@c9up/station 0.1.5

package/dist/views/form.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `GET /admin/<slug>/new` + `GET /admin/<slug>/:id/edit` — form view
+ * shared between the create and edit actions (Story 54.3).
+ *
+ * Field rendering is INFERRED from the entity's `@Column` metadata
+ * (Story 54.5): column type maps to an `<input type>`, boolean →
+ * checkbox, text-long → textarea, etc. The primary key and any
+ * timestamp columns (`created_at` / `updated_at` / `deleted_at`) are
+ * skipped from the form body. Per-field overrides declared on
+ * `Resource.formFields` win over the inferred defaults.
+ *
+ * Every dynamic value flows through `escapeHtml()` so a malicious
+ * column value rendered into an edit form cannot smuggle markup. The
+ * lint sweep at `tests/unit/no-unescaped-interpolation.test.ts`
+ * enforces the convention.
+ */
+import type { ColumnMetadata } from "@c9up/atlas";
+import type { Resource } from "../types.js";
+export interface FormPageInput {
+    resource: Resource;
+    columns: ReadonlyArray<ColumnMetadata>;
+    pkColumn: string;
+    /** Existing row for edit; undefined for create. */
+    row?: Readonly<Record<string, unknown>>;
+    /** Validation errors keyed by column propertyKey. */
+    errors?: Readonly<Record<string, string>>;
+    /** Caller-controlled hidden inputs (e.g. CSRF token). */
+    hiddenInputs?: ReadonlyArray<{
+        name: string;
+        value: string;
+    }>;
+}
+export declare function renderFormPage(input: FormPageInput): string;
+//# sourceMappingURL=form.d.ts.map

package/dist/views/form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"form.d.ts","sourceRoot":"","sources":["../../src/views/form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAqB,QAAQ,EAAE,MAAM,aAAa,CAAC;AAU/D,MAAM,WAAW,aAAa;IAC7B,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxC,qDAAqD;IACrD,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,yDAAyD;IACzD,YAAY,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAkD3D"}

