wabi 0.15.0 → 0.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5da6047adf08752f3a94d9e9d10828e5eb68f6e597f0193608a7bcabd3125a6e
-  data.tar.gz: 2874c23f200ecc7b714e21a27a85ca6808192e6bf82e3a59f3baa21c1c5f530c
+  metadata.gz: d4495a8631cd5ad14cac92e522f0bdd4f1409ec525d9ca7772e806c6a2556947
+  data.tar.gz: 5434b6d05819812507dd79b35b4e8d5de17b18e0f3972be980cab3ee3073c6a3
 SHA512:
-  metadata.gz: a36925fa1db4d383e3b2435331a3f5c1f8ec639a702ef43483cd165b4f4abb33482cd188459ca9f4fcf7bc6928953caaa27ef2a9c08c1682a1399e21bc302199
-  data.tar.gz: e3cf19e0882ad6bcb472bc46650ba69b91feafc2fae65e46f383a16dfc8a01abc66c94bb0b8fb4b06278fc0da7f3b6bc5c42f63ff6ab3b2f53d0fe3117aaa576
+  metadata.gz: c2fa7aa63c365c998c8b1c842e042d6c52de53ee28f9ec9ca23a4ee252cbb8716a9c48500cc1659d518ed78fed2b8b0a02b98a528e5f3eea8227bb610cebd62d
+  data.tar.gz: 8e555b3a09a17aed90cff323d97480199ff85b1f236170e90441a6b20551f908a5e24d16a35c3c8e0a8d19641614fd8f3fd9b778606c4cb50dc6497fa08482ff

data/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to Wabi land here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.16.0 - 2026-06-03
+
+Local Zag vendoring for offline / strict-CSP installs, plus a `:pill` style
+variant for Tabs.
+
+### Added
+
+- **`wabi:vendor` generator — opt-in local vendoring of Zag (offline / strict-CSP).**
+  Components pin Zag from the jsDelivr `+esm` CDN by default, which fails for
+  offline, air-gapped, or strict-CSP apps. `bin/rails g wabi:vendor` reads the
+  jsDelivr `+esm` pins from `config/importmap.rb`, downloads the full transitive
+  `+esm` graph into `vendor/javascript/`, rewrites every cross-package CDN
+  reference (including subpath exports like `@floating-ui/utils/dom`) to a bare
+  specifier, and repins each package at its local copy — so no controller loads
+  from the CDN at runtime. Pass package names to vendor a subset. `wabi:add` now
+  hints at it when a component needs Zag. CDN remains the default.
+- **Tabs `:pill` variant.** `Tabs.new(variant: :pill)` renders a rounded
+  container with a solid-primary active pill, as an alternative to the default
+  `:standard` segmented look. The variant is set once on the root and propagates
+  to `TabsList`/`TabsTrigger` via a `group-data-[variant=pill]` marker — no
+  changes to how triggers are written, and the Stimulus controller is unchanged.
+
 ## 0.15.0 - 2026-06-03
 
 Adds the **NumberInput** component.

data/README.md

@@ -4,7 +4,7 @@
 
 Wabi is an open-source UI component library for **Ruby on Rails 8**, built on **Phlex + Tailwind 4 + Stimulus + Hotwire**. Inspired by shadcn/ui, components are *copied* into your app — you own the code, customize freely, no upstream API to drift away from.
 
-🎉 **Status:** v0.15.0 alpha — [available on RubyGems](https://rubygems.org/gems/wabi). 35 components, 8 theme palettes, WCAG-AA targeted, live docs + registry at [wabi-docs.onrender.com](https://wabi-docs.onrender.com).
+🎉 **Status:** v0.16.0 alpha — [available on RubyGems](https://rubygems.org/gems/wabi). 35 components, 8 theme palettes, WCAG-AA targeted, live docs + registry at [wabi-docs.onrender.com](https://wabi-docs.onrender.com).
 
 ---
 
@@ -108,6 +108,7 @@ That's a fully-accessible modal with focus trap, scroll lock, backdrop click, Es
 | `wabi:list` | Lists all available components in the configured registry. |
 | `wabi:registry <url>` | Switches the active registry origin (default: `https://wabi-docs.onrender.com/r`). |
 | `wabi:theme <slug>` | Swaps `tokens.css` for the requested palette. Run `bin/rails tailwindcss:build` after. |
+| `wabi:vendor [pkg…]` | **Offline / strict-CSP.** Downloads the Zag `+esm` dependency graph for your jsDelivr-pinned packages into `vendor/javascript/` and repins `config/importmap.rb` at the local copies, so no controller loads from the CDN at runtime. Default: every jsDelivr `+esm` pin in the importmap. |
 
 ---
 

data/lib/wabi/generators/add_generator.rb

@@ -68,6 +68,8 @@ module Wabi
         say "  imports (like @zag-js/*) — it only downloads the entry file, leaving relative"
         say "  imports unresolved. The `+esm` endpoint above ships a single bundle with all"
         say "  transitive deps resolved to absolute URLs.", :yellow
+        say "\n  Offline / strict-CSP app? Run `bin/rails g wabi:vendor` to download Zag", :yellow
+        say "  into vendor/javascript/ and pin the local copies instead of the CDN.", :yellow
       end
     end
   end

data/lib/wabi/generators/vendor_generator.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+require "rails/generators"
+require "net/http"
+require "uri"
+require "fileutils"
+require "wabi/zag_vendor"
+
+module Wabi
+  module Generators
+    class VendorGenerator < Rails::Generators::Base
+      argument :packages, type: :array, default: [],
+               banner: "[@scope/pkg ...]  (default: all jsDelivr +esm pins in config/importmap.rb)"
+
+      desc "Download Zag's +esm graph into vendor/javascript and pin it locally (offline / strict-CSP)."
+
+      def vendor
+        roots = resolve_roots
+        if roots.empty?
+          say "  No jsDelivr +esm pins found in config/importmap.rb (nothing to vendor).", :yellow
+          return
+        end
+
+        result = Wabi::ZagVendor.call(roots, fetcher: method(:http_get))
+
+        result.files.each do |pkg, content|
+          target = File.join(destination_root, "vendor/javascript", "#{pkg}.js")
+          FileUtils.mkdir_p(File.dirname(target))
+          File.write(target, content)
+          say "  vendor    vendor/javascript/#{pkg}.js", :green
+        end
+
+        rewrite_importmap(result.files.keys)
+        say "\n  Vendored #{result.files.size} package(s). config/importmap.rb now points at local copies.", :green
+      end
+
+      private
+
+      IMPORTMAP = "config/importmap.rb"
+      # pin "<name>", to: "<jsDelivr +esm url>"
+      CDN_PIN = /^\s*pin\s+"(?<name>[^"]+)",\s*to:\s*"(?<url>https:\/\/cdn\.jsdelivr\.net\/npm\/[^"]+\/\+esm)"/
+
+      def importmap_path
+        File.join(destination_root, IMPORTMAP)
+      end
+
+      def resolve_roots
+        return [] unless File.exist?(importmap_path)
+        content = File.read(importmap_path)
+        pins = content.each_line.filter_map do |line|
+          next unless (m = line.match(CDN_PIN))
+          ref = m[:url].match(Wabi::ZagVendor::REF)
+          next unless ref
+          { name: m[:name], pkg: ref[1], ver: ref[2] }
+        end
+        return pins.map { |p| { pkg: p[:pkg], ver: p[:ver] } } if packages.empty?
+        packages.map do |name|
+          found = pins.find { |p| p[:pkg] == name }
+          { pkg: name, ver: found ? found[:ver] : "1.41.0" }
+        end
+      end
+
+      # For every vendored package, ensure `pin "<pkg>", to: "<pkg>.js" # vendored by wabi`.
+      # Replace an existing pin for that pkg (CDN or vendored); insert if absent.
+      def rewrite_importmap(pkgs)
+        content = File.exist?(importmap_path) ? File.read(importmap_path) : ""
+        pkgs.each do |pkg|
+          new_line = %(pin "#{pkg}", to: "#{pkg}.js" # vendored by wabi)
+          existing = /^\s*pin\s+"#{Regexp.escape(pkg)}",.*$/
+          if content =~ existing
+            content = content.sub(existing, new_line)
+          else
+            content = content.rstrip + "\n" + new_line + "\n"
+          end
+        end
+        File.write(importmap_path, content)
+      end
+
+      # Net::HTTP.get_response does NOT follow redirects; jsDelivr may 3xx.
+      def http_get(url, limit = 5)
+        raise Wabi::Error, "vendor: too many redirects for #{url}" if limit <= 0
+        res = Net::HTTP.get_response(URI.parse(url))
+        case res
+        when Net::HTTPSuccess      then res.body.dup.force_encoding("UTF-8")
+        when Net::HTTPRedirection  then http_get(URI.join(url, res["location"]).to_s, limit - 1)
+        else raise Wabi::Error, "vendor: failed to fetch #{url}: HTTP #{res.code}"
+        end
+      end
+    end
+  end
+end

data/lib/wabi/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Wabi
-  VERSION = "0.15.0"
+  VERSION = "0.16.0"
 end

