studio-engine 0.137.0 → 0.138.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 448f5dc2b80db8f30bb9d05849d581065592b28f2189062424bfd26c25acdc63
-  data.tar.gz: 68b40d7dd6cbc3bc2f8c9e19f409755e1c7e1d1ece531e1689542f32fdeccb7c
+  metadata.gz: cb1274e13e7eca7030835c5ff43a48a897f01e723273ec60e4f5eb334e190c85
+  data.tar.gz: a8e5bb472135b9f72a8662026dac450d2b0830dd30d6913a504c0ced09e57dd2
 SHA512:
-  metadata.gz: 93377b901882007a34b2bb4ffc855ed5078cfb02e8cc35a58e9afe102df2d832d046f7531d95996a4899259a6bbfe0359d6a64ebd32370e7ca8fb274a27cd3bb
-  data.tar.gz: 4781ef35c39d5cdde579d71cf8ad93e26abb5896895480aece83c315b2e944fc48b959b09589c34e6c62354dbe2d7aa1a7746980dafd299d24023e80e74a9ae8
+  metadata.gz: 4184a55e11cf2e7c3146c73520878a5e1edbc6802bcb19eb9a3c61b09d6d73912a867c98bbd56772d664dc4bf2bace1a152a864c36c1447102bf83d7d0d444df
+  data.tar.gz: d06d58547262873513c597eb54f8313e76ac8bbbc3dcc7d6693a5a12ffbc23b4c08eeb782a94edf384d4af09bc3f83eda27845f5fc5a112af339c8ada5269bc0

data/CHANGELOG.md

@@ -4,6 +4,29 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+## 0.138.0 — 2026-11-08
+
+### Added
+
+- **`studio/_carousel` takes `style: :cascade`, a 3D stacked carousel.** The open slide sits in front at full size; the slides either side step back behind it, each step smaller, deeper and dimmer, turned a little toward the centre. `visible: 5` (the default) shows two each side, `visible: 3` one, and a region under 36rem wide shows one whatever it asks. Arrows, dots, keys, swipe or drag, a click on a side slide and keyboard focus bring a slide to the front; `loop:`, `start:`, `autoplay:` and `caption:` work as on the spotlight, and a looping cascade needs no clones. Reduced motion lays it flat as a spotlight row. `:standard` and `:spotlight` render byte for byte as before. A host adopts it by changing `style: :spotlight` to `style: :cascade`; `visible:` on any other style raises.
+- **Shared reveal waits for page transition specs.** `e2e_helpers.js` adds `watchReveal`, `revealed`, `settled`, `arrivalSettled`, `frames`, `sessionLog` and `logOnRed`, moved from the engine's full-load spec. They wait on the new page's `pagereveal` and its view transition, never on a pause, and a red prints and attaches the event log. A host's own transition spec can drop its copies and require these from `node_modules/.studio-engine/e2e_helpers.js`.
+- **Integrations registry: QuickBooks, Egnyte and Microsoft 365 connection definitions, and an admin page.** The engine now ships a connection definition for each (URLs, scopes, token behaviour, a one-call describe of the account; no reader). QuickBooks keeps its access token until 5 minutes before it expires or a 401, then refreshes once under the row lock and stores the rotated refresh token; it captures Intuit's `intuit_tid` header on every call (new generic `trace_header:` provider option: logged per call, `provider.last_trace_id`, and on every raised error as `trace_id` and in its message). A host enables one in an initializer with `Studio.enable_integration :quickbooks, env: { client_id: "...", client_secret: "..." }`, naming its own env vars, and mounts `Studio.draw_integrations_routes(self)`: `/admin/integrations` lists each status and Connect, and `/admin/integrations/<key>` shows its connections, Disconnect, the redirect URI to register (`/admin/integrations/<key>/callback`) and the host's own panel (`panel:`). Stand-ins walk a connect end to end in development and test. See `docs/INTEGRATIONS.md`.
