turbo_form 0.4.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e9cee9bf341b5d0a6bf59ac5334065a7c71f66c0cfe99636471af207054c6484
-  data.tar.gz: 6d60f46ff0e7e74e43ba80a6db207a7fc5d30cf79afb0a7baf5ca8fa3a08fad5
+  metadata.gz: 1ea880fbc0453b32344bf09706c5bc68c095de36fdbea018f00fdf4adc7acc03
+  data.tar.gz: 49bf3d131c1a1179d8ce8b64772e23681f1c54332797bca9cd46589c4d0c90d3
 SHA512:
-  metadata.gz: 87318b7b8397c9e71d1754cea8b527f7d813865b6ad8d4101183494f8788815b1f77ea3a22053b0cfe7ec2418a9f644b21380bde114839ba98adf6b38d155241
-  data.tar.gz: b62767b018f4c05fce71f7af5060d68526d0c4bfb3f47d6b872405f89c879489f4d4320b93a09d2e55f452b3c158b3ac0af4520d8567788e6d32ee3548d5dbdd
+  metadata.gz: 300aabd3ad77727c57ddf99980ce56036e4f5fdbf6c001a31908dcef1f0f53408b4100cf21fa1b88abfd663f2adab10dd14003d90e1915136231e62576b1e2d6
+  data.tar.gz: 24ec9eabed896e9de6f14c71b70e3f6aa8bc299244fcf3858146b55bf5d78c76549e4e08acdaaa6c0f77b13b6713183fabc2c469347c3a59df7e7dd477ed6ff9

data/README.md

@@ -1,6 +1,6 @@
 # turbo_form
 
-Turbo-Stream backed dynamic forms for Rails, by convention.
+Dynamic forms for Rails, by convention.
 
 A form that needs to change as it is filled in — a dependent dropdown, a section
 that appears once you pick a type — usually costs you a route, a controller
@@ -10,26 +10,19 @@ instead:
 ```erb
 <%= form_for @widget, dynamic: true do |f| %>
   <%= f.select :category, @widget.categories, {}, dynamic_trigger: true %>
-
-  <div id="flavor-field">
-    <%= f.select :flavor, @widget.flavors %>
-  </div>
+  <%= f.select :flavor, @widget.flavors %>
 <% end %>
 ```
 
-Pick a category and the form is sent to the server as it currently stands. The
-server rebuilds `@resource` from what you typed and renders
-`app/views/widgets/dynamic_form.turbo_stream.erb`:
-
-```erb
-<%= fields model: @resource do |f| %>
-  <%= turbo_stream.update "flavor-field" do %>
-    <%= f.select :flavor, @resource.flavors %>
-  <% end %>
-<% end %>
-```
+Pick a category and the form is sent to the page it is on. That page's own
+action builds `@widget`, the form's values are assigned to it, and the page's
+own template renders it — so `@widget.flavors` answers for the category just
+picked. Turbo morphs the page in place, so focus, scroll and everything else
+typed survive.
 
-That's the whole feature. No route, no controller, no JavaScript.
+No new action, no template, no JavaScript to write. The page is rendered by its
+own controller, so its authentication, authorization and partials are the ones
+it always had.
 
 ## Installation
 
@@ -37,72 +30,61 @@ That's the whole feature. No route, no controller, no JavaScript.
 gem "turbo_form"
 ```
 
-There is nothing to mount. On a stock Rails app — Propshaft, importmap-rails,
-stimulus-rails — the Stimulus controller registers itself and there is nothing
-to generate either. If your app bundles with esbuild, Vite, Bun or webpack:
+Then run the installer:
 
 ```bash
 rails generate turbo_form:install
 ```
 
-See [JavaScript](#javascript) for what that does and how to do it by hand.
+It includes `TurboForm::Controller` in your ApplicationController and declares
+the route concern:
 
-## The two options
-
-### `dynamic:` on the form
-
-`dynamic: true` makes the form dynamic. When a trigger fires, the gem renders a
-template named `dynamic_form`, looked up just as the controller that rendered
-the form would look up one of its own views:
+```ruby
+class ApplicationController < ActionController::Base
+  include TurboForm::Controller
+end
+```
 
-- A form rendered by `WidgetsController` gets
-  `widgets/dynamic_form.turbo_stream.erb`.
-- If that doesn't exist, lookup follows controller inheritance, ending at
-  `application/dynamic_form.turbo_stream.erb`.
-- Partials resolve the same way, so `render "fields"` inside the template finds
-  `widgets/_fields`, just as it would in the form itself.
+```ruby
+concern :turbo_form, TurboForm::Routes
+```
 
-To render a different template, pass its name instead of `true`:
+Draw the concern on each resource with a dynamic form — the installer leaves
+which ones to you:
 
-```erb
-<%= form_for @widget, dynamic: "shared/refresh_widget" %>
+```ruby
+resources :widgets, concerns: :turbo_form
 ```
 
-### `dynamic_trigger:` on a field
+It draws a PATCH beside whichever of `new` and `edit` the resource has, so
+`resources :widgets, only: %i[new create], concerns: :turbo_form` gets only the
+one for `new`.
 
-```erb
-<%= f.text_field :name, dynamic_trigger: true %>       <%# on the default event %>
-<%= f.text_field :name, dynamic_trigger: :blur %>      <%# on a named event %>
-```
+It also imports the script into `app/javascript/application.js`, adding the npm
+package first if your app bundles with esbuild, Vite, Bun or webpack; see
+[JavaScript](#javascript) for doing that by hand.
+
+## The two options
 
-`true` lets Stimulus pick the element's natural event: `change` for a select or
-checkbox, `input` for a text field, `click` for a button. Name an event when you
-want something else — `:blur` on text fields is usually what you want, since the
-default fires on every keystroke.
+### `dynamic:` on the form
 
-#### Sending the form somewhere else
+`dynamic: true` makes the form dynamic: a trigger sends it to the `new` or `edit`
+page of its model — `edit` once the record is saved — which is where
+`TurboForm::Routes` listens.
 
