plutonium 0.60.5 → 0.61.0

data/lib/plutonium.rb

@@ -10,7 +10,11 @@ require "phlexi-display"
 require "phlexi-form"
 require "phlexi-table"
 
+require_relative "plutonium/wizard"
+require_relative "plutonium/migrations"
 require_relative "plutonium/configuration"
+require_relative "plutonium/positioning"
+require_relative "plutonium/kanban"
 require_relative "rodauth/plugins" if defined?(Rodauth)
 
 # Plutonium module
@@ -46,6 +50,7 @@ module Plutonium
     loader.ignore("#{__dir__}/rodauth")
     loader.inflector.inflect("ui" => "UI")
     loader.inflector.inflect("workflow_dsl" => "WorkflowDSL")
+    loader.inflector.inflect("dsl" => "DSL")
     loader.enable_reloading if defined?(Rails.env) && Rails.env.development?
     loader.setup
   end

data/lib/rodauth/features/case_insensitive_login.rb

@@ -10,7 +10,7 @@ module Rodauth
       logins = [login_param]
       logins << login_confirm_param if respond_to?(:login_confirm_param)
 
-      if [logins].include?(key)
+      if logins.include?(key)
         super.downcase
       else
         super

data/lib/tasks/release.rake

@@ -1,230 +1,183 @@
 # frozen_string_literal: true
 
+# Release flow
+# ------------
+# Publishing happens from a laptop. CI does NOT push to any registry — it only
+# cuts the GitHub Release (with notes + the built gem) when the tag lands.
+#
+#   1. rake release:prepare          # auto-computes next version via git-cliff
+#      rake release:prepare[1.2.3]   # ...or pass one explicitly
+#                                    # → bumps + regenerates changelog + builds assets,
+#                                    #   STAGES them, and shows the diff. Nothing is committed.
+#   2. git diff --cached             # review the staged changes
+#   3. rake release:publish          # commits, publishes gem + npm, then tags + pushes
+#                                    #   → CI cuts the Release from the tag
+#
+# To abort after prepare: git reset --hard (discards the staged changes).
+# release:publish is idempotent and resumable: it skips a gem/npm already live
+# and only tags if the tag is missing, so a partial failure can just be re-run.
+
+require "json"
+
+RELEASE_CLIFF_CONFIG = ".cliff.toml"
+RELEASE_VERSION_FILE = "lib/plutonium/version.rb"
+RELEASE_PACKAGE_JSON = "package.json"
+RELEASE_NPM_PACKAGE = "@radioactive-labs/plutonium"
+
 namespace :release do
-  desc "Display next version based on conventional commits"
-  task :next_version do
-    current_version = Plutonium::VERSION
-    puts "Current version: #{current_version}"
+  # --- helpers --------------------------------------------------------------
 
-    # Find the tag to compare against
-    version_tag = "v#{current_version}"
-    tag_exists = system("git rev-parse #{version_tag} >/dev/null 2>&1")
-
-    unless tag_exists
-      # Fall back to most recent tag
-      version_tag = `git describe --tags --abbrev=0 2>/dev/null`.strip
-      if version_tag.empty?
-        puts "No tags found, comparing against initial commit"
-        version_tag = `git rev-list --max-parents=0 HEAD`.strip
-      else
-        puts "Tag v#{current_version} not found, comparing against #{version_tag}"
-      end
-    end
+  def current_version
+    File.read(RELEASE_VERSION_FILE)[/VERSION = "([\d.]+)"/, 1] ||
+      abort("Could not read VERSION from #{RELEASE_VERSION_FILE}")
+  end
 
