studio-engine 0.88.0 → 0.90.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e16f65ea44055886fea1ffb0743a9415caa612f858caa0ff7dabb7c87beeeb15
-  data.tar.gz: 9690ad40a9e766646995ddfa1c69c8c22191e3509bb944d5c184ea5c1a1b21e2
+  metadata.gz: c11c676d845c483117f043e7925f84cc0d7128dfa170740dd3d3c1c484438259
+  data.tar.gz: a873622a9676a51d1864612008e09a4e7f8822a371e275b5e0586ea9b252ad9e
 SHA512:
-  metadata.gz: ae4786abebc9f1d9dc86cc3992f4a6f4225c4fceaa20b73fca12ddd43afad1e4d6ef2807a8d3302bdf2d811792995fdac42961a02c6b70637f8923e841e61402
-  data.tar.gz: 3ba6c43faf9e1f7a03596b70924fc099469d8c95ce967f63e4a2ba8f4f0da0112db6068e701e739fa7e3ce5435bd07ee456b2982fec91ebb9561a4bc3dd18b09
+  metadata.gz: eb5630d5317933c839f352af196f567be745f13c53ba90c503f373ae0869f2084ce0bff41a47489056a85cf36731dd39974f30f7ab553b9f6b43d920f353a6a4
+  data.tar.gz: a4651700a47b3700f99ed6c00f9e56d5e9682b8771843d4156ca1566b66844a03e1d7a846889f3d5283bf301d537e301bc59284149f0ac97a9f0ad8e6fcbed7c

data/CHANGELOG.md

@@ -4,6 +4,44 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+## 0.90.0 — 2026-10-06
+
+### Removed
+
+- **`components/card`, `components/input` and `components/progress_bar`.** No
+  app renders these partials. The `card` and `input-field` utilities they wrapped
+  still ship; write the classes on your own markup.
+- **`Studio::Impersonation`** and its four settings,
+  `impersonation_target_session_key`, `impersonation_actor_session_key`,
+  `impersonation_started_at_session_key` and `impersonation_max_minutes`. No app
+  includes the concern; each owns its Act As session. The
+  `studio/banners/impersonation` banner stays.
+- **`Studio::Broadcastable`.** No app includes it. Wrap a broadcast in
+  `Studio::Cable.safe_broadcast { broadcast_replace_to ... }` instead
+  (`docs/CABLE.md`).
+- **`Studio::UserProfile`.** No app includes it; each `User` defines
+  `display_name`, `avatar_initials` and `avatar_color` itself. The initial-circle
+  palette moves to `Studio::AVATAR_COLORS`.
+- **`/admin/email_images`**, `Studio::EmailImagesController`, its view and the
+  `admin_email_images_path` and `admin_email_image_path` helpers. `/admin/emails`
+  replaces the page, and no app links or tests it.
+
+## 0.89.0 — 2026-10-05
+
+### Changed
+
+- **A survey opens on question 1.** The intro screen and its Start button are
+  gone: a respondent lands on "Question 1 of N" with the progress bar started,
+  and question 1 shows no Back button. The definition's `intro` becomes a quiet
+  lead line above question 1, and its `title` stays the page's `h1`; when the
+  title repeats question 1 (`Studio::Survey#title_repeats_first_question?`), the
+  stepper hides it visually so the same words are not painted twice. Number keys
+  and Enter work from the first paint. Returning respondents still resume on
+  their first unanswered question, and the no-JavaScript form shows the title
+  and intro at the top. No host change is needed.
+- **The survey's "Press a number to choose" hint** no longer shows at phone width
+  (under 640px), as well as on touch screens.
+
 ## 0.88.0 — 2026-10-05
 
 ### Added

data/README.md

@@ -34,7 +34,7 @@ resolved.
 - **Session drift**: every page carries a session stamp and loads `window.StudioSession`, which notices when another tab signs in or out, the session expires, or the server revokes it; `session:changed` / `session:mismatch` events, cross-tab sync, an identity-source plug-in interface, and `expectChange` holds for deliberate switches. The rehydrate endpoint (`GET /session/state`) is opt-in. See [`docs/SESSION_DRIFT.md`](docs/SESSION_DRIFT.md).
 - **Theme system**: Dynamic CSS custom properties generated from 7 role colors (primary, dark, light, success, accent, warning, danger). Dark/light mode toggle. Admin theme editor at `/admin/theme`.
 - **UI primitives**: Shared component partials and CSS primitives such as `components/emoji_swap` for nav/sidebar emoji hover transitions.
-- **Operator tooling**: Shared `studio/banners/environment` banner with Dev Mode + email connector controls, `studio/banners/impersonation`, and an opt-in `Studio::Impersonation` concern for Act As session conventions.
+- **Operator tooling**: Shared `studio/banners/environment` banner with Dev Mode + email connector controls and `studio/banners/impersonation`.
 - **Sluggable concern**: `before_save :set_slug` with `to_param` for human-readable URLs
 - **ThemeSetting model**: Per-app DB overrides with fallback to config defaults
 - **Geo**: `Studio::GeoDetection` places every visitor (IP → country + subdivision, session-cached), `Studio::GeoSetting` stores the operator's blocked countries and regions, `require_geo_allowed` locks whichever surfaces an app chooses, and the shared badge + `/admin/geo` manager ship with it. See [`docs/GEO.md`](docs/GEO.md).
@@ -169,22 +169,8 @@ with their own users and return route:
            stop_path: admin_stop_impersonating_path %>
 ```
 
-The engine also provides an optional `Studio::Impersonation` concern for the
-session convention:
-
-```ruby
-class ApplicationController < ActionController::Base
-  include Studio::ErrorHandling
-  include Studio::Impersonation
-end
-```
-
-The concern adds `true_user`, `impersonated_user`, `impersonating?`,
-`start_impersonation_session(target_user, actor:)`, and
-`clear_impersonation_session`. Consumer apps still own the authorization rule,
-audit log, enter/exit controller actions, and any app-specific safeguards such
-as binding session-token checks to `true_user` or disabling wallet-only
-privileges while impersonating.
