
+  **NOTHING MOVED FOR REAL INPUT.** Seven banner shapes rendered before and after,
+  in both email and preview mode, are byte-identical. The one input whose bytes
+  change is a signed CDN URL, whose `&` now ships as `&amp;` — a correction, since
+  the CSS twin and the VML `src` on the SAME element already escaped it and the
+  hand-assembled `background` was the odd one out shipping a bare `&`. Verified in
+  a real browser: the client decodes the attribute, requests the URL with its
+  signature intact, and paints the banner.
+
+- **The Rails guard sweep's non-vacuity check tested a COPY of the scanner, so
+  the scanner could go blind and the suite stayed green.**
+  `rails_guard_sweep_test.rb` is a source scan, and a scan is only trustworthy
+  with a control proving its predicate can still say NO. That control re-typed
+  the rule as string operations on a sample instead of calling the scan's own
+  path: the predicate existed twice, at line 78 and line 101. Measured — typing
+  one typo into line 78 ALONE (`\bRails\.` → `\bRailz\.`), which blinds the net so
+  it can never flag anything no matter what `lib/` contains, left all three tests
+  passing, 0 failures. The floor was being measured against a duplicate
+  implementation, so it certified the copy and never the instrument.
+
+  **THE REPAIR IS ONE DEFINITION, NOT A BETTER COPY.** The rule now lives in a
+  single `offending_line?`, and both the scan and every control call it. The same
+  mutation now reddens `test_the_predicate_still_flags_the_shape_that_was_fixed`
+  by name — while the scan itself still passes, which is precisely the "passes for
+  free" the control exists to catch.
+
+  **THE CONTROLS ARE SPLIT ONE PER CLAUSE**, because `offending_line?` decides on
+  four (comment exemption, mentions `defined?(Rails)`, not already asking
+  `Rails.respond_to?`, and calls a method on the constant) and one combined
+  assertion would go red without saying which clause went inert — the same
+  blindness as the copy, one level in. Each of the four now reddens its own named
+  test. The scan also asserts its EXIT-BLINDNESS FLOOR inside the test that trusts
+  the result — the three named files were swept, and more than 1,000 lines were
+  read — because a scan whose loop never runs reports zero offenders and passes
+  having proved nothing. Six mutations, applied one at a time, each verified red.
+
+  **TWO CLAIMS IN THE ENTRIES BELOW WERE FALSE, and are corrected in this same
+  change.** *The Rails guard sweep really is finished now* said a bare
+  `require "action_view"` is what defines the namespace-only `module Rails`. It is
+  not — measured, that require leaves `Rails` UNDEFINED and never loads
+  rails-html-sanitizer. What defines it is naming a constant under
+  `ActionView::Helpers`, which autoloads the helpers tree; in `studio/js_literal`
+  that is line 66's `extend ActionView::Helpers::JavaScriptHelper`. The same loose
+  sentence had propagated into three test files and is corrected there too. And
+  *`Studio::S3` no longer mistakes a Rails NAMESPACE* said `lib/studio.rb` used the
+  repaired form "in three places" — the sweep in this same unreleased block made it
+  FOUR, so a false completeness claim was shipping one sentence above the entry
+  announcing a fix for exactly that.
+
 - **A quote in a host local can no longer close an Alpine attribute and turn the
   rest of the element into markup.** Four partials built an attribute — its OWN
   QUOTES included — as a Ruby String and marked it `html_safe`, which is the one
@@ -81,9 +205,16 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
   `Studio.routes`. All three now ask `Rails.respond_to?` first.
 
   **THE MAIL TRANSPORT ONE WAS ARMED, not theoretical.** `lib/studio.rb` requires
-  `studio/js_literal` (line 11) — whose first line is `require "action_view"`,
-  which is what defines the namespace-only `module Rails` — BEFORE it requires
-  `studio/mail_transport` (line 25). Measured at this branch's head, a bare
+  `studio/js_literal` (line 11) BEFORE it requires `studio/mail_transport`
+  (line 25), and loading `js_literal` is what puts the namespace-only `module
+  Rails` in memory. **Not its `require "action_view"`** — measured, that require
+  alone leaves `Rails` UNDEFINED and never loads the sanitizer at all. It is line
+  66, `extend ActionView::Helpers::JavaScriptHelper`: naming anything under
+  `ActionView::Helpers` autoloads the helpers tree, which requires
+  rails-html-sanitizer, and that gem is what ships `module Rails` — with
+  `Rails.methods(false) == []`, no singleton methods at all. The distinction is
+  not pedantry: a file that requires `action_view` and never reaches into
+  `Helpers` does not arm this trap. Measured at this branch's head, a bare
   `Studio::MailTransport.configure!(env: {}, action_mailer: mailer)` died with
   `NoMethodError: undefined method 'env' for module Rails`. No shipped app can
   reach it (every host configures mail from an initializer, where `Rails.env`
@@ -467,10 +598,12 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
   long before any application does — ships a namespace-only `module Rails` with no
   singleton methods, so that guard reads true and the next call raises
   `NoMethodError: undefined method 'env' for module Rails`. It now asks
-  `Rails.respond_to?(:env)`, which is the form `lib/studio.rb` already uses in three
-  places. **This entry originally called it "the straggler"; that was wrong** —
-  three more sites carried the bare form, swept in *The Rails guard sweep really is
-  finished now* above. No shipped app can reach it — every host boots a
+  `Rails.respond_to?(:env)`, which is the form `lib/studio.rb` now uses in FOUR
+  places: the three it already carried (lines 701, 707 and 742) plus the route
+  guard at line 859. **This entry originally called it "the straggler"; that was
+  wrong** — three more sites carried the bare form, line 859 among them, and all
+  three are swept in *The Rails guard sweep really is finished now* above, in this
+  same unreleased block. No shipped app can reach it — every host boots a
   real application — but the engine's own pure-Ruby unit lane can, and it did:
   adding one `require` for a file that needs `action_view` turned an untouched
   `email_catalog_test` red with two errors about email uploads.

data/app/views/studio/mailers/_layered_banner.html.erb

@@ -66,7 +66,25 @@
 <table role="presentation" width="<%= banner.width %>" cellpadding="0" cellspacing="0" border="0"
        style="width:<%= banner.width %>px;border-collapse:collapse;">
   <tr>
-    <td <%= %(background="#{banner.background_url}").html_safe if banner.background_url.present? %>
+    <%# THE BACKGROUND ATTRIBUTE, EMITTED BY tag.attributes. It was assembled as a
+        Ruby string carrying its OWN quotes and then marked html_safe, which is the
+        one shape ERB's attribute escaping can never reach.
+
+        MEASURED on the unrepaired template, not reasoned about: a double quote in
+        background_url closed the attribute, and the browser read the remainder of
+        the tag as markup. The td came back carrying attributes named `quote"`,
+        `\`, `<` and `script`, and LOST bgcolor, width, height, valign and style
+        outright. That is worse than an injected attribute — the cell loses the
+        fallback colour and both dimensions the whole banner is laid out from, so
+        the failure is a wrecked email, not just a tainted one.
+
+        The URL is CONTENT, not code, so it is passed UNMARKED and takes the full
+        escaping a content attribute is owed. That also closes the latent half: a
+        bare ampersand in a signed-URL query string used to reach the client as the
+        start of an entity. Contrast the Alpine handlers elsewhere in this engine,
+        which stay html_safe precisely because they are expressions the host wrote
+        on purpose. The rule follows what the value IS, not which file it is in. %>
+    <td <%= tag.attributes(background: banner.background_url) if banner.background_url.present? %>
         bgcolor="<%= Studio.theme_primary %>"
         width="<%= banner.width %>" height="<%= banner.height %>" valign="middle"
         style="width:<%= banner.width %>px;height:<%= banner.height %>px;<%= "background-image:url(#{banner.background_url});background-size:cover;background-position:center;background-repeat:no-repeat;" if banner.background_url.present? %>">
@@ -97,7 +115,24 @@
                     contrast case the scrim exists for, in the one client that
                     cannot be spot-checked. Every other client honours the rgba
                     declaration and overrides the flat attribute. %>
-                <%= %(bgcolor="#{banner.scrim_solid_hex}").html_safe if banner.scrim_opacity.positive? %>
+                <%# SAME SHAPE AS THE background ABOVE, AND — stated honestly — NOT
+                    THE SAME LIVE DEFECT. This one was assembled with its own quotes
+                    and marked html_safe too, but the value cannot currently carry a
+                    quote to exploit it: scrim_solid_hex formats three integers the
+                    model has already clamped to 0-255, so it returns a hash sign
+                    and six hex digits for EVERY input. Checked by rendering rather
+                    than by reading, which is the only way that claim is worth
+                    anything: a scrim of `0.5" onload="alert(1)` still came back as
+                    the hex #4C4860, with all five of this cell's attributes intact.
+
+                    It is converted anyway because the SHAPE is the hazard. Safety
+                    here rests on an implementation detail one refactor away from
+                    changing — a scrim that ever learned to accept a named colour
+                    would reopen it silently — and leaving a hand-assembled
+                    attribute beside a repaired one is how the wrong pattern gets
+                    copied next. Same encoder, same reasoning, zero byte movement
+                    for a hex triplet. %>
+                <%= tag.attributes(bgcolor: banner.scrim_solid_hex) if banner.scrim_opacity.positive? %>
                 style="height:<%= banner.height %>px;padding:0 <%= side_padding %>px;<%= "background-color:rgba(24,16,64,#{banner.scrim_opacity});" if banner.scrim_opacity.positive? %>">
               <% if preview || banner.header.present? %>
                 <p<%= hook.call("header") %> style="margin:0 0 <%= gap_after_header %>px;font-family:Montserrat,'Segoe UI',Helvetica,Arial,sans-serif;font-size:<%= header_size %>px;line-height:<%= header_line %>px;font-weight:700;color:#ffffff;">