-    # Check for breaking changes, features, or fixes since last tag
-    breaking = `git log #{version_tag}..HEAD --oneline | grep -i "BREAKING CHANGE"`.strip
-    features = `git log #{version_tag}..HEAD --oneline | grep "^[a-f0-9]* feat"`.strip
-    fixes = `git log #{version_tag}..HEAD --oneline | grep "^[a-f0-9]* fix"`.strip
-
-    major, minor, patch = current_version.split(".").map(&:to_i)
-
-    if !breaking.empty?
-      next_version = "#{major + 1}.0.0"
-      puts "Next version (breaking changes): #{next_version}"
-    elsif !features.empty?
-      next_version = "#{major}.#{minor + 1}.0"
-      puts "Next version (new features): #{next_version}"
-    elsif !fixes.empty?
-      next_version = "#{major}.#{minor}.#{patch + 1}"
-      puts "Next version (bug fixes): #{next_version}"
-    else
-      puts "No changes detected"
-    end
+  def git_cliff?
+    system("which git-cliff > /dev/null 2>&1")
   end
 
-  desc "Prepare a new release"
-  task :prepare, [:version] do |_t, args|
-    version = args[:version]
+  # Next version per conventional commits. git-cliff owns the semver math
+  # (including the pre-1.0 rules configured under [bump] in .cliff.toml).
+  def computed_next_version
+    abort "git-cliff not found. Install with: brew install git-cliff" unless git_cliff?
+    bumped = `git-cliff --config #{RELEASE_CLIFF_CONFIG} --bumped-version 2>/dev/null`.strip
+    abort "git-cliff could not compute a version (no conventional commits since last tag?)" if bumped.empty?
+    bumped.delete_prefix("v")
+  end
 
-    unless version
-      puts "Usage: rake release:prepare[VERSION]"
-      puts "Example: rake release:prepare[0.27.0]"
-      exit 1
-    end
+  def gem_published?(version)
+    out = `gem list --remote --exact --all plutonium 2>/dev/null`
+    out.include?("#{version},") || out.include?("#{version})") || out.include?(" #{version} ")
+  end
+
+  def npm_published?(version)
+    published = `npm view #{RELEASE_NPM_PACKAGE}@#{version} version 2>/dev/null`.strip
+    published == version
+  end
+
+  # --- version --------------------------------------------------------------
+
+  desc "Show the next version computed from conventional commits"
+  task :version do
+    puts "Current version: #{current_version}"
+    puts "Next version:    #{computed_next_version}"
+  end
+
+  # --- prepare --------------------------------------------------------------
+
+  desc "Stage a release (bump + changelog + assets) for review. Version optional; git-cliff computes it."
+  task :prepare, [:version] do |_t, args|
+    version = args[:version] || computed_next_version
 
-    # Validate version format
     unless version.match?(/^\d+\.\d+\.\d+$/)
-      puts "Error: Version must be in format X.Y.Z"
-      exit 1
+      abort "Error: version must be in format X.Y.Z (got #{version.inspect})"
     end
 
-    # Update version.rb
-    version_file = "lib/plutonium/version.rb"
-    content = File.read(version_file)
-    updated_content = content.gsub(/VERSION = "[\d.]+"/, %(VERSION = "#{version}"))
-    File.write(version_file, updated_content)
-    puts "✓ Updated #{version_file}"
-
-    # Update package.json version
-    package_json_file = "package.json"
-    if File.exist?(package_json_file)
-      package_content = File.read(package_json_file)
-      updated_package = package_content.gsub(/"version":\s*"[\d.]+"/, %("version": "#{version}"))
-      File.write(package_json_file, updated_package)
-      puts "✓ Updated #{package_json_file}"
+    unless `git status --porcelain`.strip.empty?
+      abort "Error: working tree is dirty. Commit or stash first."
     end
 