+Each app owns its Act As session, authorization rule, audit log and enter/exit
+actions; the engine supplies only the banner.
 
 ## UI Primitives
 
@@ -702,8 +688,7 @@ matching slot is absent, so existing call sites render unchanged.
 Every consuming app can render the same admin page — **`/admin/emails`** —
 listing each transactional email it sends with the banner riding at the top of
 that email, and whether that banner is the **inherited default** or an
-**app-owned override**. Supersedes the old `/admin/email_images`, which is
-deprecated but still renders for one release.
+**app-owned override**.
 
 **The page is opt-in:**
 

data/app/controllers/studio/emails_controller.rb

@@ -7,7 +7,7 @@ module Studio
   # It lists Studio::EmailCatalog's registry — one row per registered email, each
   # showing its live banner and whether that banner is the INHERITED engine
   # default or an APP-OWNED override — and writes an override through the shared
-  # crop modal. Replaces /admin/email_images, which now redirects here.
+  # crop modal.
   #
   # An app whose host never set Studio.s3_bucket_prefix cannot store an override.
   # That is a read-only page, not an error: uploads_available? gates the write

data/app/services/studio/email_catalog.rb

@@ -762,8 +762,8 @@ module Studio
     # THE SAME QUESTION background_url ASKS, so it must ask it the same way.
     # This guard read engine_artwork? while background_url read layered?, and the
     # two answer differently for a host that registers its own background: the
-    # mailer sent the layered banner while /admin/email_images and the detail
-    # page's "Artwork" frame both drew the flat asset. That frame is where
+    # mailer sent the layered banner while the detail page's "Artwork" frame
+    # drew the flat asset. That frame is where
     # "Modify image" lives, and an upload writes the row background_url reads
     # FIRST — so the operator was shown one picture and told it was the one the
     # button would replace.

data/app/services/studio/email_image.rb

@@ -20,8 +20,7 @@ module Studio
   # stays green. A host that did reference it gets a NameError, not a silent
   # wrong answer.
   #
-  # Delete it once no consumer's main names it — the same staged retirement
-  # /admin/email_images is on.
+  # Delete it once no consumer's main names it.
   #
   # Deliberately explicit rather than method_missing: a typo should still raise
   # NoMethodError here, and the delegated surface should be readable as a list.

data/app/views/studio/public_users/show.html.erb

@@ -19,7 +19,7 @@
       <%= render "components/avatar", user: @public_user, size: "xl", alt: username %>
     <% else %>
       <%# Drawn from the username alone: a host's avatar_initials / avatar_color may read the name or email (cyvasse's do). %>
-      <% colors = Studio::UserProfile::AVATAR_COLORS %>
+      <% colors = Studio::AVATAR_COLORS %>
       <div class="w-28 h-28 text-4xl rounded-full flex items-center justify-center font-bold text-white"
            style="background-color: <%= colors[Digest::MD5.hexdigest(username).hex % colors.size] %>"><%= username[0].upcase %></div>
     <% end %>

data/app/views/studio/surveys/_script.html.erb

@@ -19,7 +19,9 @@
 
     var form = root.querySelector("[data-survey-form]");
     var steps = Array.prototype.slice.call(root.querySelectorAll("[data-survey-step]"));
-    var total = steps.length - 1;
+    // Every step is a question: the survey opens on question 1, no intro screen.
+    var total = steps.length;
+    var head = root.querySelector("[data-survey-head]");
     var back = root.querySelector("[data-survey-back]");
     var next = root.querySelector("[data-survey-next]");
     var submit = root.querySelector("[data-survey-submit]");
@@ -128,21 +130,23 @@
         }
       });
       current = index;
-      var onIntro = index === 0;
+      var first = index === 0;
       var last = index === steps.length - 1;
-      back.hidden = onIntro;
+      // Nothing comes before question 1, so it has no Back. Next keeps the
+      // right edge on its own (margin-left: auto), so the row does not shift.
+      back.hidden = first;
       next.hidden = last;
-      next.textContent = onIntro ? "Start" : "Next";
       submit.hidden = !last;
+      // The title and intro lead question 1 only; later screens are the question alone.
+      if (head) head.hidden = !first;
       // The number-key shortcut only means something on a choice or scale.
       var step = steps[index];
       hint.hidden = !(step.dataset.key && (isChoice(step) || isMulti(step)));
 
-      var position = onIntro ? 0 : index;
+      var position = index + 1;
       fill.style.width = (total ? (position / total) * 100 : 0) + "%";
       bar.setAttribute("aria-valuenow", String(position));
-      // The intro already says how many questions there are.
-      count.textContent = onIntro ? "" : "Question " + index + " of " + total;
+      count.textContent = "Question " + position + " of " + total;
 
       var focusTarget = steps[index].querySelector("[data-survey-focus]");
       if (focusTarget && direction) focusTarget.focus({ preventScroll: true });
@@ -182,7 +186,7 @@
     // The first required question still missing an answer, for a Submit that
     // jumps ahead (Enter on the last step, or a mid-survey reload).
     form.addEventListener("submit", function (event) {
-      for (var i = 1; i < steps.length; i++) {
+      for (var i = 0; i < steps.length; i++) {
         if (steps[i].dataset.required === "true" && !answered(steps[i])) {
           event.preventDefault();
           go(i);
@@ -230,7 +234,7 @@
       timers[step.dataset.key] = setTimeout(function () { save(step); }, 900);
     });
 
-    root.addEventListener("keydown", function (event) {
+    function onKey(event) {
       if (event.defaultPrevented || event.altKey) return;
       // A tap on an already-chosen option fires pointerdown but no change, so
       // the flag would outlive it and make the next arrow key advance.
