@chaosity/location-client 0.5.1 → 0.7.0

package/dist/cjs/utils/roundPosition.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Round coordinate arrays in command inputs so nearby callers share a server
+ * cache entry.
+ *
+ * `BiasPosition` is a hint about where to look, so collapsing it onto a grid
+ * lets two users in the same area reuse one upstream answer. `QueryPosition`
+ * is not a hint — reverse-geocode resolves an exact point a user clicked or a
+ * device reported, and rounding it returns a neighbour's address. It is left
+ * alone (RFC-0001 §2).
+ *
+ * WHY THE DEFAULT MOVED FROM 2 dp TO 3 dp
+ *
+ * 2 dp is a ~1.1 km grid, and that is not a coarser answer — it is a wrong
+ * one. Measured against Amazon Location directly, `QueryText: "cafe"` from
+ * Sydney CBD returns a completely different set of places when the bias moves
+ * 111 m:
+ *
+ *   base      -> Crepe de Paris | Deli Ziosa | CBD Patisserie
+ *   +111 m    -> Cafe Chocolat  | Paradiso Cafe | Incanto Coffee
+ *
+ * So two users a kilometre apart both received whichever places were nearest
+ * the FIRST of them, with nothing in the response saying so. The server moved
+ * to 3 dp in api#21 — but this library rounds BEFORE sending, on both the
+ * browser and server paths, so the precision was already gone by the time the
+ * request arrived and that fix never reached anyone using the SDK. This is
+ * what makes it reach them.
+ *
+ * The cost is hit rate: cells shrink 100x in area. RFC-0001 §5 expected only
+ * "single-digit to low-double-digit percent" in mixed traffic, so there was
+ * little to protect, and a miss costs one upstream call while a wrong answer
+ * costs trust.
+ */
+/** The server's floor (api#65). A request for less is clamped up to it. */
+export declare const DEFAULT_BIAS_DECIMALS = 3;
+/**
+ * The band the server enforces (api#65). Mirrored here so the value this
+ * library rounds to is the value the server will actually key its cache by —
+ * rounding to something outside the band just means being wrong about what
+ * was sent.
+ *
+ * The floor is correctness: below 3 dp the nearest places are not the ones
+ * returned. The ceiling is cost: cells shrink 100x in area per decimal, so
+ * finer precision collapses the cache hit rate and every miss is a billable
+ * upstream call.
+ */
+export declare const MIN_BIAS_DECIMALS = 3;
+export declare const MAX_BIAS_DECIMALS = 5;
+/**
+ * Clamp a requested precision into the allowed band.
+ *
+ * Anything absent or malformed becomes the default rather than throwing: this
+ * runs on every request, and a surprising token claim must not break geocoding
+ * for an application that is otherwise working.
+ */
+export declare function clampBiasDecimals(requested?: unknown): number;
+/**
+ * Shallow-clone the input and round position arrays that benefit from caching.
+ * Returns the original object if no position fields are present.
+ *
+ * @param input      the command input
+ * @param decimals   precision for this application; defaults to the floor.
+ *                   Comes from the `biasDecimals` JWT claim where the token
+ *                   carries one (api#65) — an application entitled to finer
+ *                   bias gets it without the caller configuring anything.
+ */
+export declare function roundPositionFields<T extends object>(input: T, decimals?: number): T;