-    # Generate changelog using git-cliff
-    if system("which git-cliff > /dev/null 2>&1")
-      system("git-cliff --tag v#{version} -o CHANGELOG.md")
-      puts "✓ Generated CHANGELOG.md"
-    else
-      puts "⚠ git-cliff not found. Install with: brew install git-cliff"
-      puts "  Skipping changelog generation"
-    end
+    puts "Preparing release v#{version}..."
+
+    # Bump version.rb
+    content = File.read(RELEASE_VERSION_FILE)
+    File.write(RELEASE_VERSION_FILE, content.gsub(/VERSION = "[\d.]+"/, %(VERSION = "#{version}")))
+    puts "✓ #{RELEASE_VERSION_FILE}"
+
+    # Bump package.json
+    pkg = File.read(RELEASE_PACKAGE_JSON)
+    File.write(RELEASE_PACKAGE_JSON, pkg.gsub(/"version":\s*"[\d.]+"/, %("version": "#{version}")))
+    puts "✓ #{RELEASE_PACKAGE_JSON}"
 
-    # Build front-end assets
+    # Changelog — same config CI uses for release notes, so they agree.
+    abort "git-cliff not found. Install with: brew install git-cliff" unless git_cliff?
+    system("git-cliff", "--config", RELEASE_CLIFF_CONFIG, "--tag", "v#{version}", "-o", "CHANGELOG.md") ||
+      abort("Changelog generation failed")
+    puts "✓ CHANGELOG.md"
+
+    # Rebuild committed frontend assets so the tagged tree ships current JS/CSS.
     Rake::Task["release:build_frontend"].invoke
 
-    puts "\nNext steps:"
-    puts "1. Review the changes:"
-    puts "   git diff"
-    puts "2. Commit the version bump:"
-    puts "   git add -A"
-    puts "   git commit -m 'chore(release): prepare for v#{version}'"
-    puts "3. Create and push the tag:"
-    puts "   git tag v#{version}"
-    puts "   git push origin main --tags"
-    puts "4. Build and release:"
-    puts "   rake release:publish"
+    # Stage everything and show it — review happens BEFORE anything is committed.
+    system("git", "add", "-A") || abort("git add failed")
+
+    puts "\n✓ Staged release v#{version} (nothing committed yet)."
+    puts "\nStaged changes:"
+    system("git", "--no-pager", "diff", "--cached", "--stat")
+    puts "\nNext:"
+    puts "  git diff --cached     # review the full diff"
+    puts "  rake release:publish  # commit, publish gem + npm, tag + push"
+    puts "  git reset --hard      # abort and discard the staged changes"
   end
 
   desc "Build front-end assets"
   task :build_frontend do
     puts "Building front-end assets..."
-    # in: File::NULL — yarn 4 puts the terminal in raw mode for its
-    # progress UI and doesn't always restore it on exit. Without this,
-    # subsequent `$stdin.gets` prompts read one keystroke at a time and
-    # never see a newline, so Enter never terminates the line.
     system("yarn build", in: File::NULL) || abort("Front-end build failed")
     puts "✓ Built front-end assets"
   end
 
-  desc "Publish the gem to RubyGems"
-  task :publish_gem do
-    # Reload version constant in case it was updated
-    load "lib/plutonium/version.rb"
-    version = Plutonium::VERSION
-
-    # Build the gem
-    puts "Building gem..."
-    system("gem build plutonium.gemspec") || abort("Gem build failed")
-
-    # Push to RubyGems
-    puts "Publishing to RubyGems..."
-    gem_file = "plutonium-#{version}.gem"
-    system("gem push #{gem_file}") || abort("Gem push failed")
-
-    puts "✓ Published plutonium #{version} to RubyGems"
-
-    # Clean up
-    File.delete(gem_file) if File.exist?(gem_file)
-  end
-
-  desc "Publish the npm package"
-  task :publish_npm do
-    puts "Publishing npm package..."
-
-    # Check if user is logged in to npm, login if needed
-    unless system("npm whoami > /dev/null 2>&1")
-      puts "Not logged in to npm. Opening login..."
-      system("npm login") || abort("npm login failed")
-    end
-
-    # Publish to npm
-    system("npm publish --access public") || abort("npm publish failed")
-
-    # Get version from package.json
-    require "json"
-    package_json = JSON.parse(File.read("package.json"))
-    version = package_json["version"]
-
-    puts "✓ Published @radioactive-labs/plutonium #{version} to npm"
-  end
-
-  desc "Publish both gem and npm package"
-  task publish: [:build_frontend, :publish_gem, :publish_npm]
+  # --- publish (primary; idempotent + resumable) ----------------------------
 
