@seed-ship/mcp-ui-solid 6.19.1 → 6.21.0

package/src/utils/format-string.ts

@@ -0,0 +1,33 @@
+/**
+ * `formatMCPUIString` — the chrome-string template helper, runtime-free.
+ *
+ * @since v6.20.0 (extracted from `MCPUIStringsContext` so the pure adapters
+ * under `src/adapters` can interpolate their own message templates without
+ * importing `solid-js`). `MCPUIStringsContext` re-exports it, so every
+ * existing import path — including the root barrel — keeps working.
+ *
+ * This module imports nothing. It must stay that way: `src/adapters/*` is
+ * published as a dedicated subpath that never pulls in the renderer.
+ */
+
+/**
+ * Substitutes `{name}` placeholders in a chrome string template.
+ *
+ * Only the keys present in `vars` are replaced; an unknown placeholder is
+ * left verbatim so a mistyped or locale-specific template degrades to
+ * visible text rather than to `undefined`.
+ *
+ * @example
+ * ```ts
+ * formatMCPUIString('Sort by {column}', { column: 'Revenue' }) // 'Sort by Revenue'
+ * formatMCPUIString('Export CSV ({count} rows)', { count: 42 }) // 'Export CSV (42 rows)'
+ * ```
+ */
+export function formatMCPUIString(
+  template: string,
+  vars: Record<string, string | number>
+): string {
+  return template.replace(/\{(\w+)\}/g, (match, name: string) =>
+    Object.prototype.hasOwnProperty.call(vars, name) ? String(vars[name]) : match
+  )
+}

package/src/utils/iframe-coep.ts

@@ -0,0 +1,74 @@
+/**
+ * COEP helpers for the two iframes the library renders
+ * (`IframeRenderer` in `UIResourceRenderer.tsx`, and the YouTube / Vimeo
+ * embed in `VideoRenderer.tsx`).
+ *
+ * @since v6.21.0
+ *
+ * A host that serves `Cross-Origin-Embedder-Policy: credentialless` makes the
+ * browser refuse any cross-origin iframe whose own document sends no COEP
+ * header. The HTML attribute `credentialless` on the `<iframe>` lifts that,
+ * at the price of the embedded document losing access to the cookies and
+ * storage of its own origin — see `MCPUIConfigContext` for the policy.
+ */
+
+import { createSignal, onMount, type Accessor } from 'solid-js'
+import { isTrustedIframeDomain } from '../services/validation'
+import type { MCPUIConfig } from '../context/MCPUIConfigContext'
+
+/**
+ * Does this iframe get the boolean `credentialless` attribute?
+ *
+ * `'auto'` (the default) says yes only when the embed has nothing to lose:
+ * the host is not trusted AND the iframe already runs without cookies because
+ * its `sandbox` has no `allow-same-origin` (`sandboxedWithoutSameOrigin`).
+ * The video embed carries no sandbox, so in `'auto'` it keeps its provider
+ * cookies and a COEP host must opt in with `'always'`.
+ *
+ * An unparsable URL is not trusted, so it gets the attribute.
+ */
+export function shouldSetCredentialless(
+  url: string,
+  config: MCPUIConfig,
+  options: { sandboxedWithoutSameOrigin: boolean }
+): boolean {
+  const mode = config.iframeCredentialless
+  if (mode === 'always') return true
+  if (mode === 'never') return false
+  if (!options.sandboxedWithoutSameOrigin) return false
+  return !isTrustedIframeDomain(url, {
+    customTrustedDomains: config.customTrustedIframeDomains,
+  })
+}
+
+/**
+ * `window.crossOriginIsolated`, read **after mount** into a signal.
+ *
+ * Reading it during render would make the server emit markup the client
+ * cannot reproduce; the signal starts at `false` (the SSR value) and flips
+ * once mounted, so hydration always matches.
+ */
+export function createCrossOriginIsolated(): Accessor<boolean> {
+  const [isolated, setIsolated] = createSignal(false)
+  onMount(() => {
+    setIsolated(typeof window !== 'undefined' && window.crossOriginIsolated === true)
+  })
+  return isolated
+}
+
+/**
+ * Does the "open in a new tab" link show under an embed?
+ *
+ * `'auto'` shows it only on a cross-origin-isolated page — exactly where COEP
+ * can block the frame, and where the blocking is silent (a refused
+ * cross-origin document fires no `error` event the parent can observe).
+ */
+export function shouldShowIframeFallbackLink(
+  config: MCPUIConfig,
+  crossOriginIsolated: boolean
+): boolean {
+  const mode = config.iframeFallbackLink
+  if (mode === 'always') return true
+  if (mode === 'never') return false
+  return crossOriginIsolated
+}

package/src/validation.ts

@@ -19,9 +19,18 @@ export {
   validateTableComponent,
   validatePayloadSize,
   validateIframeDomain,
+  getIframeSandbox,
+  // v6.21.0 — trusted-host test shared by the sandbox and the
+  // `credentialless` iframe attribute.
+  isTrustedIframeDomain,
   sanitizeString,
   DEFAULT_RESOURCE_LIMITS,
+  // v6.20.0 — end-user form validation with injectable wording.
+  validateFieldValue,
+  validateFormData,
+  DEFAULT_VALIDATION_MESSAGES,
 } from './services/validation'
+export type { FormValidationMessages } from './services/validation'
 
 // Re-export types only (no runtime code)
 export type {