@mapbox/mcp-server 0.13.0 → 0.14.0

package/dist/esm/utils/tracing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tracing.d.ts","sourceRoot":"","sources":["../../../src/utils/tracing.ts"],"names":[],"mappings":"AAWA,OAAO,EAIL,KAAK,IAAI,EAGV,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AA+B9C;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,IAAI,CAAC;IACX,cAAc,EAAE;QACd,UAAU,CAAC,EAAE,IAAI,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,IAAI,CAAC;IACX,cAAc,EAAE;QACd,UAAU,CAAC,EAAE,IAAI,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,yBAAyB,CAqB3B;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,WAAW,EACxB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,oBAAoB,CAsBtB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAoFvD;AAED;;GAEG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED;;GAEG;AACH,wBAAgB,SAAS,wCAExB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE;IACN,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,IAAI,CAkBN;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE;IACN,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,IAAI,CAkBN;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,IAAI,EACV,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GACrD,IAAI,CAMN;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK,GAAG,MAAM,EACrB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GACrD,IAAI,CAoBN;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;IACrD,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAmBA;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAMlD"}
+{"version":3,"file":"tracing.d.ts","sourceRoot":"","sources":["../../../src/utils/tracing.ts"],"names":[],"mappings":"AAWA,OAAO,EAIL,KAAK,IAAI,EAGV,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AA+B9C;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,IAAI,CAAC;IACX,cAAc,EAAE;QACd,UAAU,CAAC,EAAE,IAAI,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,IAAI,CAAC;IACX,cAAc,EAAE;QACd,UAAU,CAAC,EAAE,IAAI,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,yBAAyB,CAqB3B;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,WAAW,EACxB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,oBAAoB,CAsBtB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAsFvD;AAED;;GAEG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED;;GAEG;AACH,wBAAgB,SAAS,wCAExB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE;IACN,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,IAAI,CAkBN;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE;IACN,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,IAAI,CAkBN;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,IAAI,EACV,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GACrD,IAAI,CAMN;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK,GAAG,MAAM,EACrB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GACrD,IAAI,CAoBN;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;IACrD,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAmBA;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAMlD"}

package/dist/esm/utils/tracing.js

@@ -7,6 +7,7 @@ import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from '@opentelemetry/semantic
 import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http';
 import { trace, SpanStatusCode, SpanKind, diag, DiagLogLevel } from '@opentelemetry/api';
 import { getVersionInfo } from './versionUtils.js';
+import { RedactingSpanExporter } from './redactingSpanExporter.js';
 import { ATTR_SERVICE_INSTANCE_ID } from '@opentelemetry/semantic-conventions/incubating';
 // Suppress OpenTelemetry diagnostic logging IMMEDIATELY to avoid polluting stdio
 // This must happen at module load time, before any OTEL operations
@@ -128,7 +129,9 @@ export async function initializeTracing() {
         // Create SDK instance
         sdk = new NodeSDK({
             resource,
-            traceExporter: exporters[0],
+            // Wrap the exporter so access tokens recorded in HTTP client span
+            // attributes (url.full, url.query) never reach the trace backend
+            traceExporter: new RedactingSpanExporter(exporters[0]),
             instrumentations: [
                 getNodeAutoInstrumentations({
                     // Disable instrumentations that might be too noisy

