@mapbox/mcp-server 0.13.0 → 0.14.0

package/dist/commonjs/utils/urlSafety.d.ts

@@ -6,14 +6,30 @@
  * Rejects:
  *  - non-http(s) schemes (e.g. file:, gopher:, data:, javascript:)
  *  - non-https URLs (markers should always be fetched over TLS)
- *  - URLs whose host is an IP literal in a loopback, private, link-local,
- *    unique-local, or otherwise non-routable range (CWE-918 SSRF)
- *  - URLs whose host is a well-known local hostname
+ *  - IPv4/IPv6 literals outside ipaddr.js's plain "unicast" range —
+ *    deny-by-default, so loopback, private, link-local, multicast,
+ *    broadcast, CGNAT, reserved, and every IPv4-in-IPv6 transition/
+ *    translation mechanism (mapped, compatible, 6to4, NAT64, SIIT, Teredo,
+ *    AMT, ORCHID, etc.) are all rejected without needing to be named
+ *    individually (CWE-918 SSRF)
+ *  - well-known local hostnames, reserved local/internal-use suffixes
+ *    (.internal, .local, .arpa), and dotless single-label hostnames
  *
- * Note: we do not perform DNS resolution here — the upstream service will
- * still resolve the hostname when fetching. This validation is a defense in
- * depth against the most common SSRF vectors that prompt-injected agents
- * tend to produce (IP literals and "localhost").
+ * Out of scope, by design, for this pre-fetch string check — all three
+ * require validating the actual connection, not the URL string, so they
+ * belong where the fetch happens, not here:
+ *  - DNS rebinding (an ordinary hostname resolving to an internal address
+ *    at fetch time)
+ *  - port restriction
+ *  - network-specific hostname suffixes (.corp, .lan, .home, etc.) —
+ *    unlike .internal/.local/.arpa, these aren't globally reserved, so
+ *    they can't be enumerated in general
  */
 export declare function isSafeExternalUrl(rawUrl: string): boolean;
+/**
+ * Same validation as isSafeExternalUrl, but returns the parsed URL on
+ * success (null otherwise) so callers that need the WHATWG-canonical form
+ * of the validated URL don't have to re-parse the raw string.
+ */
+export declare function parseSafeExternalUrl(rawUrl: string): URL | null;
 //# sourceMappingURL=urlSafety.d.ts.map

package/dist/commonjs/utils/urlSafety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"urlSafety.d.ts","sourceRoot":"","sources":["../../../src/utils/urlSafety.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CA0EzD"}
+{"version":3,"file":"urlSafety.d.ts","sourceRoot":"","sources":["../../../src/utils/urlSafety.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAoF/D"}

