@seed-ship/mcp-ui-solid 6.21.0 → 6.23.0

package/dist/context/MCPUIConfigContext.cjs

@@ -7,7 +7,8 @@ const DEFAULT_MCPUI_CONFIG = {
   customTrustedIframeDomains: [],
   iframePolicy: "strict",
   customIframeDomains: [],
-  iframeFallbackLink: "auto"
+  iframeFallbackLink: "auto",
+  chartZoom: "expanded"
 };
 const MCPUIConfigContext = solidJs.createContext(DEFAULT_MCPUI_CONFIG);
 function useMCPUIConfig() {

package/dist/context/MCPUIConfigContext.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"MCPUIConfigContext.cjs","sources":["../../src/context/MCPUIConfigContext.tsx"],"sourcesContent":["/**\n * MCPUIConfigContext — host-level rendering policy for the library's iframes.\n *\n * @since v6.21.0\n *\n * ## Why\n *\n * A host that serves `Cross-Origin-Embedder-Policy: credentialless` makes the\n * browser refuse every cross-origin iframe whose own document does not send a\n * COEP header — which is YouTube, Vimeo, Google Docs, Notion and nearly all of\n * `DEFAULT_IFRAME_DOMAINS`. The escape hatch is the boolean HTML attribute\n * `credentialless` on the `<iframe>` itself: the document then loads, but\n * without access to the cookies and storage of its own origin.\n *\n * That trade-off is free for a public video or chart and fatal for an\n * authenticated embed, so the library keys it on the distinction it already\n * makes: `TRUSTED_IFRAME_DOMAINS` (the hosts that receive `allow-same-origin`\n * because they need their own cookies) do NOT get the attribute; everything\n * else does. This context lets a host override that, add its own trusted\n * hosts, and control the \"open in a new tab\" fallback link.\n *\n * ## Scope — policy only, NOT strings\n *\n * Text lives in `MCPUIStrings` (`MCPUIStringsContext`). This context carries\n * only behavioural switches, and like the strings context every renderer works\n * standalone: with no provider mounted, `DEFAULT_MCPUI_CONFIG` applies.\n *\n * @example\n * ```tsx\n * import { MCPUIConfigProvider } from '@seed-ship/mcp-ui-solid'\n *\n * <MCPUIConfigProvider config={{ customTrustedIframeDomains: ['embed.acme.com'] }}>\n *   <App />\n * </MCPUIConfigProvider>\n * ```\n */\n\nimport { createContext, mergeProps, useContext, type JSX } from 'solid-js'\nimport type { IframePolicy } from '../types'\n\n/**\n * Host-level rendering policy. Every field has a default — a provider passes\n * a partial override.\n */\nexport interface MCPUIConfig {\n  /**\n   * When the library puts the boolean `credentialless` attribute on an\n   * `<iframe>` it renders.\n   *\n   * - `'auto'` (default) — on every iframe whose host is NOT in\n   *   `TRUSTED_IFRAME_DOMAINS` (plus `customTrustedIframeDomains`). Those\n   *   hosts already ran without cookies, since their sandbox has no\n   *   `allow-same-origin`; the attribute is what unblocks them under COEP.\n   * - `'always'` — on every iframe, trusted hosts included. An authenticated\n   *   embed will then render its login screen.\n   * - `'never'` — never. The right value for a host that sends no COEP header\n   *   and does not want its embeds to lose their cookies.\n   *\n   * Chrome/Edge 110+ honour the attribute; Firefox ignores it (iframes stay\n   * blocked while the host sends COEP); Safari ignores the COEP value itself,\n   * so nothing is blocked there in the first place.\n   */\n  iframeCredentialless: 'auto' | 'always' | 'never'\n\n  /**\n   * Extra hosts treated as trusted, on top of `TRUSTED_IFRAME_DOMAINS`:\n   * no `credentialless` attribute, and `allow-same-origin` in the sandbox.\n   * A subdomain of a listed host matches too.\n   *\n   * This only RECLASSIFIES a host the allow-list already accepts. To render an\n   * iframe whose host is outside `DEFAULT_IFRAME_DOMAINS`, add it to\n   * {@link MCPUIConfig.customIframeDomains} with `iframePolicy: 'extend'`.\n   */\n  customTrustedIframeDomains: string[]\n\n  /**\n   * How `UIResourceRenderer` validates an `iframe` component's host:\n   * `'strict'` (default) accepts `DEFAULT_IFRAME_DOMAINS` only, `'extend'`\n   * also accepts {@link MCPUIConfig.customIframeDomains}.\n   */\n  iframePolicy: IframePolicy\n\n  /**\n   * Extra hosts the allow-list accepts when `iframePolicy` is `'extend'`.\n   * Without this, a component pointing at an unlisted host is replaced by the\n   * validation card before any renderer runs.\n   */\n  customIframeDomains: string[]\n\n  /**\n   * When the library renders an \"open in a new tab\" link under an embed\n   * (`strings.iframeOpenInNewTab`).\n   *\n   * A COEP-blocked iframe fires no event the parent page can observe, so\n   * without this the user sees an unexplained blank frame.\n   *\n   * - `'auto'` (default) — only when the page is cross-origin isolated\n   *   (`window.crossOriginIsolated`). That flag needs COOP `same-origin` AND\n   *   COEP, so a host that sends COEP alone still blocks embeds while the\n   *   flag is false: set `'always'` there. Read after mount, never during\n   *   render, so SSR markup and hydration agree.\n   * - `'always'` / `'never'` — unconditional.\n   */\n  iframeFallbackLink: 'auto' | 'always' | 'never'\n}\n\n/**\n * Defaults. Chosen so a host that sends no COEP header sees no change from\n * 6.20.0 apart from the fallback link, which `'auto'` keeps hidden there.\n */\nexport const DEFAULT_MCPUI_CONFIG: MCPUIConfig = {\n  iframeCredentialless: 'auto',\n  customTrustedIframeDomains: [],\n  iframePolicy: 'strict',\n  customIframeDomains: [],\n  iframeFallbackLink: 'auto',\n}\n\nexport const MCPUIConfigContext = createContext<MCPUIConfig>(DEFAULT_MCPUI_CONFIG)\n\n/**\n * Reads the active host config. Returns `DEFAULT_MCPUI_CONFIG` when no\n * `<MCPUIConfigProvider>` is mounted above.\n */\nexport function useMCPUIConfig(): MCPUIConfig {\n  return mergeProps(DEFAULT_MCPUI_CONFIG, useContext(MCPUIConfigContext))\n}\n\nexport interface MCPUIConfigProviderProps {\n  /**\n   * Partial override of the host config. Any key left unset falls back to\n   * `DEFAULT_MCPUI_CONFIG`.\n   */\n  config?: Partial<MCPUIConfig>\n  children: JSX.Element\n}\n\n/**\n * Provides the host config to every MCP-UI renderer below it.