package/dist/esm/utils/tracing.js.map

@@ -1 +1 @@
-{"version":3,"file":"tracing.js","sourceRoot":"","sources":["../../../src/utils/tracing.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAElC,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,EACL,KAAK,EACL,cAAc,EACd,QAAQ,EAER,IAAI,EACJ,YAAY,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAG1F,iFAAiF;AACjF,mEAAmE;AACnE,iEAAiE;AACjE,MAAM,wBAAwB,GAAG,GAAG,EAAE;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc;QACzC,CAAC,CAAC,YAAY,CACV,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAA+B,CACtE;QACH,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC;IAEtB,IAAI,CAAC,SAAS,CACZ;QACE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;QACjB,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;QACf,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;KAChB,EACD,QAAQ,CACT,CAAC;AACJ,CAAC,CAAC;AAEF,4CAA4C;AAC5C,wBAAwB,EAAE,CAAC;AAE3B,sBAAsB;AACtB,IAAI,GAAG,GAAmB,IAAI,CAAC;AAC/B,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAmC7B;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAgB,EAChB,SAAiB,EACjB,KAA+B;IAE/B,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE;QAC/C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;QAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;QACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,cAAc,EAAE;YACd,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;YAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;YACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;SAChD;QACD,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAgB,EAChB,SAAiB,EACjB,WAAwB,EACxB,KAA+B;IAE/B,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE;QAC/C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;QAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;QACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,cAAc,EAAE;YACd,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;YAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;YACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;SAChD;QACD,WAAW;QACX,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,+EAA+E;IAC/E,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACjE,OAAO;IACT,CAAC;IAED,yCAAyC;IACzC,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,OAAO,EAAE,CAAC;QACjD,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IAErC,IAAI,CAAC;QACH,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,sBAAsB,CAAC;YACtC,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,WAAW,CAAC,IAAI;YACtE,CAAC,oBAAoB,CAAC,EAAE,WAAW,CAAC,OAAO;YAC3C,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS;YAC7D,iBAAiB,EAAE,WAAW,CAAC,GAAG;YAClC,oBAAoB,EAAE,WAAW,CAAC,MAAM;YACxC,iBAAiB,EAAE,WAAW,CAAC,GAAG;SACnC,CAAC,CAAC;QAEH,sBAAsB;QACtB,MAAM,SAAS,GAAG,EAAE,CAAC;QAErB,8DAA8D;QAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,MAAM,EAAE,CAAC;YACzD,MAAM,EAAE,mBAAmB,EAAE,GAC3B,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,oCAAoC;QACpC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;QAC7D,IAAI,YAAY,EAAE,CAAC;YACjB,SAAS,CAAC,IAAI,CACZ,IAAI,iBAAiB,CAAC;gBACpB,GAAG,EAAE,GAAG,YAAY,YAAY;gBAChC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;oBAC7C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;oBACpD,CAAC,CAAC,EAAE;aACP,CAAC,CACH,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,sBAAsB;QACtB,GAAG,GAAG,IAAI,OAAO,CAAC;YAChB,QAAQ;YACR,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;YAC3B,gBAAgB,EAAE;gBAChB,2BAA2B,CAAC;oBAC1B,mDAAmD;oBACnD,mCAAmC,EAAE;wBACnC,OAAO,EAAE,KAAK;qBACf;oBACD,oCAAoC,EAAE;wBACpC,OAAO,EAAE,KAAK;qBACf;oBACD,2DAA2D;oBAC3D,qCAAqC,EAAE;wBACrC,OAAO,EAAE,IAAI;qBACd;oBACD,iDAAiD;oBACjD,uCAAuC,EAAE;wBACvC,OAAO,EAAE,IAAI;qBACd;iBACF,CAAC;aACH;SACF,CAAC,CAAC;QAEH,gBAAgB;QAChB,GAAG,CAAC,KAAK,EAAE,CAAC;QACZ,gBAAgB,GAAG,IAAI,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,gBAAgB,GAAG,KAAK,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrB,GAAG,GAAG,IAAI,CAAC;QACX,gBAAgB,GAAG,KAAK,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,KAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,SAAiB,EACjB,KAMC;IAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,QAAQ,EAAE,EAAE;QAChD,IAAI,EAAE,QAAQ,CAAC,QAAQ;QACvB,UAAU,EAAE;YACV,WAAW,EAAE,QAAQ;YACrB,iBAAiB,EAAE,SAAS;YAC5B,gBAAgB,EAAE,gBAAgB;YAClC,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,EAAE,aAAa,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;YACvE,GAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SACxD;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,GAAW,EACX,KAIC;IAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE;QAC5D,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,UAAU,EAAE;YACV,aAAa,EAAE,MAAM;YACrB,UAAU,EAAE,GAAG;YACf,gBAAgB,EAAE,cAAc;YAChC,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,EAAE,aAAa,IAAI;gBAC1B,6BAA6B,EAAE,KAAK,CAAC,aAAa;aACnD,CAAC;YACF,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SAC3D;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAU,EACV,UAAsD;IAEtD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAU,EACV,KAAqB,EACrB,UAAsD;IAEtD,MAAM,YAAY,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACvE,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;IAE/D,IAAI,CAAC,aAAa,CAAC;QACjB,YAAY,EAAE,SAAS;QACvB,eAAe,EAAE,YAAY;QAC7B,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;KACtB,CAAC,CAAC;IAEH,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,SAAS,CAAC;QACb,IAAI,EAAE,cAAc,CAAC,KAAK;QAC1B,OAAO,EAAE,YAAY;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAIlD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,+BAA+B;IAC3D,CAAC;IAED,yDAAyD;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,CAAC;QACH,wEAAwE;QACxE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}
