@seed-ship/mcp-ui-solid 6.19.1 → 6.21.0

package/CHANGELOG.md

@@ -5,6 +5,669 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [6.21.0] - 2026-09-17
+
+The library's iframes now work on a host that serves
+`Cross-Origin-Embedder-Policy: credentialless`.
+
+### The problem
+
+Under that header a browser refuses **any** cross-origin iframe whose own
+document does not itself send a COEP header. That is YouTube, Vimeo, Google
+Docs, Notion — nearly every entry of `DEFAULT_IFRAME_DOMAINS`. The frame stays
+blank and nothing in the page can detect it: a refused cross-origin document
+fires no `error` event the parent can observe. The `credentialless` *header*
+only relaxes the rule for sub-resources (images, fonts, map tiles — which is
+why the quickchart `<img>` fallback and the Leaflet tiles were never
+affected); nested documents need the boolean HTML attribute
+`<iframe credentialless>` on the tag itself.
+
+### What the library now does
+
+Both iframes it renders — `IframeRenderer` (the `iframe` component) and
+`VideoRenderer`'s YouTube / Vimeo embed — can carry `credentialless` when their
+host is **not** in `TRUSTED_IFRAME_DOMAINS`.
+
+- **The `iframe` component on an untrusted host gets it by default.** Those
+  frames already ran without cookies, since their sandbox has no
+  `allow-same-origin`. The attribute costs them nothing and is exactly what
+  unblocks them under COEP.
+- **The video embed does NOT get it by default.** It carries no sandbox, so a
+  YouTube or Vimeo frame really does hold provider cookies (consent, playback
+  state, sign-in). Taking them away on every host — including the majority
+  that send no COEP header — would be a silent regression, so `'auto'` leaves
+  it alone and a COEP host opts in with `iframeCredentialless: 'always'`.
+- **Trusted hosts deliberately do NOT get it.** `TRUSTED_IFRAME_DOMAINS`
+  (Google Docs/Drive, Notion, Airtable, Figma, Linear, Stripe, Polar, HubSpot,
+  Calendly, …) exists precisely because those embeds need their own cookies to
+  authenticate. Loaded `credentialless` they would render a login screen — a
+  visibly broken embed. Under COEP they stay blocked, which is the honest
+  outcome; `iframeCredentialless: 'always'` overrides it if you disagree.
+
+The attribute is a **boolean** attribute: it is absent from the DOM when it
+does not apply, never `credentialless="false"`.
+
+### Added
+
+- **`<MCPUIConfigProvider>` / `useMCPUIConfig()` / `DEFAULT_MCPUI_CONFIG` /
+  `MCPUIConfig`** (new `src/context/MCPUIConfigContext.tsx`, exported from the
+  root barrel) — host-level rendering policy, the behavioural counterpart of
+  `MCPUIStrings`. Three options:
+
+  | option | default | meaning |
+  | --- | --- | --- |
+  | `iframeCredentialless` | `'auto'` | `'auto'`: attribute on the `iframe` component when its host is not trusted (those frames already run without cookies); the video embed, which has no sandbox, is left alone. `'always'`: every iframe, video and trusted hosts included. `'never'`: none. |
+  | `customTrustedIframeDomains` | `[]` | extra hosts treated as trusted — no `credentialless`, and `allow-same-origin` in the sandbox. Subdomains match. Reclassification only: the allow-list must already accept the host. |
+  | `iframePolicy` | `'strict'` | how an `iframe` component's host is validated; `'extend'` also accepts `customIframeDomains`. |
+  | `customIframeDomains` | `[]` | extra hosts the allow-list accepts under `iframePolicy: 'extend'`. Without this, an unlisted host never reaches a renderer. |
+  | `iframeFallbackLink` | `'auto'` | when the "open in a new tab" link shows under an embed. `'auto'`: only on a cross-origin-isolated page. |
+
+  ```tsx
+  import { MCPUIConfigProvider } from '@seed-ship/mcp-ui-solid'
+
+  // A host that serves COEP: credentialless and embeds its own tool.
+  <MCPUIConfigProvider
+    config={{
+      iframeCredentialless: 'always',
+      iframePolicy: 'extend',
+      customIframeDomains: ['embed.acme.com'],
+      customTrustedIframeDomains: ['embed.acme.com'],
+      iframeFallbackLink: 'auto',
+    }}
+  >
+    <App />
+  </MCPUIConfigProvider>
+
+  // A host with no COEP header that does not want its embeds to lose cookies.
+  <MCPUIConfigProvider config={{ iframeCredentialless: 'never' }}>
+    <App />
+  </MCPUIConfigProvider>
+  ```
+
+  With no provider mounted, `DEFAULT_MCPUI_CONFIG` applies — every renderer
+  still works standalone.
+
+- **`isTrustedIframeDomain(url, { customTrustedDomains? })`** — the trusted-host
+  test `getIframeSandbox` already performed, extracted and exported from the
+  root barrel and from the `@seed-ship/mcp-ui-solid/validation` subpath
+  (`getIframeSandbox` is now exported from that subpath too). Invalid URL →
+  `false`, so an unparsable URL is never trusted and does receive the
+  attribute. Matching is unchanged: exact host, or a subdomain of a listed
+  host.
