studio-engine 0.42.0 → 0.43.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d675146488bc53f26f2ab9df774878f26b8c6fe714f8298fda17fbf85b3632de
-  data.tar.gz: afb41c11138b07903925c87abe6bab93d82476db7789226b79b2b38872f0ab2a
+  metadata.gz: 60d9ce89189f6f027c2158888a403269310397f20cb86cddc88519e9ec4644bb
+  data.tar.gz: cb5f1ee58d3825e6b3ee705f07f8ede2cd2ebed14e2d86f03ddf22c1debb4b20
 SHA512:
-  metadata.gz: f209b273cfacd2d9f428f43cc886b15e57ff7b1131a6753589d8ddcd17b07c9458c678ae1583e4826038a8d3cd2004757f460695952f60367677fbac7c44fc73
-  data.tar.gz: 5aa5fe2bf6fa67cfdf30aa6fdfe253f34f6c29715aa42ef56c95d892d61706d049c6b6f137908db54d6d8fda72ebb7e16e7b66e4c2705fc0286cbbcabbdcb9f8
+  metadata.gz: 2d82567b9773871905899b6519699d95d5c05a73c5239914c3535d9a16198f6282c7d30309f07bb7961760d51a114ba031c4f20b83321ae1eb71f2ef7b7dc065
+  data.tar.gz: ae096e420cc8e25d8cb34013f6fc5eee1b41b5c102561b626bf67330b64e0115067ba0c237d32ab9b2c96f963181ae6c419f2fbf01f2f909504337980942cd9f

data/app/controllers/studio/emails_controller.rb

@@ -125,7 +125,22 @@ module Studio
     # two places to press.
     def copy
       rescue_and_log do
-        Studio::EmailSetting.set_copy(@key, copy_params)
+        attrs = copy_params
+        Studio::EmailSetting.set_copy(@key, attrs)
+        # The button's on/off is a boolean, so it is not a COPY_FIELD and needs
+        # its own write — the same shape that once made hide_logo a dead control.
+        Studio::EmailSetting.set_cta_enabled(@key, attrs[:cta_enabled]) if attrs.key?(:cta_enabled)
+        # The footer is SHARED across every email, so it is stored under its own
+        # key rather than this one, and the page posts its two inputs on every
+        # save. update_footer (not set_footer) is what makes that safe: it writes
+        # only on a real change, so blank posts from a page nobody edited cannot
+        # wipe the footer every email sends.
+        #
+        # The form spells the footer's logo `footer_logo_url` because `logo_url`
+        # is already this email's OWN banner logo; the model takes it as
+        # `logo_url`, so the rename is undone here.
+        Studio::EmailSetting.update_footer(discord_url: attrs[:discord_url],
+                                           logo_url: attrs[:footer_logo_url])
         if params.key?(:scrim_percent)
           percent = params[:scrim_percent]
           percent = nil unless percent.present? && Studio::EmailSetting::SCRIM_RANGE.cover?(percent.to_i)
@@ -202,7 +217,8 @@ module Studio
     # Every model-level logo test passed throughout, because set_copy was never
     # the broken part. The filter lives here, so the assertion does too.
     def copy_params
-      params.permit(*Studio::EmailSetting::COPY_FIELDS, :hide_logo)
+      params.permit(*Studio::EmailSetting::COPY_FIELDS, :hide_logo, :cta_enabled,
+                    :discord_url, :footer_logo_url)
             .to_h.symbolize_keys
     end
 

data/app/mailers/studio/newsletter_mailer.rb

@@ -35,6 +35,10 @@ module Studio
       # registered the layout renders the flat <img> instead of nothing.
       @banner_url = Studio::EmailCatalog.resolved_url(:newsletter_subscribed)
 
+      # No @cta_* here: this email's template renders no button, and setting
+      # ivars a view never reads is how a dead control looks like a live one.
+      @body = Studio::EmailCatalog.body(:newsletter_subscribed, name: @name)
+
       subject = Studio::EmailCatalog.subject_for(:newsletter_subscribed, name: @name) ||
                 "You're subscribed to #{@app_name}"
       mail(to: email, subject: subject)

data/app/mailers/user_mailer.rb

@@ -50,6 +50,13 @@ class UserMailer < ApplicationMailer
     # Layered is opt-in, never a migration.
     @banner_url = Studio::EmailCatalog.resolved_url(:magic_link)
     @banner_alt = "Your #{@app_name} sign-in link"
+    # THE COPY BELOW THE BANNER is the operator's too, on the same terms as the
+    # banner's words: the registry carries what this file used to hard-code, so
+    # an app that never opens /admin/emails sends exactly what it sent before.
+    @body      = Studio::EmailCatalog.body(:magic_link, name: name)
+    @cta_text  = Studio::EmailCatalog.cta_text(:magic_link, name: name) if Studio::EmailCatalog.cta_enabled?(:magic_link)
+    @cta_color = Studio::EmailCatalog.cta_color(:magic_link)
+
     # The operator's subject when they have set one, the hard-coded line
     # otherwise — so an app that never visits /admin/emails is unchanged.
     subject = Studio::EmailCatalog.subject_for(:magic_link, name: name) ||

data/app/models/studio/email_setting.rb

@@ -21,7 +21,13 @@ module Studio
 
     # The banner's words and logo. Each is nil until the operator sets it, and
     # nil means INHERIT — never "empty".
-    COPY_FIELDS = %i[header header_fallback subtext logo_url subject].freeze
+    COPY_FIELDS = %i[header header_fallback subtext logo_url subject body cta_text cta_color].freeze
+
+    # The footer is shared by every email this app sends, so it is stored once
+    # under a reserved key rather than copied onto each row. Underscored so it
+    # cannot collide with a registry key, which is always a plain identifier.
+    FOOTER_KEY = "_footer".freeze
+    FOOTER_FIELDS = %i[discord_url logo_url].freeze
 
     class << self
       # The saved scrim for this email as a 0.0-1.0 fraction, or nil when the
@@ -69,6 +75,75 @@ module Studio
         key.nil? ? cache.clear : cache.delete(key.to_s)
       end
 
