Reach the tile route, and give the map what it was missing (#130, #131)

**The world rendered in the app and in neither web surface, because the panel's
tile route was unreachable.** Server routes match

    /^\/api\/servers\/([^/]+)(?:\/(\w+))?$/

and `\w` does not match a slash, so `/api/servers/:id/map/tiles` matched nothing
and fell through to the 404 at the bottom. Every tile fetch from the panel has
404'd since #119; the desktop was fine because it goes over IPC. One nested
segment is allowed now, still `\w`-only per segment so a sub-route cannot
express a traversal.

The coverage test could not have caught it: it compares the documented surface
to route literals found in the handler's own source, and `'map/tiles'` was in
the source. So there is a second check now — every documented fixed-path GET
route must answer something other than the router's own "not-found", called with
an owner token so a scope refusal cannot be mistaken for a reachable route. It
found the bug immediately when reinstated, and it also flags routes with a
second placeholder as untestable rather than pretending to cover them.

**Heatmap off by default**, on all three surfaces. It is an analysis overlay,
and a red block over the one player online was the first thing anyone saw.

**Click a player to go to them.** The list under the map was inert; with several
people online, finding one meant panning and reading the coordinate readout. It
centres the view and keeps the zoom — jumping to a fixed zoom would throw away
the scale the operator had chosen.

**Structures on the map**: villages, dungeons and ruins, temples, fortresses,
mineshafts, with a filter. Read from `structures.starts` in the same chunk NBT
the surface already comes from, so it costs a lookup rather than a second pass
over the world, and only when asked for — a payload that carries them "in case"
is one the public feed could leak.

Off by default everywhere. An operator may switch them on for their own map
without a setting, because they can already read the world folder. **The public
map cannot**: the feed sends markers only when the operator published them and
ignores what the caller asks for, so the site cannot be talked into a treasure
map of a private world. The toggle is hidden on the public page for the same
reason — a control the feed ignores is not a control.

**How far ahead to load**, as an operator setting. Worth being exact about what
it is not: MSMS never generates terrain. It reads region files the server has
already written, and a map that could grow a world by being panned would be a
map that can fill a disk. "Load ahead" reads a ring of chunks around the
viewport so panning is already drawn — more parsing, same world. Pregenerating
terrain deliberately is a separate feature.

Author: CaYatur

src/main/core/worldTiles.ts

@@ -29,16 +29,25 @@ import {
   regionOf,
   unpackIndices,
   seeThrough,
+  structureKind,
   CHUNK_AXIS,
   INVISIBLE
 } from '@shared/regionFormat'
+import type { StructureMark } from '@shared/regionFormat'
 
 /** A chunk's surface: 256 columns, row-major (x fastest). */
 export interface ChunkTile {
   /** Packed 0xRRGGBB per column. */
   colour: number[]
   /** World Y of the drawn block, for cross-chunk shading. */
   height: number[]
+  /**
+   * Structures starting in this chunk (#131).
+   *
+   * Read from the same NBT the surface came from, so it costs one more object
+   * lookup rather than a second pass over the world. Absent on most chunks.
+   */
+  marks?: StructureMark[]
 }
 
 interface RegionEntry {
@@ -178,7 +187,37 @@ export function tileFromChunk(chunk: any): ChunkTile | null {
   }
   // Nothing at all: an ungenerated or empty chunk, which is not a tile.
   if (remaining === colour.length) return null
-  return { colour, height }
+  const marks = structuresOf(v)
+  return { colour, height, ...(marks.length ? { marks } : {}) }
+}
+
+/**
+ * Structures whose start is in this chunk.
+ *
+ * `structures.starts` is keyed by structure id and each entry carries the chunk
+ * it starts in — `ChunkX`/`ChunkZ` in chunk units, which is why they are
+ * multiplied here rather than used raw. A chunk that merely CONTAINS part of a
+ * structure lists it in `References`, not `starts`, so this yields one mark per
+ * structure rather than one per chunk it sprawls across.
+ */
+function structuresOf(v: any): StructureMark[] {
+  const starts = tag(tag(v.structures)?.starts) ?? tag(tag(tag(v.Level)?.Structures)?.Starts)
+  if (!starts || typeof starts !== 'object') return []
+  const out: StructureMark[] = []
+  for (const [id, raw] of Object.entries(starts)) {
+    const s = tag(raw)
+    if (!s || typeof s !== 'object') continue
+    const cx = Number(tag((s as any).ChunkX))
+    const cz = Number(tag((s as any).ChunkZ))
+    if (!Number.isFinite(cx) || !Number.isFinite(cz)) continue
+    out.push({
+      kind: structureKind(id),
+      id: String(id).replace(/^minecraft:/, ''),
+      x: cx * CHUNK_AXIS + CHUNK_AXIS / 2,
+      z: cz * CHUNK_AXIS + CHUNK_AXIS / 2
+    })
+  }
+  return out
 }
 
