studio-engine 0.76.3 → 0.77.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2c352381b0778909cd1798ba2d81abf435f1c2e668198ac38fdae33310d65d8c
-  data.tar.gz: 6a80ed76a9748b246df94016572aa1b1b470360c8938390acaef92342a4d1350
+  metadata.gz: e8cc0d34a62b18829e9caa043f820a5dc6100fa9de2d990f32dd4f3439c5bd40
+  data.tar.gz: b5a7794c1c53bea3354f4b48e46887c9315df5fbff6d671436328fac9f95c2d3
 SHA512:
-  metadata.gz: b57498e85f26bfe1ba051381c0411f0f5161513726ed9fbd6aa4769e0bd3767ec962d0f007ac09ad2326e9a97fb05d73e17e122ef5b779f6cc8e48dd923c3c24
-  data.tar.gz: 0a17dcfaa72bd771c57cacb04ee9f2f3b82baf5839bc9b739216bc1d6fc1e96b456bc68b645b0865bca9569d64b1abd5327a4e779ff74c6af4cf740776f8f14e
+  metadata.gz: 65d91ace8c12010d262fb841a19c384ef85aa8418d6ec270cf30d2b68e28f73f1da5cdbfe9057cdefad831e44c519ea088468f36ce3a9467866102da47d08491
+  data.tar.gz: e56bd88f0517331aeb58ddac29ab027053a74189a97c78c3a55b9b8cd4f8827fa3492676b4604c0e779f96d7136073b11e8e4e624ed7e064654c037c676457c0

data/CHANGELOG.md

@@ -4,6 +4,40 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+## 0.77.1 — 2026-09-27
+
+### Fixed
+
+- **The engine header fits a phone.** `.user-nav-col` / `.user-nav-fit` capped their
+  two phone bands at a constant `14rem`/`15rem` — 224px is 57% of a 390px screen — on
+  a `flex-shrink-0` column, leaving the left column 166px for a 48px logo, its gap,
+  32px of padding and the app's name. Every flex item defaults to `min-width: auto`,
+  so the name could not truncate either: it drew across the gap and on top of the user
+  column beside it. The bands are now `min(14rem, 46vw)` and `min(15rem, 46vw)`, with
+  `min-w-0` on each flex item between the nav row and the title and `truncate` on the
+  two title spans. `min()` resolves to the plain rem at ~487px and ~522px, so the
+  768px band and every desktop width are unchanged; below ~344px the app name
+  truncates rather than spilling.
+  - **Consumers that render `layouts/_navbar` unforked inherit this on upgrade** —
+    `mcritchie-industries` and `acquisition-studio`. `mcritchie-studio` inlines its own
+    `<header>` and `turf-monster` forks the partial and declares its own
+    `.user-nav-col` widths, so each adopts the change separately.
+
+## 0.77.0 — 2026-09-26
+
+### Added
+
+- **`Studio::S3` runs on Cloudflare R2, or any S3-compatible endpoint.** Four new
+  settings, all nil by default: `s3_endpoint`, `s3_access_key_id` +
+  `s3_secret_access_key` (passed to the client as a pair, so an app can hold its
+  R2 keys beside the `AWS_*` ones during a cutover; half a pair raises), and
+  `s3_public_url`, the base public objects are served from. Unset, every app gets
+  the same client and the same amazonaws.com URLs as before. On an endpoint with
+  no public base, `url` raises `NotConfigured` instead of building a URL R2 would
+  refuse, and `upload` still writes but returns `nil`. Proven live against an R2
+  bucket: upload, download, exists, list, signed URL (200) and delete, with the
+  anonymous endpoint read refused.
+
 ## 0.76.3 — 2026-09-23
 
 ### Fixed

data/README.md

@@ -838,6 +838,24 @@ config.s3_key_prefix    = "mcritchie-industries/"
 logical keys and never see it. Unset (the default) leaves keys byte-identical to
 what every already-shipped app wrote.
 
+### S3-compatible storage (Cloudflare R2)
+
+`Studio::S3` talks to any S3-compatible endpoint. The McRitchie fleet is moving
+to R2 (one account, McRitchie Studio's); an app switches in its initializer:
+
+```ruby
+config.s3_endpoint          = ENV["R2_ENDPOINT"]   # https://<account>.r2.cloudflarestorage.com
+config.s3_region            = "auto"
+config.s3_access_key_id     = ENV["R2_ACCESS_KEY_ID"]
+config.s3_secret_access_key = ENV["R2_SECRET_ACCESS_KEY"]
+config.s3_public_url        = ENV["R2_PUBLIC_URL"] # custom domain on this env's bucket
+```
+
+All four are nil by default, and nil is AWS exactly as before. The keys must be
+set as a pair. R2 serves nothing anonymously from its S3 endpoint, so with an
+endpoint and no `s3_public_url`, `Studio::S3.url` raises `NotConfigured` and
+`upload` writes but returns `nil`; serve private objects with `signed_url`.
+
 An app with **no** bucket configured does not error — `/admin/emails` renders
 read-only, showing the inherited defaults it is genuinely sending and naming the
 one setting that turns uploads on.