package/dist/cjs/utils/roundPosition.js

@@ -0,0 +1,109 @@
+"use strict";
+/**
+ * Round coordinate arrays in command inputs so nearby callers share a server
+ * cache entry.
+ *
+ * `BiasPosition` is a hint about where to look, so collapsing it onto a grid
+ * lets two users in the same area reuse one upstream answer. `QueryPosition`
+ * is not a hint — reverse-geocode resolves an exact point a user clicked or a
+ * device reported, and rounding it returns a neighbour's address. It is left
+ * alone (RFC-0001 §2).
+ *
+ * WHY THE DEFAULT MOVED FROM 2 dp TO 3 dp
+ *
+ * 2 dp is a ~1.1 km grid, and that is not a coarser answer — it is a wrong
+ * one. Measured against Amazon Location directly, `QueryText: "cafe"` from
+ * Sydney CBD returns a completely different set of places when the bias moves
+ * 111 m:
+ *
+ *   base      -> Crepe de Paris | Deli Ziosa | CBD Patisserie
+ *   +111 m    -> Cafe Chocolat  | Paradiso Cafe | Incanto Coffee
+ *
+ * So two users a kilometre apart both received whichever places were nearest
+ * the FIRST of them, with nothing in the response saying so. The server moved
+ * to 3 dp in api#21 — but this library rounds BEFORE sending, on both the
+ * browser and server paths, so the precision was already gone by the time the
+ * request arrived and that fix never reached anyone using the SDK. This is
+ * what makes it reach them.
+ *
+ * The cost is hit rate: cells shrink 100x in area. RFC-0001 §5 expected only
+ * "single-digit to low-double-digit percent" in mixed traffic, so there was
+ * little to protect, and a miss costs one upstream call while a wrong answer
+ * costs trust.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_BIAS_DECIMALS = exports.MIN_BIAS_DECIMALS = exports.DEFAULT_BIAS_DECIMALS = void 0;
+exports.clampBiasDecimals = clampBiasDecimals;
+exports.roundPositionFields = roundPositionFields;
+/** The server's floor (api#65). A request for less is clamped up to it. */
+exports.DEFAULT_BIAS_DECIMALS = 3;
+/**
+ * The band the server enforces (api#65). Mirrored here so the value this
+ * library rounds to is the value the server will actually key its cache by —
+ * rounding to something outside the band just means being wrong about what
+ * was sent.
+ *
+ * The floor is correctness: below 3 dp the nearest places are not the ones
+ * returned. The ceiling is cost: cells shrink 100x in area per decimal, so
+ * finer precision collapses the cache hit rate and every miss is a billable
+ * upstream call.
+ */
+exports.MIN_BIAS_DECIMALS = 3;
+exports.MAX_BIAS_DECIMALS = 5;
+/**
+ * Clamp a requested precision into the allowed band.
+ *
+ * Anything absent or malformed becomes the default rather than throwing: this
+ * runs on every request, and a surprising token claim must not break geocoding
+ * for an application that is otherwise working.
+ */
+function clampBiasDecimals(requested) {
+    const n = Number(requested);
+    if ((typeof requested !== 'number' &&
+        !(typeof requested === 'string' && requested.trim() !== '')) ||
+        !Number.isFinite(n)) {
+        return exports.DEFAULT_BIAS_DECIMALS;
+    }
+    const floored = Math.floor(n);
+    if (floored < exports.MIN_BIAS_DECIMALS)
+        return exports.MIN_BIAS_DECIMALS;
+    if (floored > exports.MAX_BIAS_DECIMALS)
+        return exports.MAX_BIAS_DECIMALS;
+    return floored;
+}
+/** Known position field names and whether they should be rounded */
+const POSITION_FIELDS = {
+    BiasPosition: true, // geocode, autocomplete, search — round for cache
+    QueryPosition: false, // reverse geocode — keep full precision
+};
+function roundCoord(value, decimals) {
+    const factor = 10 ** decimals;
+    return Math.round(value * factor) / factor;
+}
+/**
+ * Shallow-clone the input and round position arrays that benefit from caching.
+ * Returns the original object if no position fields are present.
+ *
+ * @param input      the command input
+ * @param decimals   precision for this application; defaults to the floor.
+ *                   Comes from the `biasDecimals` JWT claim where the token
+ *                   carries one (api#65) — an application entitled to finer
+ *                   bias gets it without the caller configuring anything.
+ */
+function roundPositionFields(input, decimals = exports.DEFAULT_BIAS_DECIMALS) {
+    if (!input || typeof input !== 'object')
+        return input;
+    const dp = clampBiasDecimals(decimals);
+    let cloned = null;
+    for (const [field, shouldRound] of Object.entries(POSITION_FIELDS)) {
+        if (!shouldRound)
+            continue;
+        const value = input[field];
+        if (!Array.isArray(value))
+            continue;
+        if (!cloned)
+            cloned = { ...input };
+        cloned[field] = value.map((v) => typeof v === 'number' && Number.isFinite(v) ? roundCoord(v, dp) : v);
+    }
+    return cloned ?? input;
+}