+- **`Studio::Account`, the engine-owned account contract.** `include Studio::Account` in `User` gives `admin?`, a default `display_name`, `normalizes :email` (blank stored as NULL), `validates :role, inclusion:` against the new `Studio::Roles` (`viewer`, `member`, `admin`; a host may narrow it with `studio_roles`, never widen it), `Sluggable` and `Studio::OmniauthUser`. `Studio::Account.find_by_email` is the one safe lookup by address (blank finds nobody, `LOWER(email)`), and `Studio::Account.race_winner` is the race rescue for a host's own `from_omniauth` (verified address only; logs to `ErrorLog.capture!` when nothing matches). The new host migration `AddUsersRoleKnownCheck` installs CHECK `users_role_known` and NOT NULL, skips an app that already has the CHECK, and refuses on a stray role. Nothing changes until an app includes the concern or installs the migration. See docs/USER_CONTRACT.md, "The account concern". (The audit called it `Studio::User`; that name would shadow the host's `User` inside `module Studio`.)
+
+### Changed
+
+- **A local-review provisioning miss is logged to ErrorLog.** `Studio::LocalReviewsController` still mints the link when it cannot provision the reviewer, and now records the reason with `ErrorLog.capture!` as well as the Rails log. The likeliest cause after `Studio::Account`: `Studio.local_review_role` names a role the app's list refuses.
+- **The engine's own tables meet the hub's database standard.** Two new migrations, for every host. `RequireSlugsOnEngineTables` makes `slug` NOT NULL with a unique index on `error_logs`, `theme_settings`, `studio_geo_settings` and `studio_site_identities`. It first fills a NULL or blank slug the way the model writes one (`error-log-<id>`, `theme-<app>`, `geo-<app>`, `site-identity-<app>`), and gives a duplicate after the first `-<id>`. `AddEngineStateChecks` adds CHECK `studio_links_kind_known` (`Studio::LinkToken::KINDS`) and `studio_knowledge_docs_status_known` (`Studio::KnowledgeDoc::STATUSES`), and stops with the stray values named if a row holds another value. Production held no NULL slug, no duplicate and no stray value on 2026-11-08. `ErrorLog` now includes `Sluggable`, so a bare `ErrorLog.create!` gets `error-log-<id>` too, and a host's own `update_column(:slug, "error-log-#{log.id}")` after a create may go. To adopt, use two releases, model first. Release one bumps the gem only: the new `ErrorLog` writes a slug on the old nullable column. Release two runs `bin/rails studio_engine:install:migrations && bin/rails db:migrate` and commits `db/schema.rb`. In one release, old dynos insert a NULL slug until the restart, and a failed release or a `heroku rollback` leaves old code on the NOT NULL column, so every `ErrorLog` write fails; undo it with `bin/rails db:migrate:down VERSION=20261108160000` before the rollback. A host whose own state registry lists `studio_knowledge_docs.status` as unconstrained (the hub's `StringStates`) moves it to a checked entry.
+
+### Fixed
+
+- **A local e2e run no longer reuses another tree's server.** `playwright_base.js` reuses a server already on the e2e port only when its working directory (read with `lsof`) is inside this tree. A sibling desk's server on the shared default port is refused, with a warning that names its root; give the run its own port with `E2E_PORT`. CI is unchanged: it never reuses a server.
+- **Connect's refusal of a mistyped account now reads "That is not a valid <label> account."** It read "not a Egnyte account" for a label that starts with a vowel. A host test that matched the old text matches the new one.
+
+### Security
+
+- **The engine's sign-in doors find nobody for a blank email.** `SessionsController#create` and the SSO "Continue as" path looked the account up with `User.find_by(email: ...)`. With no address that is `find_by(email: nil)`, which matches any account without an email (a wallet or guest sign-up): the password door handed that account to `authenticate`, and the SSO path signed it in. Both now use `Studio::Account.find_by_email`, which also matches case-insensitively. Nothing for a consumer to change.
+
 ## 0.137.0 — 2026-11-08
 
 ### Added

data/README.md

@@ -51,7 +51,8 @@ resolved.
 - **Voice profile**: an opt-in row on `/profile` ("Set up your voice"): the person reads three phrases with a live level meter, their device turns each take into a speaker embedding (WeSpeaker via transformers.js), and only the averaged vector is saved on their user, never audio. `Studio::VoiceMatch.identify(embedding, among: User.all, model:)` answers who is speaking. Turn it on with `config.voice_profile = true` after installing the migration. See [`docs/VOICE_PROFILE.md`](docs/VOICE_PROFILE.md).