\n * Merges the partial `config` override over the defaults.\n */\nexport function MCPUIConfigProvider(props: MCPUIConfigProviderProps): JSX.Element {\n  // The function source keeps replacement `config` objects reactive while\n  // mergeProps fills any omitted key without taking a one-time snapshot.\n  const value = mergeProps(DEFAULT_MCPUI_CONFIG, () => props.config)\n  return (\n    <MCPUIConfigContext.Provider value={value}>\n      {props.children}\n    </MCPUIConfigContext.Provider>\n  )\n}\n"],"names":["DEFAULT_MCPUI_CONFIG","iframeCredentialless","customTrustedIframeDomains","iframePolicy","customIframeDomains","iframeFallbackLink","MCPUIConfigContext","createContext","useMCPUIConfig","mergeProps","useContext","MCPUIConfigProvider","props","value","config","_$createComponent","Provider","children"],"mappings":";;;;AA8GO,MAAMA,uBAAoC;AAAA,EAC/CC,sBAAsB;AAAA,EACtBC,4BAA4B,CAAA;AAAA,EAC5BC,cAAc;AAAA,EACdC,qBAAqB,CAAA;AAAA,EACrBC,oBAAoB;AACtB;AAEO,MAAMC,qBAAqBC,QAAAA,cAA2BP,oBAAoB;AAM1E,SAASQ,iBAA8B;AAC5C,SAAOC,mBAAWT,sBAAsBU,QAAAA,WAAWJ,kBAAkB,CAAC;AACxE;AAeO,SAASK,oBAAoBC,OAA8C;AAGhF,QAAMC,QAAQJ,QAAAA,WAAWT,sBAAsB,MAAMY,MAAME,MAAM;AACjE,SAAAC,IAAAA,gBACGT,mBAAmBU,UAAQ;AAAA,IAACH;AAAAA,IAAY,IAAAI,WAAA;AAAA,aACtCL,MAAMK;AAAAA,IAAQ;AAAA,EAAA,CAAA;AAGrB;;;;;"}
+{"version":3,"file":"MCPUIConfigContext.cjs","sources":["../../src/context/MCPUIConfigContext.tsx"],"sourcesContent":["/**\n * MCPUIConfigContext — host-level rendering policy: the library's iframes\n * (v6.21.0) and, since v6.22.0, where a chart may capture the wheel.\n *\n * @since v6.21.0\n *\n * ## Why\n *\n * A host that serves `Cross-Origin-Embedder-Policy: credentialless` makes the\n * browser refuse every cross-origin iframe whose own document does not send a\n * COEP header — which is YouTube, Vimeo, Google Docs, Notion and nearly all of\n * `DEFAULT_IFRAME_DOMAINS`. The escape hatch is the boolean HTML attribute\n * `credentialless` on the `<iframe>` itself: the document then loads, but\n * without access to the cookies and storage of its own origin.\n *\n * That trade-off is free for a public video or chart and fatal for an\n * authenticated embed, so the library keys it on the distinction it already\n * makes: `TRUSTED_IFRAME_DOMAINS` (the hosts that receive `allow-same-origin`\n * because they need their own cookies) do NOT get the attribute; everything\n * else does. This context lets a host override that, add its own trusted\n * hosts, and control the \"open in a new tab\" fallback link.\n *\n * ## Scope — policy only, NOT strings\n *\n * Text lives in `MCPUIStrings` (`MCPUIStringsContext`). This context carries\n * only behavioural switches, and like the strings context every renderer works\n * standalone: with no provider mounted, `DEFAULT_MCPUI_CONFIG` applies.\n *\n * @example\n * ```tsx\n * import { MCPUIConfigProvider } from '@seed-ship/mcp-ui-solid'\n *\n * <MCPUIConfigProvider config={{ customTrustedIframeDomains: ['embed.acme.com'] }}>\n *   <App />\n * </MCPUIConfigProvider>\n * ```\n */\n\nimport { createContext, mergeProps, useContext, type JSX } from 'solid-js'\nimport type { IframePolicy } from '../types'\n\n/**\n * Host-level rendering policy. Every field has a default — a provider passes\n * a partial override.\n *\n * ## Two names, because there are two jobs\n *\n * This type grows a key every time the library gains a policy switch, and\n * those releases are MINOR — so neither AUTHORING a config nor READING one\n * may break when a key appears. Those two demands pull in opposite\n * directions, and one name cannot serve both:\n *\n * - an author must be allowed to omit the new key, so the fields they write\n *   have to be OPTIONAL;\n * - a reader assigning `const p: IframePolicy = config.iframePolicy` must not\n *   suddenly face `undefined`, so the fields they read have to be REQUIRED.\n *\n * Hence {@link MCPUIConfigInput} (what a host writes — every field optional)\n * and {@link MCPUIConfig} (what the library hands back — every field\n * resolved). `MCPUIConfig` is derived from the input type, so the two can\n * never drift and a key is declared exactly once.\n *\n * Which one you name depends on the surface:\n *\n * - `<MCPUIConfigProvider config={…}>` takes `MCPUIConfigInput` — name that\n *   type for a partial you build, and it merges the rest;\n * - `<MCPUIConfigContext.Provider value={…}>` takes the RESOLVED\n *   `MCPUIConfig`, because that context is read as well as written, so a\n *   direct provider hands over `{ ...DEFAULT_MCPUI_CONFIG, ...mine }`;\n * - anything you RECEIVE is `MCPUIConfig`, which is what\n *   {@link useMCPUIConfig} returns.\n */\nexport interface MCPUIConfigInput {\n  /**\n   * When the library puts the boolean `credentialless` attribute on an\n   * `<iframe>` it renders.\n   *\n   * - `'auto'` (default) — on every iframe whose host is NOT in\n   *   `TRUSTED_IFRAME_DOMAINS` (plus `customTrustedIframeDomains`). Those\n   *   hosts already ran without cookies, since their sandbox has no\n   *   `allow-same-origin`; the attribute is what unblocks them under COEP.\n   * - `'always'` — on every iframe, trusted hosts included. An authenticated\n   *   embed will then render its login screen.\n   * - `'never'` — never. The right value for a host that sends no COEP header\n   *   and does not want its embeds to lose their cookies.\n   *\n   * Chrome/Edge 110+ honour the attribute; Firefox ignores it (iframes stay\n   * blocked while the host sends COEP); Safari ignores the COEP value itself,\n   * so nothing is blocked there in the first place.\n   */\n  iframeCredentialless?: 'auto' | 'always' | 'never'\n\n  /**\n   * Extra hosts treated as trusted, on top of `TRUSTED_IFRAME_DOMAINS`:\n   * no `credentialless` attribute, and `allow-same-origin` in the sandbox.\n   * A subdomain of a listed host matches too.\n   *\n   * This only RECLASSIFIES a host the allow-list already accepts. To render an\n   * iframe whose host is outside `DEFAULT_IFRAME_DOMAINS`, add it to\n   * {@link MCPUIConfigInput.customIframeDomains} with `iframePolicy: 'extend'`.