+
+- **`MCPUIStrings.iframeOpenInNewTab`** — optional, default
+  `'Open in a new tab'`. Label of the link rendered under an embed, which is
+  the only way out of a silently blocked frame. Visibility follows
+  `iframeFallbackLink`; `window.crossOriginIsolated` is read **after mount**,
+  never during render, so SSR markup and hydration agree. That flag requires
+  COOP `same-origin` on top of COEP — a host that sends COEP alone should set
+  `iframeFallbackLink: 'always'`, since its embeds are blocked while the flag
+  reads false. The link is skipped
+  when `safeUrl()` rejects the URL. `MCPUIStrings` now covers **271 keys**.
+
+### Fixed
+
+- `IframeRenderer` called `getIframeSandbox(params.url)` with no options, so a
+  host's custom trusted domains never reached the sandbox. It now passes
+  `{ customTrustedDomains: config.customTrustedIframeDomains }`, which is what
+  makes `customTrustedIframeDomains` grant `allow-same-origin` as documented.
+
+### Browser support
+
+| | header `COEP: credentialless` | attribute `<iframe credentialless>` |
+| --- | --- | --- |
+| Chrome / Edge | 96+ | **110+** |
+| Firefox | 119+ | **not supported** |
+| Safari | not supported (value ignored) | not supported |
+
+- **Chrome / Edge** — the attribute fixes the problem. This is the majority
+  case.
+- **Firefox** — honours the header but ignores the attribute, so third-party
+  iframes stay blocked for as long as the host page sends COEP. Nothing in
+  this library can change that; it is a host-side trade-off (drop COEP, or
+  accept the degradation on Firefox). The fallback link is what the user gets
+  there.
+- **Safari** — does not know the `credentialless` value and treats the header
+  as absent: no cross-origin isolation, but embeds work.
+
+### Note for hosts
+
+The library's allow-list is not a substitute for your CSP. The browser also
+enforces `frame-src`, which the host sets — a domain missing from it stays
+blocked whatever this library emits (see the comment at
+`services/validation.ts` on `DEFAULT_IFRAME_DOMAINS`: "Must match CSP
+frame-src directive").
+
+### Tests
+
+`src/components/IframeCredentialless.test.tsx` (25 tests) — the
+`isTrustedIframeDomain` matching table, attribute presence/absence through
+`<UIResourceRenderer>` and `<VideoRenderer>` for each `iframeCredentialless`
+mode, the `customTrustedIframeDomains` → sandbox plumbing, the fallback link
+under each `iframeFallbackLink` mode with `window.crossOriginIsolated`
+stubbed, and the SSR-shape assertions on the pure decision helpers. Plus a new
+`iframeOpenInNewTab` case in `MCPUIStringsContext.sweep.test.tsx` and the
+default pinned in `mcpui-strings-defaults.test.ts`.
+
+## [6.20.0] - 2026-09-17
+
+Every user-visible chrome string the library itself renders — button titles,
+`aria-label`s, placeholders, empty states, degraded-fallback captions, form
+validation messages, and more — is now localizable: through `MCPUIStrings`
+for components (`useMCPUIStrings()`), or through an exported `messages` /
+`labels` option with an English default table for the runtime-free adapters,
+services, helpers and hooks that cannot read Solid context. `MCPUIStrings`
+now covers **270 keys** (9 required, carried over from the original v6.6.0
+surface, plus 261 optional — every key added since defaults to English and
+falls back cleanly when omitted). The only strings still hardcoded fall under
+the explicit exclusion policy below (P1–P8). Both are enforced by an
+AST-based guard test over all of `src` and a runtime pseudo-localization
+render test — see **Tests**.