data/app/views/studio/modals/_saving.html.erb

@@ -10,7 +10,8 @@
                      apps omit this; the /admin/style demo passes an expression
                      (e.g. close) so the specimen self-terminates after min_duration
                      instead of spinning forever. %>
-<% saving_store = local_assigns.fetch(:store, "modals") %>
+<%# IDENTIFIER position ($store.<name>) — VALIDATED, never escaped: Studio::JsIdentifier. %>
+<% saving_store = Studio::JsIdentifier.validate!(local_assigns.fetch(:store, "modals"), local: :store) %>
 <div>
   <%= render "studio/modals/blocks/processing_card",
         title_key: "$store.#{saving_store}.current()?.props?.title || 'Saving…'",

data/app/views/studio/modals/_scoped_host.html.erb

@@ -46,7 +46,9 @@
   rest of it onto the page as visible text. That shipped once.)
 %>
 <%
-  scoped_store = local_assigns.fetch(:store)
+  # IDENTIFIER position ($store.<name>) — VALIDATED, never escaped: Studio::JsIdentifier.
+  scoped_store = Studio::JsIdentifier.validate!(
+                 local_assigns.fetch(:store), local: :store)
   card_class   = local_assigns.fetch(:card_class,
                    "bg-surface rounded-xl border border-subtle shadow-2xl p-6 max-w-sm w-full")
 %>

data/app/views/studio/modals/auth/_resend_footer.html.erb

@@ -12,7 +12,9 @@
     modal_store — Alpine store name backing close(). Default "modals".
 %>
 <%
-  modal_store = local_assigns.fetch(:modal_store, "modals")
+  # IDENTIFIER position ($store.<name>) — VALIDATED, never escaped: Studio::JsIdentifier.
+  modal_store = Studio::JsIdentifier.validate!(
+                local_assigns.fetch(:modal_store, "modals"), local: :modal_store)
 %>
 <button @click="resendMagicLink()" :disabled="props.submitting === 'magic-link' || (props.resendCooldown || 0) > 0"
         class="block mx-auto text-sm text-primary hover:text-primary-300 underline underline-offset-2 disabled:opacity-50 disabled:no-underline">

data/app/views/studio/modals/blocks/_age_gate.html.erb

@@ -62,7 +62,9 @@
   birthday_modal_id = local_assigns.fetch(:birthday_modal_id, "birthday")
   back_label        = local_assigns.fetch(:back_label, "Update your Birthday")
   title             = local_assigns[:title]
-  modal_store       = local_assigns.fetch(:modal_store, "modals")
+  # IDENTIFIER position ($store.<name>) — VALIDATED, never escaped: Studio::JsIdentifier.
+  modal_store       = Studio::JsIdentifier.validate!(
+                      local_assigns.fetch(:modal_store, "modals"), local: :modal_store)
 %>
 <div x-data="{
        now: Date.now(),

data/app/views/studio/modals/blocks/_birthday.html.erb

@@ -80,6 +80,13 @@
   fine_print  = local_assigns.fetch(:fine_print,
                   validates ? "We use your date of birth only to confirm eligibility."
                             : "We use your date of birth only to know when to wish you a happy birthday.")
+  # NOT VALIDATED HERE, deliberately. This partial never splices the store name into
+  # identifier position: it reaches birthdayModal as a JS STRING (escaped below) and
+  # the factory looks it up with Alpine.store(name), where any character is legal.
+  # The identifier contract is owed by blocks/_shell, which this card renders one
+  # line further down and which validates it — so a hostile value still raises,
+  # once, at the site that actually splices it. A second guard here would be a
+  # redundant one: it would survive being deleted.
   modal_store = local_assigns.fetch(:modal_store, "modals")
   demo        = local_assigns.fetch(:demo, false)
   demo_underage     = local_assigns.fetch(:demo_underage, false)

data/app/views/studio/modals/blocks/_close_x.html.erb

@@ -42,7 +42,9 @@
     label       — aria-label. Default "Close".
 %>
 <%
-  modal_store = local_assigns.fetch(:modal_store, "modals")
+  # IDENTIFIER position ($store.<name>) — VALIDATED, never escaped: Studio::JsIdentifier.
+  modal_store = Studio::JsIdentifier.validate!(
+                local_assigns.fetch(:modal_store, "modals"), local: :modal_store)
   label       = local_assigns.fetch(:label, "Close")
 %>
 <button type="button" @click="$store.<%= modal_store %>.close()"

data/app/views/studio/modals/blocks/_cta_redirect.html.erb

@@ -25,7 +25,9 @@
   href_key         = local_assigns.fetch(:href_key)
   label_html       = local_assigns.fetch(:label_html, "Continue")
   duration_seconds = local_assigns.fetch(:duration_seconds, 5)
-  modal_store      = local_assigns.fetch(:modal_store, "modals")
+  # IDENTIFIER position ($store.<name>) — VALIDATED, never escaped: Studio::JsIdentifier.
+  modal_store      = Studio::JsIdentifier.validate!(
+                     local_assigns.fetch(:modal_store, "modals"), local: :modal_store)
 %>
 <div x-data="{
        _redirectTimer: null,

data/app/views/studio/modals/blocks/_entry_confirmed.html.erb

@@ -60,7 +60,9 @@
                        that does nothing.
 %>
 <%
-  modal_store      = local_assigns.fetch(:modal_store, "modals")
+  # IDENTIFIER position ($store.<name>) — VALIDATED, never escaped: Studio::JsIdentifier.
+  modal_store      = Studio::JsIdentifier.validate!(
+                     local_assigns.fetch(:modal_store, "modals"), local: :modal_store)
   props_expr       = local_assigns.fetch(:props_expr,
                        "(function () { var c = $store.#{modal_store}.current(); return (c && c.props) || {}; })()")
   above_seeds        = local_assigns[:above_seeds]

data/app/views/studio/modals/blocks/_free_entry_earned.html.erb

@@ -19,7 +19,9 @@
     close_label  — dismiss link text. Default "Close".
 %>
 <%
-  modal_store  = local_assigns.fetch(:modal_store, "modals")
+  # IDENTIFIER position ($store.<name>) — VALIDATED, never escaped: Studio::JsIdentifier.
+  modal_store  = Studio::JsIdentifier.validate!(
+                 local_assigns.fetch(:modal_store, "modals"), local: :modal_store)
   icon_emoji   = local_assigns.fetch(:icon_emoji, "🎉")
   title_key    = local_assigns.fetch(:title_key, "props.level ? ('Level ' + props.level) : 'Free Entry Earned'")
   subtitle     = local_assigns.fetch(:subtitle, "You leveled up and earned a reward. Keep earning more with each level.")

