ruact 0.0.5 → 0.0.6

data/lib/generators/ruact/scaffold/templates/components/agnostic/List.tsx.tt

@@ -0,0 +1,253 @@
+"use client";
+
+<% unless typescript? -%>
+// Generated with --javascript: this .jsx file forfeits the FR99 typed server
+// boundary and the FR100 call-site contract (both TS-only). Re-run without
+// --javascript for the typed .tsx variant.
+<% end -%>
+// <%= class_name %> list — a DESIGN-SYSTEM-AGNOSTIC table (Story 14.4 / FR103). The
+// default scaffold ships plain, native HTML elements styled by the browser /
+// Rails-default CSS — NO shadcn/ui, NO Tailwind, NO table-engine dependency. The
+// collection arrives as a SERVER-RENDERED prop (`posts`); there is no client query
+// for the initial render. A query only enters when the *client* drives the read:
+// the search box calls useQuery(<%= js_search_alias %>, { q }) and swaps in filtered rows as
+// you type. Per-row delete drives a controlled <%= class_name %>DeleteDialog (DELETE
+// /<%= plural_name %>/:id via the destroy<%= class_name %> action); on `{ ok: true }` the row is
+// removed from the displayed rows IN PLACE (no reload, no URL built). Column
+// sorting is CLIENT-ONLY — the dataset is the index payload; server-side
+// sort/pagination is Phase-3 territory. (The richer shadcn DataTable styling is
+// the opt-in `--shadcn` path — Story 14.5.)
+import { useState } from "react";
+import { search as <%= js_search_alias %>, destroy<%= class_name %>, useQuery } from "@/.ruact/server-functions";
+import { <%= class_name %>DeleteDialog } from "./<%= class_name %>DeleteDialog";
+<% if typescript? -%>
+
+type <%= class_name %>Row = { <%= ts_row_fields %> };
+
+// FR100 — opt-in call-site contract: `posts` is required. The index view passes
+// `<<%= class_name %>List posts={rows} />` (satisfied); a call site that omits it
+// fails at preprocess time, not as a silent `undefined` in the browser.
+export const __ruactContract = {
+  props: { posts: "required" },
+};
+<% end -%>
+
+// Columns whose values are date/datetime strings: the sort compares these by
+// epoch time (`new Date(value).getTime()`) rather than lexically, so they order
+// chronologically. Generated from the model's date/datetime attributes.
+const DATE_KEYS = new Set<% if typescript? %><string><% end %>([<%= scaffold_attributes.select(&:date?).map { |attr| %("#{attr.column_name}") }.join(", ") %>]);
+
+// Generated client-side comparator (no table engine). Sorts a COPY of the rows
+// by the active key + direction: `null`/`undefined` always sort LAST (so a blank
+// cell never jumps to the top, regardless of direction); date columns compare by
+// time, numbers numerically, booleans false-before-true, everything else via a
+// locale-aware string compare. The direction flip is applied AFTER the null
+// handling, never to it.
+function compareRows(
+  a<% if typescript? %>: <%= class_name %>Row<% end %>,
+  b<% if typescript? %>: <%= class_name %>Row<% end %>,
+  sort<% if typescript? %>: { key: string; dir: "asc" | "desc" }<% end %>,
+)<% if typescript? %>: number<% end %> {
+  const av = a[sort.key<% if typescript? %> as keyof <%= class_name %>Row<% end %>];
+  const bv = b[sort.key<% if typescript? %> as keyof <%= class_name %>Row<% end %>];
+  if (av == null && bv == null) return 0;
+  if (av == null) return 1;
+  if (bv == null) return -1;
+
+  let result<% if typescript? %>: number<% end %>;
+  if (DATE_KEYS.has(sort.key)) {
+    result = new Date(String(av)).getTime() - new Date(String(bv)).getTime();
+  } else if (typeof av === "number" && typeof bv === "number") {
+    result = av - bv;
+  } else if (typeof av === "boolean" && typeof bv === "boolean") {
+    result = Number(av) - Number(bv);
+  } else {
+    result = String(av).localeCompare(String(bv));
+  }
+  return sort.dir === "desc" ? -result : result;
+}
+
+// Pull a human-readable message out of the failed-delete result. A thrown
+// RuactActionError (non-2xx) carries the parsed structured-error body, whose
+// `message` the gem shapes per env (the exception message in development, the
+// generic server message in production); a resolved soft-failure may carry a
+// top-level `error`/`message`. Returns undefined when none is present, so the
+// dialog can fall back to its own generic copy.
+function deleteErrorMessage(error<% if typescript? %>: unknown<% end %>)<% if typescript? %>: string | undefined<% end %> {
+  if (error != null && typeof error === "object") {
+    const carrier = error<% if typescript? %> as { body?: unknown; error?: unknown; message?: unknown }<% end %>;
+    if (carrier.body != null && typeof carrier.body === "object") {
+      const message = (carrier.body<% if typescript? %> as { message?: unknown }<% end %>).message;
+      if (typeof message === "string" && message.length > 0) return message;
+    }
+    if (typeof carrier.error === "string" && carrier.error.length > 0) return carrier.error;
+    if (typeof carrier.message === "string" && carrier.message.length > 0) return carrier.message;
+  }
+  return undefined;
+}
+
+// A resolved delete is a SUCCESS only on the server-owned success shapes: the
+// in-list default `{ ok: true }`, or the delete-from-show `$redirect` the
+// accessor already followed (which resolves to `null`). Any other resolved shape
+// (e.g. an explicit `{ ok: false }`) is a non-success the dialog surfaces.
+function deleteSucceeded(result<% if typescript? %>: unknown<% end %>)<% if typescript? %>: boolean<% end %> {
+  if (result === null) return true;
+  return (
+    typeof result === "object" &&
+    (result<% if typescript? %> as { ok?: unknown }<% end %>).ok === true
+  );
+}
+
+// Per-row actions (AC2) — an Edit link + a Delete TRIGGER that opens the
+// controlled dialog. Each row owns its OWN dialog `open` state (one independent
+// useState), so the dialog opens for exactly one row. `onConfirm` calls
+// destroy<%= class_name %> and, on a server-owned success, asks the List to drop the row
+// in place via `onDeleted`. The agnostic default keeps a single inline actions
+// cell (the responsive overflow menu is a shadcn refinement deferred to the
+// `--shadcn` path — Story 14.5).
+function RowActions({ record, onDeleted }<% if typescript? %>: {
+  record: <%= class_name %>Row;
+  onDeleted: (id: number) => void;
+}<% end %>) {
+  const [open, setOpen] = useState(false);
+
+  async function onConfirm()<% if typescript? %>: Promise<{ ok: boolean; error?: string }><% end %> {
+    try {
+      const result = await destroy<%= class_name %>({ id: record.id });
+      if (deleteSucceeded(result)) {
+        onDeleted(record.id);
+        setOpen(false);
+        return { ok: true };
+      }
+      // Resolved but not a success shape → keep the dialog open with the message.
+      return { ok: false, error: deleteErrorMessage(result) };
+    } catch (error) {
+      // Failure (non-2xx structured error) → keep the dialog open, message inline.
+      return { ok: false, error: deleteErrorMessage(error) };
+    }
+  }
+
+  return (
+    <span>
+      <a href={`/<%= plural_name %>/${record.id}/edit`}>Edit</a>
+      {" "}
+      <button type="button" onClick={() => setOpen(true)}>
+        Delete
+      </button>
+
+      <<%= class_name %>DeleteDialog
+        open={open}
+        onOpenChange={setOpen}
+        <%= singular_name %>={record}
+        onConfirm={onConfirm}
+      />
+    </span>
+  );
+}
+
+export function <%= class_name %>List({
+  posts = [],
+  emptyLabel = "No <%= plural_name %> yet — create one.",
+}<% if typescript? %>: { posts?: <%= class_name %>Row[]; emptyLabel?: string }<% end %>) {
+  const [q, setQ] = useState("");
+  const searching = q.trim().length > 0;
+
+  // Ids deleted IN PLACE — a single tombstone list (not a second row cache)
+  // applied to whichever source is displayed, so a delete removes the row
+  // immediately whether it happened on the server-rendered list OR on the live
+  // search results.
+  const [removedIds, setRemovedIds] = useState<% if typescript? %><number[]><% end %>([]);
+
+  // Sort state (AC2) — the active column key + direction, or null when unsorted
+  // (server/insertion order). A new key sorts ascending; clicking the same key
+  // again flips asc↔desc.
+  const [sort, setSort] = useState<% if typescript? %><{ key: string; dir: "asc" | "desc" } | null><% end %>(null);
+
+  // Client-driven read (AC5) — only meaningful while searching. When q is blank
+  // the box is idle and we fall back to the server-rendered rows.
+  const { data: searchData, loading: searchLoading } = useQuery<% if typescript? %><<%= class_name %>Row[]><% end %>(<%= js_search_alias %>, { q: q.trim() });
+
+  const source = searching ? searchData ?? [] : posts;
+  const rows = removedIds.length === 0 ? source : source.filter((row) => !removedIds.includes(row.id));
+  // Always sort a COPY — never mutate the prop/source array.
+  const sortedRows = sort ? [...rows].sort((a, b) => compareRows(a, b, sort)) : rows;
+
+  const onDeleted = (id<% if typescript? %>: number<% end %>) =>
+    setRemovedIds((current) => (current.includes(id) ? current : [...current, id]));
+
+  // Set the sort to a new key (ascending), or flip the direction when the active
+  // key is clicked again.
+  function toggleSort(key<% if typescript? %>: string<% end %>) {
+    setSort((current) =>
+      current && current.key === key
+        ? { key, dir: current.dir === "asc" ? "desc" : "asc" }
+        : { key, dir: "asc" },
+    );
+  }
+
+  return (
+    <section>
+      <h1><%= human_name.pluralize %></h1>
+      <p>
+        <a href="/<%= plural_name %>/new">+ New <%= human_name.downcase %></a>
+      </p>
+
+      <input
+        type="search"
+        value={q}
+        onChange={(e) => setQ(e.target.value)}
+        placeholder="Search <%= plural_name %>…"
+      />
+
+      {searching && searchLoading && <p>Searching…</p>}
+      {!searching && rows.length === 0 && <p>{emptyLabel}</p>}
+      {searching && !searchLoading && rows.length === 0 && (
+        <p>No <%= plural_name %> match “{q.trim()}”.</p>
+      )}
+
+      {sortedRows.length > 0 && (
+        <table>
+          <thead>
+            <tr>
+              <th>
+                <button type="button" onClick={() => toggleSort("id")}>ID</button>
+              </th>
+<% scaffold_attributes.each do |attr| -%>
+              <th>
+                <button type="button" onClick={() => toggleSort("<%= attr.column_name %>")}>
+                  <%= attr.column_name.humanize %>
+                </button>
+              </th>
+<% end -%>
+              <th>Actions</th>
+            </tr>
+          </thead>
+          <tbody>
+            {sortedRows.map((row) => (
+              <tr key={row.id}>
+                <td>
+                  <a href={`/<%= plural_name %>/${row.id}`}>{row.id}</a>
+                </td>
+<% scaffold_attributes.each do |attr| -%>
+<% kind = attr.column_kind -%>
+<% if kind == :numeric -%>
+                <td>{String(row.<%= attr.column_name %> ?? "")}</td>
+<% elsif kind == :badge -%>
+                <td>{row.<%= attr.column_name %> ? "Yes" : "No"}</td>
+<% elsif kind == :date -%>
+                <td>{row.<%= attr.column_name %> ? new Date(String(row.<%= attr.column_name %>)).toLocaleString() : ""}</td>
+<% else -%>
+                <td>{String(row.<%= attr.column_name %> ?? "")}</td>
+<% end -%>
+<% end -%>
+                <td>
+                  <RowActions record={row} onDeleted={onDeleted} />
+                </td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      )}
+    </section>
+  );
+}