+      # The shared footer, as a plain hash. Reads through the same per-request
+      # memo as everything else, so rendering it on every email in a list costs
+      # one query rather than one per email.
+      # The saved footer, or NIL when the operator has never touched it.
+      #
+      # nil and {} are different answers and the distinction is load-bearing: no
+      # row means "apply the defaults", while a row whose fields are blank means
+      # "I cleared these on purpose". Returning {} for both made clearing the
+      # logo hand the default straight back, so the field could not be emptied.
+      def footer
+        return nil unless table_ready?
+
+        row = for_key(FOOTER_KEY)
+        return nil if row.nil?
+
+        FOOTER_FIELDS.index_with { |field| row.public_send(field).presence }
+      end
+
+      # Write the footer ONLY when it actually changes.
+      #
+      # There is one Save for the whole page, so every save posts the footer
+      # inputs — blank ones included, from a page where the operator only touched
+      # the subject. Writing those blanks created a row of nils, which reads the
+      # same as "cleared", so the shared footer vanished from every email the app
+      # sends and could not be recovered without retyping it.
+      #
+      # Comparing against what is stored keeps both meanings: blanks matching an
+      # untouched footer write nothing, blanks replacing a stored value clear it.
+      def update_footer(discord_url: nil, logo_url: nil)
+        posted = { discord_url: discord_url.presence, logo_url: logo_url.presence }
+        stored = footer
+
+        return nil if stored.nil? && posted.values.all?(&:nil?)
+        return nil if stored.present? && stored.slice(:discord_url, :logo_url) == posted
+
+        set_footer(posted)
+      end
+
+      def set_footer(attrs)
+        return nil unless table_ready?
+
+        record = find_or_initialize_by(email_key: FOOTER_KEY)
+        FOOTER_FIELDS.each do |field|
+          next unless attrs.key?(field) || attrs.key?(field.to_s)
+
+          record.public_send(:"#{field}=", (attrs[field] || attrs[field.to_s]).presence)
+        end
+        record.save!
+        forget!(FOOTER_KEY)
+        record
+      end
+
+      # nil when the operator has not decided — the registry then answers.
+      def cta_enabled_for(key)
+        return nil unless table_ready?
+
+        for_key(key)&.cta_enabled
+      end
+
+      def set_cta_enabled(key, value)
+        return nil unless table_ready?
+
+        record = find_or_initialize_by(email_key: key.to_s)
+        record.cta_enabled = value.nil? ? nil : ActiveModel::Type::Boolean.new.cast(value)
+        record.save!
+        forget!(key)
+        record
+      end
+
       # True when the operator has explicitly hidden the logo — which is a
       # different answer from "no logo url saved" (that one inherits).
       def hide_logo?(key)

data/app/services/studio/banner.rb

@@ -43,8 +43,13 @@ module Studio
     end
 
     # The email card is 600px wide; the banner fills it.
+    #
+    # 300, not 200. It was cut to 200 to take out vertical dead space, which the
+    # proportional type below then closed on its own — so the shorter box was
+    # buying nothing and costing the artwork half its sky. Everything in the
+    # partial scales from this number, which is what makes the change one line.
     DEFAULT_WIDTH  = 600
-    DEFAULT_HEIGHT = 200
+    DEFAULT_HEIGHT = 300
 
     # A wash between the artwork and the text. Not decoration: background art is
     # chosen for looks, not contrast, and white text over a pale sky is

data/app/services/studio/email_catalog.rb

@@ -80,14 +80,22 @@ module Studio
     #   type          — :transactional or :marketing.
     #   preview       — callable returning a Mail, or nil.
     Entry = Struct.new(:key, :label, :description, :default_asset, :type, :preview,
-                       :default_origin, :aspect_ratio, :background, :logo, :scrim,
-                       :header, :header_fallback, :subtext, :subject,
+                       :default_origin, :background_origin, :aspect_ratio, :background, :logo, :scrim,
+                       :header, :header_fallback, :subtext, :subject, :body, :cta_text, :cta_color, :cta_enabled, :supports_cta,
                        keyword_init: true) do
       def to_s = key
       def previewable? = preview.respond_to?(:call)
       # nil-safe: an Entry built directly (the STANDARD seed) may carry no type.
       def marketing? = type.to_s == "marketing"
 
+      # Can this email render a button AT ALL? An email's view has to have
+      # somewhere to send the reader — the sign-in link has a token URL, a
+      # "you're subscribed" note has nothing. OPT-IN, because an entry that has
+      # not said yes cannot be assumed to have a destination, and a Call-to-action
+      # card offered for an email whose template ignores it is a dead control:
+      # the operator ticks the box, saves, and no button ever appears.
+      def supports_cta? = supports_cta == true
+
       # WHOSE artwork default_asset names. Recorded at registration rather than
       # inferred later: by the time the page asks, a resolved asset path looks
       # identical whether the file came from the gem or from the host, and
@@ -96,6 +104,24 @@ module Studio
       # passes default_asset for is that host's own.
       def engine_artwork? = default_origin.to_s != "app"
 
+      # Does THIS APP's artwork layer?
+      #
+      # True when the app registered a background itself — that is the host
+      # saying "layer this email", whatever else it registered. Also true when
+      # the app has registered no artwork at all, so an app that touches nothing
+      # keeps the engine's layered banner.
+      #
+      # False only in the case this exists for: the app registered its OWN flat
+      # asset and merely INHERITED a background it never asked for. turf-monster
+      # is exactly that — its magic_link carries a baked-in .jpg and inherits the
+      # engine's island art — and drawing live text over a picture it never sends
+      # is the failure this whole feature exists to prevent.
+      def layered?
+        return true if background_origin.to_s == "app"
+
+        engine_artwork?
+      end
+
       # The shape of THIS email's banner — the box the page draws and the ratio
       # the upload cropper enforces. Per-entry because the engine's own artwork
       # is 3:1 while turf-monster's eight banners are 2:1; one global constant
@@ -111,7 +137,7 @@ module Studio
         label: "Magic-link sign-in",
         description: "Passwordless sign-in link. Sent whenever someone asks to sign in by email.",
         default_asset: "emails/magic-link.gif",
-        aspect_ratio: 3.0,
+        aspect_ratio: 2.0,
         # Layered artwork: the background animates, the greeting is live HTML on
         # top. default_asset above stays the flat <img> for a mailer that has not
         # adopted the layered banner.
@@ -122,13 +148,18 @@ module Studio
         header: "Welcome {name}!",
         header_fallback: "Your Magic Link",
         subtext: "your sign-in link is below",
-        subject: "Your {app} sign-in link"
+        subject: "Your {app} sign-in link",
+        body: "Tap the button below to sign in to {app} — no password needed. " \
+              "If you don't have an account yet, we'll create one for you.",
+        # The token URL is the destination, so this email really does have a button.
+        supports_cta: true,
+        cta_text: "Sign in to {app}"
       },
       {
         key: "newsletter_subscribed",
         label: "Newsletter subscribed",
         description: "Welcomes someone who has just joined the mailing list.",
-        aspect_ratio: 3.0,
+        aspect_ratio: 2.0,
         # LAYERED-NATIVE: no default_asset. A flat asset is the pre-layered
         # fallback — artwork with the words baked in, for a mailer that only
         # knows how to render an <img>. Studio::NewsletterMailer has known how to
@@ -140,6 +171,11 @@ module Studio
         header_fallback: "You're subscribed!",
         subtext: "you're on the list",
         subject: "You're subscribed to {app}",
+        body: "Thanks for subscribing to {app}. We'll send the occasional note " \
+              "about what we're building — no more often than it's worth your time.",
+        # NO BUTTON, and no card offering one: a new subscriber has nowhere to be
+        # sent, so subscribed.html.erb renders none and never will.
+        supports_cta: false,
         # The engine ships this email's preview because it can: the mailer takes
         # a bare address, so no host sample data is involved. Every other entry's
         # builder needs records only the host has — this one does not, and an
@@ -152,12 +188,33 @@ module Studio
     # The FALLBACK shape, for an email that states none. 2:1 because that is what
     # turf-monster's eight banners are, and changing it would recrop all of them.
     #
-    # It is NOT what the engine's own emails use: both STANDARD entries declare
-    # aspect_ratio: 3.0 and both shipped backgrounds are 1200x400. The ratio is
-    # per-entry precisely so those two answers can differ.
+    # The engine's own two entries now declare 2.0 as well, and their backgrounds
+    # are 1200x600 — but the ratio stays per-entry, because that is what lets a
+    # host register artwork of a different shape without recropping everyone's.
     ASPECT_RATIO = 2.0
     MAX_WIDTH = 1200
 