 function decompress(buf: Buffer, kind: number): Buffer | null {
@@ -316,14 +355,23 @@ let working = false
 export function requestTiles(
   serverId: string,
   dim: string,
-  want: { cx: number; cz: number }[]
-): { tiles: Record<string, { c: number[]; h: number[] }>; pending: number } {
-  const tiles: Record<string, { c: number[]; h: number[] }> = {}
+  want: { cx: number; cz: number }[],
+  opts: { marks?: boolean } = {}
+): { tiles: Record<string, { c: number[]; h: number[]; m?: StructureMark[] }>; pending: number } {
+  const tiles: Record<string, { c: number[]; h: number[]; m?: StructureMark[] }> = {}
   const missing: { cx: number; cz: number }[] = []
   for (const w of want) {
     const t = peekChunkTile(serverId, dim, w.cx, w.cz)
     if (t === undefined) missing.push(w)
-    else if (t) tiles[w.cx + ',' + w.cz] = { c: t.colour, h: t.height }
+    // Structures are omitted unless asked for. They are a spoiler, and a
+    // payload that carries them "in case" is one the public feed could leak.
+    else if (t) {
+      tiles[w.cx + ',' + w.cz] = {
+        c: t.colour,
+        h: t.height,
+        ...(opts.marks && t.marks ? { m: t.marks } : {})
+      }
+    }
   }
   for (const m of missing) {
     if (queue.length > 4096) break

src/main/smoke.ts

@@ -67,7 +67,7 @@ import { getPublicSiteHtml } from './web/publicSiteHtml'
 import { CRATE_CSS } from '@shared/crateUi'
 import { openApiDocument } from '@shared/openapi'
 import { clampGrace, deliveryDecision, queueReason, HOLD_REASONS } from '@shared/delivery'
-import { API_PREFIX } from '@shared/apiSurface'
+import { API_PREFIX, API_ROUTES } from '@shared/apiSurface'
 import { MODERATION_ACTIONS, WORLD_ACTIONS } from '@shared/ops'
 import { removeServer } from './core/serverRegistry'
 import * as sf from './core/serverFiles'
@@ -6990,6 +6990,44 @@ export async function runWebSmoke(): Promise<void> {
         }
       }
 
+      // ...and the router can actually REACH them (#130).
+      //
+      // Everything above compares documentation to source literals, which says
+      // nothing about routing. `/servers/{id}/map/tiles` was documented, present
+      // as a literal in the handler, and unreachable for weeks: the route
+      // matcher's `\w+` cannot match a slash, so every two-segment sub-route
+      // fell through to the 404 at the bottom. The desktop app hid it by going
+      // over IPC.
+      //
+      // A 404 with `not-found` is the fall-through; anything else — a real
+      // answer, a 400, a 403 — means the route was found.
+      {
+        const fixture = getConfig().servers.find((s) => s.id === id)
+        if (!fixture) return fail('the fixture server vanished before the reachability check')
+        let checked = 0
+        for (const route of API_ROUTES) {
+          if (route.method !== 'GET') continue
+          if (!route.path.startsWith('/servers/{id}')) continue
+          const url = '/api' + route.path.replace('{id}', encodeURIComponent(id))
+          // Only fixed paths. A route with another placeholder needs a value
+          // that exists, and a legitimate "no such player" is indistinguishable
+          // from "no such route" — which would make this assert nothing useful
+          // about routing while looking like it did.
+          if (url.includes('{')) continue
+          // Owner token: a refusal for want of scope would hide the real
+          // question, which is whether the router found the route at all.
+          const rr = await get(url, ot)
+          checked++
+          if (rr.status === 404) {
+            const body = (await rr.json().catch(() => ({}))) as { error?: string }
+            if (body.error === 'not-found') {
+              return fail('the router cannot reach a documented route: GET ' + url)
+            }
+          }
+        }
+        if (checked < 10) return fail('the reachability check only tried ' + checked + ' routes')
+      }
+
       // Keep the checked-in copy current. It is a generated artefact, and a
       // stale one in the repo is worse than none — an integrator reads the file
       // in the repository, not the one this process would serve.

src/main/web/panelHtml.ts

@@ -794,8 +794,9 @@ function mapFeedUrl(dim,cell){
  return '/api/servers/'+mapServerId()+'/map?dim='+encodeURIComponent(dim)+'&cell='+encodeURIComponent(cell)}
 /* The map engine does not know how this page wraps a response, and must not:
    the two pages disagree, and it used to assume this one (#115). */
-function mapTilesUrl(dim,list){
- return '/api/servers/'+mapServerId()+'/map/tiles?dim='+encodeURIComponent(dim)+'&c='+encodeURIComponent(list)}
+function mapTilesUrl(dim,list,marks){
+ return '/api/servers/'+mapServerId()+'/map/tiles?dim='+encodeURIComponent(dim)+
+  '&c='+encodeURIComponent(list)+(marks?'&marks=1':'')}
 function mapGet(u){return api(u).then(function(r){return r.ok?r.body:null}).catch(function(){return null})}
 function mapPost(u){return api(u,{method:'POST'}).then(function(r){
  /* A refusal still has a body worth showing — "no jar available" is the answer,

src/main/web/publicSiteHtml.ts

@@ -483,6 +483,12 @@ function pagePost(id){
    rounds coordinates, drops the height, and only sends a uuid when the operator
    turned heads on. */
 function pageMap(){
+ /* The operator's settings, not the visitor's. Structures and read-ahead are
+    published decisions; a visitor toggling them would only be asking for data
+    the feed refuses anyway (#131). */
+ MAP.marksOn=!!S.mapStructures;
+ MAP.loadAhead=!!S.mapLoadAhead;
+ MAP.world=!!S.mapWorld;
  setTimeout(function(){mapStart()},0);
  return '<section class="section"><div class="wrap"><div class="section-head"><h2>'+esc(T('map.title'))+'</h2>'+
   '<span class="muted" id="mapRoundNote"></span></div>'+${JSON.stringify(MAP_HTML)}+'</div></section>'}
@@ -491,6 +497,8 @@ function mapFeedUrl(dim,cell){
 /* This page's api() answers {ok,s,j}; the panel's answers {ok,status,body}. The
    map engine used to read .body unconditionally, so on this page every poll
    threw on undefined and the map never drew (#115). */
+/* No marks parameter: the public feed decides from the operator's setting and
+   ignores what the caller asks for, so there is nothing to send (#131). */
 function mapTilesUrl(dim,list){
  return '/api/public/map/tiles?dim='+encodeURIComponent(dim)+'&c='+encodeURIComponent(list)}
 function mapGet(u){return api(u).then(function(r){return r.ok?r.j:null}).catch(function(){return null})}

src/main/web/server.ts

@@ -738,7 +738,14 @@ async function handlePublic(
     if (!cfg || !cfg.world) return sendJson(res, 404, { error: 'not-found' })
     const q = new URL(req.url ?? '/', 'http://localhost').searchParams
     const dim = normalizeDimension(q.get('dim') ?? 'overworld')
-    return sendJson(res, 200, tilesFor(cfg.serverId, dim, parseWanted(q.get('c'))))
+    // Structures only when the operator published them, whatever the caller
+    // asks for: where every village and dungeon is turns a public site into a
+    // treasure map of a private world.
+    return sendJson(
+      res,
+      200,
+      tilesFor(cfg.serverId, dim, parseWanted(q.get('c')), { marks: cfg.structures })
+    )
   }
 
   const sid = site.siteServerId()
@@ -972,7 +979,15 @@ async function handlePanel(req: IncomingMessage, res: ServerResponse): Promise<v
   }
 
