studio-engine 0.83.0 → 0.85.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 51cd7605f076d91cafbf154a51531843b2e1c621e7a9246070fc947b365714a7
-  data.tar.gz: 8edb99d5c852b69d73068d9c034d296a9a117416b6a584a0333df141475b4bc8
+  metadata.gz: 940823449254339d163e66fe93eabdab83cc36e25f4b80600ab02c6552e3d624
+  data.tar.gz: 1ce338c5ba90749bbd3a5217c5dba0bd3813b5be96996c15c734cdacdb1b0f0d
 SHA512:
-  metadata.gz: 5b9ef1be9cc7ec70f7afa978140a5fad06d4b828a561ba774ebd4ad83890584eaa3bb6678067280a9e22526291393a11e2fb30615687d995f2005c6876a02bd9
-  data.tar.gz: 3f7ef9e1b17181cc63de69106270690245e3762826abdca4af9efaa42483b95d89f61e9519465449fbff7082c35b31b7cc10751d0ef01a73706da289fd33eaf0
+  metadata.gz: c322848f2708206583cff895faf563e34b85853494172dfd6f859568a771555a5f5b7859c0ac517a361679a282dbe5af1e5aa91b4bdce9a5e5df57c38a4cbf59
+  data.tar.gz: 70c41c33f57623eee5a8fe63aab6ff5c804a3570f055cca12bde70c8ae0919b20c3026de2100518e01ccab75c79f77afcc21674dede4c76ea7d6b1be4b6d5e0f

