@mapbox/mcp-server 0.13.0 → 0.15.0

package/dist/esm/utils/storeMapPayload.d.ts

@@ -20,11 +20,11 @@ export type MapAppRef = z.infer<typeof MapAppRefSchema>;
  * payloads (e.g. polygon-op chains). Passing a ref instead keeps the LLM's
  * emission down to a few tokens.
  *
- * `owner` must be the same account identifier (`getUserNameFromToken`) the
- * caller resolves for its own token — `TemporaryDataResource.read()` fails
- * closed on an unowned resource, so omitting this makes the ref permanently
- * unreadable via the real `resources/read` path the render iframe uses (it
- * always 404s), even though callers that read the manager directly (like
+ * `owner` must be the same ownership key (`getOwnerKeyFromToken`) the caller
+ * resolves for its own token — `TemporaryDataResource.read()` fails closed on
+ * an unowned resource, so omitting this makes the ref permanently unreadable
+ * via the real `resources/read` path the render iframe uses (it always 404s),
+ * even though callers that read the manager directly (like
  * `resolveMapPayloadRef`) wouldn't notice anything wrong.
  */
 export declare function storeMapPayload(payload: MapAppPayload, owner?: string): string;
@@ -54,12 +54,12 @@ export declare function buildMapboxRenderField(ref: string, payload: MapAppPaylo
 export declare function renderHint(ref: string): string;
 /**
  * Resolve a `mapbox://temp/map-payload-...` ref back to its `MapAppPayload`.
- * Returns null if the ref is unknown, expired, or owned by a different
- * account than `owner` — this is the same account-scoping enforced by
- * `TemporaryDataResource.read()` (a caller passing another account's ref
- * would otherwise have it silently merged and re-served under their own
- * ref, bypassing the read-side check entirely since this goes straight to
- * the manager rather than through `resources/read`).
+ * Returns null if the ref is unknown, expired, or owned by a key other than
+ * `owner` — this is the same token-scoping enforced by
+ * `TemporaryDataResource.read()` (a caller passing someone else's ref would
+ * otherwise have it silently merged and re-served under their own ref,
+ * bypassing the read-side check entirely since this goes straight to the
+ * manager rather than through `resources/read`).
  */
 export declare function resolveMapPayloadRef(ref: string, owner: string | undefined): MapAppPayload | null;
 /**

package/dist/esm/utils/storeMapPayload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storeMapPayload.d.ts","sourceRoot":"","sources":["../../../src/utils/storeMapPayload.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAMxD,eAAO,MAAM,wBAAwB,QAAY,CAAC;AAElD;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;iBAUzB,CAAC;AAEJ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAIxD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,aAAa,EACtB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAcR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,aAAa,GACrB;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAM1C;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,aAAa,GAAG,IAAI,CAMtB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,aAAa,CA8BzE"}
+{"version":3,"file":"storeMapPayload.d.ts","sourceRoot":"","sources":["../../../src/utils/storeMapPayload.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAMxD,eAAO,MAAM,wBAAwB,QAAY,CAAC;AAElD;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;iBAUzB,CAAC;AAEJ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAIxD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,aAAa,EACtB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAcR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,aAAa,GACrB;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAM1C;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,aAAa,GAAG,IAAI,CAMtB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,aAAa,CA8BzE"}