package/dist/views/form.js

@@ -0,0 +1,139 @@
+/**
+ * `GET /admin/<slug>/new` + `GET /admin/<slug>/:id/edit` — form view
+ * shared between the create and edit actions (Story 54.3).
+ *
+ * Field rendering is INFERRED from the entity's `@Column` metadata
+ * (Story 54.5): column type maps to an `<input type>`, boolean →
+ * checkbox, text-long → textarea, etc. The primary key and any
+ * timestamp columns (`created_at` / `updated_at` / `deleted_at`) are
+ * skipped from the form body. Per-field overrides declared on
+ * `Resource.formFields` win over the inferred defaults.
+ *
+ * Every dynamic value flows through `escapeHtml()` so a malicious
+ * column value rendered into an edit form cannot smuggle markup. The
+ * lint sweep at `tests/unit/no-unescaped-interpolation.test.ts`
+ * enforces the convention.
+ */
+import { escapeHtml, safeHtml } from "./escape.js";
+import { renderLayout } from "./layout.js";
+const SKIPPED_COLUMN_NAMES = new Set([
+    "created_at",
+    "updated_at",
+    "deleted_at",
+]);
+export function renderFormPage(input) {
+    const { resource, columns, pkColumn, row, errors, hiddenInputs } = input;
+    const isEdit = row !== undefined;
+    const slug = encodeURIComponent(resource.name);
+    const id = isEdit ? String(row[pkColumn] ?? "") : "";
+    const action = isEdit
+        ? `/admin/${slug}/${encodeURIComponent(id)}`
+        : `/admin/${slug}`;
+    const methodOverride = isEdit
+        ? `<input type="hidden" name="_method" value="PUT">`
+        : "";
+    const heading = isEdit
+        ? `Edit ${escapeHtml(resource.label)} #${escapeHtml(id)}`
+        : `New ${escapeHtml(resource.label)}`;
+    const hiddens = (hiddenInputs ?? [])
+        .map((h) => `<input type="hidden" name="${escapeHtml(h.name)}" value="${escapeHtml(h.value)}">`)
+        .join("");
+    const fieldHtml = columns
+        .filter((c) => !shouldSkipColumn(c, pkColumn, resource.formFields[c.propertyKey]))
+        .map((c) => renderField(c, row, errors, resource.formFields[c.propertyKey]))
+        .join("");
+    const submitLabel = isEdit ? "Update" : "Create";
+    const cancelUrl = isEdit
+        ? `/admin/${slug}/${encodeURIComponent(id)}`
+        : `/admin/${slug}`;
+    const body = `<h1>${heading}</h1>` +
+        `<form class="st-form" method="POST" action="${escapeHtml(action)}">` +
+        methodOverride +
+        hiddens +
+        fieldHtml +
+        `<div class="st-form-actions">` +
+        `<button type="submit">${escapeHtml(submitLabel)}</button>` +
+        `<a class="st-cancel" href="${escapeHtml(cancelUrl)}">Cancel</a>` +
+        `</div>` +
+        `</form>`;
+    return renderLayout({
+        title: isEdit ? `Edit ${resource.label} #${id}` : `New ${resource.label}`,
+        bodyHtml: safeHtml(body),
+    });
+}
+function shouldSkipColumn(c, pkColumn, override) {
+    if (override?.hidden === true)
+        return true;
+    // Atlas's ColumnMetadata exposes the property key (camelCase). The
+    // pkColumn passed by the provider is also camelCase (it comes from
+    // `atlas.getPrimaryKey(entity)`), so the comparison is direct.
+    // snake_case fallbacks live in SKIPPED_COLUMN_NAMES below for the
+    // timestamps convention.
+    if (c.propertyKey === pkColumn)
+        return true;
+    const snake = c.propertyKey.replace(/([A-Z])/g, "_$1").toLowerCase();
+    if (SKIPPED_COLUMN_NAMES.has(snake))
+        return true;
+    if (SKIPPED_COLUMN_NAMES.has(c.propertyKey))
+        return true;
+    return false;
+}
+function renderField(c, row, errors, override) {
+    const inputType = override?.inputType ?? inferInputType(c);
+    const labelText = override?.label ?? titleise(c.propertyKey);
+    const required = override?.required === true ? " required" : "";
+    const placeholder = override?.placeholder !== undefined
+        ? ` placeholder="${escapeHtml(override.placeholder)}"`
+        : "";
+    const name = c.propertyKey;
+    const fieldId = `f-${escapeHtml(name)}`;
+    const rawValue = row?.[name];
+    const errorMsg = errors?.[name];
+    const errorHtml = errorMsg !== undefined
+        ? `<p class="st-field-error">${escapeHtml(errorMsg)}</p>`
+        : "";
+    const input = renderInput(inputType, fieldId, name, rawValue, required, placeholder);
+    return (`<div class="st-field">` +
+        `<label for="${escapeHtml(fieldId)}">${escapeHtml(labelText)}</label>` +
+        input +
+        errorHtml +
+        `</div>`);
+}
+/** Render the `<input>` / `<textarea>` element for a field by input type. */
+function renderInput(inputType, fieldId, name, rawValue, required, placeholder) {
+    if (inputType === "checkbox") {
+        const checked = rawValue ? " checked" : "";
+        return `<input id="${escapeHtml(fieldId)}" type="checkbox" name="${escapeHtml(name)}" value="1"${checked}>`;
+    }
+    const value = rawValue === undefined || rawValue === null ? "" : String(rawValue);
+    if (inputType === "textarea") {
+        return `<textarea id="${escapeHtml(fieldId)}" name="${escapeHtml(name)}"${required}${placeholder}>${escapeHtml(value)}</textarea>`;
+    }
+    return `<input id="${escapeHtml(fieldId)}" type="${escapeHtml(inputType)}" name="${escapeHtml(name)}" value="${escapeHtml(value)}"${required}${placeholder}>`;
+}
+function inferInputType(c) {
+    const type = (c.type ?? "").toString().toLowerCase();
+    if (type === "boolean")
+        return "checkbox";
+    if (type === "integer" || type === "bigint" || type === "number") {
+        return "number";
+    }
+    if (type === "date")
+        return "date";
+    if (type === "datetime" || type === "timestamp")
+        return "datetime-local";
+    if (type === "text" || type === "longtext")
+        return "textarea";
+    const name = c.propertyKey.toLowerCase();
+    if (name.includes("email"))
+        return "email";
+    if (name.includes("password"))
+        return "password";
+    return "text";
+}
+function titleise(propertyKey) {
+    // camelCase → "Camel Case"
+    const spaced = propertyKey.replace(/([a-z0-9])([A-Z])/g, "$1 $2");
+    return spaced.charAt(0).toUpperCase() + spaced.slice(1);
+}
+//# sourceMappingURL=form.js.map

package/dist/views/form.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"form.js","sourceRoot":"","sources":["../../src/views/form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IACzD,YAAY;IACZ,YAAY;IACZ,YAAY;CACZ,CAAC,CAAC;AAcH,MAAM,UAAU,cAAc,CAAC,KAAoB;IAClD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACzE,MAAM,MAAM,GAAG,GAAG,KAAK,SAAS,CAAC;IACjC,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM;QACpB,CAAC,CAAC,UAAU,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,EAAE;QAC5C,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;IACpB,MAAM,cAAc,GAAG,MAAM;QAC5B,CAAC,CAAC,kDAAkD;QACpD,CAAC,CAAC,EAAE,CAAC;IACN,MAAM,OAAO,GAAG,MAAM;QACrB,CAAC,CAAC,QAAQ,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,EAAE,CAAC,EAAE;QACzD,CAAC,CAAC,OAAO,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAEvC,MAAM,OAAO,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;SAClC,GAAG,CACH,CAAC,CAAC,EAAE,EAAE,CACL,8BAA8B,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CACpF;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,MAAM,SAAS,GAAG,OAAO;SACvB,MAAM,CACN,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CACzE;SACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;SAC3E,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM;QACvB,CAAC,CAAC,UAAU,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,EAAE;QAC5C,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;IAEpB,MAAM,IAAI,GACT,OAAO,OAAO,OAAO;QACrB,+CAA+C,UAAU,CAAC,MAAM,CAAC,IAAI;QACrE,cAAc;QACd,OAAO;QACP,SAAS;QACT,+BAA+B;QAC/B,yBAAyB,UAAU,CAAC,WAAW,CAAC,WAAW;QAC3D,8BAA8B,UAAU,CAAC,SAAS,CAAC,cAAc;QACjE,QAAQ;QACR,SAAS,CAAC;IAEX,OAAO,YAAY,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,KAAK,EAAE;QACzE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC;KACxB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACxB,CAAiB,EACjB,QAAgB,EAChB,QAAuC;IAEvC,IAAI,QAAQ,EAAE,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3C,mEAAmE;IACnE,mEAAmE;IACnE,+DAA+D;IAC/D,kEAAkE;IAClE,yBAAyB;IACzB,IAAI,CAAC,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,IAAI,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CACnB,CAAiB,EACjB,GAAkD,EAClD,MAAoD,EACpD,QAAuC;IAEvC,MAAM,SAAS,GAAG,QAAQ,EAAE,SAAS,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,QAAQ,EAAE,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,WAAW,GAChB,QAAQ,EAAE,WAAW,KAAK,SAAS;QAClC,CAAC,CAAC,iBAAiB,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG;QACtD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC;IAC3B,MAAM,OAAO,GAAG,KAAK,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,SAAS,GACd,QAAQ,KAAK,SAAS;QACrB,CAAC,CAAC,6BAA6B,UAAU,CAAC,QAAQ,CAAC,MAAM;QACzD,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,KAAK,GAAG,WAAW,CACxB,SAAS,EACT,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,QAAQ,EACR,WAAW,CACX,CAAC;IAEF,OAAO,CACN,wBAAwB;QACxB,eAAe,UAAU,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,UAAU;QACtE,KAAK;QACL,SAAS;QACT,QAAQ,CACR,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CACnB,SAAyC,EACzC,OAAe,EACf,IAAY,EACZ,QAAiB,EACjB,QAAgB,EAChB,WAAmB;IAEnB,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,cAAc,UAAU,CAAC,OAAO,CAAC,2BAA2B,UAAU,CAAC,IAAI,CAAC,cAAc,OAAO,GAAG,CAAC;IAC7G,CAAC;IACD,MAAM,KAAK,GACV,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrE,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC9B,OAAO,iBAAiB,UAAU,CAAC,OAAO,CAAC,WAAW,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,WAAW,IAAI,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC;IACpI,CAAC;IACD,OAAO,cAAc,UAAU,CAAC,OAAO,CAAC,WAAW,UAAU,CAAC,SAAS,CAAC,WAAW,UAAU,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,IAAI,QAAQ,GAAG,WAAW,GAAG,CAAC;AAC/J,CAAC;AAED,SAAS,cAAc,CAAC,CAAiB;IACxC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClE,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACnC,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,gBAAgB,CAAC;IACzE,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAC9D,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IACjD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,WAAmB;IACpC,2BAA2B;IAC3B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/views/layout.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Layout shell shared by every Station page (list / show / 404 in this
+ * story; create / edit will join later). Pure string output so consumers
+ * can `response.send(html)` directly without bundler glue.
+ *
+ * Inline CSS lives here rather than `/_assets/station/*` because Story
+ * 54.2 ships zero assets — the route mount that serves a separate
+ * stylesheet lands in 54.7 alongside the Warden + login plumbing. The
+ * size budget (~80 lines, ~3 KB) keeps the inline approach cheaper than
+ * an extra round-trip per page until then.
+ */
+import { type SafeHtml } from "./escape.js";
+/** ~80 LOC inline stylesheet. Dependency-free; no PostCSS, no Tailwind. */
+export declare const STATION_INLINE_CSS: string;
+/**
+ * Render the outer HTML shell. `bodyHtml` is a `SafeHtml` brand to make
+ * the trust boundary explicit: callers must escape every dynamic value
+ * inside the body, then wrap the final string via `safeHtml()`.
+ */
+export declare function renderLayout(input: {
+    title: string;
+    bodyHtml: SafeHtml;
+}): string;
+//# sourceMappingURL=layout.d.ts.map

package/dist/views/layout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout.d.ts","sourceRoot":"","sources":["../../src/views/layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAExD,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,QAkDvB,CAAC;AAET;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC;CACnB,GAAG,MAAM,CAcT"}

package/dist/views/layout.js

@@ -0,0 +1,85 @@
+/**
+ * Layout shell shared by every Station page (list / show / 404 in this
+ * story; create / edit will join later). Pure string output so consumers
+ * can `response.send(html)` directly without bundler glue.
+ *
+ * Inline CSS lives here rather than `/_assets/station/*` because Story
+ * 54.2 ships zero assets — the route mount that serves a separate
+ * stylesheet lands in 54.7 alongside the Warden + login plumbing. The
+ * size budget (~80 lines, ~3 KB) keeps the inline approach cheaper than
+ * an extra round-trip per page until then.
+ */
+import { escapeHtml } from "./escape.js";
+/** ~80 LOC inline stylesheet. Dependency-free; no PostCSS, no Tailwind. */
+export const STATION_INLINE_CSS = `
+:root {
+  color-scheme: light dark;
+  --st-fg: #1f2937;
+  --st-fg-muted: #6b7280;
+  --st-bg: #ffffff;
+  --st-bg-alt: #f9fafb;
+  --st-border: #e5e7eb;
+  --st-accent: #2563eb;
+  --st-accent-hover: #1d4ed8;
+  --st-danger: #b91c1c;
+  font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    --st-fg: #e5e7eb;
+    --st-fg-muted: #9ca3af;
+    --st-bg: #0f172a;
+    --st-bg-alt: #1e293b;
+    --st-border: #334155;
+    --st-accent: #60a5fa;
+    --st-accent-hover: #93c5fd;
+  }
+}
+body { margin: 0; color: var(--st-fg); background: var(--st-bg); }
+main { max-width: 64rem; margin: 0 auto; padding: 2rem 1.5rem; }
+h1 { font-size: 1.75rem; margin: 0 0 1.5rem; }
+a { color: var(--st-accent); text-decoration: none; }
+a:hover { color: var(--st-accent-hover); text-decoration: underline; }
+table { width: 100%; border-collapse: collapse; margin-bottom: 1.5rem; }
+th, td {
+  text-align: left;
+  padding: 0.5rem 0.75rem;
+  border-bottom: 1px solid var(--st-border);
+  vertical-align: top;
+}
+th { background: var(--st-bg-alt); font-weight: 600; }
+tbody tr:hover { background: var(--st-bg-alt); }
+.st-empty { color: var(--st-fg-muted); font-style: italic; }
+.st-pager { display: flex; gap: 0.5rem; align-items: center; flex-wrap: wrap; margin-bottom: 0.75rem; }
+.st-pager a, .st-pager span { padding: 0.25rem 0.5rem; border-radius: 0.25rem; }
+.st-pager a { border: 1px solid var(--st-border); }
+.st-pager strong { padding: 0.25rem 0.5rem; background: var(--st-accent); color: var(--st-bg); border-radius: 0.25rem; }
+.st-pager .st-disabled { color: var(--st-fg-muted); border: 1px solid var(--st-border); }
+.st-pager .st-ellipsis { color: var(--st-fg-muted); }
+.st-caption { color: var(--st-fg-muted); font-size: 0.875rem; }
+dl { display: grid; grid-template-columns: max-content 1fr; gap: 0.5rem 1.5rem; }
+dt { font-weight: 600; color: var(--st-fg-muted); }
+dd { margin: 0; }
+.st-backlink { display: inline-block; margin-top: 1.5rem; }
+`.trim();
+/**
+ * Render the outer HTML shell. `bodyHtml` is a `SafeHtml` brand to make
+ * the trust boundary explicit: callers must escape every dynamic value
+ * inside the body, then wrap the final string via `safeHtml()`.
+ */
+export function renderLayout(input) {
+    const titleEscaped = escapeHtml(input.title);
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <title>${titleEscaped} · Station</title>
+  <style>${STATION_INLINE_CSS}</style>
+</head>
+<body>
+  <main>${input.bodyHtml.html}</main>
+</body>
+</html>`;
+}
+//# sourceMappingURL=layout.js.map