\n   */\n  customTrustedIframeDomains?: string[]\n\n  /**\n   * How `UIResourceRenderer` validates an `iframe` component's host:\n   * `'strict'` (default) accepts `DEFAULT_IFRAME_DOMAINS` only, `'extend'`\n   * also accepts {@link MCPUIConfigInput.customIframeDomains}.\n   */\n  iframePolicy?: IframePolicy\n\n  /**\n   * Extra hosts the allow-list accepts when `iframePolicy` is `'extend'`.\n   * Without this, a component pointing at an unlisted host is replaced by the\n   * validation card before any renderer runs.\n   */\n  customIframeDomains?: string[]\n\n  /**\n   * When the library renders an \"open in a new tab\" link under an embed\n   * (`strings.iframeOpenInNewTab`).\n   *\n   * A COEP-blocked iframe fires no event the parent page can observe, so\n   * without this the user sees an unexplained blank frame.\n   *\n   * - `'auto'` (default) — only when the page is cross-origin isolated\n   *   (`window.crossOriginIsolated`). That flag needs COOP `same-origin` AND\n   *   COEP, so a host that sends COEP alone still blocks embeds while the\n   *   flag is false: set `'always'` there. Read after mount, never during\n   *   render, so SSR markup and hydration agree.\n   * - `'always'` / `'never'` — unconditional.\n   */\n  iframeFallbackLink?: 'auto' | 'always' | 'never'\n\n  /**\n   * Where `ChartJSRenderer` enables wheel-zoom / drag-pan / pinch on a chart\n   * (through the optional `chartjs-plugin-zoom` peer dependency — absent, the\n   * chart renders exactly as it does without this setting).\n   *\n   * Hijacking the mouse wheel on a component sitting inline in a scrolling\n   * chat feed is hostile: the user scrolls the conversation and the chart eats\n   * the gesture. So zoom belongs to a surface that OWNS its viewport, which\n   * here is `ExpandableWrapper`'s fullscreen modal.\n   *\n   * - `'expanded'` (default) — only inside the fullscreen modal.\n   * - `'always'` — inline as well. For a host that lays charts out in a\n   *   dashboard rather than in a feed, where the wheel has nothing to steal.\n   * - `'never'` — off everywhere; the plugin is never registered.\n   *\n   * @since 6.22.0\n   */\n  chartZoom?: 'expanded' | 'always' | 'never'\n}\n\n/**\n * The resolved host policy: every key present. This is what the library hands\n * back, so a reader never null-checks a policy.\n *\n * Extends `Required<`{@link MCPUIConfigInput}`>` rather than declaring the\n * fields again, so a key exists in exactly one place and the two views cannot\n * drift. It remains an interface so existing consumers can extend or augment\n * the public contract as they could before 6.22.0.\n */\nexport interface MCPUIConfig extends Required<MCPUIConfigInput> {}\n\n/**\n * Defaults. Chosen so a host that sends no COEP header sees no change from\n * 6.20.0 apart from the fallback link, which `'auto'` keeps hidden there —\n * and, since 6.22.0, so no inline component ever captures the wheel\n * (`chartZoom: 'expanded'`).\n *\n * Typed `MCPUIConfig` (i.e. resolved): that annotation is what stops a new\n * key from shipping without a default.\n */\nexport const DEFAULT_MCPUI_CONFIG: MCPUIConfig = {\n  iframeCredentialless: 'auto',\n  customTrustedIframeDomains: [],\n  iframePolicy: 'strict',\n  customIframeDomains: [],\n  iframeFallbackLink: 'auto',\n  chartZoom: 'expanded',\n}\n\n/**\n * Typed with the RESOLVED view, because this context is read as well as\n * written: it is exported, so a consumer may call\n * `useContext(MCPUIConfigContext)` directly, and typing it as the input view\n * would hand them `IframePolicy | undefined` — exactly the regression this\n * whole split exists to undo.\n *\n * The cost lands on the rarer side: a host feeding this context directly\n * passes a COMPLETE value, `{ ...DEFAULT_MCPUI_CONFIG, ...mine }`. Anyone who\n * wants to pass only the keys they care about uses `MCPUIConfigProvider`,\n * whose `config` prop takes `Partial<`{@link MCPUIConfig}`>` and does that\n * merge. That preserves optional properties added through declaration\n * merging; {@link MCPUIConfigInput} remains the unaugmented built-in input\n * shape a host can name for ordinary authored configs.\n */\nexport const MCPUIConfigContext = createContext<MCPUIConfig>(DEFAULT_MCPUI_CONFIG)\n\n/**\n * Reads the active host config, resolved: every key is present, whether it\n * came from the provider or from `DEFAULT_MCPUI_CONFIG`. Returns the defaults\n * outright when no `<MCPUIConfigProvider>` is mounted above.\n */\nexport function useMCPUIConfig(): MCPUIConfig {\n  return mergeProps(DEFAULT_MCPUI_CONFIG, useContext(MCPUIConfigContext))\n}\n\nexport interface MCPUIConfigProviderProps {\n  /**\n   * Partial override of the host config. Any key left unset falls back to\n   * `DEFAULT_MCPUI_CONFIG`.\n   */\n  config?: Partial<MCPUIConfig>\n  children: JSX.Element\n}\n\n/**\n * Provides the host config to every MCP-UI renderer below it.\n * Merges the partial `config` override over the defaults.\n */\nexport function MCPUIConfigProvider(props: MCPUIConfigProviderProps): JSX.Element {\n  // The function source keeps replacement `config` objects reactive while\n  // mergeProps fills any omitted key without taking a one-time snapshot.\n  const value = mergeProps(DEFAULT_MCPUI_CONFIG, () => props.config)\n  return (\n    <MCPUIConfigContext.Provider value={value}>\n      {props.children}\n    </MCPUIConfigContext.Provider>\n  )\n}\n"],"names":["DEFAULT_MCPUI_CONFIG","iframeCredentialless","customTrustedIframeDomains","iframePolicy","customIframeDomains","iframeFallbackLink","chartZoom","MCPUIConfigContext","createContext","useMCPUIConfig","mergeProps","useContext","MCPUIConfigProvider","props","value","config","_$createComponent","Provider","children"],"mappings":";;;;AA6KO,MAAMA,uBAAoC;AAAA,EAC/CC,sBAAsB;AAAA,EACtBC,4BAA4B,CAAA;AAAA,EAC5BC,cAAc;AAAA,EACdC,qBAAqB,CAAA;AAAA,EACrBC,oBAAoB;AAAA,EACpBC,WAAW;AACb;AAiBO,MAAMC,qBAAqBC,QAAAA,cAA2BR,oBAAoB;AAO1E,SAASS,iBAA8B;AAC5C,SAAOC,mBAAWV,sBAAsBW,QAAAA,WAAWJ,kBAAkB,CAAC;AACxE;AAeO,SAASK,oBAAoBC,OAA8C;AAGhF,QAAMC,QAAQJ,QAAAA,WAAWV,sBAAsB,MAAMa,MAAME,MAAM;AACjE,SAAAC,IAAAA,gBACGT,mBAAmBU,UAAQ;AAAA,IAACH;AAAAA,IAAY,IAAAI,WAAA;AAAA,aACtCL,MAAMK;AAAAA,IAAQ;AAAA,EAAA,CAAA;AAGrB;;;;;"}