data/app/views/studio/modals/blocks/_leveling_activity.html.erb

@@ -91,7 +91,9 @@
   free_entry_label   = local_assigns.fetch(:free_entry_label, "Free Entry Earned 🎟️")
   seeds_per_level    = local_assigns.fetch(:seeds_per_level, 100)
   leveling           = local_assigns.fetch(:leveling, Studio.feature?(:leveling))
-  modal_store        = local_assigns.fetch(:modal_store, "modals")
+  # IDENTIFIER position ($store.<name>) — VALIDATED, never escaped: Studio::JsIdentifier.
+  modal_store        = Studio::JsIdentifier.validate!(
+                       local_assigns.fetch(:modal_store, "modals"), local: :modal_store)
   demo               = local_assigns.fetch(:demo, false)
   # consent_label — render a consent checkbox that gates the action (newsletter
   # join). next_label / next_open — an optional "Next Quest" button in the

data/app/views/studio/modals/blocks/_onchain_success.html.erb

@@ -27,7 +27,9 @@
   cta_label_key    = local_assigns.fetch(:cta_label_key)
   cta_href_key     = local_assigns.fetch(:cta_href_key)
   cluster_param    = local_assigns.fetch(:cluster_param, "")
-  modal_store      = local_assigns.fetch(:modal_store, "modals")
+  # IDENTIFIER position ($store.<name>) — VALIDATED, never escaped: Studio::JsIdentifier.
+  modal_store      = Studio::JsIdentifier.validate!(
+                     local_assigns.fetch(:modal_store, "modals"), local: :modal_store)
 %>
 <div>
   <%= render "studio/modals/blocks/card_header",

data/app/views/studio/modals/blocks/_shell.html.erb

@@ -13,7 +13,9 @@
 <%
   shell_title       = local_assigns[:title]
   shell_dismissible = local_assigns.fetch(:dismissible, true)
-  modal_store       = local_assigns.fetch(:modal_store, "modals")
+  # IDENTIFIER position ($store.<name>) — VALIDATED, never escaped: Studio::JsIdentifier.
+  modal_store       = Studio::JsIdentifier.validate!(
+                      local_assigns.fetch(:modal_store, "modals"), local: :modal_store)
 %>
 <div>
   <% if shell_title || shell_dismissible %>

data/app/views/studio/modals/onboarding/_first_name.html.erb

@@ -104,8 +104,8 @@
       sites: the props getter, finish's close, and the Ruby-built dismiss_action
       emitted into the x's click handler. Escaping is the WRONG repair here: an
       escaped identifier is a different SyntaxError and the same dead card.
-      Repair: refuse a value that is not a JS identifier, which the Ruby block
-      below does once, at the source, so all three sites are covered.
+      Repair: refuse a value that is not a JS identifier, which one call to
+      Studio::JsIdentifier.validate! does at the source, covering all three sites.
 
   A PATTERN, NOT AN ALLOWLIST, and the reason is worth keeping: an allowlist would
   be this engine enumerating its own consumers, so the next app to mount a
@@ -116,7 +116,9 @@
 
   NOTE THE SAME LOCAL TAKES THE OTHER REPAIR ELSEWHERE. blocks/_birthday and
   blocks/_leveling_activity pass modal_store in STRING position and escape it,
-  correctly. The shape decides the repair, never the name of the local.
+  correctly. The shape decides the repair, never the name of the local. And where
+  a store name reaches ONLY a string — blocks/_birthday hands it to Alpine.store(),
+  a lookup by string — no identifier is owed and none is demanded.
 %>
 <%
   submit_path = local_assigns.fetch(:submit_path, "/onboarding/first_name")
@@ -163,37 +165,21 @@
   typed_placeholder = !placeholder_names.nil?
   max_length  = local_assigns.fetch(:max_length, Studio::FULL_NAME_MAX_LENGTH)
   progress    = local_assigns.fetch(:progress, nil)
-  modal_store = local_assigns.fetch(:modal_store, "modals")
   # VALIDATED, NOT ESCAPED — and that distinction is the whole point of this local.
   # Every other value inside the x-data is a JS STRING and is repaired by escaping.
   # This one is spliced in as a bare NAME (`$store.<name>.current()`), so the same
-  # repair breaks it: escape_javascript turns `a'b` into `a\'b`, and
-  # `$store.a\'b.current()` is not a rescued identifier, it is a different
-  # SyntaxError — the same silently dead card, reached a longer way.
+  # repair breaks it: escape_javascript backslash-escapes the apostrophe, and an
+  # escaped apostrophe is not a rescued identifier — it is a different SyntaxError,
+  # the same silently dead card reached a longer way.
   #
-  # A PATTERN RATHER THAN AN ALLOWLIST, deliberately. An allowlist would be this
-  # engine enumerating its own CONSUMERS — "modals" and the style guide's
-  # "dsModals" today — so the next app to mount a page-scoped host would be refused
-  # by its own dependency until a gem release admitted the name. That is backwards
-  # for a shared primitive. The real contract is narrower and stateless: this is
-  # spliced into member-access position, so it must be a JS identifier, and WHICH
-  # identifier is none of the engine's business.
-  #
-  # ASCII IdentifierName, which is what member access after a dot accepts. It
-  # admits every store name a host would plausibly write and rejects every
-  # character that could leave identifier position — quote, apostrophe, backslash,
-  # dot, space, semicolon, angle bracket.
-  #
-  # IT RAISES RATHER THAN FALLING BACK TO THE DEFAULT. A silent fallback is the
-  # worse of the two repairs: the card would mount, look perfect, and talk to a
-  # store that is not the host's — which is the SILENT-brick failure class this
-  # guard exists to leave behind. A host sees this the first time it renders.
-  unless modal_store.to_s.match?(/\A[A-Za-z_$][A-Za-z0-9_$]*\z/)
-    raise ArgumentError,
-          "modal_store must be a JS identifier (it is spliced into $store.<name>); " \
-          "got #{modal_store.inspect}. Escaping it would not help — an escaped " \
-          "identifier is a different SyntaxError, and the card would mount dead."
-  end
+  # THE REGEX AND THE ARGUMENT USED TO LIVE HERE, INLINE. This card was the first
+  # site to need them, so it carried the worked example; the engine has sixteen more
+  # splices of a store name in identifier position, and the contract now lives in ONE
+  # place. Studio::JsIdentifier holds the pattern, why it is a pattern and not an
+  # allowlist, and why it raises rather than falling back to the default. Behaviour
+  # here is unchanged: same pattern, same ArgumentError, same message.
+  modal_store = Studio::JsIdentifier.validate!(
+                  local_assigns.fetch(:modal_store, "modals"), local: :modal_store)
   done_event  = local_assigns.fetch(:done_event, "onboarding-step-done")
   # THE SAME HAZARD empty_error_js CARRIES, on the three remaining locals that land
   # inside a JS SINGLE-quoted literal in the x-data below. A bare apostrophe in any

data/app/views/studio/modals/templates/_action.html.erb

@@ -7,7 +7,8 @@
     icon_color :primary / :success / :warning to card_header.
 
     Local: modal_store — Alpine store name backing close(). Default "modals". %>
-<% modal_store = local_assigns.fetch(:modal_store, "modals") %>
+<%# IDENTIFIER position ($store.<name>) — VALIDATED, never escaped: Studio::JsIdentifier. %>
+<% modal_store = Studio::JsIdentifier.validate!(local_assigns.fetch(:modal_store, "modals"), local: :modal_store) %>
 <div x-data>
   <%= render "studio/modals/blocks/card_header",
         size: :lg,

data/app/views/studio/modals/templates/_form.html.erb

@@ -4,7 +4,8 @@
     + close ×. Ported from turf-monster.
 
     Local: modal_store — Alpine store name backing close(). Default "modals". %>
-<% modal_store = local_assigns.fetch(:modal_store, "modals") %>
+<%# IDENTIFIER position ($store.<name>) — VALIDATED, never escaped: Studio::JsIdentifier. %>
+<% modal_store = Studio::JsIdentifier.validate!(local_assigns.fetch(:modal_store, "modals"), local: :modal_store) %>
 <div x-data="{ value: '' }">
   <%= render layout: "studio/modals/blocks/shell", locals: { title: "Form Template", modal_store: modal_store } do %>
     <p class="text-sm text-muted mb-4">

data/app/views/studio/modals/templates/_status.html.erb

@@ -6,7 +6,8 @@
     at 1.6s so a viewer can step through both states.
 