package/dist/views/layout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout.js","sourceRoot":"","sources":["../../src/views/layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAiB,MAAM,aAAa,CAAC;AAExD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkDjC,CAAC,IAAI,EAAE,CAAC;AAET;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAG5B;IACA,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO;;;;;WAKG,YAAY;WACZ,kBAAkB;;;UAGnB,KAAK,CAAC,QAAQ,CAAC,IAAI;;QAErB,CAAC;AACT,CAAC"}

package/dist/views/list.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `GET /admin/<slug>` — paginated list view.
+ *
+ * Pure `(input) => string` renderer. Every dynamic value flows through
+ * `escapeHtml()` or `encodeURIComponent()` (URL components). The
+ * "interpolation must wrap" rule is grep-enforced by
+ * `tests/unit/no-unescaped-interpolation.test.ts`.
+ */
+import type { ColumnMetadata } from "@c9up/atlas";
+import type { Resource } from "../types.js";
+export interface ListPageInput {
+    resource: Resource;
+    rows: ReadonlyArray<Record<string, unknown>>;
+    columns: ReadonlyArray<ColumnMetadata>;
+    pkColumn: string;
+    page: number;
+    perPage: number;
+    total: number;
+    lastPage: number;
+}
+export declare function renderListPage(input: ListPageInput): string;
+//# sourceMappingURL=list.d.ts.map

package/dist/views/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/views/list.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAI5C,MAAM,WAAW,aAAa;IAC7B,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAgB3D"}

package/dist/views/list.js

@@ -0,0 +1,85 @@
+/**
+ * `GET /admin/<slug>` — paginated list view.
+ *
+ * Pure `(input) => string` renderer. Every dynamic value flows through
+ * `escapeHtml()` or `encodeURIComponent()` (URL components). The
+ * "interpolation must wrap" rule is grep-enforced by
+ * `tests/unit/no-unescaped-interpolation.test.ts`.
+ */
+import { escapeHtml, safeHtml } from "./escape.js";
+import { renderLayout } from "./layout.js";
+export function renderListPage(input) {
+    const { resource, rows, columns, pkColumn, page, perPage, total, lastPage } = input;
+    const slug = encodeURIComponent(resource.name);
+    const body = rows.length === 0
+        ? renderEmptyState(resource)
+        : renderTable(rows, columns, pkColumn, slug);
+    const pager = renderPager(slug, page, perPage, lastPage);
+    const caption = renderCaption(page, perPage, total);
+    return renderLayout({
+        title: resource.label,
+        bodyHtml: safeHtml(`<h1>${escapeHtml(resource.label)}</h1>${body}${pager}${caption}`),
+    });
+}
+function renderEmptyState(resource) {
+    return `<p class="st-empty">No ${escapeHtml(resource.label.toLowerCase())} yet.</p>`;
+}
+function renderTable(rows, columns, pkColumn, slug) {
+    const headers = columns
+        .map((c) => `<th>${escapeHtml(c.propertyKey)}</th>`)
+        .join("");
+    const headerRow = `<thead><tr>${headers}<th></th></tr></thead>`;
+    const bodyRows = rows
+        .map((row) => {
+        const cells = columns
+            .map((c) => `<td>${escapeHtml(row[c.propertyKey])}</td>`)
+            .join("");
+        const id = String(row[pkColumn] ?? "");
+        const showLink = `<td><a href="/admin/${slug}/${encodeURIComponent(id)}">Show</a></td>`;
+        return `<tr>${cells}${showLink}</tr>`;
+    })
+        .join("");
+    return `<table>${headerRow}<tbody>${bodyRows}</tbody></table>`;
+}
+function renderPager(slug, page, perPage, lastPage) {
+    const pp = encodeURIComponent(String(perPage));
+    const prev = page > 1
+        ? `<a href="/admin/${slug}?page=${page - 1}&perPage=${pp}">« Prev</a>`
+        : `<span class="st-disabled">« Prev</span>`;
+    const next = page < lastPage
+        ? `<a href="/admin/${slug}?page=${page + 1}&perPage=${pp}">Next »</a>`
+        : `<span class="st-disabled">Next »</span>`;
+    const numbers = renderPageNumbers(slug, page, lastPage, pp);
+    return `<div class="st-pager">${prev}${numbers}${next}</div>`;
+}
+function renderPageNumbers(slug, page, lastPage, pp) {
+    const link = (n) => n === page
+        ? `<strong>${n}</strong>`
+        : `<a href="/admin/${slug}?page=${n}&perPage=${pp}">${n}</a>`;
+    if (lastPage <= 7) {
+        const parts = [];
+        for (let i = 1; i <= lastPage; i++)
+            parts.push(link(i));
+        return parts.join("");
+    }
+    // Collapsed shape: 1 … current-1, current, current+1 … lastPage
+    const parts = [link(1)];
+    const start = Math.max(2, page - 1);
+    const end = Math.min(lastPage - 1, page + 1);
+    if (start > 2)
+        parts.push(`<span class="st-ellipsis">…</span>`);
+    for (let i = start; i <= end; i++)
+        parts.push(link(i));
+    if (end < lastPage - 1)
+        parts.push(`<span class="st-ellipsis">…</span>`);
+    parts.push(link(lastPage));
+    return parts.join("");
+}
+function renderCaption(page, perPage, total) {
+    if (total === 0)
+        return "";
+    const start = (page - 1) * perPage + 1;
+    const end = Math.min(page * perPage, total);
+    return `<p class="st-caption">Showing ${start}–${end} of ${total}</p>`;
+}
+//# sourceMappingURL=list.js.map

