@mapbox/mcp-server 0.12.5 → 0.12.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -5,10 +5,12 @@ import type { HttpRequest } from './types.js';
5
5
  *
6
6
  * Resolution order:
7
7
  * 1. If the access token is already a pk.* token, use it directly.
8
- * 2. Reuse a cached pk.* token while it has >5 min TTL remaining.
9
- * 3. If the access token is an sk.* token, call
8
+ * 2. Reuse a cached pk.* token (per-user) while it has >5 min TTL remaining.
9
+ * 3. If the access token is an sk.* or tk.* token, call
10
10
  * GET /tokens/v2/{user}?default=true to fetch the user's default public
11
- * token (requires `tokens:read` scope on the bearer).
11
+ * token (requires `tokens:read` scope on the bearer). OAuth-issued bearers
12
+ * are tk.* temporary tokens, so this is the path exercised in hosted
13
+ * (OAuth) deployments — without it, granting `tokens:read` has no effect.
12
14
  * 4. Fall back to the MAPBOX_PUBLIC_TOKEN env var.
13
15
  *
14
16
  * Returns undefined if none of the above produces a pk.* token.
@@ -19,7 +21,7 @@ export declare function resolveMapboxPublicToken(params: {
19
21
  httpRequest: HttpRequest;
20
22
  }): Promise<string | undefined>;
21
23
  /**
22
- * Reset the cached public token. For tests only.
24
+ * Reset the cached public token(s). For tests only.
23
25
  */
24
26
  export declare function __resetMapboxPublicTokenCache(): void;
25
27
  //# sourceMappingURL=mapboxPublicToken.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"mapboxPublicToken.d.ts","sourceRoot":"","sources":["../../../src/utils/mapboxPublicToken.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAgB9C;;;;;;;;;;;;;GAaG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,WAAW,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkD9B;AAED;;GAEG;AACH,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}
1
+ {"version":3,"file":"mapboxPublicToken.d.ts","sourceRoot":"","sources":["../../../src/utils/mapboxPublicToken.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAmB9C;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,WAAW,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA2D9B;AAED;;GAEG;AACH,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}
@@ -6,17 +6,21 @@ exports.resolveMapboxPublicToken = resolveMapboxPublicToken;
6
6
  exports.__resetMapboxPublicTokenCache = __resetMapboxPublicTokenCache;
7
7
  const jwtUtils_js_1 = require("./jwtUtils.js");
8
8
  const PUBLIC_TOKEN_TTL_MS = 60 * 60 * 1000; // 1h
9
- let cachedPublicToken = null;
9
+ // Keyed by username so that concurrent requests from different accounts
10
+ // never share each other's cached pk.* token.
11
+ const publicTokenCache = new Map();
10
12
  /**
11
13
  * Resolve a public (pk.*) Mapbox token suitable for embedding in client-side
12
14
  * HTML (e.g. an MCP App iframe that initializes Mapbox GL JS).
13
15
  *
14
16
  * Resolution order:
15
17
  * 1. If the access token is already a pk.* token, use it directly.
16
- * 2. Reuse a cached pk.* token while it has >5 min TTL remaining.
17
- * 3. If the access token is an sk.* token, call
18
+ * 2. Reuse a cached pk.* token (per-user) while it has >5 min TTL remaining.
19
+ * 3. If the access token is an sk.* or tk.* token, call
18
20
  * GET /tokens/v2/{user}?default=true to fetch the user's default public
19
- * token (requires `tokens:read` scope on the bearer).
21
+ * token (requires `tokens:read` scope on the bearer). OAuth-issued bearers
22
+ * are tk.* temporary tokens, so this is the path exercised in hosted
23
+ * (OAuth) deployments — without it, granting `tokens:read` has no effect.
20
24
  * 4. Fall back to the MAPBOX_PUBLIC_TOKEN env var.
21
25
  *
22
26
  * Returns undefined if none of the above produces a pk.* token.