+{"version":3,"file":"tracing.js","sourceRoot":"","sources":["../../../src/utils/tracing.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAElC,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,EACL,KAAK,EACL,cAAc,EACd,QAAQ,EAER,IAAI,EACJ,YAAY,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAG1F,iFAAiF;AACjF,mEAAmE;AACnE,iEAAiE;AACjE,MAAM,wBAAwB,GAAG,GAAG,EAAE;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc;QACzC,CAAC,CAAC,YAAY,CACV,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAA+B,CACtE;QACH,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC;IAEtB,IAAI,CAAC,SAAS,CACZ;QACE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;QACjB,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;QACf,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;KAChB,EACD,QAAQ,CACT,CAAC;AACJ,CAAC,CAAC;AAEF,4CAA4C;AAC5C,wBAAwB,EAAE,CAAC;AAE3B,sBAAsB;AACtB,IAAI,GAAG,GAAmB,IAAI,CAAC;AAC/B,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAmC7B;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAgB,EAChB,SAAiB,EACjB,KAA+B;IAE/B,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE;QAC/C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;QAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;QACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,cAAc,EAAE;YACd,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;YAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;YACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;SAChD;QACD,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAgB,EAChB,SAAiB,EACjB,WAAwB,EACxB,KAA+B;IAE/B,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE;QAC/C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;QAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;QACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,cAAc,EAAE;YACd,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;YAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;YACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;SAChD;QACD,WAAW;QACX,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,+EAA+E;IAC/E,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACjE,OAAO;IACT,CAAC;IAED,yCAAyC;IACzC,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,OAAO,EAAE,CAAC;QACjD,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IAErC,IAAI,CAAC;QACH,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,sBAAsB,CAAC;YACtC,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,WAAW,CAAC,IAAI;YACtE,CAAC,oBAAoB,CAAC,EAAE,WAAW,CAAC,OAAO;YAC3C,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS;YAC7D,iBAAiB,EAAE,WAAW,CAAC,GAAG;YAClC,oBAAoB,EAAE,WAAW,CAAC,MAAM;YACxC,iBAAiB,EAAE,WAAW,CAAC,GAAG;SACnC,CAAC,CAAC;QAEH,sBAAsB;QACtB,MAAM,SAAS,GAAG,EAAE,CAAC;QAErB,8DAA8D;QAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,MAAM,EAAE,CAAC;YACzD,MAAM,EAAE,mBAAmB,EAAE,GAC3B,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,oCAAoC;QACpC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;QAC7D,IAAI,YAAY,EAAE,CAAC;YACjB,SAAS,CAAC,IAAI,CACZ,IAAI,iBAAiB,CAAC;gBACpB,GAAG,EAAE,GAAG,YAAY,YAAY;gBAChC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;oBAC7C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;oBACpD,CAAC,CAAC,EAAE;aACP,CAAC,CACH,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,sBAAsB;QACtB,GAAG,GAAG,IAAI,OAAO,CAAC;YAChB,QAAQ;YACR,kEAAkE;YAClE,iEAAiE;YACjE,aAAa,EAAE,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtD,gBAAgB,EAAE;gBAChB,2BAA2B,CAAC;oBAC1B,mDAAmD;oBACnD,mCAAmC,EAAE;wBACnC,OAAO,EAAE,KAAK;qBACf;oBACD,oCAAoC,EAAE;wBACpC,OAAO,EAAE,KAAK;qBACf;oBACD,2DAA2D;oBAC3D,qCAAqC,EAAE;wBACrC,OAAO,EAAE,IAAI;qBACd;oBACD,iDAAiD;oBACjD,uCAAuC,EAAE;wBACvC,OAAO,EAAE,IAAI;qBACd;iBACF,CAAC;aACH;SACF,CAAC,CAAC;QAEH,gBAAgB;QAChB,GAAG,CAAC,KAAK,EAAE,CAAC;QACZ,gBAAgB,GAAG,IAAI,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,gBAAgB,GAAG,KAAK,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrB,GAAG,GAAG,IAAI,CAAC;QACX,gBAAgB,GAAG,KAAK,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,KAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,SAAiB,EACjB,KAMC;IAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,QAAQ,EAAE,EAAE;QAChD,IAAI,EAAE,QAAQ,CAAC,QAAQ;QACvB,UAAU,EAAE;YACV,WAAW,EAAE,QAAQ;YACrB,iBAAiB,EAAE,SAAS;YAC5B,gBAAgB,EAAE,gBAAgB;YAClC,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,EAAE,aAAa,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;YACvE,GAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SACxD;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,GAAW,EACX,KAIC;IAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE;QAC5D,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,UAAU,EAAE;YACV,aAAa,EAAE,MAAM;YACrB,UAAU,EAAE,GAAG;YACf,gBAAgB,EAAE,cAAc;YAChC,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,EAAE,aAAa,IAAI;gBAC1B,6BAA6B,EAAE,KAAK,CAAC,aAAa;aACnD,CAAC;YACF,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SAC3D;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAU,EACV,UAAsD;IAEtD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAU,EACV,KAAqB,EACrB,UAAsD;IAEtD,MAAM,YAAY,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACvE,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;IAE/D,IAAI,CAAC,aAAa,CAAC;QACjB,YAAY,EAAE,SAAS;QACvB,eAAe,EAAE,YAAY;QAC7B,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;KACtB,CAAC,CAAC;IAEH,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,SAAS,CAAC;QACb,IAAI,EAAE,cAAc,CAAC,KAAK;QAC1B,OAAO,EAAE,YAAY;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAIlD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,+BAA+B;IAC3D,CAAC;IAED,yDAAyD;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,CAAC;QACH,wEAAwE;QACxE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/esm/utils/urlSafety.d.ts

