gemstack 0.2.5 → 0.3.0

data/templates/frontend/app/page.tsx.tt

@@ -0,0 +1,183 @@
+"use client";
+
+import { useQuery } from "@tanstack/react-query";
+import { useState } from "react";
+import { api, API_PATH } from "@/lib/gemstack/client";
+import styles from "./page.module.css";
+
+// The GemStack welcome page: shows that Next.js renders and that the browser
+// reaches the Ruby API through the same origin. Replace it with your app —
+// this file and app/page.module.css are yours to delete.
+
+const DOCS = "https://github.com/gemstack-rb/gemstack/tree/main/docs";
+
+export default function Welcome() {
+  const health = useQuery({
+    queryKey: ["gemstack", "health"],
+    queryFn: async () => {
+      const started = performance.now();
+      const body = await api.get<{ status: string }>("/health");
+      return { ...body, ms: Math.round(performance.now() - started) };
+    },
+    retry: 1,
+  });
+  const apiState = health.isPending ? "pending" : health.isError ? "error" : "ok";
+
+  return (
+    <div className={styles.shell}>
+      <main className={styles.main}>
+        <header className={styles.hero}>
+          <GemLogo className={styles.logo} />
+          <p className={styles.eyebrow}>GemStack</p>
+          <h1 className={styles.title}>
+            Yay! You&apos;re on <span className={styles.accent}>GemStack</span>.
+          </h1>
+          <p className={styles.lead}>
+            <strong><%= module_name %></strong> is running: a Next.js frontend and a Ruby API, served from one origin.
+          </p>
+
+          <div className={styles.checks} role="status" aria-live="polite">
+            <span className={`${styles.check} ${styles.ok}`}>
+              <span className={styles.dot} aria-hidden="true" /> Next.js rendering
+            </span>
+            <span className={`${styles.check} ${styles[apiState]}`}>
+              <span className={styles.dot} aria-hidden="true" />
+              {apiState === "pending" && "Connecting to the Ruby API…"}
+              {apiState === "ok" && (
+                <>
+                  Ruby API connected · <code>GET {API_PATH}/health</code> in {health.data?.ms} ms
+                </>
+              )}
+              {apiState === "error" && <>Ruby API unreachable: {health.error?.message}</>}
+            </span>
+          </div>
+        </header>
+
+        <section className={styles.grid} aria-label="Next steps">
+          <Card
+            step="1"
+            title="Generate a resource"
+            text="Migration, model, API, typed TypeScript client and Next.js pages — in one command."
+            command="gemstack g resource Product name:string"
+          />
+          <Card
+            step="2"
+            title="Explore your API"
+            text="Every endpoint with its types, and a form to try requests from the browser."
+            href={`${API_PATH}/docs`}
+            linkLabel={`Open ${API_PATH}/docs`}
+          />
+          <Card
+            step="3"
+            title="Check your setup"
+            text="Ruby, Node.js, the database, migrations and the TypeScript contract — with the fix for anything off."
+            command="gemstack doctor"
+          />
+          <Card
+            step="4"
+            title="Read the guides"
+            text="Models, controllers, jobs, realtime, authentication, storage and deployment."
+            href={DOCS}
+            linkLabel="Open the guides"
+            external
+          />
+        </section>
+
+        <p className={styles.edit}>
+          Edit <code>frontend/app/page.tsx</code> to replace this page · API code lives in <code>app/</code>
+        </p>
+      </main>
+
+      <footer className={styles.footer}>
+        <span>
+          GemStack <%= version %> · Ruby <%= ruby_version %> · Next.js
+        </span>
+        <span>
+          Open source by{" "}
+          <a href="https://www.adwaretech.com" target="_blank" rel="noreferrer">
+            Adware Technologies
+          </a>
+        </span>
+      </footer>
+    </div>
+  );
+}
+
+function Card(props: {
+  step: string;
+  title: string;
+  text: string;
+  command?: string;
+  href?: string;
+  linkLabel?: string;
+  external?: boolean;
+}) {
+  return (
+    <article className={styles.card}>
+      <span className={styles.step} aria-hidden="true">
+        {props.step}
+      </span>
+      <h2 className={styles.cardTitle}>{props.title}</h2>
+      <p className={styles.cardText}>{props.text}</p>
+      {props.command && <Command text={props.command} />}
+      {props.href && (
+        <a
+          className={styles.link}
+          href={props.href}
+          {...(props.external ? { target: "_blank", rel: "noreferrer" } : {})}
+        >
+          {props.linkLabel} <span aria-hidden="true">→</span>
+        </a>
+      )}
+    </article>
+  );
+}
+
+function Command({ text }: { text: string }) {
+  const [copied, setCopied] = useState(false);
+  async function copy() {
+    try {
+      await navigator.clipboard.writeText(text);
+      setCopied(true);
+      setTimeout(() => setCopied(false), 1500);
+    } catch {
+      // Clipboard unavailable (e.g. not a secure context): the command stays selectable.
+    }
+  }
+  return (
+    <div className={styles.command}>
+      <code>
+        <span className={styles.prompt} aria-hidden="true">
+          $
+        </span>{" "}
+        {text}
+      </code>
+      <button type="button" className={styles.copy} onClick={copy} aria-label={`Copy: ${text}`}>
+        {copied ? "Copied" : "Copy"}
+      </button>
+    </div>
+  );
+}
+
+function GemLogo({ className }: { className?: string }) {
+  return (
+    <svg className={className} viewBox="0 0 64 64" role="img" aria-label="GemStack">
+      <defs>
+        <linearGradient id="gemstack-gem" x1="0" y1="0" x2="1" y2="1">
+          <stop offset="0" stopColor="#ff5f8f" />
+          <stop offset="0.55" stopColor="#e11d48" />
+          <stop offset="1" stopColor="#7c3aed" />
+        </linearGradient>
+      </defs>
+      <path d="M18 8h28l12 15-26 34L6 23z" fill="url(#gemstack-gem)" />
+      <path
+        d="M6 23h52M18 8l7 15 7-15 7 15 7-15M25 23l7 34 7-34"
+        fill="none"
+        stroke="rgba(255,255,255,0.55)"
+        strokeWidth="1.4"
+        strokeLinejoin="round"
+      />
+      <path d="M18 8h28l-7 15H25z" fill="rgba(255,255,255,0.18)" />
+    </svg>
+  );
+}