data/lib/generators/ruact/scaffold/templates/controller.rb.tt

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+# <%= controller_class_name %>Controller — a complete CRUD on the v2 route-driven contract.
+#
+# `include Ruact::Server` (sibling of the Ruact::Controller already on
+# ApplicationController via `ruact:install`) gives this controller two
+# behaviours at once:
+#
+#   - GET actions (index/show/new/edit) need NO explicit `ruact_render` —
+#     Ruact::Controller#default_render activates the RSC pipeline implicitly
+#     whenever a matching .html.erb exists. The actions just set ivars.
+#
+#   - NON-GET actions (create/update/destroy) are the v2 SERVER FUNCTIONS:
+#     exposed because the route is non-GET on a Ruact::Server controller. The
+#     route-driven codegen emits their JS accessors (create<%= class_name %> /
+#     update<%= class_name %> / destroy<%= class_name %>). On success they
+#     drive navigation server-side via `redirect_to` (the override emits
+#     `{ "$redirect": "<path>" }`, which the runtime follows); on a validation
+#     failure they surface an always-present, attribute-keyed `errors` map via
+#     `ruact_errors` (FR98). The navigation decision lives HERE, not in React.
+#
+# NOTE: `include Ruact::Server` must come AFTER `protect_from_forgery` (inherited
+# from ApplicationController) so the CSRF check precedes these actions.
+class <%= controller_class_name %>Controller < ApplicationController
+  include Ruact::Server
+
+  # --- GET pages (rendered as RSC) -----------------------------------------
+
+  def index
+    @<%= plural_name %> = <%= class_name %>.all
+  end
+
+  def show
+    @<%= singular_name %> = <%= class_name %>.find(params[:id])
+    # FR96 opt-in (tamper-proof reference): resolve from a signed, purpose-scoped
+    # token instead of a raw, forgeable :id. Mint the token in create/update below.
+    # @<%= singular_name %> = Ruact.locate_signed(params[:<%= singular_name %>_ref], for: :<%= singular_name %>_ref)
+  end
+
+  def new
+<% reference_attributes.each do |ref| -%>
+    # Story 10.3 (AC6) — parent options for the <%= ref.name %> <Select> (ivar → prop,
+    # capped at <%= reference_options_limit %>+1). Labels: name → title → to_s.
+    @<%= ref.options_ivar %> = <%= reference_options_expr(ref) %>
+<% end -%>
+  end
+
+  def edit
+    @<%= singular_name %> = <%= class_name %>.find(params[:id])
+<% reference_attributes.each do |ref| -%>
+    @<%= ref.options_ivar %> = <%= reference_options_expr(ref) %>
+<% end -%>
+  end
+
+  # --- Writes (v2 actions → Bucket 2 JSON / $redirect) ---------------------
+
+  def create
+    <%= singular_name %> = <%= class_name %>.new(<%= singular_name %>_params)
+    if <%= singular_name %>.save
+      # FR96 opt-in: hand the client a signed, scoped, expiring handle to the
+      # saved record instead of a raw id (rides the Bucket-2 JSON as a String).
+      # @<%= singular_name %>_ref = Ruact.signed_global_id(<%= singular_name %>, for: :<%= singular_name %>_ref, expires_in: 1.hour)
+      redirect_to <%= singular_name %>
+    else
+      # FR98 — the always-present, attribute-keyed `errors` map. The form
+      # surfaces it inline (no redirect — the client stays on the form).
+      ruact_errors(<%= singular_name %>)
+      @ok = false
+    end
+  end
+
+  def update
+    <%= singular_name %> = <%= class_name %>.find(params[:id])
+    if <%= singular_name %>.update(<%= singular_name %>_params)
+      # @<%= singular_name %>_ref = Ruact.signed_global_id(<%= singular_name %>, for: :<%= singular_name %>_ref, expires_in: 1.hour)
+      redirect_to <%= singular_name %>
+    else
+      ruact_errors(<%= singular_name %>)
+      @ok = false
+    end
+  end
+
+  def destroy
+    <%= singular_name %> = <%= class_name %>.find(params[:id])
+    # `destroy!` (bang) so a destroy aborted by a callback RAISES
+    # `ActiveRecord::RecordNotDestroyed` instead of silently returning false —
+    # otherwise `@ok = true` below would lie. A `restrict_with_exception`
+    # foreign key raises `ActiveRecord::DeleteRestrictionError` either way. Both
+    # are shaped by the gem's structured-error middleware into the dev/prod
+    # failure response the dialog surfaces inline — do NOT catch them here.
+    <%= singular_name %>.destroy!
+    # DataTable in-list default (golden): NO redirect — the List removes the row
+    # in place from this `{ ok: true }` Bucket-2 JSON.
+    @ok = true
+    @id = <%= singular_name %>.id
+    # Delete-from-show alternative — land back on the index instead (the
+    # destroy<%= class_name %> accessor follows the emitted `$redirect` automatically):
+    # redirect_to <%= plural_name %>_url
+  end
+
+  # --- FR96 opt-in: a reference addressed ONLY by a signed token -------------
+  # Uncomment this action AND a matching `collection { post :publish }` route to
+  # expose an endpoint that takes NO raw :id — the record is recovered purely
+  # from the tamper-proof, purpose-scoped, expiring token minted in create/update
+  # above. A forged/expired/wrong-purpose token raises
+  # Ruact::InvalidSignedGlobalIDError → a clean structured 400 (no raw-id trust).
+  #
+  # def publish
+  #   <%= singular_name %> = Ruact.locate_signed(params[:<%= singular_name %>_ref], for: :<%= singular_name %>_ref)
+  #   <%= singular_name %>.update(published: true)
+  #   @ok = true
+  #   @id = <%= singular_name %>.id
+  # end
+
+  private
+
+  # Strong-params-style reader: each attribute is read explicitly.<% if scaffold_attributes.any?(&:boolean?) %> A boolean
+  # field is coerced to a real boolean (it may arrive as "true"/"on" over the wire).<% end %>
+  def <%= singular_name %>_params
+    {
+<% scaffold_attributes.each do |attr| -%>
+<% if attr.boolean? -%>
+      <%= attr.column_name %>: ActiveModel::Type::Boolean.new.cast(params[:<%= attr.column_name %>]),
+<% else -%>
+      <%= attr.column_name %>: params[:<%= attr.column_name %>],
+<% end -%>
+<% end -%>
+    }
+  end
+end

