swal_rails 0.3.4 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9c32d3f037cf95eabb9afc8d578ca88927dbbf95cfca901534f74bc11aad2976
-  data.tar.gz: 3e5bef30b1085080e83c98ec3a97b7da2dbd28ea1d2452546ab3252b9fa7f029
+  metadata.gz: 958168a17777ae58b1ce198ab3de6df9945942a5065c7311201fc05bd4ee8714
+  data.tar.gz: 756c79ba6c1bf50bf288a934b807ddda9e09a49eb221097092c72ac3f2981c8b
 SHA512:
-  metadata.gz: 15fc85547a69d5bbadd35cfe7a2f2c8b7f9e7627e75f14161dcdfda5c9ed23595f4ae856716baaea56d8f9ed21f2ff9ded2a9b2ba1a99dd70d51c82b5cf70c62
-  data.tar.gz: e7c1aa7c9057d6c4bcc4708259dc38b40096e57b2bc6a870d8dd2bbe0c3cbdf80b19053a75d47649e541524f52b33fbf8df8fa979b64d38920434e068b7a122a
+  metadata.gz: aa8b8b60bb0e2c37cd2669d5dbaaa1e14ccbd3c342f97496679b2829294a050be7250ef131bc2d94cb9d469a51daf3f71bd838edc949beefb2040cbb086b13b5
+  data.tar.gz: bf4db27a6c234df8aec4e881c99c67578cf575a3c6fdd53092f7f1e827ce01354c2334d677919159cf31a09e2ecc821193cf78f7438409bb89fdcd1e8c71544b

data/CHANGELOG.md

@@ -6,6 +6,56 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-05-27
+
+### Added
+- **npm companion package** (`swal_rails` on npm). The install generator now runs
+  `yarn add swal_rails@<version>` (or `npm install`) in jsbundling mode, placing
+  the gem's JS runtime in `node_modules/swal_rails` so esbuild / webpack / vite
+  can resolve `import "swal_rails"` as a bare specifier — with no bundler
+  config required. All sub-paths (`swal_rails/confirm`, `/flash`, `/chain`,
+  `/controllers/swal_controller`) are covered via the package `exports` map.
+  Closes [#24](https://github.com/Metalzoid/swal_rails/issues/24).
+- **`rake npm:sync`** — copies JS files from `app/assets/javascripts/swal_rails/`
+  into `npm/` and bumps `npm/package.json` version to match `SwalRails::VERSION`.
+  Run before any npm publish.
+- **`rake npm:publish`** — runs `npm:sync` then `npm publish --access public`.
+- **`_persistent` flash option** — adding `_persistent: true` to a flash entry
+  (via `swal_flash :key, msg, _persistent: true` or directly in `flash_map`)
+  removes the auto-close timer and forces a visible close button, requiring
+  manual dismissal.
+
+### Fixed
+- **Stacked flash clone timing** — `didRender` replaced by `willOpen` + `didOpen`
+  for cloning SA2 popups into the stack container. The previous `timer: 1` could
+  race the `setTimeout(0)` SA2 uses to schedule `didOpen`, leaving slots empty.
+  Timer raised to 50 ms; the original popup is hidden via `willOpen` (opacity 0,
+  pointer-events none) so the clone is the only visible element.
+- **Stacked toast CSS scope** — SA2 scopes element rules under
+  `div:where(.swal2-container)` (zero-specificity `:where()`). Clones rendered
+  outside that container lost color, border-radius, and the close-button layout.
+  Added explicit `div.swal2-popup`, `div.swal2-html-container`, and
+  `button.swal2-close` rules in `index.css` that apply regardless of scope.
+- **`install_jsbundling` generator** — previously only installed `sweetalert2`;
+  now also installs `swal_rails` from the npm registry.
+
+### Changed
+- Release workflow (`.github/workflows/release.yml`) auto-publishes the npm
+  package after every gem push via the `NPM_TOKEN` repository secret.
+
+## [0.4.0] - 2026-05-03
+
+### Added
+- **`config.assets_mode`** (`:auto` default; also `:importmap`, `:jsbundling`, `:sprockets`). When set to a non-`:auto` value, the engine skips file-system sniffing at boot.
+- **`config.precompile_strategy`** (`:all` default; `:minimal` opt-in). Setting it to `:minimal` ships only the sweetalert2 variant matching the resolved `assets_mode` (and drops the optional theme files), saving ~700 KB of precompiled assets in `public/assets/`.
+- **`SwalRails::AssetManifest`** module that computes the precompile list. Pure / side-effect-free; covered by spec.
+
+### Changed
+- The `swal_rails.assets` initializer now runs `after: :load_config_initializers` so it can read user-supplied `config.assets_mode` / `config.precompile_strategy`. Default behaviour is unchanged for hosts that don't configure either option.
+
+### Deprecated
+- **`swal_tag`** and **`swal_chain_tag`** view helpers. Both emit inline `<script type="module">` tags that fight CSP and add per-request nonce overhead; prefer the bundled Stimulus controller (`data-controller="swal"` + `data-action="click->swal#fire"`) or the `data-swal-confirm` / `data-swal-steps` attributes. Slated for removal in v1.0; calling either helper now logs an `ActiveSupport::Deprecation` warning.
+
 ## [0.3.4] - 2026-05-01
 
 ### Added

data/README.md

@@ -9,9 +9,10 @@ Stimulus controller, auto-wired flash messages, Turbo confirm replacement,
 Ruby view helpers, and full I18n. Everything is configurable.
 