 - **Voice capture**: the microphone chip (names the microphone a page records from, picks another, Chrome help dialog), one level meter, and a record button that refuses a silent take and hands a heard one to the page as a `studio:voice-recorder:take` event with the blob; it uploads nothing. Render `studio/voice/microphone_chip` and `studio/voice/recorder`. See [`docs/VOICE_CAPTURE.md`](docs/VOICE_CAPTURE.md).
 - **Voice transcription**: `POST /voice/takes` (opt-in, `config.voice_transcription = true`) turns a signed-in user's take into `{text, speaker, score}`: a mock-first transcriber (OpenAI `gpt-4o-transcribe` in production, a mock elsewhere, a no-live-calls trap in every test environment) and `Studio::VoiceMatch` against the user's own saved voice. Nothing is kept. See [`docs/VOICE_TRANSCRIPTION.md`](docs/VOICE_TRANSCRIPTION.md).
-- **Connections**: generic OAuth 2.0 tooling to connect a third-party account. A host declares each provider with `Studio.define_connection` (endpoints, static or per-account; scopes; form or HTTP Basic client auth; a rotating, cached or client-credentials refresh policy). The engine gives it `Studio::Connection` (one table, tokens encrypted, `bin/rails g studio:connections`), the connect, callback and disconnect actions (`Studio::ConnectionFlow`) behind the host's admin guard, `Studio.draw_connection_routes`, an exact-key log filter, and a stand-in for the e2e lane. The engine names no provider. See [`docs/CONNECTIONS.md`](docs/CONNECTIONS.md).
+- **Connections**: generic OAuth 2.0 tooling to connect a third-party account. A host declares each provider with `Studio.define_connection` (endpoints, static or per-account; scopes; form or HTTP Basic client auth; a rotating, cached or client-credentials refresh policy). The engine gives it `Studio::Connection` (one table, tokens encrypted, `bin/rails g studio:connections`), the connect, callback and disconnect actions (`Studio::ConnectionFlow`) behind the host's admin guard, `Studio.draw_connection_routes`, an exact-key log filter, and a stand-in for the e2e lane. The tooling names no provider; the engine's own definitions are the Integrations below. See [`docs/CONNECTIONS.md`](docs/CONNECTIONS.md).
+- **Integrations**: ready connection definitions on that tooling for QuickBooks, Egnyte and Microsoft 365: the URLs, scopes, token behaviour and a minimal describe, never a reader. A host turns one on with `Studio.enable_integration :quickbooks, env: { client_id: "...", client_secret: "..." }` (env var names) and mounts the admin page with `Studio.draw_integrations_routes(self)`: a list with each status and Connect, and one page per integration with Disconnect and a host panel for the host's own live read. See [`docs/INTEGRATIONS.md`](docs/INTEGRATIONS.md).
 - **Surveys**: define a survey in app code (`config/surveys/*.rb`, `Studio.define_survey`) with six question types — emoji scale, 1–5 rating, single and multiple choice, short and long text — and the engine serves it at `/surveys/:slug`: one question per screen, autosave, resume, keyboard shortcuts, and a no-JavaScript fallback. `config.on_survey_completed` and `config.survey_ref_resolver` let the app fire its own goals and attribute email arrivals. An admin panel at `/admin/surveys` breaks results down per question and exports CSV. Opt in with `config.draw_survey_routes = true` and `config.draw_admin_survey_routes = true`. See [`docs/SURVEYS.md`](docs/SURVEYS.md).
 
 ## Tailwind
@@ -257,6 +258,8 @@ Set `Studio.draw_survey_routes = true` to add the public survey pages (`/surveys
 
 For each connection provider a host declares, `Studio.draw_connection_routes(self, :files, path: "admin/files")` adds its connect (`GET`/`POST /admin/files/connect`), callback (`GET /admin/files/callback`, the redirect URI to register) and disconnect (`DELETE /admin/files/connections/:id`) routes. Nothing is drawn for a provider the host has not declared. They need the `studio_connections` table (`bin/rails g studio:connections`; [`docs/CONNECTIONS.md`](docs/CONNECTIONS.md)).