data/CHANGELOG.md

@@ -4,6 +4,132 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+## 0.85.0 — 2026-10-02
+
+### Changed
+
+- **`Studio::S3.delete` now moves the object to `trash/` instead of deleting
+  it.** The object is copied to `trash/<UTC date>/<epoch ms>/<key>` in the same
+  bucket, then deleted; a failed copy raises and never deletes. It returns the
+  trash key (nil when nothing was there) rather than the S3 response. The
+  bucket's lifecycle rule must expire `trash/` after three days, or trash never
+  expires: set it up before upgrading (README, *Trash and restore*). The
+  `/admin/emails` banner and logo replace and revert paths go through this
+  delete.
+- **`Studio::S3.list` leaves `trash/` keys out.** Pass `include_trash: true` to
+  keep them. The filter runs after `max_keys`, so a page can come back short.
+- **The engine's auth pages speak `Studio.sign_in_label`.** 0.80.0 put the label
+  on the navbar's signed-out buttons only, so an app that set `"Sign in"` still
+  showed "Log in to continue", a "Log In" button and a "Log in" link on its
+  `/login` and `/signup` pages. Those words, the magic-link button, the SSO
+  divider, the magic-link confirm page's button and the link-sent notice now
+  derive from the label (`lib/studio/auth_labels.rb`; README, *Navbar
+  identity*). An app that leaves the label at its default renders those pages
+  byte-identical to before. No routes change.
+
+### Added
+
+- **`Studio::S3.purge!(key:)`**, the hard delete, for objects with no value
+  after deletion.
+- **A production-bucket guard.** `Studio::S3.delete`, `purge!`, and the trash
+  service's `delete` and `delete_prefixed` raise
+  `Studio::S3::Trash::ProductionBucketRefused` before any request when the
+  bucket ends in `-production` and the process is not production (`QA_ENV`
+  first, then `Rails.env`).
+- **`ActiveStorage::Service::StudioTrashS3Service`** (`service: StudioTrashS3`
+  in `config/storage.yml`): Active Storage's S3 service whose `delete` trashes
+  the blob's object, recording the content type, byte size, checksum and
+  filename it can read off the object so a blob row can be rebuilt.
+  `delete_prefixed` (variants) stays a hard delete. Opt-in per app.
+- **`rake studio:trash:list[KEY]` and `studio:trash:restore[TRASH_KEY]`**: find
+  a key's trash copies, and copy one back to its original key (`FORCE=1` to
+  overwrite, `SERVICE=<name>` for an Active Storage bucket). A restore prints the
+  `ActiveStorage::Blob.create!` that re-creates the blob row.
+- **`Studio::S3::Trash`**, the shared copy-then-delete, key mapping, listing and
+  restore. A single CopyObject moves at most 5 GiB, so a larger object raises
+  `TooLarge` and is left in place.
+
+## 0.84.0 — 2026-10-01
+
+### Changed
+
+- **BREAKING for a 0.83.0 consumer that shows the booking frame: the frame is no
+  longer cropped by default.** 0.83.0 cropped every `studio_booking_frame` to a
+  414px window, 205px down a 732px frame. Those three numbers were measured from
+  one Google schedule, and on a schedule with a different header they sliced the
+  heading and exposed blank space. A crop that fits one schedule must not be a
+  default, so the frame now shows Google's whole page at rest until the app
+  declares its own crop. To keep exactly what 0.83.0 drew, add:
+
+  ```ruby
+  config.booking_crop = { top: 211, bottom: 613, frame_height: 732 }
+  ```
+
+  Better, measure the app's own schedule (below): 613 was that schedule's box
+  with five slots showing, and its fullest day has eight, so the 0.83.0 window
+  cut off the last three. `crop: false` still shows the whole frame; `crop:
+  true`, the default, now means "the app's crop". See *Upgrading from 0.83.0* in
+  [`docs/BOOKING.md`](docs/BOOKING.md).
+
+### Added
+
+- **`config.booking_crop`: the booking frame's crop, per site.** A Hash of
+  `top:`, `bottom:` and `frame_height:`, in pixels of Google's own page: the
+  "Select an appointment time" box's top, its bottom on its fullest day, and the
+  page's height that day. The window is that box plus 6px on each edge. Because
+  `bottom` is the tallest the box gets, a day with fewer slots shows a strip of
+  Google's credit lines under a shorter box and never a cut one.
+  `studio_booking_frame crop:` takes `false`, `true` (the app's crop) or a Hash
+  for one frame. The numbers ride on each wrapper as custom properties, so two
+  frames with different crops share a page. The engine's `/schedule` honours the
+  app's crop; the popup is never cropped. A crop that cannot be one (not numbers,
+  negative, bottom not below top or outside the frame, a window as tall as the
+  frame) shows the frame whole and is logged once.
+- **`bin/booking-crop-measure <booking url>`** prints that Hash. It opens Google's
+  embedded page at two widths, selects every bookable day of the next three
+  months, and reports the month-grid rows and the slot rows of the fullest day it
+  measured against. It reaches the live Google page, so it refuses to run in CI.
+- **`config.booking_path`: an app's own booking page.** A path, or a callable
+  receiving the view. An app that renders `studio_booking_frame` in its own view,
+  rather than drawing the engine's `/schedule`, names that page here and gets
+  what the engine's page had: a footer link to it opens the popup, it is
+  `studio_booking_link`'s fallback href, and a signed-in viewer keeps the footer
+  on it. With neither set, nothing changes. It must be a local path (one leading
+  `/`): a scheme or a protocol-relative `//host` is refused, from a String at
+  assignment and from a callable on each request.
+- [`docs/BOOKING.md`](docs/BOOKING.md): booking as a primitive of its own,
+  adoptable without the footer. Setting the schedule up in Google, sharing other
+  calendars in for conflict checking, the booking URL, measuring the crop, CSP,
+  and the limits. [`docs/SITE_FOOTER.md`](docs/SITE_FOOTER.md) keeps the footer.
+- `/admin/style` shows the frame's two states, whole and cropped, as drawings.
+
+### Fixed
+
+- **A footer link column no longer breaks an email address or a URL mid-word.**
+  The link columns were equal `minmax(0, 1fr)` tracks with `overflow-wrap:
+  anywhere`, so an address in a column broke in two at every width. The rows are
+  unchanged (two link columns to a row on a phone, one row from 768px, beside the
+  brand from 1024px), but a track is now a plain `fr`, at least as wide as its
+  longest word, and an address is kept on one line: its column grows to hold it
+  and its neighbours give way. The first column is 1.5 shares by default and a
+  column may set its own, `[ "Contact", links, { width: 2 } ]`. More than four
+  columns wrap four to a row under the brand. An app that overrode 0.83.0's
+  tracks from its own stylesheet may leave that block (it draws the same rows) or
+  delete it once it is on this version; while it stays, `width:` hints do nothing.
+  [`docs/SITE_FOOTER.md`](docs/SITE_FOOTER.md) lists the stable class hooks.
+- **A booking link that jumps to an inline frame asks Google once.** When the
+  frame had never been scrolled near, the link assigned its `src` and the
+  still-armed observer assigned it again as the frame scrolled into view: two
+  requests for one calendar. Whoever comes second now finds it set.
+- **The footer and the booking note set their own line heights.** The Location
+  heading inherited the page's (a 45px line box at 1.5; it is 2.25rem, 36px,
+  now), and the legal line, the © line and the "Scheduling by Google Calendar"
+  note were each a pixel taller per line than their 1.25rem.
+- **A second cropped frame on a page opens when focus moves into it from the
+  first.** Focus that goes from one frame straight into another never passes
+  through the window, so no second `blur` fired and the second frame stayed
+  cropped under the cursor. Only a page with two cropped frames could show it.
+
 ## 0.83.0 — 2026-10-01
 