package/dist/context/MCPUIConfigContext.d.ts

@@ -1,5 +1,6 @@
 /**
- * MCPUIConfigContext — host-level rendering policy for the library's iframes.
+ * MCPUIConfigContext — host-level rendering policy: the library's iframes
+ * (v6.21.0) and, since v6.22.0, where a chart may capture the wheel.
  *
  * @since v6.21.0
  *
@@ -39,8 +40,35 @@ import type { IframePolicy } from '../types';
 /**
  * Host-level rendering policy. Every field has a default — a provider passes
  * a partial override.
+ *
+ * ## Two names, because there are two jobs
+ *
+ * This type grows a key every time the library gains a policy switch, and
+ * those releases are MINOR — so neither AUTHORING a config nor READING one
+ * may break when a key appears. Those two demands pull in opposite
+ * directions, and one name cannot serve both:
+ *
+ * - an author must be allowed to omit the new key, so the fields they write
+ *   have to be OPTIONAL;
+ * - a reader assigning `const p: IframePolicy = config.iframePolicy` must not
+ *   suddenly face `undefined`, so the fields they read have to be REQUIRED.
+ *
+ * Hence {@link MCPUIConfigInput} (what a host writes — every field optional)
+ * and {@link MCPUIConfig} (what the library hands back — every field
+ * resolved). `MCPUIConfig` is derived from the input type, so the two can
+ * never drift and a key is declared exactly once.
+ *
+ * Which one you name depends on the surface:
+ *
+ * - `<MCPUIConfigProvider config={…}>` takes `MCPUIConfigInput` — name that
+ *   type for a partial you build, and it merges the rest;
+ * - `<MCPUIConfigContext.Provider value={…}>` takes the RESOLVED
+ *   `MCPUIConfig`, because that context is read as well as written, so a
+ *   direct provider hands over `{ ...DEFAULT_MCPUI_CONFIG, ...mine }`;
+ * - anything you RECEIVE is `MCPUIConfig`, which is what
+ *   {@link useMCPUIConfig} returns.
  */
-export interface MCPUIConfig {
+export interface MCPUIConfigInput {
     /**
      * When the library puts the boolean `credentialless` attribute on an
      * `<iframe>` it renders.
@@ -58,7 +86,7 @@ export interface MCPUIConfig {
      * blocked while the host sends COEP); Safari ignores the COEP value itself,
      * so nothing is blocked there in the first place.
      */
-    iframeCredentialless: 'auto' | 'always' | 'never';
+    iframeCredentialless?: 'auto' | 'always' | 'never';
     /**
      * Extra hosts treated as trusted, on top of `TRUSTED_IFRAME_DOMAINS`:
      * no `credentialless` attribute, and `allow-same-origin` in the sandbox.
@@ -66,21 +94,21 @@ export interface MCPUIConfig {
      *
      * This only RECLASSIFIES a host the allow-list already accepts. To render an
      * iframe whose host is outside `DEFAULT_IFRAME_DOMAINS`, add it to
-     * {@link MCPUIConfig.customIframeDomains} with `iframePolicy: 'extend'`.
+     * {@link MCPUIConfigInput.customIframeDomains} with `iframePolicy: 'extend'`.
      */
-    customTrustedIframeDomains: string[];
+    customTrustedIframeDomains?: string[];
     /**
      * How `UIResourceRenderer` validates an `iframe` component's host:
      * `'strict'` (default) accepts `DEFAULT_IFRAME_DOMAINS` only, `'extend'`
-     * also accepts {@link MCPUIConfig.customIframeDomains}.
+     * also accepts {@link MCPUIConfigInput.customIframeDomains}.
      */
-    iframePolicy: IframePolicy;
+    iframePolicy?: IframePolicy;
     /**
      * Extra hosts the allow-list accepts when `iframePolicy` is `'extend'`.
      * Without this, a component pointing at an unlisted host is replaced by the
      * validation card before any renderer runs.
      */
-    customIframeDomains: string[];
+    customIframeDomains?: string[];
     /**
      * When the library renders an "open in a new tab" link under an embed
      * (`strings.iframeOpenInNewTab`).
@@ -95,17 +123,67 @@ export interface MCPUIConfig {
      *   render, so SSR markup and hydration agree.
      * - `'always'` / `'never'` — unconditional.
      */
-    iframeFallbackLink: 'auto' | 'always' | 'never';
+    iframeFallbackLink?: 'auto' | 'always' | 'never';
+    /**
+     * Where `ChartJSRenderer` enables wheel-zoom / drag-pan / pinch on a chart
+     * (through the optional `chartjs-plugin-zoom` peer dependency — absent, the
+     * chart renders exactly as it does without this setting).
+     *
+     * Hijacking the mouse wheel on a component sitting inline in a scrolling
+     * chat feed is hostile: the user scrolls the conversation and the chart eats
+     * the gesture. So zoom belongs to a surface that OWNS its viewport, which
+     * here is `ExpandableWrapper`'s fullscreen modal.
+     *
+     * - `'expanded'` (default) — only inside the fullscreen modal.
+     * - `'always'` — inline as well. For a host that lays charts out in a
+     *   dashboard rather than in a feed, where the wheel has nothing to steal.
+     * - `'never'` — off everywhere; the plugin is never registered.
+     *
+     * @since 6.22.0
+     */
+    chartZoom?: 'expanded' | 'always' | 'never';
+}
+/**
+ * The resolved host policy: every key present. This is what the library hands
+ * back, so a reader never null-checks a policy.
+ *
+ * Extends `Required<`{@link MCPUIConfigInput}`>` rather than declaring the
+ * fields again, so a key exists in exactly one place and the two views cannot
+ * drift. It remains an interface so existing consumers can extend or augment
+ * the public contract as they could before 6.22.0.
+ */
+export interface MCPUIConfig extends Required<MCPUIConfigInput> {
 }
 /**
  * Defaults. Chosen so a host that sends no COEP header sees no change from
- * 6.20.0 apart from the fallback link, which `'auto'` keeps hidden there.
+ * 6.20.0 apart from the fallback link, which `'auto'` keeps hidden there —
+ * and, since 6.22.0, so no inline component ever captures the wheel
+ * (`chartZoom: 'expanded'`).
+ *
+ * Typed `MCPUIConfig` (i.e. resolved): that annotation is what stops a new
+ * key from shipping without a default.
  */
 export declare const DEFAULT_MCPUI_CONFIG: MCPUIConfig;
+/**
+ * Typed with the RESOLVED view, because this context is read as well as
+ * written: it is exported, so a consumer may call
+ * `useContext(MCPUIConfigContext)` directly, and typing it as the input view
+ * would hand them `IframePolicy | undefined` — exactly the regression this
+ * whole split exists to undo.
+ *
+ * The cost lands on the rarer side: a host feeding this context directly
+ * passes a COMPLETE value, `{ ...DEFAULT_MCPUI_CONFIG, ...mine }`. Anyone who
+ * wants to pass only the keys they care about uses `MCPUIConfigProvider`,
+ * whose `config` prop takes `Partial<`{@link MCPUIConfig}`>` and does that
+ * merge. That preserves optional properties added through declaration
+ * merging; {@link MCPUIConfigInput} remains the unaugmented built-in input
+ * shape a host can name for ordinary authored configs.
+ */
 export declare const MCPUIConfigContext: import("solid-js").Context<MCPUIConfig>;
 /**
- * Reads the active host config. Returns `DEFAULT_MCPUI_CONFIG` when no
- * `<MCPUIConfigProvider>` is mounted above.
+ * Reads the active host config, resolved: every key is present, whether it
+ * came from the provider or from `DEFAULT_MCPUI_CONFIG`. Returns the defaults
+ * outright when no `<MCPUIConfigProvider>` is mounted above.
  */
 export declare function useMCPUIConfig(): MCPUIConfig;
 export interface MCPUIConfigProviderProps {

package/dist/context/MCPUIConfigContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MCPUIConfigContext.d.ts","sourceRoot":"","sources":["../../src/context/MCPUIConfigContext.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAyC,KAAK,GAAG,EAAE,MAAM,UAAU,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE5C;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;;;;;;OAgBG;IACH,oBAAoB,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;IAEjD;;;;;;;;OAQG;IACH,0BAA0B,EAAE,MAAM,EAAE,CAAA;IAEpC;;;;OAIG;IACH,YAAY,EAAE,YAAY,CAAA;IAE1B;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAE7B;;;;;;;;;;;;;OAaG;IACH,kBAAkB,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;CAChD;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAMlC,CAAA;AAED,eAAO,MAAM,kBAAkB,yCAAmD,CAAA;AAElF;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAE5C;AAED,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;IAC7B,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAA;CACtB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,GAAG,CAAC,OAAO,CAShF"}
+{"version":3,"file":"MCPUIConfigContext.d.ts","sourceRoot":"","sources":["../../src/context/MCPUIConfigContext.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAyC,KAAK,GAAG,EAAE,MAAM,UAAU,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,oBAAoB,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;IAElD;;;;;;;;OAQG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAA;IAErC;;;;OAIG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAE3B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE9B;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;IAEhD;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA;CAC5C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAAC,gBAAgB,CAAC;CAAG;AAElE;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAOlC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB,yCAAmD,CAAA;AAElF;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAE5C;AAED,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;IAC7B,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAA;CACtB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,GAAG,CAAC,OAAO,CAShF"}