data/lib/generators/ruact/scaffold/templates/queries/application_query.rb.tt

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+# Base class for the app's v2 server QUERIES (Story 9.4 contract). Mirrors the
+# app/controllers/application_controller.rb convention — a thin host base every
+# concrete query inherits. The context accessors (current_user, params, request,
+# session) come from Ruact::Query and are inherited, so they never appear in
+# public_instance_methods(false) and are NOT mounted as routes.
+#
+# Created by `ruact:scaffold` the first time a resource introduces a query
+# (`ruact:install` does not ship it). A second scaffold never clobbers it, so
+# customise this base freely.
+class ApplicationQuery < Ruact::Query
+end

data/lib/generators/ruact/scaffold/templates/queries/query.rb.tt

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+# Read side of the CRUD. Each public instance method becomes one named GET
+# route when mounted with `ruact_queries <%= query_class_name %>`:
+#
+#   GET /q/search  → <%= query_class_name %>#search(q:)  → useQuery(<%= js_search_alias %>, { q })  (list search box)
+#
+# NOTE: there is deliberately NO whole-list query — the index list is
+# server-rendered as props (see <%= controller_class_name %>Controller#index). A query is only the
+# right tool when the *client* drives the read; here that's the search box.
+class <%= query_class_name %> < ApplicationQuery
+  # Client-driven search (FR88 kwargs). A blank/nil `q` returns the whole list;
+  # otherwise a case-insensitive match over the model's string/text columns. THIS
+  # is what justifies a query — the result depends on live client input, not on
+  # what the server already had. Rows are the SAME shape the index serializes, so
+  # the search results and the server-rendered props are interchangeable.
+  def search(q:)
+    term = q.to_s.strip
+    scope =
+<% if searchable_attributes.empty? -%>
+      # No string/text columns to match on — a text search can only match
+      # nothing, so a non-blank query returns an empty set (a blank box is idle).
+      term.empty? ? <%= class_name %>.all : <%= class_name %>.none
+<% else -%>
+      if term.empty?
+        <%= class_name %>.all
+      else
+        # `sanitize_sql_like` escapes user-supplied `%`/`_` (with `!`) so they
+        # match literally; the value is bound (`:needle`), never interpolated.
+        # `ESCAPE '!'` is explicit so the escape is honored on SQLite too (it has
+        # no default LIKE escape char, unlike Postgres/MySQL). Column names are
+        # quoted per-adapter so a column that is a SQL reserved word (`order`,
+        # `select`, …) does not break the query.
+        needle = "%#{<%= class_name %>.sanitize_sql_like(term.downcase, "!")}%"
+        columns = %w[<%= searchable_attributes.map(&:column_name).join(' ') %>]
+        clause = columns.map do |column|
+          "LOWER(#{<%= class_name %>.connection.quote_column_name(column)}) LIKE :needle ESCAPE '!'"
+        end.join(" OR ")
+        <%= class_name %>.where(clause, needle: needle)
+      end
+<% end -%>
+    # Order by `id` (always present) — newest-first without assuming timestamps.
+    scope.order(id: :desc).map { |record| as_row(record) }
+  end
+
+  private
+
+  # The wire row — must match <%= controller_class_name %>Controller#index's serialization
+  # (the `serialized_row` grain) so query results and server-rendered props are
+  # interchangeable in <%= class_name %>List.
+  def as_row(record)
+    {
