plutonium 0.62.2 → 0.64.0

data/lib/plutonium/ui/display/theme.rb

@@ -8,9 +8,28 @@ module Plutonium
           super.merge({
             base: "",
             value_wrapper: "max-h-[300px] overflow-y-auto",
-            fields_wrapper: "pu-card",
+            # Merged into the fields_wrapper's Block, which supplies `pu-card`
+            # itself — this is only for anything a caller wants to add on top.
+            fields_wrapper: nil,
             fields_inner: "pu-card-body grid grid-cols-1 md:grid-cols-2 2xl:grid-cols-4 gap-x-8 gap-y-6 grid-flow-row-dense",
 
+            # display_layout sectioning. `sections_wrapper` replaces
+            # `fields_inner` as the card's inner padding box when a layout is
+            # declared (it stacks sections instead of fields directly), and
+            # each section's field grid uses `section_grid` — the same grid as
+            # `fields_inner` without the padding, which the wrapper now owns.
+            # Split into their own keys so overriding one path doesn't
+            # silently reshape the other.
+            # Sections are their OWN cards (see Component::Section), so this
+            # only has to stack them — no card, no padding of its own.
+            sections_wrapper: "space-y-4",
+            section_grid: "grid grid-cols-1 md:grid-cols-2 2xl:grid-cols-4 gap-x-8 gap-y-6 grid-flow-row-dense",
+
+            # Section chrome (heading, accent, divider, collapsible caret).
+            # Shared defaults with the form so both read the same; override any
+            # key here to restyle show-page sections alone.
+            **Plutonium::UI::Component::Section::DEFAULT_THEME,
+
             # Labels and descriptions
             label: "text-sm font-semibold uppercase tracking-wide text-[var(--pu-text-muted)] mb-2",
             description: "text-sm text-[var(--pu-text-subtle)]",

data/lib/plutonium/ui/export_button.rb

@@ -63,7 +63,7 @@ module Plutonium
 
       def render_menu
         div(
-          class: "hidden absolute right-0 top-full z-50 mt-1 w-48 origin-top-right bg-[var(--pu-surface)] " \
+          class: "hidden absolute right-0 top-full z-50 mt-1 w-max min-w-48 max-w-[min(20rem,90vw)] origin-top-right bg-[var(--pu-surface)] " \
                  "border border-[var(--pu-border)] rounded-[var(--pu-radius-lg)] overflow-hidden",
           style: "box-shadow: var(--pu-shadow-lg)",
           data: {resource_drop_down_target: "menu"}

data/lib/plutonium/ui/form/base.rb

@@ -9,6 +9,7 @@ module Plutonium
         class Builder < Builder
           include Phlexi::Field::Common::Tokens
           include Plutonium::UI::Form::Options::InferredTypes
+          include Plutonium::UI::Component::ResolvesTags
 
           # Consume `:as` here so it doesn't land in Phlexi's `@options` —
           # `:as` is a Plutonium-internal concept (it picks the tag method),
@@ -74,16 +75,16 @@ module Plutonium
           end
           alias_method :phone_tag, :int_tel_input_tag
 
-          # The `as:` values that render through the Uppy file-upload component —
-          # the single source of truth, also consulted by
-          # {Plutonium::Wizard::Attachments.field?} so a wizard can detect an
-          # attachment field model-free without re-listing the aliases.
-          FILE_INPUT_TYPES = %i[uppy file attachment].freeze
-
           def uppy_tag(**, &)
             create_component(Components::Uppy, :uppy, **, &)
           end
-          (FILE_INPUT_TYPES - [:uppy]).each { |name| alias_method :"#{name}_tag", :uppy_tag }
+          # Every file alias renders through Uppy. The list itself lives with the
+          # other `as:` semantics in {Plutonium::Definition::InputAliases}, which
+          # is also where non-view callers (controller, wizard, generators) ask
+          # whether an `as:` is an attachment — so the two never drift.
+          (Plutonium::Definition::InputAliases::FILE_INPUT_TYPES - [:uppy]).each do |name|
+            alias_method :"#{name}_tag", :uppy_tag
+          end
 
           def key_value_store_tag(**, &)
             create_component(Components::KeyValueStore, :key_value_store, **, &)

