plutonium 0.67.0 → 0.69.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7285167839fdb5e60e89da076028dc08b719ec60125cb61faaeb26cd151b9140
-  data.tar.gz: 87fe956c9ab3cdcc92e7083a3c5c965c144661f530e4ce0cb609d3b0a8adfb06
+  metadata.gz: ec1cce1809eadd51ea67c024d0b3634ce5484c84f8399cf8eaa33c5eb0c2e000
+  data.tar.gz: fca80361dc22fcb0ff768c9ff3c4a4e6128aceff31425c6e1f02d4e3df6d958c
 SHA512:
-  metadata.gz: 3cdc13417311bd847b8b721ae46da0b59b12ecb1fafe95be087e556d71ac4d053d236169f2d48fa08edf831f9d49cdfdce27c3e28229b1bf5155dafdfb30cad5
-  data.tar.gz: 539932b5d8700edf4878fde1eb3c33ed0cd518d6ebafbbcf83df92de5ff098061dabcc1c1ca1a859cdfcf1e68a3f3e6ceaa55c44499b4132f132192db5cfcd18
+  metadata.gz: 7aeac86ceb3d02a7528c685aa7b1a3e4ae1069dc30610cbeea384cc9e777191b7ed6b81903153351feb9919163b1be8e4e19cf902d12a10b8457b31458948d80
+  data.tar.gz: cb967b6a1a24dcfeda965994c2ed0395a30f1446c78128b3b51dcf2f6e3daa2465a12b95e13b9c07ec2f40cb2f314917a6e0ba4443700c7c51a81d5287dc3211

data/.claude/skills/plutonium-async-interactions/SKILL.md

@@ -19,7 +19,7 @@ For everything about the interaction itself (inputs, validation, outcomes, `exec
 - **Permissions are re-derived at perform time, never replayed from dispatch.** The job rebuilds `(initiator, tenant)` from the row and re-checks the policy scope and predicate per target, immediately before each `perform_on`. A permission revoked mid-run stops applying to what's left. Both failure directions (scope, predicate) fail closed (refuse/report), never open.
 - **Register `Run` as a resource per portal.** Its show page IS the progress page, and other resources' index pages get a "runs in progress" banner for free. Nothing renders without registration.
 - **Read `outcome`, never bare `state`, when displaying a run's result.** A `:continue` run that under-applied still has `state == "completed"`; only `outcome` says `"completed_with_errors"`.
-- **Long work must call `heartbeat!`.** `stall_after` measures SILENCE, and the executor only writes per target, so opaque `perform` writes nothing at all between claim and finish. An opaque run longer than `stall_after` is reaped and, having no `handled_target_ids`, re-run from scratch. Call `heartbeat!` inside the loop. It also raises `StaleObjectError` if another worker took the run over, which for opaque work is the only way to find out.
+- **Long work must call `heartbeat!`.** `stall_after` measures SILENCE, and the executor only writes per target, so opaque `perform` writes nothing at all between claim and finish. The same holds for `pre_check`. An opaque run longer than `stall_after` is reaped and, having no `handled_target_ids`, re-run from scratch. Call `heartbeat!` inside the loop. It also raises `StaleObjectError` if another worker took the run over, which for opaque work is the only way to find out.
 - **A crashed/stalled run does not auto-heal.** Nothing revisits a `"running"` row on its own. `pu:async_interactions:install` schedules `Plutonium::Interaction::Async::ReapJob` for you when Solid Queue is in the bundle; otherwise (or on another scheduler) you must schedule it yourself. Unscheduled, a crash mid-batch leaves that row stuck forever.
 
 ---
@@ -114,6 +114,44 @@ end
 
 `backend:` and `uploader:` come off the attribute's `input` declaration, exactly as in a wizard step: `input :import_file, as: :uppy, uploader: Catalog::ImportUploader`. The uploader's `Attacher.validate` rules run when the interaction validates, so a bad file **fails the form** rather than surfacing as a run failure the submitter never sees. Where no `backend:` is declared: `config.async_interactions.attachment_backend` → `config.attachment_backend` → auto-detect.
 