 ### Added

data/README.md

@@ -41,7 +41,8 @@ resolved.
 - **Site identity and link previews**: `Studio::SiteIdentity` holds the app's title, description and image, edited at `/admin/link_preview` beside a live unfurl card and read anywhere through `Studio.site_identity`. Every page unfurls with it unless it calls `link_preview image:, title:, description:`, and `Studio::LinkPreviewBots` serves preview fetchers a slim page under iMessage's 1 MiB limit. Adopt with `bin/rails g studio:site_identity`. See [`docs/LINK_PREVIEW.md`](docs/LINK_PREVIEW.md).
 - **Public user page**: `/u/:username` shows a user's avatar and username (nothing else), and unfurls with their avatar, falling back to the site image. Link any username to it with `link_to_user_profile(user)` or `studio_user_profile_path(user)`. Opt in with `config.draw_public_user_routes = true`. See [`docs/PUBLIC_USER_PAGE.md`](docs/PUBLIC_USER_PAGE.md).
 - **Transactional emails**: `Studio::EmailCatalog` — every email an app sends, its type, a live preview, and its banner — plus the shared `/admin/emails` page. Every app inherits the standard emails and their artwork on day one, and can register its own workflows and upload its own banners. See [Transactional emails](#transactional-emails).
-- **Site footer and booking**: `<%= studio_site_footer %>` in the layout renders the public site's footer from `config.site_footer` (brand, social profiles, link columns, an address with a live map, legal links), every part optional. With `config.booking_url`, `studio_booking_frame` embeds Google Calendar's appointment page, `studio_booking_link` opens it in a popup, and `config.draw_booking_routes = true` draws `/schedule`. Leaflet is vendored and served by the engine. See [`docs/SITE_FOOTER.md`](docs/SITE_FOOTER.md).
+- **Site footer**: `<%= studio_site_footer %>` in the layout renders the public site's footer from `config.site_footer` (brand, social profiles, link columns, an address with a live map, legal links), every part optional. Leaflet is vendored and served by the engine. See [`docs/SITE_FOOTER.md`](docs/SITE_FOOTER.md).
+- **Booking**: a simple scheduler on Google Calendar appointment schedules, with or without the footer. With `config.booking_url`, `studio_booking_frame` embeds Google's booking page, `studio_booking_link` opens it in a popup, and `config.draw_booking_routes = true` draws `/schedule` (or name the app's own page with `config.booking_path`). `config.booking_crop` crops the frame to the slot picker at rest, from numbers `bin/booking-crop-measure` reads off the app's own schedule. See [`docs/BOOKING.md`](docs/BOOKING.md).
 
 ## Configuration
 
@@ -126,7 +127,7 @@ This draws the enabled auth routes (`/login`, `/signup`, `/logout`, `POST /magic
 
 Set `Studio.draw_session_routes = true` to add the session-drift rehydrate endpoint (`GET /session/state`) — off by default because it inherits the host's filters, which an app should check first ([`docs/SESSION_DRIFT.md`](docs/SESSION_DRIFT.md)).
 
-Set `Studio.draw_booking_routes = true` to add the booking page (`GET /schedule`, helper `studio_booking_path`) — off by default because mcritchie-studio draws its own `/schedule` until it adopts this one ([`docs/SITE_FOOTER.md`](docs/SITE_FOOTER.md)).
+Set `Studio.draw_booking_routes = true` to add the booking page (`GET /schedule`, helper `studio_booking_path`) — off by default because mcritchie-studio draws its own `/schedule` until it adopts this one. An app that keeps its own booking page names it with `Studio.booking_path` instead ([`docs/BOOKING.md`](docs/BOOKING.md)).
 
 **Magic links need the `studio_links` table.** Install it with `bin/rails studio_engine:install:migrations && bin/rails db:migrate` (install all of them) before enabling `:magic_link` — never by hand-copying the migration, which collides with the task's own copy on `class CreateStudioLinks`. Without the table, the first sign-in raises `Studio::Link::MissingTable`.
 
@@ -628,7 +629,8 @@ Studio.configure do |config|
   config.navbar_user_name = :player_name                        # a method on the user
   # config.navbar_user_name = ->(user, view) { user.player_name } # or a callable
 