package/dist/cjs/utils/tokenClaims.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Read advisory application config out of the access token (api#65).
+ *
+ * The API puts an application's own settings — `biasDecimals`, `countries` —
+ * into the JWT alongside `allowedDomain` and `allowedResources`, so this
+ * library can stop hard-coding values it has no other way of knowing.
+ *
+ * DELIBERATELY UNVERIFIED, and that is safe. This library has no signing key
+ * and does not need one: every claim here is re-read from the application row
+ * by the API on each request, and the API's answer is the one that counts. A
+ * forged token would fail at the authorizer long before any of this mattered.
+ * What is read here only decides how the request is SHAPED — a hint, never a
+ * permission.
+ *
+ * A JWT is signed, not encrypted, so the payload is plain base64url. Nothing
+ * secret is in it; these are the caller's own settings.
+ */
+export interface AppConfigClaims {
+    /**
+     * Bias precision this application is entitled to.
+     *
+     * Safe to act on: it only changes how a coordinate is rounded before
+     * sending, and the server re-rounds to its own configured value anyway. A
+     * stale value here costs precision, never correctness.
+     */
+    biasDecimals?: number;
+    /**
+     * Countries this application may search, ISO 3166-1 alpha-2.
+     *
+     * READ THIS, DO NOT ACT ON IT. It is here to be displayed — a country
+     * selector, a settings screen, a "this application serves AU and NZ" label.
+     *
+     * Do not inject it into requests and do not reject requests with it. The
+     * token is a snapshot up to fifteen minutes old; the API reads the scope
+     * fresh from the application row on every request. Acting on a stale value
+     * makes things WORSE, in both directions:
+     *
+     *   app is now scoped to NZ, token still says AU
+     *     send nothing         -> API injects [NZ]  -> 200
+     *     inject stale [AU]    -> outside scope     -> 400
+     *
+     * So a request that would have succeeded fails instead. Rejecting locally
+     * has the mirror-image bug: refusing something the API would now allow.
+     * Sending nothing and letting the API scope the request is always correct.
+     */
+    countries?: string[];
+}
+/**
+ * Decode a JWT payload without verifying it.
+ *
+ * Returns `{}` for anything unparseable. This runs on every request, so a
+ * surprising token must degrade to "no claims" rather than break geocoding
+ * for an application that is otherwise working.
+ */
+export declare function readAppConfigClaims(token?: string | null): AppConfigClaims;