@@ -256,15 +260,29 @@
       option.focus({ preventScroll: true });
       pointerPick = isChoice(step);
       option.dispatchEvent(new Event("change", { bubbles: true }));
-    });
+    }
+
+    root.addEventListener("keydown", onKey);
+    // The survey opens on question 1 with nothing focused, so a first key
+    // lands on <body>, outside the root. Take those keys too, and only those:
+    // a key aimed at any other control on the page is not the survey's. The
+    // listener retires itself once a Turbo visit has taken this root away.
+    function onPageKey(event) {
+      if (!root.isConnected) { document.removeEventListener("keydown", onPageKey); return; }
+      var target = event.target;
+      if (target === document.body || target === document.documentElement) onKey(event);
+    }
+    document.addEventListener("keydown", onPageKey);
 
     var resume = root.dataset.resumeIndex;
-    var start = resume === "" || resume === undefined ? 0 : parseInt(resume, 10) + 1;
+    // resume-index is the question's own index, and every step is a question.
+    var start = resume === "" || resume === undefined ? 0 : parseInt(resume, 10);
+    if (!(start >= 0 && start < steps.length)) start = 0;
     var hasErrors = root.dataset.hasErrors === "true";
-    // A fresh visitor sees the intro; a returning one lands on their next
+    // A fresh visitor lands on question 1; a returning one on their next
     // question, and a failed submit on the first question it flagged.
     if (restored >= 0) start = restored;
-    render(start > 0 ? start : 0, null);
+    render(start, null);
     if (restored < 0 && (start > 0 || hasErrors)) {
       var focusTarget = steps[current].querySelector("[data-survey-focus]");
       if (focusTarget) focusTarget.focus({ preventScroll: true });

data/app/views/studio/surveys/_styles.html.erb

@@ -18,6 +18,15 @@
   .studio-survey__title { margin: 0 0 .75rem; font-size: 1.75rem; line-height: 1.2; font-weight: 800; color: var(--color-text); outline: none; }
   .studio-survey__intro-copy { margin: 0 0 1rem; font-size: 1.0625rem; line-height: 1.55; color: var(--color-text-body); white-space: pre-line; }
   .studio-survey__meta { margin: 0; font-size: .8125rem; color: var(--color-text-muted); }
+  .studio-survey__head { margin: 0 0 2.25rem; }
+  /* Stepped, the head leads question 1 quietly: a small title (or none, when it
+     repeats question 1, kept for screen readers), the intro as one lead line,
+     and no meta, since the count above already says "Question 1 of N". */
+  .studio-survey.is-enhanced .studio-survey__head { margin-bottom: 1.25rem; }
+  .studio-survey.is-enhanced .studio-survey__title { margin: 0 0 .375rem; font-size: 1rem; line-height: 1.4; font-weight: 700; color: var(--color-text-secondary); }
+  .studio-survey.is-enhanced .studio-survey__head--echo .studio-survey__title { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; border: 0; }
+  .studio-survey.is-enhanced .studio-survey__intro-copy { margin: 0; font-size: .9375rem; line-height: 1.5; color: var(--color-text-secondary); }
+  .studio-survey.is-enhanced .studio-survey__meta { display: none; }
   .studio-survey__question { display: block; width: 100%; padding: 0; margin: 0 0 .5rem; font-size: 1.375rem; line-height: 1.3; font-weight: 700; color: var(--color-text); outline: none; }
   .studio-survey__qnum { display: block; margin-bottom: .375rem; font-size: .75rem; font-weight: 600; letter-spacing: .06em; text-transform: uppercase; color: var(--color-text-muted); }
   .studio-survey.is-enhanced .studio-survey__qnum { display: none; }
@@ -68,7 +77,9 @@
   .studio-survey__forward { margin-left: auto; }
   .studio-survey__status { min-height: 1.25rem; margin: .5rem 0 0; font-size: .75rem; text-align: center; color: var(--color-text-muted); }
   .studio-survey__hint { margin: .25rem 0 0; font-size: .75rem; text-align: center; color: var(--color-text-muted); }
-  @media (hover: none), (pointer: coarse) { .studio-survey__hint { display: none; } }
+  /* The hint speaks to a keyboard. A touch screen has none, and a phone-width
+     window is a phone more often than not, so neither shows it. */
+  @media (hover: none), (pointer: coarse), (max-width: 639px) { .studio-survey__hint { display: none; } }
 
   .studio-survey__card { padding: 2rem 1.5rem; text-align: center; border: 1px solid var(--color-border); border-radius: 1.25rem; background: var(--color-surface); }
   .studio-survey__burst { font-size: 3rem; line-height: 1; margin-bottom: .75rem; }
@@ -86,7 +97,7 @@
   @media (min-width: 640px) {
     .studio-survey { padding-top: 3rem; }
     .studio-survey__question { font-size: 1.625rem; }
-    .studio-survey__title { font-size: 2.125rem; }
+    .studio-survey:not(.is-enhanced) .studio-survey__title { font-size: 2.125rem; }
     .studio-survey__scale { gap: .75rem; }
     .studio-survey__tile { min-height: 5.5rem; }
     .studio-survey__face { font-size: 2.5rem; }

data/app/views/studio/surveys/show.html.erb

@@ -1,9 +1,10 @@
 <%# /surveys/:slug — the survey (Studio::SurveysController#show, docs/SURVEYS.md).