data/app/views/layouts/_navbar.html.erb

@@ -62,13 +62,44 @@
         class="nav-shell <%= is_preview ? 'bg-page' : "#{'vt-pinned-header ' if pin_header}sticky top-0 z-50 bg-page transition-shadow duration-300" %>"
         :class="scrolled && 'shadow-lg border-b border-subtle is-scrolled'">
   <style>
-    .user-nav-col { width: 14rem; }
+    /* THE PHONE STEP IS A SHARE OF THE VIEWPORT, NOT A CONSTANT, and that is the
+       whole width fix. 14rem is 224px — 57% of a 390px screen — handed to a
+       flex-shrink-0 column, so the left column was left 166px for a 48px logo,
+       a 4px gap, 32px of padding and whatever the app is called. MEASURED on
+       /lab/bar_stack?signed_in=1 at 390x844, app_name "McRitchie Industries":
+       the title's own box ran to x=175.3 inside a column whose border box ends
+       at x=166, and "Industries" painted ON TOP of the wallet address in the
+       column beside it. documentElement.scrollWidth was 390 against a
+       clientWidth of 390 the entire time — the page did not scroll sideways,
+       so every document-level check of this header was green while the header
+       was visibly broken.
+
+       min() rather than a new breakpoint: the cap still resolves to 14rem on
+       anything at or above ~487px, so this band's desktop-side behaviour is
+       byte-identical and only the phone widths move. 46vw is not a taste
+       value — it is the largest share that still leaves the left column the
+       191px a 48px logo, its gap, its padding and a ten-character word need at
+       360px, the narrowest mainstream Android. Below that the title truncates
+       (see min-w-0 + truncate on the markup) instead of spilling.
+
+       BOTH LINES, and that is not redundancy. .user-nav-col is a hard width
+       (a host passing balance_html reserves the seat) and .user-nav-fit is a
+       cap (no balance, so the column hugs its content). They are two different
+       properties and a fix to one leaves the other exactly as broken. */
+    .user-nav-col { width: min(14rem, 46vw); }
     /* No balance content → no reserved column. The nav hugs its icons and
        name instead of floating in the balance's empty seat. max-width steps
        mirror the col's clamps: the item is flex-shrink-0, so without them a
        long nowrap username sizes the column past a narrow viewport. */
-    .user-nav-fit { max-width: 14rem; }
-    @media (min-width: 400px) { .user-nav-col { width: 15rem; } .user-nav-fit { max-width: 15rem; } }
+    .user-nav-fit { max-width: min(14rem, 46vw); }
+    /* THE SAME SHARE IN THE NEXT BAND UP, and leaving it out was measurably
+       worse than not fixing the first one. With only the base band capped, a
+       412px screen (Pixel-class, and the 400px band's own territory) gave the
+       title 84px while a 390px screen gave it 107 — a WIDER phone showing LESS
+       of the app's name. Monotone or it is not fixed. min(15rem, 46vw) resolves
+       to the plain 15rem at ~522px and up, so everything above this band's
+       phone edge is unchanged. */
+    @media (min-width: 400px) { .user-nav-col { width: min(15rem, 46vw); } .user-nav-fit { max-width: min(15rem, 46vw); } }
     @media (min-width: 768px) { .user-nav-col { width: 20rem; } .user-nav-fit { max-width: 20rem; } }
     /* The COLLAPSE band table used to live here, which meant only an app
        rendering THIS partial got it. Three of five apps fork the navbar, so each
@@ -88,16 +119,27 @@
   </style>
   <div class="nav-row flex items-center">
     <%# Left side: logo + nav %>
-    <div class="flex-1 px-4">
-      <div class="flex items-center gap-6">
-        <%= link_to root_path, class: "nav-logo-link inline-flex items-center gap-3 group" do %>
+    <%# min-w-0 THREE TIMES, on every flex item between the row and the title.
+        A flex item's default min-width is auto, which floors it at its own
+        min-content — so ONE of these left out puts the floor back and the
+        title spills across the gap again. The chain is: row item (.flex-1) ->
+        its inner flex -> the logo link. The <h1> is the fourth link and carries
+        its own min-w-0 below. %>
+    <div class="flex-1 min-w-0 px-4">
+      <div class="flex items-center gap-6 min-w-0">
+        <%= link_to root_path, class: "nav-logo-link inline-flex items-center gap-3 group min-w-0" do %>
           <% if logo_path %>
             <%# No w-*/h-* utility here: .nav-shell .nav-logo sizes it off --nav-p.
                 transition-transform, NOT transition-all — the hover lift still
                 eases, while width/height follow the finger with no clock. %>
             <img src="<%= logo_path %>" alt="<%= Studio.app_name %>" class="nav-logo rounded-full shadow-lg <%= "group-hover:scale-105 transition-transform duration-300" unless is_preview %>">
           <% end %>
-          <h1 class="nav-title font-extrabold text-heading tracking-tight"><span><%= prefix %></span><span class="text-primary"><%= last_word %></span></h1>
+          <%# truncate on the SPANS, not the h1. .nav-title is itself a flex
+              container (a column below 768px, a baseline row above), so the
+              overflow that has to be clipped belongs to each word's own box —
+              `truncate` on the h1 would clip the flex CONTAINER and leave the
+              spans drawing outside it, which is the bug rather than the fix. %>
+          <h1 class="nav-title font-extrabold text-heading tracking-tight min-w-0"><span class="truncate"><%= prefix %></span><span class="text-primary truncate"><%= last_word %></span></h1>
         <% end %>
         <%# Desktop nav — apps should override this partial to add links here %>
         <nav class="hidden md:flex items-center gap-4">