   // ---- /api/servers/:id/... ----
-  const m = path.match(/^\/api\/servers\/([^/]+)(?:\/(\w+))?$/)
+  //
+  // One optional NESTED segment. `\w` does not match a slash, so the previous
+  // shape silently refused every two-part sub-route: `/map/tiles` matched
+  // nothing and fell through to the 404 at the bottom of this function, which
+  // is why the world rendered in the desktop app (IPC) and nowhere on the web.
+  //
+  // Still `\w`-only per segment, so a sub-route cannot express `..` or anything
+  // else that would mean something to a path.
+  const m = path.match(/^\/api\/servers\/([^/]+)(?:\/(\w+(?:\/\w+)?))?$/)
   if (m) {
     const id = decodeURIComponent(m[1])
     const sub = m[2]
@@ -1228,7 +1243,15 @@ async function handlePanel(req: IncomingMessage, res: ServerResponse): Promise<v
     if (sub === 'map/tiles' && method === 'GET') {
       if (!gate('view')) return
       const dim = normalizeDimension(url.searchParams.get('dim') ?? 'overworld')
-      return sendJson(res, 200, tilesFor(id, dim, parseWanted(url.searchParams.get('c'))))
+      // An operator may ask for structures on their own map without a setting —
+      // they can already read the world folder. The public feed cannot.
+      return sendJson(
+        res,
+        200,
+        tilesFor(id, dim, parseWanted(url.searchParams.get('c')), {
+          marks: url.searchParams.get('marks') === '1'
+        })
+      )
     }
     if (sub === 'map' && method === 'GET') {
       if (!gate('view')) return

src/main/web/site.ts

@@ -144,6 +144,8 @@ export function setSiteConfig(patch: Partial<SiteConfig>): SiteConfig {
     if (m.heads !== undefined) s.map.heads = !!m.heads
     if (m.names !== undefined) s.map.names = !!m.names
     if (m.world !== undefined) s.map.world = !!m.world
+    if (m.structures !== undefined) s.map.structures = !!m.structures
+    if (m.loadAhead !== undefined) s.map.loadAhead = !!m.loadAhead
   }
   if (patch.profile) {
     // Field by field and coerced, for the reason above: "false" is truthy, and
@@ -316,6 +318,8 @@ export function publicSite(): PublicSite {
     showMap: s.map.enabled && !!getServer(s.map.serverId),
     mapHeads: s.map.enabled && s.map.heads,
     mapWorld: s.map.enabled && s.map.world,
+    mapStructures: s.map.enabled && s.map.structures,
+    mapLoadAhead: s.map.enabled && s.map.loadAhead,
     // A profile needs a server to read a roster from. Without one the page
     // would render a name and a head and nothing else.
     showProfiles: !!getServer(s.storeServerId),

src/renderer/src/components/LiveMap.tsx

@@ -100,7 +100,9 @@ export function LiveMap({ serverId }: { serverId: string }): JSX.Element {
   const [bridge, setBridge] = useState(false)
   const [dim, setDim] = useState('overworld')
   const [cell, setCell] = useState(16)
-  const [showHeat, setShowHeat] = useState(true)
+  // An analysis overlay, not what a map is for: a red block over the one player
+  // online was the first thing anyone saw (#131).
+  const [showHeat, setShowHeat] = useState(false)
   const canvasRef = useRef<HTMLCanvasElement>(null)
   // Only to explain an empty canvas. The install itself is `BridgeNotice`,
   // which renders above the map whether or not there is anyone to draw — this
@@ -494,13 +496,22 @@ export function LiveMap({ serverId }: { serverId: string }): JSX.Element {
       </div>
       {shown.length > 0 && (
         <div className="row wrap" style={{ gap: 6, marginTop: 8 }}>
+          {/* Click to centre on them, keeping the zoom — with several people
+              online, finding one meant panning around reading the coordinate
+              readout (#131). */}
           {shown.map((p) => (
-            <span key={p.name} className="badge">
+            <button
+              key={p.name}
+              className="badge"
+              style={{ cursor: 'pointer', font: 'inherit', color: 'inherit' }}
+              title={t('map.goTo')}
+              onClick={() => view && setView({ cx: p.x, cz: p.z, scale: view.scale })}
+            >
               {p.name}{' '}
               <span className="dim">
                 {p.x}, {p.y}, {p.z}
               </span>
-            </span>
+            </button>
           ))}
         </div>
       )}