data/lib/plutonium/ui/form/components/intl_tel_input.rb

@@ -35,7 +35,7 @@ module Plutonium
           # `Plutonium.configuration.default_phone_country`.
           def build_intl_options
             options = {}
-            if (country = attributes.delete(:initial_country) || Plutonium.configuration.default_phone_country)
+            if (country = attributes.delete(:initial_country) || Plutonium.configuration.normalized_default_phone_country)
               options[:initialCountry] = country
             end
             if (extra = attributes.delete(:intl_options))

data/lib/plutonium/ui/form/components/section.rb

@@ -4,68 +4,13 @@ module Plutonium
   module UI
     module Form
       module Components
-        # Renders a form section's chrome (heading/description, optional native
-        # <details> collapsible, and a fields grid) and yields to a block that
-        # renders the section's fields (the form supplies render_resource_field).
-        class Section < Plutonium::UI::Component::Base
-          def initialize(resolved, grid_class:)
-            @section = resolved.section
-            @grid_class = grid_class
-          end
-
-          SECTION_CLASS = "space-y-5 pt-7 first:pt-0"
-          # A short primary accent rule to the left of the heading — anchors the
-          # section and adds a touch of brand. Shared by the grouped <div> header
-          # and the collapsible <summary> so both read the same.
-          ACCENT_CLASS = "border-l-[3px] border-primary-500 pl-3.5"
-          HEADING_CLASS = "text-base font-semibold tracking-tight text-[var(--pu-text)]"
-          SUMMARY_CLASS = "#{HEADING_CLASS} #{ACCENT_CLASS} cursor-pointer select-none"
-          # font-normal resets the semibold inherited from a <summary> parent.
-          DESCRIPTION_CLASS = "mt-1 text-sm font-normal text-[var(--pu-text-muted)]"
-
-          def view_template(&fields_block)
-            if @section.collapsible?
-              details(open: !@section.collapsed?, class: SECTION_CLASS) do
-                # <summary> must be the first child of <details> and can't be
-                # wrapped, so the title text and its description both live inside
-                # it — keeping the description hugging the title under one accent.
-                summary(class: SUMMARY_CLASS) do
-                  plain heading_text
-                  describe
-                end
-                grid(&fields_block)
-              end
-            else
-              div(class: SECTION_CLASS) do
-                header_block
-                grid(&fields_block)
-              end
-            end
-          end
-
-          private
-
-          # Title + description grouped under one accented header so the
-          # description hugs the heading (mt-1) instead of inheriting the
-          # section's larger vertical rhythm.
-          def header_block
-            return if @section.ungrouped? && @section.options[:label].nil?
-            div(class: ACCENT_CLASS) do
-              h3(class: HEADING_CLASS) { heading_text }
-              describe
-            end
-          end
-
-          def heading_text = @section.label
-
-          def describe
-            return unless @section.description
-            p(class: DESCRIPTION_CLASS) { @section.description }
-          end
-
-          def grid(&fields_block)
-            div(class: @grid_class, &fields_block)
-          end
+        # A form's declared `form_layout` section. All chrome lives in the
+        # shared {Plutonium::UI::Component::Section} so a form section and a
+        # show-page section cannot drift apart; the form contributes only its
+        # own grid class (via `columns:`) and the block that renders the
+        # fields (the form supplies render_resource_field).
+        class Section < Plutonium::UI::Component::Section
+          def self.theme_class = Plutonium::UI::Form::Theme
         end
       end
     end

data/lib/plutonium/ui/form/components/uppy.rb

@@ -54,9 +54,20 @@ module Plutonium
 
           private
 
+          # Previews for what is ALREADY attached.
+          #
+          # A model-backed field holds attachment objects, which answer +url+. An
+          # interaction's field does not: between submit and re-render it holds
+          # whatever the user posted — an ActionDispatch::Http::UploadedFile, or
+          # the token staging replaced it with. Neither answers +url+, and
+          # calling it took the whole form down with a NoMethodError on any
+          # validation failure, including one on an unrelated attribute.
+          #
+          # A value that cannot answer +url+ is not an existing attachment, so
+          # there is nothing here to preview for it.
           def render_existing_attachments
             Array(field.value).each do |attachment|
-              next unless attachment&.url.present?
+              next unless attachment.respond_to?(:url) && attachment.url.present?
 
