@seed-ship/mcp-ui-solid 6.15.0 → 6.17.0

package/src/services/component-registry.ts

@@ -582,31 +582,260 @@ export const CodeRegistry: ComponentRegistryEntry = {
 /**
  * Map Registry Entry
  */
+const MAP_LAT_LNG_POINT_SCHEMA = {
+  oneOf: [
+    {
+      type: 'array',
+      items: { type: 'number' },
+      minItems: 2,
+      maxItems: 2,
+      description: '[latitude, longitude] tuple',
+    },
+    {
+      type: 'object',
+      properties: {
+        lat: { type: 'number' },
+        lng: { type: 'number' },
+      },
+      required: ['lat', 'lng'],
+      description: '{ lat, lng } object',
+    },
+  ],
+}
+
+const MAP_GEOJSON_POSITION_SCHEMA = {
+  type: 'array',
+  items: { type: 'number' },
+  minItems: 2,
+}
+
+const MAP_GEOJSON_COORDINATES_SCHEMA = {
+  anyOf: [
+    MAP_GEOJSON_POSITION_SCHEMA,
+    { type: 'array', items: MAP_GEOJSON_POSITION_SCHEMA },
+    { type: 'array', items: { type: 'array', items: MAP_GEOJSON_POSITION_SCHEMA } },
+    {
+      type: 'array',
+      items: {
+        type: 'array',
+        items: { type: 'array', items: MAP_GEOJSON_POSITION_SCHEMA },
+      },
+    },
+  ],
+}
+
+const MAP_GEOJSON_BBOX_SCHEMA = {
+  type: 'array',
+  items: { type: 'number' },
+}
+
+const MAP_GEOJSON_GEOMETRY_TYPE_SCHEMA = {
+  type: 'string',
+  enum: [
+    'Point',
+    'MultiPoint',
+    'LineString',
+    'MultiLineString',
+    'Polygon',
+    'MultiPolygon',
+    'GeometryCollection',
+  ],
+}
+
+const MAP_GEOJSON_SIMPLE_GEOMETRY_SCHEMA = {
+  type: 'object',
+  properties: {
+    type: MAP_GEOJSON_GEOMETRY_TYPE_SCHEMA,
+    coordinates: MAP_GEOJSON_COORDINATES_SCHEMA,
+    bbox: MAP_GEOJSON_BBOX_SCHEMA,
+  },
+  required: ['type'],
+}
+
+const MAP_GEOJSON_GEOMETRY_SCHEMA = {
+  type: 'object',
+  properties: {
+    type: MAP_GEOJSON_GEOMETRY_TYPE_SCHEMA,
+    coordinates: MAP_GEOJSON_COORDINATES_SCHEMA,
+    geometries: { type: 'array', items: MAP_GEOJSON_SIMPLE_GEOMETRY_SCHEMA },
+    bbox: MAP_GEOJSON_BBOX_SCHEMA,
+  },
+  required: ['type'],
+}
+
+const MAP_GEOJSON_FEATURE_SCHEMA = {
+  type: 'object',
+  properties: {
+    type: { type: 'string', enum: ['Feature'] },
+    geometry: { oneOf: [MAP_GEOJSON_GEOMETRY_SCHEMA, { type: 'null' }] },
+    properties: { oneOf: [{ type: 'object' }, { type: 'null' }] },
+    id: { oneOf: [{ type: 'string' }, { type: 'number' }] },
+    bbox: MAP_GEOJSON_BBOX_SCHEMA,
+  },
+  required: ['type', 'geometry'],
+}
+
+const MAP_GEOJSON_FEATURE_COLLECTION_SCHEMA = {
+  type: 'object',
+  properties: {
+    type: { type: 'string', enum: ['FeatureCollection'] },
+    features: { type: 'array', items: MAP_GEOJSON_FEATURE_SCHEMA },
+    bbox: MAP_GEOJSON_BBOX_SCHEMA,
+  },
+  required: ['type', 'features'],
+}
+
+const MAP_GEOJSON_SCHEMA = {
+  oneOf: [
+    MAP_GEOJSON_FEATURE_COLLECTION_SCHEMA,
+    MAP_GEOJSON_FEATURE_SCHEMA,
+    MAP_GEOJSON_GEOMETRY_SCHEMA,
+  ],
+  description: 'GeoJSON FeatureCollection, Feature, or Geometry',
+}
+
+const MAP_GEOJSON_STYLE_SCHEMA = {
+  type: 'object',
+  properties: {
+    fillColor: { type: 'string' },
+    fillOpacity: { type: 'number' },
+    strokeColor: { type: 'string' },
+    strokeWeight: { type: 'number' },
+    strokeOpacity: { type: 'number' },
+    choroplethField: { type: 'string' },
+    choroplethScale: {
+      type: 'array',
+      items: {
+        type: 'array',
+        items: [{ type: 'number' }, { type: 'string' }],
+        additionalItems: false,
+        minItems: 2,
+        maxItems: 2,
+      },
+    },
+    choroplethFallback: { type: 'string' },
+  },
+}
+
+const MAP_POPUP_SCHEMA = {
+  type: 'object',
+  properties: {
+    titleField: { type: 'string' },
+    fields: { type: 'array', items: { type: 'string' } },
+    template: {
+      type: 'string',
+      description: 'Trusted-host HTML template; ignored on the default untrusted renderer path',
+    },
+  },
+}
+
 export const MapRegistry: ComponentRegistryEntry = {
   type: 'map',
   name: 'InteractiveMap',
   description:
-    'Render interactive maps with markers using Leaflet. Supports marker clustering, custom tile layers, and auto-fitting bounds. Best for displaying geographic data with up to 1000 markers.',
+    'Render interactive maps on the default OpenStreetMap base layer (using Leaflet internally) from already-resolved markers, GeoJSON, named layers, clustering, or PMTiles. The renderer does not geocode place names.',