@@ -6,14 +6,30 @@
  * Rejects:
  *  - non-http(s) schemes (e.g. file:, gopher:, data:, javascript:)
  *  - non-https URLs (markers should always be fetched over TLS)
- *  - URLs whose host is an IP literal in a loopback, private, link-local,
- *    unique-local, or otherwise non-routable range (CWE-918 SSRF)
- *  - URLs whose host is a well-known local hostname
+ *  - IPv4/IPv6 literals outside ipaddr.js's plain "unicast" range —
+ *    deny-by-default, so loopback, private, link-local, multicast,
+ *    broadcast, CGNAT, reserved, and every IPv4-in-IPv6 transition/
+ *    translation mechanism (mapped, compatible, 6to4, NAT64, SIIT, Teredo,
+ *    AMT, ORCHID, etc.) are all rejected without needing to be named
+ *    individually (CWE-918 SSRF)
+ *  - well-known local hostnames, reserved local/internal-use suffixes
+ *    (.internal, .local, .arpa), and dotless single-label hostnames
  *
- * Note: we do not perform DNS resolution here — the upstream service will
- * still resolve the hostname when fetching. This validation is a defense in
- * depth against the most common SSRF vectors that prompt-injected agents
- * tend to produce (IP literals and "localhost").
+ * Out of scope, by design, for this pre-fetch string check — all three
+ * require validating the actual connection, not the URL string, so they
+ * belong where the fetch happens, not here:
+ *  - DNS rebinding (an ordinary hostname resolving to an internal address
+ *    at fetch time)
+ *  - port restriction
+ *  - network-specific hostname suffixes (.corp, .lan, .home, etc.) —
+ *    unlike .internal/.local/.arpa, these aren't globally reserved, so
+ *    they can't be enumerated in general
  */
 export declare function isSafeExternalUrl(rawUrl: string): boolean;
+/**
+ * Same validation as isSafeExternalUrl, but returns the parsed URL on
+ * success (null otherwise) so callers that need the WHATWG-canonical form
+ * of the validated URL don't have to re-parse the raw string.
+ */
+export declare function parseSafeExternalUrl(rawUrl: string): URL | null;
 //# sourceMappingURL=urlSafety.d.ts.map