+    # NO DEFAULT LOGO, deliberately.
+    #
+    # It was emails/logo-horizontal.png — the white "McRITCHIE STUDIO" wordmark —
+    # and every consumer inherits this layout without defining its own. That put
+    # Studio branding into turf-monster's entire player-facing mail set, which
+    # today carries none, plus moms-app, mcritchie-industries, acquisition-studio
+    # and rolio, with no opt-in and no host-side change.
+    #
+    # It also contradicted the rule at the top of this file: the url / resolved_url
+    # split exists so the engine cannot swap a host's artwork for the engine's in
+    # live email. A footer logo is the same swap by another route.
+    #
+    # Each app opts in on /admin/emails by pasting its own mark.
+
+    # The footer band. Dark on purpose: it closes the white card, and a light
+    # sign-off floating under body copy reads as part of the message rather than
+    # the end of it. Hard-coded rather than derived from the theme because a
+    # host's primary can be light, and white-on-light is unreadable — the one
+    # thing this band must never be.
+    FOOTER_BACKGROUND = "#1A1535".freeze
+
     module_function
 
     # --- Registry ----------------------------------------------------------
@@ -169,7 +226,8 @@ module Studio
     # attach a preview builder to it, without restating its artwork.
     def register(key, label: nil, description: nil, default_asset: nil, type: nil, preview: nil,
                  aspect_ratio: nil, background: nil, logo: nil, scrim: nil,
-                 header: nil, header_fallback: nil, subtext: nil, subject: nil)
+                 header: nil, header_fallback: nil, subtext: nil, subject: nil,
+                 body: nil, cta_text: nil, cta_color: nil, cta_enabled: nil, supports_cta: nil)
       key = key.to_s
       existing = registry[key]
       registry[key] = Entry.new(
@@ -184,6 +242,11 @@ module Studio
         # had, so a host relabelling an inherited email does not accidentally
         # claim the engine's picture as its own.
         default_origin: default_asset.nil? ? (existing&.default_origin || :engine) : :app,
+        # WHOSE background this is, recorded the same way and for the same
+        # reason: by the time anyone asks, an inherited background and a
+        # host-registered one are indistinguishable, and guessing is what this
+        # records to avoid. A host passing background: is ASKING to layer.
+        background_origin: background.nil? ? (existing&.background_origin || :engine) : :app,
         aspect_ratio: aspect_ratio || existing&.aspect_ratio,
         background: background.nil? ? existing&.background : background.presence,
         logo: logo.nil? ? existing&.logo : logo.presence,
@@ -191,7 +254,12 @@ module Studio
         header: header.nil? ? existing&.header : header.presence,
         header_fallback: header_fallback.nil? ? existing&.header_fallback : header_fallback.presence,
         subtext: subtext.nil? ? existing&.subtext : subtext.presence,
-        subject: subject.nil? ? existing&.subject : subject.presence
+        subject: subject.nil? ? existing&.subject : subject.presence,
+        body: body.nil? ? existing&.body : body.presence,
+        cta_text: cta_text.nil? ? existing&.cta_text : cta_text.presence,
+        cta_color: cta_color.nil? ? existing&.cta_color : cta_color.presence,
+        cta_enabled: cta_enabled.nil? ? existing&.cta_enabled : cta_enabled,
+        supports_cta: supports_cta.nil? ? existing&.supports_cta : supports_cta
       )
       key
     end
@@ -322,6 +390,64 @@ module Studio
       saved(key, :subtext) || entry(key)&.subtext
     end
 
+    # --- the email below the banner ------------------------------------------
+    #
+    # Same resolution as the banner's words: operator > registry > default. A
+    # mailer reads these instead of hard-coding copy, which is what makes the
+    # cards on /admin/emails real rather than decorative.
+
+    def body(key, name: nil)
+      template = saved(key, :body) || entry(key)&.body
+      return nil if template.blank?
+
+      Studio::Banner.interpolate(template, name).presence
+    end
+
+    def cta_text(key, name: nil)
+      template = saved(key, :cta_text) || entry(key)&.cta_text
+      return nil if template.blank?
+
+      Studio::Banner.interpolate(template, name).presence
+    end
+
+    # The app's primary unless this email says otherwise — a button that matches
+    # the banner above it by default, and can be made to stand out per email.
+    def cta_color(key)
+      saved(key, :cta_color) || entry(key)&.cta_color || Studio.theme_primary
+    end
+
+    # Shown unless someone said no. Defaults to TRUE for an email that has CTA
+    # text, because the button is the point of a transactional email; an email
+    # with no text has nothing to render either way.
+    def cta_enabled?(key)
+      # An email whose template cannot render a button is never "enabled", no
+      # matter what is stored — otherwise a value saved before the capability was
+      # declared keeps claiming a button that cannot appear.
+      return false unless entry(key)&.supports_cta?
+
+      operator = begin
+        Studio::EmailSetting.cta_enabled_for(key)
+      rescue StandardError
+        nil
+      end
+      return operator unless operator.nil?
+
+      registered = entry(key)&.cta_enabled
+      return registered unless registered.nil?
+
+      true
+    end
+
+    # The shared footer — the same on every email this app sends.
+    #
+    # The operator's footer, or nothing. An app that has not set one renders no
+    # band at all — the engine ships no branding of its own into a host's email.
+    def footer
+      (Studio::EmailSetting.footer || {}).compact
+    rescue StandardError
+      {}
+    end
+
     # The subject line, resolved the same way and supporting the same {name}
     # placeholder. A mailer calls this instead of hard-coding a string, which is
     # what makes the field on /admin/emails real rather than decorative.
@@ -367,12 +493,16 @@ module Studio
     # flipped to "Uploaded here", and the email kept sending the gem's artwork
     # because the layered banner never looked at the row.
     #
-    # NIL WHEN THIS APP OWNS THE ARTWORK. A host registering its own flat
-    # default_asset sends that picture; the background it also inherited is the
-    # engine's and nothing sends it. The list row carried this guard alone, so
-    # the detail page still layered live text over artwork no inbox receives.
+    # NIL UNLESS THIS EMAIL LAYERS. A host registering its own flat
+    # default_asset sends that picture, and the background it merely INHERITED is
+    # the engine's — nothing sends it. But a host that registers a background of
+    # its OWN is asking to layer, and layered? is what tells the two apart.
+    #
+    # This is the ONE place that decision is made. Every reader asks this method
+    # rather than re-deriving it: the list row used to carry its own copy of the
+    # guard, and the copy went stale the moment the guard moved here.
     def background_url(key)
-      return nil unless entry(key)&.engine_artwork?
+      return nil unless entry(key)&.layered?
 
