plutonium 0.63.0 → 0.65.0

data/lib/plutonium/ui/table/components/view_switcher.rb

@@ -12,10 +12,12 @@ module Plutonium
         # through. The Stimulus controller sets the cookie on click,
         # then reloads.
         class ViewSwitcher < Plutonium::UI::Component::Base
+          # Labels are translation keys, resolved at render time so the
+          # switcher follows the request's locale.
           SEGMENT_LABELS = {
-            table: {label: "Table", icon: Phlex::TablerIcons::Table},
-            grid: {label: "Grid", icon: Phlex::TablerIcons::LayoutGrid},
-            kanban: {label: "Board", icon: Phlex::TablerIcons::LayoutKanban}
+            table: {label: "plutonium.ui.table.views.table", icon: Phlex::TablerIcons::Table},
+            grid: {label: "plutonium.ui.table.views.grid", icon: Phlex::TablerIcons::LayoutGrid},
+            kanban: {label: "plutonium.ui.table.views.kanban", icon: Phlex::TablerIcons::LayoutKanban}
           }.freeze
 
           def initialize(views:, current:, cookie_name:, cookie_path: "/")
@@ -32,7 +34,7 @@ module Plutonium
           def view_template
             div(
               role: "tablist",
-              aria: {label: "View"},
+              aria: {label: t("plutonium.ui.table.view")},
               class: "inline-flex h-8 rounded-md border border-[var(--pu-border)] bg-[var(--pu-surface)] overflow-hidden",
               data: {
                 controller: "view-switcher",
@@ -49,7 +51,9 @@ module Plutonium
           private
 
           def render_segment(key, last:)
-            meta = SEGMENT_LABELS.fetch(key) { {label: key.to_s.titleize, icon: Phlex::TablerIcons::LayoutGrid} }
+            meta = SEGMENT_LABELS[key]
+            label = meta ? t(meta[:label]) : key.to_s.titleize
+            icon = meta ? meta[:icon] : Phlex::TablerIcons::LayoutGrid
             active = key == @current
 
             classes = ["px-2.5 inline-flex items-center gap-1.5 text-sm transition-colors"]
@@ -64,15 +68,15 @@ module Plutonium
               type: "button",
               role: "tab",
               class: classes.join(" "),
-              title: meta[:label],
+              title: label,
               aria: {selected: active.to_s},
               data: {
                 action: "click->view-switcher#select",
                 view_switcher_view_param: key.to_s
               }
             ) do
-              render meta[:icon].new(class: "w-4 h-4 shrink-0")
-              span { meta[:label] }
+              render icon.new(class: "w-4 h-4 shrink-0")
+              span { label }
             end
           end
         end

data/lib/plutonium/ui/table/resource.rb

@@ -84,7 +84,7 @@ module Plutonium
         end
 
         def render_empty_card
-          EmptyCard("No #{resource_name_plural(resource_class).downcase} available") {
+          EmptyCard(t("plutonium.ui.empty_state.none_available", resources: resource_name_plural(resource_class).downcase)) {
             action = resource_definition.defined_actions[:new]
             if action&.permitted_by?(current_policy)
               url = route_options_to_url(action.route_options, resource_class)
@@ -121,19 +121,33 @@ module Plutonium
               column_definition = resource_definition.defined_columns[name] || {}
               column_options = column_definition[:options] || {}
 
-              # Check for conditional rendering
-              condition = column_options[:condition]
+              field_options = resolve_field_level_procs(field_options)
+              display_options = resolve_field_level_procs(display_options)
+              column_options = resolve_field_level_procs(column_options)
+
+              # A `column` condition or a surface-neutral `field` condition hides
+              # the column. A `display` condition stays show-only: it may reference
+              # `object`, and the table has no single record to evaluate it against.
+              condition = column_options[:condition] || field_options[:condition]
               conditionally_hidden = condition && !instance_exec(&condition)
               next if conditionally_hidden
 