 
+`Studio.draw_integrations_routes(self)` draws the admin integrations page at `GET /admin/integrations` and, for each integration enabled with `Studio.enable_integration`, its page (`GET /admin/integrations/<key>`) and its connection routes under that path. QuickBooks's callback is then `/admin/integrations/quickbooks/callback` ([`docs/INTEGRATIONS.md`](docs/INTEGRATIONS.md)).
+
 **Magic links need the `studio_links` table.** Install it with `bin/rails studio_engine:install:migrations && bin/rails db:migrate` (install all of them) before enabling `:magic_link` — never by hand-copying the migration, which collides with the task's own copy on `class CreateStudioLinks`. Without the table, the first sign-in raises `Studio::Link::MissingTable`.
 
 Set `Studio.agent_chat_souls = %w[alex]` to add the shared agent chat's proxy (`POST /agent_chat/messages`, `GET /agent_chat/turns`), which forwards to the McRitchie Studio hub with the app's `AGENT_CHAT_TOKEN`; then `render "studio/agent_chat/chat", soul: "alex", name: "Alex", portrait: ...` on any page, with `voice: true` for hold to talk in the composer ([`docs/AGENT_CHAT.md`](docs/AGENT_CHAT.md)). To open that chat in a modal from any button, render `studio/agent_chat/talk_modal` once and mark the buttons with `studio_talk_to_agent_link` ([`docs/AGENT_CHAT.md`](docs/AGENT_CHAT.md), "Talk to an agent in a modal").
@@ -395,6 +398,29 @@ again from the first.
 <% end %>
 ```
 
+`style: :cascade` is a 3D stack. The open slide sits in front at full size, and the slides
+either side step back behind it: each step further aside, smaller, deeper (`perspective`,
+`translateZ`), dimmer and turned a little toward the centre, with the open slide on top.
+`visible: 5` (the default) shows two each side and `visible: 3` one; a region under 36rem
+wide shows one each side whatever it asks, so a phone keeps its cards legible. `visible:`
+on another style raises. The row does not scroll: each slide wears `data-cascade-step`
+(`-2` to `2` in view, `before` and `after` past the window, hidden), which the partial writes
+for the first paint and the controller rewrites on a move. The arrows, dots, keys
+(arrows, Home, End), a swipe or drag, autoplay, a click on a side slide (which opens
+nothing) and keyboard focus landing in a side slide bring that slide to the front, and the
+status line says "Slide N of M". `start:`, `caption:` (under the open slide only),
+`autoplay:` and `loop:` behave as on the spotlight; a looping cascade needs no clones,
+since the steps wrap round the set. Under reduced motion the stack lays flat as a spotlight
+row, the neighbours only dimmed, and a move swaps at once. A controller that fails leaves
+a plain scrolling row.
+
+```erb
+<%= render layout: "studio/carousel",
+      locals: { label: "Portfolio", items: @apps, style: :cascade, autoplay: 6, loop: true } do |app| %>
+  <%= render "apps/card", app: app %>
+<% end %>
+```
+
 ### The "at" time stamp — `at_time_tag`
 
 Stamps WHEN something happened, on the reader's own clock: `at 3:53p`, gaining a

data/app/assets/tailwind/studio_engine/engine.css

@@ -1112,6 +1112,234 @@ body.modal-open .studio-app-banner {
   }
 }
 
+/* -- The cascade carousel (studio/_carousel, style: :cascade) ----------------------
+   A 3D stack. The open slide sits in front at full size; the slides either side step
+   back behind it, each step further aside, smaller, deeper and dimmer, turned a
+   little toward the centre. visible: 5 (the default) shows two each side, visible: 3
+   one; a region under 36rem wide shows one each side whatever it asks, so a phone
+   keeps its cards legible.
+
+   THE ROW DOES NOT SCROLL. Every slide sits in one grid cell, so the cell is as tall
+   as the tallest slide, and each wears data-cascade-step: its place from the open
+   slide, -2 to 2 in view, "before" and "after" past the window (hidden). The partial
+   writes the first paint's steps and the controller rewrites them on a move; this
+   block maps a step to --cascade-x (signed) and --cascade-d (its depth) and lays the
+   slide out from the two, with a transition. The track clips sideways, so the stack
+   never widens the page. --carousel-cascade-reach tells the controller how many
+   steps each side are in view.