       url(key) || absolute_asset_url(entry(key)&.background)
     end
@@ -519,10 +649,19 @@ module Studio
     # The flat asset stays the fallback, for a host still on the engine's own
     # unlayered UserMailer — there, the baked-text banner IS what arrives.
     #
-    # Unless THIS APP owns the artwork, in which case it previews exactly what
+    # Unless this email does not LAYER, in which case it previews exactly what
     # the flat resolution sends — same method, so the two cannot disagree.
+    #
+    # THE SAME QUESTION background_url ASKS, so it must ask it the same way.
+    # This guard read engine_artwork? while background_url read layered?, and the
+    # two answer differently for a host that registers its own background: the
+    # mailer sent the layered banner while /admin/email_images and the detail
+    # page's "Artwork" frame both drew the flat asset. That frame is where
+    # "Modify image" lives, and an upload writes the row background_url reads
+    # FIRST — so the operator was shown one picture and told it was the one the
+    # button would replace.
     def preview_asset_path(key)
-      return default_asset_path(key) unless entry(key)&.engine_artwork?
+      return default_asset_path(key) unless entry(key)&.layered?
 
       asset_path(entry(key)&.background.presence || entry(key)&.default_asset)
     end

data/app/views/layouts/branded_mailer.html.erb

@@ -42,6 +42,38 @@
             <%= yield %>
           </td>
         </tr>
+
+        <%# THE SHARED FOOTER — the same on every email this app sends, which is
+            why it lives in the layout and is stored once rather than per email.
+
+            FULL-BLEED AND DARK. The band closes the white card: a light sign-off
+            floating under the body reads as part of the message rather than the
+            end of it. bgcolor as well as the CSS, because Outlook renders through
+            Word and drops background-color on a td often enough that the
+            attribute is the only reliable half.
+
+            Renders nothing when the operator has cleared both fields. %>
+        <% footer = Studio::EmailCatalog.footer %>
+        <% if footer[:logo_url].present? || footer[:discord_url].present? %>
+          <tr>
+            <td align="center" bgcolor="<%= Studio::EmailCatalog::FOOTER_BACKGROUND %>"
+                <%# color as well as the background: with images blocked, the alt
+                    text is all that is left, and a client's near-black default on
+                    a near-black band is invisible. %>
+                style="background-color:<%= Studio::EmailCatalog::FOOTER_BACKGROUND %>;padding:28px 36px;color:#F5F3FF;">
+              <% if footer[:logo_url].present? %>
+                <%# height as well as width: Outlook collapses an alt placeholder
+                    that has no height, so a blocked image leaves nothing at all. %>
+                <img src="<%= footer[:logo_url] %>" width="132" height="32" alt="<%= Studio.app_name %>"
+                     style="display:block;margin:0 auto 14px;width:132px;height:auto;border:0;color:#F5F3FF;" />
+              <% end %>
+              <% if footer[:discord_url].present? %>
+                <a href="<%= footer[:discord_url] %>"
+                   style="font-size:13px;color:#C9C2FF;text-decoration:none;">Join us on Discord</a>
+              <% end %>
+            </td>
+          </tr>
+        <% end %>
       </table>
     </td>
   </tr>

data/app/views/studio/emails/_banner_editor.html.erb

@@ -112,6 +112,13 @@
 
         // Field by field rather than JSON.stringify, whose output depends on key
         // order — two equal objects can stringify differently.
+        //
+        // No type coercion here, deliberately. An earlier version normalised
+        // booleans on the theory that a checkbox holds true while the server
+        // echoes "1"; a mutation run showed removing it changed nothing, because
+        // the payload sends real booleans for the two checkboxes and strings for
+        // everything else. Unproven defensive code in a comparison that decides
+        // whether a Save button appears is worse than none.
         dirty() {
           return Object.keys(this.initial).some(function (k) {
             return (this.form[k] ?? "") !== (this.initial[k] ?? "");

data/app/views/studio/emails/_banner_preview.html.erb

@@ -0,0 +1,62 @@
+<%# THE banner preview — one component, every size.
+
+    locals:
+      banner:   a Studio::Banner (required)
+      ratio:    the frame's aspect ratio (default: the banner's own)
+      max_width: cap the frame in px, or nil to fill its column
+      isolate:  render inside an iframe (default true)
+
+    WHY IT IS A COMPONENT
+    There were two copies of this — the list row and the email's own page — and
+    they had already drifted: one carried the "does this app actually send a
+    layered banner" guard and the other did not, so the detail page previewed
+    live text over artwork no inbox receives. One component means a fix lands
+    everywhere, which is the same argument as rendering through the mailer's own
+    partial rather than a lookalike.
+
+    WHY THE IFRAME
+    The banner is the EMAIL's markup — a <table>. Dropping one into a list row
+    nests rows inside rows, and every host asserting "one row per email" counted
+    three per layered email. A separate document keeps the host page's markup
+    contract intact. Pass isolate: false where nesting is not a concern and a
+    plain preview is cheaper.
+
+    WHY THE RESET
+    A srcdoc document is a fresh page with the browser's default stylesheet, so
+    it inherits `body { margin: 8px }` — which showed as a band of padding around
+    every thumbnail. The email itself never sees this: the reset lives here, not
+    in the partial the mailer renders.
+%>
+<%
+  banner    = local_assigns.fetch(:banner)
+  ratio     = local_assigns.fetch(:ratio, banner.width.to_f / banner.height)
+  max_width = local_assigns.fetch(:max_width, Studio::Banner::DEFAULT_WIDTH)
+  isolate   = local_assigns.fetch(:isolate, true)
+
+  markup = render("studio/mailers/layered_banner", banner: banner, preview: true)
+  document = <<~HTML
+    <!doctype html><html><head><meta charset="utf-8">
+    <style>html,body{margin:0;padding:0;background:transparent;}</style>
+    </head><body>#{markup}</body></html>
+  HTML
+  frame_style = ["aspect-ratio: #{ratio}"]
+  frame_style << "max-width: #{max_width}px" if max_width
+%>
+<div class="rounded-lg overflow-hidden border border-subtle" data-email-banner-frame
+     style="<%= frame_style.join("; ") %>;">
+  <% if isolate %>
+    <iframe class="pointer-events-none block" scrolling="no" tabindex="-1" loading="lazy"
+            data-email-banner-preview data-banner-width="<%= banner.width %>"
+            title="<%= banner.header.presence || "Email banner" %>"
+            style="width:<%= banner.width %>px;height:<%= banner.height %>px;border:0;display:block;transform-origin:top left;"
+            <%# ESCAPED EXPLICITLY: render returns an html_safe buffer, so a bare
+                output tag injects it RAW and closes the iframe at the banner's
+                first quote. to_str drops the safe flag so escaping happens. %>
+            srcdoc="<%= ERB::Util.html_escape(document.to_str) %>"></iframe>
+  <% else %>
+    <div data-email-banner-preview data-banner-width="<%= banner.width %>"
+         style="width:<%= banner.width %>px;transform-origin:top left;">
+      <%= markup %>
+    </div>
+  <% end %>
+</div>