package/dist/esm/utils/urlSafety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"urlSafety.d.ts","sourceRoot":"","sources":["../../../src/utils/urlSafety.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CA0EzD"}
+{"version":3,"file":"urlSafety.d.ts","sourceRoot":"","sources":["../../../src/utils/urlSafety.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAoF/D"}

package/dist/esm/utils/urlSafety.js

@@ -1,5 +1,6 @@
 // Copyright (c) Mapbox, Inc.
 // Licensed under the MIT License.
+import ipaddr from 'ipaddr.js';
 /**
  * Validates that a URL is safe for server-side fetching by an upstream service
  * (in particular, the Mapbox Static Images API which fetches custom marker
@@ -8,30 +9,55 @@
  * Rejects:
  *  - non-http(s) schemes (e.g. file:, gopher:, data:, javascript:)
  *  - non-https URLs (markers should always be fetched over TLS)
- *  - URLs whose host is an IP literal in a loopback, private, link-local,
- *    unique-local, or otherwise non-routable range (CWE-918 SSRF)
- *  - URLs whose host is a well-known local hostname
+ *  - IPv4/IPv6 literals outside ipaddr.js's plain "unicast" range —
+ *    deny-by-default, so loopback, private, link-local, multicast,
+ *    broadcast, CGNAT, reserved, and every IPv4-in-IPv6 transition/
+ *    translation mechanism (mapped, compatible, 6to4, NAT64, SIIT, Teredo,
+ *    AMT, ORCHID, etc.) are all rejected without needing to be named
+ *    individually (CWE-918 SSRF)
+ *  - well-known local hostnames, reserved local/internal-use suffixes
+ *    (.internal, .local, .arpa), and dotless single-label hostnames
  *
- * Note: we do not perform DNS resolution here — the upstream service will
- * still resolve the hostname when fetching. This validation is a defense in
- * depth against the most common SSRF vectors that prompt-injected agents
- * tend to produce (IP literals and "localhost").
+ * Out of scope, by design, for this pre-fetch string check — all three
+ * require validating the actual connection, not the URL string, so they
+ * belong where the fetch happens, not here:
+ *  - DNS rebinding (an ordinary hostname resolving to an internal address
+ *    at fetch time)
+ *  - port restriction
+ *  - network-specific hostname suffixes (.corp, .lan, .home, etc.) —
+ *    unlike .internal/.local/.arpa, these aren't globally reserved, so
+ *    they can't be enumerated in general
  */
 export function isSafeExternalUrl(rawUrl) {
+    return parseSafeExternalUrl(rawUrl) !== null;
+}
+/**
+ * Same validation as isSafeExternalUrl, but returns the parsed URL on
+ * success (null otherwise) so callers that need the WHATWG-canonical form
+ * of the validated URL don't have to re-parse the raw string.
+ */
+export function parseSafeExternalUrl(rawUrl) {
     let parsed;
     try {
         parsed = new URL(rawUrl);
     }
     catch {
-        return false;
+        return null;
     }
     if (parsed.protocol !== 'https:') {
-        return false;
+        return null;
     }
-    // Strip optional surrounding brackets from IPv6 literals
-    const host = parsed.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    // Strip optional surrounding brackets from IPv6 literals and a trailing
+    // root-label dot (e.g. "localhost." is equivalent to "localhost"). The
+    // dotless-hostname check further below relies on this running first —
+    // without it, "intranet." would still contain a dot and slip past that
+    // check.
+    const host = parsed.hostname
+        .replace(/^\[|\]$/g, '')
+        .replace(/\.$/, '')
+        .toLowerCase();
     if (host.length === 0) {
-        return false;
+        return null;
     }
     // Block well-known local hostnames
     const blockedHostnames = new Set([
@@ -40,62 +66,50 @@ export function isSafeExternalUrl(rawUrl) {
         'ip6-loopback',
         'broadcasthost'
     ]);
-    if (blockedHostnames.has(host) || host.endsWith('.localhost')) {
-        return false;
+    // Suffixes reserved for local/internal use that no public marker image
+    // host is ever legitimately under: cloud-internal DNS zones (.internal,
+    // used by GCP/AWS service discovery — covers metadata.google.internal,
+    // the GCP metadata endpoint's actual hostname), mDNS (.local), and
+    // reverse-DNS / home-network zones reserved by RFC 6761/8375 (.arpa
+    // covers .in-addr.arpa, .ip6.arpa, and .home.arpa as suffixes of it).
+    const blockedSuffixes = ['.localhost', '.internal', '.local', '.arpa'];
+    if (blockedHostnames.has(host) ||
+        blockedSuffixes.some((suffix) => host.endsWith(suffix))) {
+        return null;
     }
-    // IPv4 literal check (dotted quad)
-    const ipv4Match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
-    if (ipv4Match) {
-        const octets = ipv4Match.slice(1, 5).map((o) => Number(o));
-        if (octets.some((o) => o < 0 || o > 255)) {
-            return false;
-        }
-        const [a, b] = octets;
-        // 0.0.0.0/8, 10/8, 127/8
-        // 0.0.0.0/8 — "this network" (unspecified + reserved); block conservatively
-        if (a === 0 || a === 10 || a === 127)
-            return false;
-        // 169.254/16 (link-local, includes cloud metadata 169.254.169.254)
-        if (a === 169 && b === 254)
-            return false;
-        // 172.16/12
-        if (a === 172 && b >= 16 && b <= 31)
-            return false;
-        // 192.168/16
-        if (a === 192 && b === 168)
-            return false;
-        // 100.64/10 (CGNAT)
-        if (a === 100 && b >= 64 && b <= 127)
-            return false;
-        // 224/4 multicast and 240/4 reserved
-        if (a >= 224)
-            return false;
-        return true;
+    // If the host isn't a parseable IP literal at all, it's an ordinary
+    // hostname — allowed here (subject to the checks above), except that a
+    // public marker image host always has at least one dot; a dotless,
+    // single-label hostname only resolves via the fetcher's own network
+    // search-domain suffixing (e.g. "intranet", "metadata"), which is never
+    // the case for a legitimate external image URL. DNS rebinding on a
+    // multi-label hostname is out of scope for this pre-fetch check, see the
+    // module doc comment.
+    if (!ipaddr.isValid(host)) {
+        return host.includes('.') ? parsed : null;
+    }
+    const addr = ipaddr.parse(host);
+    // Deny by default for both IPv4 and IPv6: only plain global unicast
+    // addresses are allowed. Every other named range (private, loopback,
+    // link-local, multicast, broadcast, CGNAT, reserved, unique-local, and
+    // every IPv4-in-IPv6 transition/translation mechanism) is rejected,
+    // regardless of what it does or doesn't embed.
+    if (addr.range() !== 'unicast') {
+        return null;
     }
-    // IPv6 literal check (presence of ':' indicates IPv6 since IPv4 was handled)
-    if (host.includes(':')) {
-        // ::1 loopback, :: unspecified
-        if (host === '::1' || host === '::')
-            return false;
-        // fc00::/7 unique local (fc.. or fd..)
-        if (/^f[cd][0-9a-f]{2}:/.test(host))
-            return false;
-        // fe80::/10 link-local
-        if (/^fe[89ab][0-9a-f]:/.test(host))
-            return false;
-        // ff00::/8 multicast
-        if (/^ff[0-9a-f]{2}:/.test(host))
-            return false;
-        // IPv4-mapped / IPv4-compatible IPv6: ::ffff:a.b.c.d or ::a.b.c.d
-        // (Node's URL parser normalises ::ffff:127.0.0.1 to ::ffff:7f00:1, so
-        // detect the embedded IPv4 either as a dotted-quad or as the
-        // ::ffff:xxxx:xxxx hex form.)
-        if (/\d+\.\d+\.\d+\.\d+/.test(host))
-            return false;
-        if (/^::ffff:[0-9a-f]{1,4}:[0-9a-f]{1,4}$/.test(host))
-            return false;
-        return true;
+    if (addr.kind() === 'ipv6') {
+        // ipaddr.js does not classify the deprecated IPv4-compatible form
+        // (::a.b.c.d, i.e. the leading 96 bits all zero) as a special range
+        // when written in plain hex, which is exactly the form Node's URL
+        // parser normalises a dotted-quad IPv4-compatible literal to — so it
+        // reaches here as ordinary 'unicast' and needs an explicit check.
+        // (::1 and :: are already excluded above via the loopback/unspecified
+        // ranges, so this only affects addresses with a genuine embedded IPv4.)
+        const bytes = addr.toByteArray();
+        if (bytes.slice(0, 12).every((b) => b === 0)) {
+            return null;
+        }
     }
-    return true;
+    return parsed;
 }
 //# sourceMappingURL=urlSafety.js.map