 [![CI](https://github.com/Metalzoid/swal_rails/actions/workflows/main.yml/badge.svg)](https://github.com/Metalzoid/swal_rails/actions)
-[![Gem Version](https://badge.fury.io/rb/swal_rails.svg)](https://rubygems.org/gems/swal_rails)
-[![Ruby](https://img.shields.io/gem/ruby-version/swal_rails?label=ruby)](https://www.ruby-lang.org/)
-[![Rails](https://img.shields.io/gem/dv/swal_rails/railties?label=rails)](https://rubyonrails.org/)
+[![Gem Version](https://img.shields.io/gem/v/swal_rails.svg?label=gem)](https://rubygems.org/gems/swal_rails)
+[![Downloads](https://img.shields.io/gem/dt/swal_rails?label=downloads)](https://rubygems.org/gems/swal_rails)
+[![Ruby](https://img.shields.io/badge/ruby-%3E%3D%203.2-CC342D?logo=ruby&logoColor=white)](https://www.ruby-lang.org/)
+[![Rails](https://img.shields.io/badge/rails-7.2%20%7C%208.0%20%7C%208.1-CC0000?logo=rubyonrails&logoColor=white)](https://rubyonrails.org/)
 [![SweetAlert2](https://img.shields.io/badge/SweetAlert2-v11.26-3085d6.svg)](https://sweetalert2.github.io/)
 [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE.txt)
 
@@ -284,6 +285,19 @@ Signature: `swal_flash(key, messages, mode: nil, delay: nil, now: false, **optio
 `_stackDelay` meta-keys, extracted by the JS runtime before the options are
 handed to `Swal.fire` — they never leak into SA2.
 
+#### Persistent (non-auto-closing) entries
+
+Pass `_persistent: true` to any `swal_flash` call — or add it directly to a
+`flash_map` entry — to remove the auto-close timer and force a visible close
+button, requiring the user to dismiss manually:
+
+```ruby
+swal_flash :alert, "Your session will expire soon.", _persistent: true
+```
+
+The runtime strips `_persistent` before calling `Swal.fire`, then deletes
+`timer` / `timerProgressBar` and sets `showCloseButton: true` on the item.
+
 Behind the scenes, the engine serializes the flash into a meta tag
 (`<meta name="swal-flash" content="...">`) and the JS runtime reads it and
 calls `Swal.fire(...)` with your per-key options.
@@ -764,7 +778,7 @@ Flash entries are `{ key: "notice", options: { text: "..." } }` for string value
 Per-mode side effects:
 
 - **importmap**: appends `pin "sweetalert2", to: "sweetalert2.esm.all.js"` and `pin "swal_rails", to: "swal_rails/index.js"` to `config/importmap.rb`; appends `import "swal_rails"` to `app/javascript/application.js`.
-- **jsbundling**: runs `yarn add sweetalert2@<pinned>` or `npm install sweetalert2@<pinned>` (based on the lockfile present); appends `import "swal_rails"` to `app/javascript/application.js`.
+- **jsbundling**: runs `yarn add sweetalert2@<pinned> swal_rails@<version>` or `npm install sweetalert2@<pinned> swal_rails@<version>` (based on the lockfile present); appends `import "swal_rails"` to `app/javascript/application.js`. The `swal_rails` npm package ships the same JS runtime as the gem, making the bare specifier `import "swal_rails"` resolvable by any bundler (esbuild, webpack, vite, rollup) without additional configuration.
 - **sprockets**: appends `//= link sweetalert2.js` and `//= link sweetalert2.css` to `app/assets/config/manifest.js`.
 
 All append operations are idempotent — running the generator twice is safe.
@@ -947,7 +961,7 @@ right template automatically.
 └──────────────────────────────────────────────────────────────────────┘
 
 ┌─ jsbundling (esbuild / vite / rollup) ───────────────────────────────┐
-│   package.json  →  "sweetalert2": "^11"  (your bundler resolves it)  │
+│   package.json  →  "sweetalert2": "^11", "swal_rails": "^0.5"        │
 │   app/javascript/application.js                                      │
 │     import "swal_rails"                                              │
 └──────────────────────────────────────────────────────────────────────┘

data/Rakefile

@@ -10,3 +10,42 @@ require "rubocop/rake_task"
 RuboCop::RakeTask.new
 
 task default: %i[spec rubocop]
+
+# ---------------------------------------------------------------------------
+# npm companion package tasks
+# ---------------------------------------------------------------------------
+require "fileutils"
+require "json"
+
+NPM_JS_SRC  = "app/assets/javascripts/swal_rails"
+NPM_JS_DEST = "npm"
+
+def npm_sync_files
+  require_relative "lib/swal_rails/version"
+
+  Dir.glob("#{NPM_JS_SRC}/**/*.js").each do |src|
+    rel  = src.sub("#{NPM_JS_SRC}/", "")
+    dest = "#{NPM_JS_DEST}/#{rel}"
+    FileUtils.mkdir_p(File.dirname(dest))
+    FileUtils.cp(src, dest)
+    puts "  synced #{rel}"
+  end
+
+  pkg_path = "#{NPM_JS_DEST}/package.json"
+  pkg = JSON.parse(File.read(pkg_path))
+  pkg["version"] = SwalRails::VERSION
+  File.write(pkg_path, "#{JSON.pretty_generate(pkg)}\n")
+  puts "  version → #{SwalRails::VERSION}"
+end
+
+namespace :npm do
+  desc "Sync JS files from #{NPM_JS_SRC}/ → #{NPM_JS_DEST}/ and bump version in package.json"
+  task(:sync) { npm_sync_files }
+
+  desc "Publish npm package to registry (runs npm:sync first)"
+  task publish: :sync do
+    Dir.chdir(NPM_JS_DEST) do
+      system("npm publish --access public") || abort("npm publish failed")
+    end
+  end
+end

data/app/assets/javascripts/swal_rails/flash.js

@@ -29,6 +29,18 @@ const extractMeta = (queue) => {
   return { mode, delay };
 };
 