package/dist/commonjs/utils/urlSafety.js

@@ -1,8 +1,13 @@
 "use strict";
 // Copyright (c) Mapbox, Inc.
 // Licensed under the MIT License.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isSafeExternalUrl = isSafeExternalUrl;
+exports.parseSafeExternalUrl = parseSafeExternalUrl;
+const ipaddr_js_1 = __importDefault(require("ipaddr.js"));
 /**
  * Validates that a URL is safe for server-side fetching by an upstream service
  * (in particular, the Mapbox Static Images API which fetches custom marker
@@ -11,30 +16,55 @@ exports.isSafeExternalUrl = isSafeExternalUrl;
  * Rejects:
  *  - non-http(s) schemes (e.g. file:, gopher:, data:, javascript:)
  *  - non-https URLs (markers should always be fetched over TLS)
- *  - URLs whose host is an IP literal in a loopback, private, link-local,
- *    unique-local, or otherwise non-routable range (CWE-918 SSRF)
- *  - URLs whose host is a well-known local hostname
+ *  - IPv4/IPv6 literals outside ipaddr.js's plain "unicast" range —
+ *    deny-by-default, so loopback, private, link-local, multicast,
+ *    broadcast, CGNAT, reserved, and every IPv4-in-IPv6 transition/
+ *    translation mechanism (mapped, compatible, 6to4, NAT64, SIIT, Teredo,
+ *    AMT, ORCHID, etc.) are all rejected without needing to be named
+ *    individually (CWE-918 SSRF)
+ *  - well-known local hostnames, reserved local/internal-use suffixes
+ *    (.internal, .local, .arpa), and dotless single-label hostnames
  *
- * Note: we do not perform DNS resolution here — the upstream service will
- * still resolve the hostname when fetching. This validation is a defense in
- * depth against the most common SSRF vectors that prompt-injected agents
- * tend to produce (IP literals and "localhost").
+ * Out of scope, by design, for this pre-fetch string check — all three
+ * require validating the actual connection, not the URL string, so they
+ * belong where the fetch happens, not here:
+ *  - DNS rebinding (an ordinary hostname resolving to an internal address
+ *    at fetch time)
+ *  - port restriction
+ *  - network-specific hostname suffixes (.corp, .lan, .home, etc.) —
+ *    unlike .internal/.local/.arpa, these aren't globally reserved, so
+ *    they can't be enumerated in general
  */
 function isSafeExternalUrl(rawUrl) {
+    return parseSafeExternalUrl(rawUrl) !== null;
+}
+/**
+ * Same validation as isSafeExternalUrl, but returns the parsed URL on
+ * success (null otherwise) so callers that need the WHATWG-canonical form
+ * of the validated URL don't have to re-parse the raw string.
+ */
+function parseSafeExternalUrl(rawUrl) {
     let parsed;
     try {
         parsed = new URL(rawUrl);
     }
     catch {
-        return false;
+        return null;
     }
     if (parsed.protocol !== 'https:') {
-        return false;
+        return null;
     }
-    // Strip optional surrounding brackets from IPv6 literals
-    const host = parsed.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    // Strip optional surrounding brackets from IPv6 literals and a trailing
+    // root-label dot (e.g. "localhost." is equivalent to "localhost"). The
+    // dotless-hostname check further below relies on this running first —
+    // without it, "intranet." would still contain a dot and slip past that
+    // check.
+    const host = parsed.hostname
+        .replace(/^\[|\]$/g, '')
+        .replace(/\.$/, '')
+        .toLowerCase();
     if (host.length === 0) {
-        return false;
+        return null;
     }
     // Block well-known local hostnames
     const blockedHostnames = new Set([
@@ -43,62 +73,50 @@ function isSafeExternalUrl(rawUrl) {
         'ip6-loopback',
         'broadcasthost'
     ]);
-    if (blockedHostnames.has(host) || host.endsWith('.localhost')) {
-        return false;
+    // Suffixes reserved for local/internal use that no public marker image
+    // host is ever legitimately under: cloud-internal DNS zones (.internal,
+    // used by GCP/AWS service discovery — covers metadata.google.internal,
+    // the GCP metadata endpoint's actual hostname), mDNS (.local), and
+    // reverse-DNS / home-network zones reserved by RFC 6761/8375 (.arpa
+    // covers .in-addr.arpa, .ip6.arpa, and .home.arpa as suffixes of it).
+    const blockedSuffixes = ['.localhost', '.internal', '.local', '.arpa'];
+    if (blockedHostnames.has(host) ||
+        blockedSuffixes.some((suffix) => host.endsWith(suffix))) {
+        return null;
     }
-    // IPv4 literal check (dotted quad)
-    const ipv4Match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
-    if (ipv4Match) {
-        const octets = ipv4Match.slice(1, 5).map((o) => Number(o));
-        if (octets.some((o) => o < 0 || o > 255)) {
-            return false;
-        }
-        const [a, b] = octets;
-        // 0.0.0.0/8, 10/8, 127/8
-        // 0.0.0.0/8 — "this network" (unspecified + reserved); block conservatively
-        if (a === 0 || a === 10 || a === 127)
-            return false;
-        // 169.254/16 (link-local, includes cloud metadata 169.254.169.254)
-        if (a === 169 && b === 254)
-            return false;
-        // 172.16/12
-        if (a === 172 && b >= 16 && b <= 31)
-            return false;
-        // 192.168/16
-        if (a === 192 && b === 168)
-            return false;
-        // 100.64/10 (CGNAT)
-        if (a === 100 && b >= 64 && b <= 127)
-            return false;
-        // 224/4 multicast and 240/4 reserved
-        if (a >= 224)
-            return false;
-        return true;
+    // If the host isn't a parseable IP literal at all, it's an ordinary
+    // hostname — allowed here (subject to the checks above), except that a
+    // public marker image host always has at least one dot; a dotless,
+    // single-label hostname only resolves via the fetcher's own network
+    // search-domain suffixing (e.g. "intranet", "metadata"), which is never
+    // the case for a legitimate external image URL. DNS rebinding on a
+    // multi-label hostname is out of scope for this pre-fetch check, see the
+    // module doc comment.
+    if (!ipaddr_js_1.default.isValid(host)) {
+        return host.includes('.') ? parsed : null;
+    }
+    const addr = ipaddr_js_1.default.parse(host);
+    // Deny by default for both IPv4 and IPv6: only plain global unicast
+    // addresses are allowed. Every other named range (private, loopback,
+    // link-local, multicast, broadcast, CGNAT, reserved, unique-local, and
+    // every IPv4-in-IPv6 transition/translation mechanism) is rejected,
+    // regardless of what it does or doesn't embed.
+    if (addr.range() !== 'unicast') {
+        return null;
     }
-    // IPv6 literal check (presence of ':' indicates IPv6 since IPv4 was handled)
-    if (host.includes(':')) {
-        // ::1 loopback, :: unspecified
-        if (host === '::1' || host === '::')
-            return false;
-        // fc00::/7 unique local (fc.. or fd..)
-        if (/^f[cd][0-9a-f]{2}:/.test(host))
-            return false;
-        // fe80::/10 link-local
-        if (/^fe[89ab][0-9a-f]:/.test(host))
-            return false;
-        // ff00::/8 multicast
-        if (/^ff[0-9a-f]{2}:/.test(host))
-            return false;
-        // IPv4-mapped / IPv4-compatible IPv6: ::ffff:a.b.c.d or ::a.b.c.d
-        // (Node's URL parser normalises ::ffff:127.0.0.1 to ::ffff:7f00:1, so
-        // detect the embedded IPv4 either as a dotted-quad or as the
-        // ::ffff:xxxx:xxxx hex form.)
-        if (/\d+\.\d+\.\d+\.\d+/.test(host))
-            return false;
-        if (/^::ffff:[0-9a-f]{1,4}:[0-9a-f]{1,4}$/.test(host))
-            return false;
-        return true;
+    if (addr.kind() === 'ipv6') {
+        // ipaddr.js does not classify the deprecated IPv4-compatible form
+        // (::a.b.c.d, i.e. the leading 96 bits all zero) as a special range
+        // when written in plain hex, which is exactly the form Node's URL
+        // parser normalises a dotted-quad IPv4-compatible literal to — so it
+        // reaches here as ordinary 'unicast' and needs an explicit check.
+        // (::1 and :: are already excluded above via the loopback/unspecified
+        // ranges, so this only affects addresses with a genuine embedded IPv4.)
+        const bytes = addr.toByteArray();
+        if (bytes.slice(0, 12).every((b) => b === 0)) {
+            return null;
+        }
     }
-    return true;
+    return parsed;
 }
 //# sourceMappingURL=urlSafety.js.map