               render_attachment_preview(attachment)
             end

data/lib/plutonium/ui/form/concerns/renders_nested_resource_fields.rb

@@ -23,11 +23,17 @@ module Plutonium
           class NestedFieldContext
             attr_reader :name, :definition, :options, :permitted_fields
 
-            def initialize(name:, definition:, resource_class:, resource_definition:, object_class:)
+            # @param declared_options [Hash] the nested input's own options, already
+            #   proc-resolved by the form (the context has no form to resolve
+            #   against). Everything merged in below — nested-attribute macro,
+            #   limits — is derived from the model, never authored, so this is the
+            #   only half that can carry a proc.
+            def initialize(name:, definition:, resource_class:, resource_definition:, object_class:, declared_options:)
               @name = name
               @definition = definition
               @resource_definition = resource_definition
               @resource_class = resource_class
+              @declared_options = declared_options
               @options = build_options
               @permitted_fields = build_permitted_fields
               @object_class = object_class
@@ -52,7 +58,7 @@ module Plutonium
             private
 
             def build_options
-              options = @resource_definition.defined_nested_inputs[@name][:options].dup || {}
+              options = @declared_options.dup
               merge_nested_fields_options(options)
               set_nested_fields_limits(options)
               options
@@ -97,12 +103,19 @@ module Plutonium
               return
             end
 
+            # Resolved here rather than in the context: `condition:` above needs the
+            # raw proc (resolve_option_procs deliberately leaves it alone, but it is
+            # also evaluated before this point), and the context has no form to
+            # resolve the rest against.
+            declared_options = resolve_option_procs(nested_input_definition[:options] || {})
+
             context = NestedFieldContext.new(
               name: name,
               definition: build_nested_fields_definition(name),
               resource_class: resource_class,
               resource_definition: resource_definition,
-              object_class: nested_input_definition[:options]&.fetch(:object_class, nil)
+              object_class: declared_options[:object_class],
+              declared_options: declared_options
             )
 
             render_nested_field_container(context) do

data/lib/plutonium/ui/form/concerns/renders_structured_inputs.rb

@@ -15,7 +15,11 @@ module Plutonium
 
           def render_structured_input(name)
             entry = resource_definition.defined_structured_inputs[name]
-            options = entry[:options] || {}
+            # Same proc resolution the inner fields already get (they render
+            # through render_simple_resource_field on this same form), so
+            # `repeat:`/`fields:` can depend on the request — or, on a wizard
+            # step, on the run: the receiver rule is the form's, not ours.
+            options = resolve_option_procs(entry[:options] || {})
             definition = structured_input_fields_definition(entry)
             fields = options[:fields] || definition.defined_inputs.keys
             repeat = options[:repeat]

data/lib/plutonium/ui/form/query.rb

@@ -102,6 +102,7 @@ module Plutonium
             button(
               type: "button",
               class: "pu-btn pu-btn-secondary px-4 py-3 text-base",
+              aria: {expanded: "false"},
               data: {resource_drop_down_target: "trigger"}
             ) do
               render Phlex::TablerIcons::Filter.new(class: "w-4 h-4 inline-block align-text-bottom")
@@ -186,10 +187,7 @@ module Plutonium
           tag = input_options[:as] || field_options[:as]
           tag_attributes = input_options.except(:wrapper, :as)
 
-          tag_block = input_definition[:block] || ->(f) {
-            tag ||= f.inferred_field_component
-            f.send(:"#{tag}_tag", **tag_attributes, class: "w-full")
-          }
+          tag_block = input_definition[:block] || ->(f) { f.component_for(tag, **tag_attributes, class: "w-full") }
 
           field_options = field_options.except(:as)
 

data/lib/plutonium/ui/form/resource.rb

@@ -49,8 +49,20 @@ module Plutonium
           end
         end
 
+        # The form is normally a card (theme :base). When a form_layout is
+        # declared each section becomes a card of its own, so the form must
+        # stop being one — otherwise every section is a card nested inside a
+        # card, doubling borders and padding. The sections' own container
+        # supplies the spacing that :base's padding used to.
+        #
+        # Width comes from configuration rather than the theme (`page_width` /
+        # `form_width` on the definition), so it is appended here. A modal form
+        # gets none of this: the dialog already sets its own width.
         def form_class
-          in_modal? ? "flex-1 flex flex-col min-h-0" : super
+          return "flex-1 flex flex-col min-h-0" if in_modal?
+
+          base = resource_definition.defined_form_layout ? themed(:sectioned_base, nil) : super
+          tokens(base, resource_definition.form_width_classes)
         end
 