data/templates/frontend/app/providers.tsx

@@ -0,0 +1,24 @@
+"use client";
+
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { useState, type ReactNode } from "react";
+import { ApiError } from "@/lib/gemstack/client";
+
+// Server state lives in TanStack Query; local UI state is plain React state;
+// URL state uses Next.js search params. No global store is needed by default.
+export function Providers({ children }: { children: ReactNode }) {
+  const [queryClient] = useState(
+    () =>
+      new QueryClient({
+        defaultOptions: {
+          queries: {
+            staleTime: 30_000,
+            // Don't retry requests the API rejected (4xx); retry transient failures twice.
+            retry: (failureCount, error) => !(error instanceof ApiError && error.isClientError) && failureCount < 2,
+          },
+        },
+      }),
+  );
+
+  return <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>;
+}

data/templates/frontend/lib/gemstack/client.ts

@@ -0,0 +1,125 @@
+/**
+ * GemStack API client runtime.
+ *
+ * This file belongs to your application (it is not a hidden dependency):
+ * add auth headers, interceptors or logging here as needed.
+ *
+ * Where requests go:
+ * - Browser: relative URLs ("/api/..."), i.e. the same origin — no CORS, no config.
+ * - Server Components / Route Handlers: GEMSTACK_API_URL (injected by `gemstack dev`,
+ *   set by you in production) so the Next.js server calls Ruby directly.
+ * - API on another domain: set NEXT_PUBLIC_GEMSTACK_API_URL.
+ */
+
+export const API_PATH = process.env.NEXT_PUBLIC_GEMSTACK_API_PATH ?? "/api";
+
+/** The JSON error envelope every GemStack API error uses. */
+export interface ApiErrorBody {
+  error: { code: string; message: string; request_id?: string };
+  /** Field-level validation messages, e.g. { name: ["is required"] }. */
+  errors?: Record<string, string[]>;
+  /** Development only (config.http.show_exceptions): the server-side exception. */
+  exception?: { class: string; message: string; backtrace: string[] };
+}
+
+export class ApiError extends Error {
+  readonly status: number;
+  readonly code: string;
+  readonly requestId?: string;
+  readonly errors: Record<string, string[]>;
+
+  constructor(status: number, body: ApiErrorBody | null, fallbackMessage: string) {
+    super(body?.error?.message ?? fallbackMessage);
+    this.name = "ApiError";
+    this.status = status;
+    this.code = body?.error?.code ?? "http_error";
+    this.requestId = body?.error?.request_id;
+    this.errors = body?.errors ?? {};
+  }
+
+  /** True for 4xx responses: retrying the same request won't help. */
+  get isClientError(): boolean {
+    return this.status >= 400 && this.status < 500;
+  }
+}
+
+type QueryValue = string | number | boolean | null | undefined;
+export type Query = Record<string, QueryValue | QueryValue[]>;
+
+export interface RequestOptions extends Omit<RequestInit, "body" | "method"> {
+  query?: Query;
+  body?: unknown;
+}
+
+function baseUrl(): string {
+  const publicUrl = process.env.NEXT_PUBLIC_GEMSTACK_API_URL;
+  if (publicUrl) return publicUrl.replace(/\/$/, "");
+  if (typeof window === "undefined") {
+    return (process.env.GEMSTACK_API_URL ?? "http://127.0.0.1:4000").replace(/\/$/, "");
+  }
+  return "";
+}
+
+/** Builds a URL for an API path: apiUrl("/products", { page: 2 }) → "/api/products?page=2". */
+export function apiUrl(path: string, query?: Query): string {
+  const normalized = path.startsWith("/") ? path : `/${path}`;
+  let url = `${baseUrl()}${API_PATH}${normalized}`;
+  if (query) {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(query)) {
+      const values = Array.isArray(value) ? value : [value];
+      for (const item of values) {
+        if (item !== undefined && item !== null) params.append(Array.isArray(value) ? `${key}[]` : key, String(item));
+      }
+    }
+    const qs = params.toString();
+    if (qs) url += `?${qs}`;
+  }
+  return url;
+}
+
+function parse(text: string): unknown {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+
+export async function request<T>(method: string, path: string, options: RequestOptions = {}): Promise<T> {
+  const { query, body, headers, ...init } = options;
+  const requestHeaders = new Headers(headers);
+  requestHeaders.set("accept", "application/json");
+
+  let payload: BodyInit | undefined;
+  if (body !== undefined) {
+    if (body instanceof FormData || body instanceof Blob || body instanceof URLSearchParams) {
+      payload = body;
+    } else {
+      payload = JSON.stringify(body);
+      requestHeaders.set("content-type", "application/json");
+    }
+  }
+
+  const response = await fetch(apiUrl(path, query), { ...init, method, headers: requestHeaders, body: payload });
+  const text = response.status === 204 ? "" : await response.text();
+  const data = text ? parse(text) : null;
+
+  if (!response.ok) {
+    const exception = (data as ApiErrorBody | null)?.exception;
+    if (exception && process.env.NODE_ENV !== "production") {
+      // The Ruby exception behind a 500, so it shows up next to the failing request.
+      console.error(`[GemStack API] ${method} ${path} → ${exception.class}: ${exception.message}\n  ${exception.backtrace.slice(0, 8).join("\n  ")}`);
+    }
+    throw new ApiError(response.status, data as ApiErrorBody | null, response.statusText || `HTTP ${response.status}`);
+  }
+  return data as T;
+}
+
+export const api = {
+  get: <T>(path: string, options?: RequestOptions) => request<T>("GET", path, options),
+  post: <T>(path: string, body?: unknown, options?: RequestOptions) => request<T>("POST", path, { ...options, body }),
+  put: <T>(path: string, body?: unknown, options?: RequestOptions) => request<T>("PUT", path, { ...options, body }),
+  patch: <T>(path: string, body?: unknown, options?: RequestOptions) => request<T>("PATCH", path, { ...options, body }),
+  delete: <T = void>(path: string, options?: RequestOptions) => request<T>("DELETE", path, options),
+};