@@ -26,13 +30,14 @@ async function resolveMapboxPublicToken(params) {
26
30
  if (accessToken.startsWith('pk.')) {
27
31
  return accessToken;
28
32
  }
29
- const now = Date.now();
30
- if (cachedPublicToken && cachedPublicToken.expiresAt - now > 5 * 60 * 1000) {
31
- return cachedPublicToken.token;
32
- }
33
- if (accessToken.startsWith('sk.')) {
33
+ if (accessToken.startsWith('sk.') || accessToken.startsWith('tk.')) {
34
34
  const username = (0, jwtUtils_js_1.getUserNameFromToken)(accessToken);
35
35
  if (username) {
36
+ const now = Date.now();
37
+ const cached = publicTokenCache.get(username);
38
+ if (cached && cached.expiresAt - now > 5 * 60 * 1000) {
39
+ return cached.token;
40
+ }
36
41
  try {
37
42
  const tokensUrl = new URL(`${apiEndpoint}tokens/v2/${username}`);
38
43
  tokensUrl.searchParams.set('default', 'true');
@@ -45,13 +50,20 @@ async function resolveMapboxPublicToken(params) {
45
50
  : (body?.tokens ?? []);
46
51
  const defaultPk = entries.find((entry) => entry?.usage === 'pk' && typeof entry.token === 'string');
47
52
  if (defaultPk?.token) {
48
- cachedPublicToken = {
53
+ publicTokenCache.set(username, {
49
54
  token: defaultPk.token,
50
55
  expiresAt: now + PUBLIC_TOKEN_TTL_MS
51
- };
56
+ });
52
57
  return defaultPk.token;
53
58
  }
54
59
  }
60
+ else if (response.status === 401 || response.status === 403) {
61
+ // Expected when the bearer lacks the `tokens:read` scope — not an
62
+ // anomaly, so don't warn-log on every such request.
63
+ }
64
+ else {
65
+ console.warn(`resolveMapboxPublicToken: Tokens API returned unexpected HTTP ${response.status}; falling back to MAPBOX_PUBLIC_TOKEN env var`);
66
+ }
55
67
  }
56
68
  catch (err) {
57
69
  // Network failures and JSON parse errors land here. Surface a warning
@@ -65,9 +77,9 @@ async function resolveMapboxPublicToken(params) {
65
77
  return envFallback && envFallback.startsWith('pk.') ? envFallback : undefined;
66
78
  }
67
79
  /**
68
- * Reset the cached public token. For tests only.
80
+ * Reset the cached public token(s). For tests only.
69
81
  */
70
82
  function __resetMapboxPublicTokenCache() {
71
- cachedPublicToken = null;
83
+ publicTokenCache.clear();
72
84
  }
73
85
  //# sourceMappingURL=mapboxPublicToken.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"mapboxPublicToken.js","sourceRoot":"","sources":["../../../src/utils/mapboxPublicToken.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;AAiClC,4DAsDC;AAKD,sEAEC;AA5FD,+CAAqD;AAcrD,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK;AACjD,IAAI,iBAAiB,GAAuB,IAAI,CAAC;AAEjD;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,wBAAwB,CAAC,MAI9C;IACC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAEzD,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,SAAS,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAC3E,OAAO,iBAAiB,CAAC,KAAK,CAAC;IACjC,CAAC;IAED,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAA,kCAAoB,EAAC,WAAW,CAAC,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,WAAW,aAAa,QAAQ,EAAE,CAAC,CAAC;gBACjE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBAC9C,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;gBAExD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACzD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAChB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;oBAChD,MAAM,OAAO,GAAqB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;wBACnD,CAAC,CAAE,IAAyB;wBAC5B,CAAC,CAAC,CAAE,IAAsC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;oBAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAC5B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CACpE,CAAC;oBACF,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;wBACrB,iBAAiB,GAAG;4BAClB,KAAK,EAAE,SAAS,CAAC,KAAK;4BACtB,SAAS,EAAE,GAAG,GAAG,mBAAmB;yBACrC,CAAC;wBACF,OAAO,SAAS,CAAC,KAAK,CAAC;oBACzB,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sEAAsE;gBACtE,sEAAsE;gBACtE,iCAAiC;gBACjC,OAAO,CAAC,IAAI,CACV,kGAAkG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACrJ,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACpD,OAAO,WAAW,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED;;GAEG;AACH,SAAgB,6BAA6B;IAC3C,iBAAiB,GAAG,IAAI,CAAC;AAC3B,CAAC"}
1