data/app/views/navbar/show.html.erb

@@ -41,21 +41,38 @@
     --nav-title-lead-size: calc(1.5rem - 0.35rem * var(--nav-p));
   }
 
+  /* THE USER-COLUMN WIDTH STEPS, re-keyed on the wrapper for the same reason
+     the --nav-p sizes above are: the shipped rules live in media queries, which
+     cannot fire for a CONTAINER at a fixed viewport width.
+
+     PERCENT HERE, vw THERE, AND THEY ARE THE SAME NUMBER. layouts/_navbar caps
+     the two phone bands at min(<rem>, 46vw). A literal 46vw inside a 390px
+     preview box on a 1400px monitor resolves to 644px, which would make the
+     preview show a header no phone has — so the share is expressed against the
+     CONTAINING BLOCK instead, which in this preview is the navbar row, i.e. the
+     simulated device width. Retune the cap in _navbar and retune these, or the
+     preview starts lying about the one dimension it exists to show.
+
+     REMOVED, 2026-09-27: three `.username-cap` rules, at 5/6/7rem. No element
+     in this engine or in any consuming app has ever carried that class —
+     components/_user_nav truncates the name with `truncate` and a min-w-0
+     parent instead. They were dead the day they were written and they read, to
+     the next person sizing this header, like a cap that was already in force.
+     (turf-monster's app/views/admin/navbar.html.erb carries the same three dead
+     rules; that is its own repo's to drop.) */
+
   /* Tiny (< 400px) */
   .navbar-preview.bp-tiny .nav-logo-link { gap: 0.25rem !important; }
-  .navbar-preview.bp-tiny .user-nav-col { width: 14rem !important; }
-  .navbar-preview.bp-tiny .user-nav-fit { max-width: 14rem !important; }
-  .navbar-preview.bp-tiny .username-cap { max-width: 5rem !important; }
+  .navbar-preview.bp-tiny .user-nav-col { width: min(14rem, 46%) !important; }
+  .navbar-preview.bp-tiny .user-nav-fit { max-width: min(14rem, 46%) !important; }
 
   /* Small (400-767px) */
-  .navbar-preview.bp-small .user-nav-col { width: 15rem !important; }
-  .navbar-preview.bp-small .user-nav-fit { max-width: 15rem !important; }
-  .navbar-preview.bp-small .username-cap { max-width: 6rem !important; }
+  .navbar-preview.bp-small .user-nav-col { width: min(15rem, 46%) !important; }
+  .navbar-preview.bp-small .user-nav-fit { max-width: min(15rem, 46%) !important; }
 
-  /* Desktop (768px+) */
+  /* Desktop (768px+) — a bare rem, exactly as the shipped band declares it. */
   .navbar-preview.is-desktop .user-nav-col { width: 20rem !important; }
   .navbar-preview.is-desktop .user-nav-fit { max-width: 20rem !important; }
-  .navbar-preview.is-desktop .username-cap { max-width: 7rem !important; }
 
   /* Scrolled state. The size half of this used to be TWELVE !important rules
      restating every collapsed value; the toggle now just sets --nav-p: 1 on

data/lib/studio/s3.rb

@@ -15,17 +15,34 @@ module Studio
         opts[:content_type] = content_type if content_type
         opts[:cache_control] = cache_control if cache_control
         client.put_object(**opts)
-        url(key: key)
+        public_url? ? url(key: key) : nil
       end
 
       def download(key:)
         client.get_object(bucket: bucket, key: full_key(key)).body.read
       end
 