data/templates/frontend/next-env.d.ts

@@ -0,0 +1,5 @@
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

data/templates/frontend/next.config.ts

@@ -0,0 +1,17 @@
+import type { NextConfig } from "next";
+
+// One public origin, in every environment:
+// - `gemstack dev`: the GemStack gateway routes /api/* to Ruby before requests reach Next.js.
+// - Production: set GEMSTACK_API_URL (e.g. http://api.internal:4000) and Next.js proxies
+//   /api/* to the Ruby API. Leave it unset if a reverse proxy already routes /api/*.
+const apiUrl = process.env.GEMSTACK_API_URL?.replace(/\/$/, "");
+const apiPath = process.env.NEXT_PUBLIC_GEMSTACK_API_PATH ?? "/api";
+
+const nextConfig: NextConfig = {
+  async rewrites() {
+    if (!apiUrl) return [];
+    return [{ source: `${apiPath}/:path*`, destination: `${apiUrl}${apiPath}/:path*` }];
+  },
+};
+
+export default nextConfig;

data/templates/frontend/package.json.tt

@@ -0,0 +1,23 @@
+{
+  "name": "<%= name %>-frontend",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@tanstack/react-query": "^5.104.0",
+    "next": "^16.3.6",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "typescript": "~5.9.3"
+  }
+}

data/templates/frontend/tsconfig.json

@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "allowJs": false,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "react-jsx",
+    "incremental": true,
+    "plugins": [{ "name": "next" }],
+    "paths": { "@/*": ["./*"] }
+  },
+  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts", ".next/dev/types/**/*.ts"],
+  "exclude": ["node_modules"]
+}

data/templates/job/app/jobs/%file_name%.rb.tt

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+# Enqueue with <%= class_name %>.perform_later(...) — arguments must be JSON values (pass ids, not records).
+# Runs in `gemstack jobs` (and in `gemstack dev`). Delivery is at-least-once: keep perform idempotent.
+class <%= class_name %> < ApplicationJob
+<% if queue_name -%>
+  queue :<%= queue_name %>
+<% end -%>
+  # retry_on SomeTimeoutError, attempts: 5    # default: any StandardError, 10 attempts, exponential backoff
+  # discard_on GemStack::NotFound             # drop instead of retrying
+
+  def perform(*args)
+    GemStack.logger.info("<%= class_name %> ran", args: args)
+  end
+end

data/templates/job/test/jobs/%file_name%_test.rb.tt

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+require_relative "../test_helper"
+
+class <%= class_name %>Test < GemStack::TestCase
+  def test_enqueue
+    <%= class_name %>.perform_later(1)
+
+    assert_enqueued <%= class_name %>, args: [1]
+  end
+
+  def test_perform
+    perform_enqueued_jobs { <%= class_name %>.perform_later(1) }
+  end
+end

data/templates/migration/db/migrations/%timestamp%_%file_name%.rb.tt

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+# Sequel migration — see https://sequel.jeremyevans.net/rdoc/files/doc/schema_modification_rdoc.html
+Sequel.migration do
+  change do
+<% if table && !columns.empty? -%>
+    alter_table(:<%= table %>) do
+<% columns.each do |column| -%>
+      <%= column %>
+<% end -%>
+    end
+<% else -%>
+    # create_table(:things) { primary_key :id, type: :Bignum }
+    # alter_table(:things) { add_column :name, String }
+<% end -%>
+  end
+end