-A trigger can answer to a different endpoint than its own form, and can add to
-what the form sends:
+### `dynamic_trigger:` on a field
 
 ```erb
-<%= f.button "Run", type: "button", dynamic_trigger: {
-      event: :click,
-      url: formula_preview_widgets_path,
-      params: { attribute: :rafter_count }
-    } %>
+<%= f.text_field :name, dynamic_trigger: true %>       <%# on the default event %>
+<%= f.text_field :name, dynamic_trigger: :blur %>      <%# on a named event %>
 ```
 
-`url:` replaces the form's own endpoint for that one trigger; everything else on
-the form keeps using the form's. `params:` are appended to the submitted form
-data, so one endpoint can tell which of several triggers asked. Both are
-optional, and either can be given without the other.
-
-That endpoint is yours, not the gem's — it's an ordinary action rendering an
-ordinary turbo_stream template, so the whole form arrives as `params` under its
-usual scope. Use it when one form feeds several actions: a dozen fields that
-each preview themselves, or a select that belongs to a nested form with its own
-controller.
+`true` picks the element's natural event: `change` for a select, `click` for a
+submit button, `input` for everything else. Name an event when you want
+something else — `:blur` on text fields is usually what you want, since the
+default fires on every keystroke. Any event name works, including custom ones
+dispatched by other Stimulus controllers — `dynamic_trigger: "autocomplete:selected"`
+— as long as the event is dispatched on the field or bubbles up from inside it.
 
 Works on every Rails field helper, including the select and date families where
 Rails keeps HTML attributes in a separate hash:
@@ -121,124 +103,90 @@ inherits from, so it works without SimpleForm being involved at all:
   = f.input :category, input_html: { dynamic_trigger: true }
 ```
 
-## What the endpoint does
+## What a trigger does
 
-A `dynamic: true` form carries a signed description of itself to a single
-endpoint the gem draws into your routes. Given a valid signature it:
+A trigger PATCHes the whole form to its own page — `/widgets/new` or
+`/widgets/:id/edit` — which the route concern sends to that page's own action.
+The request:
 
-1. permits the submitted parameters wholesale,
-2. rebuilds the form's object and assigns them to it — an edit form's record is
-   found again by id, and a new form's object is rebuilt from the attributes it
-   was built with (a parent's foreign key from `@order.line_items.new`, say) before
-   the submitted ones are applied,
-3. assigns it to `@resource`,
-4. runs `TurboForm.before_render` inside the controller with the resource, if one is set,
-5. renders the turbo_stream template.
+1. runs `new` or `edit` as an ordinary visit would, callbacks and all, building
+   `@widget` the way it always does — found by id, built from a parent,
+   whatever it does,
+2. assigns `widget_params` to it,
+3. renders the page's own template,
 
-Nothing is persisted. `@resource` exists to be asked what the form should now
-look like, not to be saved — and since Active Record saves some assignments on
-the spot (`has_many` writers, `*_ids=`), an Active Record resource is rebuilt
-inside a transaction that is always rolled back.
+all inside a database transaction that is always rolled back.
 
-The signature covers the class name, the parameter scope, the template, the view
-paths the form was rendered under, and the record's id or starting attributes. It is signed because the endpoint
-constantizes, loads and renders what it names; none of that may come from the
-browser unverified. It is not encrypted, so those starting attributes are
-readable in the page, as the form itself is.
+Because the values are assigned in the controller, before anything renders, the
+whole page sees what was typed — the layout, the template above the form, and
+the form itself.
 
-## Configuration
+The rollback is there because Active Record saves some assignments on the spot
+(`has_many` writers, `*_ids=`). A trigger exists to render, so nothing it does is
+kept — including anything else the action or its callbacks write.
 
-```ruby
-# config/initializers/turbo_form.rb
+### The conventions it leans on
 
-# The endpoint inherits from this, so your authentication applies to it. Point
-# it at a narrower controller when that inheritance brings something the
-# endpoint shouldn't have.
-TurboForm.parent_controller = "ApplicationController"
+turbo_form knows nothing about your resource beyond its controller's name.
+For a `WidgetsController`:
 
-# Draw the route yourself instead.
-TurboForm.draw_routes = false
+- `new` and `edit` set `@widget`,
+- `widget_params` permits the form's fields — the same method `create` and
+  `update` already use, so a trigger assigns nothing a save wouldn't,
+- `new` and `edit` leave rendering to Rails. The values are assigned just before
+  Rails' implicit render, so an action that calls `render` itself renders its
+  object as it built it, and one that redirects still redirects.
 
-# Run something before the render. See below.
-TurboForm.before_render = ->(resource) { }
-```
+### Switching an STI subclass
 
-### `before_render`
+When the submitted values include the inheritance column, the object is switched
+to the subclass it names, with `becomes`, before assigning — so a `type` select
+can turn a `Gizmo` into a `Doohickey` and the rest of the page answers as one.
+Give the form its base class's scope (`scope: :gadget`) so the switched object
+reads and posts under the same name, and permit `type` in the params method.
 
-The endpoint is a controller you never wrote, inheriting filters written for
-controllers that save things. `before_render` is where you get to treat it like
-one of your own: it runs in a `before_action`, after the signature is verified
-and the resource is built, and is handed that resource. It runs *inside* the
-controller, so its protected helpers — Pundit's among them — are in reach.
+### Inside a Turbo Frame
 
-Satisfy a filter the endpoint can't — the most common need, since nothing here
-is authorized because nothing here is saved:
+A form inside a `<turbo-frame>`, or one naming a frame with
+`data-turbo-frame`, asks for that frame alone: the request carries the
+`Turbo-Frame` header, turbo-rails renders without the layout, and only the frame
+is morphed. A frame's own `target` is followed, and `_top` means the whole page,
+as they do for Turbo. While the request is out, the form and its frame are `aria-busy`, and the
+frame `busy`, the way Turbo marks a submission.
 
-```ruby
-# Pundit's after_action :verify_authorized
-TurboForm.before_render = ->(resource) { skip_authorization }
-
-# Action Policy's verify_authorized
-TurboForm.before_render = ->(resource) { skip_verify_authorized! }
-```
+### After a failed save
 
-Or authorize it for real, if re-rendering a form is something you'd rather gate.
-Name the query explicitly: the endpoint's action is `update`, which is not the
-permission you mean.
-
-```ruby
-# Pundit
-TurboForm.before_render = ->(resource) { authorize resource, :edit? }
-
-# Action Policy
-TurboForm.before_render = ->(resource) { authorize! resource, to: :edit? }
-
-# CanCanCan -- this also satisfies `check_authorization`, which has no runtime skip
-TurboForm.before_render = ->(resource) { authorize! :edit, resource }
-```
-
-Raising works the way it does in any `before_action`: your
-`rescue_from`s catch it, since the endpoint inherits them too. Rendering or
-redirecting halts the chain as usual.
+A trigger sends the form to its model's `new` or `edit` page, not to whatever
+URL the browser is on, so a trigger after rendering `:new` from a failed
+`create` still reaches the right action. The object it builds is fresh and has
+not been validated, so the error messages go away.
 
 ## JavaScript
 
-**importmap-rails** — nothing to do. The engine pins its controller as
-`controllers/turbo_form_controller`, which the `eagerLoadControllersFrom` /
-`lazyLoadControllersFrom` in a stock `app/javascript/controllers/index.js`
-registers as `turbo-form` on its own.
-
-If you hand-wrote that file, register it yourself:
+There is no Stimulus controller to register. The script listens on the document
+for triggers, so it only has to be imported once:
 