package/dist/commonjs/utils/urlSafety.js.map

@@ -1 +1 @@
-{"version":3,"file":"urlSafety.js","sourceRoot":"","sources":["../../../src/utils/urlSafety.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;AAmBlC,8CA0EC;AA3FD;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,iBAAiB,CAAC,MAAc;IAC9C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,yDAAyD;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAEnE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mCAAmC;IACnC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;QAC/B,WAAW;QACX,eAAe;QACf,cAAc;QACd,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mCAAmC;IACnC,MAAM,SAAS,GAAG,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;QACtB,yBAAyB;QACzB,4EAA4E;QAC5E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACnD,mEAAmE;QACnE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACzC,YAAY;QACZ,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;QAClD,aAAa;QACb,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACzC,oBAAoB;QACpB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC;QACnD,qCAAqC;QACrC,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,+BAA+B;QAC/B,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAClD,uCAAuC;QACvC,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,uBAAuB;QACvB,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,qBAAqB;QACrB,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,kEAAkE;QAClE,sEAAsE;QACtE,6DAA6D;QAC7D,8BAA8B;QAC9B,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"urlSafety.js","sourceRoot":"","sources":["../../../src/utils/urlSafety.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;;;;AAgClC,8CAEC;AAOD,oDAoFC;AA3HD,0DAA+B;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,SAAgB,iBAAiB,CAAC,MAAc;IAC9C,OAAO,oBAAoB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,MAAc;IACjD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,SAAS;IACT,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ;SACzB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,WAAW,EAAE,CAAC;IAEjB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mCAAmC;IACnC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;QAC/B,WAAW;QACX,eAAe;QACf,cAAc;QACd,eAAe;KAChB,CAAC,CAAC;IACH,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,mEAAmE;IACnE,oEAAoE;IACpE,sEAAsE;IACtE,MAAM,eAAe,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvE,IACE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;QAC1B,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EACvD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,mEAAmE;IACnE,oEAAoE;IACpE,wEAAwE;IACxE,mEAAmE;IACnE,yEAAyE;IACzE,sBAAsB;IACtB,IAAI,CAAC,mBAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,GAAG,mBAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEhC,oEAAoE;IACpE,qEAAqE;IACrE,uEAAuE;IACvE,oEAAoE;IACpE,+CAA+C;IAC/C,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;QAC3B,kEAAkE;QAClE,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/commonjs/version.json