+## Checking input before processing (`pre_check`)
+
+For checks too slow for the request (every row of a large file, lookups per row), define `pre_check` in the run. It runs in the job before any work; `reject` records a problem and keeps going (`return` yourself where nothing after it makes sense):
+
+```ruby
+# require "csv" at the top of the file
+async do
+  def pre_check                     # targeted runs: def pre_check(records)
+    each_row do |row, line|
+      reject "line #{line}: title is missing" if row["title"].blank?
+    end
+  rescue CSV::MalformedCSVError => e
+    reject "the file is not valid CSV: #{e.message}"
+  end
+
+  def perform                       # one transaction: an opaque run restarts from scratch after a reap
+    Task.transaction { each_row { |row, _line| Task.create!(title: row["title"]) } }
+  end
+
+  private
+
+  # Whole file, UTF-8, BOM stripped: the stored file comes back as binary.
+  def each_row
+    text = attachment(:import_file).download.force_encoding(Encoding::UTF_8).delete_prefix("\uFEFF")
+    CSV.parse(text, headers: true).each.with_index(2) do |row, line|   # header is line 1
+      yield row, line unless row.fields.all?(&:blank?)
+    end
+  end
+end
+```
+
+- Any rejection: run ends `failed`, `outcome == "rejected"`, problems on the progress page, no work done.
+- An exception in `pre_check` is a plain `failed`, not `rejected`. A wrong-arity `pre_check` fails the run naming the expected signature.
+- `config.async_interactions.max_rejections` (default 100) caps stored problems; the rest become one "and N more problems were found" entry.
+- It re-runs on resume, so it must only read (a resumed targeted run skips it once a target was applied). Long checks must `heartbeat!`.
+- `reject` outside `pre_check` raises.
+- Full version: `docs/reference/behavior/async-interactions.md`, "Checking input before processing".
+
 ## Registering the Run resource
 
 Use the generator, per portal. Never hand-write the route/controller:
@@ -144,7 +182,8 @@ Registering gets you, for free:
 
 - **Progress page.** The show page IS the progress page, self-polling while `pending`/`running`, and stops carrying the poll once settled (a finished run is a static page, not an eternal background request per viewer).
 - **Self-refreshing index.** The runs index polls on the same terms, one frame around the whole collection, armed only while some run is still working. One request per interval whatever the page size, and it re-fetches the current URL so filters, sort and page survive. No action needed on your part.
-- **Running banner.** Any OTHER registered resource's index lists in-progress runs targeting it, above the collection, scoped through the same `authorized_resource_scope` every cross-resource read uses (a run in another tenant can't surface). If a `resource_class` is registered in a portal that never registered `Run`, the banner is skipped there instead of raising while building a link to a nonexistent route. No action needed on your part.
+- **Running banner.** Any OTHER registered resource's index lists in-progress runs targeting it, above the collection, plus the viewer's own runs that finished within `config.async_interactions.recent_runs_window` (default 10 minutes, at most 5) with their outcome, so a fast or rejected run is still visible after the dispatch redirects back to the index. Both are scoped through the same `authorized_resource_scope` every cross-resource read uses (a run in another tenant can't surface). If a `resource_class` is registered in a portal that never registered `Run`, the banner is skipped there instead of raising while building a link to a nonexistent route. No action needed on your part.
+- **`interaction_label`.** A block-declared run (`<Interaction>::Run`) is titled by its interaction's label (`"Archive all (async) #19"`): its `presents label:`, else the class name without the `Interaction` suffix. A standalone run class falls back to its own name. An action-level `label:` or `plutonium.actions.*` translation does NOT reach the run (it does not know which action started it), so label the interaction with `presents label:` when the button and the run should match. The show page/table read `interaction_label` rather than the STI `type`.
 - **`target_label`.** The show page/table read `run.target_label` (`model_name.human`, e.g. `"Post"`) rather than the raw `target_type` string (`"Blogging::Post"`).
 - **Tenant scoping via `associated_with`.** Filters on the tenant the run was dispatched in (recorded on the row), because the two tenant columns are polymorphic and the generic object-graph scope can't walk them.
 