 
     ONE FORM, TWO PRESENTATIONS. Without JavaScript every question renders in
-    order and the Submit button posts the lot. The script below adds
-    .is-enhanced and turns the same markup into one question per screen, with a
-    progress bar, Back and Next, number-key and Enter shortcuts, and an
+    order under the title and intro, and the Submit button posts the lot. The
+    script below adds .is-enhanced and turns the same markup into one question
+    per screen, opening on question 1 with no intro screen, with a progress
+    bar, Back (from question 2 on) and Next, number-key and Enter shortcuts, and an
     autosave on each answer. Submit is still the same POST either way, so the
     server's validation is the one rule. %>
 <% total = @survey.questions.size %>
@@ -28,10 +29,14 @@
 
     <%= form_with url: studio_survey_path(@survey.slug), method: :post, local: true,
                   html: { class: "studio-survey__form", data: { survey_form: true } } do %>
-      <section class="studio-survey__step" data-survey-step data-intro aria-labelledby="studio-survey-title">
-        <h1 class="studio-survey__title" id="studio-survey-title" tabindex="-1" data-survey-focus><%= @survey.title %></h1>
+      <%# The head is not a step: the survey opens straight on question 1. The
+          title stays the page's h1 for a screen reader; when it says what
+          question 1 asks, the stepper hides it visually rather than paint the
+          same words twice. The intro is a quiet lead line over question 1. %>
+      <header class="studio-survey__head<%= " studio-survey__head--echo" if @survey.title_repeats_first_question? %>" data-survey-head>
+        <h1 class="studio-survey__title" id="studio-survey-title"><%= @survey.title %></h1>
         <% if @survey.intro %>
-          <p class="studio-survey__intro-copy"><%= @survey.intro %></p>
+          <p class="studio-survey__intro-copy" data-survey-intro><%= @survey.intro %></p>
         <% end %>
         <p class="studio-survey__meta">
           <%= pluralize(total, "question") %> · about <%= pluralize(minutes, "minute") %><% if @survey.required_keys.any? %> · <span aria-hidden="true">*</span> required<% end %>
@@ -39,7 +44,7 @@
         <% if @errors.any? %>
           <p class="studio-survey__error" role="alert">A few answers need another look before this can be sent.</p>
         <% end %>
-      </section>
+      </header>
 
       <% @survey.questions.each_with_index do |question, index| %>
         <%= render "studio/surveys/question", question: question, index: index, total: total,
@@ -48,7 +53,7 @@
 
       <div class="studio-survey__nav">
         <button type="button" class="btn btn-neutral" data-survey-back hidden>Back</button>
-        <button type="button" class="btn btn-primary studio-survey__forward" data-survey-next hidden>Start</button>
+        <button type="button" class="btn btn-primary studio-survey__forward" data-survey-next hidden>Next</button>
         <button type="submit" class="btn btn-primary studio-survey__forward" data-survey-submit>Submit</button>
       </div>
       <p class="studio-survey__status" aria-live="polite" data-survey-status></p>

data/lib/studio/engine.rb

@@ -113,8 +113,8 @@ module Studio
     # skip :require_authentication, its mailers and jobs subclass ActionMailer
     # and ActiveJob, and the two concerns roots (app/controllers/concerns,
     # app/models/concerns) are roots of their OWN to Zeitwerk: excluding
-    # app/models does not exclude app/models/concerns, and Sluggable and
-    # Studio::UserProfile sit there. They stay lazily loadable, and nothing in a
+    # app/models does not exclude app/models/concerns, and Sluggable sits
+    # there. They stay lazily loadable, and nothing in a
     # host that draws no Studio.routes asks for them.
     #
     # Read off the engine's own eager-load paths rather than listed, so a root

data/lib/studio/survey.rb

@@ -241,6 +241,15 @@ module Studio
     def keys = questions.map(&:key)
     def required_keys = questions.select(&:required?).map(&:key)
 
+    # True when the title says what the first question asks ("How was your
+    # first game?" twice). The survey opens on that question, so the stepper
+    # keeps the title as the page's heading for a screen reader but does not
+    # paint it twice. Compared on letters and digits alone, ignoring case.
+    def title_repeats_first_question?
+      squash = ->(text) { text.to_s.downcase.gsub(/[^[:alnum:]]/, "") }
+      squash.call(title) == squash.call(questions.first.label)
+    end
+
     private
 
     def validate!

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.88.0"
+  VERSION = "0.90.0"
 end

data/lib/studio.rb

@@ -839,6 +839,10 @@ module Studio
   # Studio::ProfilesController to get it would couple the two for no reason.
   FIRST_NAME_MAX_LENGTH = 40
 
+  # The house palette for initial-circle backgrounds. /u/:username hashes the
+  # username into it, so one person draws the same circle on every render.
+  AVATAR_COLORS = %w[#EF4444 #F97316 #EAB308 #22C55E #06B6D4 #3B82F6 #8B5CF6 #EC4899].freeze
+
   # How long a WHOLE typed answer may be — one string holding a full name, which
   # the onboarding step stores as users.name and SPLITS into the two halves
   # above (Studio::NameParts).
@@ -914,14 +918,6 @@ module Studio
     true
   end
 
-  # Optional admin Act As / impersonation session conventions. Consumers that
-  # include Studio::Impersonation get current_user layered over true_user with
-  # these session keys, but still own authorization, audit logging, and routes.
-  mattr_accessor :impersonation_target_session_key, default: :impersonated_user_id
-  mattr_accessor :impersonation_actor_session_key,  default: :true_admin_id
-  mattr_accessor :impersonation_started_at_session_key, default: :impersonation_started_at
-  mattr_accessor :impersonation_max_minutes, default: 30
-
   # Cap for the host app's local (development + test) log file, in bytes.
   # nil means "use the engine's defaults" — Studio::Engine::DEVELOPMENT_LOG_MAX_BYTES
   # and ::TEST_LOG_MAX_BYTES. An Integer sets your own cap; `false` opts out and
@@ -1530,9 +1526,6 @@ module Studio
       # stores this app's own override; destroy drops it back to the inherited
       # default. Surfaced from each app's admin sidebar.
       #
-      # /admin/email_images redirects here but KEEPS its admin_email_images_path
-      # helper, so a shipped host sidebar link on the old helper still resolves
-      # (same treatment as /admin/design_system -> /admin/style).