-  # The signed-out button in layouts/_navbar and components/_user_nav.
+  # The signed-out button in layouts/_navbar and components/_user_nav, and the
+  # sign-in wording on the engine's own auth pages (below).
   config.sign_in_label = "Sign in"                              # default "Log in"
 end
 ```
@@ -645,6 +647,24 @@ end
 - The engine has no I18n catalogue, so the label is plain config, not a locale
   key. A blank or non-String label, or a `navbar_user_name` of any other type,
   raises `Studio::NavbarIdentity::InvalidConfig` at assignment.
+- The label also sets the sign-in words on the engine's own auth pages, so the
+  navbar and `/login` never disagree. Rules: `lib/studio/auth_labels.rb`.
+
+  | Where | `"Log in"` (default) | `"Sign in"` |
+  |-------|----------------------|-------------|
+  | `/login` prompt | Log in to continue | Sign in to continue |
+  | `/login` password button | Log In | Sign In |
+  | `/login` magic-link button | Send sign-in link | Send sign-in link |
+  | `/login` SSO divider | or sign in below | or sign in below |
+  | `/signup` link back to `/login` | Log in | Sign in |
+  | Magic-link confirm page button | Sign in to *App* | Sign in to *App* |
+  | Link-sent notice | …emailed you a sign-in link. | …emailed you a sign-in link. |
+
+  The default reproduces the pages' earlier wording byte for byte, including the
+  four places that already said "sign in". Any other label derives every form:
+  `"Log on"` gives *Log On*, *Log on to continue*, *or log on below* and
+  *log-on link*. The "Sign in with Google" and "Sign up" buttons are not
+  sign-in labels and do not change.
 
 ### User nav slots
 
@@ -919,6 +939,9 @@ set as a pair. R2 serves nothing anonymously from its S3 endpoint, so with an
 endpoint and no `s3_public_url`, `Studio::S3.url` raises `NotConfigured` and
 `upload` writes but returns `nil`; serve private objects with `signed_url`.
 
+`Studio::S3.delete` moves the object to `trash/` for three days rather than
+deleting it; see [Trash and restore](#trash-and-restore).
+
 An app with **no** bucket configured does not error — `/admin/emails` renders
 read-only, showing the inherited defaults it is genuinely sending and naming the
 one setting that turns uploads on.
@@ -931,6 +954,137 @@ Add it to the app's admin sidebar section:
 { label: "Emails", href: admin_emails_path, emoji: "✉️", desc: "Transactional email banners" }
 ```
 
+## Trash and restore
+
+A delete through the engine is recoverable for three days. R2 has no object
+versioning, so instead of deleting, the engine **moves** the object under
+`trash/` in the same bucket, and a lifecycle rule on the bucket expires
+`trash/` after three days:
+
+```text
+avatars/abc.png  ->  trash/2026-10-01/1759302000123/avatars/abc.png
+                     trash/<UTC date>/<epoch ms>/<original key>
+```
+
+The copy goes first and the delete second. A copy that fails raises and the
+delete is never sent, so a failure leaves the original in place. The trash copy
+keeps the object's content type, cache headers and metadata, and adds
+`original-key`, `deleted-at`, `deleted-env`, and what an Active Storage blob row
+needs to be rebuilt (`blob-content-type`, `blob-byte-size`, `blob-checksum`
+from a single-part ETag, and `blob-filename` when the upload carried a
+Content-Disposition). A single CopyObject moves at most 5 GiB, so a larger
+object raises `Studio::S3::Trash::TooLarge` and stays where it is.
+
+`trash/` always sits at the bucket **root**, even for an app under a
+`s3_key_prefix` in a shared bucket, so one lifecycle rule and one Cloudflare
+rule cover every app in the bucket.
+
+### What deletes, and what purges
+
+| Call | Effect |
+|------|--------|
+| `Studio::S3.delete(key:)` | Moves to trash; returns the trash key (nil if nothing was there) |
+| `Studio::S3.purge!(key:)` | Hard delete, gone at once |
+| `Studio::S3.list` | Leaves `trash/` keys out; `include_trash: true` keeps them |
+| Active Storage `service: StudioTrashS3`, `delete` | Moves the blob's object to trash (`Blob#purge`, a replaced attachment) |
+| Active Storage `service: StudioTrashS3`, `delete_prefixed` | Hard delete: Active Storage calls it for `variants/<key>/`, which regenerate from the original |
+
+**The production guard.** All four destructive paths refuse a bucket whose name
+ends in `-production` when the process is not production, by `Studio::S3`'s own
+resolution (`QA_ENV` first, so a QA app running Rails as production is NOT
+production, then `Rails.env`). They raise
+`Studio::S3::Trash::ProductionBucketRefused` before sending any request. The
+guard reads the bucket NAME, so it protects only buckets that follow the
+`<app>-production` convention.
+
+### Set up the bucket (once per bucket, before an app adopts)
+
+Without the lifecycle rule, trash never expires. In the Cloudflare dashboard:
+R2 → the bucket → Settings → Object lifecycle rules → add a rule for prefix
+`trash/` that deletes objects 3 days after upload. A trash copy is a new object,
+so "uploaded" is the moment it was deleted. The same rule as S3 lifecycle JSON
+(R2's S3 API and AWS both take it). `aws s3api
+put-bucket-lifecycle-configuration` REPLACES the bucket's whole lifecycle
+configuration, R2's default abort-incomplete-multipart rule included, so read
+the current rules first (`get-bucket-lifecycle-configuration`) and send them
+together with this one, or use the dashboard:
+
+```json
+{
+  "Rules": [
+    {
+      "ID": "expire-trash-3d",
+      "Status": "Enabled",
+      "Filter": { "Prefix": "trash/" },
+      "Expiration": { "Days": 3 }
+    }
+  ]
+}
+```
+
+A public bucket also serves `trash/` from its custom domain unless it is
+blocked, which would keep a "deleted" profile picture reachable by URL for three
+days. Add a Cloudflare WAF custom rule on the zone, action **Block**:
+
+```text
+(http.host in {"assets.example.com"} and starts_with(http.request.uri.path, "/trash/"))
+```
+
+Name every `assets.<domain>` host the bucket answers on. If the bucket has the
+`r2.dev` public URL enabled, turn it off; a WAF rule cannot cover it.
+
+### Adopt it in an app
+
+Active Storage: change the R2 service in `config/storage.yml` from `service: S3`
+to `service: StudioTrashS3`. Every other key stays as it is:
+
+```yaml
+r2:
+  service: StudioTrashS3
+  bucket: my-app-production
+  endpoint: <%= ENV["R2_ENDPOINT"] %>
+  region: auto
+  access_key_id: <%= ENV["R2_ACCESS_KEY_ID"] %>
+  secret_access_key: <%= ENV["R2_SECRET_ACCESS_KEY"] %>
+```
+
+An app with its own S3 service subclass (turf-monster's
+`ActiveStorage::Service::R2PublicService`) inherits from the trash service
+instead:
+
+```ruby
+require "active_storage/service/studio_trash_s3_service"
+
+module ActiveStorage
+  class Service::R2PublicService < Service::StudioTrashS3Service
+    # ...
+  end
+end
+```
+
+`Studio::S3` callers need no change: `delete` trashes from this release on. Call
+`purge!` where an object truly has no value after deletion.
+
+### Find and restore a deleted object
+
+```bash
+bin/rails "studio:trash:list"                      # everything in trash
+bin/rails "studio:trash:list[avatars/abc.png]"     # one key's trash copies
+bin/rails "studio:trash:restore[trash/2026-10-01/1759302000123/avatars/abc.png]"
+```
+
+Both read `Studio::S3`'s bucket. `SERVICE=<storage.yml service name>` reads an
+Active Storage service's bucket instead, e.g. `SERVICE=r2`. A restore copies the
+object back to its original key and leaves the trash copy for the lifecycle rule
+to expire. It refuses to overwrite an object already at the original key unless
+`FORCE=1`.
+
+Restoring an Active Storage object restores its **bytes only**. The blob row was
+destroyed before the object was trashed, so the task prints the
+`ActiveStorage::Blob.create!(...)` to run, filled from the trash copy's metadata,
+and the record must be re-attached by hand. `filename` is known only when the
+upload carried a Content-Disposition; supply it otherwise.
+
 ## Overriding Views
 