package/dist/esm/utils/storeMapPayload.js

@@ -3,6 +3,7 @@
 import { randomUUID } from 'node:crypto';
 import { z } from 'zod';
 import { temporaryResourceManager } from './temporaryResourceManager.js';
+import { ownerKeyMatches } from './jwtUtils.js';
 // Above this size, only the ref is included inline (the ref+resources/read
 // path still works for hosts that support it) - matches the 50KB threshold
 // already used elsewhere (e.g. the directions/isochrone large-response
@@ -31,11 +32,11 @@ const TEMP_URI_PREFIX = 'mapbox://temp/map-payload-';
  * payloads (e.g. polygon-op chains). Passing a ref instead keeps the LLM's
  * emission down to a few tokens.
  *
- * `owner` must be the same account identifier (`getUserNameFromToken`) the
- * caller resolves for its own token — `TemporaryDataResource.read()` fails
- * closed on an unowned resource, so omitting this makes the ref permanently
- * unreadable via the real `resources/read` path the render iframe uses (it
- * always 404s), even though callers that read the manager directly (like
+ * `owner` must be the same ownership key (`getOwnerKeyFromToken`) the caller
+ * resolves for its own token — `TemporaryDataResource.read()` fails closed on
+ * an unowned resource, so omitting this makes the ref permanently unreadable
+ * via the real `resources/read` path the render iframe uses (it always 404s),
+ * even though callers that read the manager directly (like
  * `resolveMapPayloadRef`) wouldn't notice anything wrong.
  */
 export function storeMapPayload(payload, owner) {
@@ -81,17 +82,17 @@ export function buildMapboxRenderField(ref, payload) {
  * URI — including the literal string in the visible text fixes that.)
  */
 export function renderHint(ref) {
-    return (`\n\n📍 To show this on a live Mapbox GL JS map, call:\n` +
+    return (`\n\n📍 To show this on a map, call render_map_tool (not static_map_image_tool) with this ref unchanged:\n` +
         `   render_map_tool({ "payload_refs": ["${ref}"] })`);
 }
 /**
  * Resolve a `mapbox://temp/map-payload-...` ref back to its `MapAppPayload`.
- * Returns null if the ref is unknown, expired, or owned by a different
- * account than `owner` — this is the same account-scoping enforced by
- * `TemporaryDataResource.read()` (a caller passing another account's ref
- * would otherwise have it silently merged and re-served under their own
- * ref, bypassing the read-side check entirely since this goes straight to
- * the manager rather than through `resources/read`).
+ * Returns null if the ref is unknown, expired, or owned by a key other than
+ * `owner` — this is the same token-scoping enforced by
+ * `TemporaryDataResource.read()` (a caller passing someone else's ref would
+ * otherwise have it silently merged and re-served under their own ref,
+ * bypassing the read-side check entirely since this goes straight to the
+ * manager rather than through `resources/read`).
  */
 export function resolveMapPayloadRef(ref, owner) {
     if (!ref.startsWith(TEMP_URI_PREFIX))
@@ -99,7 +100,7 @@ export function resolveMapPayloadRef(ref, owner) {
     const entry = temporaryResourceManager.get(ref);
     if (!entry || !entry.data)
         return null;
-    if (!entry.owner || !owner || entry.owner !== owner)
+    if (!ownerKeyMatches(entry.owner, owner))
         return null;
     return entry.data;
 }