package/dist/cjs/utils/tokenClaims.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * Read advisory application config out of the access token (api#65).
+ *
+ * The API puts an application's own settings — `biasDecimals`, `countries` —
+ * into the JWT alongside `allowedDomain` and `allowedResources`, so this
+ * library can stop hard-coding values it has no other way of knowing.
+ *
+ * DELIBERATELY UNVERIFIED, and that is safe. This library has no signing key
+ * and does not need one: every claim here is re-read from the application row
+ * by the API on each request, and the API's answer is the one that counts. A
+ * forged token would fail at the authorizer long before any of this mattered.
+ * What is read here only decides how the request is SHAPED — a hint, never a
+ * permission.
+ *
+ * A JWT is signed, not encrypted, so the payload is plain base64url. Nothing
+ * secret is in it; these are the caller's own settings.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readAppConfigClaims = readAppConfigClaims;
+/**
+ * Decode a JWT payload without verifying it.
+ *
+ * Returns `{}` for anything unparseable. This runs on every request, so a
+ * surprising token must degrade to "no claims" rather than break geocoding
+ * for an application that is otherwise working.
+ */
+function readAppConfigClaims(token) {
+    if (typeof token !== 'string')
+        return {};
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        return {};
+    try {
+        // base64url -> base64: JWT omits padding and swaps two characters.
+        const b64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+        const padded = b64.padEnd(b64.length + ((4 - (b64.length % 4)) % 4), '=');
+        // `atob` exists in browsers and in Node 16+, so one path serves both.
+        const json = decodeURIComponent(Array.from(atob(padded), (c) => `%${c.charCodeAt(0).toString(16).padStart(2, '0')}`).join(''));
+        const payload = JSON.parse(json);
+        const claims = {};
+        if (typeof payload.biasDecimals === 'number') {
+            claims.biasDecimals = payload.biasDecimals;
+        }
+        else if (typeof payload.biasDecimals === 'string' &&
+            payload.biasDecimals.trim() !== '') {
+            const n = Number(payload.biasDecimals);
+            if (Number.isFinite(n))
+                claims.biasDecimals = n;
+        }
+        if (Array.isArray(payload.countries)) {
+            const list = payload.countries.filter((c) => typeof c === 'string');
+            if (list.length)
+                claims.countries = list;
+        }
+        return claims;
+    }
+    catch {
+        return {};
+    }
+}

package/dist/client/GeoPlacesClient.d.ts

@@ -1,6 +1,6 @@
-import type { RequestOptions } from '../transport/http';
-import type { ClientConfig } from '../types';
-import type { AppConfigClaims } from '../utils/tokenClaims';
+import type { RequestOptions } from '../transport/http.js';
+import type { ClientConfig } from '../types/index.js';
+import type { AppConfigClaims } from '../utils/tokenClaims.js';
 export type SendOptions = RequestOptions;
 /**
  * GeoPlacesClient — AWS Location Service compatible client with custom auth.
@@ -31,9 +31,12 @@ export declare class GeoPlacesClient {
      * case until one is configured in the portal.
      */
     getAppConfig(): AppConfigClaims;
+    /** Prefer the getToken callback (live ref) over a static token string. */
+    private currentToken;
     /**
      * @param options `signal` to cancel, `timeoutMs` per attempt, `retry: false`
      *   to disable the retry loop. Every failure throws LocationServiceException.
      */
     send<TInput, TOutput>(command: TInput, options?: SendOptions): Promise<TOutput>;
+    private dispatch;
 }

