studio-engine 0.74.11 → 0.75.0

data/lib/studio.rb

@@ -10,6 +10,7 @@ require "studio/theme_resolver"
 require "studio/ui_primitives"
 require "studio/js_literal"
 require "studio/js_identifier"
+require "studio/partial_block"
 require "studio/sidebar_sections"
 require "studio/profile_sections"
 require "studio/profile_image"
@@ -21,6 +22,8 @@ require "studio/s3"
 require "studio/image_cache"
 require "studio/link_token"
 require "studio/link_resolution"
+require "studio/session_fingerprint"
+require "studio/session_state"
 require "studio/email"
 require "studio/email_smoke"
 require "studio/mail_transport"
@@ -269,6 +272,33 @@ module Studio
   # its own routes (it can still reuse Studio::Link + Studio::LinkConsumption).
   mattr_accessor :draw_link_routes, default: true
 
+  # Draw the session-drift rehydrate endpoint, GET /session/state
+  # (Studio::SessionStatesController, helper studio_session_state_path). See
+  # docs/SESSION_DRIFT.md.
+  #
+  # OFF by default, and not because of a name collision (no consumer owns the
+  # path or the helper, checked 2026-09-16). The endpoint is a JSON GET that
+  # inherits the HOST's ApplicationController filters, and the browser store calls
+  # it whenever a tab returns from the background or learns another tab changed
+  # the session. A host must look at its own filters before that traffic starts:
+  # one that redirects every request to an onboarding page would answer the store
+  # with HTML. turf-monster already runs its own copy of this loop
+  # (/account/session_state), so drawing it there by default would double the
+  # requests. Each app's adoption turns it on:
+  #
+  #   config.draw_session_routes = true
+  #
+  # With it off, every page still carries the stamp and the store still detects
+  # drift (another tab, expiry). It cannot repair a page in place, so it stays
+  # `stale` and the host decides what to do.
+  mattr_accessor :draw_session_routes, default: false
+
+  # The key Studio::SessionFingerprint signs with. nil (the default) derives one
+  # from the app's secret_key_base via Rails.application.key_generator, which
+  # every process of the app agrees on. Set it only to share fingerprints across
+  # two apps on one origin or to pin a value in a test.
+  mattr_accessor :session_fingerprint_secret, default: nil
+
   # Draw the shared transactional-email page at /admin/emails
   # (Studio::EmailsController). OFF by default because the path AND its helper
   # names (admin_emails_path / admin_email_path) are already taken in
@@ -886,6 +916,14 @@ module Studio
              constraints: { token: %r{[^/]+} }
       end
 
+      # The session-drift rehydrate endpoint (Studio::SessionStatesController).
+      # OPT-IN — see Studio.draw_session_routes. JSON only: the browser store is
+      # its one caller, and an HTML answer would only ever be a mistake.
+      if Studio.draw_session_routes
+        get "session/state", to: "studio/session_states#show", as: :studio_session_state,
+            defaults: { format: :json }
+      end
+
       # Knowledge layer — /admin/knowledge (Studio::KnowledgeDoc): folder/flat
       # document browser, upload-to-inbox intake, per-agent access map, and
       # 15-minute presigned downloads. Opt-in (default off) like every route

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.74.11
+  version: 0.75.0
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-14 00:00:00.000000000 Z
+date: 2026-09-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -303,6 +303,7 @@ files:
 - app/assets/images/state-flags/wy.svg
 - app/assets/javascripts/studio/alpine.js
 - app/assets/javascripts/studio/canvas_confetti.js
+- app/assets/javascripts/studio/session.js
 - app/assets/javascripts/studio/sortable.js
 - app/assets/javascripts/studio/sticky_table_header.js
 - app/assets/javascripts/studio/studio_confetti.js
@@ -317,6 +318,7 @@ files:
 - app/controllers/concerns/studio/impersonation.rb
 - app/controllers/concerns/studio/link_consumption.rb
 - app/controllers/concerns/studio/magic_link_issuing.rb
+- app/controllers/concerns/studio/session_drift.rb
 - app/controllers/error_logs_controller.rb
 - app/controllers/magic_links_controller.rb
 - app/controllers/navbar_controller.rb
@@ -335,6 +337,7 @@ files:
 - app/controllers/studio/models_controller.rb
 - app/controllers/studio/onboarding_controller.rb
 - app/controllers/studio/profiles_controller.rb
+- app/controllers/studio/session_states_controller.rb
 - app/controllers/style_controller.rb
 - app/controllers/theme_settings_controller.rb
 - app/helpers/studio/admin_models_table_helper.rb
@@ -413,6 +416,7 @@ files:
 - app/views/studio/_fizz_layer.html.erb
 - app/views/studio/_hold_button.html.erb
 - app/views/studio/_leveling_activity_assets.html.erb
+- app/views/studio/_session_stamp.html.erb
 - app/views/studio/admin_models/_arenas_table.html.erb
 - app/views/studio/admin_models/_teams_table.html.erb
 - app/views/studio/admin_models/index.html.erb
@@ -570,10 +574,13 @@ files:
 - lib/studio/name_parts.rb
 - lib/studio/newsletter.rb
 - lib/studio/oauth_identity.rb
+- lib/studio/partial_block.rb
 - lib/studio/profile_image.rb
 - lib/studio/profile_sections.rb
 - lib/studio/redis.rb
 - lib/studio/s3.rb
+- lib/studio/session_fingerprint.rb
+- lib/studio/session_state.rb
 - lib/studio/sidebar_sections.rb
 - lib/studio/theme_resolver.rb
 - lib/studio/ui_primitives.rb