-              tag = column_options[:as] || display_definition[:as] || field_options[:as]
+              # A column that says anything about RENDERING (`as:`, a component
+              # attribute, or a block) renders alone: its own `as:` and attributes,
+              # no display inheritance. A column that only touches the header
+              # (align/label/condition) layers on whatever the display renders, so
+              # `display :x, as: :badge` + `column :x, align: :end` keeps the badge.
+              # Only attributes are inherited, never the display's block.
+              column_render_options = column_options.except(:wrapper, :condition, *COLUMN_FIELD_LEVEL_KEYS)
+              renders_alone = column_definition[:block] || column_render_options.present?
+              source_options = renders_alone ? column_options : display_options
+
+              tag = source_options[:as] || field_options[:as]
 
-              # Extract field-level options from display_options and column_options
-              # These are Phlexi field options that should NOT be passed to the tag builder
-              field_level_keys = [:label, :description, :placeholder]
-              display_tag_attributes = display_options.except(:wrapper, :as, :condition, *field_level_keys)
-              column_tag_attributes = column_options.except(:wrapper, :as, :align, :condition, *field_level_keys)
-              tag_attributes = display_tag_attributes.merge(column_tag_attributes)
+              # Strip the field-level help keys and the header keys: they configure
+              # the field or the column, not the tag, and would otherwise leak as an
+              # HTML attribute.
+              tag_attributes = source_options.except(:wrapper, :as, :condition, *FIELD_LEVEL_KEYS, *COLUMN_FIELD_LEVEL_KEYS)
 
               # A `formatter:` produces the cell string itself, so render it
               # through the formatted-value component regardless of the column's
@@ -142,9 +156,17 @@ module Plutonium
               tag = :formatted_value if tag_attributes.key?(:formatter)
 
               tag_block = if column_definition[:block]
-                # User-provided blocks receive the raw record for convenience
+                # User blocks receive the raw record and are instance_exec'd against
+                # this table page, exactly as display blocks are against the show
+                # page: `self` has resource_definition/current_user/helpers and the
+                # tag methods, so the body can emit markup directly. The cell is a
+                # zero-arity proc; Phlex `render`s it in the <td>, sharing this
+                # component's buffer.
                 user_block = column_definition[:block]
-                ->(wrapped_object, _key) { user_block.call(wrapped_object.unwrapped) }
+                ->(wrapped_object, _key) {
+                  record = wrapped_object.unwrapped
+                  -> { render_column_block_result(instance_exec(record, &user_block)) }
+                }
               else
                 ->(wrapped_object, key) {
                   f = wrapped_object.field(key)
@@ -160,9 +182,11 @@ module Plutonium
                 tag_block = wrap_with_drag_handle(tag_block)
               end
 
-              # For table columns, only extract column-level options (label and align)
-              # Field-level options like description and placeholder don't make sense in table cells
-              field_options = field_options.except(:condition).merge(**column_options.slice(:align, :label))
+              # Header options (label/align) come from field, then display, then
+              # column, the most specific winning. Field-level help keys like
+              # description and placeholder have no place in a table cell.
+              header_options = display_options.slice(*COLUMN_FIELD_LEVEL_KEYS).merge(column_options.slice(*COLUMN_FIELD_LEVEL_KEYS))
+              field_options = field_options.except(:condition).merge(header_options)
               table.column name,
                 **field_options,
                 sort_params: current_query_object.sort_params_for(name),
@@ -209,6 +233,18 @@ module Plutonium
         #
         # The per-record `reposition?` check, by contrast, HAS to run per row.
         # Rows that fail it render exactly as they did before, unwrapped.
+        # A block that emitted markup returns nil (a no-op render); a String,
+        # component or proc renders as Phlex normally would; anything else
+        # (a count, a date…) reads as text instead of raising.
+        def render_column_block_result(result)
+          case result
+          when nil, String, Phlex::SGML, Proc, Enumerable
+            render result
+          else
+            plain result.to_s
+          end
+        end
+
         def wrap_with_drag_handle(inner)
           sort_url = position_grip_sort_url
 