src/renderer/src/locales/en.ts

@@ -125,6 +125,7 @@ export default {
     needsBridge:
       'No live positions yet — this server has no MSMS-Bridge plugin. Positions arrive over the server console, so installing it opens no extra port.',
     heads: 'Heads',
+    goTo: 'Centre the map here',
     world: 'World',
     resetView: 'Reset view',
     installBridge: 'Install MSMS-Bridge {{version}}',
@@ -715,6 +716,11 @@ export default {
     mapRound: 'Round to (blocks)',
     mapNames: 'Show names',
     mapHeads: 'Draw skin heads',
+    mapWorld: 'Show the terrain',
+    mapStructures: 'Show villages and dungeons',
+    mapLoadAhead: 'Load ahead of the view',
+    mapLoadHint:
+      'MSMS never generates terrain — it reads what the server has already written. “Load ahead” only reads a ring of chunks around the view so panning is already drawn; it costs more parsing and changes nothing about the world.',
     profile_inventory: 'Publish inventories',
     profile_enderChest: 'Publish ender chests',
     profile_stats: 'Publish health and XP',

src/renderer/src/locales/tr.ts

@@ -127,6 +127,7 @@ const tr: typeof en = {
     needsBridge:
       'Henüz canlı konum yok — bu sunucuda MSMS-Bridge eklentisi yok. Konumlar sunucu konsolu üzerinden geldiği için kurmak ek bir port açmaz.',
     heads: 'Kafalar',
+    goTo: 'Haritayı buraya ortala',
     world: 'Dünya',
     resetView: 'Görünümü sıfırla',
     installBridge: 'MSMS-Bridge {{version}} kur',
@@ -719,6 +720,11 @@ const tr: typeof en = {
     mapRound: 'Yuvarlama (blok)',
     mapNames: 'İsimleri göster',
     mapHeads: 'Oyuncu kafalarını çiz',
+    mapWorld: 'Araziyi göster',
+    mapStructures: 'Köyleri ve zindanları göster',
+    mapLoadAhead: 'Görünümün ötesini önceden yükle',
+    mapLoadHint:
+      'MSMS arazi üretmez — sunucunun zaten yazdığını okur. “Önceden yükle” yalnızca görünümün etrafındaki chunk halkasını okur, böylece kaydırınca çizilmiş olur; daha fazla ayrıştırma demektir, dünyada hiçbir şeyi değiştirmez.',
     profile_inventory: 'Envanterleri yayınla',
     profile_enderChest: 'Ender sandıklarını yayınla',
     profile_stats: 'Can ve XP’yi yayınla',

src/renderer/src/views/SiteView.tsx

@@ -197,8 +197,29 @@ export function SiteView(): JSX.Element {
               <input type="checkbox" checked={cfg.map.heads} onChange={(e) => patchMap({ heads: e.target.checked })} />
               {t('site.mapHeads')}
             </label>
+            <label className="switch" style={{ paddingBottom: 8 }}>
+              <input type="checkbox" checked={cfg.map.world} onChange={(e) => patchMap({ world: e.target.checked })} />
+              {t('site.mapWorld')}
+            </label>
+            <label className="switch" style={{ paddingBottom: 8 }}>
+              <input
+                type="checkbox"
+                checked={cfg.map.structures}
+                onChange={(e) => patchMap({ structures: e.target.checked })}
+              />
+              {t('site.mapStructures')}
+            </label>
+            <label className="switch" style={{ paddingBottom: 8 }}>
+              <input
+                type="checkbox"
+                checked={cfg.map.loadAhead}
+                onChange={(e) => patchMap({ loadAhead: e.target.checked })}
+              />
+              {t('site.mapLoadAhead')}
+            </label>
           </div>
           <p className="hint">{t('site.mapHint')}</p>
+          <p className="hint">{t('site.mapLoadHint')}</p>
 
           {/* What a STRANGER may read on a player's profile (#107). A player
               always sees their own — the toggles are about publishing, and an