-  desc "Full release workflow"
-  task :full, [:version] do |_t, args|
-    version = args[:version]
+  desc "Commit the prepared release, publish gem + npm, then tag + push (fires the Release workflow)"
+  task publish: [:build_frontend] do
+    version = current_version
+    tag = "v#{version}"
 
-    unless version
-      puts "Usage: rake release:full[VERSION]"
-      exit 1
+    # Commit the changes prepare left staged for review. If the tree is already
+    # clean (e.g. re-running after a partial failure), there's nothing to commit.
+    if `git status --porcelain`.strip.empty?
+      puts "• working tree clean — nothing to commit"
+    else
+      system("git", "add", "-A") || abort("git add failed")
+      system("git", "commit", "-m", "chore(release): prepare for v#{version}") || abort("git commit failed")
+      puts "✓ Committed release v#{version}"
     end
 
-    # Snapshot the terminal mode up front. yarn 4 and git-cliff both put
-    # the TTY in raw mode for progress UIs and don't always restore it,
-    # which breaks every subsequent `$stdin.gets` (Enter arrives as a
-    # bare \r and gets() never returns). Restore the snapshot before each
-    # prompt so the user can actually answer.
-    tty_state = `stty -g 2>/dev/null`.strip
-    restore_tty = -> { system("stty #{tty_state} 2>/dev/null") if tty_state != "" }
-
-    puts "Starting release workflow for v#{version}..."
-
-    # Check npm authentication early, login if needed
-    unless system("npm whoami > /dev/null 2>&1")
-      puts "Not logged in to npm. Opening login..."
-      system("npm login") || abort("npm login failed")
+    # Gem (skip if this version is already on RubyGems)
+    if gem_published?(version)
+      puts "• gem plutonium #{version} already on RubyGems — skipping"
+    else
+      puts "Building + pushing gem..."
+      system("gem build plutonium.gemspec") || abort("Gem build failed")
+      gem_file = "plutonium-#{version}.gem"
+      system("gem push #{gem_file}") || abort("Gem push failed")
+      File.delete(gem_file) if File.exist?(gem_file)
+      puts "✓ Published plutonium #{version} to RubyGems"
     end
-    puts "✓ npm authenticated as: #{`npm whoami`.strip}"
 
-    # Check for uncommitted changes
-    unless `git status --porcelain`.strip.empty?
-      puts "Error: You have uncommitted changes. Please commit or stash them first."
-      exit 1
+    # npm (skip if this version is already published)
+    if npm_published?(version)
+      puts "• npm #{RELEASE_NPM_PACKAGE}@#{version} already published — skipping"
+    else
+      unless system("npm whoami > /dev/null 2>&1")
+        puts "Not logged in to npm. Opening login..."
+        system("npm login") || abort("npm login failed")
+      end
+      system("npm publish --access public") || abort("npm publish failed")
+      puts "✓ Published #{RELEASE_NPM_PACKAGE} #{version} to npm"
     end
 
-    # Check we're on main branch
-    current_branch = `git branch --show-current`.strip
-    unless current_branch == "main" || current_branch == "master"
-      puts "Warning: You're not on main/master branch (current: #{current_branch})"
-      restore_tty.call
-      print "Continue anyway? [y/N] "
-      exit 1 unless $stdin.gets.strip.downcase == "y"
+    # Tag + push last, so CI cuts the Release only once the packages are live.
+    branch = `git branch --show-current`.strip
+    if system("git rev-parse #{tag} >/dev/null 2>&1")
+      puts "• tag #{tag} already exists — skipping tag"
+    else
+      system("git", "tag", tag) || abort("git tag failed")
     end
+    system("git", "push", "origin", branch) || abort("git push branch failed")
+    system("git", "push", "origin", tag) || abort("git push tag failed")
 