     Local: modal_store — Alpine store name backing close(). Default "modals". %>
-<% modal_store = local_assigns.fetch(:modal_store, "modals") %>
+<%# IDENTIFIER position ($store.<name>) — VALIDATED, never escaped: Studio::JsIdentifier. %>
+<% modal_store = Studio::JsIdentifier.validate!(local_assigns.fetch(:modal_store, "modals"), local: :modal_store) %>
 <div x-data="{
        state: 'loading',
        start() {

data/app/views/studio/modals/templates/_success.html.erb

@@ -5,7 +5,8 @@
     use studio/modals/blocks/_onchain_success instead. Ported from turf-monster.
 
     Local: modal_store — Alpine store name backing close(). Default "modals". %>
-<% modal_store = local_assigns.fetch(:modal_store, "modals") %>
+<%# IDENTIFIER position ($store.<name>) — VALIDATED, never escaped: Studio::JsIdentifier. %>
+<% modal_store = Studio::JsIdentifier.validate!(local_assigns.fetch(:modal_store, "modals"), local: :modal_store) %>
 <div x-data>
   <%= render "studio/modals/blocks/card_header",
         size: :lg,

data/app/views/studio/modals/templates/_wizard.html.erb

@@ -8,7 +8,8 @@
     primary CTA pulling forward; Back as a subtle link, hidden on step 1.
 
     Local: modal_store — Alpine store name backing close(). Default "modals". %>
-<% modal_store = local_assigns.fetch(:modal_store, "modals") %>
+<%# IDENTIFIER position ($store.<name>) — VALIDATED, never escaped: Studio::JsIdentifier. %>
+<% modal_store = Studio::JsIdentifier.validate!(local_assigns.fetch(:modal_store, "modals"), local: :modal_store) %>
 <div x-data="{ step: 1, total: 3 }">
   <div class="relative mb-3 -mt-2">
     <h3 class="text-heading font-bold text-lg leading-tight text-center pt-1">Wizard Template</h3>

data/app/views/style/_modals.html.erb

@@ -468,14 +468,6 @@
                     resolve_expr: "$store.dsModals.close()" %></div>
         </template>
 
-        <%# wallet-setup — registered here with the other cards this page opens.
-            Its CARD lives in the Web3 section (it is about getting a wallet); the
-            3-of-3 pill it renders is the HOST's onboarding chain position, which
-            is not this page's business. The Onboarding section that used to own
-            it was folded into Profile on 2026-08-24. %>
-        <template x-if="$store.dsModals.current().id === 'wallet-setup'">
-          <div><%= render "style/modals/wallet_setup" %></div>
-        </template>
 
         <%# --- Batch 3: the modals that had no card on EITHER page --- %>
         <template x-if="$store.dsModals.current().id === 'it-begins'">
@@ -504,21 +496,12 @@
         <template x-if="$store.dsModals.current().id === 'ds-onramp-hub'">
           <div><%= render "style/modals/ds_onramp_hub" %></div>
         </template>
-        <template x-if="$store.dsModals.current().id === 'ds-buy-entry-token'">
-          <div><%= render "style/modals/ds_buy_entry_token" %></div>
-        </template>
-        <template x-if="$store.dsModals.current().id === 'ds-cdp-ramp'">
-          <div><%= render "style/modals/ds_cdp_ramp" %></div>
-        </template>
         <template x-if="$store.dsModals.current().id === 'ds-newsletter-success'">
           <div><%= render "style/modals/ds_newsletter_success" %></div>
         </template>
         <template x-if="$store.dsModals.current().id === 'rate-limit-general'">
           <div><%= render "style/modals/rate_limit_general" %></div>
         </template>
-        <template x-if="$store.dsModals.current().id === 'wallet-changed'">
-          <div><%= render "style/modals/wallet_changed" %></div>
-        </template>
 
         <%# --- Newsletter exit + the off-page quest celebration --- %>
         <template x-if="$store.dsModals.current().id === 'quest-success'">
@@ -534,9 +517,6 @@
         </template>
 
         <%# --- Web3 --- %>
-        <template x-if="$store.dsModals.current().id === 'cosign-rejected'">
-          <div><%= render "style/modals/cosign_rejected" %></div>
-        </template>
         <%# Both web3 sign-in cards render from SOLANA-STUDIO, and both are the
             REAL shipped partials rather than style-guide forks — the same files
             turf-monster renders in production, so what is reviewed here IS the
@@ -1187,9 +1167,9 @@
           listed for reference but <strong>cannot be opened here</strong>. Nothing
           registers them, so a trigger would open an empty panel.
         <% end %>
-        The cards run in the order a player meets them &mdash; <strong>get a wallet,
-        prove it, spend from it</strong>: Connect wallet &rarr; Setup Wallet &rarr;
-        the two Sign Wallet states &rarr; Processing &rarr; success or error &rarr;
+        The cards run in the order a player meets them &mdash; <strong>connect a
+        wallet, prove it, spend from it</strong>: Connect wallet &rarr; the two
+        Sign Wallet states &rarr; Processing &rarr; success or error &rarr;
         top-up &rarr; Entry confirmed. Inside that, <strong>Connect Wallet &rarr;
         Processing on-chain transaction &rarr; On-chain success</strong> is a
         <strong>walked flow</strong> and the live card <strong>glows</strong>,
@@ -1212,14 +1192,7 @@
         <strong>standard web3 auth button</strong>: a wallet row (brand mark, the
         wallet&rsquo;s own name, Installed badge, chevron) rather than a filled
         CTA, glowing via <code class="font-mono text-2xs">pulse-cta</code> because
-        it is the one thing to press. Do not confuse them with <strong>Setup
-        Wallet</strong>, immediately before them: that one asks an account to
-        <strong>get</strong> a wallet, these ask an account to
-        <strong>prove</strong> the one it already has &mdash; opposite populations
-        (<code class="font-mono text-2xs">WalletSetupPolicy</code> exits at its own
-        step 1 for an account that holds a wallet), so no user ever meets both.
-        They sit next to each other anyway, because the pair is easiest to keep
-        straight when you can read them side by side.
+        it is the one thing to press.
       </p>
     </div>
     <%# ONE ordered run, read left to right as a player meets it: get a wallet,
@@ -1261,30 +1234,6 @@
           section's business.
           ONE card with a "Wallet detected" toggle rather than two cards sharing a
           modal id: the two Sign Wallet cards below are what that shape costs. %>
-      <%= render layout: "style/modal_specimen", locals: {
-            label:     "Setup Wallet",
-            reference: %(the "Set up your wallet" card (style/modals/_wallet_setup) — how an account with NO wallet gets one, and the host's third onboarding step (it renders a 3-of-3 pill, which is the host's chain position, not this section's). An APP-SPECIFIC flow: the engine owns only the chrome (shell, progress_pill, wallet_brand_sprite) and the house wallet-row idiom, while extension detection, the 90-second walkthrough video, the Detailed Guide route and the managed-wallet fallback stay in the host (turf-monster's own is ~576 lines). Toggle "Wallet detected" to swap the row between INSTALL and Installed. NOTE it is the OPPOSITE population to the two Sign Wallet cards immediately below — WalletSetupPolicy exits at its own step 1 for an account that already holds a wallet, so no user ever meets both. Open with $store.dsModals.open('wallet-setup', { detected: false })),
-            card_data: "opts: { detected: false }",
-            toggles:   [{ model: "opts.detected", label: "Wallet detected" }],
-            open_expr: "$store.dsModals.open('wallet-setup', { detected: opts.detected })",
-            glow_when: ds_glow.call("wallet-setup"),
-            disabled: !web3_on, openable: true } do %>
-        <div class="pointer-events-none w-40 rounded-lg bg-surface border border-subtle shadow p-4 space-y-2">
-          <span class="block h-2 w-20 mx-auto rounded" style="background: var(--color-text); opacity: .18"></span>
-          <%# the 3-of-3 pill, filled — the whole reason this card sits here %>
-          <span class="flex gap-1">
-            <span class="flex-1 h-1.5 rounded" style="background: var(--color-cta)"></span>
-            <span class="flex-1 h-1.5 rounded" style="background: var(--color-cta)"></span>
-            <span class="flex-1 h-1.5 rounded" style="background: var(--color-cta)"></span>
-          </span>
-          <span class="flex items-center gap-1.5 h-7 w-full rounded-lg border px-1.5" style="border-color: var(--color-border-strong)">
-            <span class="w-4 h-4 rounded shrink-0" style="background: var(--color-primary)"></span>
-            <span class="block h-1.5 w-8 rounded" style="background: var(--color-text); opacity: .35"></span>
-          </span>
-          <%# the walkthrough placeholder, the card's second half %>
-          <span class="block w-full rounded" style="height: 1.6rem; background: var(--color-text); opacity: .10"></span>
-        </div>
-      <% end %>
 