package/dist/esm/utils/urlSafety.js.map

@@ -1 +1 @@
-{"version":3,"file":"urlSafety.js","sourceRoot":"","sources":["../../../src/utils/urlSafety.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAElC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,yDAAyD;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAEnE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mCAAmC;IACnC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;QAC/B,WAAW;QACX,eAAe;QACf,cAAc;QACd,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mCAAmC;IACnC,MAAM,SAAS,GAAG,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;QACtB,yBAAyB;QACzB,4EAA4E;QAC5E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACnD,mEAAmE;QACnE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACzC,YAAY;QACZ,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;QAClD,aAAa;QACb,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACzC,oBAAoB;QACpB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC;QACnD,qCAAqC;QACrC,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,+BAA+B;QAC/B,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAClD,uCAAuC;QACvC,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,uBAAuB;QACvB,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,qBAAqB;QACrB,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,kEAAkE;QAClE,sEAAsE;QACtE,6DAA6D;QAC7D,8BAA8B;QAC9B,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"urlSafety.js","sourceRoot":"","sources":["../../../src/utils/urlSafety.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAElC,OAAO,MAAM,MAAM,WAAW,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,oBAAoB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,SAAS;IACT,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ;SACzB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,WAAW,EAAE,CAAC;IAEjB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mCAAmC;IACnC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;QAC/B,WAAW;QACX,eAAe;QACf,cAAc;QACd,eAAe;KAChB,CAAC,CAAC;IACH,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,mEAAmE;IACnE,oEAAoE;IACpE,sEAAsE;IACtE,MAAM,eAAe,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvE,IACE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;QAC1B,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EACvD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,mEAAmE;IACnE,oEAAoE;IACpE,wEAAwE;IACxE,mEAAmE;IACnE,yEAAyE;IACzE,sBAAsB;IACtB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEhC,oEAAoE;IACpE,qEAAqE;IACrE,uEAAuE;IACvE,oEAAoE;IACpE,+CAA+C;IAC/C,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;QAC3B,kEAAkE;QAClE,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/esm/version.json

@@ -1,6 +1,6 @@
 {
-  "sha": "88ba37c5e1013138c5baea75c8db90e8ae8731b1",
-  "tag": "v0.12.7-4-g88ba37c",
+  "sha": "8d26d7636a30dd0355db18bb2c64f3bc7112b41c",
+  "tag": "v0.13.0-6-g8d26d76",
   "branch": "HEAD",
-  "version": "0.13.0"
+  "version": "0.14.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mapbox/mcp-server",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Mapbox MCP server.",
   "mcpName": "io.github.mapbox/mcp-server",
   "main": "./dist/commonjs/index.js",
@@ -88,6 +88,7 @@
     "@opentelemetry/sdk-trace-base": "^2.7.1",
     "@opentelemetry/semantic-conventions": "^1.40.0",
     "@turf/turf": "^7.3.1",
+    "ipaddr.js": "^2.4.0",
     "patch-package": "^8.0.1",
     "zod": "^4.3.6"
   },

package/dist/commonjs/resources/ui-apps/StaticMapUIResource.d.ts

@@ -1,15 +0,0 @@
-import type { RequestHandlerExtra } from '@modelcontextprotocol/sdk/shared/protocol.js';
-import type { ReadResourceResult, ServerNotification, ServerRequest } from '@modelcontextprotocol/sdk/types.js';
-import { BaseResource } from '../BaseResource.js';
-/**
- * Serves UI App HTML for Static Map Preview
- * Implements MCP Apps pattern with ui:// scheme
- */
-export declare class StaticMapUIResource extends BaseResource {
-    readonly name = "Static Map Preview UI";
-    readonly uri = "ui://mapbox/static-map/index.html";
-    readonly description = "Interactive UI for previewing static map images (MCP Apps)";
-    readonly mimeType = "text/html;profile=mcp-app";
-    read(_uri: string, _extra?: RequestHandlerExtra<ServerRequest, ServerNotification>): Promise<ReadResourceResult>;
-}
-//# sourceMappingURL=StaticMapUIResource.d.ts.map

package/dist/commonjs/resources/ui-apps/StaticMapUIResource.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"StaticMapUIResource.d.ts","sourceRoot":"","sources":["../../../../src/resources/ui-apps/StaticMapUIResource.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACd,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,YAAY;IACnD,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,GAAG,uCAAuC;IACnD,QAAQ,CAAC,WAAW,gEAC2C;IAC/D,QAAQ,CAAC,QAAQ,+BAAsB;IAEjC,IAAI,CAER,IAAI,EAAE,MAAM,EAEZ,MAAM,CAAC,EAAE,mBAAmB,CAAC,aAAa,EAAE,kBAAkB,CAAC,GAC9D,OAAO,CAAC,kBAAkB,CAAC;CAgP/B"}