package/dist/client/GeoPlacesClient.js

@@ -1,8 +1,9 @@
 import debug from 'debug';
-import { resolveEndpoint } from '../transport/endpoints';
-import { requestJson } from '../transport/http';
-import { roundPositionFields } from '../utils/roundPosition';
-import { readAppConfigClaims } from '../utils/tokenClaims';
+import { resolveEndpoint } from '../transport/endpoints.js';
+import { isTokenRejected } from '../transport/errors.js';
+import { requestJson } from '../transport/http.js';
+import { roundPositionFields } from '../utils/roundPosition.js';
+import { readAppConfigClaims } from '../utils/tokenClaims.js';
 const log = debug('location-client:api');
 /**
  * GeoPlacesClient — AWS Location Service compatible client with custom auth.
@@ -32,8 +33,11 @@ export class GeoPlacesClient {
      * case until one is configured in the portal.
      */
     getAppConfig() {
-        const token = this.clientConfig.getToken?.() ?? this.clientConfig.token;
-        return readAppConfigClaims(token);
+        return readAppConfigClaims(this.currentToken());
+    }
+    /** Prefer the getToken callback (live ref) over a static token string. */
+    currentToken() {
+        return this.clientConfig.getToken?.() ?? this.clientConfig.token;
     }
     /**
      * @param options `signal` to cancel, `timeoutMs` per attempt, `retry: false`
@@ -41,15 +45,35 @@ export class GeoPlacesClient {
      */
     async send(command, options) {
         const cmd = command;
-        const endpoint = resolveEndpoint(cmd);
-        // Prefer the getToken callback (live ref) over a static token string.
-        const token = this.clientConfig.getToken?.() ?? this.clientConfig.token;
+        const url = `${this.clientConfig.apiUrl}${resolveEndpoint(cmd)}`;
+        const token = this.currentToken();
+        try {
+            return await this.dispatch(url, token, cmd, options);
+        }
+        catch (err) {
+            if (!isTokenRejected(err))
+                throw err;
+            // One shot. `refreshToken` is the only way to actually obtain a new
+            // token here — `getToken` is synchronous and returns the one already in
+            // hand — but it is re-read as a fallback because a provider that
+            // refreshes in the background may have landed a new one while this
+            // request was in flight.
+            const fresh = (await this.clientConfig.refreshToken?.()) ?? this.currentToken();
+            // Nothing new to send. Repeating the request would fail identically, and
+            // be billed identically.
+            if (!fresh || fresh === token)
+                throw err;
+            log('401 — retrying %s once with a refreshed token', cmd.constructor?.name);
+            return await this.dispatch(url, fresh, cmd, options);
+        }
+    }
+    dispatch(url, token, cmd, options) {
         // Resolve the token BEFORE rounding: the precision this application is
         // entitled to is a claim on it (api#65). Absent claim -> the 3 dp floor.
         const { biasDecimals } = readAppConfigClaims(token);
         const input = roundPositionFields(cmd.input, biasDecimals);
-        log('Sending %s to %s', cmd.constructor?.name, endpoint);
-        return requestJson(`${this.clientConfig.apiUrl}${endpoint}`, {
+        log('Sending %s to %s', cmd.constructor?.name, url);
+        return requestJson(url, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',