@@ -1,6 +1,6 @@
 {
-  "sha": "88ba37c5e1013138c5baea75c8db90e8ae8731b1",
-  "tag": "v0.12.7-4-g88ba37c",
+  "sha": "8d26d7636a30dd0355db18bb2c64f3bc7112b41c",
+  "tag": "v0.13.0-6-g8d26d76",
   "branch": "HEAD",
-  "version": "0.13.0"
+  "version": "0.14.0"
 }

package/dist/esm/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AAGA,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,iBAAiB;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAiCD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EAAE,EACd,WAAW,EAAE,cAAc,GAC1B,iBAAiB,CAsCnB"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AAGA,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,iBAAiB;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAoCD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EAAE,EACd,WAAW,EAAE,cAAc,GAC1B,iBAAiB,CAsCnB"}

package/dist/esm/cli.js

@@ -4,10 +4,13 @@ const OPTIONS = [
     '--help, -h           Show this help message',
     '--version, -v        Show the server version',
     '--enable-tools       Enable only the comma-separated tools',
-    '--disable-tools      Disable the comma-separated tools',
-    '--disable-mcp-ui     Disable MCP-UI resources'
+    '--disable-tools      Disable the comma-separated tools'
 ];
 const OPTIONS_WITH_VALUES = new Set(['--enable-tools', '--disable-tools']);
+// --disable-mcp-ui is no longer a real option (MCP-UI support was removed
+// entirely — see docs/mcp-ui.md) but stays recognized-and-ignored here, not
+// in OPTIONS, so an existing launch config that still passes it keeps
+// starting instead of hard-failing on "Unknown option".
 const KNOWN_FLAGS = new Set([
     '--help',
     '-h',

package/dist/esm/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAclC,MAAM,OAAO,GAAG;IACd,6CAA6C;IAC7C,8CAA8C;IAC9C,4DAA4D;IAC5D,wDAAwD;IACxD,+CAA+C;CAChD,CAAC;AAEF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAC3E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,QAAQ;IACR,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;CACnB,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,WAA2B;IAC7C,OAAO;QACL,GAAG,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,EAAE;QAC5C,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,UAAU;QACV,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;QACzC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,IAAc,EACd,WAA2B;IAE3B,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,GAAG,WAAW,CAAC,OAAO,IAAI;SACnC,CAAC;IACJ,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAEpB,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,CAAC;gBACX,KAAK,EAAE,mBAAmB,GAAG,IAAI;aAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,CAAC;KACZ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAclC,MAAM,OAAO,GAAG;IACd,6CAA6C;IAC7C,8CAA8C;IAC9C,4DAA4D;IAC5D,wDAAwD;CACzD,CAAC;AAEF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAC3E,0EAA0E;AAC1E,4EAA4E;AAC5E,sEAAsE;AACtE,wDAAwD;AACxD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,QAAQ;IACR,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;CACnB,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,WAA2B;IAC7C,OAAO;QACL,GAAG,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,EAAE;QAC5C,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,UAAU;QACV,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;QACzC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,IAAc,EACd,WAA2B;IAE3B,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,GAAG,WAAW,CAAC,OAAO,IAAI;SACnC,CAAC;IACJ,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAEpB,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,CAAC;gBACX,KAAK,EAAE,mBAAmB,GAAG,IAAI;aAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,CAAC;KACZ,CAAC;AACJ,CAAC"}

package/dist/esm/resources/resourceRegistry.d.ts

@@ -2,10 +2,9 @@ import { CategoryListResource } from './category-list/CategoryListResource.js';
 import { TemporaryDataResource } from './temporary/TemporaryDataResource.js';
 import { ComputeResource } from './compute/ComputeResource.js';
 import { InlinePayloadResource } from './inline-payload/InlinePayloadResource.js';
-import { StaticMapUIResource } from './ui-apps/StaticMapUIResource.js';
 import { MapAppUIResource } from './ui-apps/MapAppUIResource.js';
 import { VersionResource } from './version/VersionResource.js';
-export declare const ALL_RESOURCES: readonly [CategoryListResource, TemporaryDataResource, ComputeResource, InlinePayloadResource, StaticMapUIResource, MapAppUIResource, VersionResource];
+export declare const ALL_RESOURCES: readonly [CategoryListResource, TemporaryDataResource, ComputeResource, InlinePayloadResource, MapAppUIResource, VersionResource];
 export type ResourceInstance = (typeof ALL_RESOURCES)[number];
 export declare function getAllResources(): readonly ResourceInstance[];
 export declare function getResourceByUri(uri: string): ResourceInstance | undefined;

package/dist/esm/resources/resourceRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resourceRegistry.d.ts","sourceRoot":"","sources":["../../../src/resources/resourceRegistry.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAI/D,eAAO,MAAM,aAAa,wJAUhB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,wBAAgB,eAAe,IAAI,SAAS,gBAAgB,EAAE,CAE7D;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAkB1E"}
+{"version":3,"file":"resourceRegistry.d.ts","sourceRoot":"","sources":["../../../src/resources/resourceRegistry.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAI/D,eAAO,MAAM,aAAa,mIAShB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,wBAAgB,eAAe,IAAI,SAAS,gBAAgB,EAAE,CAE7D;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAkB1E"}

package/dist/esm/resources/resourceRegistry.js

@@ -5,7 +5,6 @@ import { CategoryListResource } from './category-list/CategoryListResource.js';
 import { TemporaryDataResource } from './temporary/TemporaryDataResource.js';
 import { ComputeResource } from './compute/ComputeResource.js';
 import { InlinePayloadResource } from './inline-payload/InlinePayloadResource.js';
-import { StaticMapUIResource } from './ui-apps/StaticMapUIResource.js';
 import { MapAppUIResource } from './ui-apps/MapAppUIResource.js';
 import { VersionResource } from './version/VersionResource.js';
 import { httpRequest } from '../utils/httpPipeline.js';
@@ -16,7 +15,6 @@ export const ALL_RESOURCES = [
     new TemporaryDataResource(),
     new ComputeResource(),
     new InlinePayloadResource(),
-    new StaticMapUIResource(),
     // Single shared map renderer, targeted exclusively by render_map_tool.
     new MapAppUIResource({ httpRequest }),
     new VersionResource()

package/dist/esm/resources/resourceRegistry.js.map

@@ -1 +1 @@
-{"version":3,"file":"resourceRegistry.js","sourceRoot":"","sources":["../../../src/resources/resourceRegistry.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAElC,kCAAkC;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,oCAAoC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,oCAAoC;IACpC,IAAI,oBAAoB,CAAC,EAAE,WAAW,EAAE,CAAC;IACzC,IAAI,qBAAqB,EAAE;IAC3B,IAAI,eAAe,EAAE;IACrB,IAAI,qBAAqB,EAAE;IAC3B,IAAI,mBAAmB,EAAE;IACzB,uEAAuE;IACvE,IAAI,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC;IACrC,IAAI,eAAe,EAAE;CACb,CAAC;AAIX,MAAM,UAAU,eAAe;IAC7B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,yBAAyB;IACzB,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC1E,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,gFAAgF;IAChF,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,iEAAiE;IACjE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACrC,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,UAAU,GACd,aAAa,KAAK,CAAC,CAAC;YAClB,CAAC,CAAC,QAAQ,CAAC,GAAG;YACd,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QAC3C,OAAO,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"resourceRegistry.js","sourceRoot":"","sources":["../../../src/resources/resourceRegistry.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAElC,kCAAkC;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,oCAAoC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,oCAAoC;IACpC,IAAI,oBAAoB,CAAC,EAAE,WAAW,EAAE,CAAC;IACzC,IAAI,qBAAqB,EAAE;IAC3B,IAAI,eAAe,EAAE;IACrB,IAAI,qBAAqB,EAAE;IAC3B,uEAAuE;IACvE,IAAI,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC;IACrC,IAAI,eAAe,EAAE;CACb,CAAC;AAIX,MAAM,UAAU,eAAe;IAC7B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,yBAAyB;IACzB,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC1E,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,gFAAgF;IAChF,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,iEAAiE;IACjE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACrC,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,UAAU,GACd,aAAa,KAAK,CAAC,CAAC;YAClB,CAAC,CAAC,QAAQ,CAAC,GAAG;YACd,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QAC3C,OAAO,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/resources/ui-apps/mapAppHtml.d.ts

@@ -1,8 +1,8 @@
 import type { MapAppPayload } from '../../utils/mapAppPayload.js';
 /**
- * Render the generic Mapbox MCP App HTML — used by both the MCP Apps
- * resource (postMessage delivery) and any tool's inline MCP-UI rawHtml
- * block (initial-data baked in).
+ * Render the generic Mapbox MCP App HTML — served by the MCP Apps resource
+ * (`MapAppUIResource`) that `render_map_tool` targets exclusively via
+ * postMessage delivery.
  *
  * The iframe is a thin renderer over Mapbox GL JS. Tools produce a
  * `MapAppPayload` (see src/utils/mapAppPayload.ts) and the iframe

package/dist/esm/resources/ui-apps/mapAppHtml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mapAppHtml.d.ts","sourceRoot":"","sources":["../../../../src/resources/ui-apps/mapAppHtml.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE;;;;;;;;;GASG;AAMH,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B,GAAG,MAAM,CA+jDT"}
+{"version":3,"file":"mapAppHtml.d.ts","sourceRoot":"","sources":["../../../../src/resources/ui-apps/mapAppHtml.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE;;;;;;;;;GASG;AAMH,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B,GAAG,MAAM,CA6kDT"}

package/dist/esm/resources/ui-apps/mapAppHtml.js

@@ -1,9 +1,9 @@
 // Copyright (c) Mapbox, Inc.
 // Licensed under the MIT License.
 /**
- * Render the generic Mapbox MCP App HTML — used by both the MCP Apps
- * resource (postMessage delivery) and any tool's inline MCP-UI rawHtml
- * block (initial-data baked in).
+ * Render the generic Mapbox MCP App HTML — served by the MCP Apps resource
+ * (`MapAppUIResource`) that `render_map_tool` targets exclusively via
+ * postMessage delivery.
  *
  * The iframe is a thin renderer over Mapbox GL JS. Tools produce a
  * `MapAppPayload` (see src/utils/mapAppPayload.ts) and the iframe
@@ -622,6 +622,11 @@ ${initialDataScript}
       if (typeof params.exclude !== 'string') return false;
       if (!/^[A-Za-z0-9_,.() -]+$/.test(params.exclude)) return false;
     }
+    if (params.selectedRouteIndex !== undefined && params.selectedRouteIndex !== null) {
+      if (typeof params.selectedRouteIndex !== 'number') return false;
+      if (!isFinite(params.selectedRouteIndex) || params.selectedRouteIndex < 0) return false;
+      if (Math.floor(params.selectedRouteIndex) !== params.selectedRouteIndex) return false;
+    }
     return true;
   }
 
@@ -743,7 +748,16 @@ ${initialDataScript}
         return res.json();
       })
       .then(function(data) {
-        var route = data && data.routes && data.routes[0];
+        var routes = (data && data.routes) || [];
+        // If elicitation resolved to a specific route server-side, draw that
+        // same one out of the freshly re-fetched alternatives — falling back
+        // to the first route if the index is out of range (e.g. the API
+        // returned fewer alternatives this time around), same fallback
+        // philosophy as selectedMapboxId in the search self-fetch.
+        var route =
+          (typeof params.selectedRouteIndex === 'number' &&
+            routes[params.selectedRouteIndex]) ||
+          routes[0];
         var coords = route ? pickRouteGeometryClient(route) : null;
         if (!coords) {
           showError('Directions API returned no route.');

package/dist/esm/resources/ui-apps/mapAppHtml.js.map

@@ -1 +1 @@
-{"version":3,"file":"mapAppHtml.js","sourceRoot":"","sources":["../../../../src/resources/ui-apps/mapAppHtml.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAIlC;;;;;;;;;GASG;AAEH,yEAAyE;AACzE,wEAAwE;AACxE,6EAA6E;AAC7E,8CAA8C;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C,MAAM,UAAU,gBAAgB,CAAC,MAKhC;IACC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,yBAAyB,CAAC;IACpE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,iBAAiB,CAAC;IAExD,MAAM,iBAAiB,GAAG,WAAW;QACnC,CAAC,CAAC,qDAAqD,eAAe,CAClE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAC5B,WAAW;QACd,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;;;mDAM0C,SAAS;oDACR,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkD3D,iBAAiB;;;;gBAIH,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;uBACpB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAq/C1C,CAAC;AACT,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC"}
+{"version":3,"file":"mapAppHtml.js","sourceRoot":"","sources":["../../../../src/resources/ui-apps/mapAppHtml.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAIlC;;;;;;;;;GASG;AAEH,yEAAyE;AACzE,wEAAwE;AACxE,6EAA6E;AAC7E,8CAA8C;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C,MAAM,UAAU,gBAAgB,CAAC,MAKhC;IACC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,yBAAyB,CAAC;IACpE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,iBAAiB,CAAC;IAExD,MAAM,iBAAiB,GAAG,WAAW;QACnC,CAAC,CAAC,qDAAqD,eAAe,CAClE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAC5B,WAAW;QACd,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;;;mDAM0C,SAAS;oDACR,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkD3D,iBAAiB;;;;gBAIH,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;uBACpB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAmgD1C,CAAC;AACT,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC"}