data/templates/policy/app/policies/%file_name%_policy.rb.tt

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+# Who may do what with <%= model_name %> records (docs/authorization.md).
+# `user` is the signed-in user (nil when anonymous); `record` the <%= model_name %>.
+# In controllers: authorize!(record) checks "<action>?", policy_scope(<%= model_name %>) filters lists.
+class <%= class_name %> < <%= parent_class %>
+  def index? = !user.nil?
+  def show? = owner?
+  def create? = !user.nil?
+  def update? = owner?
+  def destroy? = owner?
+
+  class Scope < Scope
+    # The <%= model_name %> records the user may list. Adjust to your data model.
+    def resolve = user ? scope.where(user_id: user.id) : scope.where(false)
+  end
+
+  private
+
+  def owner? = !user.nil? && record.respond_to?(:user_id) && record.user_id == user.id
+end

data/templates/policy/test/policies/%file_name%_policy_test.rb.tt

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+require_relative "../test_helper"
+
+class <%= class_name %>Test < GemStack::TestCase
+  def test_anonymous_users_are_denied
+    refute <%= class_name %>.new(nil, Struct.new(:user_id).new(1)).update?
+  end
+end

data/templates/realtime/config/channels.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# Realtime channels browsers may subscribe to (docs/realtime.md). Anything not
+# listed here is refused. `*` matches one segment and is passed to the block,
+# together with the request (cookies, headers) for authorization.
+#
+#   GemStack.broadcast("orders:#{order.id}", "order.updated", order)
+#
+GemStack.channels do
+  # channel "announcements"                        # public
+  # channel "orders:*" do |order_id, request|      # private
+  #   Order.find_by(id: order_id)&.user_id == current_user_id(request)
+  # end
+end

data/templates/realtime/frontend/lib/gemstack/realtime.ts

@@ -0,0 +1,120 @@
+/**
+ * GemStack realtime client (yours to edit — see docs/realtime.md).
+ *
+ *   const off = realtime.subscribe("orders:42", (event) => console.log(event.event, event.data));
+ *   off(); // unsubscribe
+ *
+ *   useRealtime("products", (event) => queryClient.invalidateQueries({ queryKey: ["products"] }));
+ *
+ * One EventSource per tab carries every channel; changes to the set of
+ * channels made in the same tick cause a single reconnect. After a dropped
+ * connection the browser reconnects with Last-Event-ID and the server replays
+ * what was missed — or sends `gemstack.gap` (delivered to every handler) when
+ * it can't, so you can refetch. A refused channel's handlers get `gemstack.denied`
+ * while the other channels keep working.
+ */
+"use client";
+
+import { useEffect, useRef } from "react";
+import { apiUrl } from "./client";
+
+export type RealtimeEvent<T = unknown> = {
+  id: string | null;
+  channel: string | null;
+  event: string;
+  data: T;
+};
+
+export type RealtimeHandler<T = unknown> = (event: RealtimeEvent<T>) => void;
+export type RealtimeStatus = "idle" | "connecting" | "open" | "reconnecting";
+
+export const GAP_EVENT = "gemstack.gap";
+/** Delivered to a channel's handlers when the server refuses the subscription. */