package/dist/index.d.ts

@@ -1,24 +1,24 @@
-export { GeoPlacesClient } from './client/GeoPlacesClient';
-export type { SendOptions } from './client/GeoPlacesClient';
-export { DEFAULT_MAX_ATTEMPTS, DEFAULT_TIMEOUT_MS } from './transport/http';
-export type { RequestOptions } from './transport/http';
-export { TOKEN_REFRESH_BUFFER_SECONDS, readTokenExpiry, } from './auth/tokenRefresh';
-export { LocationServiceException } from './errors/LocationServiceException';
-export type { LocationServiceExceptionOptions } from './errors/LocationServiceException';
+export { GeoPlacesClient } from './client/GeoPlacesClient.js';
+export type { SendOptions } from './client/GeoPlacesClient.js';
+export { DEFAULT_MAX_ATTEMPTS, DEFAULT_TIMEOUT_MS } from './transport/http.js';
+export type { RequestOptions } from './transport/http.js';
+export { TOKEN_REFRESH_BUFFER_SECONDS, readTokenExpiry, } from './auth/tokenRefresh.js';
+export { LocationServiceException } from './errors/LocationServiceException.js';
+export type { LocationServiceExceptionOptions } from './errors/LocationServiceException.js';
 export * from '@aws-sdk/client-geo-places';
 export * from '@aws/amazon-location-utilities-datatypes';
-export { GeoPlaces } from './adapters/GeoPlaces';
-export type { GeoPlacesDetailOptions, GeoPlacesOptions, } from './adapters/GeoPlaces';
-export { createTransformRequest } from './maps/createTransformRequest';
-export { applyMapLanguage } from './maps/mapLanguage';
-export { POI_CATEGORIES, setAllPoiVisibility, setPoiVisibility, } from './maps/mapPoi';
-export type { PoiCategory } from './maps/mapPoi';
-export { buildMapStyleUrl, fetchMapStyle } from './maps/mapStyle';
-export type { MapStyleOptions } from './maps/mapStyle';
-export { buildStaticMapUrl, fetchStaticMap, staticMapAccept, } from './maps/staticMap';
-export type { StaticMapFileName, StaticMapOptions } from './maps/staticMap';
-export { BUILDINGS, COLOR_SCHEMES, CONTOUR_DENSITIES, LABEL_SIZES, MAP_FEATURE_MODES, MAP_STYLES, SCALE_BAR_UNITS, SPRITE_VARIANTS, STATIC_MAP_STYLES, TERRAINS, TRAFFIC_MODES, TRAVEL_MODES, } from './maps/mapEnums';
-export type { Buildings, ColorScheme, ContourDensity, LabelSize, MapFeatureMode, MapStyle, ScaleBarUnit, SpriteVariant, StaticMapStyle, Terrain, TrafficMode, TravelMode, } from './maps/mapEnums';
-export { transformRequest } from './maps/Utils';
-export type { ClientConfig, GeoPlacesCommand, MapLike } from './types';
-export type { AppConfigClaims } from './utils/tokenClaims';
+export { GeoPlaces } from './adapters/GeoPlaces.js';
+export type { GeoPlacesDetailOptions, GeoPlacesOptions, } from './adapters/GeoPlaces.js';
+export { createTransformRequest } from './maps/createTransformRequest.js';
+export { applyMapLanguage } from './maps/mapLanguage.js';
+export { POI_CATEGORIES, setAllPoiVisibility, setPoiVisibility, } from './maps/mapPoi.js';
+export type { PoiCategory } from './maps/mapPoi.js';
+export { buildMapStyleUrl, fetchMapStyle } from './maps/mapStyle.js';
+export type { MapStyleOptions } from './maps/mapStyle.js';
+export { buildStaticMapUrl, fetchStaticMap, staticMapAccept, } from './maps/staticMap.js';
+export type { StaticMapFileName, StaticMapOptions } from './maps/staticMap.js';
+export { BUILDINGS, COLOR_SCHEMES, CONTOUR_DENSITIES, LABEL_SIZES, MAP_FEATURE_MODES, MAP_STYLES, SCALE_BAR_UNITS, SPRITE_VARIANTS, STATIC_MAP_STYLES, TERRAINS, TRAFFIC_MODES, TRAVEL_MODES, } from './maps/mapEnums.js';
+export type { Buildings, ColorScheme, ContourDensity, LabelSize, MapFeatureMode, MapStyle, ScaleBarUnit, SpriteVariant, StaticMapStyle, Terrain, TrafficMode, TravelMode, } from './maps/mapEnums.js';
+export { transformRequest } from './maps/Utils.js';
+export type { ClientConfig, GeoPlacesCommand, MapLike } from './types/index.js';
+export type { AppConfigClaims } from './utils/tokenClaims.js';