+
+### Added
+
+- **251 new optional `MCPUIStrings` keys** (the released 6.19.1 had 19),
+  bringing the total to 270. Each defaults to the exact English literal it
+  replaced, except the defaults listed under **Changed**. The complete list,
+  with defaults and where each key is used, is the key reference table in
+  the README (*Internationalization (i18n) — `MCPUIStrings`*). Selected
+  groups:
+
+  - **Generic chrome** — `download`: `"Download"` (`ArtifactRenderer`
+    download link), `unknown`: `"unknown"` (`GenerativeUIErrorBoundary`
+    metadata fallback)
+  - **`UIResourceRenderer` table citations** — `citationUnresolved`:
+    `"[ref. {id}]"` (template `{id}`; placeholder for a citation marker no
+    `citationMap` resolves, empty map only — see **Changed**)
+  - **`UIResourceRenderer` error / fallback chrome** — `invalidComponent`:
+    `"Invalid {type}"`, `toolErrorTitle`: `"Tool Error: {tool}"`,
+    `errorTypeLabel`: `"Type: {type}"`, `errorSuggestions`: `"Suggestions:"`,
+    `chartInvalidData`: `"Invalid chart data: missing data.datasets"`,
+    `unsupportedComponentType`: `"Unsupported component type:"`
+  - **`UIResourceRenderer` table (search, pagination, tool-error clipboard)**
+    — `tableVirtualizedRows`: `"(virtualized: {count} rows)"`,
+    `tableSearchResultsOne` / `tableSearchResultsMany`:
+    `"{count} result(s) on {total}"` (was one template with a hardcoded
+    `s`), `tableServerPageRange`: `"Showing {start} - {end} of {total}"`,
+    `errorCopyText`: `"Error in {tool}: {message}"` (text the tool-error
+    card's Copy button puts on the clipboard), `errorUnknownTool`:
+    `"unknown tool"` (tool name inside `errorCopyText` when the error has
+    none)
+  - **`DataPreviewSection`** — `previewPrev`: `"Prev"`, `previewNext`:
+    `"Next"`, `previewPageIndicator`: `"Page {page} / {total}"`,
+    `previewShowingRange`: `"Showing {start}–{end} of {total}"`,
+    `previewRowsOne`: `"{count} row"`, `previewRowsMany`: `"{count} rows"`,
+    `previewTotalSuffix`: `" ({total} total)"`
+  - **`FormFieldRenderer`** — `fieldResolving`: `"Resolving..."`,
+    `fieldAddMorePlaceholder`: `"Add more..."`, `fieldUnknownType`:
+    `"Unknown field type: {type}"`, `fieldSelectedCount`: `"{count}
+    selected"`
+  - **`FormRenderer`** — `formPrefilledOne`: `"{count} field pre-filled out
+    of {total}"`, `formPrefilledMany`: `"{count} fields pre-filled out of
+    {total}"` (shared with `ScratchpadPanel`'s prefill summary — see
+    **Changed**), `formSubmitting`: `"Submitting..."`, `formReset`:
+    `"Reset"`
+  - **`GenerativeUIErrorBoundary`** — `errorBoundaryTitle`: `"Component
+    Failed to Render"`, `errorBoundaryMeta`: `"Type: {type} | ID:
+    {id}..."` (both fall back to `unknown`), `errorBoundaryRetry`: `"Retry
+    Rendering"`
+  - **`ScratchpadPanel`** — `scratchpadSearch`: `"Search"`
+    (`waiting_human` search button), `scratchpadNextStep`: `"Next"`
+    (steps view advance button), `scratchpadPlan`: `"Plan:"`,
+    `scratchpadModify`: `"Modify"` (prompt-section edit button),
+    `scratchpadDetails`: `"Details"` (error-section toggle),
+    `scratchpadItems`: `"items"` (action-section item-count suffix),
+    `statusLoading` / `statusActionAvailable` / `statusYourTurn` /
+    `statusProcessing` / `statusComplete` — status badge, one key per
+    state (the `error` state reuses `scratchpadError`),
+    `scratchpadErrorCode`: `"Code: {code}"`, `scratchpadResultCount`:
+    `"{count} results"` (data-source card row count)
+  - **`VideoRenderer`** — `videoUnsupported`: `"Your browser does not
+    support the video tag."` (`<video>` fallback text)
+  - **`AgentCard` / `AgentStatusBadge`** — `agentStatusIdle`: `"Idle"`,
+    `agentStatusRunning`: `"Running"`, `agentStatusWaiting`: `"Waiting"`,
+    `agentStatusDone`: `"Done"`, `agentStatusError`: `"Error"`
+  - **`AgentHandoff`** — `handoffItems`: `"{count} items"` (fallback;
+    `content.summary` still wins)
+  - **Fallback ladder** (`DegradedFallback`, `ChartJSRenderer`,
+    `GraphRenderer`, `MapRenderer`) — `degradedMoreRows`: `"+{count} more
+    rows not shown."`, `chartDegradedCaption`, `chartRenderFailed`:
+    `"Chart rendering failed: {error}"`, `chartRenderError`,
+    `chartQuickchartCaption`, `graphDegradedCaption`, `graphRenderFailed`,
+    `graphRenderError`, `graphPngUnsupported`, `graphPngExportFailed`,
+    `mapLibraryUnavailable`, `mapDegradedCaption`, `mapRenderFailed`,
+    `mapRenderError`
+  - **Degraded / accessible table headers** — `degradedColType`,
+    `degradedColLat`, `degradedColLng`, `degradedColInfo`,
+    `degradedColSource`, `degradedColTarget`, `degradedColNode`,
+    `degradedColLabel`, `degradedSeries`: `"Series {n}"`, `chartTableSeries`,
+    `chartTablePoint`, plus `degradedMarker`: `"marker"` and
+    `degradedFeature`: `"feature"` — the degraded map table's `Type` cell
+    for a marker row / a GeoJSON feature without a geometry type (mirrored
+    in `DEGRADED_PROJECTION_LABELS`, see below)