package/dist/context/MCPUIConfigContext.js

@@ -5,7 +5,8 @@ const DEFAULT_MCPUI_CONFIG = {
   customTrustedIframeDomains: [],
   iframePolicy: "strict",
   customIframeDomains: [],
-  iframeFallbackLink: "auto"
+  iframeFallbackLink: "auto",
+  chartZoom: "expanded"
 };
 const MCPUIConfigContext = createContext(DEFAULT_MCPUI_CONFIG);
 function useMCPUIConfig() {

package/dist/context/MCPUIConfigContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"MCPUIConfigContext.js","sources":["../../src/context/MCPUIConfigContext.tsx"],"sourcesContent":["/**\n * MCPUIConfigContext — host-level rendering policy for the library's iframes.\n *\n * @since v6.21.0\n *\n * ## Why\n *\n * A host that serves `Cross-Origin-Embedder-Policy: credentialless` makes the\n * browser refuse every cross-origin iframe whose own document does not send a\n * COEP header — which is YouTube, Vimeo, Google Docs, Notion and nearly all of\n * `DEFAULT_IFRAME_DOMAINS`. The escape hatch is the boolean HTML attribute\n * `credentialless` on the `<iframe>` itself: the document then loads, but\n * without access to the cookies and storage of its own origin.\n *\n * That trade-off is free for a public video or chart and fatal for an\n * authenticated embed, so the library keys it on the distinction it already\n * makes: `TRUSTED_IFRAME_DOMAINS` (the hosts that receive `allow-same-origin`\n * because they need their own cookies) do NOT get the attribute; everything\n * else does. This context lets a host override that, add its own trusted\n * hosts, and control the \"open in a new tab\" fallback link.\n *\n * ## Scope — policy only, NOT strings\n *\n * Text lives in `MCPUIStrings` (`MCPUIStringsContext`). This context carries\n * only behavioural switches, and like the strings context every renderer works\n * standalone: with no provider mounted, `DEFAULT_MCPUI_CONFIG` applies.\n *\n * @example\n * ```tsx\n * import { MCPUIConfigProvider } from '@seed-ship/mcp-ui-solid'\n *\n * <MCPUIConfigProvider config={{ customTrustedIframeDomains: ['embed.acme.com'] }}>\n *   <App />\n * </MCPUIConfigProvider>\n * ```\n */\n\nimport { createContext, mergeProps, useContext, type JSX } from 'solid-js'\nimport type { IframePolicy } from '../types'\n\n/**\n * Host-level rendering policy. Every field has a default — a provider passes\n * a partial override.\n */\nexport interface MCPUIConfig {\n  /**\n   * When the library puts the boolean `credentialless` attribute on an\n   * `<iframe>` it renders.\n   *\n   * - `'auto'` (default) — on every iframe whose host is NOT in\n   *   `TRUSTED_IFRAME_DOMAINS` (plus `customTrustedIframeDomains`). Those\n   *   hosts already ran without cookies, since their sandbox has no\n   *   `allow-same-origin`; the attribute is what unblocks them under COEP.\n   * - `'always'` — on every iframe, trusted hosts included. An authenticated\n   *   embed will then render its login screen.\n   * - `'never'` — never. The right value for a host that sends no COEP header\n   *   and does not want its embeds to lose their cookies.\n   *\n   * Chrome/Edge 110+ honour the attribute; Firefox ignores it (iframes stay\n   * blocked while the host sends COEP); Safari ignores the COEP value itself,\n   * so nothing is blocked there in the first place.\n   */\n  iframeCredentialless: 'auto' | 'always' | 'never'\n\n  /**\n   * Extra hosts treated as trusted, on top of `TRUSTED_IFRAME_DOMAINS`:\n   * no `credentialless` attribute, and `allow-same-origin` in the sandbox.\n   * A subdomain of a listed host matches too.\n   *\n   * This only RECLASSIFIES a host the allow-list already accepts. To render an\n   * iframe whose host is outside `DEFAULT_IFRAME_DOMAINS`, add it to\n   * {@link MCPUIConfig.customIframeDomains} with `iframePolicy: 'extend'`.\n   */\n  customTrustedIframeDomains: string[]\n\n  /**\n   * How `UIResourceRenderer` validates an `iframe` component's host:\n   * `'strict'` (default) accepts `DEFAULT_IFRAME_DOMAINS` only, `'extend'`\n   * also accepts {@link MCPUIConfig.customIframeDomains}.\n   */\n  iframePolicy: IframePolicy\n\n  /**\n   * Extra hosts the allow-list accepts when `iframePolicy` is `'extend'`.\n   * Without this, a component pointing at an unlisted host is replaced by the\n   * validation card before any renderer runs.\n   */\n  customIframeDomains: string[]\n\n  /**\n   * When the library renders an \"open in a new tab\" link under an embed\n   * (`strings.iframeOpenInNewTab`).\n   *\n   * A COEP-blocked iframe fires no event the parent page can observe, so\n   * without this the user sees an unexplained blank frame.\n   *\n   * - `'auto'` (default) — only when the page is cross-origin isolated\n   *   (`window.crossOriginIsolated`). That flag needs COOP `same-origin` AND\n   *   COEP, so a host that sends COEP alone still blocks embeds while the\n   *   flag is false: set `'always'` there. Read after mount, never during\n   *   render, so SSR markup and hydration agree.\n   * - `'always'` / `'never'` — unconditional.\n   */\n  iframeFallbackLink: 'auto' | 'always' | 'never'\n}\n\n/**\n * Defaults. Chosen so a host that sends no COEP header sees no change from\n * 6.20.0 apart from the fallback link, which `'auto'` keeps hidden there.\n */\nexport const DEFAULT_MCPUI_CONFIG: MCPUIConfig = {\n  iframeCredentialless: 'auto',\n  customTrustedIframeDomains: [],\n  iframePolicy: 'strict',\n  customIframeDomains: [],\n  iframeFallbackLink: 'auto',\n}\n\nexport const MCPUIConfigContext = createContext<MCPUIConfig>(DEFAULT_MCPUI_CONFIG)\n\n/**\n * Reads the active host config. Returns `DEFAULT_MCPUI_CONFIG` when no\n * `<MCPUIConfigProvider>` is mounted above.\n */\nexport function useMCPUIConfig(): MCPUIConfig {\n  return mergeProps(DEFAULT_MCPUI_CONFIG, useContext(MCPUIConfigContext))\n}\n\nexport interface MCPUIConfigProviderProps {\n  /**\n   * Partial override of the host config. Any key left unset falls back to\n   * `DEFAULT_MCPUI_CONFIG`.\n   */\n  config?: Partial<MCPUIConfig>\n  children: JSX.Element\n}\n\n/**\n * Provides the host config to every MCP-UI renderer below it.