data/app/views/studio/emails/_row.html.erb

@@ -28,12 +28,12 @@
   # untouched — the same reason the email preview lower down the detail page is
   # one.
   #
-  # And it only layers when THIS APP's artwork is layered. Whether an email
-  # layers belongs to its mailer, which the catalogue cannot see; the closest
-  # honest proxy is whose artwork is registered. turf-monster re-registers
-  # magic_link with its own flat banner and inherits the engine's background, so
-  # a naive check drew a layered picture turf-monster never sends.
-  layered = Studio::EmailCatalog.background_url(entry.key).present? && entry.engine_artwork?
+  # And it only layers when THIS APP's artwork is layered — a question
+  # background_url now answers by itself (it returns nil unless entry.layered?).
+  # The row used to carry a SECOND copy of that guard; when the guard moved down
+  # and grew the host-registered-background case, the stale copy started
+  # disagreeing with the mailer. One guard, one place, so they cannot drift.
+  layered = Studio::EmailCatalog.background_url(entry.key).present?
   banner  = layered ? Studio::Banner.for(entry.key, name: name) : nil
   subject = Studio::EmailCatalog.subject_for(entry.key, name: name)
 
@@ -43,86 +43,41 @@
   header_fallback = Studio::EmailCatalog.header_fallback(entry.key)
   subject_template = Studio::EmailSetting.copy_for(entry.key, :subject) || entry.subject
 
-  # `badge` is a shape-only utility in engine.css — the state color comes from
-  # theme-token utilities so it follows each app's palette in light and dark.
-  #
-  # Four states, because three of them used to read as one. An app that ships
-  # its own committed artwork was told that artwork "ships with the engine",
-  # which is the wrong answer to the only question this column exists to answer.
-  badge_class, badge_label, badge_note =
-    case source
-    when :app
-      ["badge bg-success/10 text-success border-success/30", "Uploaded here",
-       "Stored for #{Studio.app_name} — this upload is what ships."]
-    when :app_asset
-      ["badge bg-success/10 text-success border-success/30", "#{Studio.app_name}'s artwork",
-       "Committed in this app's own assets. Upload to replace it."]
-    when :engine_default
-      ["badge bg-inset text-muted border-subtle", "Studio default",
-       "Shared artwork that ships with the engine. Upload to make it #{Studio.app_name}'s."]
-    else
-      ["badge bg-warning/10 text-warning border-warning/30", "No image",
-       "This email sends without a banner."]
-    end
 %>
-<%# The uploader host is attached ONLY when this app can actually store an
-    override. On a read-only app the cropper assets are not loaded either, so an
-    unconditional x-data would reference an undefined factory and Alpine would
-    throw on every row. %>
-<%# THE WHOLE ROW OPENS THE EMAIL. Kept as a click handler on the row with the
-    name still a real <a>: wrapping a table row in a link is invalid HTML, and
-    making every cell a link would break the Upload button inside one of them.
-    The handler ignores clicks that landed on a control, so Upload, Revert and
-    the name link keep their own behaviour. %>
+<%# THE WHOLE ROW OPENS THE EMAIL, and now that is the only thing it does. The
+    provenance badge and the upload button lived here and both moved to the
+    email's own page — one place where changes are made, rather than a row that
+    is half a control panel.
+
+    A click handler rather than a wrapping link: an anchor around a <tr> is
+    invalid HTML. The name stays a real <a> so it keeps middle-click and
+    open-in-new-tab. %>
 <tr class="border-b border-subtle last:border-0 cursor-pointer hover:bg-inset/60" data-email-row
     data-email-path="<%= admin_email_path(entry.key) %>"
     data-header="<%= header_template %>"
     data-header-fallback="<%= header_fallback %>"
     data-subject="<%= subject_template %>"
-    <% if uploads_available %>
-      x-data="imageUploadHost({
-        store: 'emailModals',
-        aspectRatio: <%= entry.ratio %>,
-        maxWidth: <%= max_width %>,
-        transparent: false,
-        <%# Same answer as the email's own page. Without this the SAME button
-            refused an animated GIF here and accepted it there. %>
-        allowGifs: true,
-        filename: '<%= entry.key %>.png',
-        saving: 'Saving banner…',
-        success: 'Banner updated',
-        successMessage: '<%= j entry.label %> now uses this app\'s own image.',
-        failure: 'Couldn\'t save the banner'
-      })"
-      @crop-photo-confirmed.window="onCropConfirmed($event.detail)"
-    <% end %>>
+    >
 
   <td class="px-4 py-4">
-    <div class="rounded-lg overflow-hidden border border-subtle w-56" data-email-banner-frame
-         style="aspect-ratio: <%= entry.ratio %>; background: linear-gradient(135deg, var(--color-primary-700), var(--color-primary-900));">
-      <% if banner %>
-        <%# srcdoc, so the email's table lives in its own document. Root-relative
-            asset paths inside it resolve against this page's origin, which is
-            what the admin preview wants. %>
-        <iframe class="pointer-events-none" scrolling="no" tabindex="-1" loading="lazy"
-                data-email-banner-preview data-banner-width="<%= card_width %>"
-                title="<%= entry.label %> banner"
-                style="width:<%= card_width %>px;height:<%= (card_width / entry.ratio).round %>px;border:0;transform-origin:top left;display:block;"
-                <%# ESCAPED EXPLICITLY. render returns an html_safe buffer, so a bare
-                    output tag injects it RAW into the attribute and closes the iframe
-                    at the banner's first quote — the row's markup collapses and the
-                    email's name disappears from the page. to_str drops the safe flag
-                    so the escaping actually happens. %>
-                srcdoc="<%= ERB::Util.html_escape(render("studio/mailers/layered_banner", banner: banner, preview: true).to_str) %>"></iframe>
-      <% elsif banner_url %>
+    <% if banner %>
+      <%= render "studio/emails/banner_preview", banner: banner, ratio: entry.ratio, max_width: 224 %>
+    <% elsif banner_url %>
+      <div class="rounded-lg overflow-hidden border border-subtle"
+           style="aspect-ratio: <%= entry.ratio %>; max-width: 224px;">
         <%= image_tag banner_url, class: "w-full h-full object-cover",
               alt: "#{entry.label} email banner", loading: "lazy" %>
-      <% else %>
-        <div class="w-full h-full flex items-center justify-center text-2xs text-white/80 text-center px-3">
-          No banner
-        </div>
-      <% end %>
-    </div>
+      </div>
+    <% else %>
+      <div class="rounded-lg overflow-hidden border border-subtle flex items-center justify-center text-2xs text-white/80 text-center px-3"
+           style="aspect-ratio: <%= entry.ratio %>; max-width: 224px; background: linear-gradient(135deg, var(--color-primary-700), var(--color-primary-900));">
+        No banner
+      </div>
+    <% end %>
+  </td>
+
+  <td class="px-4 py-4">
+    <p class="text-sm text-heading" data-row-subject><%= subject %></p>
   </td>
 
   <td class="px-4 py-4">
@@ -138,41 +93,4 @@
     <p class="font-mono text-2xs text-muted mt-1"><%= entry.key %></p>
   </td>
 