+  - **`AutocompleteDropdown` / `AutocompleteFormField`** —
+    `autocompleteHintNavigate`: `" to navigate, "`, `autocompleteHintSelect`:
+    `" to select, "`, `autocompleteHintDismiss`: `" to dismiss"`,
+    `autocompleteTabToAccept`: `"Tab to accept"` (the `<kbd>` key caps
+    themselves stay hardcoded — P1)
+  - **Images and chart fallbacks** — `galleryViewImage`: `"View image
+    {index}"`, `galleryImageAlt`: `"Image {index}"` (a payload `image.alt`
+    still wins for both), `imageAltFallback`: `"image"`,
+    `chartVisualizationAlt`: `"Chart visualization"`, `chartWithTitleAlt`:
+    `"Chart: {title}"`, `chartLoadFailed`: `"Failed to load chart"`
+  - **Table pagination** — `paginationAllRows`: `"All"`
+  - **Form validation** — `fieldRequired`, `fieldMustBeChecked`,
+    `fieldMinLength`, `fieldMaxLength`, `fieldInvalidPattern`,
+    `fieldInvalidEmail`, `fieldInvalidNumber`, `fieldMinValue`,
+    `fieldMaxValue`, `fieldMinDate`, `fieldMaxDate`, `fieldInvalidOption`,
+    `fieldInvalidFormat`: `"Invalid format (expected: {format})"`
+    (`field.valueFormatHint` wins when set) — `FormRenderer` feeds these
+    into `validateFieldValue` / `validateFormData` from `useMCPUIStrings()`
+  - **`BriefingDiff`** — `briefingAdded`: `"+{count} added"`,
+    `briefingRemoved`: `"{count} removed"`, `briefingChanged`: `"{count}
+    changed"`
+  - **`FooterRenderer`** — `footerSources`: `"{count} sources"`
+  - **`StreamingUIRenderer` / `useStreamingUI`** — `streamInitializing`:
+    `"Initializing..."`, `streamConnecting`: `"Connecting to server..."`,
+    `streamLoadingComponent`: `"Loading {type} component..."`,
+    `streamDashboardLoaded`: `"Dashboard loaded"`, `streamErrorProgress`:
+    `"Error: {message}"`, `streamConnectionFailed`: `"Stream connection
+    failed"`, `streamRequestFailed`: `"Stream request failed"`,
+    `streamEmptyResponse`: `"Response body is null"`, `streamServerSide`:
+    `"Streaming UI cannot start on server-side"`, `streamUnknownError`:
+    `"Unknown error"`
+  - **`locale`**: `"en-US"` — see **Changed**
+  - **Unavailable and degraded states shown to end users** —
+    `streamServerSideTitle`: `"Streaming unavailable"` (see **Changed**),
+    `graphUnavailable`: `"Graph rendering unavailable"`,
+    `mapPmtilesUnavailable`: `"PMTiles layer unavailable — the optional
+    \"protomaps-leaflet\" peer dependency failed to load or render."`,
+    `mapBaseMapStillShown`: `"The base map is still shown."`,
+    `chartJsUnavailable`: `"Chart.js is not available. Install chart.js peer
+    dependency."`, `chartIframeUnavailable`: `"Interactive chart unavailable
+    — install the chart.js peer dependency, or set allowQuickchartFallback to
+    use the external quickchart.io renderer."`, `previewInvalidContent`:
+    `"[DataPreviewSection] Invalid content format"`. Their text names a peer
+    or a config flag, but end users see them, so a host can translate them.
+  - **Citation chip tooltip** — `citationViewSource`: `"View source -
+    {label}"` (template `{label}`: file name and page)
+  - **`ArtifactRenderer` file sizes** — `sizeBytes`: `"{size} B"`,
+    `sizeKilobytes`: `"{size} KB"`, `sizeMegabytes`: `"{size} MB"` (the number
+    is formatted with `locale`)
+
+- **`useStreamingUI({ messages })`** — new optional `messages?:
+  Partial<StreamingUIMessages>` on `UseStreamingUIOptions`, with exported
+  `DEFAULT_STREAMING_UI_MESSAGES` and `StreamingUIMessages` (root barrel and
+  `/hooks`). Covers `initializing`, `connecting`, `loadingComponent`,
+  `dashboardLoaded`, `errorProgress`, `connectionFailed`, `requestFailed`,
+  `emptyResponse`, `serverSide`, `unknownError`. `StreamingUIRenderer` feeds
+  it from the `stream*` `MCPUIStrings` keys through getters (a `messages`
+  prop passed directly to the renderer still wins over the context). Every
+  other hook in the library (`useAction`, `useAutocomplete`, `useModal`, …)
+  is unchanged.
+
+- **`CitationCtx.unresolvedLabel?: string`** — new optional field on the
+  exported `CitationCtx` interface (`UIResourceRenderer.tsx`). It supplies
+  the placeholder `transformCellCitations` keeps in a table cell for a
+  citation marker that no `citationMap` resolves (empty map only). Optional,
+  so every existing `renderCellValue(value, citationCtx?)` call site keeps
+  type-checking; the placeholder now defaults to English (`citationUnresolved`)
+  instead of hardcoded French. A second optional field,
+  **`CitationCtx.viewSourceLabel?: string`**, carries the default citation
+  chip's tooltip template (`citationViewSource`); the table renderer fills
+  both from `useMCPUIStrings()`.
+
+- **New export `formatMCPUIString(template, vars)`** (root barrel) —
+  replaces `{name}` placeholders in a template with `vars[name]`; an
+  unrecognized `{placeholder}` is left verbatim rather than throwing or
+  rendering `undefined`. It lives in the dependency-free
+  `src/utils/format-string.ts` (no imports), so the runtime-free adapters
+  use it too, and `MCPUIStringsContext.tsx` re-exports it.