+// Per-item: _persistent removes the auto-close timer and ensures the user
+// must dismiss manually via the close button.
+const applyPersistent = (queue) => {
+  for (const item of queue) {
+    if (!item._persistent) continue;
+    delete item._persistent;
+    delete item.timer;
+    delete item.timerProgressBar;
+    item.showCloseButton = true;
+  }
+};
+
 const STACK_ID = "swal-rails-stack";
 
 const ensureStackContainer = () => {
@@ -85,42 +97,36 @@ const fireStacked = async (Swal, queue, delay) => {
       Swal.fire({
         ...opts,
         toast: true,
-        // Close the SA2 original immediately; the clone in `slot` persists.
-        // Animations disabled on the decoy so the clone captures the popup
-        // in its normal "shown" state (no opacity-0 from close transition).
-        timer: 1,
         timerProgressBar: false,
         showClass: { popup: "", backdrop: "", icon: "" },
         hideClass: { popup: "", backdrop: "", icon: "" },
-        didRender: (popup) => {
+        // timer:1 races with the setTimeout(0) SA2 uses to schedule didOpen
+        // when animations are disabled — didOpen can lose that race and never
+        // fire, leaving the slot empty. 50 ms gives the event loop a safe
+        // margin while remaining imperceptible to the user.
+        timer: 50,
+        // Suppress the SA2 original so only our clone in the stack is visible.
+        willOpen: (popup) => {
+          popup.style.opacity = "0";
+          popup.style.pointerEvents = "none";
+        },
+        // Clone at didOpen: SA2 has applied all inline styles at this point
+        // (display:grid, icon classes, close-button grid placement, etc.),
+        // so the clone requires no manual fixups.
+        didOpen: (popup) => {
           const clone = popup.cloneNode(true);
+          // willOpen set opacity:0 on the original; clear it on the clone.
           clone.style.opacity = "";
-          // SA2 only flips `popup.style.display` to `grid` at didOpen. We
-          // clone at didRender — earlier in the lifecycle — so the inline
-          // display is missing. Outside SA2's `.swal2-container` the toast
-          // therefore falls back to `display: block`, which collapses the
-          // grid layout (`.swal2-toast { grid-template-columns: … }`) and
-          // ends up rendering icon/title/content stacked vertically — the
-          // "vachement haute" symptom of stacked flashes.
-          clone.style.display = "grid";
           clone
             .querySelectorAll(".swal2-timer-progress-bar-container")
             .forEach((e) => e.remove());
-          // SA2 adds `.swal2-icon-show` only after didOpen, but we clone
-          // earlier (in didRender) to beat the close animation. Apply it
-          // manually so the icon's SVG is visibly drawn in the clone.
-          clone
-            .querySelectorAll(".swal2-icon")
-            .forEach((icon) => icon.classList.add("swal2-icon-show"));
           slot.appendChild(clone);
           const dismiss = () => {
             if (slot.isConnected) slot.remove();
             if (stack.isConnected && stack.children.length === 0)
               stack.remove();
           };
-          clone
-            .querySelector(".swal2-close")
-            ?.addEventListener("click", dismiss);
+          clone.querySelector(".swal2-close")?.addEventListener("click", dismiss);
           if (timerMs) setTimeout(dismiss, timerMs);
         },
         didClose: () => resolve(),
@@ -151,6 +157,7 @@ export const installFlash = (Swal, config) => {
   });
 
   const meta = extractMeta(queue);
+  applyPersistent(queue);
   const mode = meta.mode || config.flashArrayMode || "sequential";
   const delay =
     meta.delay != null

data/app/assets/stylesheets/swal_rails/index.css

@@ -3,3 +3,51 @@
  * Imports the vendored SweetAlert2 CSS; override variables in your own stylesheet.
  */
 @import "sweetalert2.css";
+
+/*
+ * SA2 scopes all element styles under `div:where(.swal2-container)` for CSS
+ * isolation (zero-specificity :where() = easy to override, but only inside the
+ * container). This breaks stacked-toast clones that live outside that scope.
+ *
+ * Fix: re-declare the affected rules without the container ancestor. Our
+ * selectors have higher specificity than SA2's :where()-based ones, so they
+ * win everywhere — values are identical for native popups, so no regression.
+ * Risk of page pollution is near-zero: .swal2-* class names are distinctive.
+ */
+div.swal2-popup {
+  color: var(--swal2-color);
+  font-size: 1rem;
+  border-radius: var(--swal2-border-radius);
+  container-name: swal2-popup;
+}
+div.swal2-html-container {
+  color: inherit;
+  font-weight: normal;
+  line-height: normal;
+  overflow-wrap: break-word;
+  word-break: break-word;
+  cursor: initial;
+}
+button.swal2-close {
+  z-index: 2;
+  align-items: center;
+  justify-content: center;
+  padding: 0;
+  overflow: hidden;
+  transition: var(--swal2-close-button-transition);
+  border: none;
+  border-radius: var(--swal2-border-radius);
+  outline: var(--swal2-close-button-outline);
+  background: transparent;
+  color: var(--swal2-close-button-color);
+  font-family: monospace;
+  cursor: pointer;
+}
+button.swal2-close:hover {
+  background: transparent;
+  color: #f27474;
+}
+button.swal2-close:focus-visible {
+  outline: none;
+  box-shadow: var(--swal2-close-button-focus-box-shadow);
+}

data/lib/generators/swal_rails/install/install_generator.rb

@@ -99,8 +99,13 @@ module SwalRails
 
       def install_jsbundling
         if file_exists?("package.json")
-          run "yarn add sweetalert2@#{SwalRails::SWEETALERT2_VERSION}" if file_exists?("yarn.lock")
-          run "npm install sweetalert2@#{SwalRails::SWEETALERT2_VERSION}" if file_exists?("package-lock.json") && !file_exists?("yarn.lock")
+          if file_exists?("yarn.lock")
+            run "yarn add sweetalert2@#{SwalRails::SWEETALERT2_VERSION}"
+            run "yarn add swal_rails@#{SwalRails::VERSION}"
+          elsif file_exists?("package-lock.json")
+            run "npm install sweetalert2@#{SwalRails::SWEETALERT2_VERSION}"
+            run "npm install swal_rails@#{SwalRails::VERSION}"
+          end
         else
           say_status(:warn, "package.json not found", :yellow)
         end