package/dist/index.js

@@ -1,25 +1,25 @@
 // Client (Custom - uses our auth instead of AWS SigV4)
-export { GeoPlacesClient } from './client/GeoPlacesClient';
+export { GeoPlacesClient } from './client/GeoPlacesClient.js';
 // Transport options — cancellation, per-attempt timeout, retry policy
-export { DEFAULT_MAX_ATTEMPTS, DEFAULT_TIMEOUT_MS } from './transport/http';
+export { DEFAULT_MAX_ATTEMPTS, DEFAULT_TIMEOUT_MS } from './transport/http.js';
 // Token refresh policy — shared by the server provider and the React provider
-export { TOKEN_REFRESH_BUFFER_SECONDS, readTokenExpiry, } from './auth/tokenRefresh';
+export { TOKEN_REFRESH_BUFFER_SECONDS, readTokenExpiry, } from './auth/tokenRefresh.js';
 // Errors
-export { LocationServiceException } from './errors/LocationServiceException';
+export { LocationServiceException } from './errors/LocationServiceException.js';
 // Re-export AWS SDK commands and types
 export * from '@aws-sdk/client-geo-places';
 // Re-export AWS Location Utilities (data type conversions)
 export * from '@aws/amazon-location-utilities-datatypes';
 // Adapters (Custom - for MapLibre integration)
-export { GeoPlaces } from './adapters/GeoPlaces';
+export { GeoPlaces } from './adapters/GeoPlaces.js';
 // Maps utilities
-export { createTransformRequest } from './maps/createTransformRequest';
-export { applyMapLanguage } from './maps/mapLanguage';
-export { POI_CATEGORIES, setAllPoiVisibility, setPoiVisibility, } from './maps/mapPoi';
-export { buildMapStyleUrl, fetchMapStyle } from './maps/mapStyle';
-export { buildStaticMapUrl, fetchStaticMap, staticMapAccept, } from './maps/staticMap';
+export { createTransformRequest } from './maps/createTransformRequest.js';
+export { applyMapLanguage } from './maps/mapLanguage.js';
+export { POI_CATEGORIES, setAllPoiVisibility, setPoiVisibility, } from './maps/mapPoi.js';
+export { buildMapStyleUrl, fetchMapStyle } from './maps/mapStyle.js';
+export { buildStaticMapUrl, fetchStaticMap, staticMapAccept, } from './maps/staticMap.js';
 // Accepted values for every map parameter, as VALUES so a picker can be built
 // from them, plus the matching types. Case sensitive — see mapEnums.ts.
-export { BUILDINGS, COLOR_SCHEMES, CONTOUR_DENSITIES, LABEL_SIZES, MAP_FEATURE_MODES, MAP_STYLES, SCALE_BAR_UNITS, SPRITE_VARIANTS, STATIC_MAP_STYLES, TERRAINS, TRAFFIC_MODES, TRAVEL_MODES, } from './maps/mapEnums';
-export { transformRequest } from './maps/Utils';
+export { BUILDINGS, COLOR_SCHEMES, CONTOUR_DENSITIES, LABEL_SIZES, MAP_FEATURE_MODES, MAP_STYLES, SCALE_BAR_UNITS, SPRITE_VARIANTS, STATIC_MAP_STYLES, TERRAINS, TRAFFIC_MODES, TRAVEL_MODES, } from './maps/mapEnums.js';
+export { transformRequest } from './maps/Utils.js';
 // Server-only utilities are available via '@chaosity/location-client/server'

package/dist/maps/Utils.d.ts

@@ -1,2 +1,2 @@
-import type { ClientConfig } from '../types';
+import type { ClientConfig } from '../types/index.js';
 export declare function transformRequest(url: string, config: ClientConfig): import("maplibre-gl").RequestParameters | Promise<import("maplibre-gl").RequestParameters> | undefined;

package/dist/maps/Utils.js

@@ -1,4 +1,4 @@
-import { createTransformRequest } from './createTransformRequest';
+import { createTransformRequest } from './createTransformRequest.js';
 export function transformRequest(url, config) {
     const token = config.getToken?.() ?? config.token;
     return createTransformRequest(config.apiUrl, () => token)(url);

package/dist/maps/createTransformRequest.d.ts

@@ -3,6 +3,8 @@ import type { RequestTransformFunction } from 'maplibre-gl';
  * Creates a transformRequest function for MapLibre that adds authentication
  * and proper Accept headers for AWS Location Service API requests.
  *
+ * The token is attached to our own API and nowhere else — see isOurApi.
+ *
  * @param apiUrl - Base URL of the Location Service API
  * @param getToken - Callback function that returns the current auth token
  * @returns MapLibre transformRequest function