+
+- **New `messages` / `labels` options on the runtime-free adapters,
+  services and helpers** — these modules cannot read
+  `MCPUIStringsProvider` (no `solid-js` import), so their English ships as
+  a TRAILING OPTIONAL parameter with an exported default table; every
+  existing call site keeps type-checking and behaving identically:
+
+  - **`connectorResultToUILayout(result, options?)`**
+    (`src/adapters/connector.ts`) — `options.messages?:
+    Partial<ConnectorAdapterMessages>`. Covers the connector adapter's two
+    degraded-state paragraphs: `degradedNotice` (unreadable payload,
+    template `{versionSuffix}`), `degradedVersionSuffix` (template
+    `{version}`), `versionWarning` (unrecognized schema version, template
+    `{version}`, `{expected}`). New exports `ConnectorAdapterMessages` and
+    `DEFAULT_CONNECTOR_MESSAGES` from `@seed-ship/mcp-ui-solid/adapters`
+    (not the root barrel — no other connector-adapter export is there
+    either):
+
+    ```ts
+    import { connectorResultToUILayout } from '@seed-ship/mcp-ui-solid/adapters'
+
+    connectorResultToUILayout(result, {
+      messages: {
+        versionWarning: '> ⚠ Schéma connecteur non reconnu (`{version}`, attendu `{expected}`).',
+      },
+    })
+    ```
+
+  - **`macroRunToScratchpadState(run, options?)` /
+    `macroInterrogationToChatPromptConfig(q, options?)`**
+    (`src/adapters/macro-run.ts`) — `options.messages?:
+    Partial<MacroRunAdapterMessages>`. The real fields are
+    `agentSectionTitle` (`"Agent"`), `progressSectionTitle` (`"Progress"`),
+    `resultSectionTitle` (`"Result"`), `runAborted` (`"Macro run
+    aborted."`), `runFailed` (`"Macro run failed."`), `confirmDefault`
+    (`"Please confirm to continue."`). New exports
+    `MacroRunAdapterMessages`, `MacroRunAdapterOptions` and
+    `DEFAULT_MACRO_RUN_MESSAGES` from `@seed-ship/mcp-ui-solid/adapters`:
+
+    ```ts
+    macroRunToScratchpadState(run, { messages: { resultSectionTitle: 'Résultat' } })
+    ```
+
+  - **`validateFieldValue(value, field, messages?)` /
+    `validateFormData(data, fields, messages?)`** (`src/services/validation.ts`)
+    — `messages?: Partial<FormValidationMessages>` (13 fields: `required`,
+    `mustBeChecked`, `minLength`, `maxLength`, `invalidPattern`,
+    `invalidEmail`, `invalidNumber`, `minValue`, `maxValue`, `minDate`,
+    `maxDate`, `invalidOption`, `invalidFormat`). New exports
+    `validateFieldValue`, `validateFormData`, `FormValidationMessages` and
+    `DEFAULT_VALIDATION_MESSAGES` from the root barrel and
+    `@seed-ship/mcp-ui-solid/validation` (the two validators were not
+    exported from any entry point before). `FormRenderer` feeds
+    this from `useMCPUIStrings()` (the `field*` keys above) — a host does
+    not normally call `validateFieldValue` directly for that path. The
+    STRUCTURAL validators (`validateComponent`, `validateLayout`, …) keep
+    their English `ValidationError.message` — see the exclusion policy
+    below.
+
+  - **`graphToDegradedTable` / `mapToDegradedTable` /
+    `chartToDegradedTable`** (`src/utils/degraded-projections.ts`) —
+    `labels?: Partial<DegradedProjectionLabels>` (`source`, `target`,
+    `label`, `node`, `type`, `lat`, `lng`, `info`, `marker`, `feature`,
+    `series`). **`chartToDataTable(params, labels?)`**
+    (`src/components/chart-data-table.ts`) — `labels?:
+    Partial<ChartDataTableLabels>` (`series`, `point`, `label`,
+    `seriesName`, `x`, `y`, `r` — the last three are the Chart.js point
+    property names the cells mirror, still overridable). New root-barrel
+    exports `graphToDegradedTable`, `mapToDegradedTable`,
+    `chartToDegradedTable`, `chartToDataTable` (not exported from any entry
+    point before), `DegradedProjectionLabels`, `DEGRADED_PROJECTION_LABELS`,
+    `ChartDataTableLabels`, `CHART_DATA_TABLE_LABELS`. The renderers pass
+    the `degradedCol*` / `chartTable*` keys from `useMCPUIStrings()`.
+
+    ```ts
+    graphToDegradedTable(graph, { source: 'Origine', target: 'Destination' })
+    ```
+
+- **The chrome-strings guard is now a TypeScript-AST scanner over all of
+  `src`.** `scripts/chrome-scan.ts` (outside `src`, not published; `node
+  scripts/chrome-scan.ts [root] [--json] [--raw]`) parses every non-test
+  source and flags: JSX text; literals reaching a visible attribute, a JSX
+  child or the clipboard through `||` / `??`, each ternary branch, template
+  spans, `formatMCPUIString`, helper returns, `const` variables and signal
+  setters; prose in object properties, `*Label`-style helper returns and
+  arrays; French text (accented characters or stopwords); and hardcoded
+  BCP-47 locale tags or argument-less `toLocaleString()` calls in
+  components. `console.*` / logger / telemetry calls, `onError` payloads and
+  thrown errors are skipped by AST context (see **P7** below) — the scanner
+  never has to allow-list them individually. The repository's exclusions
+  (`ALLOW_LIST`, `SANCTIONED_TABLES`, `SCOPED_EXCLUSIONS`) live in
+  `scripts/chrome-scan.policy.ts` and are enforced by
+  `mcpui-strings-guard.test.ts` — see **Tests**.