+      id: record.id,
+<% scaffold_attributes.each do |attr| -%>
+      <%= attr.column_name %>: <%= row_value_expr('record', attr) %><%= attr == scaffold_attributes.last ? '' : ',' %>
+<% end -%>
+    }
+  end
+end

data/lib/generators/ruact/scaffold/templates/request_spec.rb.tt

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+# Smoke spec for the generated <%= class_name %>Controller (Story 10.1 skeleton).
+#
+# PREREQUISITES (the model + migration are now generated for you — ruact:scaffold
+# delegates them to Rails' own `resource` generator (FR102), so after
+# `rails db:migrate` this resource is ready, with no manual model step):
+#   1. rspec-rails (`rails_helper`).
+#   2. a built client manifest (`react-client-manifest.json`) so the RSC GET
+#      index can resolve `<<%= class_name %>List />` — run the Vite build / dev
+#      server (or your test bootstrap) before the suite.
+<% if scaffold_attributes.any?(&:reference?) -%>
+#   3. this scaffold has a `references` column — adjust `valid_attributes` below
+#      to a REAL associated record id (the placeholder `1` assumes one exists;
+#      a required `belongs_to` will reject a dangling id).
+<% end -%>
+#
+# With those in place this passes unmodified. It is a LIGHT smoke of the v2
+# contract — not full coverage: RSC GET index, the Bucket-2 JSON create
+# happy-path (server-driven `$redirect`), the FR98 keyed `errors` channel, and
+# destroy. Add real coverage as the resource grows.
+require "rails_helper"
+
+RSpec.describe "<%= class_name.pluralize %>", type: :request do
+  # Every imperative accessor call (create<%= class_name %>/update<%= class_name %>/destroy<%= class_name %>) sends
+  # this exact header — it is what routes the action into the Bucket-2 JSON path.
+  let(:bucket_two) { { "Accept" => "application/json" } }
+
+  let(:valid_attributes) do
+    {
+<% scaffold_attributes.each do |attr| -%>
+      <%= attr.column_name %>: <%= sample_value(attr) %>,
+<% end -%>
+    }
+  end
+
+  describe "GET /<%= plural_name %>" do
+    it "renders the index (200)" do
+      get "/<%= plural_name %>"
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe "POST /<%= plural_name %> (Bucket 2)" do
+    it "creates a <%= singular_name %> and drives a server-side redirect" do
+      expect do
+        post "/<%= plural_name %>", params: valid_attributes, headers: bucket_two
+      end.to change(<%= class_name %>, :count).by(1)
+
+      # Success path is a server-driven redirect the runtime follows ($redirect).
+      expect(response.parsed_body).to be_a(Hash).and(have_key("$redirect"))
+    end
+
+    it "rides the FR98 keyed `errors` contract" do
+      # Empty params. If the model declares a validation it fails → an
+      # attribute-keyed `errors` map; if it does not, the create succeeds and
+      # the server redirects. Either branch upholds the v2 contract.
+      post "/<%= plural_name %>", params: {}, headers: bucket_two
+      body = response.parsed_body
+      expect(body).to be_a(Hash)
+      if body.key?("errors")
+        expect(body["errors"]).to be_a(Hash)
+      else
+        expect(body).to have_key("$redirect")
+      end
+    end
+  end
+
+  describe "DELETE /<%= plural_name %>/:id (Bucket 2)" do
+    it "destroys the <%= singular_name %>" do
+      <%= singular_name %> = <%= class_name %>.create!(valid_attributes)
+      expect do
+        delete "/<%= plural_name %>/#{<%= singular_name %>.id}", headers: bucket_two
+      end.to change(<%= class_name %>, :count).by(-1)
+    end
+  end
+end