         private
@@ -104,7 +116,15 @@ module Plutonium
               resource_fields.each { |name| render_resource_field name }
             }
           else
-            sections.each { |rs| render_form_section(rs) }
+            # Sections live in their own stacking container rather than being
+            # emitted straight into the form body. They are cards in their own
+            # right, and the container is what spaces them; without it they
+            # would also share a parent with the errors block, so any
+            # `:first-child` styling in the section chrome would silently
+            # target the wrong element.
+            div(class: themed(:sections_wrapper, nil)) do
+              sections.each { |rs| render_form_section(rs) }
+            end
           end
         end
 
@@ -132,10 +152,11 @@ module Plutonium
             # section's own `condition:`.
             next if resolved.fields.empty?
 
-            # `columns` stays a validated literal; everything else may be a proc.
-            options = section.options.to_h do |key, value|
-              [key, (key != :condition && value.is_a?(Proc)) ? instance_exec(&value) : value]
-            end
+            # `columns` stays a validated literal (the Builder rejects a non-Integer
+            # at declaration); `label`/`description`/`collapsible`/`collapsed` may be
+            # procs, resolved by the SAME arity rule as a field/input option so
+            # `-> { … }` means one thing across the whole form DSL.
+            options = resolve_option_procs(section.options)
             Plutonium::Definition::FormLayout::ResolvedSection.new(
               section: Plutonium::Definition::FormLayout::Section.new(
                 key: section.key, fields: section.fields, options: options.freeze
@@ -289,6 +310,9 @@ module Plutonium
           input_definition = definition.defined_inputs[name] || {}
           input_options = input_definition[:options] || {}
 
+          field_options = resolve_option_procs(field_options)
+          input_options = resolve_option_procs(input_options)
+
           tag = input_options[:as] || field_options[:as]
 
           # Extract field-level options from input_options and merge into field_options
@@ -298,20 +322,28 @@ module Plutonium
           field_level_options = input_options.slice(*field_level_keys)
           field_options = field_options.merge(field_level_options)
 
-          tag_attributes = input_options.except(:wrapper, :as, :pre_submit, :condition, *field_level_keys)
+          # Staging options are stripped here as well as in Wizard::StepAdapter,
+          # because an interaction's inputs reach this method directly. A
+          # Class-valued `uploader:` is not an HTML attribute and Phlex refuses
+          # it, so leaving it in raises rather than rendering.
+          tag_attributes = input_options.except(
+            :wrapper, :as, :pre_submit, :condition, *field_level_keys,
+            *Plutonium::Attachments::STAGING_ONLY_INPUT_OPTIONS
+          )
           if input_options[:pre_submit]
             tag_attributes["data-action"] = "change->form#preSubmit"
           end
-          tag_block = input_definition[:block] || ->(f) do
-            tag ||= f.inferred_field_component
-            if tag.is_a?(Class)
-              f.send :create_component, tag, tag.name.demodulize.underscore.sub(/component$/, "").to_sym
-            else
-              f.send(:"#{tag}_tag", **tag_attributes)
-            end
-          end
+          tag_block = input_definition[:block] || ->(f) { f.component_for(tag, **tag_attributes) }
 
           # Keep `:as` so the Builder can detect hidden fields via `options[:as]`.
+          # `as:` may be declared on either `field` or `input`, and the tag
+          # lookup above already honours both. Carry the resolved value back
+          # into field_options so the Builder sees it too: without this,
+          # `input :x, as: :hidden` renders a hidden input inside a fully
+          # chromed wrapper, label and all, while `field :x, as: :hidden`
+          # renders correctly. The Builder consumes `:as` before Phlexi sees
+          # the options, so this cannot leak into a Phlexi field option.
+          field_options = field_options.merge(as: tag) if tag
           field_options = field_options.except(:condition)
 
           condition = input_options[:condition] || field_options[:condition]
@@ -346,6 +378,51 @@ module Plutonium
           end
         end
 
+        # Resolve proc-valued options for THIS render, so any option can vary per
+        # request rather than being frozen when the class loads. One rule for the
+        # whole form DSL: `field`/`input`, `section`/`ungrouped`, `structured_input`
+        # and nested inputs all route through here.
+        #
+        # Arity says whether you want the form, NOT which `self` you get:
+        #
+        #   -> { … }       a plain call — means what it reads like where it was
+        #                  written, closure and all
+        #   ->(form) { … } handed this form, for `object`/`params`/helpers
+        #
+        # This is `choices:`'s rule, adopted rather than replaced. Phlexi has
+        # always resolved a `choices:` proc with a plain `.call`, so it is both
+        # the oldest of these semantics and the only one that predates Plutonium's
+        # own option layer — and it is the unsurprising one: nothing silently
+        # rebinds `self` out from under a lambda. `section :x, collapsed: -> { … }`
+        # (v0.60) followed the other convention and was migrated to `->(form)` to
+        # meet it here.
+        #
+        # Form::Wizard overrides the zero-arity case, because a step block is
+        # instance_exec'd against a throwaway recorder — the closure there holds
+        # nothing, so the wizard takes its place.
+        #
+        # `condition:` is excluded because it is a different kind of thing, not
+        # because it is an awkward leftover. An option asks "what value should
+        # this have?" and may not care about the render; `condition:` asks
+        # "should this render here, now?", which is a question about the render
+        # context by definition. So it is evaluated separately, always AGAINST
+        # its context — and that context is not always a form (a `column`'s is the
+        # table, a step's is the wizard, an action's is a ConditionContext), which
+        # is why it cannot take a `form` argument the way an option does.
+        # Resolving it here would also collapse it to a boolean before the render
+        # site that owns it gets to ask.
+        def resolve_option_procs(options)
+          return options if options.blank?
+
+          options.to_h do |key, value|
+            [key, resolvable_proc?(key, value) ? call_option_proc(value) : value]
+          end
+        end
+
+        def resolvable_proc?(key, value) = key != :condition && value.is_a?(Proc)
+
+        def call_option_proc(value) = value.arity.zero? ? value.call : value.call(self)
+
         def when_permitted(name, &)
           return unless resource_fields.include? name
 

data/lib/plutonium/ui/form/theme.rb

@@ -7,8 +7,25 @@ module Plutonium
         def self.theme
           super.merge({
             # Form structure
+            # Width is NOT baked in here — it is configuration, not theme
+            # (`page_width` / `form_width` on the definition, defaulting to
+            # `Plutonium.configuration.default_page_width`), so Form::Resource
+            # appends it. Overriding these keys therefore restyles the form
+            # without silently pinning its width.
             base: "pu-card my-4 p-8 space-y-8",
+            # :base for a form whose sections are cards — no card, no padding
+            # of its own, since the section cards provide both.
+            sectioned_base: "my-4 space-y-4",
             fields_wrapper: "grid grid-cols-1 md:grid-cols-2 2xl:grid-cols-4 gap-6 grid-flow-row-dense",
+
+            # Sections are their OWN cards (see Component::Section), so this
+            # only has to stack them.
+            sections_wrapper: "space-y-4",
+
+            # Section chrome (heading, accent, divider, collapsible caret).
+            # Shared defaults with the show page so both read the same;
+            # override any key here to restyle form sections alone.
+            **Plutonium::UI::Component::Section::DEFAULT_THEME,
             actions_wrapper: "flex justify-end gap-3 pt-4 border-t border-[var(--pu-border-muted)]",
             wrapper: nil,
             inner_wrapper: "w-full",

data/lib/plutonium/ui/form/wizard.rb

@@ -16,8 +16,13 @@ module Plutonium
         # @param action  [String] the current step's POST URL.
         # @param fields  [Array<Symbol>] the step's renderable field names
         #   (scalar attributes + structured inputs).
-        def initialize(step:, data:, action:, fields:, **options, &)
+        # @param wizard  [Plutonium::Wizard::Base] the run being rendered. Exposed
+        #   as `form.wizard` so a step's proc-valued option can reach the run —
+        #   see {#wizard}. Required: it is read during render, so defaulting it to
+        #   nil would only defer the failure to a NoMethodError inside a proc.
+        def initialize(step:, data:, action:, fields:, wizard:, **options, &)
           @step = step
+          @wizard = wizard
           options[:key] = :wizard
           options[:as] = :wizard
           options[:action] = action
@@ -27,6 +32,25 @@ module Plutonium
           super(data, **options, &)
         end
 
+        # The run being rendered. Public because a step's proc-valued option is
+        # how an option depends on the run, and reaching the run is the whole
+        # point:
+        #
+        #   input :tier, as: :select,
+        #     choices: ->(form) { form.wizard.anchor.available_tiers }
+        #
+        # Deliberately NOT reached by rebinding a zero-arity proc to the wizard.
+        # A step block is instance_exec'd against a FieldCapture at class load,
+        # so its closure holds nothing useful — but that is equally true of a
+        # `form_layout` block and its Builder, and the answer there is to ask for
+        # the receiver rather than have it swapped in silently. Same answer here:
+        # `-> { … }` means what it reads like wherever it is written, and an
+        # `input` line moved between a definition and a step keeps its meaning.
+        #
+        # `form.object`, alongside this, is the step's staged data.
+        # @return [Plutonium::Wizard::Base]
+        attr_reader :wizard
+
         private
 
         attr_reader :step

data/lib/plutonium/ui/grid/card.rb

@@ -10,11 +10,22 @@ module Plutonium
       class Card < Plutonium::UI::Component::Base
         attr_reader :record, :resource_definition, :resource_fields, :card_fields
 
-        def initialize(record, resource_definition:, resource_fields: nil, card_fields: nil, show_turbo_frame: nil)
+        def initialize(record, resource_definition:, resource_fields: nil, card_fields: nil, show_turbo_frame: nil, drag_handle: nil, position_group: nil)
           @record = record
+          # Which positioning group this card belongs to, for a scoped resource;
+          # nil when unscoped. Same rationale as the table's row attribute — the
+          # drag refuses a drop across groups (see Positionable).
+          @position_group = position_group
           @resource_definition = resource_definition
           @resource_fields = resource_fields
           @card_fields = card_fields
+          # A prebuilt Table::Components::DragHandle, or nil for a card that is
+          # not reorderable. The GRID owns the decision — whether the resource
+          # declares `position_on`, whether the collection is in position order,
+          # whether this viewer passes `reposition?` — because all three are
+          # properties of the collection and its policy, not of one card. The
+          # card only knows where to put what it was handed.
+          @drag_handle = drag_handle
           # Overrides the show link's turbo-frame target. Defaults to the show
           # action's own frame (nil → normal navigation). The kanban board sets
           # "_top" so a card click escapes its column's lazy turbo-frame instead
@@ -23,11 +34,9 @@ module Plutonium
         end
 
         def view_template
-          article(
-            class: card_class,
-            data: {controller: "row-click", action: "click->row-click#click auxclick->row-click#click"}
-          ) do
+          article(class: card_class, data: card_data) do
             render_show_link if can_show?
+            render_drag_handle if @drag_handle
             render_actions_dropdown
             case resource_definition.defined_grid_layout
             when :media then render_media_layout
@@ -76,8 +85,16 @@ module Plutonium
         # Footer falls back to `:created_at` when the slot is unset and
         # the record has a created_at column. Gives cards a sensible
         # second line without forcing every grid_fields call to repeat it.
+        #
+        # That fallback means omitting the slot does NOT remove the footer —
+        # unlike every other slot, whose `if slots[:x]` guard collapses it. Pass
+        # `footer: false` to opt out. nil still means "unset" so a slot hash built
+        # from a nil variable keeps falling back rather than silently losing it.
         def footer_field
-          slots[:footer] || (record.respond_to?(:created_at) ? :created_at : nil)
+          footer = slots[:footer]
+          return nil if footer == false
+
+          footer || (record.respond_to?(:created_at) ? :created_at : nil)
         end
 
         # ---------------------------------------------------------------
@@ -219,6 +236,16 @@ module Plutonium
         # Card chrome — selection, actions, show
         # ---------------------------------------------------------------
 