data/.claude/skills/plutonium-dashboard/SKILL.md

@@ -77,9 +77,24 @@ end
 
 ## metric
 
-Return a value, or a hash: `value` (required), `previous` (computes % change), `change` (numeric percentage points or a verbatim string), `trend` (`:up`/`:down`/`:flat`, inferred), `change_label`.
+Return a value, or a hash: `value` (required), `previous` (computes the change), `change` (a number or a verbatim string), `trend` (`:up`/`:down`/`:flat`, inferred), `change_label`.
 
-Options: `format:` (`:number` default, `:currency`, `:percentage`, `:human`, or `->(v) { ... }`), `precision:`, `unit:` (currency symbol), `prefix:`, `suffix:`, `positive:` (`:up` default, `:down` when falling is good), `change_label:`.
+Options: `format:` (`:number` default, `:currency`, `:percentage`, `:human`, or `->(v) { ... }`), `precision:`, `unit:` (currency symbol), `prefix:`, `suffix:`, `positive:` (`:up` default, `:down` when falling is good), `change_label:`, `change_unit:` (`:percent` default; `:points` for a value that is itself a percentage, so 50% to 55.6% reads `+5.6 pts`).
+
+## Filters and toolbar links
+
+```ruby
+filter :period, choices: {"7" => "Last 7 days", "30" => "Last 30 days"}, default: "30"
+link :settings, icon: Phlex::TablerIcons::Settings, href: -> { resource_url_for(Setting) }
+
+metric(:orders) { orders.where(created_at: filter_value(:period).to_i.days.ago..).count }
+```
+
+- A filter's value comes from the query string; an unknown value reads as the default. Read it with `filter_value(:key)`, never `params[:key]` directly.
+- Don't name a filter after a card-route param or `url_for` option (`card`, `format`, `anchor`, `host`, `use_route`, ...) or a path segment of the dashboard's route (entity param, `locale`); it raises.
+- To filter by a resource's scopes, use `filter :status, scopes: Post` (choices = "All" + the definition's scopes) with `filtered(Post)` in card blocks and `href: -> { filtered_url(Post) }`. Do not hand-map filter values to `where` clauses or `q[scope]` URLs; `filtered` runs the definition's scope, so the count matches the index. One scope filter per resource. The scope block runs on the dashboard's controller, so it cannot call resource-controller helpers like `current_parent`.
+- Every lazy card's frame URL carries the filter values, so lazy cards see the page's choice. Do not hand-roll query forwarding or a custom `DashboardsController` for this.
+- Filters render as segmented links and links as buttons in a toolbar above the cards; neither needs a custom page class.
 
 ## chart
 

data/.claude/skills/plutonium-resource/SKILL.md

@@ -622,8 +622,9 @@ end
 
 - `input :tag_ids` uses Rails' collection-ids setter. Permit `:tag_ids`; values are plain ids. Simplest for a scoped checkbox list.
 - `input :tags, as: :secure_association` is the native picker. It sets input_param `tag_sgids`, scopes via `choices:` (or the target policy), and validates submitted SGIDs by decoded model-id.
+- `input :tags, as: :association_checkboxes` (or `:association_toggles`) is the same picker rendered as one checkbox/switch per record. `input :category, as: :association_radio_buttons` does the same for a belongs_to/has_one. They are capped by `choice_limit:` like the select but have no typeahead, so keep them to short lists.
 
-⚠️ Do **not** hand-roll `collection_checkboxes_tag(choices: [[label, record.to_sgid.to_s]])`. SGIDs are non-deterministic (`to_sgid` embeds a timestamp), the component re-derives `choices` at submit and intersects the posted value against the freshly-minted SGIDs, so it never matches and the value is dropped. Use stable ids in custom checkboxes, or `secure_association` (which validates by model-id).
+⚠️ Do **not** hand-roll `collection_checkboxes_tag(choices: [[label, record.to_sgid.to_s]])`. SGIDs are non-deterministic (`to_sgid` embeds a timestamp), the component re-derives `choices` at submit and intersects the posted value against the freshly-minted SGIDs, so it never matches and the value is dropped. Use stable ids in custom checkboxes, or `as: :association_checkboxes` (which validates by model-id).
 