+ {"version":3,"file":"mapboxPublicToken.js","sourceRoot":"","sources":["../../../src/utils/mapboxPublicToken.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;AAsClC,4DA+DC;AAKD,sEAEC;AA1GD,+CAAqD;AAcrD,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK;AAEjD,wEAAwE;AACxE,8CAA8C;AAC9C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,wBAAwB,CAAC,MAI9C;IACC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAEzD,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,IAAA,kCAAoB,EAAC,WAAW,CAAC,CAAC;QAEnD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBACrD,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,WAAW,aAAa,QAAQ,EAAE,CAAC,CAAC;gBACjE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBAC9C,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;gBAExD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACzD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAChB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;oBAChD,MAAM,OAAO,GAAqB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;wBACnD,CAAC,CAAE,IAAyB;wBAC5B,CAAC,CAAC,CAAE,IAAsC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;oBAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAC5B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CACpE,CAAC;oBACF,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;wBACrB,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE;4BAC7B,KAAK,EAAE,SAAS,CAAC,KAAK;4BACtB,SAAS,EAAE,GAAG,GAAG,mBAAmB;yBACrC,CAAC,CAAC;wBACH,OAAO,SAAS,CAAC,KAAK,CAAC;oBACzB,CAAC;gBACH,CAAC;qBAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC9D,kEAAkE;oBAClE,oDAAoD;gBACtD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CACV,iEAAiE,QAAQ,CAAC,MAAM,+CAA+C,CAChI,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sEAAsE;gBACtE,sEAAsE;gBACtE,iCAAiC;gBACjC,OAAO,CAAC,IAAI,CACV,kGAAkG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACrJ,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACpD,OAAO,WAAW,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED;;GAEG;AACH,SAAgB,6BAA6B;IAC3C,gBAAgB,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC"}
@@ -1,6 +1,6 @@
1
1
  {
2
- "sha": "ceb53a6704aa12985d342ffecd416f6b2baefd07",
3
- "tag": "v0.12.4-1-gceb53a6",
2
+ "sha": "cd734202906bbfb6fc9138476bbbb2b2403fc997",
3
+ "tag": "v0.12.5-2-gcd73420",
4
4
  "branch": "HEAD",
5
- "version": "0.12.5"
5
+ "version": "0.12.6"
6
6
  }
@@ -5,10 +5,12 @@ import type { HttpRequest } from './types.js';
5
5
  *
6
6
  * Resolution order:
7
7
  * 1. If the access token is already a pk.* token, use it directly.
8
- * 2. Reuse a cached pk.* token while it has >5 min TTL remaining.
9
- * 3. If the access token is an sk.* token, call
8
+ * 2. Reuse a cached pk.* token (per-user) while it has >5 min TTL remaining.
9
+ * 3. If the access token is an sk.* or tk.* token, call
10
10
  * GET /tokens/v2/{user}?default=true to fetch the user's default public
11
- * token (requires `tokens:read` scope on the bearer).
11
+ * token (requires `tokens:read` scope on the bearer). OAuth-issued bearers
12
+ * are tk.* temporary tokens, so this is the path exercised in hosted
13
+ * (OAuth) deployments — without it, granting `tokens:read` has no effect.
12
14
  * 4. Fall back to the MAPBOX_PUBLIC_TOKEN env var.
13
15
  *
14
16
  * Returns undefined if none of the above produces a pk.* token.
@@ -19,7 +21,7 @@ export declare function resolveMapboxPublicToken(params: {
19
21
  httpRequest: HttpRequest;
20
22
  }): Promise<string | undefined>;
21
23
  /**
22
- * Reset the cached public token. For tests only.
24
+ * Reset the cached public token(s). For tests only.
23
25
  */
24
26
  export declare function __resetMapboxPublicTokenCache(): void;
25
27
  //# sourceMappingURL=mapboxPublicToken.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"mapboxPublicToken.d.ts","sourceRoot":"","sources":["../../../src/utils/mapboxPublicToken.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAgB9C;;;;;;;;;;;;;GAaG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,WAAW,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkD9B;AAED;;GAEG;AACH,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}
1
+ {"version":3,"file":"mapboxPublicToken.d.ts","sourceRoot":"","sources":["../../../src/utils/mapboxPublicToken.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAmB9C;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,WAAW,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA2D9B;AAED;;GAEG;AACH,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}
@@ -2,17 +2,21 @@
2
2
  // Licensed under the MIT License.