 ```js
-import TurboFormController from "controllers/turbo_form_controller"
-application.register("turbo-form", TurboFormController)
+// app/javascript/application.js
+import "turbo_form"             // importmap-rails: the engine pins it
+import "@rolemodel/turbo-form"  // esbuild, Vite, Bun, webpack
 ```
 
-**esbuild, Vite, Bun, webpack** — there is no sweep to pick the controller up,
-so the package has to be installed alongside the gem, at the same version, and
-registered. `rails generate turbo_form:install` does both: it adds the package
-with whichever manager your lockfile names, and writes
+Bundled apps install the npm package alongside the gem, at the same version.
+`rails generate turbo_form:install` does that with whichever package manager
+your lockfile names, and adds the import.
+
+To send a form from your own code, import `refresh`:
 
 ```js
-// app/javascript/controllers/turbo_form_controller.js
-import TurboFormController from "@rolemodel/turbo-form"
+import { refresh } from "turbo_form"
 
-export default TurboFormController
+refresh(document.querySelector("form[data-turbo-form-url]"))
 ```
 
-Registering by *filename* rather than by appending to
-`app/javascript/controllers/index.js` is deliberate. That file is regenerated
-from the contents of the directory every time `rails generate stimulus` runs, so
-a registration appended to it lasts until the next controller you generate. A
-file named `turbo_form_controller.js` is picked up by that same regeneration and
-registered as `turbo-form`, every time.
-
-To do it by hand, write that file yourself and run `rails stimulus:manifest:update`.
-
 ### Testing against it
 
-A re-render is a round trip, so the line after a trigger is racing it. Wrap the
+A trigger is a round trip, so the line after it is racing it. Wrap the
 trigger and the wait comes with it:
 