       <%# SIGN WALLET — the web2-session-on-a-wallet-account card. NOT part of the
           walk above: that walk is one on-chain transaction, this is an AUTH state
@@ -1411,20 +1360,6 @@
           no — refusing to co-sign because the transaction it was handed did not
           match the entry it prepared. They sit together because a reviewer
           reading either alone would not know the other existed. %>
-      <%= render layout: "style/modal_specimen", locals: {
-            label:     "Co-sign refused",
-            reference: %(the "Transaction not signed" card (style/modals/_cosign_rejected) — turf-monster's modals/_cosign_rejected, opened when POST confirm_onchain_entry answers 422 with code tx_rejected: the server refused to co-sign because the submitted transaction did not match the entry it had prepared. APP-SPECIFIC — the engine owns no entry preparation, no co-signing and no verdict; it lends card_header and nothing else. THE COPY IS DELIBERATELY VAGUE and should stay that way: good actors never see this card (it fires on a tampered or mismatched transaction), so naming WHICH server-side check failed would help an attacker probe the validation. What the copy does commit to is the part the one honest user needs — nothing was submitted, the funds are safe. Open with $store.dsModals.open('cosign-rejected')),
-            open_expr: "$store.dsModals.open('cosign-rejected')",
-            glow_when: ds_glow.call("cosign-rejected"),
-            disabled: !web3_on, openable: true } do %>
-        <div class="pointer-events-none w-40 rounded-lg bg-surface border border-subtle shadow p-4 text-center space-y-2">
-          <div class="text-2xl leading-none">&#128737;&#65039;</div>
-          <span class="block h-2 w-24 mx-auto rounded" style="background: var(--color-text); opacity: .18"></span>
-          <span class="block h-1.5 w-full rounded" style="background: var(--color-text); opacity: .3"></span>
-          <span class="block h-1.5 w-28 mx-auto rounded" style="background: var(--color-text); opacity: .3"></span>
-          <span class="block h-5 w-full rounded" style="background: var(--color-cta)"></span>
-        </div>
-      <% end %>
 
       <%# Wallet deposit — standalone top-up card (not part of the walk). %>
       <%= render layout: "style/modal_specimen", locals: {
@@ -1486,41 +1421,7 @@
         </div>
       <% end %>
 
-      <%# ds-buy-entry-token — reached with a lineup picked and no way to pay. %>
-      <%= render layout: "style/modal_specimen", locals: {
-            label:     "Buy entry token",
-            reference: %(the entry-token purchase (style/modals/_ds_buy_entry_token) — turf-monster's modals/_buy_entry_token, built from blocks/_close_x and two blocks/_rail_row. Reached when a player has picked a lineup and has no way to pay for it, which is why the copy says the lineup is SAVED: losing their picks is the one thing they are afraid of at that moment. The ranking is a PRODUCT decision rather than a visual one — Coinflow leads and carries the "New" badge because it mints a spendable entry token directly, the shortest path from here to being in the contest, while Stripe swaps into the auth wizard's tokens picker, the older and longer path, and defers. Open with $store.dsModals.open('ds-buy-entry-token')),
-            open_expr: "$store.dsModals.open('ds-buy-entry-token')",
-            glow_when: ds_glow.call("ds-buy-entry-token"),
-            disabled: !web3_on, openable: true } do %>
-        <div class="pointer-events-none w-40 rounded-lg bg-surface border border-subtle shadow p-4 space-y-2">
-          <span class="block h-2 w-24 mx-auto rounded" style="background: var(--color-text); opacity: .18"></span>
-          <span class="flex items-center gap-1.5 rounded-md p-1.5" style="border: 2px solid var(--color-primary)">
-            <span class="block h-4 w-4 rounded" style="background: var(--color-cta)"></span>
-            <span class="block h-1.5 flex-1 rounded" style="background: var(--color-text); opacity: .3"></span>
-          </span>
-          <span class="flex items-center gap-1.5 rounded-md p-1.5 border border-subtle">
-            <span class="block h-4 w-4 rounded" style="background: var(--color-text); opacity: .25"></span>
-            <span class="block h-1.5 flex-1 rounded" style="background: var(--color-text); opacity: .18"></span>
-          </span>
-        </div>
-      <% end %>
 
-      <%# ds-cdp-ramp — ONE of thirteen states, and the card says so. %>
-      <%= render layout: "style/modal_specimen", locals: {
-            label:     "Coinbase ramp (preflight)",
-            reference: %(the Coinbase ramp's BUY PREFLIGHT (style/modals/_ds_cdp_ramp) — turf-monster's modals/_cdp_ramp. DELIBERATELY PARTIAL: that modal is a TWO-FLOW step machine (buy and cash-out) across THIRTEEN states — preflight, opening, waiting, awaiting-cdp, send, settling and the rest — and this cards exactly one of them, the buy preflight, which is the state both funding cards hand off to and therefore the only one a player reaches without already being mid-flow. The other twelve are uncarded BY DECISION (operator, 2026-08-26), which is a different thing from an oversight — a cabinet that shows one state of a thirteen-state machine without admitting it teaches a reader that the machine is simpler than it is. /tasks/port-cdp-ramp-specimen holds the full state map if that decision reverses. Open with $store.dsModals.open('ds-cdp-ramp')),
-            open_expr: "$store.dsModals.open('ds-cdp-ramp')",
-            glow_when: ds_glow.call("ds-cdp-ramp"),
-            disabled: !web3_on, openable: true } do %>
-        <div class="pointer-events-none w-40 rounded-lg bg-surface border border-subtle shadow p-4 text-center space-y-2 relative">
-          <span class="absolute top-1 right-2 text-secondary leading-none">&times;</span>
-          <span class="block h-2 w-28 mx-auto rounded" style="background: var(--color-text); opacity: .18"></span>
-          <span class="block h-1.5 w-full rounded" style="background: var(--color-text); opacity: .12"></span>
-          <span class="block h-1.5 w-24 mx-auto rounded" style="background: var(--color-text); opacity: .12"></span>
-          <span class="block h-4 w-full rounded" style="background: var(--color-cta)"></span>
-        </div>
-      <% end %>
 
       <%# Entry confirmed — the GENERIC web3 celebration (tx link + heading + drain
           CTA). seedsEarned: 0 so no seeds bar even where leveling is on: this card
@@ -1567,30 +1468,6 @@
         </div>
       <% end %>
 
-      <%# wallet-changed — the extension switched accounts underneath the session.
-          Both addresses are shown because recognising your own is the only way to
-          tell a deliberate switch from an accident. %>
-      <%= render layout: "style/modal_specimen", locals: {
-            label:     "Wallet changed",
-            reference: %(the Web3 "Wallet changed" reconciliation (style/modals/_wallet_changed) — turf-monster's modals/_wallet_changed, fired when the person switches accounts inside their wallet extension while signed in. Composes the engine's blocks/_card_header; the switch itself belongs to turf's wallet store (continueSwitch) and the engine owns no wallet. Nothing is broken — but the session and the extension now disagree about who this is, and every on-chain action from here would use an identity the page is not showing. So it prints BOTH addresses, truncated the Solana way, because recognising your own is the one check the app cannot make for you. Continuing re-derives a session against the new wallet, which is a round trip, so the button carries a busy state rather than looking dead. Open with $store.dsModals.open('wallet-changed', { currentAddress: '…', newAddress: '…' })),
-            open_expr: "$store.dsModals.open('wallet-changed', { currentAddress: '7xKpDemoSignedInWallet9JZ2Q', newAddress: '9mQtDemoSwitchedWalletLd4V' })",
-            glow_when: ds_glow.call("wallet-changed"),
-            disabled: !web3_on, openable: true } do %>
-        <div class="pointer-events-none w-40 rounded-lg bg-surface border border-subtle shadow p-4 text-center space-y-2">
-          <div class="text-2xl leading-none">🔀</div>
-          <span class="block h-2 w-24 mx-auto rounded" style="background: var(--color-text); opacity: .18"></span>
-          <%# the two truncated addresses — the comparison IS the card %>
-          <span class="flex items-center justify-between gap-2">
-            <span class="block h-1.5 w-10 rounded" style="background: var(--color-text); opacity: .18"></span>
-            <span class="block h-1.5 w-12 rounded" style="background: var(--color-text); opacity: .35"></span>
-          </span>
-          <span class="flex items-center justify-between gap-2">
-            <span class="block h-1.5 w-10 rounded" style="background: var(--color-text); opacity: .18"></span>
-            <span class="block h-1.5 w-12 rounded" style="background: var(--color-text); opacity: .35"></span>
-          </span>
-          <span class="block h-5 w-full rounded" style="background: var(--color-cta)"></span>
-        </div>
-      <% end %>
     </div>
   </section>
 