+
+   A slide that crosses the stack round a looping set's seam (data-cascade-jump)
+   takes no glide; it fades in at its new place. A drag nudges the stack after the
+   pointer (--carousel-cascade-drag) and settles on release.
+
+   UNDER REDUCED MOTION nothing turns, deepens, scales or glides: the stack lays flat
+   as a spotlight row does, the neighbours only dimmed, and a move swaps at once.
+
+   IF THE CONTROLLER FAILS (data-studio-controller-failed) the stack is a plain
+   scrolling row, so every slide can still be reached. */
+@keyframes carousel-cascade-in {
+  from {
+    opacity: 0;
+  }
+}
+
+@utility carousel-cascade {
+  & > .carousel-track {
+    --carousel-cascade-reach: 2;
+    --cascade-w: min(34cqi, 22rem);
+    --cascade-shift: 0.52;
+    --cascade-scale: 0.12;
+    --cascade-depth: 6rem;
+    --cascade-turn: 10deg;
+    --cascade-dim: 0.22;
+    display: grid;
+    grid-template-columns: minmax(0, 1fr);
+    justify-items: center;
+    align-items: start;
+    gap: 0;
+    overflow: visible;
+    overflow-x: clip;
+    scroll-snap-type: none;
+    perspective: 1400px;
+    perspective-origin: 50% 40%;
+    touch-action: pan-y;
+    padding-block: 0.5rem 0.75rem;
+    -webkit-mask-image: none;
+            mask-image: none;
+  }
+
+  &[data-carousel-visible="3"] > .carousel-track {
+    --carousel-cascade-reach: 1;
+    --cascade-w: min(46cqi, 26rem);
+    --cascade-shift: 0.62;
+  }
+
+  /* A narrow region shows one each side, on wider cards. */
+  @container (width < 36rem) {
+    & > .carousel-track {
+      --carousel-cascade-reach: 1;
+      --cascade-w: 64cqi;
+      --cascade-shift: 0.44;
+      --cascade-depth: 3.5rem;
+    }
+  }
+
+  &[data-carousel-dragging] > .carousel-track {
+    cursor: grabbing;
+    user-select: none;
+  }
+
+  & > .carousel-track > .carousel-slide {
+    --cascade-x: 0;
+    --cascade-d: 0;
+    grid-area: 1 / 1;
+    flex: none;
+    width: var(--cascade-w);
+    scroll-snap-align: none;
+    display: flex;
+    flex-direction: column;
+    z-index: calc(10 - var(--cascade-d));
+    transform:
+      translateX(calc(var(--cascade-x) * var(--cascade-w) * var(--cascade-shift)))
+      translateZ(calc(var(--cascade-d) * -1 * var(--cascade-depth)))
+      rotateY(calc(var(--cascade-x) * -1 * var(--cascade-turn)))
+      scale(calc(1 - var(--cascade-d) * var(--cascade-scale)));
+    translate: var(--carousel-cascade-drag, 0px) 0;
+    opacity: 1;
+    transition:
+      transform 480ms cubic-bezier(0.22, 0.8, 0.26, 1),
+      translate 480ms cubic-bezier(0.22, 0.8, 0.26, 1),
+      opacity 320ms ease,
+      visibility 0s linear 0s;
+    -webkit-user-drag: none;
+  }
+
+  & > .carousel-track > .carousel-slide :is(a, img) {
+    -webkit-user-drag: none;
+  }
+
+  /* A side slide is a target: a click brings it to the front. */
+  &[data-carousel-ready] > .carousel-track > .carousel-slide:not([data-current]) {
+    cursor: pointer;
+  }
+
+  &[data-carousel-dragging] > .carousel-track > .carousel-slide {
+    transition-property: transform, opacity, visibility;
+  }
+
+  & > .carousel-track > [data-cascade-step="-1"] { --cascade-x: -1; --cascade-d: 1; }
+  & > .carousel-track > [data-cascade-step="1"] { --cascade-x: 1; --cascade-d: 1; }
+  & > .carousel-track > [data-cascade-step="-2"] { --cascade-x: -2; --cascade-d: 2; }
+  & > .carousel-track > [data-cascade-step="2"] { --cascade-x: 2; --cascade-d: 2; }
+
+  /* Past the window: one more step out, hidden. visibility waits for the fade. */
+  & > .carousel-track > :is([data-cascade-step="before"], [data-cascade-step="after"]) {
+    --cascade-d: 3;
+    opacity: 0;
+    visibility: hidden;
+    pointer-events: none;