data/lib/swal_rails/asset_manifest.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module SwalRails
+  # Computes the list of vendored sweetalert2 assets the host should
+  # precompile, based on `SwalRails.configuration.assets_mode` and
+  # `precompile_strategy`. Kept side-effect-free so it's easy to test
+  # without booting a full Rails app.
+  module AssetManifest
+    GEM_FILES = %w[
+      swal_rails/index.js
+      swal_rails/confirm.js
+      swal_rails/flash.js
+      swal_rails/chain.js
+      swal_rails/controllers/swal_controller.js
+      swal_rails/index.css
+    ].freeze
+
+    THEME_FILES = %w[
+      themes/bootstrap-4.css
+      themes/bootstrap-5.css
+      themes/borderless.css
+      themes/bulma.css
+      themes/material-ui.css
+      themes/minimal.css
+    ].freeze
+
+    ALL_VENDOR_FILES = %w[
+      sweetalert2.js
+      sweetalert2.min.js
+      sweetalert2.all.js
+      sweetalert2.all.min.js
+      sweetalert2.esm.js
+      sweetalert2.esm.min.js
+      sweetalert2.esm.all.js
+      sweetalert2.esm.all.min.js
+      sweetalert2.css
+      sweetalert2.min.css
+    ].freeze
+
+    # Returns the list of asset paths to add to `config.assets.precompile`.
+    # Always includes the gem's own JS/CSS entrypoints (small, host-facing).
+    # Vendored sweetalert2 variants depend on `precompile_strategy`:
+    #   `:all`     → every JS + CSS variant + every theme (legacy)
+    #   `:minimal` → only the variant matching the resolved assets_mode,
+    #                plus the canonical CSS bundle
+    def self.precompile_for(configuration, app_root: nil)
+      strategy = configuration.precompile_strategy
+      mode = resolve_assets_mode(configuration.assets_mode, app_root)
+
+      base = GEM_FILES.dup
+      base.concat(vendor_files_for(strategy, mode))
+      base.concat(THEME_FILES) if strategy == :all
+      base.uniq
+    end
+
+    # When `assets_mode` is `:auto`, sniff the host's filesystem to infer
+    # which Rails asset pipeline is in use. Mirrors the heuristic in the
+    # install generator (importmap.rb → :importmap, package.json → :jsbundling,
+    # else :sprockets) so explicit and auto-detected behaviour match.
+    def self.resolve_assets_mode(mode, app_root)
+      return mode unless mode == :auto
+      return :sprockets unless app_root
+
+      return :importmap if app_root.join("config/importmap.rb").exist?
+      return :jsbundling if app_root.join("package.json").exist?
+
+      :sprockets
+    end
+
+    def self.vendor_files_for(strategy, mode)
+      return ALL_VENDOR_FILES if strategy == :all
+
+      case mode
+      when :importmap
+        # Importmap pins `sweetalert2` to the ESM bundle; CSS is sprocketed
+        # separately so we ship `index.css` (which @imports the canonical CSS).
+        %w[sweetalert2.esm.all.min.js sweetalert2.min.css]
+      when :jsbundling
+        # JS comes from `npm install sweetalert2`; we only ship the CSS.
+        %w[sweetalert2.min.css]
+      when :sprockets
+        # Classic sprockets users `javascript_include_tag "sweetalert2.all.min"`.
+        %w[sweetalert2.all.min.js sweetalert2.min.css]
+      else
+        ALL_VENDOR_FILES
+      end
+    end
+  end
+end

data/lib/swal_rails/configuration.rb

@@ -12,6 +12,8 @@ module SwalRails
   class Configuration
     CONFIRM_MODES = %i[off data_attribute turbo_override both].freeze
     FLASH_ARRAY_MODES = %i[sequential stacked].freeze
+    ASSETS_MODES = %i[auto importmap jsbundling sprockets].freeze
+    PRECOMPILE_STRATEGIES = %i[all minimal].freeze
 
     attr_accessor :default_options,
                   :flash_keys_as_meta,
@@ -20,7 +22,8 @@ module SwalRails
                   :flash_stack_delay,
                   :initializer_version,
                   :silence_initializer_warning
-    attr_reader :confirm_mode, :flash_map, :i18n_scope, :flash_array_mode
+    attr_reader :confirm_mode, :flash_map, :i18n_scope, :flash_array_mode,
+                :assets_mode, :precompile_strategy
 
     def initialize
       @confirm_mode = :data_attribute
@@ -36,6 +39,16 @@ module SwalRails
       # explicitly in the initializer template silences it.
       @initializer_version = nil
       @silence_initializer_warning = false
+      # `:auto` lets the engine sniff (importmap.rb, package.json) at boot.
+      # Override in your initializer to lock the choice and skip the sniff.
+      @assets_mode = :auto
+      # `:all` keeps every sweetalert2 variant in the host's precompile
+      # list (legacy behaviour, ~970 KB on disk). `:minimal` precompiles
+      # only the variant the host's assets_mode actually uses, shaving
+      # ~700 KB. Default stays `:all` for backwards compatibility — flip
+      # to `:minimal` once you've confirmed your host doesn't reference
+      # extra variants directly.
+      @precompile_strategy = :all
       # `focusConfirm` / `returnFocus` are intentionally omitted: SA2 already
       # defaults both to `true` internally, and passing them explicitly makes
       # SA2 warn on every toast ("incompatible with toasts"). Listing them
@@ -67,6 +80,22 @@ module SwalRails
       @i18n_scope = value.to_s
     end
 
+    def assets_mode=(value)
+      value = value.to_sym
+      raise ArgumentError, "assets_mode must be one of #{ASSETS_MODES.inspect}" unless ASSETS_MODES.include?(value)
+
+      @assets_mode = value
+    end
+
+    def precompile_strategy=(value)
+      value = value.to_sym
+      unless PRECOMPILE_STRATEGIES.include?(value)
+        raise ArgumentError, "precompile_strategy must be one of #{PRECOMPILE_STRATEGIES.inspect}, got #{value.inspect}"
+      end
+
+      @precompile_strategy = value
+    end
+
     # Replace the full flash map. Prefer editing individual keys via `flash_map[:key] = ...`.
     def flash_map=(value)
       raise ArgumentError, "flash_map must be a Hash" unless value.is_a?(Hash)