 ```ruby
@@ -247,16 +195,26 @@ select "Barrel Aged", from: "Flavor"
 ```
 
 `expect_dynamic_form_request` is available in system tests with nothing to
-require or include — Minitest and RSpec both. It waits on the controller's
-count of completed round trips rather than on the fields that came back, so it
-doesn't care what the response changed. Scope it with Capybara's `within` when
-a page carries more than one dynamic form.
+require or include — Minitest and RSpec both. It waits on a count of
+completed triggers kept on `<html>` rather than on the fields that came back, so
+it doesn't care what the trigger changed.
 
 ## What this deliberately doesn't do
 
-It handles the common case well and gets out of the way otherwise. There is no
-debouncing, no request cancellation and no loading state. When you need those, write the action by hand — that path is still open,
-and this gem doesn't stand in front of it.
+It handles the common case well and gets out of the way otherwise.
+
+- **No debouncing, request cancellation or loading state** beyond `aria-busy`.
+  Write the action by hand when you need those — that path is still open.
+- **Resourceful pages only.** The form's URL comes from its model, so a page
+  whose `new` or `edit` isn't the model's own route has nowhere to send it.
+- **Not a Turbo form submission.** Turbo renders a form's response only when it
+  redirects or fails, so the trigger fetches the form itself and hands the
+  response to a Turbo visit. Turbo renders the page — its morph, render events,
+  error page and progress bar — but there are no `turbo:submit-start`,
+  `turbo:submit-end` or `turbo:before-fetch-request` events. A frame is morphed
+  directly, without Turbo's frame render events.
+- **Only the primary database is rolled back**, and only writes: jobs enqueued
+  or mail sent during a trigger still happen.
 
 ## License
 

data/app/assets/javascripts/turbo_form.js

@@ -1,44 +1,156 @@
-import { Controller } from "@hotwired/stimulus"
 import { Turbo } from "@hotwired/turbo-rails"
 
-// Re-renders the form it is attached to, from the server, as a Turbo Stream.
+// PATCHes the form, as it stands, to the page it is on. The server runs that
+// page's own action, assigns the form to its object and renders its own
+// template, which is morphed in so focus, scroll and everything typed survive.
+// Inside a frame, only the frame is asked for and morphed, as Turbo would.
 //
-// The whole form is submitted so the server sees exactly the state the user is
-// looking at; nothing is saved, and the response only describes what should
-// change on screen.
-export default class extends Controller {
-  static values = { url: String, requests: Number }
-
-  // A trigger can send the form somewhere other than the form's own endpoint,
-  // and can add to what it sends. Both ride in as Stimulus action params, so
-  // one form can feed several actions without needing several forms.
-  async perform({ params: { url, query } }) {
-    const body = new FormData(this.element)
-
-    if (query) Object.entries(query).forEach(([name, value]) => body.append(name, value))
-
-    const response = await fetch(url || this.urlValue, {
-      method: "PATCH",
-      headers: this.#headers,
-      body
+// Fetched rather than submitted through Turbo, which renders a form response
+// only if it redirects or fails. The page is still rendered by Turbo: a visit
+// handed the response, so its events, error page and progress bar all apply. A
+// frame is morphed directly, since Turbo's frame loading wants its own
+// unexported response object.
+export function refresh(form) {
+  return new FormRefresh(form).start()
+}
+
+// Shaped like Turbo's FormSubmission, which is what its navigator expects to be
+// told about.
+class FormRefresh {
+  constructor(formElement) {
+    this.formElement = formElement
+    this.location = new URL(formElement.dataset.turboFormUrl, location.href)
+    this.target = targetFor(formElement)
+  }
+
+  async start() {
+    this.requestStarted()
+    try {
+      const response = await Turbo.fetch(this.location, { method: "PATCH", body: new FormData(this.formElement), headers: this.target.headers })
+
+      this.target.render(response.status, await response.text())
+    } finally {
+      this.requestFinished()
+    }
+  }
+
+  requestStarted() {
+    markAsBusy(this.formElement, ...this.target.elements)
+    Turbo.navigator.formSubmissionStarted(this)
+  }
+
+  requestFinished() {
+    clearBusyState(this.formElement, ...this.target.elements)
+    Turbo.navigator.formSubmissionFinished(this)
+  }
+}
+
+class PageTarget {
+  elements = []
+  headers = { Accept: "text/html" }
+
+  render(statusCode, responseHTML) {
+    document.addEventListener("turbo:load", countVisit, { once: true })
+    Turbo.visit(location.href, {
+      action: "replace",
+      shouldCacheSnapshot: false,
+      refresh: { method: "morph", scroll: "preserve" },
+      response: { statusCode, responseHTML }
     })
+  }
+}
+
+class FrameTarget {
+  constructor(element) {
+    this.element = element
+    this.elements = [ element ]
+  }
+
+  get headers() {
+    return { Accept: "text/html", "Turbo-Frame": this.element.id }
+  }
+
+  render(_statusCode, responseHTML) {
+    const frame = new DOMParser().parseFromString(responseHTML, "text/html").getElementById(this.element.id)
 
-    if (!response.ok) return
+    Turbo.morphTurboFrameElements(this.element, frame)
+    countVisit()
+  }
+}
+
+// Turbo's own targeting: the form's data-turbo-frame, then the target of the
+// frame it sits in, then that frame itself. "_top" means the page.
+function targetFor(form) {
+  const enclosing = form.closest("turbo-frame")
+  const id = form.dataset.turboFrame || enclosing?.getAttribute("target")
+  const frame = id === "_top" ? null : id ? document.getElementById(id) : enclosing
+
+  return frame ? new FrameTarget(frame) : new PageTarget()
+}
+
+const triggerSelector = "[data-turbo-form-trigger]"
+
+// Shaped like Turbo's observers. One listener per event the page's triggers
+// name, on the event target and in the capture phase, so fields rendered later
+// are covered and events that don't bubble, like blur, still arrive. New names
+// are picked up as triggers appear; the browser ignores a listener it already has.
+class TriggerObserver {
+  constructor(delegate, eventTarget) {
+    this.delegate = delegate
+    this.eventTarget = eventTarget
+    this.mutationObserver = new MutationObserver(this.listen)
+  }
+
+  start() {
+    this.listen()
+    this.mutationObserver.observe(this.eventTarget, { subtree: true, childList: true, attributeFilter: [ "data-turbo-form-trigger" ] })
+  }
 
-    Turbo.renderStreamMessage(await response.text())
+  listen = () => {
+    for (const trigger of this.eventTarget.querySelectorAll(triggerSelector)) {
+      this.eventTarget.addEventListener(eventFor(trigger), this.triggerCaptured, true)
+    }
+  }
+
+  triggerCaptured = ({ type, target }) => {
+    const trigger = target.closest?.(triggerSelector)
+    const form = trigger?.form
 
-    // Lets a system test wait on a completed round trip instead of sleeping.
-    this.requestsValue++
+    if (form?.dataset.turboFormUrl && eventFor(trigger) == type) this.delegate.triggerFired(form)
   }
+}
 
-  get #headers() {
-    const headers = { Accept: "text/vnd.turbo-stream.html" }
-    const token = document.querySelector("meta[name=csrf-token]")?.content