\n * Merges the partial `config` override over the defaults.\n */\nexport function MCPUIConfigProvider(props: MCPUIConfigProviderProps): JSX.Element {\n  // The function source keeps replacement `config` objects reactive while\n  // mergeProps fills any omitted key without taking a one-time snapshot.\n  const value = mergeProps(DEFAULT_MCPUI_CONFIG, () => props.config)\n  return (\n    <MCPUIConfigContext.Provider value={value}>\n      {props.children}\n    </MCPUIConfigContext.Provider>\n  )\n}\n"],"names":["DEFAULT_MCPUI_CONFIG","iframeCredentialless","customTrustedIframeDomains","iframePolicy","customIframeDomains","iframeFallbackLink","MCPUIConfigContext","createContext","useMCPUIConfig","mergeProps","useContext","MCPUIConfigProvider","props","value","config","_$createComponent","Provider","children"],"mappings":";;AA8GO,MAAMA,uBAAoC;AAAA,EAC/CC,sBAAsB;AAAA,EACtBC,4BAA4B,CAAA;AAAA,EAC5BC,cAAc;AAAA,EACdC,qBAAqB,CAAA;AAAA,EACrBC,oBAAoB;AACtB;AAEO,MAAMC,qBAAqBC,cAA2BP,oBAAoB;AAM1E,SAASQ,iBAA8B;AAC5C,SAAOC,WAAWT,sBAAsBU,WAAWJ,kBAAkB,CAAC;AACxE;AAeO,SAASK,oBAAoBC,OAA8C;AAGhF,QAAMC,QAAQJ,WAAWT,sBAAsB,MAAMY,MAAME,MAAM;AACjE,SAAAC,gBACGT,mBAAmBU,UAAQ;AAAA,IAACH;AAAAA,IAAY,IAAAI,WAAA;AAAA,aACtCL,MAAMK;AAAAA,IAAQ;AAAA,EAAA,CAAA;AAGrB;"}
+{"version":3,"file":"MCPUIConfigContext.js","sources":["../../src/context/MCPUIConfigContext.tsx"],"sourcesContent":["/**\n * MCPUIConfigContext — host-level rendering policy: the library's iframes\n * (v6.21.0) and, since v6.22.0, where a chart may capture the wheel.\n *\n * @since v6.21.0\n *\n * ## Why\n *\n * A host that serves `Cross-Origin-Embedder-Policy: credentialless` makes the\n * browser refuse every cross-origin iframe whose own document does not send a\n * COEP header — which is YouTube, Vimeo, Google Docs, Notion and nearly all of\n * `DEFAULT_IFRAME_DOMAINS`. The escape hatch is the boolean HTML attribute\n * `credentialless` on the `<iframe>` itself: the document then loads, but\n * without access to the cookies and storage of its own origin.\n *\n * That trade-off is free for a public video or chart and fatal for an\n * authenticated embed, so the library keys it on the distinction it already\n * makes: `TRUSTED_IFRAME_DOMAINS` (the hosts that receive `allow-same-origin`\n * because they need their own cookies) do NOT get the attribute; everything\n * else does. This context lets a host override that, add its own trusted\n * hosts, and control the \"open in a new tab\" fallback link.\n *\n * ## Scope — policy only, NOT strings\n *\n * Text lives in `MCPUIStrings` (`MCPUIStringsContext`). This context carries\n * only behavioural switches, and like the strings context every renderer works\n * standalone: with no provider mounted, `DEFAULT_MCPUI_CONFIG` applies.\n *\n * @example\n * ```tsx\n * import { MCPUIConfigProvider } from '@seed-ship/mcp-ui-solid'\n *\n * <MCPUIConfigProvider config={{ customTrustedIframeDomains: ['embed.acme.com'] }}>\n *   <App />\n * </MCPUIConfigProvider>\n * ```\n */\n\nimport { createContext, mergeProps, useContext, type JSX } from 'solid-js'\nimport type { IframePolicy } from '../types'\n\n/**\n * Host-level rendering policy. Every field has a default — a provider passes\n * a partial override.\n *\n * ## Two names, because there are two jobs\n *\n * This type grows a key every time the library gains a policy switch, and\n * those releases are MINOR — so neither AUTHORING a config nor READING one\n * may break when a key appears. Those two demands pull in opposite\n * directions, and one name cannot serve both:\n *\n * - an author must be allowed to omit the new key, so the fields they write\n *   have to be OPTIONAL;\n * - a reader assigning `const p: IframePolicy = config.iframePolicy` must not\n *   suddenly face `undefined`, so the fields they read have to be REQUIRED.\n *\n * Hence {@link MCPUIConfigInput} (what a host writes — every field optional)\n * and {@link MCPUIConfig} (what the library hands back — every field\n * resolved). `MCPUIConfig` is derived from the input type, so the two can\n * never drift and a key is declared exactly once.\n *\n * Which one you name depends on the surface:\n *\n * - `<MCPUIConfigProvider config={…}>` takes `MCPUIConfigInput` — name that\n *   type for a partial you build, and it merges the rest;\n * - `<MCPUIConfigContext.Provider value={…}>` takes the RESOLVED\n *   `MCPUIConfig`, because that context is read as well as written, so a\n *   direct provider hands over `{ ...DEFAULT_MCPUI_CONFIG, ...mine }`;\n * - anything you RECEIVE is `MCPUIConfig`, which is what\n *   {@link useMCPUIConfig} returns.\n */\nexport interface MCPUIConfigInput {\n  /**\n   * When the library puts the boolean `credentialless` attribute on an\n   * `<iframe>` it renders.\n   *\n   * - `'auto'` (default) — on every iframe whose host is NOT in\n   *   `TRUSTED_IFRAME_DOMAINS` (plus `customTrustedIframeDomains`). Those\n   *   hosts already ran without cookies, since their sandbox has no\n   *   `allow-same-origin`; the attribute is what unblocks them under COEP.\n   * - `'always'` — on every iframe, trusted hosts included. An authenticated\n   *   embed will then render its login screen.\n   * - `'never'` — never. The right value for a host that sends no COEP header\n   *   and does not want its embeds to lose their cookies.\n   *\n   * Chrome/Edge 110+ honour the attribute; Firefox ignores it (iframes stay\n   * blocked while the host sends COEP); Safari ignores the COEP value itself,\n   * so nothing is blocked there in the first place.\n   */\n  iframeCredentialless?: 'auto' | 'always' | 'never'\n\n  /**\n   * Extra hosts treated as trusted, on top of `TRUSTED_IFRAME_DOMAINS`:\n   * no `credentialless` attribute, and `allow-same-origin` in the sandbox.\n   * A subdomain of a listed host matches too.\n   *\n   * This only RECLASSIFIES a host the allow-list already accepts. To render an\n   * iframe whose host is outside `DEFAULT_IFRAME_DOMAINS`, add it to\n   * {@link MCPUIConfigInput.customIframeDomains} with `iframePolicy: 'extend'`.