-  <td class="px-4 py-4">
-    <p class="text-sm text-heading" data-row-subject><%= subject %></p>
-  </td>
-
-  <%# whitespace-nowrap keeps the pill a pill — "<App>'s own" is long enough to
-      wrap inside a bordered badge, which reads as a broken box next to the
-      short "Inherited default". %>
-  <td class="px-4 py-4">
-    <span class="<%= badge_class %> whitespace-nowrap"><%= badge_label %></span>
-    <p class="text-2xs text-muted mt-1.5 max-w-[12rem]"><%= badge_note %></p>
-  </td>
-
-  <% if uploads_available %>
-    <td class="px-4 py-4 text-right whitespace-nowrap">
-      <button type="button" @click="open()" class="btn btn-outline btn-sm inline-flex items-center gap-1.5">
-        <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
-                d="M11 5H6a2 2 0 00-2 2v11a2 2 0 002 2h11a2 2 0 002-2v-5m-1.414-9.414a2 2 0 112.828 2.828L11.828 15H9v-2.828l8.586-8.586z"/>
-        </svg>
-        <%= source == :app ? "Replace" : "Upload" %>
-      </button>
-
-      <%# Only an APP-OWNED image can be reverted — there is nothing to drop when
-          the row is already showing the inherited default. %>
-      <% if source == :app %>
-        <%= button_to "Revert", admin_email_path(entry.key), method: :delete,
-              class: "btn btn-neutral btn-sm mt-1.5 w-full",
-              form: { data: { turbo_confirm: "Drop #{Studio.app_name}'s own #{entry.label} banner and go back to the shared default?" } } %>
-      <% end %>
-
-      <%# The cropper drops its Blob into this hidden input and submits. %>
-      <%= form_with url: admin_email_path(entry.key), method: :patch,
-            html: { multipart: true, id: form_id, "x-ref": "form" } do %>
-        <%= file_field_tag :image, class: "hidden", "x-ref": "fileInput" %>
-      <% end %>
-    </td>
-  <% end %>
 </tr>

data/app/views/studio/emails/index.html.erb

@@ -101,13 +101,13 @@
       <table class="w-full text-left align-middle">
         <thead>
           <tr class="border-b border-subtle">
+            <%# Banner, then what an inbox shows: the subject line, then the
+                email itself. Provenance and the upload button used to sit here;
+                both belong on the email's own page, which is one click away and
+                is where every other change is made. %>
             <th class="label-upper px-4 py-3 w-64">Banner</th>
+            <th class="label-upper px-4 py-3 w-64">Subject</th>
             <th class="label-upper px-4 py-3">Email</th>
-            <th class="label-upper px-4 py-3 w-56">Subject</th>
-            <th class="label-upper px-4 py-3 w-52">Image</th>
-            <% if @uploads_available %>
-              <th class="label-upper px-4 py-3 w-40 text-right">Actions</th>
-            <% end %>
           </tr>
         </thead>
         <tbody @click="openRow($event, $event.target.closest('[data-email-row]'))">

data/app/views/studio/emails/show.html.erb

@@ -29,6 +29,15 @@
     subtext: Studio::EmailCatalog.subtext(@entry.key).to_s,
     subject: (Studio::EmailSetting.copy_for(@entry.key, :subject) || @entry.subject).to_s,
     logo_url: Studio::EmailSetting.copy_for(@entry.key, :logo_url).to_s,
+    body: (Studio::EmailSetting.copy_for(@entry.key, :body) || @entry.body).to_s,
+    cta_text: (Studio::EmailSetting.copy_for(@entry.key, :cta_text) || @entry.cta_text).to_s,
+    cta_color: Studio::EmailCatalog.cta_color(@entry.key).to_s,
+    cta_enabled: Studio::EmailCatalog.cta_enabled?(@entry.key),
+    # The SAVED footer, not the resolved one: the form shows what the operator
+    # actually stored, so a blank field reads as blank rather than echoing the
+    # default back and making "clear this" impossible to express.
+    discord_url: (Studio::EmailSetting.footer || {})[:discord_url].to_s,
+    footer_logo_url: (Studio::EmailSetting.footer || {})[:logo_url].to_s,
     hide_logo: Studio::EmailSetting.hide_logo?(@entry.key),
     scrim_percent: Studio::EmailCatalog.scrim_percent(@entry.key).to_s
   }
@@ -49,12 +58,25 @@
     end
   }
 
-  badge_class, badge_label =
+  # Provenance moved here from the list, along with the upload and the revert —
+  # the list is now a list, and every change to an email is made on its own page.
+  # Four states, because three of them once read as one: an app that ships its
+  # OWN committed artwork was told that artwork "ships with the engine", which is
+  # the wrong answer to the only question this label exists to answer.
+  badge_class, badge_label, badge_note =
     case source
-    when :app       then ["badge bg-success/10 text-success border-success/30", "Uploaded here"]
-    when :app_asset then ["badge bg-success/10 text-success border-success/30", "#{Studio.app_name}'s artwork"]
-    when :engine_default then ["badge bg-inset text-muted border-subtle", "Studio default"]
-    else               ["badge bg-warning/10 text-warning border-warning/30", "No image"]
+    when :app
+      ["badge bg-success/10 text-success border-success/30", "Uploaded here",
+       "Stored for #{Studio.app_name} — this upload is what ships."]
+    when :app_asset
+      ["badge bg-success/10 text-success border-success/30", "#{Studio.app_name}'s artwork",
+       "Committed in this app's own assets. Upload to replace it."]
+    when :engine_default
+      ["badge bg-inset text-muted border-subtle", "Studio default",
+       "Shared artwork that ships with the engine. Upload to make it #{Studio.app_name}'s."]
+    else
+      ["badge bg-warning/10 text-warning border-warning/30", "No image",
+       "This email sends without a banner."]
     end
 %>
 <div class="max-w-5xl mx-auto px-4 pb-16"
@@ -193,13 +215,7 @@
       <% end %>>
       <p class="label-upper mb-3">Banner</p>
       <% if @banner %>
-        <div class="rounded-lg overflow-hidden border border-subtle"
-             style="aspect-ratio: <%= aspect %>; max-width: <%= card_width %>px;" data-email-banner-frame>
-          <div data-email-banner-preview data-banner-width="<%= card_width %>"
-               style="width:<%= card_width %>px;transform-origin:top left;">
-            <%= render "studio/mailers/layered_banner", banner: @banner, preview: true %>
-          </div>
-        </div>
+        <%= render "studio/emails/banner_preview", banner: @banner, ratio: aspect, max_width: card_width %>
       <% else %>
         <div class="rounded-lg overflow-hidden border border-subtle flex items-center justify-center text-xs text-muted text-center px-4"
              style="aspect-ratio: <%= aspect %>; max-width: <%= card_width %>px;">
@@ -244,6 +260,14 @@
           <%= file_field_tag :image, class: "hidden", "x-ref": "fileInput" %>
         <% end %>
       <% end %>
+      <p class="text-sm text-body mt-3"><%= badge_note %></p>
+      <% if @uploads_available && source == :app %>
+        <%# Only an APP-OWNED image can be reverted — there is nothing to drop
+            when this email is already showing the inherited default. %>
+        <%= button_to "Revert to the shared default", admin_email_path(@entry.key), method: :delete,
+              class: "btn btn-outline btn-sm mt-2",
+              form: { data: { turbo_confirm: "Drop #{Studio.app_name}'s own #{@entry.label} banner and go back to the shared default?" } } %>
+      <% end %>
       <p class="text-2xs text-muted mt-2">
         <% if @uploads_available %>
           GIFs keep their animation. Displayed at <%= card_width %>x<%= (card_width / aspect).round %>.
@@ -338,6 +362,77 @@
     </section>
   </div>
 