package/dist/commonjs/resources/ui-apps/StaticMapUIResource.js

@@ -1,262 +0,0 @@
-"use strict";
-// Copyright (c) Mapbox, Inc.
-// Licensed under the MIT License.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.StaticMapUIResource = void 0;
-const server_1 = require("@modelcontextprotocol/ext-apps/server");
-const BaseResource_js_1 = require("../BaseResource.js");
-/**
- * Serves UI App HTML for Static Map Preview
- * Implements MCP Apps pattern with ui:// scheme
- */
-class StaticMapUIResource extends BaseResource_js_1.BaseResource {
-    name = 'Static Map Preview UI';
-    uri = 'ui://mapbox/static-map/index.html';
-    description = 'Interactive UI for previewing static map images (MCP Apps)';
-    mimeType = server_1.RESOURCE_MIME_TYPE;
-    async read(
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    _uri, 
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    _extra) {
-        // Generate HTML for static map visualization with MCP Apps protocol support
-        const html = `<!DOCTYPE html>
-<html>
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Static Map Preview</title>
-  <style>
-    * { margin: 0; padding: 0; box-sizing: border-box; }
-    body {
-      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
-      background: #000;
-    }
-    #toolbar {
-      display: none;
-      align-items: center;
-      justify-content: flex-end;
-      padding: 6px 10px;
-      background: rgba(0, 0, 0, 0.7);
-      gap: 8px;
-    }
-    #toolbar.visible { display: flex; }
-    #fullscreen-btn {
-      background: rgba(255, 255, 255, 0.15);
-      border: 1px solid rgba(255, 255, 255, 0.3);
-      color: #fff;
-      padding: 4px 12px;
-      border-radius: 4px;
-      cursor: pointer;
-      font-size: 12px;
-    }
-    #fullscreen-btn:hover { background: rgba(255, 255, 255, 0.25); }
-    #image-container {
-      position: relative;
-    }
-    #preview-image {
-      display: none;
-      max-width: 100%;
-      width: 100%;
-      cursor: zoom-in;
-    }
-    #preview-image.zoomed {
-      cursor: zoom-out;
-      max-width: none;
-      width: auto;
-    }
-    #loading {
-      padding: 20px;
-      color: #fff;
-      font-size: 16px;
-    }
-    #error {
-      padding: 20px;
-      color: #ff6b6b;
-      text-align: center;
-    }
-  </style>
-</head>
-<body>
-  <div id="toolbar">
-    <button id="fullscreen-btn">⛶ Fullscreen</button>
-  </div>
-  <div id="image-container">
-    <div id="loading">Loading static map preview...</div>
-    <img id="preview-image" alt="Static Map Preview">
-    <div id="error" style="display:none"></div>
-  </div>
-
-  <script type="module">
-    const image = document.getElementById('preview-image');
-    const loading = document.getElementById('loading');
-    const errorDiv = document.getElementById('error');
-    const toolbar = document.getElementById('toolbar');
-    const fullscreenBtn = document.getElementById('fullscreen-btn');
-
-    let isZoomed = false;
-    let currentDisplayMode = 'inline';
-    let canFullscreen = false;
-
-    image.addEventListener('click', () => {
-      isZoomed = !isZoomed;
-      image.classList.toggle('zoomed', isZoomed);
-    });
-
-    let messageId = 0;
-    const pendingRequests = new Map();
-
-    function sendRequest(method, params = {}) {
-      const id = ++messageId;
-      window.parent.postMessage({ jsonrpc: '2.0', id, method, params }, '*');
-      return new Promise((resolve, reject) => {
-        pendingRequests.set(id, { resolve, reject });
-      });
-    }
-
-    function sendNotification(method, params = {}) {
-      window.parent.postMessage({ jsonrpc: '2.0', method, params }, '*');
-    }
-
-    function requestSizeToFit() {
-      if (currentDisplayMode !== 'inline') return;
-      // Use requestAnimationFrame to measure after layout so we get the
-      // actual rendered height (constrained by max-width:100%), not natural px
-      requestAnimationFrame(() => {
-        const toolbarHeight = canFullscreen ? toolbar.offsetHeight : 0;
-        sendNotification('ui/notifications/size-changed', {
-          height: Math.round(image.getBoundingClientRect().height) + toolbarHeight
-        });
-      });
-    }
-
-    function updateFullscreenButton() {
-      fullscreenBtn.textContent =
-        currentDisplayMode === 'fullscreen' ? '⊟ Exit Fullscreen' : '⛶ Fullscreen';
-    }
-
-    async function toggleFullscreen() {
-      const newMode = currentDisplayMode === 'fullscreen' ? 'inline' : 'fullscreen';
-      try {
-        const result = await sendRequest('ui/request-display-mode', { mode: newMode });
-        currentDisplayMode = result?.mode ?? newMode;
-        updateFullscreenButton();
-        if (currentDisplayMode === 'inline') requestSizeToFit();
-      } catch (e) {
-        console.error('Failed to change display mode:', e);
-      }
-    }
-
-    fullscreenBtn.addEventListener('click', toggleFullscreen);
-
-    window.addEventListener('message', (event) => {
-      const message = event.data;
-      if (!message || typeof message !== 'object') return;
-
-      if (message.id !== undefined && pendingRequests.has(message.id)) {
-        const { resolve, reject } = pendingRequests.get(message.id);
-        pendingRequests.delete(message.id);
-        if (message.error) reject(new Error(message.error.message));
-        else resolve(message.result);
-        return;
-      }
-
-      if (message.method === 'ui/notifications/tool-result') {
-        if (message.params) handleToolResult(message.params);
-      }
-
-      if (message.method === 'ui/notifications/host-context-changed') {
-        const ctx = message.params;
-        if (ctx?.displayMode) {
-          currentDisplayMode = ctx.displayMode;
-          updateFullscreenButton();
-          if (currentDisplayMode === 'inline' && image.style.display !== 'none') {
-            requestSizeToFit();
-          }
-        }
-      }
-    });
-
-    async function handleToolResult(result) {
-      const textContent = result.content?.find(c => c.type === 'text');
-      if (!textContent?.text) {
-        loading.style.display = 'none';
-        errorDiv.textContent = 'No URL found in tool result';
-        errorDiv.style.display = 'block';
-        return;
-      }
-
-      const url = textContent.text;
-      if (!url.includes('api.mapbox.com/styles/') || !url.includes('/static/')) {
-        loading.style.display = 'none';
-        errorDiv.textContent = 'Unsupported URL format';
-        errorDiv.style.display = 'block';
-        return;
-      }
-
-      loading.textContent = 'Fetching map from Mapbox...';
-      try {
-        const response = await fetch(url);
-        if (!response.ok) throw new Error('HTTP ' + response.status);
-        const blob = await response.blob();
-        const blobUrl = URL.createObjectURL(blob);
-
-        image.onload = () => {
-          loading.style.display = 'none';
-          image.style.display = 'block';
-          if (canFullscreen) toolbar.classList.add('visible');
-          requestSizeToFit();
-        };
-        image.src = blobUrl;
-      } catch (error) {
-        loading.style.display = 'none';
-        errorDiv.textContent = 'Failed to load image: ' + error.message;
-        errorDiv.style.display = 'block';
-      }
-    }
-
-    async function init() {
-      try {
-        const result = await sendRequest('ui/initialize', {
-          protocolVersion: '2026-01-26',
-          appCapabilities: {},
-          appInfo: { name: 'Static Map Preview', version: '1.0.0' }
-        });
-
-        sendNotification('ui/notifications/initialized', {});
-
-        const hostContext = result?.hostContext;
-        currentDisplayMode = hostContext?.displayMode ?? 'inline';
-        canFullscreen = hostContext?.availableDisplayModes?.includes('fullscreen') ?? false;
-      } catch (error) {
-        console.error('Failed to connect to MCP host:', error);
-        loading.textContent = 'Failed to connect: ' + error.message;
-        loading.style.color = '#cc0000';
-      }
-    }
-
-    init();
-  </script>
-</body>
-</html>`;
-        return {
-            contents: [
-                {
-                    uri: this.uri,
-                    mimeType: server_1.RESOURCE_MIME_TYPE,
-                    text: html,
-                    _meta: {
-                        ui: {
-                            csp: {
-                                connectDomains: ['https://api.mapbox.com'],
-                                resourceDomains: ['https://api.mapbox.com']
-                            }
-                        }
-                    }
-                }
-            ]
-        };
-    }
-}
-exports.StaticMapUIResource = StaticMapUIResource;
-//# sourceMappingURL=StaticMapUIResource.js.map