@@ -261,7 +297,7 @@ module Plutonium
                    "data-[open]:translate-x-0 " \
                    "flex flex-col",
             role: "dialog",
-            aria: {label: "Filters", hidden: "true", modal: "true"},
+            aria: {label: t("plutonium.ui.table.filters"), hidden: "true", modal: "true"},
             data: {filter_panel_target: "panel"}
           ) do
             render Plutonium::UI::Table::Components::FilterForm.new(
@@ -279,7 +315,7 @@ module Plutonium
 
         def render_footer
           div(class: "lg:sticky bottom-[-2px] mt-1 p-4 pb-6 w-full z-30 bg-[var(--pu-body)]") {
-            TableInfo(pagy_instance)
+            TableInfo(pagy_instance, item_name: resource_name(resource_class, pagy_instance.count))
             TablePagination(pagy_instance)
           }
         end

data/lib/plutonium/ui/wizard/review.rb

@@ -69,7 +69,7 @@ module Plutonium
 
           div(class: "pu-wizard-review-outstanding rounded-lg border border-warning-300 bg-warning-50 dark:border-warning-800 dark:bg-warning-950/30 p-4 mb-6", role: "alert") do
             p(class: "text-sm font-medium text-[var(--pu-text)] mb-2") do
-              "Some steps still need attention before you can finish:"
+              t("plutonium.wizard.review.outstanding")
             end
             ul(class: "space-y-1") do
               incomplete.each do |step|
@@ -78,7 +78,7 @@ module Plutonium
                     href: @step_url.call(step.key),
                     class: "text-sm font-medium text-primary-600 dark:text-primary-400 hover:underline",
                     data: {wizard_review_fix: step.key}
-                  ) { "Fix #{step.label}" }
+                  ) { t("plutonium.wizard.review.fix_step", step: step.label) }
                 end
               end
             end
@@ -109,7 +109,7 @@ module Plutonium
               a(
                 href: @step_url.call(step.key),
                 class: "shrink-0 text-xs font-medium text-primary-600 dark:text-primary-400 hover:underline"
-              ) { "Edit" }
+              ) { t("plutonium.wizard.review.edit") }
             end
             div(class: "px-5 py-4") do
               # Decorate so attachment fields resolve to displayable attachments —
@@ -147,14 +147,14 @@ module Plutonium
                 name.to_s.humanize
               end
               if rows.empty?
-                p(class: "text-sm text-[var(--pu-text-subtle)]") { "None" }
+                p(class: "text-sm text-[var(--pu-text-subtle)]") { t("plutonium.wizard.review.none") }
               else
                 ul(class: "space-y-1.5") do
                   rows.each do |row|
                     li(class: "flex flex-wrap items-center gap-x-2 gap-y-0.5 rounded-[var(--pu-radius-md)] bg-[var(--pu-surface-alt)] px-3 py-2 text-sm text-[var(--pu-text)]") do
                       row.each do |key, value|
                         span do
-                          span(class: "text-[var(--pu-text-muted)]") { "#{key.to_s.humanize}: " }
+                          span(class: "text-[var(--pu-text-muted)]") { t("plutonium.wizard.review.row_label", label: key.to_s.humanize) }
                           plain value.to_s
                         end
                       end
@@ -186,9 +186,9 @@ module Plutonium
             div(class: "mb-4 flex h-14 w-14 items-center justify-center rounded-full bg-success-100 text-success-600 dark:bg-success-900/30 dark:text-success-400") do
               render Phlex::TablerIcons::Check.new(class: "h-7 w-7")
             end
-            h3(class: "text-lg font-semibold tracking-tight text-[var(--pu-text)]") { "You're all set" }
+            h3(class: "text-lg font-semibold tracking-tight text-[var(--pu-text)]") { t("plutonium.wizard.review.ready_title") }
             p(class: "mt-1.5 max-w-prose text-sm text-[var(--pu-text-muted)]") do
-              "Everything looks good. Click Finish to complete."
+              t("plutonium.wizard.review.ready_message")
             end
           end
         end