+export const DENIED_EVENT = "gemstack.denied";
+
+class RealtimeClient {
+  private handlers = new Map<string, Set<RealtimeHandler>>();
+  private source: EventSource | null = null;
+  private connectedKey = "";
+  private lastEventId: string | null = null;
+  private scheduled = false;
+  private statusListeners = new Set<(status: RealtimeStatus) => void>();
+  status: RealtimeStatus = "idle";
+
+  subscribe<T = unknown>(channel: string, handler: RealtimeHandler<T>): () => void {
+    const set = this.handlers.get(channel) ?? new Set<RealtimeHandler>();
+    set.add(handler as RealtimeHandler);
+    this.handlers.set(channel, set);
+    this.schedule();
+    return () => {
+      set.delete(handler as RealtimeHandler);
+      if (set.size === 0) this.handlers.delete(channel);
+      this.schedule();
+    };
+  }
+
+  onStatus(listener: (status: RealtimeStatus) => void): () => void {
+    this.statusListeners.add(listener);
+    return () => this.statusListeners.delete(listener);
+  }
+
+  private setStatus(status: RealtimeStatus) {
+    this.status = status;
+    this.statusListeners.forEach((listener) => listener(status));
+  }
+
+  private schedule() {
+    if (this.scheduled) return;
+    this.scheduled = true;
+    queueMicrotask(() => {
+      this.scheduled = false;
+      this.connect();
+    });
+  }
+
+  private connect() {
+    if (typeof window === "undefined" || typeof EventSource === "undefined") return;
+    const channels = [...this.handlers.keys()].sort();
+    const key = channels.join(",");
+    if (key === this.connectedKey && this.source) return;
+
+    this.source?.close();
+    this.source = null;
+    this.connectedKey = key;
+    if (channels.length === 0) return this.setStatus("idle");
+
+    const query: Record<string, string> = { channels: key };
+    if (this.lastEventId) query.last_event_id = this.lastEventId;
+    const source = new EventSource(apiUrl("/realtime", query), { withCredentials: true });
+    this.source = source;
+    this.setStatus("connecting");
+    source.onopen = () => this.setStatus("open");
+    source.onerror = () => this.setStatus("reconnecting"); // the browser retries on its own
+    source.onmessage = (message) => {
+      if (message.lastEventId) this.lastEventId = message.lastEventId;
+      let event: RealtimeEvent;
+      try {
+        event = JSON.parse(message.data) as RealtimeEvent;
+      } catch {
+        return;
+      }
+      const targets =
+        event.event === GAP_EVENT ? [...this.handlers.values()] : [this.handlers.get(event.channel ?? "") ?? new Set()];
+      targets.forEach((set) => set.forEach((handler) => handler(event)));
+    };
+  }
+}
+
+export const realtime = new RealtimeClient();
+
+/** Subscribes while the component is mounted. Pass null to skip. */
+export function useRealtime<T = unknown>(channel: string | null, handler: RealtimeHandler<T>) {
+  const latest = useRef(handler);
+  useEffect(() => {
+    latest.current = handler; // always call the newest handler without resubscribing
+  });
+  useEffect(() => {
+    if (!channel) return;
+    return realtime.subscribe<T>(channel, (event) => latest.current(event));
+  }, [channel]);
+}