       # OPT-IN, and it has to be. turf-monster ALREADY owns /admin/emails —
       # `namespace :admin { get "emails", as: :emails }` (its EmailCatalog
       # manager) — which claims the SAME path and the SAME helper names,
@@ -1592,17 +1585,6 @@ module Studio
              as: :onboarding_skip_first_name
       end
 
-      # DEPRECATED, kept for ONE release. Not a redirect: consumer-ci.yml runs
-      # each consumer's DEFAULT-BRANCH suite against this engine, and both
-      # mcritchie-studio and turf-monster have tests on `main` that GET this page
-      # and PATCH through admin_email_image_path. Redirecting (or deleting) here
-      # reddens their lanes the moment the PR opens, and no change inside the
-      # engine PR can fix it. Each app's adoption task moves its link + tests; a
-      # later engine minor deletes these two routes with the controller and view.
-      get   "admin/email_images",          to: "studio/email_images#index",  as: :admin_email_images
-      patch "admin/email_images/:variant", to: "studio/email_images#update", as: :admin_email_image,
-            constraints: { variant: /[a-z_]+/ }
-
       # Surveys (docs/SURVEYS.md). Both halves OPT-IN — see
       # Studio.draw_survey_routes and Studio.draw_admin_survey_routes.
       if Studio.draw_survey_routes

data/studio-engine.gemspec

@@ -40,7 +40,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency "mini_magick", "~> 5.0"
   spec.add_dependency "resend", "~> 1.1"
   # Realtime: the redis cable/cache/Sidekiq adapter (Studio::Redis) + Turbo Streams
-  # broadcasting (Studio::Broadcastable). `redis` is the dependency whose ABSENCE
+  # broadcasting (Studio::Cable). `redis` is the dependency whose ABSENCE
   # 500'd a host app's task board — declaring it here makes that impossible to repeat.
   #
   # The `< 6` ceiling is ActionCable's, not ours. Its redis pubsub adapter

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.88.0
+  version: 0.90.0
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-05 00:00:00.000000000 Z
+date: 2026-10-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -323,7 +323,6 @@ files:
 - app/controllers/concerns/studio/board/reorderable.rb
 - app/controllers/concerns/studio/error_handling.rb
 - app/controllers/concerns/studio/geo_detection.rb
-- app/controllers/concerns/studio/impersonation.rb
 - app/controllers/concerns/studio/link_consumption.rb
 - app/controllers/concerns/studio/link_preview_bots.rb
 - app/controllers/concerns/studio/magic_link_issuing.rb
@@ -338,7 +337,6 @@ files:
 - app/controllers/solana_sessions_controller.rb
 - app/controllers/studio/admin_surveys_controller.rb
 - app/controllers/studio/bookings_controller.rb
-- app/controllers/studio/email_images_controller.rb
 - app/controllers/studio/emails_controller.rb
 - app/controllers/studio/geo_settings_controller.rb
 - app/controllers/studio/knowledge_docs_controller.rb
@@ -373,8 +371,6 @@ files:
 - app/mailers/user_mailer.rb
 - app/models/concerns/sluggable.rb
 - app/models/concerns/studio/board/rankable.rb
-- app/models/concerns/studio/broadcastable.rb
-- app/models/concerns/studio/user_profile.rb
 - app/models/current.rb
 - app/models/error_log.rb
 - app/models/image_cache.rb
@@ -399,18 +395,15 @@ files:
 - app/views/components/_avatar.html.erb
 - app/views/components/_avatar_cropper.html.erb
 - app/views/components/_badge.html.erb
-- app/views/components/_card.html.erb
 - app/views/components/_copy_button.html.erb
 - app/views/components/_emoji_swap.html.erb
 - app/views/components/_empty_state.html.erb
 - app/views/components/_geo_badge.html.erb
 - app/views/components/_geo_signpost.html.erb
 - app/views/components/_google_logo.html.erb
-- app/views/components/_input.html.erb
 - app/views/components/_json_debug.html.erb
 - app/views/components/_link_sidebar.html.erb
 - app/views/components/_link_sidebar_trigger.html.erb
-- app/views/components/_progress_bar.html.erb
 - app/views/components/_sidebar_panel.html.erb
 - app/views/components/_theme_toggle.html.erb
 - app/views/components/_theme_toggle_morph.html.erb
@@ -458,7 +451,6 @@ files:
 - app/views/studio/booking/_frame.html.erb
 - app/views/studio/booking/_popup.html.erb
 - app/views/studio/bookings/show.html.erb
-- app/views/studio/email_images/index.html.erb
 - app/views/studio/emails/_banner_editor.html.erb
 - app/views/studio/emails/_banner_preview.html.erb
 - app/views/studio/emails/_banner_scale.html.erb

data/app/controllers/concerns/studio/impersonation.rb

@@ -1,90 +0,0 @@
-require "time"
-
-module Studio
-  module Impersonation
-    extend ActiveSupport::Concern
-
-    included do
-      if respond_to?(:helper_method)
-        helper_method :true_user, :impersonated_user, :impersonating?, :impersonation_started_at
-      end
-    end
-
-    private
-
-    # The real session owner. While acting as another user, this remains the
-    # admin/operator account whose session token should be verified.
-    def true_user
-      return @true_user if defined?(@true_user)
-
-      @true_user = User.find_by(id: session[Studio.session_key])
-    end
-
-    # The currently visible user. Consumers with extra wallet or privilege state
-    # can override this and still call true_user/impersonating? from the concern.
-    def current_user
-      return @current_user if defined?(@current_user)
-
-      @current_user = impersonating? ? impersonated_user : true_user
-    end
-
-    def impersonated_user
-      return @impersonated_user if defined?(@impersonated_user)
-
-      @impersonated_user = User.find_by(id: session[Studio.impersonation_target_session_key])
-    end
-
-    def impersonating?