package/dist/views/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../src/views/list.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAa3C,MAAM,UAAU,cAAc,CAAC,KAAoB;IAClD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAC1E,KAAK,CAAC;IACP,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,IAAI,GACT,IAAI,CAAC,MAAM,KAAK,CAAC;QAChB,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC;QAC5B,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACpD,OAAO,YAAY,CAAC;QACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,QAAQ,EAAE,QAAQ,CACjB,OAAO,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,IAAI,GAAG,KAAK,GAAG,OAAO,EAAE,CACjE;KACD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB;IAC3C,OAAO,0BAA0B,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC;AACtF,CAAC;AAED,SAAS,WAAW,CACnB,IAA4C,EAC5C,OAAsC,EACtC,QAAgB,EAChB,IAAY;IAEZ,MAAM,OAAO,GAAG,OAAO;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC;SACnD,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,MAAM,SAAS,GAAG,cAAc,OAAO,wBAAwB,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI;SACnB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACZ,MAAM,KAAK,GAAG,OAAO;aACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC;aACxD,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,uBAAuB,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,iBAAiB,CAAC;QACxF,OAAO,OAAO,KAAK,GAAG,QAAQ,OAAO,CAAC;IACvC,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,OAAO,UAAU,SAAS,UAAU,QAAQ,kBAAkB,CAAC;AAChE,CAAC;AAED,SAAS,WAAW,CACnB,IAAY,EACZ,IAAY,EACZ,OAAe,EACf,QAAgB;IAEhB,MAAM,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,MAAM,IAAI,GACT,IAAI,GAAG,CAAC;QACP,CAAC,CAAC,mBAAmB,IAAI,SAAS,IAAI,GAAG,CAAC,YAAY,EAAE,cAAc;QACtE,CAAC,CAAC,yCAAyC,CAAC;IAC9C,MAAM,IAAI,GACT,IAAI,GAAG,QAAQ;QACd,CAAC,CAAC,mBAAmB,IAAI,SAAS,IAAI,GAAG,CAAC,YAAY,EAAE,cAAc;QACtE,CAAC,CAAC,yCAAyC,CAAC;IAC9C,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5D,OAAO,yBAAyB,IAAI,GAAG,OAAO,GAAG,IAAI,QAAQ,CAAC;AAC/D,CAAC;AAED,SAAS,iBAAiB,CACzB,IAAY,EACZ,IAAY,EACZ,QAAgB,EAChB,EAAU;IAEV,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAClC,CAAC,KAAK,IAAI;QACT,CAAC,CAAC,WAAW,CAAC,WAAW;QACzB,CAAC,CAAC,mBAAmB,IAAI,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC;IAChE,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,gEAAgE;IAChE,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAC7C,IAAI,KAAK,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IAChE,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,GAAG,GAAG,QAAQ,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACzE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3B,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe,EAAE,KAAa;IAClE,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,OAAO,iCAAiC,KAAK,IAAI,GAAG,OAAO,KAAK,MAAM,CAAC;AACxE,CAAC"}

