overthinkos/maputnik-layer
marimo/skills/maputnik-layer/SKILL.md
Maputnik — visual editor for MapLibre GL vector-tile styles. Pure-JS SPA built from upstream source via npm at image build time, served as static dist by python -m http.server. Pairs with osm-data's martin tile server. Use when working with the maputnik layer, the Vite --base=/ build override (critical fix; default --base=/maputnik/ produces 404 asset paths), or the asset-base lock-in eval test.
development
Updated May 11, 2026
$ install --global
skillsauthnpx skillsauth add overthinkos/overthink-plugins maputnik-layerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 11, 2026, 5:42 AM381.5s1 file scanned
SKILL.md
- name:
- maputnik-layer
- description:
- |
maputnik — visual MapLibre style editor
Maputnik is a pure-JS SPA for visually editing MapLibre GL JS style
JSON files. Built from upstream source (felt/maputnik) via npm at
image build time, served as a static dist by Python's stdlib
http.server. Composed by /ov-marimo:marimo-ml so operators can
iterate on the streets-map style against the in-pod martin tile
server (/ov-marimo:osm-data-layer).
Layer properties
| Property | Value |
|----------|-------|
| Dependencies | supervisord |
| Distros | fedora (sole; needs node + npm + git for build) |
| Build deps | nodejs, npm, git |
| Ports | 8000 (host-mapped to 28000) |
| Service | maputnik (supervisord, restart: always) |
| Static dist | /opt/maputnik/build/ (Vite dist/ renamed) |
Service spec
service:
- name: maputnik
exec: /usr/bin/python3 -m http.server 8000 --directory /opt/maputnik/build
restart: always
working_directory: /opt/maputnik
Pure stdlib server — no marimo-pixi-env coupling. The system
python3 from supervisord's own RPM dep handles the static serve.
Critical: Vite --base=/ override
Maputnik's package.json defines "build": "tsc && vite build".
Vite's default base path for builds is --base=/maputnik/. That
default bakes /maputnik/assets/* URL references into the emitted
index.html — but we serve the dist at root (/) via
python -m http.server, so all those baked URLs 404 in the
browser.
Symptom (before fix): the maputnik UI loads at
http://127.0.0.1:28000/ showing a blank page; browser dev-tools
shows asset 404s for /maputnik/assets/index-*.js etc.
Fix in the build cmd:
- cmd: |
set -euo pipefail
git clone --depth 1 https://github.com/maplibre/maputnik /tmp/maputnik
cd /tmp/maputnik
npm ci --no-audit --no-fund
# Override Vite's default --base=/maputnik/ so asset URLs are
# root-relative and resolve against our serve path. The `--`
# forwards the flag through npm to vite.
npm run build -- --base=/
if [ -d dist ]; then
mkdir -p /opt/maputnik
cp -r dist /opt/maputnik/build
else
echo "maputnik build did not produce ./dist directory" >&2
ls -la
exit 1
fi
cd /
rm -rf /tmp/maputnik /root/.npm
user: root
Eval lock-in
A deploy-scope eval probe greps the served HTML for the (forbidden)
/maputnik/ prefix and fails if present. Locks in the fix against a
future revert to the Vite default:
- id: maputnik-asset-base-not-prefixed
scope: deploy
command: |
! curl -fsS http://localhost:8000/ | grep -q '"/maputnik/'
in_container: true
exit_status: 0
Plus the standard probes (also deploy-scope):
maputnik-running— supervisord program is RUNNINGmaputnik-port-reachable— TCP 8000 reachablemaputnik-http-up—GET /returns 200
Use case in marimo-ml
The streets-map style in /ov-marimo:notebook-osm cell 7 is a
small inline JSON. Operators iterating on richer styles can:
- Open maputnik at
http://127.0.0.1:28000/ - Connect to martin's TileJSON URL
http://127.0.0.1:23000/monaco - Visually edit polygon/line/circle layer paint properties
- Export the style JSON
- Paste into the notebook cell (or save to a server-mounted file
and load via
style: 'http://...'in the MapLibre constructor)
Cross-references
/ov-marimo:marimo-ml— image composing this layer/ov-marimo:osm-data-layer— companion martin tile server/ov-marimo:notebook-osm— uses an inline style; maputnik can author richer ones/ov-infrastructure:supervisord— service runtime
Related Skills
overthinkos/plugin
tools
VerifiedTrustedCommunity
Use when authoring or modifying a charly PLUGIN — a candy with a `plugin:` block that contributes Providers (verbs/kinds/deploy-targets/steps/builders/commands), its own CUE schema, builtin (compiled-in) or external (out-of-tree git repo). Covers the unified Provider model, the per-plugin CUE-schema contract (single source → Go params for dev + schema-over-Describe RPC for runtime), the SDK, and the loader.
SKILL.mdUpdated Jun 22, 2026
overthinkos/cue
tools
VerifiedTrustedCommunity
The CUE data-validation / configuration CLI (cue), pinned to v0.16.1. Use when working with the cue candy, installing the cue binary into a box or onto a target:local dev host, or running the offline schema-vendoring pipeline that feeds charly's egress validation.
SKILL.mdUpdated Jun 16, 2026
overthinkos/egress
tools
VerifiedTrustedCommunity
CUE EGRESS validation — validating (and, where it adds value, generating) the config files charly WRITES to a system BEFORE the bytes hit disk. MUST be invoked before working on charly/egress.go, the vendored schemas under candy/plugin-egress/egress-schemas/vendor/, the ValidateEgress / registerVendoredEgressKind path, the offline `task cue:vendor` pipeline, or adding an egress schema for any written artifact (cloud-init, k8s manifests, traefik routes, runtime config, install ledger, systemd/quadlet units, ssh_config, libvirt XML).
SKILL.mdUpdated Jun 16, 2026
overthinkos/check-k8s
tools
VerifiedTrustedCommunity
Kubernetes cluster-probe declarative check verb — the `kube:` check verb (nodes, pods, ingress, storage class, addon health, apply/delete, and arbitrary resource GETs) served out-of-process by the candy/plugin-kube plugin (vendored client-go; no external kubectl required).
SKILL.mdUpdated Jun 14, 2026