+      # The PUBLIC URL of an object. On AWS (no endpoint) it is the bucket's
+      # virtual-hosted amazonaws.com URL, byte-identical to every version before
+      # endpoints existed. On an S3-compatible endpoint it is Studio.s3_public_url
+      # plus the key, and without that base it RAISES: R2's S3 endpoint answers no
+      # anonymous request, so any URL built from it would be a broken image in an
+      # inbox, not an error anyone sees. Private objects want signed_url.
       def url(key:)
+        base = Studio.s3_public_url.to_s
+        return "#{base.chomp("/")}/#{full_key(key)}" unless base.empty?
+        raise NotConfigured, "Studio.s3_public_url not set: #{endpoint} serves no public URL (use signed_url for private objects)" if endpoint
+
         "https://#{bucket}.s3.#{region}.amazonaws.com/#{full_key(key)}"
       end
 
+      # Whether url can answer. upload asks this so an app with only private
+      # objects (a data room on R2 with no public domain) can still write:
+      # upload returns nil there instead of raising AFTER the object landed.
+      def public_url?
+        endpoint.nil? || !Studio.s3_public_url.to_s.empty?
+      end
+
       def signed_url(key:, expires_in: 3600)
         require "aws-sdk-s3"
         Aws::S3::Presigner.new(client: client).presigned_url(:get_object, bucket: bucket, key: full_key(key), expires_in: expires_in)
@@ -93,11 +110,39 @@ module Studio
         Studio.s3_region
       end
 
+      # The S3-compatible endpoint (R2: https://<account>.r2.cloudflarestorage.com),
+      # or nil for AWS. Blank reads as unset, so an empty ENV var cannot point the
+      # client at "".
+      def endpoint
+        value = Studio.s3_endpoint.to_s
+        value.empty? ? nil : value
+      end
+
       def client
         @client ||= begin
           require "aws-sdk-s3"
-          Aws::S3::Client.new(region: region)
+          Aws::S3::Client.new(**client_options)
+        end
+      end
+
+      # Only what is configured is passed, so an unconfigured app builds exactly
+      # the client it always did: region alone, the SDK's default credential chain.
+      # Keys are passed as a PAIR or not at all; half a pair is a configuration
+      # error, and falling back to the default chain would silently write with
+      # whatever AWS_* key the dyno happens to hold.
+      def client_options
+        opts = { region: region }
+        opts[:endpoint] = endpoint if endpoint
+        id = Studio.s3_access_key_id.to_s
+        secret = Studio.s3_secret_access_key.to_s
+        if id.empty? != secret.empty?
+          raise NotConfigured, "Studio.s3_access_key_id and s3_secret_access_key must be set together"
+        end
+        unless id.empty?
+          opts[:access_key_id] = id
+          opts[:secret_access_key] = secret
         end
+        opts
       end
 
       def reset!

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.76.3"
+  VERSION = "0.77.1"
 end

data/lib/studio.rb

@@ -616,6 +616,30 @@ module Studio
   # A trailing slash is added if you leave it off.
   mattr_accessor :s3_key_prefix, default: nil
 
+  # S3-COMPATIBLE STORAGE (Cloudflare R2). All four default nil, and nil means
+  # AWS exactly as before: the SDK's own endpoint, its default credential chain
+  # (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY), and the virtual-hosted
+  # amazonaws.com URL. An app moves to R2 by setting them, typically from ENV:
+  #
+  #   config.s3_endpoint          = ENV["R2_ENDPOINT"]   # https://<account>.r2.cloudflarestorage.com
+  #   config.s3_region            = "auto"               # R2's only region
+  #   config.s3_access_key_id     = ENV["R2_ACCESS_KEY_ID"]
+  #   config.s3_secret_access_key = ENV["R2_SECRET_ACCESS_KEY"]
+  #   config.s3_public_url        = ENV["R2_PUBLIC_URL"] # https://assets.example.com
+  #
+  # Explicit keys exist so an app can hold its R2 pair BESIDE its AWS pair
+  # during a cutover (Active Storage may still mirror to S3) without the two
+  # fighting over the same AWS_* variables.
+  #
+  # s3_public_url is the base public objects are served from — a custom domain
+  # or r2.dev URL attached to THIS environment's bucket. R2's S3 endpoint
+  # serves nothing anonymously, so with an endpoint and no public base there is
+  # no public URL to give, and Studio::S3.url says so rather than inventing one.
+  mattr_accessor :s3_endpoint,          default: nil
+  mattr_accessor :s3_access_key_id,     default: nil
+  mattr_accessor :s3_secret_access_key, default: nil
+  mattr_accessor :s3_public_url,        default: nil
+
   # Knowledge layer — the S3-backed document store + /admin/knowledge browser
   # (Studio::KnowledgeDoc). Routes are opt-in like every route surface.
   # knowledge_agents is the roster of agent slugs the intake UI offers

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.76.3
+  version: 0.77.1
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-23 00:00:00.000000000 Z
+date: 2026-09-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails