plutonium 0.63.0 → 0.65.0

data/docs/reference/index.md

@@ -12,9 +12,11 @@ aside: false
   :rail="[
     { group: 'App', items: [
       { name: 'Overview', link: '/plutonium-core/reference/app/' },
+      { name: 'Configuration', link: '/plutonium-core/reference/configuration' },
       { name: 'Packages', link: '/plutonium-core/reference/app/packages' },
       { name: 'Portals', link: '/plutonium-core/reference/app/portals' },
       { name: 'Generators', link: '/plutonium-core/reference/app/generators' },
+      { name: 'Lite (SQLite) generators', link: '/plutonium-core/reference/generators/lite' },
     ]},
     { group: 'Resource', items: [
       { name: 'Overview', link: '/plutonium-core/reference/resource/' },
@@ -22,13 +24,15 @@ aside: false
       { name: 'Definition', link: '/plutonium-core/reference/resource/definition' },
       { name: 'Query', link: '/plutonium-core/reference/resource/query' },
       { name: 'Actions', link: '/plutonium-core/reference/resource/actions' },
-      { name: 'Positioning', link: '/plutonium-core/reference/positioning' },
+      { name: 'Positioning', link: '/plutonium-core/reference/resource/positioning' },
+      { name: 'CSV Export', link: '/plutonium-core/reference/resource/export' },
     ]},
     { group: 'Behavior', items: [
       { name: 'Overview', link: '/plutonium-core/reference/behavior/' },
       { name: 'Controllers', link: '/plutonium-core/reference/behavior/controllers' },
       { name: 'Policies', link: '/plutonium-core/reference/behavior/policies' },
       { name: 'Interactions', link: '/plutonium-core/reference/behavior/interactions' },
+      { name: 'Async interactions', link: '/plutonium-core/reference/behavior/async-interactions' },
     ]},
     { group: 'UI', items: [
       { name: 'Overview', link: '/plutonium-core/reference/ui/' },
@@ -65,6 +69,11 @@ aside: false
       { name: 'Positioning', link: '/plutonium-core/reference/kanban/positioning' },
       { name: 'Authorization', link: '/plutonium-core/reference/kanban/authorization' },
     ]},
+    { group: 'Dashboard', items: [
+      { name: 'Overview', link: '/plutonium-core/reference/dashboard/' },
+      { name: 'DSL', link: '/plutonium-core/reference/dashboard/dsl' },
+      { name: 'Registration', link: '/plutonium-core/reference/dashboard/registration' },
+    ]},
     { group: 'Testing', items: [
       { name: 'Overview', link: '/plutonium-core/reference/testing/' },
     ]},

data/docs/reference/kanban/dsl.md

@@ -49,7 +49,7 @@ Default: `nil` (unlimited).
 
 Controls how card positions are persisted after a drag-and-drop. Three modes:
 
-**Inherited from the definition.** `position_on` is the same verb outside `kanban do…end`, where it makes the resource's [table and grid drag-reorderable](/reference/positioning). A board with no `position_on` of its own uses the **definition's**, falling back to the historic default (`:position`, Mode A). Declaring it inside the board overrides that. Resolution is lazy, so declaration order in the class body does not matter.
+**Inherited from the definition.** `position_on` is the same verb outside `kanban do…end`, where it makes the resource's [table and grid drag-reorderable](/reference/resource/positioning). A board with no `position_on` of its own uses the **definition's**, falling back to the historic default (`:position`, Mode A). Declaring it inside the board overrides that. Resolution is lazy, so declaration order in the class body does not matter.
 
 #### Mode A — delegate to `Plutonium::Positioning::Model` (default)
 

data/docs/reference/kanban/positioning.md

@@ -1,7 +1,7 @@
 # Kanban Positioning
 
 ::: tip Positioning is not kanban-only
-The model concern, the arithmetic and the `position_on` modes on this page are shared with **table and grid drag-to-reorder** — see [Positioning & drag-to-reorder](/reference/positioning) for the index-surface half of the feature (the grip, the `reposition` endpoint, `reposition?`, and board inheritance).
+The model concern, the arithmetic and the `position_on` modes on this page are shared with **table and grid drag-to-reorder** — see [Positioning & drag-to-reorder](/reference/resource/positioning) for the index-surface half of the feature (the grip, the `reposition` endpoint, `reposition?`, and board inheritance).
 :::
 
 Plutonium uses **decimal fractional positioning** for kanban card ordering. A drop writes a single decimal position (the midpoint between its neighbors), so the common case touches exactly one row — no bulk renumbering. The one exception is rare **rebalancing**: when the same slot has been subdivided ~20 times and the gap between two neighbors shrinks below `1e-6`, Plutonium renumbers that one scope group back to clean integers before inserting (see [Gap exhaustion](#rebalancing)).
@@ -152,7 +152,7 @@ end
 
 Plutonium orders the column by `sort_order` for display; your block is responsible only for persisting the new value. The block is called with a single `Plutonium::Positioning::Move` argument (still reachable under its original name, `Plutonium::Kanban::Positioning::Move`) — it is NOT `instance_exec`'d, so `self` is the proc's original binding.
 
-On a table or grid the same block runs with `move.column` set to `nil`, since those surfaces have no columns. See [Mode B](/reference/positioning#mode-b) for a worked `acts_as_list` example.
+On a table or grid the same block runs with `move.column` set to `nil`, since those surfaces have no columns. See [Mode B](/reference/resource/positioning#mode-b) for a worked `acts_as_list` example.
 
 ### Mode C — disabled
 

data/docs/reference/resource/actions.md

@@ -181,7 +181,7 @@ An action declared `hidden: true` renders in **no** toolbar, row dropdown, card,
 action :reposition, hidden: true
 ```
 
-The use case is an endpoint reached by **something other than a button** — a drag gesture, a custom Stimulus controller, a client-side widget you wrote yourself. The framework uses it for exactly that: [`position_on`](/reference/positioning) expands to `action :reposition, hidden: true`, and the kanban board's drop endpoint is declared the same way.
+The use case is an endpoint reached by **something other than a button** — a drag gesture, a custom Stimulus controller, a client-side widget you wrote yourself. The framework uses it for exactly that: [`position_on`](/reference/resource/positioning) expands to `action :reposition, hidden: true`, and the kanban board's drop endpoint is declared the same way.
 
 ### `hidden:` vs `condition: -> { false }`
 

data/docs/reference/resource/definition.md

@@ -159,6 +159,8 @@ input :title,
   wrapper: {class: "col-span-full"}
 ```
 
+Label, hint, placeholder and description need no declaration to be translatable: leave them out and Plutonium looks them up under `activerecord.attributes` and `plutonium.fields.<model>.<attr>` respectively. An explicit value can be a translation too, via the class-level `t`. See [Internationalization](../i18n#fields-placeholder-hint-description).
+
 ## Select / choices
 
 ### Static
@@ -196,6 +198,13 @@ display :rejection_reason, condition: -> { object.rejected? }
 field   :debug_info,       condition: -> { Rails.env.development? }
 ```
 
+A surface's own `condition:` wins. Otherwise the form, the show page and the table
+each fall back to the `field` condition, so it runs everywhere. The table has no
+`object`, which means a `field` condition must not reference the record:
+`-> { object.published? }` works on the form and show page and raises on the index.
+Keep a `field` condition to context that exists on every surface (`Rails.env`, a
+feature flag, `current_user`) and put record checks on `input`, `display` or `column`.
+
 ::: warning UI state, not authorization
 `condition:` is for UI logic ("show this when published"). For "who can see this", use the policy's `permitted_attributes_for_*` — see [Behavior › Policy](/reference/behavior/policies).
 :::
@@ -293,24 +302,41 @@ input :birth_date do |f|
 end
 ```
 
-### `phlexi_render` for declarative custom display
+### Inline markup in a display
 
-`as: :phlexi_render` (or its shorthand `as: :phlexi`). `with:` takes either a Phlex component class OR a proc whose body is **rendered inside a Phlex context** — HTML tag methods (`span`, `div`, `a`) and Tailwind classes are first-class. The proc receives `(value, attrs)`.
+A `display` block is evaluated in the display component's Phlex context, so HTML tag
+methods (`span`, `div`, `a`) and Tailwind classes are first-class, and `field.object`
+is the record. It renders once, even for a `has_many` field.
 
 ```ruby
-# Component — preferred for anything reusable
-display :status, as: :phlexi_render, with: StatusBadgeComponent
+display :priority do |field|
+  variant = {"high" => "danger", "medium" => "warning"}.fetch(field.value.to_s, "info")
+  span(class: "pu-badge pu-badge-#{variant}") { field.value.to_s.humanize }
+end
 
-# Inline proc — `span` here is a Phlex tag method, not a Rails helper
-display :priority, as: :phlexi_render, with: ->(value, attrs) {
-  case value
-  when 'high'   then span(class: "badge badge-danger")  { "High" }
-  when 'medium' then span(class: "badge badge-warning") { "Medium" }
-  else span(class: "badge badge-info") { "Low" }
+# Reaches the record; renders once for a collection
+display :tags do |field|
+  div(class: "flex flex-wrap gap-1.5") do
+    field.object.tags.each { |tag| span(class: "pu-badge") { tag.name } }
   end
-}
+end
 ```
 
+Phlex also renders whatever the block returns, so a block that emits markup must end
+with a tag call (or `nil`). The `div` wrapper above does that. A bare
+`tags.each { span … }` as the last line returns the collection, which renders a
+second time as text.
+
+::: warning `as: :phlexi_render` is deprecated
+`display :x, as: :phlexi_render, with: ...` emits a deprecation warning and will be
+removed. Use the block form above instead. The old `with:` proc did not run in a
+Phlex context (its `self` was the definition, so `span`/`div` in the body raised), it
+received the value already stringified so it could not reach the record, and it fired
+once per element for a `has_many` field. The block form has none of those limits. This
+deprecation applies only to the `as: :phlexi_render` display option; the internal
+`phlexi_render` helper is unaffected.
+:::
+
 See [UI › Components](/reference/ui/components) for writing reusable Phlex components.
 
 ### Custom component class
@@ -338,27 +364,65 @@ See [UI › Components › Field components](/reference/ui/components#field-comp
 
 ## Column options
 
+`align:` and `label:` configure the column header. They can be declared on `field`,
+`display` or `column`; the most specific wins.
+
 ```ruby
+field  :amount, align: :end      # every surface that has a notion of alignment
 column :title,  align: :start    # default
 column :status, align: :center
-column :amount, align: :end
+column :amount, label: "Total"
+```
+
+### What a column inherits from the display
+
+With no `column` declared, the table column renders exactly as the display does: the
+display's `as:` and its attributes flow to the cell, so `display :status, as: :badge,
+colors: {…}` colors the badge on the show page and in the table.
+
+A `column` that only touches the header (`align:`, `label:`, `condition:`) keeps that
+inheritance. A `column` that says anything about rendering (an `as:`, a component
+attribute, or a block) renders alone: its own `as:` and attributes, nothing from the
+display.
+
+A `condition:` on `field` or `column` hides the column. A `condition:` on `display`
+applies to the show page only, because it may reference the record and the table has
+no single one.
+
+```ruby
+display :status, as: :badge, colors: {published: :accent}
+column  :status, align: :center                  # still a badge, still colored
+column  :status, as: :badge                      # a badge, but with default colors
+column  :status, formatter: ->(v) { v.upcase }   # plain text; the display is out
 ```
 
 ### Value formatting
 
 `formatter:` receives just the value. Use a block when you need the full record.
+A column block runs in the table page's Phlex context, the same way a display block
+runs in the show page's: it can emit markup directly, or return a String, a number
+or a component. `self` is the table page, so `current_user`, `helpers` and
+`resource_definition` are available, but methods defined on the definition class are
+not; reach through the record you are passed instead.
 
 ```ruby
 column :description, formatter: ->(value) { value&.truncate(30) }
 column :price,       formatter: ->(value) { "$%.2f" % value if value }
-column :status,      formatter: ->(value) { value&.humanize&.upcase }
 
-# Block — full record access
+# Block with full record access: emit markup...
+column :status do |record|
+  span(class: "pu-badge") { record.status.humanize }
+end
+
+# ...or return a String
 column :full_name do |record|
   "#{record.first_name} #{record.last_name}"
 end
 ```
 
+As with display blocks, a block that emits markup must end with a tag call (or
+`nil`), because Phlex renders the return value too.
+
 ## Nested inputs
 
 Inline forms for associated records. Requires `accepts_nested_attributes_for` on the model.
@@ -580,11 +644,25 @@ Section options previously took a **zero-argument** proc evaluated against the f
 It fails loudly, never silently. `condition:` is unchanged — it is still evaluated against the form and still reads `object` with no argument.
 :::
 
-A section that resolves to **zero fields** — every declared field filtered out by the permitted set, or no field assigned — renders nothing at all (no heading, no grid). This keeps forms clean when fewer attributes are permitted than declared (notably `+ New`, where the create policy often permits a subset). The check is purely "are there fields to render"; it does **not** evaluate per-field `condition:` procs (those run later, at field render). So if you want a whole section to appear only under some state, gate it with the section's own `condition:` rather than relying on every field inside it being hidden:
+A section that resolves to **zero fields** — every declared field filtered out by the permitted set, or no field assigned — renders nothing at all (no heading, no grid). This keeps forms clean when fewer attributes are permitted than declared (notably `+ New`, where the create policy often permits a subset).
+
+The same goes for a section whose fields are **all hidden by their own `condition:`** on this render: it disappears with them instead of leaving an empty heading behind. The hidden fields are still recorded on the form, just as a hidden field in a visible section is. So fields that only apply to some records — re-evaluated on `pre_submit` — can be grouped in a section without any extra wiring:
+
+```ruby
+form_layout do
+  section :timing, :duration, :starts_on, label: "Timing"   # gone when both are hidden
+end
+
+input :employment_type, as: :select, pre_submit: true, choices: %w[full_time contract]
+input :duration, condition: -> { object.contract? }
+input :starts_on, condition: -> { object.contract? }
+```
+
+A section's own `condition:` still hides it as a unit, whatever its fields say:
 
 ```ruby
 section :shipping, :address, :city, :postcode,
-  condition: -> { object.requires_shipping? }   # hide the section as a unit
+  condition: -> { object.requires_shipping? }
 ```
 
 ### `ungrouped(**opts)`
@@ -664,7 +742,7 @@ end
 
 ## Display layout
 
-The show page's counterpart to [`form_layout`](#form-layout). Same DSL and the same resolution rules — first-section-wins ownership, unlisted permitted fields collected into `ungrouped`, absent fields skipped, zero-field sections dropped entirely — applied to the show page instead of the form.
+The show page's counterpart to [`form_layout`](#form-layout). Same DSL and the same resolution rules — first-section-wins ownership, unlisted permitted fields collected into `ungrouped`, absent fields skipped, zero-field sections and sections whose fields are all condition-hidden dropped entirely — applied to the show page instead of the form.
 
 ```ruby
 class PostDefinition < ResourceDefinition
@@ -770,7 +848,7 @@ All three inherit to subclasses, so a portal-specific definition keeps its paren
 
 - **Modals are unaffected** — a dialog sizes itself via `modal_size`.
 - **Interactions** (`Plutonium::Interaction::Base`) support the same settings, for interactive actions rendered as standalone pages.
-- **Wizards are configured separately**, via `Plutonium.configuration.wizards.width`. It defaults to `default_page_width`, so a wizard step carrying a `form_layout` renders those sections at the same width the identical sections get on a resource form.
+- **Wizards are configured separately**, via `Plutonium.configuration.wizards.width`. It defaults to `:md` independently of `default_page_width`, so widening resource pages leaves wizard steps where they are. Set both if you want them to match.
 
 ## File uploads
 

data/docs/reference/resource/export.md

@@ -90,5 +90,9 @@ For a column **without** an `export` block, the value is read straight off the r
   intercepting the streamed download.
 - **CSV/formula injection** is neutralized: any cell whose value begins with `=`, `+`,
   `-`, `@`, or a leading tab/CR is prefixed with a single quote so spreadsheet apps import
-  it as literal text instead of executing it as a formula.
+  it as literal text instead of executing it as a formula. The check is run against the
+  NFKC-normalized value, so full-width (double-byte) variants (`＝`, `＋`, `－`, `＠`) that
+  East Asian locales treat as formula initiators are neutralized too; the original
+  (un-normalized) value is what gets the quote prefix, so legitimate full-width content
+  is preserved verbatim.
 - `csv` is a runtime dependency of Plutonium (it is no longer a Ruby default gem on 3.4+).

data/docs/reference/resource/index.md

@@ -42,6 +42,8 @@ A `field :title` with no options that matches what Plutonium would auto-detect i
 - [Definition](./definition) — fields, inputs, displays, columns, page chrome, metadata panel, index views
 - [Query](./query) — search, filters, scopes, sorting
 - [Actions](./actions) — custom actions, bulk actions, interaction integration
+- [Positioning & drag-to-reorder](./positioning) — `positioned_on`, `position_on`, the drag grip, `reposition?`
+- [CSV Export](./export) — streamed export, opt-in through the policy
 
 ## Related
 

data/docs/reference/{positioning.md → resource/positioning.md}

@@ -469,7 +469,8 @@ The client moves the row **optimistically**, so the response is deliberately qui
 |---|---|
 | Clean Mode A drop, both neighbours resolved | `204 No Content` — nothing repaints |
 | `reposition!` had to rebalance the group | `200` + turbo-stream of the collection |
-| A neighbour did not resolve, or belongs to another positioning group | `200` + stream |
+| A neighbour did not resolve, or belongs to another positioning group, but the other one anchored the drop | `200` + stream — the record **did** move, so there is nothing to explain |
+| Both neighbours rejected | `200` + stream, **no write** — plus a toast when the cause was a foreign group rather than transient drift |
 | Mode B (opaque block write) | `200` + stream |
 | `reposition?` denied | `403` + stream + toast (the row snaps back) |
 | `index?` denied | `403`, **no body** — you may not see the list, so the refusal must not carry it to you |

data/docs/reference/resource/query.md

@@ -84,6 +84,8 @@ For large tables, write an explicit `search` block backed by a trigram or full-t
 
 Six built-in filter types. Use the shorthand symbol or the full class name.
 
+`search`, `scope`, `sort_fields`, and `sort_directions` are reserved filter names — they're built-in controls in the `q[<name>]` namespace, so `filter :scope` raises `ArgumentError`.
+
 | Type | Symbol | Params in URL | Options |
 |---|---|---|---|
 | Text | `:text` | `query` | `predicate:` |

data/docs/reference/ui/assets.md

@@ -38,6 +38,14 @@ This:
 4. Registers Plutonium's Stimulus controllers.
 5. Updates Plutonium config to point at your asset files.
 
+### Package managers
+
+The generator installs with the package manager `rails javascript:build` will use. The lockfile decides: `bun.lock` or `bun.lockb` means bun, `pnpm-lock.yaml` pnpm, `package-lock.json` npm, `yarn.lock` yarn. With no lockfile, `bun.config.js` means bun, and otherwise the first of bun, yarn, pnpm or npm found on PATH wins (yarn if none is). That is why `rails new -j esbuild` on a machine with bun installed produces a bun app. When the app's jsbundling-rails provides `Jsbundling::PackageManager` (its `main` branch, not yet in a release as of 1.3.1), the generator defers to it instead; that detector ignores `yarn.lock` and picks by PATH. Every package goes through one `add` with versions inline (`tailwindcss@latest`, `@radioactive-labs/plutonium@^<gem version>`), which yarn 1, yarn 2+, bun, npm and pnpm all understand.
+
+Yarn 2+ apps get `nodeLinker: node-modules` written to `.yarnrc.yml` if no linker is set. Tailwind's PostCSS plugin does not load under Plug'n'Play.
+
+`pu:core:update` and `pu:docker:install` use the same detection, so the Dockerfile installs bun, yarn 1, or yarn 2+ via corepack to match the app.
+
 ## Tailwind config
 
 Generated `tailwind.config.js`:

data/docs/reference/ui/displays.md

@@ -53,14 +53,11 @@ class PostDefinition < ResourceDefinition
     StatusBadgeComponent.new(value: field.value, class: field.dom.css_class)
   end
 
-  # phlexi_render — proc whose body is rendered inside a Phlex context
-  display :priority, as: :phlexi_render, with: ->(value, attrs) {
-    case value
-    when 'high'   then span(class: "badge badge-danger")  { "High" }
-    when 'medium' then span(class: "badge badge-warning") { "Medium" }
-    else span(class: "badge badge-info") { "Low" }
-    end
-  }
+  # Block that emits markup directly (evaluated in the display's Phlex context)
+  display :priority do |field|
+    variant = {"high" => "danger", "medium" => "warning"}.fetch(field.value.to_s, "info")
+    span(class: "pu-badge pu-badge-#{variant}") { field.value.to_s.humanize }
+  end
 
   # Field component class — built as ChartComponent.new(field, **attributes),
   # so it subclasses Phlexi::Display::Components::Base and reads `field`.

data/docs/reference/ui/index.md

@@ -6,7 +6,7 @@ Plutonium uses [Phlex](https://www.phlex.fun/) for all view components and Tailw
 
 - [Pages](./pages) — `IndexPage`, `ShowPage`, `NewPage`, `EditPage`, render hooks, custom ERB views, context detection
 - [Forms](./forms) — `Form` class, field builder, association inputs (typeahead + inline add), themes
-- [Displays](./displays) — `Display` class, custom rendering, `phlexi_render`
+- [Displays](./displays) — `Display` class, custom rendering, block-form displays
 - [Tables](./tables) — `Table` class, custom rendering, search/scopes bar
 - [Components](./components) — built-in component kit, custom Phlex components, `DynaFrameContent` pattern, modals & tabs
 - [Layouts](./layouts) — shell config, ejecting chrome, custom `ResourceLayout` class

data/docs/reference/wizard/dsl.md

@@ -30,7 +30,7 @@ For task-oriented walkthroughs, start with the [Wizards guide](/guides/wizards).
 | `one_time` | Retain the completed row at the `concurrency_key` (blocks restart, gate-able). **Requires a `concurrency_key`.** Omit → row deleted on completion (repeatable). See [One-time wizards](/reference/wizard/one-time). |
 | `completed do \|wizard\| … end` | Custom body for the "already completed" page a finished **one-time** wizard shows when re-opened (replaces the default confirmation). See [`completed`](#completed) below and [One-time wizards](/reference/wizard/one-time#re-opening-a-completed-wizard). |
 | `encrypt_data` | Encrypt the staged `data` column at rest using ActiveRecord's encryption keys (off by default), for flows that stage PII. Requires `active_record.encryption` keys — see [Storage & config](/reference/wizard/storage-config#encryption). |
-| `width <size>` | Width of this wizard's step pages: `:sm` `:md` `:lg` `:xl` `:full`. Unset inherits `config.wizards.width` (default `:md`). Deliberately independent of `config.default_page_width` — see [Storage & config](/reference/wizard/storage-config). |
+| `width <size>` | Width of this wizard's step pages: `:sm` `:md` `:lg` `:xl` `:full`. Inherits to subclasses; otherwise `config.wizards.width` (default `:md`). Deliberately independent of `config.default_page_width` — see [Storage & config](/reference/wizard/storage-config). |
 | `anonymous` | Opt into **guest (unauthenticated) access** — the wizard runs pre-login (auth is required otherwise). The guest's identity is a server-minted run-id in the Rails session; it crosses the auth boundary only at its terminal `execute`. Mount it `public: true` (the default for `anonymous`). **Mutually exclusive with `concurrency_key`/`one_time`** — a guest is already session-keyed and repeatable, so declaring both raises (whichever is declared last). See [Authentication](/reference/wizard/anchoring-resume#authentication). |
 
 ```ruby
@@ -235,7 +235,7 @@ What it renders depends on completion state and the `summary:` / block options:
 | `summary:` | Show the auto-summary of completed steps (default `true`). When `false`, the complete-state body is your block — or the built-in "ready to complete" panel if there's no block. The summary always renders in the incomplete state. |
 | `header:` | Show the step-header section (the label plus the "check everything over" prompt, which only appears when the summary is shown) above the body (default `true`). `false` drops it for a chromeless finish. |
 
-The auto-summary renders each field through the display pipeline, honoring the input's declared `as:`/`label:`:
+The auto-summary renders each field through the display pipeline, honoring the input's declared `as:`/`label:`. An input hidden by its own `condition:` is left out, just as it was left off the step, so the summary never shows an empty row for a question the user wasn't asked:
 
 - a **choice input** (`select`/`radio_buttons` with `choices:`) resolves the stored value back to its label (`"pro"` → `"Pro"`) using the same choice mapper the form uses, so the recap matches what the user picked;
 - an **`as: :currency`** input formats the value as currency (`"1500.5"` → `"$1,500.50"`) rather than echoing a bare decimal — pass `unit:` on the input (the data snapshot has no `has_cents` reflection to infer it from).

data/esbuild.config.js

@@ -6,7 +6,8 @@ if (process.argv.includes("--dev")) {
   _context({
     outdir: "src/build",
     entryPoints: [
-      "src/js/plutonium.js"
+      "src/js/plutonium.js",
+      "src/js/plutonium-charts.js"
     ],
     plugins: [
       manifestPlugin({
@@ -24,6 +25,7 @@ else {
       outdir: "src/dist/js",
       entryPoints: [
         "src/js/plutonium.js",
+        "src/js/plutonium-charts.js"
       ],
       minify,
       sourcemap: true,
@@ -34,7 +36,8 @@ else {
     _build({
       outdir: "app/assets",
       entryPoints: [
-        "src/js/plutonium.js"
+        "src/js/plutonium.js",
+        "src/js/plutonium-charts.js"
       ],
       minify,
       sourcemap: true,

data/gemfiles/rails_7.gemfile.lock

@@ -1,11 +1,11 @@
 PATH
   remote: ..
   specs:
-    plutonium (0.62.2)
+    plutonium (0.64.0)
       action_policy (~> 0.7.0)
       csv
       listen (~> 3.8)
-      pagy (~> 43.0)
+      pagy (~> 43.0, >= 43.5.6)
       phlex (~> 2.0)
       phlex-rails
       phlex-slotable (>= 1.0.0)
@@ -601,7 +601,7 @@ CHECKSUMS
   phlexi-form (0.14.3) sha256=47d69c4a49ba22279ba541b9b110e81d62acc4602513f21bb5c3d29fa9c8d5ca
   phlexi-menu (0.4.1) sha256=f6eeb1eb9597caadeee33a53f1520b3613a6ac616cf1e395e9d734a412895fb2
   phlexi-table (0.2.0) sha256=73bee135adbe73fcdb6fdd2672444373556dd9e6bba61e7b5b20ca8b7a1f822c
-  plutonium (0.62.2)
+  plutonium (0.64.0)
   pp (0.6.4) sha256=dfcb0fce700c41456265922884f9fe195d7fbb0674a3578e6c0f69588e82b570
   prettyprint (0.2.0) sha256=2bc9e15581a94742064a3cc8b0fb9d45aae3d03a1baa6ef80922627a0766f193
   prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85

data/gemfiles/rails_8.0.gemfile.lock

@@ -5,7 +5,7 @@ PATH
       action_policy (~> 0.7.0)
       csv
       listen (~> 3.8)
-      pagy (~> 43.0)
+      pagy (~> 43.0, >= 43.5.6)
       phlex (~> 2.0)
       phlex-rails
       phlex-slotable (>= 1.0.0)

data/gemfiles/rails_8.1.gemfile.lock

@@ -1,11 +1,11 @@
 PATH
   remote: ..
   specs:
-    plutonium (0.62.2)
+    plutonium (0.64.0)
       action_policy (~> 0.7.0)
       csv
       listen (~> 3.8)
-      pagy (~> 43.0)
+      pagy (~> 43.0, >= 43.5.6)
       phlex (~> 2.0)
       phlex-rails
       phlex-slotable (>= 1.0.0)

data/lib/active_model/validations/array_validator.rb

@@ -52,7 +52,7 @@ module ActiveModel
         errors = record.errors.delete attribute
         return if errors.nil?
 
-        @existing_errors += errors.map { |e| "item #{index + 1} #{e}" }
+        @existing_errors += errors.map { |e| I18n.t("errors.messages.array_item", index: index + 1, message: e) }
       end
 
       def skip?(value, validator_options)

data/lib/active_model/validations/attached_validator.rb

@@ -10,7 +10,7 @@ module ActiveModel
     #
     class AttachedValidator < EachValidator
       def validate_each(record, attribute, value)
-        record.errors.add(attribute, options[:message] || "must be attached") unless value.attached?
+        record.errors.add(attribute, options[:message] || :not_attached) unless value.attached?
       end
     end
   end

data/lib/active_model/validations/url_validator.rb

@@ -35,7 +35,7 @@ module ActiveModel
       def validate_url
         return true if URL_PATTERN.match?(value)
 
-        record.errors.add attribute, (options[:message] || "is not a valid URL")
+        record.errors.add attribute, (options[:message] || :invalid_url)
         false
       end
 
@@ -43,7 +43,7 @@ module ActiveModel
         return true unless options[:image].present?
         return true unless FastImage.type(value).nil?
 
-        record.errors.add(attribute, options[:message] || "is not a valid image URL")
+        record.errors.add(attribute, options[:message] || :invalid_image_url)
         false
       end
     end

data/lib/generators/pu/core/assets/assets_generator.rb

@@ -25,15 +25,23 @@ module Pu
 
       private
 
-      # The asset pipeline assumes the app was generated with esbuild + Tailwind.
-      # Without those, `application.tailwind.css` doesn't exist and the generator
-      # later crashes with a cryptic inject_into_file error. Fail early with a fix.
+      # The asset pipeline assumes the app was generated with esbuild + Tailwind + Stimulus.
+      # Without those, `application.tailwind.css` (Tailwind) and/or
+      # `app/javascript/controllers/index.js` (Stimulus) don't exist, and the generator
+      # later crashes with a cryptic inject_into_file error. Fail early listing every
+      # missing file with a fix.
       def verify_prerequisites
-        return if File.exist?("app/assets/stylesheets/application.tailwind.css")
+        required = [
+          "app/assets/stylesheets/application.tailwind.css",
+          "app/javascript/controllers/index.js"
+        ]
+        missing = required.reject { |path| File.exist?(path) }
+        return if missing.empty?
 
         error <<~MSG
-          Plutonium assets require a Rails app generated with esbuild and Tailwind.
-          Expected app/assets/stylesheets/application.tailwind.css, but it is missing.
+          Plutonium assets require a Rails app generated with esbuild, Tailwind, and Stimulus.
+          Missing files:
+            - #{missing.join("\n  - ")}
 
           Re-create the app with the required flags:
             rails new myapp -a propshaft -j esbuild -c tailwind \\
@@ -46,28 +54,35 @@ module Pu
         copy_file "postcss.config.js", force: true
       end
 
+      # Every package goes through one `add` built for the app's package manager
+      # (bun, yarn 1, yarn 2+, npm or pnpm; see Concerns::JsPackageManager).
+      # Versions ride inline because `pkg@latest` and `pkg@^x.y.z` are the one
+      # spelling all of them share; yarn 1's `upgrade --latest` does not exist
+      # on yarn 2+, and running yarn inside a bun app leaves two lockfiles.
       def install_dependencies
-        failed = []
+        ensure_yarn_node_modules_linker
 
+        command = js_add_command(npm_packages)
+        return if run(command)
+
+        say_status :warn,
+          "`#{command}` failed — your app may not boot until you re-run it",
+          :yellow
+      end
+
+      def npm_packages
         [
-          "@radioactive-labs/plutonium",
+          # Pinned to the gem so the two halves never drift; pu:core:update
+          # keeps them together afterwards.
+          "@radioactive-labs/plutonium@^#{Plutonium::VERSION}",
+          # cssbundling-rails already installs the latest Tailwind on new apps;
+          # apps created on Tailwind 3 are moved to 4 here.
+          "tailwindcss@latest",
           "postcss", "postcss-cli", "postcss-import",
           "@tailwindcss/postcss", "@tailwindcss/forms", "@tailwindcss/typography",
           "cssnano", "marked",
           "flowbite-typography"
-        ].each do |package|
-          run "yarn add #{package}"
-          failed << "yarn add #{package}" unless $?.success?
-        end
-
-        run "yarn upgrade tailwindcss --latest"
-        failed << "yarn upgrade tailwindcss --latest" unless $?.success?
-
-        return if failed.empty?
-
-        say_status :warn,
-          "the following commands failed — your app may not boot until you resolve them:\n  #{failed.join("\n  ")}",
-          :yellow
+        ]
       end
 
       def configure_application

data/lib/generators/pu/core/assets/templates/postcss.config.js

@@ -3,7 +3,7 @@ const plutoniumGemPath = execSync("bundle show plutonium").toString().trim();
 
 module.exports = {
   plugins: {
-    [`${plutoniumGemPath}/postcss-gem-import.js`]: {},
+    [`${plutoniumGemPath}/postcss-gem-import.cjs`]: {},
     'postcss-import': {},
     '@tailwindcss/postcss': {},
     cssnano: {}

data/lib/generators/pu/core/update/update_generator.rb

@@ -45,9 +45,10 @@ module Pu
 
       def update_npm_package
         gem_version = installed_gem_version
+        package = gem_version ? "@radioactive-labs/plutonium@^#{gem_version}" : "@radioactive-labs/plutonium@latest"
 
-        say_status :update, "Updating @radioactive-labs/plutonium to #{gem_version}...", :green
-        run "yarn add @radioactive-labs/plutonium@^#{gem_version}"
+        say_status :update, "Updating #{package} with #{js_package_manager}...", :green
+        run js_add_command(package)
       end
 
       def installed_gem_version