+        # The grip positions itself (Table::Theme's :drag_handle_card floats it
+        # over the card's top-left corner), so there is no wrapper here — unlike
+        # the table, where the grip has to ride inside a specific cell.
+        #
+        # It is a <button> — or an <a> when disabled — and row_click_controller
+        # ignores both, so grabbing the grip never navigates to the show page.
+        def render_drag_handle
+          render @drag_handle
+        end
+
         def render_actions_dropdown
           # Cards have limited surface area, so all collection-record
           # actions (including primary ones like Edit) live in the
@@ -236,20 +263,42 @@ module Plutonium
         # action button works in the Table view.
         def render_show_link
           show = resource_definition.defined_actions[:show]
-          url = route_options_to_url(show.route_options, record)
-          a(
+          url = merge_query_params(route_options_to_url(show.route_options, record), show_link_url_params)
+          a(**show.link_attributes({
             href: url,
             data: {row_click_target: "show", turbo_frame: @show_turbo_frame || show.turbo_frame(resource_definition)},
             class: "sr-only",
             tabindex: "-1",
             "aria-label": "Open #{header_text}"
-          ) { plain "Open" }
+          })) { plain "Open" }
         end
 
         # ---------------------------------------------------------------
         # Helpers
         # ---------------------------------------------------------------
 
+        # Extra query params for the show link. A kanban card on a show_in :modal
+        # board is the only case a Grid::Card is handed the remote-modal frame
+        # explicitly (the grid/table reach that frame via the show action's own
+        # default, leaving @show_turbo_frame nil). Since a regular modal show and
+        # a kanban card's modal share the frame, tag the kanban one so the show
+        # page's in_kanban_modal? can tell them apart and drop the metadata rail.
+        def show_link_url_params
+          {Plutonium::KANBAN_MODAL_PARAM => "1"} if @show_turbo_frame == Plutonium::REMOTE_MODAL_FRAME
+        end
+
+        # Merges extra query params into a URL, preserving any the base URL
+        # already carries (e.g. a nested resource's parent id). Returns the URL
+        # unchanged when there's nothing to add.
+        def merge_query_params(url, extra)
+          return url if extra.blank?
+
+          uri = URI.parse(url)
+          merged = Rack::Utils.parse_nested_query(uri.query).merge(extra.stringify_keys)
+          uri.query = merged.to_query.presence
+          uri.to_s
+        end
+
         def header_text
           @header_text ||= helpers.display_name_of(field_value(slots[:header]) || record)
         end
@@ -270,7 +319,7 @@ module Plutonium
 
         def row_actions
           @row_actions ||= resource_definition.defined_actions.values.select { |a|
-            a.collection_record_action? && !a.kanban_drop? && a.permitted_by?(record_policy) && a.condition_met?(view_context, record:)
+            a.collection_record_action? && !a.hidden? && a.permitted_by?(record_policy) && a.condition_met?(view_context, record:)
           }
         end
 
@@ -286,9 +335,28 @@ module Plutonium
         def card_class
           tokens(
             "pu-card relative overflow-hidden transition-shadow",
-            -> { can_show? } => "cursor-pointer hover:shadow-md focus-within:ring-2 focus-within:ring-primary-500"
+            -> { can_show? } => "cursor-pointer hover:shadow-md focus-within:ring-2 focus-within:ring-primary-500",
+            # `group/card` is what lets the grip reveal itself on card hover.
+            # NAMED, so a card rendered inside some other hover group (or a
+            # future group inside the card) can never reveal it by accident.
+            -> { !@drag_handle.nil? } => "group/card"
           )
         end
+
+        # The card — never the grip — is the single source of truth for which
+        # record a drag is about. See positioned_controller.js.
+        #
+        # Carried whenever a grip is rendered, including the disabled one: with
+        # no controller wired to the grid the attribute is inert, and making it
+        # conditional on the sort would mean the card had to know about the
+        # collection's ordering for no gain.
+        def card_data
+          data = {controller: "row-click", action: "click->row-click#click auxclick->row-click#click"}
+          return data unless @drag_handle
+
+          data = data.merge(positioned_row_id: record.id)
+          @position_group.nil? ? data : data.merge(positioned_group: @position_group)
+        end
       end
     end
   end