 This is a non-isolated engine -- app views at the same path automatically override engine views. For example, placing `app/views/sessions/new.html.erb` in the consuming app replaces the engine's login page.

data/app/controllers/magic_links_controller.rb

@@ -28,7 +28,7 @@ class MagicLinksController < ApplicationController
     end
     respond_to do |format|
       format.json { render json: { success: true } }
-      format.html { redirect_to login_path, notice: "Check your inbox — we just emailed you a sign-in link." }
+      format.html { redirect_to login_path, notice: "Check your inbox — we just emailed you a #{Studio::AuthLabels.link_noun(Studio.sign_in_label)}." }
     end
   end
 

data/app/controllers/registrations_controller.rb

@@ -18,7 +18,7 @@ class RegistrationsController < ApplicationController
         token = issue_magic_link(email, nil)
         Studio::Email.deliver(UserMailer, :magic_link, email, token, to: email)
       end
-      return redirect_to login_path, notice: "Check your inbox — we just emailed you a sign-in link."
+      return redirect_to login_path, notice: "Check your inbox — we just emailed you a #{Studio::AuthLabels.link_noun(Studio.sign_in_label)}."
     end
 
     @user = User.new(user_params)

data/app/helpers/studio/site_footer_helper.rb

@@ -2,7 +2,7 @@
 
 module Studio
   # The site footer and the booking primitives, as view helpers. See
-  # docs/SITE_FOOTER.md.
+  # docs/SITE_FOOTER.md and docs/BOOKING.md.
   #
   #   <%= studio_site_footer %>             the footer, where it should show
   #   <%= studio_booking_frame %>           Google's booking page, inline
@@ -40,8 +40,8 @@ module Studio
 
     # Where the footer shows: Studio.site_footer_visible, asked of this view. By
     # default that is every page for a visitor and, for a signed-in viewer, only
-    # the controllers in Studio.site_footer_controllers (plus the engine's booking
-    # page). Always false for an app that declared no footer.
+    # the controllers in Studio.site_footer_controllers (plus the booking page).
+    # Always false for an app that declared no footer.
     def studio_show_site_footer?
       return false if studio_site_footer_facts.nil?
 