+
+- **Runtime pseudo-localization test**, `MCPUIStrings.pseudolocale.test.tsx`
+  — see **Tests**.
+
+### Changed
+
+- **New `locale` key (default `'en-US'`) drives every number, date and
+  collation call the library makes on its own behalf.** `strings.locale` now
+  feeds:
+  - `UIResourceRenderer` — table sort (`localeCompare`, was hardcoded
+    `'fr'`) and the client-side pagination range total (`toLocaleString`,
+    was hardcoded `'fr-FR'`), and the tool-error card timestamp
+    (`toLocaleString`, was called with no argument at all — the runtime's
+    implicit locale, which can differ between SSR and hydration);
+  - `DataPreviewSection` — number / currency / date cell formatting and
+    sort comparison (were `'fr-FR'` / `'fr'`; the `" EUR"` currency suffix
+    itself stays — P4), the page-info row counts (were `'fr-FR'`), and
+    percent cells (were `toFixed(1)` + `"%"`, now `Intl.NumberFormat` with
+    `style: 'percent'` — identical output in `en-US`);
+  - `StreamingUIRenderer` — the metadata panel cost (was `"$"` +
+    `toFixed(4)`, now `Intl.NumberFormat` currency USD with a narrow symbol
+    — identical output in `en-US`);
+  - `ArtifactRenderer` — the file-size number (was `toFixed(1)`);
+  - `ScratchpadPanel` — the filter-preview row count and the data-source
+    card's `row_count` (were argument-less);
+  - `MapRenderer` — `buildPopupContent(feature, popup, allowHtml?, locale?)`
+    and `addGeoJSONLayer(..., allowHtml?, locale?)` gain a new trailing
+    optional `locale` parameter for the numbers in auto-generated popups
+    (was hardcoded `'fr-FR'`).
+
+  Restore the previous French formatting with
+  `<MCPUIStringsProvider strings={{ locale: 'fr-FR' }}>`.
+
+  `useMCPUIStrings()` always returns a valid tag: an empty or invalid
+  `locale` (for example `'not_a_locale'`, which makes `Intl` throw a
+  `RangeError`) resolves to `'en-US'`, and a valid one is canonicalized
+  (`'fr-fr'` → `'fr-FR'`). The same check is exported as
+  `resolveMCPUILocale(locale)`. A locale change re-renders the counts and
+  citation wording that depend on it; GeoJSON map popups read it when they
+  open, so the map is not rebuilt.
+
+  Time zones are a separate concern from the locale. Date-only
+  `DataPreviewSection` cells (`2026-09-17`) are now formatted in UTC, so the
+  server and every viewer show the same calendar date. Date-time cells and the
+  tool-error card timestamp are formatted only after mount, in the viewer's
+  time zone, because the server cannot know it: server markup shows the raw
+  date-time value, then the formatted date replaces it.
+
+- **Five more chrome defaults move from French to English**, matching
+  every other key (a published library ships no hardcoded non-English
+  chrome):
+  - `tableSearchPlaceholder`: `"Rechercher dans le tableau..."` → `"Search
+    the table..."` (`UIResourceRenderer` table search input; a connector's
+    own `tableParams.searchPlaceholder` still wins when set);
+  - `verifiedStripLabel`: `"[non vérifié]"` → `"[unverified]"`
+    (`VerifiedText` `mode="strip"`);
+  - `scratchpadEdit`: `"Modifier"` → `"Edit"` (`ScratchpadPanel`'s
+    collapsed auto-submit form edit button);
+  - `citationUnresolved`: `"[réf. {id}]"` → `"[ref. {id}]"`, now backed by
+    the new `CitationCtx.unresolvedLabel`;
+  - `formPrefilledOne` / `formPrefilledMany`: `"{count} champ(s)
+    pré-rempli(s) sur {total}"` → `"{count} field(s) pre-filled out of
+    {total}"` (`FormRenderer` and `ScratchpadPanel`'s prefill summary).