+// A trigger with no event named fires on its element's natural one.
+function eventFor(trigger) {
+  const named = trigger.dataset.turboFormTrigger
+  if (named) return named
+  if (trigger.localName == "select") return "change"
+  if (trigger.type == "submit") return "click"
+
+  return "input"
+}
 
-    // The form's own authenticity_token rides along in the body; this covers
-    // the forms that don't carry one.
-    if (token) headers["X-CSRF-Token"] = token
+// Turbo's own busy state, which it doesn't export.
+function markAsBusy(...elements) {
+  for (const element of elements) {
+    if (element.localName == "turbo-frame") element.setAttribute("busy", "")
+    element.setAttribute("aria-busy", "true")
+  }
+}
 
-    return headers
+function clearBusyState(...elements) {
+  for (const element of elements) {
+    if (element.localName == "turbo-frame") element.removeAttribute("busy")
+    element.removeAttribute("aria-busy")
   }
 }
+
+// Kept on <html> because a morph rewrites <body> to what the server sent, and
+// the server never knows the count. Lets a system test wait on a completed
+// reload instead of sleeping.
+function countVisit() {
+  const root = document.documentElement.dataset
+  root.turboFormVisits = Number(root.turboFormVisits || 0) + 1
+}
+
+new TriggerObserver({ triggerFired: refresh }, document).start()

data/config/turbo_form_importmap.rb

@@ -1,5 +1,3 @@
-# Keyed as `controllers/..._controller` so the stock
-# `eagerLoadControllersFrom("controllers", application)` in a Rails app finds it
-# and registers it as `turbo-form`, with nothing asked of the host. The asset
-# name is distinct so the host's own app/javascript/controllers can't shadow it.
-pin "controllers/turbo_form_controller", to: "turbo_form.js"
+# Imported once by the host's application.js, which starts its listeners. The
+# asset name is distinct so nothing in the host's app/javascript can shadow it.
+pin 'turbo_form', to: 'turbo_form.js'

data/lib/generators/turbo_form/install/install_generator.rb

@@ -1,62 +1,56 @@
-require "rails/generators"
+require 'rails/generators'
 
 module TurboForm
   module Generators
-    # There is nothing to install on importmap-rails: the engine pins its own
-    # Stimulus controller and a stock `app/javascript/controllers/index.js`
-    # registers it. Bundled apps get no such sweep, so this hands them the two
-    # things they'd otherwise write by hand -- the package and the registration.
+    # Every app gets TurboForm::Controller, the route concern its resources opt
+    # into and an import of the script. On importmap-rails the engine pins the
+    # script itself; bundled apps get the npm package to import instead.
     class InstallGenerator < Rails::Generators::Base
-      source_root File.expand_path("templates", __dir__)
-
       LOCKFILES = {
-        "yarn.lock" => "yarn add", "pnpm-lock.yaml" => "pnpm add",
-        "bun.lock" => "bun add", "bun.lockb" => "bun add"
+        'yarn.lock' => 'yarn add', 'pnpm-lock.yaml' => 'pnpm add',
+        'bun.lock' => 'bun add', 'bun.lockb' => 'bun add'
       }.freeze
 
+      ENTRYPOINT = 'app/javascript/application.js'
+
       def install
-        if importmap?
-          say "turbo_form registers its own Stimulus controller on importmap-rails. Nothing to install."
-          return
-        end
-
-        install_package
-        register_controller
-        update_stimulus_manifest
+        include_controller
+        declare_route_concern
+        install_package unless importmap?
+        import_script
       end
 
       private
-        def importmap? = Rails.root.join("config/importmap.rb").exist?
-
-        def install_package
-          run "#{package_manager} #{package}"
-        end
-
-        # Named for the controller it is, rather than imported into `index.js`:
-        # that file is rewritten wholesale every time `rails generate stimulus`
-        # runs, and would take a registration appended to it down with it. The
-        # manifest is generated from this directory instead, so a file named
-        # this way is picked back up every time and registered as `turbo-form`.
-        def register_controller
-          copy_file "turbo_form_controller.js", "app/javascript/controllers/turbo_form_controller.js"
-        end
-
-        # Left to Stimulus' own task rather than written here, the way the
-        # `stimulus` generator does it: the task is what the app already trusts
-        # to regenerate this file, and its internals have moved between releases.
-        def update_stimulus_manifest
-          return unless Rails.root.join("app/javascript/controllers/index.js").exist?
-
-          rails_command "stimulus:manifest:update"
-        end
-
-        def package = "@rolemodel/turbo-form@#{TurboForm::VERSION}"
-
-        # Matched to the lockfile that is already there, so the generator doesn't
-        # introduce a second package manager to an app that settled on one.
-        def package_manager
-          LOCKFILES.find { |lockfile, _| Rails.root.join(lockfile).exist? }&.last || "npm install"
-        end
+      def include_controller
+        inject_into_class 'app/controllers/application_controller.rb', 'ApplicationController', "  include TurboForm::Controller\n"
+      end
+
+      # Declared once, drawn on no resource: which forms are dynamic is the
+      # app's call, one `concerns: :turbo_form` at a time.
+      def declare_route_concern
+        route 'concern :turbo_form, TurboForm::Routes'
+      end
+
+      def importmap? = Rails.root.join('config/importmap.rb').exist?
+
+      def install_package
+        run "#{package_manager} #{package}"
+      end
+
+      def import_script
+        import = %(import "#{importmap? ? "turbo_form" : "@rolemodel/turbo-form"}"\n)
+        return say("Add #{import.strip} to your JavaScript entrypoint.") unless Rails.root.join(ENTRYPOINT).exist?
+
+        append_to_file ENTRYPOINT, import
+      end
+
+      def package = "@rolemodel/turbo-form@#{TurboForm::VERSION}"
+
+      # Matched to the lockfile that is already there, so the generator doesn't
+      # introduce a second package manager to an app that settled on one.
+      def package_manager
+        LOCKFILES.find { |lockfile, _| Rails.root.join(lockfile).exist? }&.last || 'npm install'
+      end
     end
   end
 end

data/lib/turbo_form/controller.rb

@@ -0,0 +1,60 @@
+module TurboForm
+  # Included into the host's ApplicationController. A request that
+  # TurboForm::Routes marks runs `new` or `edit` as usual, callbacks and all,
+  # then assigns the form to what the action built just before the implicit
+  # render.
+  #
+  # Leans on the scaffold's conventions: the action builds `@<resource>`,
+  # `<resource>_params` permits the form, and the action leaves rendering to Rails.
+  module Controller
+    private
+    def process_action(...)
+      dynamic_form? ? discarding_writes { super } : super
+    end
+
+    def default_render
+      dynamic_form_assignment if dynamic_form?
+      super
+    end
+
+    def dynamic_form_assignment
+      resource = turbo_form_resource.extend(TurboForm::Resource).dynamic_assign(turbo_form_resource_params)
+      instance_variable_set(:"@#{turbo_form_resource_name}", resource)
+    end
+
+    def dynamic_form? = request.path_parameters[:dynamic_form]
+    def turbo_form_resource = instance_variable_get(:"@#{turbo_form_resource_name}")