@@ -75,12 +75,11 @@ module Studio
     def studio_booking_embed_url = Studio::Booking.embed_url(Studio.booking_url)
 
     # Where a booking link goes when the popup cannot open (scripts off, a
-    # modified click, a page with no dialog): the app's booking page when the
-    # engine draws it, else Google's own page.
+    # modified click, a page with no dialog): the app's booking page
+    # (Studio.booking_path, or the engine's /schedule when drawn), else Google's
+    # own page.
     def studio_booking_fallback_path
-      return studio_booking_path if Studio.draw_booking_routes && respond_to?(:studio_booking_path)
-
-      Studio.booking_url
+      Studio.booking_path_for(self) || Studio.booking_url
     end
 
     # The frame's accessible name.
@@ -99,11 +98,20 @@ module Studio
       studio_site_footer_facts&.dig(:name) || Studio.site_identity[:title]
     end
 
-    # The inline booking frame. `crop: false` shows Google's whole page at rest.
+    # The crop a frame renders with: { offset:, window:, frame_height: }, or nil
+    # for the whole frame at rest. `true` reads Studio.booking_crop; a Hash is a
+    # one-off; false or nil is no crop.
+    def studio_booking_crop(crop = true)
+      Studio::Booking.crop(crop == true ? Studio.booking_crop : crop)
+    end
+
+    # The inline booking frame. `crop:` is true (the default: use
+    # Studio.booking_crop, which is no crop until the app declares one), false
+    # (the whole page at rest) or a Hash for this frame alone.
     def studio_booking_frame(title: nil, crop: true)
       return unless studio_booking?
 
-      render "studio/booking/frame", title: studio_booking_title(title), crop: crop
+      render "studio/booking/frame", title: studio_booking_title(title), crop: studio_booking_crop(crop)
     end
 
     # The booking dialog, once per page however often it is asked for. The

data/app/views/registrations/new.html.erb

@@ -73,7 +73,7 @@
 
       <p class="text-center text-secondary text-sm mt-6">
         Already have an account?
-        <%= link_to "Log in", login_path, class: "text-primary hover:text-primary-300 font-medium underline underline-offset-2" %>
+        <%= link_to Studio::AuthLabels.link(Studio.sign_in_label), login_path, class: "text-primary hover:text-primary-300 font-medium underline underline-offset-2" %>
       </p>
     </div>
   </div>

data/app/views/sessions/_sso_continue.html.erb

@@ -11,7 +11,7 @@
 
     <div class="flex items-center gap-3 mt-5">
       <div class="flex-1 h-px border-t border-subtle"></div>
-      <span class="text-muted text-xs uppercase tracking-wider">or sign in below</span>
+      <span class="text-muted text-xs uppercase tracking-wider"><%= Studio::AuthLabels.or_below(Studio.sign_in_label) %></span>
       <div class="flex-1 h-px border-t border-subtle"></div>
     </div>
   </div>

data/app/views/sessions/new.html.erb

@@ -4,6 +4,9 @@
   words = Studio.app_name.split
   last_word = words.pop
   prefix = words.join(" ")
+  # The sign-in wording follows Studio.sign_in_label, as the navbar does
+  # (lib/studio/auth_labels.rb); the default label prints the wording these pages always had.
+  sign_in_label = Studio.sign_in_label
 %>
 
 <div class="min-h-[70vh] flex items-center justify-center">
@@ -13,7 +16,7 @@
         <img src="<%= logo_path %>" alt="<%= Studio.app_name %>" class="w-20 h-20 rounded-full shadow-lg mx-auto mb-4">
       <% end %>
       <h1 class="text-3xl font-extrabold text-heading tracking-tight"><%= prefix %> <span class="text-primary"><%= last_word %></span></h1>
-      <p class="text-secondary mt-2">Log in to continue</p>
+      <p class="text-secondary mt-2"><%= Studio::AuthLabels.prompt(sign_in_label) %></p>
     </div>
 
     <% if has_sso %>
@@ -57,7 +60,7 @@
           </div>
 
           <button type="submit" class="btn btn-primary btn-lg w-full">
-            Log In
+            <%= Studio::AuthLabels.button(sign_in_label) %>
           </button>
         <% end %>
       <% elsif Studio.auth_method?(:magic_link) %>
@@ -71,7 +74,7 @@
           </div>
 