data/lib/generators/ruact/scaffold/templates/views/edit.html.erb.tt

@@ -0,0 +1,7 @@
+<%%# <%= class_name %> edit — the shared form with the record serialized to a plain
+    row hash (initial != null = edit mode). No as_json on the model. %>
+<%% initial = <%= serialized_row("@#{singular_name}") %> %>
+<% reference_attributes.each do |ref| -%>
+<%% <%= ref.options_ivar %> = @<%= ref.options_ivar %> %>
+<% end -%>
+<<%= class_name %>Form initial={initial}<% reference_attributes.each do |ref| %> <%= ref.options_prop %>={<%= ref.options_ivar %>}<% end %> />

data/lib/generators/ruact/scaffold/templates/views/index.html.erb.tt

@@ -0,0 +1,6 @@
+<%%# <%= class_name %> index — the list is SERVER-RENDERED and handed to React as
+    props. The data is already in hand at render time, so it ships inline in the
+    Flight payload: no client query, no loading flash. The ivar is serialized to
+    plain row hashes here in the view (no as_json on the model). %>
+<%% rows = @<%= plural_name %>.map { |<%= singular_name %>| <%= serialized_row(singular_name) %> } %>
+<<%= class_name %>List posts={rows} />

data/lib/generators/ruact/scaffold/templates/views/new.html.erb.tt

@@ -0,0 +1,5 @@
+<%%# <%= class_name %> new — the shared form in create mode (no initial data). %>
+<% reference_attributes.each do |ref| -%>
+<%% <%= ref.options_ivar %> = @<%= ref.options_ivar %> %>
+<% end -%>
+<<%= class_name %>Form<% reference_attributes.each do |ref| %> <%= ref.options_prop %>={<%= ref.options_ivar %>}<% end %> />

data/lib/generators/ruact/scaffold/templates/views/show.html.erb.tt

@@ -0,0 +1,16 @@
+<%%# <%= class_name %> show — a PLAIN Rails view (no React component). It still goes
+    through the RSC pipeline — the HTML becomes host React elements in the Flight
+    tree — so "just Rails" and React components sit in one React application. %>
+<article style="font-family:system-ui,sans-serif;max-width:640px;margin:2rem auto;padding:0 1rem">
+  <p style="margin-bottom:4px"><a href="/<%= plural_name %>">← All <%= plural_name %></a></p>
+
+  <h1 style="margin-bottom:16px"><%= human_name %> #<%%= @<%= singular_name %>.id %></h1>
+
+<% scaffold_attributes.each do |attr| -%>
+  <p style="margin:4px 0"><strong><%= attr.column_name.humanize %>:</strong> <%%= @<%= singular_name %>.<%= attr.column_name %> %></p>
+<% end -%>
+
+  <p style="margin-top:24px">
+    <a href="/<%= plural_name %>/<%%= @<%= singular_name %>.id %>/edit">Edit</a>
+  </p>
+</article>