package/dist/views/login.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `GET /admin/login` — sign-in form rendered by StationProvider when
+ * the host has `@c9up/warden` wired (Story 54.7). The form POSTs
+ * `email` + `password` to `/admin/login`; the provider's
+ * `buildLoginHandler` runs them through `auth.authenticate(...)` and
+ * sets a session cookie on success.
+ *
+ * Every dynamic value flows through `escapeHtml()` so a tampered
+ * `?error=…` query parameter cannot smuggle markup into the page.
+ */
+export interface LoginPageInput {
+    /** Pre-fill the email field (e.g. after a failed attempt). */
+    email?: string;
+    /** Optional error message to display above the form. */
+    error?: string;
+    /** Form action path. Default `/admin/login`. */
+    action?: string;
+    /** Caller-controlled hidden inputs (typically `_csrf`). */
+    hiddenInputs?: ReadonlyArray<{
+        name: string;
+        value: string;
+    }>;
+}
+export declare function renderLoginPage(input: LoginPageInput): string;
+//# sourceMappingURL=login.d.ts.map

package/dist/views/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/views/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,MAAM,WAAW,cAAc;IAC9B,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAuC7D"}

package/dist/views/login.js

@@ -0,0 +1,44 @@
+/**
+ * `GET /admin/login` — sign-in form rendered by StationProvider when
+ * the host has `@c9up/warden` wired (Story 54.7). The form POSTs
+ * `email` + `password` to `/admin/login`; the provider's
+ * `buildLoginHandler` runs them through `auth.authenticate(...)` and
+ * sets a session cookie on success.
+ *
+ * Every dynamic value flows through `escapeHtml()` so a tampered
+ * `?error=…` query parameter cannot smuggle markup into the page.
+ */
+import { escapeHtml, safeHtml } from "./escape.js";
+import { renderLayout } from "./layout.js";
+export function renderLoginPage(input) {
+    const email = input.email ?? "";
+    const error = input.error;
+    const action = input.action ?? "/admin/login";
+    const hiddens = (input.hiddenInputs ?? [])
+        .map((h) => `<input type="hidden" name="${escapeHtml(h.name)}" value="${escapeHtml(h.value)}">`)
+        .join("");
+    const errorBlock = error !== undefined
+        ? `<p class="st-form-error" role="alert">${escapeHtml(error)}</p>`
+        : "";
+    const body = `<h1>Sign in</h1>` +
+        errorBlock +
+        `<form class="st-form" method="POST" action="${escapeHtml(action)}">` +
+        hiddens +
+        `<div class="st-field">` +
+        `<label for="f-email">Email</label>` +
+        `<input id="f-email" type="email" name="email" value="${escapeHtml(email)}" required autocomplete="email" autofocus>` +
+        `</div>` +
+        `<div class="st-field">` +
+        `<label for="f-password">Password</label>` +
+        `<input id="f-password" type="password" name="password" required autocomplete="current-password">` +
+        `</div>` +
+        `<div class="st-form-actions">` +
+        `<button type="submit">Sign in</button>` +
+        `</div>` +
+        `</form>`;
+    return renderLayout({
+        title: "Sign in",
+        bodyHtml: safeHtml(body),
+    });
+}
+//# sourceMappingURL=login.js.map

package/dist/views/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/views/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAa3C,MAAM,UAAU,eAAe,CAAC,KAAqB;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC;IAE9C,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;SACxC,GAAG,CACH,CAAC,CAAC,EAAE,EAAE,CACL,8BAA8B,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CACpF;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,MAAM,UAAU,GACf,KAAK,KAAK,SAAS;QAClB,CAAC,CAAC,yCAAyC,UAAU,CAAC,KAAK,CAAC,MAAM;QAClE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,IAAI,GACT,kBAAkB;QAClB,UAAU;QACV,+CAA+C,UAAU,CAAC,MAAM,CAAC,IAAI;QACrE,OAAO;QACP,wBAAwB;QACxB,oCAAoC;QACpC,wDAAwD,UAAU,CAAC,KAAK,CAAC,4CAA4C;QACrH,QAAQ;QACR,wBAAwB;QACxB,0CAA0C;QAC1C,kGAAkG;QAClG,QAAQ;QACR,+BAA+B;QAC/B,wCAAwC;QACxC,QAAQ;QACR,SAAS,CAAC;IAEX,OAAO,YAAY,CAAC;QACnB,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC;KACxB,CAAC,CAAC;AACJ,CAAC"}