data/lib/plutonium/ui/wizard/stepper.rb

@@ -31,7 +31,7 @@ module Plutonium
         end
 
         def view_template
-          nav(class: "pu-wizard-stepper mb-7", aria_label: "Progress") do
+          nav(class: "pu-wizard-stepper mb-7", aria_label: t("plutonium.wizard.stepper.progress")) do
             ol(class: "pu-wizard-steps") do
               @steps.each_with_index do |step, index|
                 render_step(step, index)

data/lib/plutonium/ui/wizard/summary_display.rb

@@ -38,6 +38,12 @@ module Plutonium
 
         def render_summary_field(name)
           input_options = @summary_inputs[name]&.dig(:options) || {}
+          # Summarise only what the step showed: an input hidden by its own
+          # `condition:` was never answered, so it gets no (empty) row. The
+          # condition runs against this display exactly as it ran against the
+          # step form — `object` is the same staged data either way.
+          condition = input_options[:condition]
+          return if condition && !instance_exec(&condition)
           field_options = input_options[:label] ? {label: input_options[:label]} : {}
 
           # A currency input stages a plain decimal; the data snapshot carries no

data/lib/plutonium/version.rb

@@ -1,5 +1,5 @@
 module Plutonium
-  VERSION = "0.63.0"
+  VERSION = "0.65.0"
   NEXT_MAJOR_VERSION = VERSION.split(".").tap { |v|
     v[1] = v[1].to_i + 1
     v[2] = 0

data/lib/plutonium/wizard/base.rb

@@ -27,6 +27,8 @@ module Plutonium
     #     end
     #   end
     class Base
+      extend Plutonium::Translation::Lazy
+
       include ActiveModel::Model
       include Plutonium::Definition::Presentable
       include DSL

data/lib/plutonium/wizard/driving.rb

@@ -33,6 +33,8 @@ module Plutonium
       # other.
       WIZARD_RETURN_TO_KEY = "plutonium_wizard_return_to"
 
+      AuthorizationDeniedResult = Struct.new(:message)
+
       # The per-wizard key under {SESSION_TOKENS_KEY} for a guest run's token.
       def self.session_token_key(wizard_class)
         wizard_class.name.underscore.tr("/", "_")
@@ -516,7 +518,7 @@ module Plutonium
       def deny_wizard_resume_for_other_user!(runner)
         return unless runner.forbidden?
 
-        raise ActiveRecord::RecordNotFound, "wizard run not found"
+        raise ActiveRecord::RecordNotFound, I18n.t("plutonium.wizard.run_not_found")
       end
 
       # Entry auth (§5.2 / §6.5). A wizard may define `authorize?` (default allow);
@@ -528,7 +530,11 @@ module Plutonium
         wizard = runner.wizard
         return if wizard.authorize?
 
-        raise ActionPolicy::Unauthorized.new(wizard.class, :authorize?)
+        raise ::ActionPolicy::Unauthorized.new(
+          wizard,
+          :authorize?,
+          AuthorizationDeniedResult.new(I18n.t("plutonium.wizard.authorization_denied"))
+        )
       end
 
       # --- params ---

data/lib/plutonium/wizard/dsl.rb

@@ -44,7 +44,8 @@ module Plutonium
             fields: capture,
             on_submit: capture.delete_hook(:on_submit),
             on_rollback: capture.delete_hook(:on_rollback),
-            using_spec: capture.using_spec
+            using_spec: capture.using_spec,
+            wizard_class: self
           )
         end
 
@@ -60,7 +61,7 @@ module Plutonium
         # `header:` (default true) controls the step-header section (the label +
         # the "check everything over" prompt). `header: false` drops it entirely,
         # leaving just the review body in the card — for a chromeless finish.
-        def review(label: "Review", description: nil, condition: nil, summary: true, header: true, &block)
+        def review(label: nil, description: nil, condition: nil, summary: true, header: true, &block)
           assert_not_after_review!(:review)
           steps << ReviewStep.new(label:, description:, condition:, summary:, header:, block:)
         end
@@ -344,6 +345,7 @@ module Plutonium
           subclass.instance_variable_set(:@anchor_resolver, @anchor_resolver)
           subclass.instance_variable_set(:@navigation, @navigation)
           subclass.instance_variable_set(:@stepper, @stepper)
+          subclass.instance_variable_set(:@width, @width)
           subclass.instance_variable_set(:@on_relaunch, @on_relaunch)
           subclass.instance_variable_set(:@cleanup_after, @cleanup_after)
           subclass.instance_variable_set(:@cleanup_after_set, @cleanup_after_set)