   schema: {
     type: 'object',
     properties: {
-      center: { type: 'array', items: { type: 'number' }, minItems: 2, maxItems: 2, description: 'Map center [lat, lng]' },
-      zoom: { type: 'number', description: 'Zoom level (1-18, default: 13)' },
+      center: {
+        ...MAP_LAT_LNG_POINT_SCHEMA,
+        description: 'Initial map center as [lat, lng] or { lat, lng }',
+      },
+      zoom: { type: 'number', description: 'Initial zoom level (default: 13)' },
       markers: {
         type: 'array',
         items: {
           type: 'object',
           properties: {
-            position: { type: 'array', items: { type: 'number' }, minItems: 2, maxItems: 2 },
-            title: { type: 'string' },
+            position: MAP_LAT_LNG_POINT_SCHEMA,
+            tooltip: { type: 'string' },
             popup: { type: 'string' },
           },
           required: ['position'],
         },
       },
       height: { type: 'string', description: 'CSS height (default: 400px)' },
-      fitBounds: { type: 'boolean', description: 'Auto-fit to show all markers' },
-      clustering: { type: 'boolean', description: 'Enable marker clustering for large datasets' },
+      fitBounds: { type: 'boolean', description: 'Auto-fit to rendered markers and features' },
+      zoomControl: { type: 'boolean', description: 'Show Leaflet zoom controls' },
+      scrollWheelZoom: { type: 'boolean', description: 'Allow scroll-wheel zoom' },
+      tileLayer: {
+        type: 'string',
+        description:
+          'Optional base tile URL template (defaults to OpenStreetMap); the host remains responsible for network policy',
+      },
+      attribution: { type: 'string', description: 'Base-map attribution' },
+      className: { type: 'string', description: 'Custom CSS class' },
+      geojson: MAP_GEOJSON_SCHEMA,
+      geojsonStyle: MAP_GEOJSON_STYLE_SCHEMA,
+      popup: MAP_POPUP_SCHEMA,
+      layers: {
+        type: 'array',
+        description: 'Named GeoJSON overlays',
+        items: {
+          type: 'object',
+          properties: {
+            name: { type: 'string', minLength: 1 },
+            visible: { type: 'boolean' },
+            geojson: MAP_GEOJSON_SCHEMA,
+            style: MAP_GEOJSON_STYLE_SCHEMA,
+            popup: MAP_POPUP_SCHEMA,
+          },
+          required: ['name', 'geojson'],
+        },
+      },
+      clustering: {
+        oneOf: [
+          { type: 'boolean' },
+          {
+            type: 'object',
+            properties: {
+              maxClusterRadius: { type: 'number' },
+              spiderfyOnMaxZoom: { type: 'boolean' },
+              showCoverageOnHover: { type: 'boolean' },
+              disableClusteringAtZoom: { type: 'number' },
+              animateAddingMarkers: { type: 'boolean' },
+            },
+          },
+        ],
+        description: 'Enable marker clustering or provide cluster options',
+      },
+      pmtiles: {
+        type: 'object',
+        description: 'PMTiles vector-tile overlay (requires the optional protomaps-leaflet peer)',
+        properties: {
+          url: { type: 'string' },
+          attribution: { type: 'string' },
+          paintRules: {
+            type: 'array',
+            items: {
+              type: 'object',
+              properties: {
+                dataLayer: { type: 'string' },
+                symbolizer: { type: 'string', enum: ['polygon', 'line', 'circle'] },
+                color: { type: 'string' },
+                width: { type: 'number' },
+                opacity: { type: 'number' },
+              },
+              required: ['dataLayer', 'symbolizer'],
+            },
+          },
+          labelRules: {
+            type: 'array',
+            items: {
+              type: 'object',
+              properties: {
+                dataLayer: { type: 'string' },
+                textField: { type: 'string' },
+                fontSize: { type: 'number' },
+              },
+              required: ['dataLayer', 'textField'],
+            },
+          },
+          maxZoom: { type: 'number' },
+          minZoom: { type: 'number' },
+        },
+        required: ['url'],
+      },
     },
     required: [],
   },

package/src/services/validation.test.ts

@@ -15,6 +15,7 @@ import {
   DEFAULT_RESOURCE_LIMITS,
 } from './validation';
 import type { UIComponent, ComponentType } from '../types';
+import { ComponentTypeSchema } from '@seed-ship/mcp-ui-spec';
 
 /** Helper to create a minimal valid UIComponent for testing */
 function makeComponent(type: ComponentType, params: Record<string, any> = {}): UIComponent {
@@ -51,6 +52,7 @@ const PASSTHROUGH_TYPES: ComponentType[] = [
   'grid',
   'carousel',
   'footer',
+  'composite', // v6.x — restored to KNOWN_COMPONENT_TYPES via the spec-derived Set
 ];
 
 describe('validateComponent', () => {
@@ -64,6 +66,30 @@ describe('validateComponent', () => {
     });
   });
 
+  describe('spec↔solid parity (drift guard)', () => {
+    // KNOWN_COMPONENT_TYPES is now derived from ComponentTypeSchema.options (the
+    // single source of truth) instead of a hand-written list, so a spec enum
+    // member can never silently drift out of solid's known-types set again.
+    // `composite` is the regression case: it lives in the spec enum but had
+    // been dropped from the former hand list, contradicting its pass-through
+    // docstring and making a composite component get flagged as unknown.
+    it('composite is a spec component type (single source of truth)', () => {
+      expect(ComponentTypeSchema.options).toContain('composite');
+    });
+
+    it('every passthrough type under test is a real spec component type', () => {
+      for (const type of PASSTHROUGH_TYPES) {
+        expect(ComponentTypeSchema.options).toContain(type);
+      }
+    });
+
+    it('recognizes composite (regression lock: it had drifted out of the known set)', () => {
+      const result = validateComponent(makeComponent('composite'));
+      const unknown = result.errors?.find((e) => e.code === 'UNKNOWN_COMPONENT_TYPE');
+      expect(unknown).toBeUndefined();
+    });
+  });
+
   describe('validated types still work', () => {
     it('validates a valid chart component', () => {
       const component = makeComponent('chart', {

package/src/services/validation.ts

@@ -27,6 +27,8 @@ import {
   FormComponentParamsSchema,
   // v6.0.0 — graph primitive (peer @antv/g6 ^5)
   GraphComponentParamsSchema,
+  // Single source of truth for the component-type enum (kills spec↔solid drift).
+  ComponentTypeSchema,
 } from '@seed-ship/mcp-ui-spec';
 import type {
   UIComponent,
@@ -44,30 +46,14 @@ import type {
 /**
  * All known ComponentType values — used to distinguish known-but-unvalidated
  * types (pass through) from truly unknown strings (reject).
+ *
+ * Derived directly from the spec's `ComponentTypeSchema` (the single source of
+ * truth) rather than hand-maintained, so a new enum member in the spec can
+ * never silently drift out of solid's known-types set again. This is what
+ * restored `composite`: it is in the spec enum but had been dropped from the
+ * former hand-written list, contradicting the pass-through docstrings below.
  */
-const KNOWN_COMPONENT_TYPES: Set<string> = new Set<ComponentType>([
-  'chart',
-  'table',
-  'metric',
-  'text',
-  'grid',
-  'iframe',
-  'image',
-  'link',
-  'action',
-  'footer',
-  'carousel',
-  'artifact',
-  'form',
-  'modal',
-  'action-group',
-  'image-gallery',
-  'video',
-  'code',
-  'map',
-  // v6.0.0
-  'graph',
-]);
+const KNOWN_COMPONENT_TYPES: Set<string> = new Set<string>(ComponentTypeSchema.options);
 
 /**
  * Spec-driven validation dispatch table (B.1 — v5.5.0, expanded in v5.6.0).
@@ -81,7 +67,9 @@ const KNOWN_COMPONENT_TYPES: Set<string> = new Set<ComponentType>([
  *
  * **v5.6.0** : `map` and `form` joined the dispatch after spec@5.0.2 relaxed
  * their schemas (LatLngPoint union for map.center, regex relax for
- * field.name) per deposium audit §L answers. Closed B.1 to **14/17 types**.
+ * field.name) per deposium audit §L answers. As of v6.x this table
+ * spec-validates 15 of the 21 component types; the remainder use imperative
+ * validators (`chart`/`table`) or are pass-through (`grid`/`footer`/`composite`/`modal`).
  *
  * Types deliberately omitted (kept on the imperative path):
  *   - `chart`, `table` — have rich imperative validators with their own

package/src/types/index.ts

@@ -6,29 +6,15 @@
  */
 
 /**
- * Component types supported by the renderer
+ * Component types supported by the renderer.
+ *
+ * Re-exported from `@seed-ship/mcp-ui-spec` (`ComponentTypeSchema`) — the spec
+ * is the single source of truth for the enum. Solid used to hand-maintain a
+ * parallel union here, which drifted (it had silently dropped `composite`).
+ * Re-exporting keeps this type and the spec enum in lockstep by construction.
  */
-export type ComponentType =
-  | 'chart'
-  | 'table'
-  | 'metric'
-  | 'text'
-  | 'grid'
-  | 'iframe'
-  | 'image'
-  | 'link'
-  | 'action'
-  | 'footer'
-  | 'carousel'
-  | 'artifact'
-  | 'form'
-  | 'modal'
-  | 'action-group'
-  | 'image-gallery' // Sprint 5
-  | 'video'         // Sprint 5
-  | 'code'          // Sprint 6
-  | 'map'           // Sprint 6
-  | 'graph'         // v6.0.0 — node-link viz (peer @antv/g6)
+import type { ComponentType, LatLngPoint } from '@seed-ship/mcp-ui-spec'
+export type { ComponentType, LatLngPoint }
 