+  <%# BELOW THE BANNER — the words, the button, and the footer every email
+      shares. Each field reaches a real send: the mailers read these from the
+      catalogue instead of hard-coding copy, so a card here is not a control that
+      changes nothing. %>
+  <div class="grid gap-6 md:grid-cols-2 mb-6">
+    <section class="card p-4">
+      <p class="label-upper mb-2">Body</p>
+      <p class="text-sm text-body mb-3">
+        The paragraph under the header. Blank lines make new paragraphs, and
+        <code class="font-mono text-2xs px-1 py-0.5 rounded bg-inset">{name}</code>
+        <code class="font-mono text-2xs px-1 py-0.5 rounded bg-inset">{app}</code> apply here too.
+      </p>
+      <%= text_area_tag :body, saved[:body], id: "body", name: nil, rows: 7,
+            "x-model": "form.body", class: "input-field w-full py-2" %>
+    </section>
+
+    <%# Offered ONLY when this email's template can render a button. A card for
+        an email that cannot is a dead control: the operator ticks the box, saves,
+        and no button ever appears. %>
+    <% if @entry.supports_cta? %>
+    <section class="card p-4">
+      <p class="label-upper mb-2">Call to action</p>
+      <div class="space-y-4">
+        <label class="flex items-center gap-2 text-sm text-body">
+          <%= check_box_tag :cta_enabled, "1", saved[:cta_enabled],
+                "x-model": "form.cta_enabled", class: "rounded border-subtle" %>
+          Show the button
+        </label>
+        <div :class="form.cta_enabled ? '' : 'opacity-50 pointer-events-none'">
+          <label class="text-sm text-muted block mb-1" for="cta_text">Button text</label>
+          <%= text_field_tag :cta_text, saved[:cta_text], id: "cta_text", name: nil,
+                "x-model": "form.cta_text", class: "input-field w-full py-2" %>
+          <label class="text-sm text-muted block mb-1 mt-3" for="cta_color">Button colour</label>
+          <div class="flex items-center gap-3">
+            <%= color_field_tag :cta_color, saved[:cta_color], id: "cta_color", name: nil,
+                  "x-model": "form.cta_color", class: "h-9 w-14 rounded border border-subtle bg-transparent" %>
+            <span class="font-mono text-2xs text-muted" x-text="form.cta_color"></span>
+          </div>
+          <p class="text-2xs text-muted mt-2">Defaults to this app's primary colour.</p>
+        </div>
+      </div>
+    </section>
+    <% end %>
+  </div>
+
+  <%# THE FOOTER IS SHARED. Stored once for the whole app rather than per email,
+      because it is the same block on every one — so the label says out loud that
+      editing it here changes every email this app sends. %>
+  <section class="card p-4 mb-6">
+    <p class="label-upper mb-2">Footer</p>
+    <p class="text-sm text-body mb-3">Shared by every email <%= Studio.app_name %> sends.</p>
+    <div class="grid gap-4 md:grid-cols-2">
+      <div>
+        <label class="text-sm text-muted block mb-1" for="discord_url">Discord invite</label>
+        <%= text_field_tag :discord_url, saved[:discord_url], id: "discord_url", name: nil,
+              "x-model": "form.discord_url", placeholder: "https://discord.gg/…",
+              class: "input-field w-full py-2 font-mono text-2xs" %>
+      </div>
+      <div>
+        <label class="text-sm text-muted block mb-1" for="footer_logo_url">Application logo</label>
+        <%= text_field_tag :footer_logo_url, saved[:footer_logo_url], id: "footer_logo_url", name: nil,
+              "x-model": "form.footer_logo_url",
+              class: "input-field w-full py-2 font-mono text-2xs" %>
+      </div>
+    </div>
+    <p class="text-2xs text-muted mt-2">
+      Leave both blank and no footer renders at all. Clearing them later removes it
+      from every email.
+    </p>
+  </section>
+
   <%# The email itself. An iframe because the response IS an email document — its
       own document shell, its own table layout, and no business inheriting the
       admin page's stylesheet. %>
@@ -374,6 +469,12 @@
     <input type="hidden" name="logo_url" :value="form.logo_url">
     <input type="hidden" name="hide_logo" :value="form.hide_logo ? '1' : ''">
     <input type="hidden" name="scrim_percent" :value="form.scrim_percent">
+    <input type="hidden" name="body" :value="form.body">
+    <input type="hidden" name="cta_text" :value="form.cta_text">
+    <input type="hidden" name="cta_color" :value="form.cta_color">
+    <input type="hidden" name="cta_enabled" :value="form.cta_enabled ? '1' : '0'">
+    <input type="hidden" name="discord_url" :value="form.discord_url">
+    <input type="hidden" name="footer_logo_url" :value="form.footer_logo_url">
   <% end %>
 
   <%= render "studio/emails/banner_scale" %>

data/app/views/studio/newsletter_mailer/subscribed.html.erb

@@ -3,10 +3,17 @@
     emails read as coming from the same place. %>
 <h1 style="margin:0 0 18px;font-size:22px;line-height:1.3;color:#1f2a1c;">You're on the list</h1>
 
-<p style="margin:0 0 24px;font-size:16px;line-height:1.6;color:#3f4a3c;">
-  Thanks for subscribing to <strong style="color:#1f2a1c;"><%= @app_name %></strong>. We'll send
-  the occasional note about what we're building — no more often than it's worth your time.
-</p>
+<%# From the catalogue, so /admin/emails owns this copy.
+
+    sanitize: true strips scripts and event handlers; it leaves a, strong and img
+    standing. The author is an admin, so that is a reasonable line — but it is not
+    "no HTML", and describing it that way would misstate the guard. %>
+<%# Resolved here as well as in the mailer, for the same reason the sign-in view
+    does it: a host may render this view from its own mailer. %>
+<% body = @body.presence || Studio::EmailCatalog.body(:newsletter_subscribed) %>
+<% if body.present? %>
+  <%= simple_format body, { style: "margin:0 0 24px;font-size:16px;line-height:1.6;color:#3f4a3c;" }, sanitize: true %>
+<% end %>
 
 <p style="margin:0 0 24px;font-size:16px;line-height:1.6;color:#3f4a3c;">
   Nothing else to do. The next one lands in this inbox.

data/app/views/user_mailer/magic_link.html.erb

@@ -1,22 +1,50 @@
 <%# Body only — branded_mailer supplies the banner + card.
 