-    # Prepare release
-    Rake::Task["release:prepare"].invoke(version)
-
-    # Confirm before proceeding
-    restore_tty.call
-    puts "\nReady to commit, tag, and publish?"
-    print "Continue? [y/N] "
-    exit 0 unless $stdin.gets.strip.downcase == "y"
-
-    # Commit
-    system("git add -A")
-    system("git commit -m 'chore(release): prepare for v#{version}'")
-
-    # Push commit (without tags yet)
-    system("git push origin #{current_branch}")
-
-    # Build and publish (do this BEFORE tagging)
-    puts "\nBuilding and publishing gem and npm package..."
-    Rake::Task["release:publish"].invoke
-
-    # Only tag and push tag if publish succeeded
-    puts "\nCreating and pushing tag..."
-    system("git tag v#{version}")
-    system("git push origin v#{version}")
-
-    puts "\n✓ Release complete!"
-    puts "GitHub Actions will create the release shortly."
+    puts "\n✓ Released #{tag}. GitHub Actions will cut the Release from the tag."
+    puts "  Watch: https://github.com/radioactive-labs/plutonium-core/actions"
   end
 end
 
-desc "Release tasks"
-task release: ["release:next_version"]
+# Neutralize the dangerous bare `rake release` that bundler/gem_tasks defines
+# (it would tag + gem push directly). Point people at the real flow instead.
+if Rake::Task.task_defined?("release")
+  Rake::Task["release"].clear
+  task :release do
+    warn "Use `rake release:prepare` then `rake release:publish`. See lib/tasks/release.rake."
+  end
+end

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@radioactive-labs/plutonium",
-  "version": "0.60.5",
+  "version": "0.61.0",
   "description": "Build production-ready Rails apps in minutes, not days. Convention-driven, fully customizable, AI-ready.",
   "type": "module",
   "main": "src/js/core.js",
@@ -25,7 +25,7 @@
     "@uppy/dashboard": "^4.1.3",
     "@uppy/image-editor": "^3.2.1",
     "@uppy/xhr-upload": "^4.2.3",
-    "dompurify": "^3.4.3",
+    "dompurify": "^3.4.11",
     "lodash.debounce": "^4.0.8",
     "marked": "^15.0.3"
   },
@@ -38,7 +38,7 @@
     "chokidar-cli": "^3.0.0",
     "concurrently": "^8.2.2",
     "cssnano": "^7.0.2",
-    "esbuild": "^0.28.0",
+    "esbuild": "^0.28.1",
     "esbuild-plugin-manifest": "^1.0.3",
     "flowbite-typography": "^1.0.5",
     "medium-zoom": "^1.1.0",