package/dist/maps/createTransformRequest.js

@@ -1,14 +1,58 @@
+/**
+ * Does this URL belong to our API?
+ *
+ * This decides who receives the customer's bearer token, and it used to be
+ * `url.startsWith(apiUrl)` — a string test standing in for a URL test. For
+ * `apiUrl = "https://api.example.com"`, the host `api.example.com.evil.test`
+ * is a prefix match, so a style referencing
+ * `https://api.example.com.evil.test/tiles/1/2/3` was handed
+ * `Authorization: Bearer <token>` and the token left the building (#34).
+ *
+ * That is reachable because a style descriptor is DATA: its `sprite`, `glyphs`
+ * and `sources` entries are URLs the style author chose, and MapLibre asks
+ * transformRequest about every one of them. Any style not wholly ours — a
+ * customer's own, or one edited through a tool — can name a host it likes.
+ *
+ * Compared as URLs instead, which also gets host case-folding, default ports
+ * (`https://api.test:443` === `https://api.test`) and userinfo right for free,
+ * and adds a path check so a shared host serving another tenant under a
+ * different base path is not "ours" either.
+ *
+ * Fails CLOSED: anything that will not parse gets no token. The only way to
+ * reach that is a relative `apiUrl` in a runtime with no `location` to resolve
+ * it against — i.e. not a browser, which is the only place MapLibre runs.
+ */
+function isOurApi(url, apiUrl) {
+    const base = typeof location === 'undefined' ? undefined : location.href;
+    let ours;
+    let theirs;
+    try {
+        ours = new URL(apiUrl, base);
+        theirs = new URL(url, base);
+    }
+    catch {
+        return false;
+    }
+    if (theirs.origin !== ours.origin)
+        return false;
+    // Trailing slashes normalised so `/v1` and `/v1/` behave the same; the `/`
+    // boundary is what stops `/v1` from matching `/v1-internal`.
+    const basePath = ours.pathname.replace(/\/+$/, '');
+    return (theirs.pathname === basePath || theirs.pathname.startsWith(`${basePath}/`));
+}
 /**
  * Creates a transformRequest function for MapLibre that adds authentication
  * and proper Accept headers for AWS Location Service API requests.
  *
+ * The token is attached to our own API and nowhere else — see isOurApi.
+ *
  * @param apiUrl - Base URL of the Location Service API
  * @param getToken - Callback function that returns the current auth token
  * @returns MapLibre transformRequest function
  */
 export function createTransformRequest(apiUrl, getToken) {
     return (url, _resourceType) => {
-        if (url.startsWith(apiUrl)) {
+        if (isOurApi(url, apiUrl)) {
             const token = getToken();
             if (!token) {
                 console.warn('[createTransformRequest] No token available');

package/dist/maps/mapLanguage.d.ts

@@ -1,4 +1,4 @@
-import type { MapLike } from '../types';
+import type { MapLike } from '../types/index.js';
 /**
  * The `text-field` expression that prefers `language`, then English, then the
  * feature's default name.

package/dist/maps/mapStyle.d.ts

@@ -1,5 +1,5 @@
 import type { StyleSpecification } from 'maplibre-gl';
-import type { Buildings, ColorScheme, ContourDensity, MapStyle, Terrain, TrafficMode, TravelMode } from './mapEnums';
+import type { Buildings, ColorScheme, ContourDensity, MapStyle, Terrain, TrafficMode, TravelMode } from './mapEnums.js';
 /**
  * Options for building an AWS Location Service map style URL.
  * All parameters map directly to query parameters supported by the style descriptor endpoint.

package/dist/maps/mapStyle.js

@@ -1,5 +1,5 @@
-import { parseErrorResponse } from '../transport/errors';
-import { labelsByName, languageExpression } from './mapLanguage';
+import { parseErrorResponse } from '../transport/errors.js';
+import { labelsByName, languageExpression } from './mapLanguage.js';
 /**
  * Build a map style descriptor URL for the Location Service API.
  *

package/dist/maps/staticMap.d.ts

@@ -1,4 +1,4 @@
-import type { ColorScheme, LabelSize, MapFeatureMode, ScaleBarUnit, StaticMapStyle } from './mapEnums';
+import type { ColorScheme, LabelSize, MapFeatureMode, ScaleBarUnit, StaticMapStyle } from './mapEnums.js';
 /**
  * Static maps: build the URL, send the right headers, get a Blob.
  *

package/dist/maps/staticMap.js

@@ -1,4 +1,4 @@
-import { parseErrorResponse } from '../transport/errors';
+import { parseErrorResponse } from '../transport/errors.js';
 /**
  * The Accept header this request must send.
  *