data/lib/swal_rails/engine.rb

@@ -8,24 +8,16 @@ module SwalRails
 
     config.swal_rails = SwalRails.configuration
 
-    initializer "swal_rails.assets" do |app|
+    initializer "swal_rails.assets", after: :load_config_initializers do |app|
       if app.config.respond_to?(:assets)
         app.config.assets.paths << root.join("vendor/javascript/sweetalert2").to_s
         app.config.assets.paths << root.join("vendor/stylesheets/sweetalert2").to_s
         app.config.assets.paths << root.join("app/assets/javascripts").to_s
         app.config.assets.paths << root.join("app/assets/stylesheets").to_s
-        app.config.assets.precompile += %w[
-          sweetalert2.js sweetalert2.min.js
-          sweetalert2.all.js sweetalert2.all.min.js
-          sweetalert2.esm.js sweetalert2.esm.min.js
-          sweetalert2.esm.all.js sweetalert2.esm.all.min.js
-          sweetalert2.css sweetalert2.min.css
-          themes/bootstrap-4.css themes/bootstrap-5.css
-          themes/borderless.css themes/bulma.css
-          themes/material-ui.css themes/minimal.css
-          swal_rails/index.js swal_rails/confirm.js swal_rails/flash.js swal_rails/chain.js
-          swal_rails/controllers/swal_controller.js
-        ]
+        app.config.assets.precompile += SwalRails::AssetManifest.precompile_for(
+          SwalRails.configuration,
+          app_root: app.root
+        )
       end
     end
 

data/lib/swal_rails/helpers.rb

@@ -100,7 +100,18 @@ module SwalRails
     # When `nonce: true` is passed and ActionView's CSP helper is available,
     # Rails substitutes the per-request nonce so the tag survives a
     # `script-src 'self' 'nonce-…'` policy.
+    #
+    # @deprecated Inline `<script>` tags add per-request CSP nonce overhead
+    #   and are not cacheable. Prefer the `data-swal-confirm` attribute or
+    #   the bundled Stimulus controller (`data-controller="swal"
+    #   data-action="click->swal#fire"`). Slated for removal in v1.0.
     def swal_tag(options = {}, html_options = {})
+      ActiveSupport::Deprecation.new("1.0", "swal_rails").warn(
+        "swal_tag is deprecated. Use the bundled Stimulus controller " \
+        "(data-controller=\"swal\" data-action=\"click->swal#fire\" " \
+        "data-swal-options-value=\"…\") or a data-swal-confirm attribute. " \
+        "swal_tag will be removed in swal_rails 1.0."
+      )
       # json_escape neutralizes `</script>`, `<!--`, U+2028 and U+2029 —
       # the four sequences that can break out of a <script> block.
       payload = ERB::Util.json_escape(options.to_json)
@@ -120,7 +131,14 @@ module SwalRails
     # Same XSS hardening and CSP nonce handling as `swal_tag`. Each step is
     # a full SweetAlert2 options Hash; `onConfirmed:` / `onDenied:` keys
     # declare nested sub-chains for conditional branching.
+    #
+    # @deprecated Same trade-offs as `swal_tag`. Prefer `data-swal-steps`
+    #   on a button/form. Slated for removal in v1.0.
     def swal_chain_tag(steps, html_options = {})
+      ActiveSupport::Deprecation.new("1.0", "swal_rails").warn(
+        "swal_chain_tag is deprecated. Use a data-swal-steps attribute on " \
+        "the triggering element. swal_chain_tag will be removed in swal_rails 1.0."
+      )
       # Array(hash) destructures a Hash into [[k, v], ...] pairs — wrap
       # single Hash steps manually so shorthand `swal_chain_tag(title: "Hi")`
       # produces `[{"title":"Hi"}]`, not `[["title","Hi"]]`.

data/lib/swal_rails/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module SwalRails
-  VERSION = "0.3.4"
+  VERSION = "0.5.0"
   SWEETALERT2_VERSION = "11.26.24"
 end

data/lib/swal_rails.rb

@@ -29,6 +29,7 @@ module SwalRails
 end
 
 require_relative "swal_rails/configuration"
+require_relative "swal_rails/asset_manifest"
 require_relative "swal_rails/initializer_version_check"
 require_relative "swal_rails/helpers"
 require_relative "swal_rails/engine" if defined?(Rails::Engine)

data/npm/chain.js

@@ -0,0 +1,60 @@
+// Runs a sequence of SweetAlert2 modals, advancing only on confirm.
+//
+// Semantics (per step):
+//   - isDismissed → abort the chain, return false
+//   - isConfirmed → run onConfirmed sub-chain if present, else continue
+//   - isDenied    → run onDenied sub-chain if present, else abort
+//
+// A chain resolves to `true` iff it ran to completion along a path without
+// abort. That boolean is the contract expected by Turbo.setConfirmMethod
+// and by the data-attribute re-dispatch logic in confirm.js.
+export const CHAIN_DEFAULTS = {
+  showCancelButton: true,
+  focusCancel: true,
+  icon: "warning"
+}
+
+// JSON-delivered steps cannot ship functions (e.g. inputValidator).
+// `inputExpected` provides a declarative guard for typed confirmations.
+const normalizeStep = (step) => {
+  const {
+    onConfirmed,
+    onDenied,
+    inputExpected,
+    inputExpectedError,
+    ...sa2Options
+  } = step || {}
+
+  if (typeof inputExpected === "string") {
+    const expected = inputExpected
+    const error = inputExpectedError || `Type "${expected}" to continue`
+    sa2Options.inputValidator = (value) => (
+      (value || "").trim() === expected ? undefined : error
+    )
+  }
+
+  return { onConfirmed, onDenied, sa2Options }
+}
+
+export const chainDialogs = async (Swal, steps) => {
+  if (!Array.isArray(steps) || steps.length === 0) return true
+
+  for (const step of steps) {
+    // Strip our own control keys — SA2 ignores unknown options, but leaking
+    // `onConfirmed`/`onDenied` into the popup options keeps the serialized
+    // payload noisy and invites confusion.
+    const { onConfirmed, onDenied, sa2Options } = normalizeStep(step)
+    const result = await Swal.fire({ ...CHAIN_DEFAULTS, ...sa2Options })
+
+    if (result.isDismissed) return false
+    if (result.isConfirmed) {
+      if (Array.isArray(onConfirmed)) return chainDialogs(Swal, onConfirmed)
+      continue
+    }
+    if (result.isDenied) {
+      if (Array.isArray(onDenied)) return chainDialogs(Swal, onDenied)
+      return false
+    }
+  }
+  return true
+}