\n   */\n  customTrustedIframeDomains?: string[]\n\n  /**\n   * How `UIResourceRenderer` validates an `iframe` component's host:\n   * `'strict'` (default) accepts `DEFAULT_IFRAME_DOMAINS` only, `'extend'`\n   * also accepts {@link MCPUIConfigInput.customIframeDomains}.\n   */\n  iframePolicy?: IframePolicy\n\n  /**\n   * Extra hosts the allow-list accepts when `iframePolicy` is `'extend'`.\n   * Without this, a component pointing at an unlisted host is replaced by the\n   * validation card before any renderer runs.\n   */\n  customIframeDomains?: string[]\n\n  /**\n   * When the library renders an \"open in a new tab\" link under an embed\n   * (`strings.iframeOpenInNewTab`).\n   *\n   * A COEP-blocked iframe fires no event the parent page can observe, so\n   * without this the user sees an unexplained blank frame.\n   *\n   * - `'auto'` (default) — only when the page is cross-origin isolated\n   *   (`window.crossOriginIsolated`). That flag needs COOP `same-origin` AND\n   *   COEP, so a host that sends COEP alone still blocks embeds while the\n   *   flag is false: set `'always'` there. Read after mount, never during\n   *   render, so SSR markup and hydration agree.\n   * - `'always'` / `'never'` — unconditional.\n   */\n  iframeFallbackLink?: 'auto' | 'always' | 'never'\n\n  /**\n   * Where `ChartJSRenderer` enables wheel-zoom / drag-pan / pinch on a chart\n   * (through the optional `chartjs-plugin-zoom` peer dependency — absent, the\n   * chart renders exactly as it does without this setting).\n   *\n   * Hijacking the mouse wheel on a component sitting inline in a scrolling\n   * chat feed is hostile: the user scrolls the conversation and the chart eats\n   * the gesture. So zoom belongs to a surface that OWNS its viewport, which\n   * here is `ExpandableWrapper`'s fullscreen modal.\n   *\n   * - `'expanded'` (default) — only inside the fullscreen modal.\n   * - `'always'` — inline as well. For a host that lays charts out in a\n   *   dashboard rather than in a feed, where the wheel has nothing to steal.\n   * - `'never'` — off everywhere; the plugin is never registered.\n   *\n   * @since 6.22.0\n   */\n  chartZoom?: 'expanded' | 'always' | 'never'\n}\n\n/**\n * The resolved host policy: every key present. This is what the library hands\n * back, so a reader never null-checks a policy.\n *\n * Extends `Required<`{@link MCPUIConfigInput}`>` rather than declaring the\n * fields again, so a key exists in exactly one place and the two views cannot\n * drift. It remains an interface so existing consumers can extend or augment\n * the public contract as they could before 6.22.0.\n */\nexport interface MCPUIConfig extends Required<MCPUIConfigInput> {}\n\n/**\n * Defaults. Chosen so a host that sends no COEP header sees no change from\n * 6.20.0 apart from the fallback link, which `'auto'` keeps hidden there —\n * and, since 6.22.0, so no inline component ever captures the wheel\n * (`chartZoom: 'expanded'`).\n *\n * Typed `MCPUIConfig` (i.e. resolved): that annotation is what stops a new\n * key from shipping without a default.\n */\nexport const DEFAULT_MCPUI_CONFIG: MCPUIConfig = {\n  iframeCredentialless: 'auto',\n  customTrustedIframeDomains: [],\n  iframePolicy: 'strict',\n  customIframeDomains: [],\n  iframeFallbackLink: 'auto',\n  chartZoom: 'expanded',\n}\n\n/**\n * Typed with the RESOLVED view, because this context is read as well as\n * written: it is exported, so a consumer may call\n * `useContext(MCPUIConfigContext)` directly, and typing it as the input view\n * would hand them `IframePolicy | undefined` — exactly the regression this\n * whole split exists to undo.\n *\n * The cost lands on the rarer side: a host feeding this context directly\n * passes a COMPLETE value, `{ ...DEFAULT_MCPUI_CONFIG, ...mine }`. Anyone who\n * wants to pass only the keys they care about uses `MCPUIConfigProvider`,\n * whose `config` prop takes `Partial<`{@link MCPUIConfig}`>` and does that\n * merge. That preserves optional properties added through declaration\n * merging; {@link MCPUIConfigInput} remains the unaugmented built-in input\n * shape a host can name for ordinary authored configs.\n */\nexport const MCPUIConfigContext = createContext<MCPUIConfig>(DEFAULT_MCPUI_CONFIG)\n\n/**\n * Reads the active host config, resolved: every key is present, whether it\n * came from the provider or from `DEFAULT_MCPUI_CONFIG`. Returns the defaults\n * outright when no `<MCPUIConfigProvider>` is mounted above.\n */\nexport function useMCPUIConfig(): MCPUIConfig {\n  return mergeProps(DEFAULT_MCPUI_CONFIG, useContext(MCPUIConfigContext))\n}\n\nexport interface MCPUIConfigProviderProps {\n  /**\n   * Partial override of the host config. Any key left unset falls back to\n   * `DEFAULT_MCPUI_CONFIG`.\n   */\n  config?: Partial<MCPUIConfig>\n  children: JSX.Element\n}\n\n/**\n * Provides the host config to every MCP-UI renderer below it.\n * Merges the partial `config` override over the defaults.\n */\nexport function MCPUIConfigProvider(props: MCPUIConfigProviderProps): JSX.Element {\n  // The function source keeps replacement `config` objects reactive while\n  // mergeProps fills any omitted key without taking a one-time snapshot.\n  const value = mergeProps(DEFAULT_MCPUI_CONFIG, () => props.config)\n  return (\n    <MCPUIConfigContext.Provider value={value}>\n      {props.children}\n    </MCPUIConfigContext.Provider>\n  )\n}\n"],"names":["DEFAULT_MCPUI_CONFIG","iframeCredentialless","customTrustedIframeDomains","iframePolicy","customIframeDomains","iframeFallbackLink","chartZoom","MCPUIConfigContext","createContext","useMCPUIConfig","mergeProps","useContext","MCPUIConfigProvider","props","value","config","_$createComponent","Provider","children"],"mappings":";;AA6KO,MAAMA,uBAAoC;AAAA,EAC/CC,sBAAsB;AAAA,EACtBC,4BAA4B,CAAA;AAAA,EAC5BC,cAAc;AAAA,EACdC,qBAAqB,CAAA;AAAA,EACrBC,oBAAoB;AAAA,EACpBC,WAAW;AACb;AAiBO,MAAMC,qBAAqBC,cAA2BR,oBAAoB;AAO1E,SAASS,iBAA8B;AAC5C,SAAOC,WAAWV,sBAAsBW,WAAWJ,kBAAkB,CAAC;AACxE;AAeO,SAASK,oBAAoBC,OAA8C;AAGhF,QAAMC,QAAQJ,WAAWV,sBAAsB,MAAMa,MAAME,MAAM;AACjE,SAAAC,gBACGT,mBAAmBU,UAAQ;AAAA,IAACH;AAAAA,IAAY,IAAAI,WAAA;AAAA,aACtCL,MAAMK;AAAAA,IAAQ;AAAA,EAAA,CAAA;AAGrB;"}