-      return @impersonating if defined?(@impersonating)
-
-      @impersonating = compute_impersonating?
-    end
-
-    def start_impersonation_session(target_user, actor: true_user)
-      session[Studio.impersonation_actor_session_key] = actor.id
-      session[Studio.impersonation_target_session_key] = target_user.id
-      session[Studio.impersonation_started_at_session_key] = Time.current.iso8601
-      reset_impersonation_memoization
-    end
-
-    def clear_impersonation_session
-      session.delete(Studio.impersonation_actor_session_key)
-      session.delete(Studio.impersonation_target_session_key)
-      session.delete(Studio.impersonation_started_at_session_key)
-      reset_impersonation_memoization
-    end
-
-    def impersonation_started_at
-      raw = session[Studio.impersonation_started_at_session_key]
-      return nil if raw.blank?
-
-      return raw if raw.is_a?(Time)
-
-      zone = Time.zone if Time.respond_to?(:zone)
-      zone ? zone.parse(raw.to_s) : Time.parse(raw.to_s)
-    rescue ArgumentError, TypeError
-      nil
-    end
-
-    def compute_impersonating?
-      return false if session[Studio.impersonation_target_session_key].blank?
-      return false unless true_user&.respond_to?(:admin?) && true_user.admin?
-      return false unless impersonation_started_at
-      return false if impersonation_started_at < Studio.impersonation_max_minutes.to_i.minutes.ago
-
-      target = impersonated_user
-      target.present? &&
-        (!target.respond_to?(:admin?) || !target.admin?) &&
-        target.id != true_user.id
-    rescue StandardError
-      false
-    end
-
-    def reset_impersonation_memoization
-      remove_instance_variable(:@current_user) if defined?(@current_user)
-      remove_instance_variable(:@true_user) if defined?(@true_user)
-      remove_instance_variable(:@impersonated_user) if defined?(@impersonated_user)
-      remove_instance_variable(:@impersonating) if defined?(@impersonating)
-    end
-  end
-end

data/app/controllers/studio/email_images_controller.rb

@@ -1,76 +0,0 @@
-module Studio
-  # DEPRECATED — superseded by Studio::EmailsController (/admin/emails), which
-  # shows every registered email with its live image, says whether that image is
-  # the inherited default or app-owned, and uploads through the crop modal.
-  #
-  # Kept alive for ONE release on purpose, not by neglect. consumer-ci.yml checks
-  # out each consumer repo with no `ref:` — i.e. its DEFAULT BRANCH — and runs
-  # that suite against the engine PR. mcritchie-studio and turf-monster both have
-  # tests on `main` that drive this page and its admin_email_image_path helper,
-  # so deleting it here would redden their lanes from the moment the PR opens,
-  # and nothing inside the engine PR could fix it: the consumer PRs would have to
-  # travel accepted -> release -> main in BOTH apps before this could go green.
-  #
-  # So the retirement is staged: this release adds /admin/emails and leaves this
-  # page working; each app's adoption task moves its link and its tests; a later
-  # engine minor deletes this file, its view, and its two routes once no
-  # consumer's main references them.
-  #
-  # It is not frozen in its broken state, though — see #index.
-  class EmailImagesController < ApplicationController
-    before_action :require_admin
-
-    MAX_BYTES = 8.megabytes
-
-    def index
-      @variants = Studio::EmailCatalog.variants
-    end
-
-    # The canonical page this one is being retired in favour of, or nil when this
-    # app has not drawn it. Rendered as a banner at the top of the old view so an
-    # admin who lands here by a stale link is walked forward.
-    #
-    # The nil case is REAL, not defensive padding: /admin/emails is opt-in
-    # (Studio.draw_admin_emails_routes, default off because turf-monster owns the
-    # name), so on any app that has not opted in the helper does not exist and a
-    # bare call raises NameError — which 500s this page. Consumer CI caught
-    # exactly that on mcritchie-studio.
-    #
-    # Asks the ROUTER rather than the config flag: the flag is read at route-draw
-    # time, so a host that flips it afterwards would still have no route, and the
-    # router is the thing that actually knows.
-    def successor_path
-      return nil unless Rails.application.routes.named_routes.key?(:admin_emails)
-
-      admin_emails_path
-    end
-    helper_method :successor_path
-
-    # PATCH /admin/email_images/:variant — upload/replace a banner.
-    def update
-      variant = params[:variant].to_s
-      return head :not_found unless Studio::EmailCatalog.known?(variant)
-
-      file = params[:image]
-      unless valid_image?(file)
-        message = file.blank? ? "Choose an image to upload." : "Use a PNG, JPG, or WebP under 8 MB."
-        return redirect_to admin_email_images_path, alert: message, status: :see_other
-      end
-
-      rescue_and_log do
-        Studio::EmailCatalog.store(variant, io: file, content_type: file.content_type)
-        redirect_to admin_email_images_path, notice: "#{Studio::EmailCatalog.label(variant)} banner updated."
-      end
-    rescue StandardError
-      redirect_to admin_email_images_path, alert: "Couldn't save the image. Please try again.", status: :see_other
-    end
-
-    private
-
-    def valid_image?(file)
-      file.respond_to?(:content_type) &&
-        file.content_type.to_s.start_with?("image/") &&
-        file.respond_to?(:size) && file.size.to_i.positive? && file.size <= MAX_BYTES
-    end
-  end
-end

data/app/models/concerns/studio/broadcastable.rb

@@ -1,40 +0,0 @@
-# frozen_string_literal: true
-
-module Studio
-  # Mixin for ActiveRecord models that broadcast Turbo Streams. It wraps
-  # turbo-rails' broadcast_*_to methods in Studio::Cable.safe_broadcast, so a cable
-  # failure (a Redis hiccup, a missing/misconfigured adapter) can NEVER break the
-  # model save / after_commit that triggered the broadcast — the SEV-1 guard, in
-  # one place. The host model already has the raw broadcast_*_to methods (turbo-rails
-  # includes Turbo::Broadcastable into ActiveRecord::Base); these are the SAFE
-  # variants every app should broadcast through.