data/npm/confirm.js

@@ -0,0 +1,103 @@
+import { chainDialogs } from "swal_rails/chain"
+
+const parseJSON = (value) => {
+  if (!value) return null
+  try { return JSON.parse(value) } catch { return null }
+}
+
+// When Rails serializes `data: { turbo_confirm: { icon: "error" } }`, the
+// attribute value is a JSON string. Detect that, and accept both Object
+// (single-step options) and Array (multi-step chain) shapes.
+const messagePayload = (message) => {
+  if (typeof message !== "string") return null
+  const trimmed = message.trim()
+  if (trimmed[0] !== "{" && trimmed[0] !== "[") return null
+  const parsed = parseJSON(trimmed)
+  if (Array.isArray(parsed)) return parsed
+  if (parsed && typeof parsed === "object") return parsed
+  return null
+}
+
+const confirmDialog = (Swal, message, element) => {
+  const dataset = element?.dataset || {}
+  const payload = messagePayload(message)
+  const fromMessage = payload && !Array.isArray(payload) ? payload : null
+  const text = fromMessage ? undefined : message
+
+  const options = {
+    title: dataset.swalTitle || text || "Are you sure?",
+    text: dataset.swalText || (dataset.swalTitle ? text : undefined),
+    icon: dataset.swalIcon || "warning",
+    showCancelButton: true,
+    focusCancel: true
+  }
+  if (dataset.swalConfirmText) options.confirmButtonText = dataset.swalConfirmText
+  if (dataset.swalCancelText) options.cancelButtonText = dataset.swalCancelText
+
+  // Merge order (later wins): defaults → data-swal-* shortcuts → JSON message
+  // (turbo_confirm: {}) → data-swal-options (most specific).
+  const extras = parseJSON(dataset.swalOptions) || {}
+  return Swal.fire({ ...options, ...(fromMessage || {}), ...extras }).then((result) => result.isConfirmed)
+}
+
+// Dispatches to either a multi-step chain or a single-step confirm. Called
+// from both the Turbo override and the data-attribute listener so both
+// paths behave identically.
+const confirmFlow = (Swal, message, element) => {
+  const fromDataset = parseJSON(element?.dataset?.swalSteps)
+  if (Array.isArray(fromDataset) && fromDataset.length) return chainDialogs(Swal, fromDataset)
+
+  const payload = messagePayload(message)
+  if (Array.isArray(payload) && payload.length) return chainDialogs(Swal, payload)
+
+  return confirmDialog(Swal, message, element)
+}
+
+const installTurboOverride = (Swal) => {
+  if (typeof window.Turbo === "undefined") return false
+  const handler = (message, element) => confirmFlow(Swal, message, element)
+  // Turbo 8.1+ renamed the API to `Turbo.config.forms.confirm`. The legacy
+  // `setConfirmMethod` still works but emits a deprecation warning. Prefer
+  // the new path, fall back to the old one for older Turbo versions.
+  if (window.Turbo.config?.forms) {
+    window.Turbo.config.forms.confirm = handler
+    return true
+  }
+  if (typeof window.Turbo.setConfirmMethod === "function") {
+    window.Turbo.setConfirmMethod(handler)
+    return true
+  }
+  return false
+}
+
+const installDataAttribute = (Swal) => {
+  const handler = (event) => {
+    const el = event.target.closest("[data-swal-confirm], [data-swal-steps]")
+    if (!el) return
+    const message = el.getAttribute("data-swal-confirm")
+    event.preventDefault()
+    event.stopPropagation()
+    confirmFlow(Swal, message, el).then((confirmed) => {
+      if (!confirmed) return
+      el.removeAttribute("data-swal-confirm")
+      el.removeAttribute("data-swal-steps")
+      if (typeof el.click === "function" && event.type === "click") {
+        el.click()
+      } else if (el.tagName === "FORM") {
+        // requestSubmit() fires the 'submit' event, so Turbo and any UJS
+        // handlers stay in the loop — unlike the raw .submit() which skips them.
+        if (typeof el.requestSubmit === "function") el.requestSubmit()
+        else el.submit()
+      }
+    })
+  }
+  document.addEventListener("click", handler, true)
+  document.addEventListener("submit", handler, true)
+}
+
+export const installConfirm = (Swal, config) => {
+  const mode = config.confirmMode || "data_attribute"
+  if (mode === "off") return
+  if (mode === "turbo_override" || mode === "both") installTurboOverride(Swal)
+  if (mode === "data_attribute" || mode === "both") installDataAttribute(Swal)
+}

data/npm/controllers/swal_controller.js

@@ -0,0 +1,54 @@
+import { Controller } from "@hotwired/stimulus"
+import Swal from "sweetalert2"
+import { chainDialogs } from "swal_rails/chain"
+
+// Fire a Swal modal/toast or a multi-step chain from markup.
+//
+// <button data-controller="swal"
+//         data-action="click->swal#fire"
+//         data-swal-options-value='{"title":"Hi","icon":"info"}'>
+//   Ping
+// </button>
+//
+// <button data-controller="swal"
+//         data-action="click->swal#chain"
+//         data-swal-steps-value='[{"title":"Sure?"},{"title":"Really?"}]'>
+//   Ping
+// </button>
+export default class extends Controller {
+  static values = {
+    options: { type: Object, default: {} },
+    steps: { type: Array, default: [] }
+  }
+
+  fire(event) {
+    if (this.element.tagName === "A" || this.element.tagName === "BUTTON") {
+      event?.preventDefault?.()
+    }
+    return Swal.fire(this.optionsValue)
+  }
+
+  confirm(event) {
+    event?.preventDefault?.()
+    const form = event?.target?.closest?.("form") || this.element
+    Swal.fire({
+      showCancelButton: true,
+      focusCancel: true,
+      ...this.optionsValue
+    }).then((result) => {
+      if (result.isConfirmed && form?.tagName === "FORM") {
+        typeof form.requestSubmit === "function" ? form.requestSubmit() : form.submit()
+      }
+    })
+  }
+
+  async chain(event) {
+    event?.preventDefault?.()
+    const form = event?.target?.closest?.("form") || this.element
+    const ok = await chainDialogs(window.Swal || Swal, this.stepsValue)
+    if (ok && form?.tagName === "FORM") {
+      typeof form.requestSubmit === "function" ? form.requestSubmit() : form.submit()
+    }
+    return ok
+  }
+}