+    transition-delay: 0s, 0s, 0s, 320ms;
+  }
+
+  & > .carousel-track > [data-cascade-step="before"] { --cascade-x: -3; }
+  & > .carousel-track > [data-cascade-step="after"] { --cascade-x: 3; }
+
+  /* Three in view: the second step out is past the window too. */
+  &[data-carousel-visible="3"] > .carousel-track > :is([data-cascade-step="-2"], [data-cascade-step="2"]) {
+    opacity: 0;
+    visibility: hidden;
+    pointer-events: none;
+    transition-delay: 0s, 0s, 0s, 320ms;
+  }
+
+  @container (width < 36rem) {
+    & > .carousel-track > :is([data-cascade-step="-2"], [data-cascade-step="2"]) {
+      opacity: 0;
+      visibility: hidden;
+      pointer-events: none;
+      transition-delay: 0s, 0s, 0s, 320ms;
+    }
+  }
+
+  /* Round the seam: no glide across the stack, a fade in at the new place. */
+  & > .carousel-track > .carousel-slide[data-cascade-jump] {
+    transition: none;
+    animation: carousel-cascade-in 320ms ease both;
+  }
+
+  & > .carousel-track > .carousel-slide[data-cascade-jump]:is([data-cascade-step="before"], [data-cascade-step="after"]) {
+    animation: none;
+  }
+
+  /* The dim: brightness and colour fall with depth, so a step back reads as further
+     away on a light page and a dark one, glass or solid, and nothing behind shows
+     through the card in front. */
+  & .carousel-cascade-body {
+    flex: 1 1 auto;
+    min-height: 0;
+    filter: brightness(calc(1 - var(--cascade-d) * var(--cascade-dim))) saturate(calc(1 - var(--cascade-d) * 0.3));
+    transition: filter 320ms ease;
+  }
+
+  & .carousel-slide[data-current] .carousel-cascade-body {
+    filter: none;
+  }
+
+  & .carousel-caption {
+    margin-top: 0.75rem;
+    text-align: center;
+    @apply text-sm text-body;
+    transition: opacity 300ms ease;
+  }
+
+  & .carousel-slide:not([data-current]) .carousel-caption {
+    opacity: 0;
+  }
+
+  @media (prefers-reduced-motion: reduce) {
+    & > .carousel-track > .carousel-slide {
+      transform: translateX(calc(var(--cascade-x) * (var(--cascade-w) + 0.75rem)));
+      translate: none;
+      transition: none !important;
+      animation: none !important;
+    }
+
+    & .carousel-cascade-body,
+    & .carousel-caption {
+      transition: none !important;
+    }
+
+    & .carousel-slide:not([data-current]) .carousel-cascade-body {
+      filter: none;
+      opacity: 0.45;
+    }
+  }
+
+  /* A controller that failed leaves a plain scrolling row: every slide in reach. */
+  &[data-studio-controller-failed] > .carousel-track {
+    display: flex;
+    gap: 1rem;
+    overflow-x: auto;
+    scroll-snap-type: x mandatory;
+    perspective: none;
+  }
+
+  &[data-studio-controller-failed] > .carousel-track > .carousel-slide {
+    flex: 0 0 var(--cascade-w);
+    scroll-snap-align: center;
+    transform: none;
+    translate: none;
+    opacity: 1;
+    visibility: visible;
+    pointer-events: auto;
+    transition: none;
+  }
+
+  &[data-studio-controller-failed] .carousel-cascade-body {
+    filter: none;
+  }
+}
+
 /* -- The section header (studio/_section_header, docs/PAGE_HEADER.md) --------
    A section's title that sticks under the rest of the stack, inside its own <section>,
    so the next section's header takes its place with no scroll script. At rest it reads as

data/app/controllers/concerns/studio/connection_flow.rb

@@ -49,7 +49,7 @@ module Studio
       account = nil
       if provider.account_source == :connect
         account = provider.normalize_account(params[provider.account_param]) or
-          return redirect_to(back, alert: "That is not a #{provider.label} account. Check what you entered, then press Connect again.")