data/lib/plutonium/wizard/field_importer.rb

@@ -36,14 +36,7 @@ module Plutonium
       FORM_VALIDATOR_KINDS = %i[presence length numericality format inclusion].freeze
 
       # The resolved import surface for one `using:` declaration.
-      Spec = Struct.new(:attribute_schema, :inputs, :form_layout, :validate_fn, :form_validators) do
-        # Run the imported validation over a staged data slice, returning a hash of
-        # {attribute => [messages]} for the imported fields + :base. Empty when
-        # `validate: false`.
-        def validate(data_slice)
-          validate_fn ? validate_fn.call(data_slice) : {}
-        end
-      end
+      Spec = Struct.new(:attribute_schema, :inputs, :form_layout, :validate_fn, :form_validators)
 
       class << self
         # @param using [Class] an ActiveRecord model class

data/lib/plutonium/wizard/review_step.rb

@@ -27,13 +27,20 @@ module Plutonium
 
       attr_reader :block, :summary, :header
 
-      def initialize(key: :review, label: "Review", description: nil, condition: nil, summary: true, header: true, block: nil)
+      def initialize(key: :review, label: nil, description: nil, condition: nil, summary: true, header: true, block: nil)
         super(key:, label:, description:, condition:, fields: EmptyFields.new)
+        @explicit_label = label
         @summary = summary
         @header = header
         @block = block
       end
 
+      # The author's `label:` when given; otherwise the translated default,
+      # looked up per call so it follows the request's locale.
+      def label
+        Plutonium::Translation.resolve(@explicit_label) || I18n.t("plutonium.wizard.review.label")
+      end
+
       def review? = true
 
       # Whether the auto-summary of completed steps renders in the COMPLETE state

data/lib/plutonium/wizard/step.rb

@@ -6,13 +6,14 @@ module Plutonium
     # field surface, per-step hooks, and the `using:` import marker (resolved in
     # Task 3). A value object — holds no runtime state.
     class Step
-      attr_reader :key, :label, :description, :condition, :fields,
+      attr_reader :key, :condition, :fields,
         :on_submit, :on_rollback, :using_spec
 
       def initialize(key:, fields:, label: nil, description: nil, condition: nil,
-        on_submit: nil, on_rollback: nil, using_spec: nil)
+        on_submit: nil, on_rollback: nil, using_spec: nil, wizard_class: nil)
         @key = key
-        @label = label || key.to_s.humanize
+        @label = label
+        @wizard_class = wizard_class
         @description = description
         @condition = condition
         @fields = fields
@@ -21,6 +22,16 @@ module Plutonium
         @using_spec = using_spec
       end
 
+      # `label:` if given, else plutonium.wizard_steps.<wizard>.<key>, else the
+      # humanized key. Resolved on every read so it follows the request locale.
+      def label
+        Plutonium::Translation.resolve(@label) ||
+          Plutonium::Translation.label_for(:wizard_step, @wizard_class, key) ||
+          key.to_s.humanize
+      end
+
+      def description = Plutonium::Translation.resolve(@description)
+
       def review? = false
 