+    def turbo_form_resource_params = send(:"#{turbo_form_resource_name}_params")
+    def turbo_form_resource_name = controller_name.singularize
+
+    # Active Record saves `has_many` writers and `*_ids=` on assignment, and
+    # this request exists only to render.
+    def discarding_writes
+      return yield unless defined?(ActiveRecord::Base)
+
+      ActiveRecord::Base.transaction do
+        yield
+        raise ActiveRecord::Rollback
+      end
+    end
+  end
+
+  # Switches to the STI subclass the submitted `type` names before assigning, so
+  # nested records land on the object that is kept -- which is returned.
+  module Resource
+    def dynamic_assign(params)
+      retype(params).tap { it.assign_attributes(params) }
+    end
+
+    private
+    def retype(params)
+      type = inheritance_column && params[inheritance_column]
+      return self if type.blank?
+
+      subclass = self.class.sti_class_for(type)
+      instance_of?(subclass) ? self : becomes!(subclass)
+    end
+
+    def inheritance_column = self.class.try(:inheritance_column)
+  end
+end

data/lib/turbo_form/engine.rb

@@ -1,33 +1,30 @@
-require "turbo-rails"
-require "turbo_form/form_helper"
-require "turbo_form/form_builder"
-require "turbo_form/signature"
+require 'turbo-rails'
+require 'turbo_form/form_helper'
+require 'turbo_form/form_builder'
+require 'turbo_form/routes'
+require 'turbo_form/controller'
 
 module TurboForm
-  # Deliberately *not* `isolate_namespace`: the template this engine renders
-  # belongs to the host, and isolating would point its route helpers at this
-  # engine's own (empty) route set -- so `widgets_path` in a host's
-  # dynamic_form template would raise.
   class Engine < ::Rails::Engine
     # importmap-rails reads config.importmap.paths exactly once, in its own
     # `importmap` initializer, and draws the host's pins last -- so appending
     # here both registers ours and leaves the host able to override them.
     # The guard keeps esbuild/vite/bun hosts booting; a `before:` naming an
     # initializer that doesn't exist is itself harmless.
-    initializer "turbo_form.importmap", before: "importmap" do |app|
+    initializer 'turbo_form.importmap', before: 'importmap' do |app|
       next unless app.config.respond_to?(:importmap)
 
-      app.config.importmap.paths << root.join("config/turbo_form_importmap.rb")
-      app.config.importmap.cache_sweepers << root.join("app/assets/javascripts")
+      app.config.importmap.paths << root.join('config/turbo_form_importmap.rb')
+      app.config.importmap.cache_sweepers << root.join('app/assets/javascripts')
     end
 
     # Propshaft puts every engine's app/assets/* on the load path by itself.
     # Sprockets additionally wants the asset named, or the pin above silently
     # resolves to nothing.
-    initializer "turbo_form.assets" do |app|
+    initializer 'turbo_form.assets' do |app|
       next unless app.config.respond_to?(:assets)
 
-      app.config.assets.precompile << "turbo_form.js"
+      app.config.assets.precompile << 'turbo_form.js'
     end
 
     # Minitest's system tests descend from ActionDispatch::SystemTestCase, so
@@ -35,9 +32,9 @@ module TurboForm
     # assembles itself from Action Dispatch's parts instead of inheriting the
     # case -- so they need telling separately, once RSpec is loaded but before
     # any example group has been defined.
-    initializer "turbo_form.system_test_helper" do
+    initializer 'turbo_form.system_test_helper' do
       ActiveSupport.on_load(:action_dispatch_system_test_case) do
-        require "turbo_form/system_test_helper"
+        require 'turbo_form/system_test_helper'
 
         include TurboForm::SystemTestHelper
       end
@@ -46,7 +43,7 @@ module TurboForm
     config.after_initialize do
       next unless defined?(RSpec.configure)
 
-      require "turbo_form/system_test_helper"
+      require 'turbo_form/system_test_helper'
 
       RSpec.configure do |config|
         config.include TurboForm::SystemTestHelper, type: :system
@@ -57,8 +54,8 @@ module TurboForm
     # hook doesn't fire until Action View is first loaded, which in an app that
     # isn't eager loading is partway through rendering the first view -- late
     # enough that the first form on the first request can miss the patch.
-    initializer "turbo_form.form_helpers" do
-      require "action_view"
+    initializer 'turbo_form.form_helpers' do
+      require 'action_view'
 
       ActionView::Helpers::FormHelper.prepend(TurboForm::FormHelper)
       ActionView::Helpers::FormBuilder.prepend(TurboForm::FormBuilder)

data/lib/turbo_form/form_builder.rb

@@ -4,7 +4,7 @@ module TurboForm
   #   f.text_field :name, dynamic_trigger: true      # re-render on the default event
   #   f.select :category, categories, {}, dynamic_trigger: :blur
   #
-  # `dynamic_trigger:` always has to end up as a `data-action`, but where it
+  # `dynamic_trigger:` always has to end up as a data attribute, but where it
   # *arrives* depends on the helper. Most treat their `options` hash as the tag's
   # HTML attributes; the select and date families keep those in a trailing
   # `html_options` instead, which is where these overrides earn their keep.
@@ -50,55 +50,37 @@ module TurboForm
     end
 
     private
-      # Every other field helper -- generated and hand-written alike -- passes its
-      # attributes through here on the way to the tag.
-      def objectify_options(options)
-        super(absorb_trigger(options))
-      end
-
-      # A trailing `dynamic_trigger:` binds to `options` because Ruby folds bare
-      # keywords into the first optional positional hash -- but for these helpers
-      # that hash is the *select's* options, not the tag's. Carry it across.
-      # SimpleForm arrives on the other side, via `input_html:`, so take it from
-      # either.
-      def hoist_trigger(options, html_options)
-        return [ options, absorb_trigger(html_options) ] unless options.key?(:dynamic_trigger)
-
-        trigger = options[:dynamic_trigger]
-        [ options.except(:dynamic_trigger), absorb_trigger(html_options.merge(dynamic_trigger: trigger)) ]
-      end
-
-      def absorb_trigger(attributes)
-        return attributes unless attributes.key?(:dynamic_trigger)
-
-        trigger = attributes[:dynamic_trigger]
-        attributes = attributes.except(:dynamic_trigger)
-        return attributes unless trigger
-
-        event, url, query = destructure_trigger(trigger)
-
-        data = (attributes[:data] || {}).dup
-        data[:action] = [ data[:action], stimulus_action_for(event) ].compact.join(" ")
-        data[:turbo_form_url_param] = url if url
-        data[:turbo_form_query_param] = query if query
-        attributes.merge(data: data)
-      end
-
-      # The short forms say when to fire and nothing else. The hash form also
-      # says where to send the form and what to send with it, which is what a
-      # field needs when it answers to a different action than its own form does.
-      def destructure_trigger(trigger)
-        return trigger.values_at(:event, :url, :params) if trigger.is_a?(Hash)
-
-        [ trigger, nil, nil ]
-      end
-
-      # `true` -- or a hash that names no event -- leaves the event off the
-      # descriptor so Stimulus binds the element's own default: `change` for a
-      # select, `input` for a text field, `click` for a button. Anything else is