+          return redirect_to(back, alert: "That is not a valid #{provider.label} account. Check what you entered, then press Connect again.")
       end
       url = provider.authorize_url(redirect_uri: connection_callback_url, state: new_connection_state, account:)
       session[connection_session_key(:account)] = account

data/app/controllers/sessions_controller.rb

@@ -5,7 +5,10 @@ class SessionsController < ApplicationController
   end
 
   def create
-    user = User.find_by(email: params[:email])
+    # Studio::Account.find_by_email, never find_by(email:): a form posted with
+    # no address made that find_by(email: nil), which matches any account with
+    # no email (a wallet or guest sign-up) and handed it to `authenticate`.
+    user = Studio::Account.find_by_email(User, params[:email])
     if user&.authenticate(params[:password])
       set_app_session(user)
       redirect_to root_path, notice: "Welcome back, #{user.display_name}!"
@@ -49,10 +52,16 @@ class SessionsController < ApplicationController
   private
 
   def authenticate_sso_user!
-    user = User.find_by(email: session[:sso_email])
+    # sso_continue checks the address is present first; this method does not
+    # trust that. A blank one finds nobody and signs nobody in: find_by(email:
+    # nil) would match any account without an email and sign in as it.
+    email = Studio::Account.normalize_email(session[:sso_email])
+    return redirect_to(login_path, alert: "Could not continue session. Please log in.") unless email
+
+    user = Studio::Account.find_by_email(User, email)
     unless user
       user = User.new(
-        email:    session[:sso_email],
+        email:    email,
         name:     session[:sso_name],
         provider: session[:sso_provider],
         uid:      session[:sso_uid]

data/app/controllers/studio/integrations_controller.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Studio
+  # The admin integrations page (docs/INTEGRATIONS.md): every integration the
+  # host enabled with Studio.enable_integration, its status and its Connect,
+  # and one page per integration with its connections, Disconnect, and the
+  # host's own panel. Studio.draw_integrations_routes points here.
+  #
+  # It includes Studio::ConnectionFlow, so connect, callback and disconnect are
+  # the connection tooling's own, and the host's admin guard
+  # (Studio.connection_admin_guard) runs before EVERY action here, the list
+  # and the pages included. It inherits the host's ApplicationController: its
+  # layout, session, current_user and Studio::ErrorHandling apply.
+  class IntegrationsController < ::ApplicationController
+    include Studio::ConnectionFlow
+
+    helper_method :integration_path_for, :integration_connect_path, :integration_callback_url,
+                  :integration_disconnect_path, :integrations_index_path
+
+    def index
+      @integrations = Studio::Integrations.all
+    end
+
+    def show
+      @integration = Studio::Integrations.fetch(params[:studio_connection])
+      @connections = @integration.connections
+    end
+
+    private
+
+    def integration_route(integration) = Studio::Connections.route(integration.key)
+
+    def integration_path_for(integration) = public_send(:"#{integration_route(integration).as}_path")
+    def integration_connect_path(integration) = public_send(:"#{integration_route(integration).as}_connect_path")
+    def integration_callback_url(integration) = public_send(:"#{integration_route(integration).as}_callback_url")
+
+    def integration_disconnect_path(integration, connection)
+      public_send(:"#{integration_route(integration).as}_disconnect_path", connection)
+    end
+
+    def integrations_index_path = "/#{Studio::Integrations.mount_path}"
+  end
+end

data/app/controllers/studio/local_reviews_controller.rb

@@ -115,9 +115,21 @@ module Studio
       Rails.logger.warn(
         "[Studio::LocalReviewsController] could not provision #{email}: #{e.class}: #{e.message}"
       )
+      # An ErrorLog too, so the miss is on the page an operator reads. The
+      # likeliest cause: Studio.local_review_role names a role this app's
+      # Studio::Account list refuses.