data/lib/studio/js_identifier.rb

@@ -0,0 +1,88 @@
+module Studio
+  # ONE home for the CONTRACT a host-supplied value must meet when a partial
+  # splices it into JS **identifier position** — a bare NAME rather than a string:
+  #
+  #     <button @click="$store.<%= modal_store %>.close()">
+  #
+  # THE SIBLING OF Studio::JsLiteral, AND ITS OPPOSITE. Both exist for the same
+  # silent failure: a host value that makes an Alpine expression a SyntaxError, so
+  # the component mounts as a NO-OP that still renders every element. Perfect
+  # markup, dead card, nothing raised and nothing logged. The two differ on the
+  # only question that matters — WHAT THE VALUE IS:
+  #
+  #   STRING position  — the value is DATA inside a JS literal. Any character is
+  #     legal; the repair is to ESCAPE it (Studio::JsLiteral.in_attribute).
+  #   IDENTIFIER position — the value is a NAME. Most characters are not legal at
+  #     all; the repair is to REFUSE it, which is this module.
+  #
+  # ESCAPING IS ACTIVELY WRONG HERE, which is why this is a second module rather
+  # than a second method on the first. escape_javascript also escapes `$`, so a
+  # perfectly legal store name like `dsModals$2` comes back as `dsModals\$2` and
+  # `$store.dsModals\$2.close()` is a SyntaxError — the same dead card, reached a
+  # longer way, on a value that was never hostile. And for a value that IS hostile,
+  # `$store.a\'b.close()` is not a rescued identifier either. There is no escaping
+  # of identifier position; there is only validity.
+  #
+  # A PATTERN, NOT AN ALLOWLIST, and the reason outlives this engine. An allowlist
+  # would be a shared primitive enumerating its own CONSUMERS — "modals" and the
+  # style guide's "dsModals" today — so the next app to mount a page-scoped host
+  # would be refused by its own dependency until a gem release admitted the name.
+  # The real contract is narrower and stateless: the value is spliced into
+  # member-access position, so it must be an identifier, and WHICH identifier is
+  # none of the engine's business.
+  #
+  # IT RAISES RATHER THAN FALLING BACK TO A DEFAULT. A silent fallback is the worse
+  # of the two repairs: the card would mount, look perfect, and talk to a store that
+  # is not the host's — the same SILENT class this guard exists to leave behind,
+  # only now with a working-looking page in front of it. A host meets this the first
+  # time it renders, in development, with the local named.
+  #
+  # WHAT IT DOES NOT COVER. A value in string position that is ALSO a store name
+  # (blocks/_birthday's `store: '<%= j modal_store %>'`, which reaches
+  # `Alpine.store(name)` — a lookup by string, where any character is legal) needs no
+  # identifier. Validate where the value reaches a SPLICE, not everywhere the word
+  # "store" appears; test/views/js_identifier_locals_test.rb carries the census.
+  module JsIdentifier
+    # ASCII IdentifierName — what member access after a dot accepts. It admits every
+    # store name a host would plausibly write (`modals`, `dsModals`, `ds_Modals$2`)
+    # and rejects every character that could leave identifier position: quote,
+    # apostrophe, backslash, dot, space, semicolon, angle bracket, and the empty
+    # string.
+    #
+    # DELIBERATELY NOT THE FULL ECMAScript GRAMMAR, which admits most of Unicode.
+    # Widening it is a decision, not a bug fix — and it would have to be taken
+    # together with the marking note on #validate! below, because the value's safety
+    # under ERB is what the narrow set buys.
+    PATTERN = /\A[A-Za-z_$][A-Za-z0-9_$]*\z/
+
+    module_function
+
+    # Return +value+ as a String, or raise ArgumentError naming +local+.
+    #
+    #     modal_store = Studio::JsIdentifier.validate!(
+    #                     local_assigns.fetch(:modal_store, "modals"), local: :modal_store)
+    #
+    # +local+ is REQUIRED and has no default on purpose. Fifteen of the engine's
+    # call sites name this local `modal_store` and two name it `store`; a default
+    # that is right fifteen times out of seventeen is exactly how the other two
+    # would hand a host the wrong local to go and fix.
+    #
+    # RETURNS A PLAIN STRING, NOT AN html_safe ONE, and that is load-bearing rather
+    # than an omission. A value that satisfies PATTERN contains no character ERB
+    # escapes, so ERB's pass over it is a byte-for-byte no-op and the identifier
+    # reaches the browser exactly as the host wrote it — the marking would buy
+    # nothing today. What it would cost is the day PATTERN is widened: ERB's
+    # escaping is the second layer that would still be standing, and a value marked
+    # safe here skips it. So the pattern is the only thing holding the line, and it
+    # is holding it alone by choice, in one place.
+    def validate!(value, local:)
+      name = "#{value}"
+      return name if name.match?(PATTERN)
+
+      raise ArgumentError,
+            "#{local} must be a JS identifier (it is spliced into $store.<name>); " \
+            "got #{value.inspect}. Escaping it would not help — an escaped " \
+            "identifier is a different SyntaxError, and the card would mount dead."
+    end
+  end
+end

data/lib/studio/js_literal.rb

@@ -56,12 +56,33 @@ module Studio
   # the worked examples; test/lib/studio/attribute_encoding_contract_test.rb pins the
   # ActionView behaviour the whole thing rests on.
   #
+  # THE MARKING IS A JUDGEMENT ABOUT THE VALUE, NOT ABOUT THE FILE, and it is the
+  # half of that repair most easily got backwards. `tag.attributes` takes both kinds
+  # and does the right thing with each:
+  #
+  #   EXPRESSION (an Alpine handler, a JS number, a store path) — pass it MARKED.
+  #     Only the double quotes move, so the code the caller deliberately handed the
+  #     engine still parses. Escaping it would be corruption of the same kind the
+  #     script-body note above describes.
+  #   CONTENT (a URL, a colour, a length, a regex, a tooltip sentence) — pass it
+  #     UNMARKED and let it take the full escaping a content attribute is owed. The
+  #     parser hands the value back decoded, and a bare `&` stops reaching the client
+  #     as the start of an entity.
+  #
+  # Both repairs live in this engine and neither is the default: the four input
+  # constraints in modals/blocks/_leveling_activity are the content case beside the
+  # handlers in the same file, and studio/mailers/_layered_banner is the content case
+  # in an EMAIL, where the consumer is a mail client rather than a browser and the
+  # margin for a malformed attribute is smaller. Choosing by which file a value sits
+  # in, rather than by what the value is, gets one of those two wrong every time.
+  #
   # AND IT IS THE WRONG REPAIR FOR IDENTIFIER POSITION. A local spliced in as a bare
   # NAME — `$store.<%= modal_store %>.close()` — must be VALIDATED, never escaped:
   # escape_javascript also escapes `$`, so a legitimate store name like `dsModals$2`
   # comes back mangled and the card dies anyway. The SHAPE of the splice decides the
-  # repair, never the name of the local. studio/modals/onboarding/_first_name
-  # carries the worked example of both.
+  # repair, never the name of the local. That repair is Studio::JsIdentifier, this
+  # module's sibling and its opposite; studio/modals/onboarding/_first_name carries
+  # the worked example of both in one partial.
   module JsLiteral
     extend ActionView::Helpers::JavaScriptHelper
 