data/src/css/components.css

@@ -931,3 +931,135 @@ html.pu-rail-pinned .icon-rail-pin-expand {
 .dark .pu-alert-info        { @apply text-info-400; }
 .pu-alert-info .pu-alert-close       { @apply bg-info-50 text-info-500 hover:bg-info-200 focus:ring-info-400; }
 .dark .pu-alert-info .pu-alert-close { @apply text-info-400; }
+
+/* ===========================================================================
+   Wizard — horizontal "steps" stepper (numbered nodes on a connector track)
+   =========================================================================== */
+.pu-wizard-steps { @apply flex list-none m-0 p-0; }
+.pu-wizard-steps > li { @apply relative flex-1 min-w-0 text-center; }
+
+/* the connector track: two halves behind each node, so first/last don't overhang */
+.pu-wizard-steps > li::before,
+.pu-wizard-steps > li::after {
+  content: ""; position: absolute; top: 17px; height: 2px; z-index: 0;
+  background: var(--pu-border);
+}
+.pu-wizard-steps > li::before { left: 0; right: 50%; }
+.pu-wizard-steps > li::after  { left: 50%; right: 0; }
+.pu-wizard-steps > li:first-child::before,
+.pu-wizard-steps > li:last-child::after { display: none; }
+
+.pu-wizard-steps .pu-step-link { @apply block no-underline; }
+.pu-wizard-steps .pu-step-node {
+  @apply relative z-10 mx-auto grid place-items-center font-semibold;
+  width: 34px; height: 34px; border-radius: 9999px; font-size: .85rem;
+  background: var(--pu-surface); border: 2px solid var(--pu-border-strong);
+  color: var(--pu-text-subtle); transition: all .2s;
+}
+.pu-wizard-steps .pu-step-label {
+  @apply block mt-2 font-bold; font-size: .8rem; color: var(--pu-text-muted);
+}
+.pu-wizard-steps a.pu-step-link:hover .pu-step-label { @apply underline; }
+
+/* current */
+.pu-wizard-steps > li[data-state="current"] .pu-step-node {
+  @apply bg-primary-600 text-white; border-color: theme(colors.primary.600);
+  box-shadow: 0 0 0 5px color-mix(in srgb, theme(colors.primary.600) 16%, transparent);
+}
+.dark .pu-wizard-steps > li[data-state="current"] .pu-step-node {
+  @apply bg-primary-400 text-primary-950; border-color: theme(colors.primary.400);
+  box-shadow: 0 0 0 5px color-mix(in srgb, theme(colors.primary.400) 20%, transparent);
+}
+.pu-wizard-steps > li[data-state="current"] .pu-step-label { color: var(--pu-text); }
+
+/* done — opaque tint (mixed with the surface, not transparent) so the connector
+   track behind the node never shows through and "cuts" the circle */
+.pu-wizard-steps > li[data-state="completed"] .pu-step-node {
+  @apply text-primary-600; border-color: theme(colors.primary.600);
+  background: color-mix(in srgb, theme(colors.primary.600) 12%, var(--pu-surface));
+}
+.dark .pu-wizard-steps > li[data-state="completed"] .pu-step-node {
+  @apply text-primary-400; border-color: theme(colors.primary.400);
+  background: color-mix(in srgb, theme(colors.primary.400) 16%, var(--pu-surface));
+}
+.pu-wizard-steps > li[data-state="completed"] .pu-step-number { display: none; }
+.pu-wizard-steps > li[data-state="completed"] .pu-step-node::after { content: "\2713"; }
+
+/* reached but NOT complete — a revealed branch step the cursor landed on that was
+   never submitted (or is now invalid). Show the number in a warning tint (matching
+   the review's "needs attention" banner), never the done-check. */
+.pu-wizard-steps > li[data-state="incomplete"] .pu-step-node {
+  @apply text-warning-600; border-color: theme(colors.warning.500);
+  background: color-mix(in srgb, theme(colors.warning.500) 12%, var(--pu-surface));
+}
+.dark .pu-wizard-steps > li[data-state="incomplete"] .pu-step-node {
+  @apply text-warning-400; border-color: theme(colors.warning.400);
+  background: color-mix(in srgb, theme(colors.warning.400) 16%, var(--pu-surface));
+}
+
+/* the terminal (review) node shows a finish flag, never the done-check — even
+   once it's been reached (`completed` state) */
+.pu-wizard-steps > li[data-terminal] .pu-step-node::after { content: none; }
+
+/* filled connectors: a node's trailing half (::after) colors only when the NEXT
+   node is reached (completed/current), and its leading half (::before) colors
+   when this node itself is reached. So navigating BACK to a step still shows a
+   filled line into the reached step that follows it — no stray gray segment. */
+.pu-wizard-steps > li[data-state="completed"]::before,
+.pu-wizard-steps > li[data-state="current"]::before,
+.pu-wizard-steps > li[data-state="incomplete"]::before,
+.pu-wizard-steps > li:has(+ li[data-state="completed"])::after,
+.pu-wizard-steps > li:has(+ li[data-state="current"])::after,
+.pu-wizard-steps > li:has(+ li[data-state="incomplete"])::after { background: theme(colors.primary.500); }
+.dark .pu-wizard-steps > li[data-state="completed"]::before,
+.dark .pu-wizard-steps > li[data-state="current"]::before,
+.dark .pu-wizard-steps > li[data-state="incomplete"]::before,
+.dark .pu-wizard-steps > li:has(+ li[data-state="completed"])::after,
+.dark .pu-wizard-steps > li:has(+ li[data-state="current"])::after,
+.dark .pu-wizard-steps > li:has(+ li[data-state="incomplete"])::after { background: theme(colors.primary.400); }
+
+/* compact on small screens: hide labels, nodes-only track */
+@media (max-width: 640px) {
+  .pu-wizard-steps .pu-step-label { @apply hidden; }
+}
+
+/* ===================
+   KANBAN BOARD
+   =================== */
+
+/*
+ * Column wrapper: by default show the expanded body and hide the strip.
+ * The Stimulus controller adds/removes `pu-kanban-column-collapsed` on the
+ * wrapper to toggle between the two halves without a server round-trip.
+ */
+.pu-kanban-column-wrapper > .pu-kanban-strip {
+  display: none;
+}
+
+/* Collapsed state: show strip, hide body */
+.pu-kanban-column-wrapper.pu-kanban-column-collapsed > .pu-kanban-strip {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+}
+
+.pu-kanban-column-wrapper.pu-kanban-column-collapsed > .pu-kanban-body {
+  display: none;
+}
+
+/* Card being dragged: ghost effect so the origin position is visible */
+.pu-kanban-dragging {
+  opacity: 0.3;
+}
+
+/* Column highlighted as the current drop target */
+.pu-kanban-drop-target {
+  outline: 2px solid var(--color-primary-500, #3b82f6);
+  outline-offset: -2px;
+  border-radius: var(--pu-radius-md, 0.5rem);
+}
+
+/* Column that would reject a drop: dimmed so the user sees valid targets */
+.pu-kanban-no-drop {
+  opacity: 0.45;
+}