package/dist/esm/tools/directions-tool/DirectionsTool.d.ts

@@ -17,6 +17,22 @@ export declare class DirectionsTool extends MapboxApiBasedTool<typeof Directions
     constructor(params: {
         httpRequest: HttpRequest;
     });
+    private formatDuration;
+    private formatDistance;
+    /** One-line label for a route option in the Stage 2 elicitation form. */
+    private describeRoute;
+    /**
+     * When multiple route alternatives come back, let the user pick one via
+     * MCP elicitation rather than handing all of them to the model. Returns
+     * the selected route's index (to thread through the self-fetch ref so the
+     * map preview draws the same route) and mutates nothing — the caller
+     * applies the filtered `routes` array itself.
+     *
+     * Mirrors search_and_geocode_tool's disambiguation elicitation: silent,
+     * best-effort fallback to "return everything" on decline, on an
+     * unsupported client, or on any elicitation error.
+     */
+    private elicitRouteSelection;
     protected execute(input: z.infer<typeof DirectionsInputSchema>, accessToken: string): Promise<CallToolResult>;
 }
 //# sourceMappingURL=DirectionsTool.d.ts.map

package/dist/esm/tools/directions-tool/DirectionsTool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DirectionsTool.d.ts","sourceRoot":"","sources":["../../../../src/tools/directions-tool/DirectionsTool.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EACL,wBAAwB,EAEzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAQzD,qBAAa,cAAe,SAAQ,kBAAkB,CACpD,OAAO,qBAAqB,EAC5B,OAAO,wBAAwB,CAChC;IACC,IAAI,SAAqB;IACzB,WAAW,SAMkE;IAC7E,WAAW;;;;;;MAMT;gBACU,MAAM,EAAE;QAAE,WAAW,EAAE,WAAW,CAAA;KAAE;cAOhC,OAAO,CACrB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,EAC5C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,cAAc,CAAC;CA4Q3B"}
+{"version":3,"file":"DirectionsTool.d.ts","sourceRoot":"","sources":["../../../../src/tools/directions-tool/DirectionsTool.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EACL,wBAAwB,EAGzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAQzD,qBAAa,cAAe,SAAQ,kBAAkB,CACpD,OAAO,qBAAqB,EAC5B,OAAO,wBAAwB,CAChC;IACC,IAAI,SAAqB;IACzB,WAAW,SAMkE;IAC7E,WAAW;;;;;;MAMT;gBACU,MAAM,EAAE;QAAE,WAAW,EAAE,WAAW,CAAA;KAAE;IAQhD,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,cAAc;IAMtB,yEAAyE;IACzE,OAAO,CAAC,aAAa;IA6BrB;;;;;;;;;;OAUG;YACW,oBAAoB;cA6ClB,OAAO,CACrB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,EAC5C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,cAAc,CAAC;CAkS3B"}