       # The step's form sections (§7.1): inline `form_layout` wins, else the layout

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@radioactive-labs/plutonium",
-  "version": "0.63.0",
+  "version": "0.65.0",
   "description": "Build production-ready Rails apps in minutes, not days. Convention-driven, fully customizable, AI-ready.",
   "type": "module",
   "main": "src/js/core.js",
@@ -25,6 +25,8 @@
     "@uppy/dashboard": "^4.1.3",
     "@uppy/image-editor": "^3.2.1",
     "@uppy/xhr-upload": "^4.2.3",
+    "chart.js": "^4.5.1",
+    "chartkick": "^5.0.1",
     "dompurify": "^3.4.11",
     "lodash.debounce": "^4.0.8",
     "marked": "^15.0.3"
@@ -55,7 +57,7 @@
   },
   "scripts": {
     "dev": "concurrently \"yarn css:dev\" \"yarn js:dev\"",
-    "build": "yarn js:prod && yarn css:prod",
+    "build": "rm -rf src/dist && yarn js:prod && yarn css:prod",
     "prepare": "yarn build",
     "css:dev": "chokidar \"src/css/**/*.css\" \"src/js/**/*.js\" \"app/views/**/*.{rb,erb,js}\" \"lib/plutonium/**/*.rb\" -c \"postcss src/css/plutonium.entry.css -o src/build/plutonium.css --dev\" --initial",
     "js:dev": "node esbuild.config.js --dev",

data/plutonium.gemspec

@@ -12,35 +12,17 @@ Gem::Specification.new do |spec|
                      "definitions, and portals that make building complex apps faster. Built for the AI era with Claude Code skills."
   spec.homepage = "https://radioactive-labs.github.io/plutonium-core/"
   spec.license = "MIT"
-  # Ruby 3.2 is DEPRECATED and will be dropped in the next release — see the
-  # post_install_message. Held here for one more release so 3.2 users can
-  # receive the fixes in this one before support ends; raising it in the same
-  # release that ships them would strand those users on the old version.
-  spec.required_ruby_version = ">= 3.2.2"
+  # Ruby 3.2 was dropped here, one release after being deprecated in the
+  # post_install_message, so 3.2 users had a release that both carried the
+  # fixes and still installed for them. See the pagy dependency below for why
+  # 3.2 could not be kept.
+  spec.required_ruby_version = ">= 3.3"
 
   spec.metadata["allowed_push_host"] = "https://rubygems.org"
   # Require multi-factor auth for privileged RubyGems actions (push, yank,
   # owner changes). `gem push` will prompt for an OTP at release time.
   spec.metadata["rubygems_mfa_required"] = "true"
 
-  # Prints on EVERY install: only notices still actionable for someone
-  # installing THIS version.
-  spec.post_install_message = <<~MSG
-    ⚠️  Ruby 3.2 support ends in the NEXT release
-
-    This is the last Plutonium release that installs on Ruby 3.2.
-
-    Why: pagy patches CVE-2026-54659 (a path-traversal in
-    `Pagy::I18n.locale=`) only in >= 43.5.6, and pagy dropped Ruby 3.2 in
-    43.5.0. No pagy version is both patched and installable on 3.2, so
-    continuing to support it means shipping a known-vulnerable dependency.
-
-    Ruby 3.2 reached end-of-life in March 2026.
-
-    Action: upgrade to Ruby 3.3 or newer before your next Plutonium bump.
-    If you stay on 3.2, `bundle update plutonium` will hold you here.
-  MSG
-
   spec.metadata["homepage_uri"] = spec.homepage
   spec.metadata["source_code_uri"] = "https://github.com/radioactive-labs/plutonium-core"
   # spec.metadata["changelog_uri"] = "https://google.com"
@@ -50,7 +32,10 @@ Gem::Specification.new do |spec|
   spec.files = Dir.chdir(__dir__) do
     `git ls-files -z`.split("\x0").reject do |f|
       (File.expand_path(f) == __FILE__) ||
-        f.start_with?(*%w[bin/ test/ spec/ features/ .git .github appveyor Gemfile])
+        f.start_with?(*%w[bin/ test/ spec/ features/ .git .github appveyor Gemfile]) ||
+        # Maintainer tooling; host apps read tailwind.options.js and the postcss
+        # plugin from the gem, not the lockfile or yarn settings.
+        %w[.yarnrc.yml yarn.lock public/plutonium-assets/].any? { |prefix| f.start_with?(prefix) }
     end
   end
   spec.bindir = "exe"
@@ -61,12 +46,12 @@ Gem::Specification.new do |spec|
   spec.add_dependency "rails", ">= 7.2.3.1"
   spec.add_dependency "csv" # CSV export; no longer a default gem on Ruby 3.4+
   spec.add_dependency "listen", "~> 3.8"
-  # NOT pinned to >= 43.5.6 (which patches CVE-2026-54659) yet: that version
-  # requires Ruby >= 3.3, so pinning it here would silently drop Ruby 3.2 a
-  # release early. `~> 43.0` already resolves to a patched 43.6.x on any fresh
-  # install under Ruby 3.3+, so the exposure is limited to apps holding an old
-  # pagy in their lockfile. Pin it in the release that drops 3.2.
-  spec.add_dependency "pagy", "~> 43.0"
+  # >= 43.5.6 patches CVE-2026-54659 (Pagy::I18n.locale= used its argument as a
+  # path component without validating it). Pinned so an app carrying an older
+  # pagy in its lockfile cannot stay on a vulnerable 43.x through a plutonium
+  # bump. This pin is what requires Ruby >= 3.3 above: pagy dropped 3.2 in
+  # 43.5.0, so no version is both patched and installable on 3.2.
+  spec.add_dependency "pagy", "~> 43.0", ">= 43.5.6"
   spec.add_dependency "rabl", "~> 0.17.0" # TODO: what to do with RABL
   spec.add_dependency "semantic_range", "~> 3.0"
   spec.add_dependency "tty-prompt", "~> 0.23.1"