-  #
-  #   class Task < ApplicationRecord
-  #     include Studio::Broadcastable
-  #     after_create_commit { safe_broadcast_replace_to [:board], target: "card_#{id}",
-  #                                                       partial: "tasks/card", locals: { task: self } }
-  #   end
-  module Broadcastable
-    extend ActiveSupport::Concern
-
-    def safe_broadcast_replace_to(*args, **kwargs, &block)
-      Studio::Cable.safe_broadcast { broadcast_replace_to(*args, **kwargs, &block) }
-    end
-
-    def safe_broadcast_update_to(*args, **kwargs, &block)
-      Studio::Cable.safe_broadcast { broadcast_update_to(*args, **kwargs, &block) }
-    end
-
-    def safe_broadcast_append_to(*args, **kwargs, &block)
-      Studio::Cable.safe_broadcast { broadcast_append_to(*args, **kwargs, &block) }
-    end
-
-    def safe_broadcast_prepend_to(*args, **kwargs, &block)
-      Studio::Cable.safe_broadcast { broadcast_prepend_to(*args, **kwargs, &block) }
-    end
-
-    def safe_broadcast_remove_to(*args, **kwargs, &block)
-      Studio::Cable.safe_broadcast { broadcast_remove_to(*args, **kwargs, &block) }
-    end
-  end
-end

data/app/models/concerns/studio/user_profile.rb

@@ -1,111 +0,0 @@
-# frozen_string_literal: true
-
-require "digest"
-
-module Studio
-  # The four things every Studio app's User has had to define for itself: how to
-  # name a person on screen, and how to draw them when they have no picture.
-  #
-  # WHY THIS EXISTS. The engine's own components/_avatar partial calls
-  # `display_name`, `avatar_initials` and `avatar_color` — and the engine has
-  # never provided any of them. Every consumer wrote its own; mcritchie-industries'
-  # user.rb even carries a comment explaining that it must, because the engine's
-  # nav renders the partial. Three copies, and by 2026-08-14 they had drifted:
-  #
-  #   mcritchie-studio      name → email prefix (capitalized) → wallet → "anon"
-  #   mcritchie-industries  name → email prefix (raw)                  → "User"
-  #   turf-monster          username → name → email prefix (cap) → wallet → "anon"
-  #
-  # Same intent, three answers, and two different words for the same empty state.
-  # That is the drift a concern removes.
-  #
-  # ON THE MERGED CHAIN. It is turf-monster's — the richest of the three — with
-  # `first_name` folded in after `name`, because /profile now lets people set that
-  # field and a name someone just typed should be the name they see. Apps missing
-  # a link in the chain simply skip it; the chain is respond_to?-guarded end to
-  # end, so mcritchie-industries' eight-column users table walks it without
-  # raising. One consequence worth stating rather than burying: an MI user with no
-  # name now falls back to "anon" instead of "User", and an email-derived name is
-  # capitalized. That is MI adopting the house standard, and its adoption task
-  # owns the change.
-  #
-  # EVERY METHOD IS OVERRIDABLE. These are plain instance methods from an included
-  # module, so a host that defines its own `display_name` in the class body wins
-  # outright. Standardizing the default is the goal; forbidding an app from having
-  # an opinion is not.
-  module UserProfile
-    extend ActiveSupport::Concern
-
-    # The house palette for initial-circle backgrounds. Identical in all three
-    # apps today, which is the clearest possible signal it belonged here.
-    AVATAR_COLORS = %w[#EF4444 #F97316 #EAB308 #22C55E #06B6D4 #3B82F6 #8B5CF6 #EC4899].freeze
-
-    # What to call this person on screen.
-    def display_name
-      studio_profile_username.presence ||
-        studio_profile_attr(:name).presence ||
-        studio_profile_attr(:first_name).presence ||
-        studio_profile_email_prefix.presence ||
-        studio_profile_wallet.presence ||
-        "anon"
-    end
-
-    # One character for the initials circle. Deliberately NOT derived from
-    # display_name: that chain ends in a wallet address or the word "anon", and
-    # "a" for every anonymous account is worse than a neutral mark.
-    def avatar_initials
-      source = studio_profile_username.presence ||
-               studio_profile_attr(:name).presence ||
-               studio_profile_attr(:first_name).presence ||
-               studio_profile_email_prefix.presence
-
-      # `source[0]`, not ActiveSupport's `String#first`: this module is included
-      # into a host model, and nothing here should depend on which core_ext that
-      # host happens to have loaded. Plain Ruby costs nothing and cannot vanish.
-      source.presence.to_s[0]&.upcase || "?"
-    end
-
-    # A stable colour for this account — same person, same circle, every render.
-    # Hashed rather than random for exactly that reason, and keyed off identity
-    # fields so it survives a display-name change.
-    def avatar_color
-      key = studio_profile_username.presence ||
-            studio_profile_attr(:name).presence ||
-            studio_profile_attr(:email).presence ||
-            id.to_s
-
-      AVATAR_COLORS[Digest::MD5.hexdigest(key.to_s).hex % AVATAR_COLORS.size]
-    end
-
-    private
-
-    # Read an attribute only if this host's model actually has it. The whole
-    # tolerance of the chain lives in this one method.
-    def studio_profile_attr(attribute)
-      return nil unless respond_to?(attribute)
-
-      public_send(attribute)
-    end
-
-    # `username` is turf-monster's on-chain handle and does not exist in the hub
-    # apps. It leads the chain where it exists because it is what that app's
-    # people call each other.
-    def studio_profile_username
-      studio_profile_attr(:username)
-    end
-
-    def studio_profile_email_prefix
-      email = studio_profile_attr(:email)
-      return nil if email.blank?