package/dist/esm/tools/directions-tool/DirectionsTool.js

@@ -33,6 +33,91 @@ export class DirectionsTool extends MapboxApiBasedTool {
             httpRequest: params.httpRequest
         });
     }
+    formatDuration(seconds) {
+        const hours = Math.floor(seconds / 3600);
+        const minutes = Math.round((seconds % 3600) / 60);
+        return hours > 0 ? `${hours}h ${minutes}min` : `${minutes}min`;
+    }
+    formatDistance(meters) {
+        const km = (meters / 1000).toFixed(1);
+        const miles = (meters / 1609.34).toFixed(1);
+        return `${km}km (${miles}mi)`;
+    }
+    /** One-line label for a route option in the Stage 2 elicitation form. */
+    describeRoute(route) {
+        const duration = this.formatDuration(route.duration);
+        const distance = this.formatDistance(route.distance);
+        const roads = route.leg_summaries?.[0] || 'Route';
+        let traffic = '';
+        const c = route.congestion_information;
+        if (c) {
+            const total = c.length_low + c.length_moderate + c.length_heavy + c.length_severe;
+            const heavyPct = total > 0
+                ? Math.round(((c.length_heavy + c.length_severe) / total) * 100)
+                : 0;
+            traffic =
+                heavyPct > 20
+                    ? ` ⚠️ Heavy traffic (${heavyPct}%)`
+                    : c.length_moderate > 0
+                        ? ' 🟡 Moderate traffic'
+                        : ' ✅ Light traffic';
+        }
+        const incidentCount = route.incidents_summary?.length ?? 0;
+        const incidents = incidentCount > 0 ? ` • ${incidentCount} incident(s)` : '';
+        return `${duration} via ${roads} • ${distance}${traffic}${incidents}`;
+    }
+    /**
+     * When multiple route alternatives come back, let the user pick one via
+     * MCP elicitation rather than handing all of them to the model. Returns
+     * the selected route's index (to thread through the self-fetch ref so the
+     * map preview draws the same route) and mutates nothing — the caller
+     * applies the filtered `routes` array itself.
+     *
+     * Mirrors search_and_geocode_tool's disambiguation elicitation: silent,
+     * best-effort fallback to "return everything" on decline, on an
+     * unsupported client, or on any elicitation error.
+     */
+    async elicitRouteSelection(routes) {
+        if (!this.server || routes.length < 2)
+            return undefined;
+        try {
+            const options = routes.map((route, index) => ({
+                value: String(index),
+                label: this.describeRoute(route)
+            }));
+            const result = await this.server.server.elicitInput({
+                mode: 'form',
+                message: `Found ${routes.length} routes. Choose your preferred route:`,
+                requestedSchema: {
+                    type: 'object',
+                    properties: {
+                        selectedIndex: {
+                            type: 'string',
+                            title: 'Select Route',
+                            description: 'Choose the route that best fits your needs',
+                            enum: options.map((o) => o.value),
+                            enumNames: options.map((o) => o.label)
+                        }
+                    },
+                    required: ['selectedIndex']
+                }
+            });
+            if (result.action === 'accept' && result.content?.selectedIndex) {
+                const index = parseInt(String(result.content.selectedIndex), 10);
+                if (Number.isInteger(index) && index >= 0 && index < routes.length) {
+                    return index;
+                }
+            }
+        }
+        catch {
+            // Elicitation isn't supported by every MCP client (Claude Desktop
+            // doesn't, for example). Falling back to "return all routes" is the
+            // expected behavior — silent, since Claude Desktop's UI flags tool
+            // calls that emit notifications/message at any level as visually
+            // failed even when the JSON-RPC response is isError: false.
+        }
+        return undefined;
+    }
     async execute(input, accessToken) {
         // Validate exclude parameter against the actual routing_profile
         // This is needed because some exclusions are only driving specific
@@ -177,6 +262,21 @@ export class DirectionsTool extends MapboxApiBasedTool {
             this.log('warning', `DirectionsTool: Response validation failed: ${error}`);
             validatedData = cleanedData;
         }
+        // When the API returns multiple route alternatives, let the user pick
+        // one via elicitation rather than handing every option to the model.
+        // selectedRouteIndex (into the *original* routes array) is threaded
+        // through the self-fetch ref below so the map preview draws the same
+        // route the user picked, not just whichever the API returns first.
+        let selectedRouteIndex;
+        if (validatedData.routes && validatedData.routes.length >= 2) {
+            selectedRouteIndex = await this.elicitRouteSelection(validatedData.routes);
+            if (selectedRouteIndex !== undefined) {
+                validatedData = {
+                    ...validatedData,
+                    routes: [validatedData.routes[selectedRouteIndex]]
+                };
+            }
+        }
         // Check response size and conditionally create temporary resource
         const RESPONSE_SIZE_THRESHOLD = 50 * 1024; // 50KB
         const responseText = JSON.stringify(validatedData, null, 2);
@@ -188,10 +288,14 @@ export class DirectionsTool extends MapboxApiBasedTool {
         // (already visible to the LLM), so unlike a mapbox://temp/ ref there's
         // nothing server-side that a restart or a rehydrated conversation could
         // invalidate. Works regardless of input.geometries since the self-fetch
-        // always forces geometries=geojson itself.
+        // always forces geometries=geojson itself. selectedRouteIndex (when
+        // elicitation resolved to one route) tells the client which of the
+        // freshly re-fetched alternatives to draw — see selectedMapboxId in
+        // search_and_geocode_tool for the equivalent pattern.
         const selfFetchRef = buildSelfFetchRef('directions', {
             coordinates: input.coordinates,
             routing_profile: input.routing_profile,
+            selectedRouteIndex,
             alternatives: input.alternatives,
             exclude: input.exclude,
             depart_at: input.depart_at,