data/postcss-gem-import.cjs

@@ -0,0 +1,34 @@
+// CommonJS on purpose: host apps load this by absolute path from their
+// postcss.config.js. This directory's package.json declares "type": "module",
+// so a .js file here is ESM, which the require()-based loader in
+// postcss-load-config 4 (postcss-cli 10) passes to PostCSS as a module
+// namespace instead of a plugin. A .cjs file loads under require() and
+// import() alike.
+const { execSync } = require('child_process');
+
+const plugin = (opts = {}) => {
+  return {
+    postcssPlugin: 'postcss-gem-import',
+    Once(root) {
+      root.walkAtRules('import', (rule) => {
+        const importPath = rule.params.replace(/['"]/g, '');
+
+        if (importPath.startsWith('gem:')) {
+          const gemName = importPath.split('gem:')[1].split('/')[0];
+
+          try {
+            const gemPath = execSync(`bundle show ${gemName}`, { encoding: 'utf8' }).trim();
+            const newPath = importPath.replace(`gem:${gemName}`, gemPath);
+            rule.params = `"${newPath}"`;
+          } catch (error) {
+            throw rule.error(`Failed to resolve gem path for ${gemName}: ${error.message}`);
+          }
+        }
+      });
+    }
+  };
+};
+
+plugin.postcss = true;
+
+module.exports = plugin;

data/postcss-gem-import.js

@@ -1,28 +1,3 @@
-import { execSync } from 'child_process';
-
-const plugin = (opts = {}) => {
-  return {
-    postcssPlugin: 'postcss-gem-import',
-    Once(root) {
-      root.walkAtRules('import', (rule) => {
-        const importPath = rule.params.replace(/['"]/g, '');
-
-        if (importPath.startsWith('gem:')) {
-          const gemName = importPath.split('gem:')[1].split('/')[0];
-
-          try {
-            const gemPath = execSync(`bundle show ${gemName}`, { encoding: 'utf8' }).trim();
-            const newPath = importPath.replace(`gem:${gemName}`, gemPath);
-            rule.params = `"${newPath}"`;
-          } catch (error) {
-            throw rule.error(`Failed to resolve gem path for ${gemName}: ${error.message}`);
-          }
-        }
-      });
-    }
-  };
-};
-
-plugin.postcss = true;
-
-export default plugin;
+// Apps generated before the plugin moved to CommonJS reference this path from
+// their postcss.config.js. Keep it resolving; new apps point at the .cjs file.
+export { default } from "./postcss-gem-import.cjs"