package/dist/context/MCPUIMathContext.cjs

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const web = require("solid-js/web");
+const solidJs = require("solid-js");
+const MCPUIMathContext = solidJs.createContext(() => void 0);
+function MCPUIMathProvider(props) {
+  return web.createComponent(MCPUIMathContext.Provider, {
+    value: () => props.renderMath ?? void 0,
+    get children() {
+      return props.children;
+    }
+  });
+}
+function useMCPUIMath() {
+  return solidJs.useContext(MCPUIMathContext);
+}
+exports.MCPUIMathProvider = MCPUIMathProvider;
+exports.useMCPUIMath = useMCPUIMath;
+//# sourceMappingURL=MCPUIMathContext.cjs.map

package/dist/context/MCPUIMathContext.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"MCPUIMathContext.cjs","sources":["../../src/context/MCPUIMathContext.tsx"],"sourcesContent":["import { createContext, useContext, type Accessor, type JSX } from 'solid-js'\n\nexport interface MathRenderOptions {\n  displayMode: boolean\n}\n\n/** A synchronous, host-supplied renderer. Returned markup is always sanitized by MCP-UI. */\nexport type MathRenderer = (tex: string, options: MathRenderOptions) => string | null\n\nconst MCPUIMathContext = createContext<Accessor<MathRenderer | undefined>>(() => undefined)\n\nexport interface MCPUIMathProviderProps {\n  /** Omit or pass null to explicitly disable an inherited renderer. */\n  renderMath?: MathRenderer | null\n  children: JSX.Element\n}\n\nexport function MCPUIMathProvider(props: MCPUIMathProviderProps): JSX.Element {\n  return (\n    <MCPUIMathContext.Provider value={() => props.renderMath ?? undefined}>\n      {props.children}\n    </MCPUIMathContext.Provider>\n  )\n}\n\n/**\n * Returns a reactive accessor for the nearest math renderer. Call the accessor\n * at use time; its value changes when a provider swaps or disables its renderer.\n */\nexport function useMCPUIMath(): Accessor<MathRenderer | undefined> {\n  return useContext(MCPUIMathContext)\n}\n"],"names":["MCPUIMathContext","createContext","undefined","MCPUIMathProvider","props","_$createComponent","Provider","value","renderMath","children","useMCPUIMath","useContext"],"mappings":";;;;AASA,MAAMA,mBAAmBC,QAAAA,cAAkD,MAAMC,MAAS;AAQnF,SAASC,kBAAkBC,OAA4C;AAC5E,SAAAC,IAAAA,gBACGL,iBAAiBM,UAAQ;AAAA,IAACC,OAAOA,MAAMH,MAAMI,cAAcN;AAAAA,IAAS,IAAAO,WAAA;AAAA,aAClEL,MAAMK;AAAAA,IAAQ;AAAA,EAAA,CAAA;AAGrB;AAMO,SAASC,eAAmD;AACjE,SAAOC,QAAAA,WAAWX,gBAAgB;AACpC;;;"}

package/dist/context/MCPUIMathContext.d.ts

@@ -0,0 +1,18 @@
+import { type Accessor, type JSX } from 'solid-js';
+export interface MathRenderOptions {
+    displayMode: boolean;
+}
+/** A synchronous, host-supplied renderer. Returned markup is always sanitized by MCP-UI. */
+export type MathRenderer = (tex: string, options: MathRenderOptions) => string | null;
+export interface MCPUIMathProviderProps {
+    /** Omit or pass null to explicitly disable an inherited renderer. */
+    renderMath?: MathRenderer | null;
+    children: JSX.Element;
+}
+export declare function MCPUIMathProvider(props: MCPUIMathProviderProps): JSX.Element;
+/**
+ * Returns a reactive accessor for the nearest math renderer. Call the accessor
+ * at use time; its value changes when a provider swaps or disables its renderer.
+ */
+export declare function useMCPUIMath(): Accessor<MathRenderer | undefined>;
+//# sourceMappingURL=MCPUIMathContext.d.ts.map

package/dist/context/MCPUIMathContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MCPUIMathContext.d.ts","sourceRoot":"","sources":["../../src/context/MCPUIMathContext.tsx"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,QAAQ,EAAE,KAAK,GAAG,EAAE,MAAM,UAAU,CAAA;AAE7E,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,OAAO,CAAA;CACrB;AAED,4FAA4F;AAC5F,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,KAAK,MAAM,GAAG,IAAI,CAAA;AAIrF,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,UAAU,CAAC,EAAE,YAAY,GAAG,IAAI,CAAA;IAChC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAA;CACtB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,GAAG,CAAC,OAAO,CAM5E;AAED;;;GAGG;AACH,wBAAgB,YAAY,IAAI,QAAQ,CAAC,YAAY,GAAG,SAAS,CAAC,CAEjE"}

package/dist/context/MCPUIMathContext.js

@@ -0,0 +1,19 @@
+import { createComponent } from "solid-js/web";
+import { createContext, useContext } from "solid-js";
+const MCPUIMathContext = createContext(() => void 0);
+function MCPUIMathProvider(props) {
+  return createComponent(MCPUIMathContext.Provider, {
+    value: () => props.renderMath ?? void 0,
+    get children() {
+      return props.children;
+    }
+  });
+}
+function useMCPUIMath() {
+  return useContext(MCPUIMathContext);
+}
+export {
+  MCPUIMathProvider,
+  useMCPUIMath
+};
+//# sourceMappingURL=MCPUIMathContext.js.map

package/dist/context/MCPUIMathContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MCPUIMathContext.js","sources":["../../src/context/MCPUIMathContext.tsx"],"sourcesContent":["import { createContext, useContext, type Accessor, type JSX } from 'solid-js'\n\nexport interface MathRenderOptions {\n  displayMode: boolean\n}\n\n/** A synchronous, host-supplied renderer. Returned markup is always sanitized by MCP-UI. */\nexport type MathRenderer = (tex: string, options: MathRenderOptions) => string | null\n\nconst MCPUIMathContext = createContext<Accessor<MathRenderer | undefined>>(() => undefined)\n\nexport interface MCPUIMathProviderProps {\n  /** Omit or pass null to explicitly disable an inherited renderer. */\n  renderMath?: MathRenderer | null\n  children: JSX.Element\n}\n\nexport function MCPUIMathProvider(props: MCPUIMathProviderProps): JSX.Element {\n  return (\n    <MCPUIMathContext.Provider value={() => props.renderMath ?? undefined}>\n      {props.children}\n    </MCPUIMathContext.Provider>\n  )\n}\n\n/**\n * Returns a reactive accessor for the nearest math renderer. Call the accessor\n * at use time; its value changes when a provider swaps or disables its renderer.\n */\nexport function useMCPUIMath(): Accessor<MathRenderer | undefined> {\n  return useContext(MCPUIMathContext)\n}\n"],"names":["MCPUIMathContext","createContext","undefined","MCPUIMathProvider","props","_$createComponent","Provider","value","renderMath","children","useMCPUIMath","useContext"],"mappings":";;AASA,MAAMA,mBAAmBC,cAAkD,MAAMC,MAAS;AAQnF,SAASC,kBAAkBC,OAA4C;AAC5E,SAAAC,gBACGL,iBAAiBM,UAAQ;AAAA,IAACC,OAAOA,MAAMH,MAAMI,cAAcN;AAAAA,IAAS,IAAAO,WAAA;AAAA,aAClEL,MAAMK;AAAAA,IAAQ;AAAA,EAAA,CAAA;AAGrB;AAMO,SAASC,eAAmD;AACjE,SAAOC,WAAWX,gBAAgB;AACpC;"}

package/dist/context/MCPUIStringsContext.cjs

@@ -284,7 +284,12 @@ const DEFAULT_MCPUI_STRINGS = {
   sizeKilobytes: "{size} KB",
   sizeMegabytes: "{size} MB",
   // ── 6.21.0 — iframe COEP fallback ──────────────────────────
-  iframeOpenInNewTab: "Open in a new tab"
+  iframeOpenInNewTab: "Open in a new tab",
+  // ── 6.22.0 — zoom / pan controls ───────────────────────────
+  zoomIn: "Zoom in",
+  zoomOut: "Zoom out",
+  zoomReset: "Reset zoom",
+  zoomLevel: "Zoom {percent}%"
 };
 const MCPUIStringsContext = solidJs.createContext(DEFAULT_MCPUI_STRINGS);
 const resolvedLocales = /* @__PURE__ */ new Map();