data/lib/wabi/zag_vendor.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+require "set"
+require "cgi"
+require "wabi" # for Wabi::Error (defined in wabi.rb, not version.rb)
+
+module Wabi
+  # Walks the jsDelivr `+esm` import graph for one or more root packages and
+  # rewrites cross-package CDN references (`/npm/<pkg>@<ver>/+esm`) to bare
+  # specifiers (`<pkg>`), so every file can be served locally and resolved
+  # through the importmap (Propshaft-digest-safe). Pure: HTTP is injected via
+  # `fetcher`, a callable taking a URL string and returning the body string.
+  class ZagVendor
+    CDN = "https://cdn.jsdelivr.net"
+    # /npm/<pkg>@<ver>[/<subpath>]/+esm — <pkg> may be scoped (@scope/name).
+    # jsDelivr references both the package root (`@ver/+esm`) and subpath exports
+    # (`@ver/dom/+esm`, e.g. @floating-ui/utils/dom); group 3 captures the
+    # optional subpath so those resolve to a distinct local module too.
+    REF = %r{/npm/((?:@[^/]+/)?[^/@]+)@([^/]+?)((?:/[^/]+)*?)/\+esm}
+
+    Result = Struct.new(:files, :versions) # files: {pkg=>content}, versions: {pkg=>ver}
+
+    def self.call(roots, fetcher:)
+      new(fetcher).call(roots)
+    end
+
+    def initialize(fetcher)
+      @fetcher = fetcher
+    end
+
+    # roots: [{ pkg: "@zag-js/dialog", ver: "1.41.0" }, ...]
+    def call(roots)
+      files = {}
+      versions = {} # specifier => normalized version (first seen)
+      queue = roots.map { |r| { spec: r[:pkg], sub: "", ver: normalize_version(r[:ver]) } }
+
+      until queue.empty?
+        item = queue.shift
+        spec = item[:spec] # bare specifier incl. any subpath, e.g. "@floating-ui/utils/dom"
+        pkg  = spec.sub(item[:sub], "") # package name without the subpath, for the fetch URL
+        ver  = item[:ver]
+
+        # Dedupe by SPECIFIER (package + subpath), not by URL: jsDelivr's real
+        # graph references the same module both as a resolved pin (`@0.2.11`) and
+        # as a range (`@%5E0.2.11`, i.e. URL-encoded `^0.2.11`). Those normalize
+        # to the same version and the rewrite drops the version anyway (bare
+        # specifier). Only genuinely-different versions (after normalizing the
+        # range/encoding) are a real conflict a single bare importmap pin can't
+        # carry.
+        if versions.key?(spec)
+          if versions[spec] != ver
+            raise Wabi::Error,
+              "vendor: #{spec} appears at two versions (#{versions[spec]} and #{ver}); " \
+              "a bare importmap pin can't carry two versions"
+          end
+          next
+        end
+        versions[spec] = ver
+
+        content = @fetcher.call("#{CDN}/npm/#{pkg}@#{ver}#{item[:sub]}/+esm")
+        files[spec] = content.gsub(REF) do
+          dep_pkg = Regexp.last_match(1)
+          dep_ver = normalize_version(Regexp.last_match(2))
+          dep_sub = Regexp.last_match(3).to_s # "" or "/dom"
+          dep_spec = "#{dep_pkg}#{dep_sub}"
+          queue << { spec: dep_spec, sub: dep_sub, ver: dep_ver }
+          dep_spec
+        end
+      end
+
+      Result.new(files, versions)
+    end
+
+    private
+
+    # jsDelivr emits versions URL-encoded and sometimes as semver ranges
+    # (`%5E0.2.11` → `^0.2.11`). Decode and strip leading range operators so a
+    # range ref and a pin ref to the same resolved version compare equal. The
+    # stripped exact version is also what we fetch (`@0.2.11/+esm`).
+    def normalize_version(ver)
+      CGI.unescape(ver.to_s).sub(/\A[\^~><= ]+/, "").strip
+    end
+  end
+end

data/lib/wabi.rb

@@ -20,4 +20,5 @@ if defined?(Rails::Generators)
   require_relative "wabi/generators/list_generator"
   require_relative "wabi/generators/registry_generator"
   require_relative "wabi/generators/theme_generator"
+  require_relative "wabi/generators/vendor_generator"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: wabi
 version: !ruby/object:Gem::Version
-  version: 0.15.0
+  version: 0.16.0
 platform: ruby
 authors:
 - Oscar Ortega
@@ -141,11 +141,13 @@ files:
 - lib/wabi/generators/registry_generator.rb
 - lib/wabi/generators/theme_generator.rb
 - lib/wabi/generators/update_generator.rb
+- lib/wabi/generators/vendor_generator.rb
 - lib/wabi/lockfile.rb
 - lib/wabi/registry_client.rb
 - lib/wabi/turbo_stream_extensions.rb
 - lib/wabi/variants.rb
 - lib/wabi/version.rb
+- lib/wabi/zag_vendor.rb
 - templates/controllers/wabi/theme_controller.js
 - templates/tokens.css
 homepage: https://wabikit.dev