           <button type="submit" class="btn btn-primary btn-lg w-full">
-            Send sign-in link
+            Send <%= Studio::AuthLabels.link_noun(sign_in_label) %>
           </button>
         <% end %>
       <% end %>

data/app/views/studio/_confirm_interstitial.html.erb

@@ -75,7 +75,7 @@
               method: :post,
               form: { id: "magic-consume-form", data: { turbo: "false" } },
               class: "magic-submit" do %>
-          Sign in to <%= Studio.app_name %>
+          <%= Studio::AuthLabels.to_app(Studio.sign_in_label, Studio.app_name) %>
         <% end %>
       </div>
     </main>

data/app/views/studio/booking/_assets.html.erb

@@ -10,18 +10,22 @@
     /* A booking link on this page scrolls here; land below the pinned navbar. */
     scroll-margin-top: calc(var(--nav-bottom, 4rem) + 1rem); }
   .booking-frame iframe { display: block; width: 100%; border: 0; height: 1200px; }
+  /* From 640px up Google lays the month beside the slots. A cropped wrapper
+     carries its own numbers (Studio::Booking.crop_style): how far the frame is
+     pulled up, the window's height, and the frame's full height. A wrapper with
+     no crop carries none, and shows the frame whole at the default height. */
   @media (min-width: 640px) {
-    .booking-frame iframe { height: 732px; }
-    .booking-frame-cropped { height: 414px; transition: height .25s ease; }
-    .booking-frame-cropped iframe { margin-top: -205px; transition: margin-top .25s ease; }
-    .booking-frame-cropped.is-open { height: 732px; }
+    .booking-frame iframe { height: var(--booking-frame-height, 732px); }
+    .booking-frame-cropped { height: var(--booking-crop-window); transition: height .25s ease; }
+    .booking-frame-cropped iframe { margin-top: calc(-1 * var(--booking-crop-offset)); transition: margin-top .25s ease; }
+    .booking-frame-cropped.is-open { height: var(--booking-frame-height, 732px); }
     .booking-frame-cropped.is-open iframe { margin-top: 0; }
   }
   /* Scripts off: the frame never gets its src, so it is hidden and a plain link
      stands in its place (the <noscript> in studio/booking/_frame). */
   .booking-frame-noscript { margin: 0; padding: 3rem 1.5rem; text-align: center; color: #111; }
   .booking-frame-noscript a { color: #4338ca; font-weight: 700; text-decoration: underline; }
-  .booking-frame-note { margin: 1rem 0 0; text-align: center; font-size: .875rem; color: var(--color-text-muted, inherit); }
+  .booking-frame-note { margin: 1rem 0 0; text-align: center; font-size: .875rem; line-height: 1.25rem; color: var(--color-text-muted, inherit); }
   .booking-frame-note a { color: var(--color-primary, #8b5cf6); }
   .booking-frame-note a:hover { text-decoration: underline; }
 
@@ -69,15 +73,23 @@
     if (window.__studioBookingFramesArmed) return;
     window.__studioBookingFramesArmed = true;
 
+    // ASK GOOGLE ONCE. Two things can ask for a frame: scrolling near it, and a
+    // booking link that jumps to it. Assigning src a second time, even to the
+    // same URL, is a second request, so whoever comes second finds it set.
+    function load(frame) {
+      if (!frame.getAttribute('src')) frame.src = frame.dataset.src;
+    }
+    window.__studioBookingLoad = load;
+
     function arm() {
       document.querySelectorAll('iframe[data-booking-frame][data-studio-booking][data-src]').forEach(function (frame) {
         if (frame.__bookingArmed) return;
         frame.__bookingArmed = true;
-        if (typeof IntersectionObserver !== 'function') { frame.src = frame.dataset.src; return; }
+        if (typeof IntersectionObserver !== 'function') { load(frame); return; }
         var watcher = new IntersectionObserver(function (entries) {
           if (!entries.some(function (entry) { return entry.isIntersecting; })) return;
           watcher.disconnect();
-          frame.src = frame.dataset.src;
+          load(frame);
         }, { rootMargin: '200px' });
         watcher.observe(frame);
       });
@@ -90,12 +102,34 @@
 
     // Focus moving into the frame is the one signal a cross-origin frame gives
     // its parent. It means the visitor has started using the calendar.
-    window.addEventListener('blur', function () {
+    function openActive() {
       var active = document.activeElement;
       if (!active || !active.matches || !active.matches('iframe[data-booking-frame][data-studio-booking]')) return;
       var wrap = active.closest('[data-booking-wrap][data-studio-booking]');
       if (wrap) wrap.classList.add('is-open');
+    }
+
+    // THE WINDOW BLURS ONCE. Focus that moves from one frame straight into
+    // another never comes back through this window, so no second blur announces
+    // the second frame, and on a page with two cropped frames it would stay
+    // cropped under the visitor's cursor. So while focus is away in a frame and a
+    // cropped wrapper is still shut, look again a few times a second. It stops
+    // when focus returns here or nothing is left to open, and a page with one
+    // frame never starts it: that frame is open by then.
+    var watching = null;
+    function shut() { return document.querySelector('[data-booking-wrap][data-studio-booking][data-booking-crop]:not(.is-open)'); }
+    function stopWatching() { if (watching) { clearInterval(watching); watching = null; } }
+
+    window.addEventListener('blur', function () {
+      openActive();
+      var active = document.activeElement;
+      if (watching || !active || active.tagName !== 'IFRAME' || !shut()) return;
+      watching = setInterval(function () {
+        openActive();
+        if (!shut()) stopWatching();
+      }, 250);
     });
+    window.addEventListener('focus', stopWatching);
 