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.74.1"
+  VERSION = "0.74.3"
 end

data/lib/studio.rb

@@ -9,6 +9,7 @@ require "studio/environment_banner"
 require "studio/theme_resolver"
 require "studio/ui_primitives"
 require "studio/js_literal"
+require "studio/js_identifier"
 require "studio/sidebar_sections"
 require "studio/profile_sections"
 require "studio/profile_image"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.74.1
+  version: 0.74.3
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-08 00:00:00.000000000 Z
+date: 2026-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -521,9 +521,6 @@ files:
 - app/views/style/modals/_age_gate.html.erb
 - app/views/style/modals/_auth.html.erb
 - app/views/style/modals/_birthday.html.erb
-- app/views/style/modals/_cosign_rejected.html.erb
-- app/views/style/modals/_ds_buy_entry_token.html.erb
-- app/views/style/modals/_ds_cdp_ramp.html.erb
 - app/views/style/modals/_ds_close_x.html.erb
 - app/views/style/modals/_ds_newsletter_success.html.erb
 - app/views/style/modals/_ds_onramp_hub.html.erb
@@ -539,11 +536,9 @@ files:
 - app/views/style/modals/_rate_limit_general.html.erb
 - app/views/style/modals/_unsubscribe_confirm.html.erb
 - app/views/style/modals/_unsubscribe_goodbye.html.erb
-- app/views/style/modals/_wallet_changed.html.erb
 - app/views/style/modals/_wallet_connect.html.erb
 - app/views/style/modals/_wallet_connect_slot.html.erb
 - app/views/style/modals/_wallet_deposit.html.erb
-- app/views/style/modals/_wallet_setup.html.erb
 - app/views/theme_settings/edit.html.erb
 - app/views/user_mailer/magic_link.html.erb
 - app/views/user_mailer/magic_link.text.erb
@@ -573,6 +568,7 @@ files:
 - lib/studio/geo/lookup.rb
 - lib/studio/image_cache.rb
 - lib/studio/ip_locations.rb
+- lib/studio/js_identifier.rb
 - lib/studio/js_literal.rb
 - lib/studio/link_resolution.rb
 - lib/studio/link_token.rb

data/app/views/style/modals/_cosign_rejected.html.erb

@@ -1,36 +0,0 @@
-<%#
-  Living style guide specimen — the "we did not co-sign that" refusal.
-
-  APP-SPECIFIC FLOW, engine chrome only. What this card names is turf-monster's:
-  POST confirm_onchain_entry answered 422 with code `tx_rejected`, meaning the
-  server refused to co-sign because the submitted transaction did not match the
-  entry it had prepared. The engine owns no entry preparation, no co-signing and
-  no verdict — it lends `blocks/_card_header` and nothing else, exactly as
-  style/modals/_entry_tokens borrows chrome for a flow the engine does not own.
-
-  WHY THE COPY IS VAGUE, and why a reviewer should not "improve" it: good actors
-  never see this card. It fires on a tampered or mismatched transaction, so the
-  copy is deliberately reassuring and deliberately silent about WHICH
-  server-side check failed — naming the check would help an attacker probe the
-  validation. The reassurance ("nothing was submitted and your funds are safe")
-  is the part that matters to the one honest user who ever hits it.
-
-  Single root: the outer <div> is the host's required root.
-%>
-<div x-data="{}">
-  <%= render "studio/modals/blocks/card_header",
-        icon_emoji: "🛡️",
-        title: "Transaction not signed" do %>
-    <p class="text-sm text-body">
-      For your security we didn&rsquo;t co-sign this transaction &mdash; it
-      didn&rsquo;t match the entry we prepared, so nothing was submitted and your
-      funds are safe. Please close this and try entering again. If it keeps
-      happening, <span class="text-primary">contact support</span>.
-    </p>
-  <% end %>
-
-  <%# One button, because there is exactly one thing to do. The host also closes
-      on escape and click-outside; this card is dismissible by design. %>
-  <button type="button" @click="$store.dsModals.close()"
-          class="btn btn-primary btn-lg w-full">Got it</button>
-</div>

data/app/views/style/modals/_ds_buy_entry_token.html.erb

@@ -1,40 +0,0 @@
-<%#
-  Living style guide specimen — Buy an Entry Token.
-
-  APP-SPECIFIC flow, engine chrome throughout (blocks/_close_x + two
-  blocks/_rail_row). Reached when a player has picked a lineup and has no way to
-  pay for it, which is why the copy says the lineup is SAVED: the one thing they
-  are afraid of at that moment is losing their picks.
-
-  TWO RAILS, RANKED, and the ranking is a product decision rather than a visual
-  one. Coinflow leads and carries the "New" badge because it mints a spendable
-  entry token directly — it is the shortest path from here to being in the
-  contest. Stripe still swaps into the auth wizard's tokens picker, which is the
-  older, longer path, so it defers.
-
-  Single root: the outer <div> is the host's required root.
-%>
-<div class="relative">
-  <%= render "studio/modals/blocks/close_x", modal_store: "dsModals" %>
-
-  <div class="text-center pt-1 mb-2">
-    <h3 class="text-heading font-bold text-lg leading-tight">Buy an Entry Token</h3>
-  </div>
-  <p class="text-xs text-body mb-4 text-center">
-    1 token = 1 contest entry. Your lineup is saved &mdash; pick how to pay.
-  </p>
-
-  <div class="space-y-3">
-    <%= render "studio/modals/blocks/rail_row",
-          emphasis: :primary, on_click: "$store.dsModals.close()",
-          icon_label: "CF", icon_bg: "#14B8A6",
-          title: "Coinflow · $19", subtitle: "Buy 1 entry with a card · fastest",
-          badge: "New", data: { ds_rail: "coinflow" } %>
-
-    <%= render "studio/modals/blocks/rail_row",
-          on_click: "$store.dsModals.close()",
-          icon_label: "S", icon_bg: "#635BFF",
-          title: "Card · $19", subtitle: "Buy an entry token with a card",
-          data: { ds_rail: "stripe" } %>
-  </div>
-</div>

data/app/views/style/modals/_ds_cdp_ramp.html.erb

@@ -1,41 +0,0 @@
-<%#
-  Living style guide specimen — the Coinbase ramp, BUY PREFLIGHT only.
-
-  DELIBERATELY PARTIAL, and saying so is the point. turf's modals/_cdp_ramp is a
-  TWO-FLOW step machine — buy and cash-out — across thirteen states: preflight,
-  opening, waiting, awaiting-cdp, send, settling and the rest. This cards ONE of
-  them: the buy preflight, which is the state both funding cards hand off to and
-  therefore the only one a player reaches without already being mid-flow.
-
-  The other twelve are uncarded BY DECISION (operator, 2026-08-26: minimal
-  migration is fine here). That is a different thing from an oversight, and the
-  reference blurb on this card says so, because a cabinet that shows one state of
-  a thirteen-state machine without admitting it teaches a reader that the machine
-  is simpler than it is. /tasks/port-cdp-ramp-specimen holds the full state map
-  if the decision reverses.
-
-  APP-SPECIFIC, engine chrome: blocks/_close_x plus the centred title this whole
-  funding family uses.
-
-  Single root: the outer <div> is the host's required root.
-%>
-<div class="relative">
-  <%= render "studio/modals/blocks/close_x", modal_store: "dsModals" %>
-
-  <div class="text-center pt-1 mb-3">
-    <h3 class="text-heading font-bold text-lg leading-tight">Buy USDC with Coinbase</h3>
-  </div>
-
-  <p class="text-xs text-body mb-4 text-center">
-    You&rsquo;ll finish the purchase in a Coinbase tab. We&rsquo;ll update here
-    automatically once the USDC lands in your wallet.
-  </p>
-
-  <button type="button" @click="$store.dsModals.close()"
-          class="btn btn-primary btn-lg w-full">Continue to Coinbase</button>
-
-  <button type="button" @click="$store.dsModals.close()"
-          class="block mx-auto mt-3 text-sm text-secondary hover:text-heading transition">
-    Not now
-  </button>
-</div>