package/dist/commonjs/resources/ui-apps/StaticMapUIResource.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"StaticMapUIResource.js","sourceRoot":"","sources":["../../../../src/resources/ui-apps/StaticMapUIResource.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;;AAQlC,kEAA2E;AAC3E,wDAAkD;AAElD;;;GAGG;AACH,MAAa,mBAAoB,SAAQ,8BAAY;IAC1C,IAAI,GAAG,uBAAuB,CAAC;IAC/B,GAAG,GAAG,mCAAmC,CAAC;IAC1C,WAAW,GAClB,4DAA4D,CAAC;IACtD,QAAQ,GAAG,2BAAkB,CAAC;IAEvC,KAAK,CAAC,IAAI;IACR,6DAA6D;IAC7D,IAAY;IACZ,6DAA6D;IAC7D,MAA+D;QAE/D,4EAA4E;QAC5E,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA0NT,CAAC;QAEL,OAAO;YACL,QAAQ,EAAE;gBACR;oBACE,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,QAAQ,EAAE,2BAAkB;oBAC5B,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE;wBACL,EAAE,EAAE;4BACF,GAAG,EAAE;gCACH,cAAc,EAAE,CAAC,wBAAwB,CAAC;gCAC1C,eAAe,EAAE,CAAC,wBAAwB,CAAC;6BAC5C;yBACF;qBACF;iBACF;aACF;SACF,CAAC;IACJ,CAAC;CACF;AA5PD,kDA4PC"}