-      # taken as the event name.
-      def stimulus_action_for(event)
-        event.nil? || event == true ? "turbo-form#perform" : "#{event}->turbo-form#perform"
-      end
+    # Every other field helper -- generated and hand-written alike -- passes its
+    # attributes through here on the way to the tag.
+    def objectify_options(options)
+      super(absorb_trigger(options))
+    end
+
+    # A trailing `dynamic_trigger:` binds to `options` because Ruby folds bare
+    # keywords into the first optional positional hash -- but for these helpers
+    # that hash is the *select's* options, not the tag's. Carry it across.
+    # SimpleForm arrives on the other side, via `input_html:`, so take it from
+    # either.
+    def hoist_trigger(options, html_options)
+      return [ options, absorb_trigger(html_options) ] unless options.key?(:dynamic_trigger)
+
+      trigger = options[:dynamic_trigger]
+      [ options.except(:dynamic_trigger), absorb_trigger(html_options.merge(dynamic_trigger: trigger)) ]
+    end
+
+    def absorb_trigger(attributes)
+      return attributes unless attributes.key?(:dynamic_trigger)
+
+      trigger = attributes[:dynamic_trigger]
+      attributes = attributes.except(:dynamic_trigger)
+      return attributes unless trigger
+
+      attributes.merge(data: { **attributes[:data].to_h, turbo_form_trigger: trigger_event(trigger) })
+    end
+
+    # Left blank for `true`, which the script reads as the element's own
+    # default: `change` for a select, `input` for a text field, `click` for a
+    # button.
+    def trigger_event(trigger) = trigger == true ? '' : trigger.to_s
   end
 end

data/lib/turbo_form/form_helper.rb

@@ -2,49 +2,26 @@ module TurboForm
   # Prepended onto ActionView::Helpers::FormHelper.
   #
   #   form_for @widget, dynamic: true
-  #   form_for @widget, dynamic: "shared/refresh"   # render this template instead
   module FormHelper
-    # `form_for` ends in `form_with`, so overriding one covers both.
+    # `form_for` ends in `form_with`, so overriding one covers both. `dynamic:`
+    # stays in the options so the builder sees it; Rails slices the form tag's
+    # attributes out by name, so it never reaches the HTML.
     def form_with(model: false, scope: nil, url: nil, format: nil, **options, &block)
-      dynamic = options.delete(:dynamic)
-      return super unless dynamic
-
-      object = _object_for_form_builder(model)
-      raise ArgumentError, "form_for/form_with needs a :model to build a dynamic form from" unless object
-
-      scope ||= model_name_from_record_or_class(object).param_key
-      signature = TurboForm::Signature.new(
-        model_name: (object.class.try(:base_class) || object.class).name,
-        scope: scope.to_s,
-        template: (dynamic unless dynamic == true),
-        prefixes: lookup_context.prefixes,
-        **origin_of(object)
-      )
-
-      wire_dynamic_form(options, signature)
-      super(model:, scope:, url:, format:, **options, &block)
+      wire_dynamic_form(options, model) if options[:dynamic]
+      super
     end
 
     private
-      # A saved record is found again by id. An unsaved one is rebuilt from what
-      # it had already been given -- a parent's foreign key, say -- since the
-      # form may not submit that back. A plain form object with no dirty
-      # tracking has nothing to carry.
-      def origin_of(object)
-        return { id: object.id } if object.try(:persisted?)
-
-        { seed: object.try(:changes).to_h.transform_values(&:last) }
-      end
-
-      # `form_for` funnels HTML attributes through options[:html] while `form_with`
-      # takes them at the top level. Write wherever the caller already is, and sit
-      # alongside any Stimulus controller they asked for rather than replacing it.
-      def wire_dynamic_form(options, signature)
-        attributes = options.key?(:html) ? (options[:html] ||= {}) : options
-        data = attributes[:data] ||= {}
+    # `form_for` funnels HTML attributes through options[:html] while `form_with`
+    # takes them at the top level. Write wherever the caller already is.
+    def wire_dynamic_form(options, model)
+      attributes = options.key?(:html) ? (options[:html] ||= {}) : options
+      (attributes[:data] ||= {})[:turbo_form_url] = namesake_path(model)
+    end
 
-        data[:controller] = [ data[:controller], "turbo-form" ].compact.join(" ")
-        data[:turbo_form_url_value] = turbo_form_path(signature)
-      end
+    # The page the form is on, which TurboForm::Routes answers PATCH on too.
+    def namesake_path(model)
+      polymorphic_path(model, action: Array(model).last.persisted? ? :edit : :new)
+    end
   end
 end

data/lib/turbo_form/routes.rb

@@ -0,0 +1,16 @@
+module TurboForm
+  # A callable route concern. Draws a PATCH beside whichever of a resource's `new`
+  # and `edit` it has, at the same paths and onto the same actions, marked so the
+  # controller renders them from what the form currently holds.
+  #
+  #   concern :turbo_form, TurboForm::Routes
+  #   resources :widgets, concerns: :turbo_form
+  module Routes
+    def self.call(mapper, _options = {})
+      actions = mapper.send(:parent_resource).actions
+
+      mapper.new { mapper.patch :new, as: nil, defaults: { dynamic_form: true } } if actions.include?(:new)
+      mapper.patch :edit, on: :member, as: nil, defaults: { dynamic_form: true } if actions.include?(:edit)
+    end
+  end
+end

data/lib/turbo_form/system_test_helper.rb

@@ -1,23 +1,13 @@
 module TurboForm::SystemTestHelper
-  # Waits for a dynamic form to finish re-rendering itself.
-  #
-  # A trigger sends the form to the server and swaps part of it out when the
-  # response lands, so anything a test does on the next line is racing that
-  # response -- and loses often enough to be flaky rather than broken. The
-  # Stimulus controller counts completed round trips; waiting on that count is
-  # both cheaper and steadier than waiting on whichever field came back.
+  # Waits for a dynamic form to finish reloading the page.
   #
   #   expect_dynamic_form_request { select "Bourbon", from: "Category" }
   #   select "Barrel Aged", from: "Flavor"
-  #
-  # Scope it with Capybara's own `within` when a page carries more than one
-  # dynamic form.
   def expect_dynamic_form_request
-    form = page.find("[data-controller~='turbo-form']")
-    completed = form["data-turbo-form-requests-value"].to_i + 1
+    completed = page.find('html')['data-turbo-form-visits'].to_i + 1
 
     yield
 
-    page.assert_selector "[data-turbo-form-requests-value='#{completed}']"
+    page.assert_selector "html[data-turbo-form-visits='#{completed}']"
   end
 end

data/lib/turbo_form/version.rb

@@ -1,3 +1,3 @@
 module TurboForm
-  VERSION = "0.4.0"
+  VERSION = '0.6.0'
 end

data/lib/turbo_form.rb

@@ -1,39 +1,2 @@
-require "active_support/core_ext/module/attribute_accessors"
-require "turbo_form/version"
-require "turbo_form/engine"
-
-module TurboForm
-  # The controller the engine's endpoint inherits from. Defaulting to the host's
-  # own `ApplicationController` means its `before_action`s -- authentication
-  # above all -- apply to dynamic renders for free. Point it elsewhere when that
-  # inheritance brings something the endpoint shouldn't have.
-  mattr_accessor :parent_controller, default: "ApplicationController"
-