3
3
  import { getUserNameFromToken } from './jwtUtils.js';
4
4
  const PUBLIC_TOKEN_TTL_MS = 60 * 60 * 1000; // 1h
5
- let cachedPublicToken = null;
5
+ // Keyed by username so that concurrent requests from different accounts
6
+ // never share each other's cached pk.* token.
7
+ const publicTokenCache = new Map();
6
8
  /**
7
9
  * Resolve a public (pk.*) Mapbox token suitable for embedding in client-side
8
10
  * HTML (e.g. an MCP App iframe that initializes Mapbox GL JS).
9
11
  *
10
12
  * Resolution order:
11
13
  * 1. If the access token is already a pk.* token, use it directly.
12
- * 2. Reuse a cached pk.* token while it has >5 min TTL remaining.
13
- * 3. If the access token is an sk.* token, call
14
+ * 2. Reuse a cached pk.* token (per-user) while it has >5 min TTL remaining.
15
+ * 3. If the access token is an sk.* or tk.* token, call
14
16
  * GET /tokens/v2/{user}?default=true to fetch the user's default public
15
- * token (requires `tokens:read` scope on the bearer).
17
+ * token (requires `tokens:read` scope on the bearer). OAuth-issued bearers
18
+ * are tk.* temporary tokens, so this is the path exercised in hosted
19
+ * (OAuth) deployments — without it, granting `tokens:read` has no effect.
16
20
  * 4. Fall back to the MAPBOX_PUBLIC_TOKEN env var.
17
21
  *
18
22
  * Returns undefined if none of the above produces a pk.* token.
@@ -22,13 +26,14 @@ export async function resolveMapboxPublicToken(params) {
22
26
  if (accessToken.startsWith('pk.')) {
23
27
  return accessToken;
24
28
  }
25
- const now = Date.now();
26
- if (cachedPublicToken && cachedPublicToken.expiresAt - now > 5 * 60 * 1000) {
27
- return cachedPublicToken.token;
28
- }
29
- if (accessToken.startsWith('sk.')) {
29
+ if (accessToken.startsWith('sk.') || accessToken.startsWith('tk.')) {
30
30
  const username = getUserNameFromToken(accessToken);
31
31
  if (username) {
32
+ const now = Date.now();
33
+ const cached = publicTokenCache.get(username);
34
+ if (cached && cached.expiresAt - now > 5 * 60 * 1000) {
35
+ return cached.token;
36
+ }
32
37
  try {
33
38
  const tokensUrl = new URL(`${apiEndpoint}tokens/v2/${username}`);
34
39
  tokensUrl.searchParams.set('default', 'true');
@@ -41,13 +46,20 @@ export async function resolveMapboxPublicToken(params) {
41
46
  : (body?.tokens ?? []);
42
47
  const defaultPk = entries.find((entry) => entry?.usage === 'pk' && typeof entry.token === 'string');
43
48
  if (defaultPk?.token) {
44
- cachedPublicToken = {
49
+ publicTokenCache.set(username, {
45
50
  token: defaultPk.token,
46
51
  expiresAt: now + PUBLIC_TOKEN_TTL_MS
47
- };
52
+ });
48
53
  return defaultPk.token;
49
54
  }
50
55
  }
56
+ else if (response.status === 401 || response.status === 403) {
57
+ // Expected when the bearer lacks the `tokens:read` scope — not an
58
+ // anomaly, so don't warn-log on every such request.
59
+ }
60
+ else {
61
+ console.warn(`resolveMapboxPublicToken: Tokens API returned unexpected HTTP ${response.status}; falling back to MAPBOX_PUBLIC_TOKEN env var`);
62
+ }
51
63
  }
52
64
  catch (err) {
53
65
  // Network failures and JSON parse errors land here. Surface a warning
@@ -61,9 +73,9 @@ export async function resolveMapboxPublicToken(params) {
61
73
  return envFallback && envFallback.startsWith('pk.') ? envFallback : undefined;
62
74
  }
63
75
  /**
64
- * Reset the cached public token. For tests only.