package/dist/views/show.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `GET /admin/<slug>/:id` — detail view (columns only in 54.2).
+ *
+ * Relations are deferred — see story spec AC17 Spec Deviations. Every
+ * dynamic value flows through `escapeHtml()`; URL components through
+ * `encodeURIComponent()`.
+ */
+import type { ColumnMetadata } from "@c9up/atlas";
+import type { Resource } from "../types.js";
+export interface ShowPageInput {
+    resource: Resource;
+    row: Record<string, unknown>;
+    columns: ReadonlyArray<ColumnMetadata>;
+    pkColumn: string;
+}
+export declare function renderShowPage(input: ShowPageInput): string;
+//# sourceMappingURL=show.d.ts.map

package/dist/views/show.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"show.d.ts","sourceRoot":"","sources":["../../src/views/show.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAI5C,MAAM,WAAW,aAAa;IAC7B,QAAQ,EAAE,QAAQ,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAgB3D"}

package/dist/views/show.js

@@ -0,0 +1,24 @@
+/**
+ * `GET /admin/<slug>/:id` — detail view (columns only in 54.2).
+ *
+ * Relations are deferred — see story spec AC17 Spec Deviations. Every
+ * dynamic value flows through `escapeHtml()`; URL components through
+ * `encodeURIComponent()`.
+ */
+import { escapeHtml, safeHtml } from "./escape.js";
+import { renderLayout } from "./layout.js";
+export function renderShowPage(input) {
+    const { resource, row, columns, pkColumn } = input;
+    const id = String(row[pkColumn] ?? "");
+    const slug = encodeURIComponent(resource.name);
+    const heading = `${escapeHtml(resource.label)} #${escapeHtml(id)}`;
+    const dl = columns
+        .map((c) => `<dt>${escapeHtml(c.propertyKey)}</dt><dd>${escapeHtml(row[c.propertyKey])}</dd>`)
+        .join("");
+    const backLink = `<a class="st-backlink" href="/admin/${slug}">← Back to ${escapeHtml(resource.label)}</a>`;
+    return renderLayout({
+        title: `${resource.label} #${id}`,
+        bodyHtml: safeHtml(`<h1>${heading}</h1><dl>${dl}</dl>${backLink}`),
+    });
+}
+//# sourceMappingURL=show.js.map

package/dist/views/show.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"show.js","sourceRoot":"","sources":["../../src/views/show.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAS3C,MAAM,UAAU,cAAc,CAAC,KAAoB;IAClD,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACnD,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;IACnE,MAAM,EAAE,GAAG,OAAO;SAChB,GAAG,CACH,CAAC,CAAC,EAAE,EAAE,CACL,OAAO,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,CAClF;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,MAAM,QAAQ,GAAG,uCAAuC,IAAI,eAAe,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC5G,OAAO,YAAY,CAAC;QACnB,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,KAAK,EAAE,EAAE;QACjC,QAAQ,EAAE,QAAQ,CAAC,OAAO,OAAO,YAAY,EAAE,QAAQ,QAAQ,EAAE,CAAC;KAClE,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@c9up/station",
+  "version": "0.1.5",
+  "description": "Station — admin scaffolding for the Ream framework. Declarative resource catalogue (defineResource) backing list/show/create/edit/destroy routes, audit, policies.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./services/main": {
+      "types": "./dist/services/main.d.ts",
+      "import": "./dist/services/main.js"
+    }
+  },
+  "peerDependencies": {
+    "@c9up/atlas": "^0.1.0",
+    "@c9up/ream": "^0.1.0",
+    "@c9up/warden": "^0.1.0"
+  },
+  "peerDependenciesMeta": {
+    "@c9up/atlas": {
+      "optional": true
+    },
+    "@c9up/ream": {
+      "optional": true
+    },
+    "@c9up/warden": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@c9up/atlas": "^0.1.0",
+    "@types/node": "^22.19.15",
+    "@vitest/coverage-v8": "^4.1.2",
+    "reflect-metadata": "^0.2.2",
+    "typescript": "^6.0.2",
+    "vitest": "^4.1.2"
+  },
+  "files": [
+    "LICENSE",
+    "README.md",
+    "dist",
+    "src"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/C9up/station.git"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "lint": "biome check src/",
+    "test:coverage": "vitest run --coverage"
+  }
+}