+
+  Restore the previous French text for these five, and the connector
+  adapter's degraded-state text (also changed from French to English —
+  `DEFAULT_CONNECTOR_MESSAGES`, below), with:
+
+  ```tsx
+  <MCPUIStringsProvider
+    strings={{
+      locale: 'fr-FR',
+      tableSearchPlaceholder: 'Rechercher dans le tableau...',
+      verifiedStripLabel: '[non vérifié]',
+      scratchpadEdit: 'Modifier',
+      citationUnresolved: '[réf. {id}]',
+      formPrefilledOne: '{count} champ pré-rempli sur {total}',
+      formPrefilledMany: '{count} champs pré-remplis sur {total}',
+    }}
+  >
+    <App />
+  </MCPUIStringsProvider>
+  ```
+
+  ```ts
+  connectorResultToUILayout(result, {
+    messages: {
+      degradedNotice:
+        '### Résultat non rendu\n\nLe résultat du connecteur n\'a pas pu être interprété{versionSuffix}. Cet état explicite remplace une disparition silencieuse du rendu.',
+      degradedVersionSuffix: ' (schéma : `{version}`)',
+      versionWarning:
+        '> ⚠ Schéma connecteur non reconnu (`{version}`, attendu `{expected}`). Le rendu ci-dessous est en mode dégradé.',
+    },
+  })
+  ```
+
+- **`StreamingUIRenderer` no longer shows the machine code `ssr` as its
+  error heading** when streaming is started during server rendering. It
+  renders `streamServerSideTitle` (`"Streaming unavailable"`) instead. The
+  hook's `StreamError.error` keeps the code `'ssr'` for consumers that test
+  it.
+
+- **`ScratchpadPanel`'s feedback badge now shows the option's label**, not
+  its machine value (`approve` / `reject` / `comment`); nothing is shown
+  after the icon for a free-text comment.
+
+- **`MCPActionProvider`'s fallback action error** — when the action
+  executor throws a non-`Error` value, `ActionResult.error` (which
+  `FormRenderer` displays) now reads `errorUnknown` instead of a hardcoded
+  string.
+
+### Exclusion policy
+
+Every user-visible chrome string now reads from `MCPUIStrings` (components)
+or an exported `messages`/`labels` option (runtime-free adapters, services,
+helpers, hooks) — enforced by `mcpui-strings-guard.test.ts`: anything the
+scanner flags must become a key or an option, or be allow-listed here under
+one of P1–P8.
+
+- **P1 — keyboard key caps inside `<kbd>`.** `AutocompleteDropdown`'s
+  `<kbd>Enter</kbd>` and `<kbd>Esc</kbd>` — the physical key reads "Enter"
+  whatever the UI language. The surrounding hint prose IS localized
+  (`autocompleteHintNavigate` / `autocompleteHintSelect` /
+  `autocompleteHintDismiss`).
+- **P2 — legal attribution wording.** `MapRenderer`'s `"OpenStreetMap</a>
+  contributors"` tile attribution — exact wording required by the ODbL. A
+  host overrides the whole notice via `params.attribution` for another
+  language.
+- **P3 — developer diagnostics** that name an npm package, a peer
+  dependency or a config flag; bracketed `[Component] …` messages;
+  debug-only panels behind an explicit debug flag; developer-misuse errors;
+  and the structural payload-schema diagnostics of `services/validation.ts`:
+  - `GraphRenderer`'s install hint under the localized
+    `graphUnavailable` heading: `"Install"` / `"@antv/g6"` / `"peer
+    dependency to render"` / `"type: \"graph\""` / `"components."` — it
+    names the missing optional `@antv/g6` peer, for whoever installs the
+    host.
+  - `RenderContext`'s `'Component "'` / `'" cannot be rendered outside of
+    UIResourceRenderer'` — a developer-misuse error (a renderer used
+    outside `<UIResourceRenderer>`).
+  - `ScratchpadPanel`'s debug overlay (`| ev:`, `| sec:`, `| last:`,
+    behind the `debugOverlay` prop) and its `FormDebugTrace` panel (behind
+    the `debugTrace` prop) — both mirror raw server/event keys verbatim, for
+    developers.
+  - `services/validation.ts`'s structural validators — `mapZodIssuesToErrors`,
+    `validateGridPosition`, `validateChartComponent`, `validateTableComponent`,
+    `validatePayloadSize`, `validateIframeDomain`, `validateComponent`,
+    `validateLayout` — their `ValidationError.message` quotes a payload
+    path (e.g. `params.data.datasets[0]`) and is addressed to whoever
+    produced the payload, not to the end user. The validation CARD chrome
+    around them (`validationError`, `validationWarning`,
+    `validationUnknownError`) IS localized; the end-user form messages of
+    `validateFieldValue` / `validateFormData` ARE localized through
+    `DEFAULT_VALIDATION_MESSAGES`.
+- **P4 — machine tokens**: file-format acronyms, HTTP verbs, unit symbols,
+  ISO currency codes, and chart point property names. `DataPreviewSection`'s
+  `"CSV"` / `"JSON"` export-button glyphs (their `title` attributes,
+  `exportCsvRows` / `exportJsonRows`, ARE localized) and its `" EUR"`
+  currency suffix; `"ms"` after execution times and durations
+  (`FooterRenderer`, `StreamingUIRenderer`, `ScratchpadPanel`); and
+  `chartToDataTable`'s `x` / `y` / `r` column headers (the Chart.js point
+  property names the cells mirror — still overridable through the
+  `labels` parameter).
+- **P5 — pure module functions with a documented render override.** No
+  occurrence remains: the default citation chip's tooltip used to be the
+  only one and is now localized (`citationViewSource`, passed through
+  `CitationCtx.viewSourceLabel`). The item stays in the policy for future
+  helpers.