data/npm/flash.js

@@ -0,0 +1,174 @@
+// Read the meta tag exactly once per page load. Boot() fires on both
+// DOMContentLoaded and turbo:load, so without this guard an array flash
+// would have its fireNext chain launched twice, racing and cascading via
+// Swal.fire's replace-current-popup behavior — only the last message wins.
+const readFlash = () => {
+  const el = document.querySelector('meta[name="swal-flash"]');
+  if (!el || el.dataset.swalConsumed === "1") return [];
+  el.dataset.swalConsumed = "1";
+  try {
+    return JSON.parse(el.getAttribute("content")) || [];
+  } catch {
+    return [];
+  }
+};
+
+// Keys attached by `swal_flash` helper for per-request mode / delay override.
+// Stripped from the options before being passed to Swal.fire so they never
+// leak into SA2.
+const META_KEYS = ["_arrayMode", "_stackDelay"];
+
+const extractMeta = (queue) => {
+  let mode = null;
+  let delay = null;
+  for (const item of queue) {
+    if (mode === null && item._arrayMode) mode = item._arrayMode;
+    if (delay === null && item._stackDelay != null) delay = item._stackDelay;
+    for (const k of META_KEYS) delete item[k];
+  }
+  return { mode, delay };
+};
+
+// Per-item: _persistent removes the auto-close timer and ensures the user
+// must dismiss manually via the close button.
+const applyPersistent = (queue) => {
+  for (const item of queue) {
+    if (!item._persistent) continue;
+    delete item._persistent;
+    delete item.timer;
+    delete item.timerProgressBar;
+    item.showCloseButton = true;
+  }
+};
+
+const STACK_ID = "swal-rails-stack";
+
+const ensureStackContainer = () => {
+  let el = document.getElementById(STACK_ID);
+  if (!el) {
+    el = document.createElement("div");
+    el.id = STACK_ID;
+    // 360px matches SA2's `body.swal2-toast-shown .swal2-container` width;
+    // without it the cloned popups inherit `width: 100%` from SA2 and
+    // visually span the whole screen.
+    el.style.cssText = [
+      "position:fixed",
+      "top:1rem",
+      "right:1rem",
+      "width:360px",
+      "max-width:calc(100vw - 2rem)",
+      "display:flex",
+      "flex-direction:column",
+      "gap:.5rem",
+      "z-index:10000",
+      "pointer-events:none",
+    ].join(";");
+    document.body.appendChild(el);
+  }
+  return el;
+};
+
+const fireSequential = (Swal, queue) => {
+  const fireNext = () => {
+    const opts = queue.shift();
+    if (!opts) return;
+    Swal.fire(opts).then(fireNext);
+  };
+  fireNext();
+};
+
+// SA2 is singleton — two concurrent Swal.fire calls collapse into one
+// popup (the second replaces the first). To stack multiple toasts we let
+// SA2 render each popup, clone it into its own slot, then close the
+// original fast so the next fire is unblocked. The clones live on in our
+// stack with their own timer and click-to-dismiss handlers. Empiler des
+// modales bloquantes n'a pas de sens — on force toast: true.
+const fireStacked = async (Swal, queue, delay) => {
+  const stack = ensureStackContainer();
+  for (let i = 0; i < queue.length; i++) {
+    const opts = queue[i];
+    const slot = document.createElement("div");
+    slot.className = "swal-rails-stack-slot";
+    slot.style.cssText = "width:100%;pointer-events:auto;";
+    stack.appendChild(slot);
+
+    const timerMs = opts.timer;
+    await new Promise((resolve) => {
+      Swal.fire({
+        ...opts,
+        toast: true,
+        timerProgressBar: false,
+        showClass: { popup: "", backdrop: "", icon: "" },
+        hideClass: { popup: "", backdrop: "", icon: "" },
+        // timer:1 races with the setTimeout(0) SA2 uses to schedule didOpen
+        // when animations are disabled — didOpen can lose that race and never
+        // fire, leaving the slot empty. 50 ms gives the event loop a safe
+        // margin while remaining imperceptible to the user.
+        timer: 50,
+        // Suppress the SA2 original so only our clone in the stack is visible.
+        willOpen: (popup) => {
+          popup.style.opacity = "0";
+          popup.style.pointerEvents = "none";
+        },
+        // Clone at didOpen: SA2 has applied all inline styles at this point
+        // (display:grid, icon classes, close-button grid placement, etc.),
+        // so the clone requires no manual fixups.
+        didOpen: (popup) => {
+          const clone = popup.cloneNode(true);
+          // willOpen set opacity:0 on the original; clear it on the clone.
+          clone.style.opacity = "";
+          clone
+            .querySelectorAll(".swal2-timer-progress-bar-container")
+            .forEach((e) => e.remove());
+          slot.appendChild(clone);
+          const dismiss = () => {
+            if (slot.isConnected) slot.remove();
+            if (stack.isConnected && stack.children.length === 0)
+              stack.remove();
+          };
+          clone.querySelector(".swal2-close")?.addEventListener("click", dismiss);
+          if (timerMs) setTimeout(dismiss, timerMs);
+        },
+        didClose: () => resolve(),
+      });
+    });
+
+    if (i < queue.length - 1 && delay > 0) {
+      await new Promise((r) => setTimeout(r, delay));
+    }
+  }
+};
+
+export const installFlash = (Swal, config) => {
+  const flashes = readFlash();
+  if (!flashes.length) return;
+
+  const map = config.flashMap || {};
+  const queue = flashes.map((flash) => {
+    const spec = map[flash.key] ||
+      map[flash.key.toLowerCase()] || {
+        icon: "info",
+        toast: true,
+        position: "top-end",
+        timer: 3000,
+      };
+    // Per-request options win over the per-key defaults from flash_map.
+    return { ...spec, ...(flash.options || {}) };
+  });
+
+  const meta = extractMeta(queue);
+  applyPersistent(queue);
+  const mode = meta.mode || config.flashArrayMode || "sequential";
+  const delay =
+    meta.delay != null
+      ? meta.delay
+      : config.flashStackDelay != null
+        ? config.flashStackDelay
+        : 500;
+
+  if (mode === "stacked" && queue.length > 1) {
+    fireStacked(Swal, queue, delay);
+  } else {
+    fireSequential(Swal, queue);
+  }
+};