     document.addEventListener('turbo:load', armAfterLoad);
     armAfterLoad();
@@ -127,7 +161,7 @@
         var wrap = inline.closest('[data-booking-wrap][data-studio-booking]');
         if (wrap) wrap.classList.add('is-open');
         // Before `load` the frame keeps waiting: its own script assigns src then.
-        if (!inline.getAttribute('src') && document.readyState === 'complete') inline.src = inline.dataset.src;
+        if (document.readyState === 'complete' && window.__studioBookingLoad) window.__studioBookingLoad(inline);
         var calm = window.matchMedia && window.matchMedia('(prefers-reduced-motion: reduce)').matches;
         (wrap || inline).scrollIntoView({ behavior: calm ? 'auto' : 'smooth', block: 'start' });
         inline.focus({ preventScroll: true });

data/app/views/studio/booking/_frame.html.erb

@@ -4,17 +4,20 @@
     width: month beside the slots from about 600px, stacked below that. It
     cannot be themed, so it sits on a white panel in both themes.
 
-    CROPPED AT REST, WHOLE IN USE. From 640px up the wrapper shows only the
-    "Select an appointment time" box: Google's header above it and its credit
-    lines below are clipped (measured in the frame at 640-862px wide: the box
-    spans 211-613px of a 732px page). The crop cannot stay on, because the form
-    that opens when a slot is picked is a dialog centred in the frame's FULL
-    height (93-640px), so a cropped frame cuts off its title and its Book
+    WHOLE AT REST unless the app declares a crop (Studio.booking_crop, or
+    `crop:` on the call). `crop` here is the resolved crop, a Hash of offset,
+    window and frame_height, or nil.
+
+    CROPPED AT REST, WHOLE IN USE, when it has one. From 640px up the wrapper
+    shows only the "Select an appointment time" box: Google's header above it
+    and its credit lines below are clipped. Where that box sits belongs to one
+    schedule, so the numbers ride on the wrapper as custom properties and two
+    frames with different crops can share a page. The crop cannot stay on,
+    because the form that opens when a slot is picked is a dialog centred in the
+    frame's FULL height, so a cropped frame cuts off its title and its Book
     button. A cross-origin frame reports no clicks, but the parent window does
     lose focus to it; on that signal the wrapper opens to the full frame.
     Below 640px Google stacks the month above the slots and nothing is cropped.
-    Those numbers are Google's layout, measured 2026-09-30; `crop: false` drops
-    the crop if that layout moves.
 
     THE SRC IS DEFERRED, and not with loading="lazy". The frame is a third
     party, and a frame that starts loading before the window's `load` event
@@ -25,7 +28,7 @@
     WITH SCRIPTS OFF nothing ever assigns the src, so the <noscript> hides the
     empty frame and puts a plain link to Google's booking page in its place. %>
 <%= studio_booking_assets %>
-<div class="booking-frame<%= " booking-frame-cropped" if crop %>" data-booking-wrap data-studio-booking>
+<div class="booking-frame<%= " booking-frame-cropped" if crop %>" data-booking-wrap data-studio-booking<% if crop %> data-booking-crop style="<%= Studio::Booking.crop_style(crop) %>"<% end %>>
   <iframe data-booking-frame data-studio-booking
           data-src="<%= studio_booking_embed_url %>"
           title="<%= title %>"

data/app/views/studio/bookings/show.html.erb

@@ -1,7 +1,9 @@
 <%# /schedule — the booking page (Studio::BookingsController), drawn by
     Studio.draw_booking_routes. It is where a booking link lands when the popup
-    cannot open. An app that wants different words around the frame renders
-    `studio_booking_frame` in a view of its own instead. %>
+    cannot open. The frame takes the app's crop (Studio.booking_crop), as it
+    does anywhere. An app that wants different words around the frame renders
+    `studio_booking_frame` in a view of its own instead, and names that page in
+    Studio.booking_path. %>
 <% label = studio_booking_label %>
 <% content_for(:title, "#{label} · #{studio_site_footer_name}") %>
 <% content_for(:full_width, true) %>