+- **P6 — components with their own documented `labels`/`messages` prop.**
+  `PresentationFeedback`'s `DEFAULT_PRESENTATION_FEEDBACK_LABELS` — the
+  component documents its own `labels` prop
+  (`<PresentationFeedback labels={{ prompt: '…' }} />`) and does not read
+  `MCPUIStringsProvider`. (`DEFAULT_CONNECTOR_MESSAGES`,
+  `DEFAULT_MACRO_RUN_MESSAGES`, `DEFAULT_VALIDATION_MESSAGES`,
+  `DEGRADED_PROJECTION_LABELS` and `CHART_DATA_TABLE_LABELS` are the same
+  kind of sanctioned default table for a `messages`/`labels` option — see
+  **Added**.)
+- **P7 — strings the library never renders itself.** Hook-level errors
+  returned to the consumer (`useAction`'s `"Max retries (…) exceeded"` /
+  `"Action cancelled by onBefore callback"`, `useAutocomplete`'s `"Unknown
+  error"`); `props.onError` payloads (`"Chart rendering failed"`,
+  `"Component validation failed"`, `"Video failed to load"`); and
+  `console.*` / logger / telemetry-only strings. A consumer that reads them
+  chooses how to display them. One edge case: the SSR stub executor's
+  `"Actions not available server-side"` is an `ActionResult.error` that
+  `FormRenderer` would display, but a form cannot be submitted during
+  server rendering, so it never reaches the DOM in practice.
+- **P8 — LLM-facing schema descriptions, example payloads, comments and
+  JSDoc.** `services/component-registry.ts` in full, and the `plugins/`
+  system prompts — a catalogue of JSON-schema descriptions and example
+  payloads shown to the model; translating it would teach the model to
+  emit non-English payloads.
+
+Also out of scope (not i18n): the auto-footer's `poweredBy: 'Deposium'`
+brand string (pre-existing since v1.2.0). Payload/content strings in
+general (`params.title`, `action.label`, and similar) remain the
+producing MCP server's responsibility — this sweep only touches the
+library's own chrome.
+
+### Tests
+
+- **`mcpui-strings-guard.test.ts` — AST-based chrome scanner.** Runs
+  `scanChrome()` (`scripts/chrome-scan.ts`) over every non-test source under
+  `src` and asserts zero unallowed findings. Separately asserts: every
+  `ALLOW_LIST` entry still matches a real finding (a fixed literal that no
+  longer exists fails the build instead of silently going stale); every
+  `SCOPED_EXCLUSIONS` function still exists in its file; every
+  `SANCTIONED_TABLES` entry is still exported and non-empty; every entry
+  across all three names the policy item (P1–P8) it invokes; and no
+  sanctioned table or scoped-exclusion function lets French text or a
+  hardcoded locale tag through. A second `describe` block carries
+  non-vacuity fixtures — one small source snippet per finding class the
+  scanner understands (JSX text, attribute literal, ternary branch,
+  template span, helper return, signal setter, prose array/object
+  property, arrays rendered item by item through `<For>` or `.map()`,
+  French text including single distinctive words, hardcoded locale) —
+  asserting the scanner flags
+  each one, and a matching "does not flag" fixture per skipped AST context
+  (`console.*`, `onError`, thrown errors).
+- **`MCPUIStrings.pseudolocale.test.tsx` — runtime pseudo-localization.**
+  Mounts the renderers (`UIResourceRenderer` layouts — table, chart, map,
+  graph, form, gallery, video, code, carousel, action, artifact, modal,
+  error and validation states; `DataPreviewSection`; `ScratchpadPanel`
+  sections and statuses; `ChatPrompt`; `FormRenderer`; `StreamingUIRenderer`;
+  `GenerativeUIErrorBoundary`; `VerifiedText`; the agent components;
+  `AutocompleteDropdown`; `GraphRenderer`'s export menu;
+  `EditableUIResourceRenderer`) with a `<MCPUIStringsProvider>` whose
+  strings are `⟦key {placeholders}⟧` markers and with CJK-only payload
+  content, under `locale: 'fr-FR'`. Walks `document.body` including
+  portals and accessible attributes (`aria-label`, `title`, `alt`), and
+  separately asserts the tool-error card's clipboard text. Fails on any
+  Latin chrome text left over. It backs up the scanner's known blind spots:
+  prose stored under machine-looking keys such as `name`, and values passed
+  to another file's component props.
+- **`mcpui-strings-defaults.test.ts`** pins every `DEFAULT_MCPUI_STRINGS`
+  value, so a default cannot drift silently.
+
+### Known follow-ups
+
+- The auto-footer's hardcoded `poweredBy: 'Deposium'` brand string is not
+  i18n and is out of scope for this release (pre-existing since v1.2.0).
+- `DataPreviewSection` appends `" EUR"` to every `currency` cell whatever
+  the data's actual currency (pre-existing; a currency code belongs in the
+  payload, not in the library).
+- `macroRunToScratchpadState` passes a whole `UIComponent` as the content of
+  `data_preview` / `chart` / `map` sections, while those sections expect the
+  component's params (pre-existing since the MacroRun adapters shipped). A
+  table result therefore shows `previewInvalidContent` in the panel.
+- Download filenames (`chart.png`, `table-*.csv`, graph export stems) stay
+  in English — they are files, not DOM text, so the policy treats them as
+  P4 machine tokens.
+
 ## [6.19.1] - 2026-09-16
 
 ### Fixed