data/app/views/style/modals/_wallet_changed.html.erb

@@ -1,70 +0,0 @@
-<%#
-  Living style guide specimen — the wallet switched underneath the session.
-
-  APP-SPECIFIC, engine chrome only (`blocks/_card_header`). The switch itself is
-  the host's: turf's wallet store owns continueSwitch, and the engine owns no
-  wallet.
-
-  THE SITUATION IT NAMES: the person changed accounts inside their wallet
-  extension while signed in here. Nothing is broken and nobody did anything
-  wrong — but the session and the extension now disagree about who this is, and
-  every on-chain action from here would use an identity the page is not showing.
-
-  SO IT SHOWS BOTH ADDRESSES, truncated the way every Solana UI truncates them
-  (4 leading, 4 trailing). Recognising your own address is the only way to tell a
-  deliberate switch from an accident, and it is the one check the app cannot make
-  for them.
-
-  The busy state matters: continuing re-derives a session against the new wallet,
-  which is a round trip. Without it the button looks dead and gets double-clicked.
-
-  Single root; x-data single-quoted throughout.
-%>
-<div x-data="{
-       busy: false,
-       get props() { var c = $store.dsModals.current(); return (c && c.props) || {} },
-       short(addr) {
-         addr = addr || '';
-         return addr.length > 12 ? (addr.slice(0, 6) + '...' + addr.slice(-4)) : addr;
-       },
-       go() {
-         if (this.busy) return;
-         this.busy = true;
-         var s = this;
-         // Demo: the real card awaits the host's wallet store. Hold briefly so
-         // the pending state is visible rather than skipped.
-         setTimeout(function () { s.busy = false; $store.dsModals.close(); }, 600);
-       }
-     }">
-  <%= render "studio/modals/blocks/card_header",
-        icon_emoji: "🔀",
-        title: "Wallet changed" do %>
-    <p class="text-sm text-body">
-      Your wallet is now on a different account than the one you signed in with.
-      Continue with the new one, or switch back in your wallet.
-    </p>
-  <% end %>
-
-  <div class="rounded-lg border border-subtle bg-surface-alt p-3 mb-4 text-sm">
-    <div class="flex items-center justify-between gap-3">
-      <span class="text-secondary">Signed in as</span>
-      <span class="font-mono text-heading" x-text="short(props.currentAddress) || '7xKp...JZ2Q'"></span>
-    </div>
-    <div class="flex items-center justify-between gap-3 mt-2">
-      <span class="text-secondary">Wallet now</span>
-      <span class="font-mono text-heading" x-text="short(props.newAddress) || '9mQt...Ld4V'"></span>
-    </div>
-  </div>
-
-  <button type="button" @click="go()" :disabled="busy"
-          class="btn btn-primary btn-lg w-full disabled:opacity-60">
-    <span x-show="!busy">Continue with this wallet</span>
-    <span x-show="busy" class="inline-flex items-center justify-center gap-2" style="display: none;">
-      <span class="spinner" aria-hidden="true"></span>
-      Switching&hellip;
-    </span>
-  </button>
-
-  <button type="button" @click="$store.dsModals.close()"
-          class="block mx-auto mt-3 text-sm text-secondary hover:text-heading transition">Not now</button>
-</div>

data/app/views/style/modals/_wallet_setup.html.erb

@@ -1,112 +0,0 @@
-<%#
-  Living style guide specimen — the onboarding chain's LAST step, "Set up your
-  wallet" (chain step 3 of 3).
-
-  This documents an APP-SPECIFIC flow. The engine deliberately does NOT own it:
-  turf-monster's app/views/modals/_wallet_setup.html.erb is ~576 lines of
-  extension-presence polling, a hosted 90-second walkthrough video, a Detailed
-  Guide route that resolves at render time, and a managed-wallet fallback for
-  grandfathered web2 accounts. None of that is shareable — it is one app's
-  answer to "how do we get this person a wallet".
-
-  What IS shared, and all this specimen composes, is the CHROME:
-    studio/modals/blocks/shell               — title row + close
-    studio/modals/blocks/progress_pill       — the 3-of-3 chain position
-    studio/modals/blocks/wallet_brand_sprite — inline brand marks, no per-app PNG
-  plus the house wallet-row idiom (brand tile, the wallet's own name, status on
-  the right, chevron) and pulse-cta, so a wallet reads identically here, in the
-  connect picker, and on the web3 step-up card.
-
-  ONE card, ONE id, a `detected` TOGGLE for the two ends of the real progression
-  (install -> waiting -> Installed -> connect). Deliberately not two specimens
-  sharing a modal id: that shape is what left the two web3-step-up cards unable
-  to tell each other apart in the glow, fixed in the same pass that added this.
-
-  WHO SEES IT — the half worth remembering. This card and the web3 step-up card
-  are OPPOSITE populations and no user can ever meet both. WalletSetupPolicy
-  exits at its own step 1 for an account that already holds a wallet; the step-up
-  card is only ever shown to accounts that DO hold one. "Get a wallet" vs "prove
-  the wallet you have".
-
-  Self-contained: no install detection, no video embed, no real routes. The
-  walkthrough is represented as a still placeholder rather than an <iframe>,
-  because the video is the app's asset and an embed here would reach off-host.
-
-  Single root: the outer <div> is the host's required root.
-%>
-<div x-data="{
-       get props() { var c = Alpine.store('dsModals').current(); return (c && c.props) || {}; },
-       get detected() { return !!this.props.detected; }
-     }"
-     class="relative">
-  <%= render "studio/modals/blocks/wallet_brand_sprite" %>
-
-  <%= render layout: "studio/modals/blocks/shell",
-        locals: { title: "Set up your wallet", modal_store: "dsModals" } do %>
-
-    <%# Chain position — the HOST's, not this page's. It is the only one of the
-        three onboarding steps that fills the pill, which is why the pill is here
-        even though the card sits in the Web3 section beside the wallet cards. %>
-    <div class="mb-3">
-      <%= render "studio/modals/blocks/progress_pill", current: 3, total: 3 %>
-    </div>
-
-    <p class="text-sm text-body text-center mb-4">
-      This app runs on the Solana public blockchain; you will need a wallet to
-      enter contests and collect winnings.
-    </p>
-
-    <%# THE wallet row — the house idiom, glowing because it is the one thing to
-        press. Same shape the connect picker and the step-up card use. The right
-        side is the only part that moves: INSTALL before the extension exists,
-        an Installed badge once it answers. %>
-    <button type="button" @click="$store.dsModals.close()"
-            style="--pulse-cta-color: var(--color-primary); --pulse-cta-strength: 0.4; --pulse-cta-scale: 1.02"
-            class="pulse-cta w-full flex items-center gap-3 p-3 rounded-xl bg-surface-alt border border-strong hover:bg-surface transition text-left">
-      <span class="w-9 h-9 rounded-lg overflow-hidden flex items-center justify-center shrink-0">
-        <svg class="w-9 h-9" aria-hidden="true"><use href="#se-wallet-phantom"></use></svg>
-      </span>
-      <span class="font-semibold text-heading">Phantom</span>
-      <span class="ml-auto flex items-center gap-2">
-        <span x-show="!detected" class="text-xs text-muted uppercase tracking-wide">Install</span>
-        <span x-show="detected" class="badge border-primary text-primary">Installed</span>
-        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="currentColor" class="w-4 h-4 text-muted">
-          <path stroke-linecap="round" stroke-linejoin="round" d="m8.25 4.5 7.5 7.5-7.5 7.5" />
-        </svg>
-      </span>
-    </button>
-
-    <%# The teaching half. A brand-new player does not know what a wallet IS, so
-        the card carries its own explainer rather than sending them away to find
-        one. Represented, not embedded — see the header. %>
-    <div class="mt-4 pt-4 border-t border-strong">
-      <h4 class="text-heading font-bold text-sm mb-1">New to Solana &#129300;</h4>
-      <p class="text-sm text-body mb-3">Set up your wallet in <strong>90 seconds</strong>.</p>
-
-      <div class="rounded-lg border border-subtle bg-inset aspect-video flex flex-col items-center justify-center gap-1">
-        <span class="text-2xl leading-none" aria-hidden="true">&#9654;&#65039;</span>
-        <span class="text-2xs text-muted">walkthrough &mdash; the app supplies the video</span>
-      </div>
-
-      <button type="button" @click="$store.dsModals.close()"
-              class="btn btn-primary btn-lg w-full mt-3 flex items-center justify-center gap-2">
-        Detailed Guide
-        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="currentColor" class="w-4 h-4">
-          <path stroke-linecap="round" stroke-linejoin="round" d="m8.25 4.5 7.5 7.5-7.5 7.5" />
-        </svg>
-      </button>
-    </div>
-
-    <%# Dismissible by design, and the fine print says what dismissing costs. The
-        chain is skippable; the entry gate is not, and the card is honest that
-        the two are different things. %>
-    <button type="button" @click="$store.dsModals.close()"
-            class="block mx-auto mt-4 text-sm text-secondary hover:text-heading transition">
-      Maybe later
-    </button>
-    <p class="mt-2 text-center text-2xs text-muted">
-      Rather pay by card? Link a wallet first &mdash; an entry token needs
-      somewhere to land.
-    </p>
-  <% end %>
-</div>