 /**
  * Chart types (powered by Quickchart)
@@ -793,9 +779,9 @@ export interface CodeComponentParams {
  */
 export interface MapMarker {
   /**
-   * Position as [latitude, longitude] tuple
+   * Position as a [latitude, longitude] tuple or { lat, lng } object
    */
-  position: [number, number]
+  position: LatLngPoint
 
   /**
    * Tooltip text (shown on hover)
@@ -895,9 +881,9 @@ export interface MapLayer {
  */
 export interface MapComponentParams {
   /**
-   * Initial center [lat, lng]
+   * Initial center as [lat, lng] or { lat, lng }
    */
-  center?: [number, number]
+  center?: LatLngPoint
 
   /**
    * Initial zoom level (default: 13)

package/src/types/map-types.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, it } from 'vitest'
+import type { LatLngPoint as SpecLatLngPoint } from '@seed-ship/mcp-ui-spec'
+import type { LatLngPoint, MapComponentParams, MapMarker } from './index'
+
+type Equal<A, B> = [A] extends [B] ? ([B] extends [A] ? true : never) : never
+const _latLngParity: Equal<LatLngPoint, SpecLatLngPoint> = true
+void _latLngParity
+
+describe('public map types (UI-MAP-0a)', () => {
+  it('accepts both tuple and object LatLng forms', () => {
+    const tuple: LatLngPoint = [48.8566, 2.3522]
+    const object: LatLngPoint = { lat: 51.5074, lng: -0.1278 }
+    const marker: MapMarker = { position: object, tooltip: 'London' }
+    const params: MapComponentParams = { center: object, markers: [marker] }
+
+    expect(tuple).toEqual([48.8566, 2.3522])
+    expect(params.center).toEqual(object)
+    expect(params.markers?.[0].position).toEqual(object)
+  })
+})

package/src/utils/escape-html.test.ts

@@ -0,0 +1,30 @@
+import { describe, it, expect } from 'vitest';
+import { escapeHtml } from './escape-html';
+
+describe('escapeHtml', () => {
+  it('escapes all five significant HTML characters', () => {
+    expect(escapeHtml(`&<>"'`)).toBe('&amp;&lt;&gt;&quot;&#39;');
+  });
+
+  it('escapes the single quote (the case MapRenderer previously missed)', () => {
+    expect(escapeHtml("O'Brien")).toBe('O&#39;Brien');
+  });
+
+  it('escapes ampersand first so entities are not double-encoded incorrectly', () => {
+    expect(escapeHtml('a & b < c')).toBe('a &amp; b &lt; c');
+  });
+
+  it('neutralizes a script-injection attempt in a popup/tooltip value', () => {
+    expect(escapeHtml('<script>alert("x")</script>')).toBe(
+      '&lt;script&gt;alert(&quot;x&quot;)&lt;/script&gt;'
+    );
+  });
+
+  it('leaves a plain string untouched', () => {
+    expect(escapeHtml('Toulouse 31000')).toBe('Toulouse 31000');
+  });
+
+  it('returns an empty string for empty input', () => {
+    expect(escapeHtml('')).toBe('');
+  });
+});

package/src/utils/escape-html.ts

@@ -0,0 +1,24 @@
+/**
+ * Canonical HTML-escaper for untrusted payload values bound into HTML-string
+ * contexts (Leaflet marker popups/tooltips, G6 node/edge tooltips).
+ *
+ * Escapes the five significant characters — `& < > " '` — so a value is safe
+ * in both text-node and quoted-attribute positions. Pure + exported for tests.
+ *
+ * Consolidated (audit 2026-05-30 hygiene pass) from two previously-divergent
+ * private copies: MapRenderer's escaped `& < > "` (it MISSED the single quote),
+ * GraphRenderer's escaped all five. This single source removes that divergence.
+ */
+export function escapeHtml(str: string): string {
+  return str.replace(/[&<>"']/g, (c) =>
+    c === '&'
+      ? '&amp;'
+      : c === '<'
+        ? '&lt;'
+        : c === '>'
+          ? '&gt;'
+          : c === '"'
+            ? '&quot;'
+            : '&#39;'
+  );
+}