-
-      email.to_s.split("@").first.to_s.capitalize
-    end
-
-    # Defers to the host's own truncation rather than reformatting an address
-    # here — mcritchie-studio and turf-monster both define `truncated_solana`,
-    # and turf's has to pick between a web2 and a web3 address to do it.
-    def studio_profile_wallet
-      studio_profile_attr(:truncated_solana)
-    end
-  end
-end

data/app/views/components/_card.html.erb

@@ -1,4 +0,0 @@
-<%# locals: (padding: "p-6") %>
-<div class="card <%= padding %>">
-  <%= yield %>
-</div>

data/app/views/components/_input.html.erb

@@ -1,13 +0,0 @@
-<%# locals: (form:, field:, label: nil, type: "text", placeholder: nil, rows: nil) %>
-<div class="mb-5">
-  <% if label.present? %>
-    <label class="block text-sm text-secondary mb-2 font-medium"><%= label %></label>
-  <% end %>
-  <% if type.to_s == "textarea" %>
-    <%= form.text_area field, rows: rows || 4, class: "input-field", placeholder: placeholder %>
-  <% elsif type.to_s == "password" %>
-    <%= form.password_field field, class: "input-field", placeholder: placeholder %>
-  <% else %>
-    <%= form.text_field field, class: "input-field", placeholder: placeholder %>
-  <% end %>
-</div>

data/app/views/components/_progress_bar.html.erb

@@ -1,9 +0,0 @@
-<%# locals: (percent:, height: "h-3", color: "var(--color-cta)", label: nil, animated: false) %>
-<div class="w-full <%= height %> rounded-full bg-surface-alt overflow-hidden">
-  <div class="h-full rounded-full<%= ' transition-all duration-500 ease-out' if animated %>"
-       style="width: <%= [percent.to_f, 100].min %>%; background-color: <%= color %>">
-  </div>
-</div>
-<% if label %>
-  <p class="text-xs text-muted mt-1"><%= label %></p>
-<% end %>

data/app/views/studio/email_images/index.html.erb

@@ -1,74 +0,0 @@
-<%# DEPRECATED page — superseded by /admin/emails (studio/emails/index).
-    Kept for one release so consumer suites on their default branch keep passing;
-    see Studio::EmailImagesController for the full staging note. %>
-<% content_for(:title) { "Email images" } %>
-<div class="max-w-2xl mx-auto px-4 py-8">
-  <header class="mb-6">
-    <h1 class="text-2xl font-bold">Email images</h1>
-    <p class="text-sm text-muted mt-1">
-      The banner shown at the top of branded transactional emails. Recommended
-      width 600px (it's displayed full-bleed at the top of the email card).
-    </p>
-  </header>
-
-  <%# Only when this app actually DREW /admin/emails — it is opt-in, and pointing
-      at a route that does not exist raises NameError and 500s this page. %>
-  <% if successor_path %>
-    <div class="mb-6 rounded-xl border border-subtle bg-inset px-4 py-3">
-      <p class="text-sm font-semibold text-heading">There's a better page now</p>
-      <p class="text-sm text-body mt-1">
-        <%= link_to "Emails", successor_path, class: "underline underline-offset-2" %>
-        lists every email this app sends with its live banner, says whether that
-        banner is the shared default or this app's own, and crops on upload.
-        This page is going away.
-      </p>
-    </div>
-  <% end %>
-
-  <% flash.each do |type, message| %>
-    <div class="mb-4 rounded-lg px-4 py-3 text-sm bg-surface border <%= type.to_s == "alert" ? "border-danger/30 text-danger-ink" : "border-success/30 text-success-ink" %>">
-      <%= message %>
-    </div>
-  <% end %>
-
-  <div class="space-y-6">
-    <% @variants.each do |variant, label| %>
-      <%# preview_url, not url: this page's ORIGINAL BUG was reading only the S3
-          override, so it announced "No image yet" for an email that was visibly
-          sending a banner from a committed repo asset. Even on its way out it
-          should tell the truth about what ships. %>
-      <% current_url = Studio::EmailCatalog.preview_url(variant) %>
-      <%# NOT `== :default` — that value split into :app_asset / :engine_default.
-          Comparing against a value nothing returns would silently never show
-          this note again. Anything that is not an upload is still inherited
-          from a file, which is all this retiring page needs to say. %>
-      <% inherited = current_url.present? && Studio::EmailCatalog.source(variant) != :app %>
-      <section class="rounded-xl border border-subtle p-5">
-        <h2 class="font-semibold mb-3"><%= label %></h2>
-
-        <div class="rounded-lg overflow-hidden border border-subtle mb-3" style="aspect-ratio: 600 / 240; background: linear-gradient(135deg, var(--color-primary-700), var(--color-primary-900));">
-          <% if current_url %>
-            <%= image_tag current_url, class: "w-full h-full object-cover", alt: "#{label} email banner" %>
-          <% else %>
-            <div class="w-full h-full flex items-center justify-center text-xs text-white/80 text-center px-4">
-              No image yet — emails send without a banner until you upload one.
-            </div>
-          <% end %>
-        </div>
-
-        <% if inherited %>
-          <p class="text-xs text-muted mb-3">
-            This is the shared default that ships with the engine. Uploading here
-            makes the image this app's own.
-          </p>
-        <% end %>
-
-        <%= form_with url: admin_email_image_path(variant), method: :patch, html: { multipart: true }, class: "flex flex-wrap items-center gap-3" do %>
-          <%= file_field_tag :image, accept: "image/png,image/jpeg,image/webp",
-                class: "text-sm file:mr-3 file:rounded-md file:border-0 file:bg-primary file:px-3 file:py-1.5 file:text-white file:cursor-pointer" %>
-          <%= submit_tag(current_url ? "Replace image" : "Upload image", class: "btn btn-primary btn-sm") %>
-        <% end %>
-      </section>
-    <% end %>
-  </div>
-</div>