data/src/js/controllers/attachment_input_controller.js

@@ -95,6 +95,20 @@ export default class extends Controller {
   //======= Config
 
   configureUppy() {
+    // A modal <dialog> opened with showModal() lives in the browser top
+    // layer, which paints above everything else regardless of z-index.
+    // uppy's Dashboard overlay (inline: false) mounts to <body> by default,
+    // so it renders BEHIND the modal. Targeting the enclosing dialog makes
+    // the overlay a descendant of the top-layer dialog, so it paints above
+    // the modal instead. (The dialog carries an open/close transform, so the
+    // overlay's `position: fixed` resolves against the dialog's box rather
+    // than the viewport — it renders within the modal bounds, above it.)
+    // Outside a modal, closest() is null and the overlay mounts to <body>
+    // (uppy's default) as before.
+    const dashboardOptions = { inline: false, closeAfterFinish: true }
+    const dialog = this.element.closest("dialog")
+    if (dialog) dashboardOptions.target = dialog
+
     this.uppy = new Uppy({
       restrictions: {
         maxFileSize: this.maxFileSizeValue,
@@ -106,7 +120,7 @@ export default class extends Controller {
         requiredMetaFields: this.requiredMetaFieldsValue,
       }
     })
-      .use(Dashboard, { inline: false, closeAfterFinish: true })
+      .use(Dashboard, dashboardOptions)
       .use(ImageEditor, { target: Dashboard })
 
     this.#configureUploader()