data/templates/resource/controller/app/controllers/%plural%_controller.rb.tt

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+class <%= spec.plural_class %>Controller < ApplicationController
+<% if spec.action?(:index) -%>
+  returns :index, GemStack::Page[<%= class_name %>Serializer]
+<% end -%>
+<% if spec.action?(:create) -%>
+  accepts :create, with: <%= class_name %>.input_schema
+<% end -%>
+<% if spec.action?(:update) -%>
+  accepts :update, with: <%= class_name %>.input_schema, partial: true
+<% end -%>
+<% if spec.action?(:index) -%>
+
+  # GET /api/<%= spec.url_segment %>?page=1&per_page=25
+  def index
+    render paginate(<%= class_name %>.order(:id))
+  end
+<% end -%>
+<% if spec.action?(:show) -%>
+
+  # GET /api/<%= spec.url_segment %>/:id
+  def show
+    render <%= class_name %>.find(params[:id])
+  end
+<% end -%>
+<% if spec.action?(:create) -%>
+
+  # POST /api/<%= spec.url_segment %>
+  def create
+    render <%= class_name %>.create(input), status: :created
+  end
+<% end -%>
+<% if spec.action?(:update) -%>
+
+  # PATCH /api/<%= spec.url_segment %>/:id
+  def update
+    <%= spec.variable %> = <%= class_name %>.find(params[:id])
+    <%= spec.variable %>.update(input)
+    render <%= spec.variable %>
+  end
+<% end -%>
+<% if spec.action?(:destroy) -%>
+
+  # DELETE /api/<%= spec.url_segment %>/:id
+  def destroy
+    <%= class_name %>.find(params[:id]).destroy
+    head :no_content
+  end
+<% end -%>
+end