-    The button is theme PRIMARY, not success. Success is the "it worked" green;
+    The button and its copy-and-paste fallback share ONE colour — cta_color,
+    which the operator can change. They were pinned to different sources, so a
+    yellow button left a purple fallback underneath it and the pair the comment
+    below promises to keep together came apart.
+
+    The button is theme PRIMARY by default, not success. Success is the "it worked" green;
     signing in has not happened yet, and the brand colour is what ties the button
     to the banner above it. The copy-and-paste link is the SAME colour on purpose
     — it is the button's fallback, and a green link under a purple button reads
     as a mistake. %>
 <h1 style="margin:0 0 18px;font-size:22px;line-height:1.3;color:#1f2a1c;">Your sign-in link</h1>
 
-<p style="margin:0 0 24px;font-size:16px;line-height:1.6;color:#3f4a3c;">
-  Tap the button below to sign in to <strong style="color:#1f2a1c;"><%= @app_name %></strong> — no password needed.
-  If you don't have an account yet, we'll create one for you.
-</p>
+<%# BODY AND BUTTON COME FROM THE CATALOGUE, not from this file. An operator
+    edits them on /admin/emails; the strings that used to live here are the
+    registry defaults, so an app that never opens that page sends what it always
+    sent.
+
+    simple_format(sanitize: true) turns blank lines into paragraphs and strips
+    scripts and event handlers — it does NOT strip all HTML: a, strong and img
+    survive. That is acceptable because the author is an admin, but the guard is
+    narrower than "no HTML" and the comment should not claim otherwise.
+
+    THE VIEW RESOLVES THEM ITSELF when the mailer did not. A host that defines
+    its own UserMailer — turf-monster does on main; McRitchie Studio does on its
+    adoption branch — renders THIS
+    view without setting the new ivars, so depending on them alone shipped an
+    email with no body and no button to exactly the apps that had customised
+    their mail. The mailer's values still win when present, which is what carries
+    the recipient's name into the copy. %>
+<%
+  body      = @body.presence      || Studio::EmailCatalog.body(:magic_link)
+  cta_text  = @cta_text.presence  || (Studio::EmailCatalog.cta_enabled?(:magic_link) ? Studio::EmailCatalog.cta_text(:magic_link) : nil)
+  cta_color = @cta_color.presence || Studio::EmailCatalog.cta_color(:magic_link)
+%>
+<% if body.present? %>
+  <%= simple_format body, { style: "margin:0 0 24px;font-size:16px;line-height:1.6;color:#3f4a3c;" }, sanitize: true %>
+<% end %>
 
-<table role="presentation" cellpadding="0" cellspacing="0" border="0" align="center" style="margin:0 auto;">
-  <tr><td align="center" bgcolor="<%= Studio.theme_primary %>" style="border-radius:10px;">
-    <a href="<%= @magic_url %>" style="display:inline-block;padding:16px 40px;font-size:17px;font-weight:700;color:#ffffff;text-decoration:none;border-radius:10px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">Sign in to <%= @app_name %> 🪄</a>
-  </td></tr>
-</table>
+<% if cta_text.present? %>
+  <table role="presentation" cellpadding="0" cellspacing="0" border="0" align="center" style="margin:0 auto;">
+    <tr><td align="center" bgcolor="<%= cta_color %>" style="border-radius:10px;">
+      <a href="<%= @magic_url %>" style="display:inline-block;padding:16px 40px;font-size:17px;font-weight:700;color:#ffffff;text-decoration:none;border-radius:10px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;"><%= cta_text %> 🪄</a>
+    </td></tr>
+  </table>
+<% end %>
 
 <p style="margin:28px 0 0;font-size:13px;line-height:1.5;color:#6b756a;text-align:center;">
   This link is for <strong style="color:#2f3a2c;"><%= @email %></strong> and expires in <%= Studio.magic_link_ttl.in_minutes.round %> minutes — it can only be used once.
@@ -28,7 +56,7 @@
       button fails, so it has to be readable enough to select by hand. It stays
       a step under the 12px label above it — the label explains, the URL is the
       thing you drag across. %>
-  <a href="<%= @magic_url %>" style="font-size:11px;line-height:1.5;color:<%= Studio.theme_primary %>;word-break:break-all;"><%= @magic_url %></a>
+  <a href="<%= @magic_url %>" style="font-size:11px;line-height:1.5;color:<%= cta_color %>;word-break:break-all;"><%= @magic_url %></a>
 </p>
 
 <p style="margin:28px 0 0;font-size:12px;line-height:1.5;color:#8a948a;text-align:center;">

data/db/migrate/20260813010000_add_body_cta_footer_to_studio_email_settings.rb

@@ -0,0 +1,32 @@
+# The email BELOW the banner: its body copy, its call to action, and the footer
+# every email shares.
+#
+# Same rule as the banner's words — nil means INHERIT the registry default, so
+# an app that never opens /admin/emails sends exactly what it sent before.
+#
+# The FOOTER is app-wide rather than per-email, and it lives in this same table
+# under a reserved key (Studio::EmailSetting::FOOTER_KEY). A separate table for
+# two strings would cost a migration, a model and a join to say the same thing;
+# a reserved key keeps one place to look for "what has the operator changed".
+class AddBodyCtaFooterToStudioEmailSettings < ActiveRecord::Migration[7.2]
+  def change
+    change_table :studio_email_settings, bulk: true do |t|
+      # The paragraph(s) under the header. Rendered through
+      # simple_format(sanitize: true), which makes blank lines into paragraphs and
+      # strips scripts and event handlers — inline tags like a and strong survive.
+      # The author is an admin, so that line is deliberate rather than an oversight.
+      t.text    :body
+
+      t.string  :cta_text
+      # Hex, defaulting to the app's primary. Stored rather than derived so an
+      # operator can make one email's button stand out.
+      t.string  :cta_color
+      # NULL, not false: three states again. nil inherits the registry's answer,
+      # true and false are the operator's.
+      t.boolean :cta_enabled
+
+      # Footer, on the reserved row.
+      t.string  :discord_url
+    end
+  end
+end

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.42.0"
+  VERSION = "0.43.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.42.0
+  version: 0.43.0
 platform: ruby
 authors:
 - Alex McRitchie
@@ -285,6 +285,7 @@ files:
 - app/views/studio/board/_column.html.erb
 - app/views/studio/email_images/index.html.erb
 - app/views/studio/emails/_banner_editor.html.erb
+- app/views/studio/emails/_banner_preview.html.erb
 - app/views/studio/emails/_banner_scale.html.erb
 - app/views/studio/emails/_recipient_picker.html.erb
 - app/views/studio/emails/_recipient_repaint.html.erb
@@ -354,6 +355,7 @@ files:
 - db/migrate/20260812000000_create_studio_email_settings.rb
 - db/migrate/20260812210000_add_copy_to_studio_email_settings.rb
 - db/migrate/20260812220000_add_subject_to_studio_email_settings.rb
+- db/migrate/20260813010000_add_body_cta_footer_to_studio_email_settings.rb
 - lib/studio-engine.rb
 - lib/studio.rb
 - lib/studio/cable.rb