data/npm/index.js

@@ -0,0 +1,69 @@
+import Swal from "sweetalert2"
+import { installConfirm } from "swal_rails/confirm"
+import { installFlash } from "swal_rails/flash"
+
+const readMeta = (name) => {
+  const el = document.querySelector(`meta[name="${name}"]`)
+  if (!el) return null
+  try { return JSON.parse(el.getAttribute("content")) } catch { return null }
+}
+
+const prefersReducedMotion = () =>
+  window.matchMedia && window.matchMedia("(prefers-reduced-motion: reduce)").matches
+
+const buildMixin = (config) => {
+  const base = { ...(config.defaultOptions || {}) }
+  if (config.respectReducedMotion && prefersReducedMotion()) {
+    base.showClass = { popup: "" }
+    base.hideClass = { popup: "" }
+  }
+  if (config.i18n?.confirm_button_text) base.confirmButtonText = config.i18n.confirm_button_text
+  if (config.i18n?.cancel_button_text) base.cancelButtonText = config.i18n.cancel_button_text
+  if (config.i18n?.deny_button_text) base.denyButtonText = config.i18n.deny_button_text
+  if (config.i18n?.close_button_aria_label) base.closeButtonAriaLabel = config.i18n.close_button_aria_label
+  return base
+}
+
+// Module-scoped so repeated calls to boot() (DOMContentLoaded + every
+// turbo:load) don't stack a new click/submit listener per navigation.
+let booted = null
+
+const boot = () => {
+  if (!booted) {
+    const config = readMeta("swal-config") || {}
+    const Mixin = Swal.mixin(buildMixin(config))
+
+    if (config.exposeWindowSwal !== false) {
+      window.Swal = Mixin
+    }
+
+    installConfirm(Mixin, config)
+    booted = { Swal: Mixin, config }
+    document.dispatchEvent(new CustomEvent("swal-rails:ready", { detail: booted }))
+  }
+
+  // Flash meta is re-rendered per request, so read and fire on every page.
+  installFlash(booted.Swal, booted.config)
+  return booted.Swal
+}
+
+const ready = (fn) => {
+  if (document.readyState === "loading") {
+    document.addEventListener("DOMContentLoaded", fn, { once: true })
+  } else {
+    fn()
+  }
+}
+
+ready(boot)
+// `turbo:load` covers full Turbo Drive navigations + initial page loads.
+// `turbo:render` additionally covers form submissions that render with
+// a non-redirect status (e.g. 422 unprocessable_entity for `flash.now`)
+// — Turbo replaces the body but does NOT fire turbo:load in that path.
+// The `data-swal-consumed` guard on the meta tag dedupes the double-fire
+// on full navigations where both events run.
+document.addEventListener("turbo:load", boot)
+document.addEventListener("turbo:render", boot)
+
+export { Swal }
+export default Swal

data/npm/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "swal_rails",
+  "version": "0.5.0",
+  "description": "SweetAlert2 for Rails 7+ — batteries included (jsbundling companion)",
+  "type": "module",
+  "main": "index.js",
+  "module": "index.js",
+  "exports": {
+    ".": "./index.js",
+    "./confirm": "./confirm.js",
+    "./flash": "./flash.js",
+    "./chain": "./chain.js",
+    "./controllers/swal_controller": "./controllers/swal_controller.js"
+  },
+  "files": [
+    "*.js",
+    "controllers/"
+  ],
+  "peerDependencies": {
+    "sweetalert2": ">=11.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Metalzoid/swal_rails"
+  },
+  "homepage": "https://github.com/Metalzoid/swal_rails",
+  "bugs": {
+    "url": "https://github.com/Metalzoid/swal_rails/issues"
+  },
+  "license": "MIT",
+  "author": "Florian Gagnaire <gagnaire.flo@gmail.com>",
+  "keywords": [
+    "rails",
+    "sweetalert2",
+    "flash",
+    "confirm",
+    "jsbundling",
+    "esbuild",
+    "webpack",
+    "vite"
+  ]
+}

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: swal_rails
 version: !ruby/object:Gem::Version
-  version: 0.3.4
+  version: 0.5.0
 platform: ruby
 authors:
 - Florian Gagnaire
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-05-01 00:00:00.000000000 Z
+date: 2026-05-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -70,11 +70,18 @@ files:
 - lib/generators/swal_rails/install/templates/initializer.rb
 - lib/generators/swal_rails/locales/locales_generator.rb
 - lib/swal_rails.rb
+- lib/swal_rails/asset_manifest.rb
 - lib/swal_rails/configuration.rb
 - lib/swal_rails/engine.rb
 - lib/swal_rails/helpers.rb
 - lib/swal_rails/initializer_version_check.rb
 - lib/swal_rails/version.rb
+- npm/chain.js
+- npm/confirm.js
+- npm/controllers/swal_controller.js
+- npm/flash.js
+- npm/index.js
+- npm/package.json
 - vendor/javascript/sweetalert2/LICENSE
 - vendor/javascript/sweetalert2/sweetalert2.all.js
 - vendor/javascript/sweetalert2/sweetalert2.all.min.js