 ## Conditional Rendering
 
@@ -1116,7 +1117,7 @@ Only declare `index_views` explicitly if you want to **disable** one (e.g. `inde
 | `grid_layout :media` | `:compact` (image left) or `:media` (image on top). |
 | `grid_columns 3` | Override responsive column count. |
 
-All grid slots are optional; slots pointing at unpermitted fields collapse silently.
+All grid slots are optional; slots pointing at unpermitted fields collapse silently. In the `:media` layout a record whose image does not resolve keeps the cover's space, with a neutral icon, so cards in a row stay one height. An image may be an attachment, an `http` or root-relative URL, or a `data:image/` URI.
 
 ---
 

data/.claude/skills/plutonium-ui/SKILL.md

@@ -324,6 +324,8 @@ render field(:title).wrapped(class: "col-span-full") { |f| f.input_tag }
 | `uppy_tag` / `file_tag` | Uppy file upload |
 | `secure_association_tag` | Association with policy-checked options |
 | `belongs_to_tag` / `has_many_tag` / `has_one_tag` | Association selects |
+| `association_checkboxes_tag` / `association_toggles_tag` | has_many / habtm as checkboxes or switches (`as: :association_checkboxes` / `:association_toggles`); same policy scoping and SGID validation as the select, capped by `choice_limit:` like the select (selected records always render), no typeahead |
+| `association_radio_buttons_tag` | belongs_to / has_one as a radio group (`as: :association_radio_buttons`); optional associations get a "None" choice |
 | `key_value_store_tag` | Key/value pairs editor |
 | `currency_tag` | Money input (number field + unit prefix) |
 | `rich_text_tag` | Action Text editor (Trix, or Lexxy once the app installs it); default for `has_rich_text` |

data/CHANGELOG.md

@@ -2,6 +2,39 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.69.0] - 2026-10-15
+
+### Bug Fixes
+
+- Link collection pages without a record back to the resource index in breadcrumbs
+- Vendor Font Awesome 4 so its .sr-only stops overriding Tailwind utilities
+- Answer turbo-stream redirects with a stream visit, held to the open-redirect check
+- Perform opaque runs dispatched from a resource index
+
+### Features
+
+- Drop the Interaction suffix from default labels
+- Name runs by their interaction, show progress as one cell
+- Check a run's input before processing with pre_check
+- Clear finished SolidQueue jobs and gate VACUUM on free pages in pu:lite:maintenance
+
+### Miscellaneous Tasks
+
+- Update gemfiles
+
+## [0.68.0] - 2026-10-14
+
+### Bug Fixes
+
+- Send card links to the whole page ([#183](https://github.com/radioactive-labs/plutonium-core/issues/183))
+- Keep the grid card cover's space when a record has no image ([#184](https://github.com/radioactive-labs/plutonium-core/issues/184))
+
+### Features
+
+- Filters carried to card frames, toolbar links, point changes ([#182](https://github.com/radioactive-labs/plutonium-core/issues/182))
+- Checkbox, toggle and radio variants of the association input ([#185](https://github.com/radioactive-labs/plutonium-core/issues/185))
+- Scope filters, plus fixes from the #182 review ([#186](https://github.com/radioactive-labs/plutonium-core/issues/186))
+
 ## [0.67.0] - 2026-10-09
 
 ### Bug Fixes

data/SECURITY.md

@@ -12,7 +12,7 @@ please upgrade before reporting an issue to confirm it still reproduces.
 
 | Version | Supported          |
 | ------- | ------------------ |
-| Latest release (`0.67.x`) | :white_check_mark: |
+| Latest release (`0.69.x`) | :white_check_mark: |
 | Older releases | :x: |
 
 ## Reporting a Vulnerability