+      log_provisioning_failure(e)
       nil
     end
 
+    # Best-effort as well: a host whose error_logs table is missing or broken
+    # must not turn a logged miss into a failed mint.
+    def log_provisioning_failure(error)
+      ErrorLog.capture!(error) if defined?(::ErrorLog) && ::ErrorLog.respond_to?(:capture!)
+    rescue StandardError => e
+      Rails.logger.warn("[Studio::LocalReviewsController] could not log the miss: #{e.class}")
+    end
+
     # A brand-new reviewer goes through the host's own new-user hook first, so
     # the account this endpoint creates is shaped like every other account in
     # the app (usernames, defaults, associations) — then the role is stamped on

data/app/javascript/studio/carousel.js

@@ -246,3 +246,69 @@ export function loopPositionText(first, shown, total) {
   const head = first + 1 === total ? `Slides ${total}` : `Slides ${first + 1} to ${total}`
   return `${head} and ${over === 1 ? "1" : `1 to ${over}`} of ${total}`
 }
+
+// THE CASCADE (style: :cascade, class carousel-cascade). The row does not scroll:
+// every slide sits in one grid cell and wears data-cascade-step, its place from the
+// open slide, which engine.css turns into the 3D stack. A STEP is signed: 0 is the
+// open slide, -1 and 1 its neighbours, and so on. CASCADE_REACH steps either side
+// are in view; past them a slide's slot is "before" or "after", hidden.
+//
+// app/views/studio/_carousel.html.erb writes the first paint's slots with the same
+// rule, so the two must agree (test/views/carousel_render_test.rb pins the partial).
+export const CASCADE_REACH = 2
+
+// A slide's step from the open one. A looping set has no ends, so the step is the
+// short way round; a tie (an even set's far side) goes to the later side.
+export function cascadeStep(index, active, total, loop = false) {
+  const step = index - active
+  if (!loop || !(total > 1)) return step
+  const round = wrapIndex(step, total)
+  return round > total / 2 ? round - total : round
+}
+
+// Every slide's step, in row order.
+export function cascadeSteps(total, active, loop = false) {
+  return Array.from({ length: Math.max(0, total) }, (_, index) => cascadeStep(index, active, total, loop))
+}
+
+// The data-cascade-step a step is written as: the step itself in view, "before" or
+// "after" past the reach.
+export function cascadeSlot(step, reach = CASCADE_REACH) {
+  if (step < -reach) return "before"
+  if (step > reach) return "after"
+  return String(step)
+}
+
+// The cascade's reach from its view: 5 slides in view reach 2 each side, 3 reach 1.
+export function cascadeReach(visible) {
+  return Number(visible) === 3 ? 1 : CASCADE_REACH
+}
+
+// Which slides JUMP on a move from one set of steps to the next: the ones that cross
+// round a looping set's seam (the far left slide becoming the far right one) instead
+// of shifting with the rest. They take no glide across the stack. Every other slide
+// moves by the same shift, the open slide's old step turned round.
+export function cascadeJumps(before, after, active) {
+  const shift = -(before[active] ?? 0)
+  return after.map((step, index) => step - before[index] !== shift)
+}
+
+// How many slides a drag of `dx` pixels moves, against `width` pixels a step: none
+// under the threshold, else at least one, the open slide following the pointer
+// (a drag to the left brings the next slides in, so it moves forward).
+export const DRAG_THRESHOLD = 40
+export function dragSteps(dx, width) {
+  if (!(Math.abs(dx) >= DRAG_THRESHOLD)) return 0
+  const per = width > 0 ? width : 1
+  const count = Math.max(1, Math.round(Math.abs(dx) / per))
+  return dx < 0 ? count : -count
+}
+
+// The slide a drag or a click takes a cascade to, from the open one: held to the
+// ends of a set that does not loop, round the set on one that does.
+export function cascadeTarget(active, by, total, loop = false) {
+  if (!(total > 0)) return 0
+  const to = active + by
+  if (loop) return wrapIndex(to, total)
+  return Math.min(total - 1, Math.max(0, to))
+}