-  # Set to false to keep the engine out of the host's route set and draw its
-  # route yourself.
-  mattr_accessor :draw_routes, default: true
-
-  # Run as the body of a `before_action`, inside the endpoint, and handed the
-  # resource the form was rebuilt into. The endpoint is an inherited controller
-  # the host never wrote, so this is where it gets to treat it like one of its
-  # own: authorize the render, skip a filter the endpoint can't satisfy
-  # (`skip_authorization`), set something the template needs. Left alone, only
-  # the host's own inherited filters apply.
-  mattr_accessor :before_render
-
-  class << self
-    attr_writer :verifier
-
-    # Signs the description of a form so the endpoint can trust the class it is
-    # about to instantiate and the template it is about to render. Derived from
-    # the application's own key generator, the way SignedGlobalID is. `url_safe`
-    # so the token can live in a path segment; JSON so nothing Marshalled ever
-    # crosses the wire.
-    def verifier
-      @verifier ||= ActiveSupport::MessageVerifier.new(
-        Rails.application.key_generator.generate_key("turbo_form"),
-        url_safe: true, serializer: JSON
-      )
-    end
-  end
-end
+require 'turbo_form/version'
+require 'turbo_form/engine'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: turbo_form
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Andy Cohen
@@ -76,17 +76,15 @@ files:
 - README.md
 - Rakefile
 - app/assets/javascripts/turbo_form.js
-- app/controllers/turbo_form/dynamic_forms_controller.rb
-- config/routes.rb
 - config/turbo_form_importmap.rb
 - lib/generators/turbo_form/install/install_generator.rb
-- lib/generators/turbo_form/install/templates/turbo_form_controller.js
 - lib/tasks/turbo_form_tasks.rake
 - lib/turbo_form.rb
+- lib/turbo_form/controller.rb
 - lib/turbo_form/engine.rb
 - lib/turbo_form/form_builder.rb
 - lib/turbo_form/form_helper.rb
-- lib/turbo_form/signature.rb
+- lib/turbo_form/routes.rb
 - lib/turbo_form/system_test_helper.rb
 - lib/turbo_form/version.rb
 homepage: https://github.com/outlawandy/turbo_form

data/app/controllers/turbo_form/dynamic_forms_controller.rb

@@ -1,56 +0,0 @@
-module TurboForm
-  # Renders a form again from the state the browser currently has it in.
-  #
-  # Nothing here is saved. The form's object is rebuilt only so the template can
-  # ask it what the form should now look like, which is why the parameters are
-  # taken whole: narrowing them would only make the re-rendered form disagree
-  # with what the user actually typed.
-  class DynamicFormsController < TurboForm.parent_controller.constantize
-    rescue_from TurboForm::Signature::Invalid do
-      head :bad_request
-    end
-
-    around_action :discard_writes
-    before_action :build_resource
-    before_action { instance_exec(@resource, &TurboForm.before_render) if TurboForm.before_render }
-
-    def update
-      render signature.template || "dynamic_form", formats: :turbo_stream
-    end
-
-    private
-      def build_resource
-        @resource = signature.rebuild(form_params)
-      end
-
-      # Assigning to a saved record is not always inert: Active Record saves
-      # `has_many` writers and `*_ids=` on the spot.
-      def discard_writes
-        return yield unless defined?(ActiveRecord::Base) && signature.model < ActiveRecord::Base
-
-        signature.model.transaction do
-          yield
-          raise ActiveRecord::Rollback
-        end
-      end
-
-      # Renders as if it were the controller that rendered the form, so the
-      # template's relative partials resolve the way the form's own did.
-      #
-      # Read while the lookup context is built, before `rescue_from` is in play,
-      # so a bad signature falls through here and is answered by the action.
-      def _prefixes
-        signature.prefixes
-      rescue TurboForm::Signature::Invalid
-        super
-      end
-
-      def signature
-        @signature ||= TurboForm::Signature.verify(params[:signature])
-      end
-
-      def form_params
-        params.fetch(signature.scope, {}).permit!
-      end
-  end
-end

data/config/routes.rb

@@ -1,10 +0,0 @@
-# Drawn straight into the host's route set so that installing the gem is the
-# whole installation -- there is nothing to mount. Set `TurboForm.draw_routes`
-# to false to take that over.
-#
-# PATCH rather than POST for two reasons: whole forms outgrow a query string,
-# and an edit form's `_method=patch` hidden field would make Rack rewrite a POST
-# out from under us.
-Rails.application.routes.draw do
-  patch "/turbo_form/:signature" => "turbo_form/dynamic_forms#update", as: :turbo_form
-end if TurboForm.draw_routes

data/lib/generators/turbo_form/install/templates/turbo_form_controller.js

@@ -1,4 +0,0 @@
-// Registered as `turbo-form` by the Stimulus manifest, which reads this filename.
-import TurboFormController from "@rolemodel/turbo-form"
-
-export default TurboFormController

data/lib/turbo_form/signature.rb

@@ -1,64 +0,0 @@
-module TurboForm
-  # A tamper-proof description of a dynamic form, carried in the URL the browser
-  # posts back to.
-  #
-  # It is signed because the endpoint acts on every word of it: `model_name` gets
-  # constantized and instantiated, `template` gets rendered. Neither may come
-  # from the client unverified.
-  #
-  # `prefixes` are the view paths the form was rendered under, so the endpoint
-  # can find its template and partials the way the form's own controller would.
-  #
-  # It also says where the form's object came from, so the endpoint can rebuild
-  # that object rather than a blank one: the `id` of a saved record, or the
-  # `seed` of attributes an unsaved one already had -- the `tank_id` of
-  # `@tank.rings.new` -- which the form itself may never submit.
-  class Signature
-    class Invalid < StandardError; end
-
-    def self.verify(token)
-      payload = TurboForm.verifier.verified(token.to_s)
-      raise Invalid, "not a signature this application generated" unless payload
-
-      new(**payload.symbolize_keys)
-    end
-
-    attr_reader :model_name, :scope, :template, :prefixes, :id, :seed
-
-    def initialize(model_name:, scope:, template: nil, prefixes: [], id: nil, seed: {})
-      @model_name = model_name
-      @scope = scope
-      @template = template
-      @prefixes = prefixes
-      @id = id
-      @seed = seed
-    end
-
-    def model = model_name.constantize
-
-    # The form's object as the user now has it. A new one is built in a single
-    # step so the submitted `type` picks its STI subclass.
-    def rebuild(params)
-      return model.new(seed.merge(params.to_h)) unless id
-
-      retype(model.find(id), params).tap { |resource| resource.assign_attributes(params) }
-    end
-
-    def to_s
-      TurboForm.verifier.generate({ model_name:, scope:, template:, prefixes:, id:, seed: })
-    end
-    alias to_param to_s
-
-    private
-      # `find` answers with the subclass that was saved, not the one just picked.
-      # Let `new` choose by Active Record's own STI rules, and switch before
-      # assigning so nested records land on the object that is kept.
-      def retype(record, params)
-        type = params.to_h.slice(model.try(:inheritance_column).to_s)
-        return record if type.empty?
-
-        subclass = model.new(type).class
-        record.instance_of?(subclass) ? record : record.becomes(subclass)
-      end
-  end
-end