76
+ * Reset the cached public token(s). For tests only.
65
77
  */
66
78
  export function __resetMapboxPublicTokenCache() {
67
- cachedPublicToken = null;
79
+ publicTokenCache.clear();
68
80
  }
69
81
  //# sourceMappingURL=mapboxPublicToken.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"mapboxPublicToken.js","sourceRoot":"","sources":["../../../src/utils/mapboxPublicToken.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAElC,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAcrD,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK;AACjD,IAAI,iBAAiB,GAAuB,IAAI,CAAC;AAEjD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAI9C;IACC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAEzD,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,SAAS,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAC3E,OAAO,iBAAiB,CAAC,KAAK,CAAC;IACjC,CAAC;IAED,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,WAAW,aAAa,QAAQ,EAAE,CAAC,CAAC;gBACjE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBAC9C,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;gBAExD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACzD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAChB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;oBAChD,MAAM,OAAO,GAAqB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;wBACnD,CAAC,CAAE,IAAyB;wBAC5B,CAAC,CAAC,CAAE,IAAsC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;oBAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAC5B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CACpE,CAAC;oBACF,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;wBACrB,iBAAiB,GAAG;4BAClB,KAAK,EAAE,SAAS,CAAC,KAAK;4BACtB,SAAS,EAAE,GAAG,GAAG,mBAAmB;yBACrC,CAAC;wBACF,OAAO,SAAS,CAAC,KAAK,CAAC;oBACzB,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sEAAsE;gBACtE,sEAAsE;gBACtE,iCAAiC;gBACjC,OAAO,CAAC,IAAI,CACV,kGAAkG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACrJ,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACpD,OAAO,WAAW,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,6BAA6B;IAC3C,iBAAiB,GAAG,IAAI,CAAC;AAC3B,CAAC"}
1
+ {"version":3,"file":"mapboxPublicToken.js","sourceRoot":"","sources":["../../../src/utils/mapboxPublicToken.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAElC,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAcrD,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK;AAEjD,wEAAwE;AACxE,8CAA8C;AAC9C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAI9C;IACC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAEzD,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAEnD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBACrD,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,WAAW,aAAa,QAAQ,EAAE,CAAC,CAAC;gBACjE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBAC9C,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;gBAExD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACzD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAChB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;oBAChD,MAAM,OAAO,GAAqB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;wBACnD,CAAC,CAAE,IAAyB;wBAC5B,CAAC,CAAC,CAAE,IAAsC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;oBAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAC5B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CACpE,CAAC;oBACF,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;wBACrB,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE;4BAC7B,KAAK,EAAE,SAAS,CAAC,KAAK;4BACtB,SAAS,EAAE,GAAG,GAAG,mBAAmB;yBACrC,CAAC,CAAC;wBACH,OAAO,SAAS,CAAC,KAAK,CAAC;oBACzB,CAAC;gBACH,CAAC;qBAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC9D,kEAAkE;oBAClE,oDAAoD;gBACtD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CACV,iEAAiE,QAAQ,CAAC,MAAM,+CAA+C,CAChI,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sEAAsE;gBACtE,sEAAsE;gBACtE,iCAAiC;gBACjC,OAAO,CAAC,IAAI,CACV,kGAAkG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACrJ,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACpD,OAAO,WAAW,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,6BAA6B;IAC3C,gBAAgB,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC"}
@@ -1,6 +1,6 @@
1
1
  {
2
- "sha": "ceb53a6704aa12985d342ffecd416f6b2baefd07",
3
- "tag": "v0.12.4-1-gceb53a6",
2
+ "sha": "cd734202906bbfb6fc9138476bbbb2b2403fc997",
3
+ "tag": "v0.12.5-2-gcd73420",
4
4
  "branch": "HEAD",
5
- "version": "0.12.5"
5
+ "version": "0.12.6"
6
6
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@mapbox/mcp-server",
3
- "version": "0.12.5",
3
+ "version": "0.12.6",
4
4
  "description": "Mapbox MCP server.",
5
5
  "mcpName": "io.github.mapbox/mcp-server",
6
6
  "main": "./dist/commonjs/index.js",