package/dist/esm/utils/storeMapPayload.js.map

@@ -1 +1 @@
-{"version":3,"file":"storeMapPayload.js","sourceRoot":"","sources":["../../../src/utils/storeMapPayload.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAGzE,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,4DAA4D;AAC5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,QAAQ,CACP,6IAA6I,CAC9I;CACJ,CAAC;KACD,QAAQ,CACP,wHAAwH,CACzH,CAAC;AAIJ,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAErD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAsB,EACtB,KAAc;IAEd,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,EAAE,EAAE,CAAC;IACtC,sEAAsE;IACtE,sEAAsE;IACtE,0BAA0B;IAC1B,wBAAwB,CAAC,MAAM,CAAC;QAC9B,EAAE;QACF,GAAG;QACH,IAAI,EAAE,OAAO;QACb,KAAK;QACL,QAAQ,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;KACtC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAW,EACX,OAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IACpE,IAAI,QAAQ,GAAG,wBAAwB,EAAE,CAAC;QACxC,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,CACL,yDAAyD;QACzD,0CAA0C,GAAG,OAAO,CACrD,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,KAAyB;IAEzB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,KAAK,GAAG,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,KAAK,CAAC,IAAqB,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAyB;IACxD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAyC,EAAE,CAAC;IACxD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,SAAS,GAA4C,EAAE,CAAC;IAE9D,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,OAAO;YAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC7B,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;gBAClB,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,EAAE,GAAG,GAAG,KAAK,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC3D,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QACjE,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACjD,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC9C,SAAS,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACxD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"storeMapPayload.js","sourceRoot":"","sources":["../../../src/utils/storeMapPayload.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGhD,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,4DAA4D;AAC5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,QAAQ,CACP,6IAA6I,CAC9I;CACJ,CAAC;KACD,QAAQ,CACP,wHAAwH,CACzH,CAAC;AAIJ,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAErD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAsB,EACtB,KAAc;IAEd,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,EAAE,EAAE,CAAC;IACtC,sEAAsE;IACtE,sEAAsE;IACtE,0BAA0B;IAC1B,wBAAwB,CAAC,MAAM,CAAC;QAC9B,EAAE;QACF,GAAG;QACH,IAAI,EAAE,OAAO;QACb,KAAK;QACL,QAAQ,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;KACtC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAW,EACX,OAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IACpE,IAAI,QAAQ,GAAG,wBAAwB,EAAE,CAAC;QACxC,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,CACL,2GAA2G;QAC3G,0CAA0C,GAAG,OAAO,CACrD,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,KAAyB;IAEzB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,KAAK,GAAG,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,KAAK,CAAC,IAAqB,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAyB;IACxD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAyC,EAAE,CAAC;IACxD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,SAAS,GAA4C,EAAE,CAAC;IAE9D,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,OAAO;YAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC7B,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;gBAClB,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,EAAE,GAAG,GAAG,KAAK,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC3D,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QACjE,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACjD,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC9C,SAAS,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACxD,CAAC;AACJ,CAAC"}

package/dist/esm/utils/temporaryResourceManager.d.ts

@@ -13,10 +13,16 @@ export interface TemporaryResource {
     created: number;
     ttl: number;
     /**
-     * Account (Mapbox username) that created this resource. Reads are restricted
-     * to the same account so one account cannot read another account's temporary
-     * data. Undefined means no owner could be determined, in which case reads
-     * fail closed.
+     * Opaque ownership key for the token that created this resource — a SHA-256
+     * fingerprint of that token, produced by `getOwnerKeyFromToken`. Reads are
+     * restricted to a caller presenting the same token so one caller cannot read
+     * another's temporary data. Undefined means no owner could be determined, in
+     * which case reads fail closed.
+     *
+     * Deliberately NOT the Mapbox username: that comes from an unsigned, locally
+     * unverifiable `u` claim, so a username-scoped check could be defeated by
+     * fabricating a token asserting the victim's name. Never store or compare a
+     * username here.
      */
     owner?: string;
     metadata?: {

package/dist/esm/utils/temporaryResourceManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"temporaryResourceManager.d.ts","sourceRoot":"","sources":["../../../src/utils/temporaryResourceManager.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,qBAAa,wBAAwB;IAMjC,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,QAAQ;IANlB,OAAO,CAAC,SAAS,CAAwC;IACzD,OAAO,CAAC,eAAe,CAAC,CAAiB;IACzC,OAAO,CAAC,UAAU,CAAK;gBAGb,UAAU,GAAE,MAAuB,EAAE,aAAa;IAClD,QAAQ,GAAE,MAAyB;IAM7C;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE;QACb,EAAE,EAAE,MAAM,CAAC;QACX,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACzC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,iBAAiB;IAiCrB;;OAEG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAiB/C;;OAEG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQ5B;;OAEG;IACH,OAAO,IAAI,MAAM;IAejB;;OAEG;IACH,KAAK,IAAI,MAAM;IAIf;;OAEG;IACH,gBAAgB,IAAI,MAAM;IAI1B;;OAEG;IACH,KAAK,IAAI,IAAI;IAKb;;OAEG;IACH,OAAO,IAAI,IAAI;CAOhB;AAGD,eAAO,MAAM,wBAAwB,0BAAiC,CAAC"}
+{"version":3,"file":"temporaryResourceManager.d.ts","sourceRoot":"","sources":["../../../src/utils/temporaryResourceManager.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,qBAAa,wBAAwB;IAMjC,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,QAAQ;IANlB,OAAO,CAAC,SAAS,CAAwC;IACzD,OAAO,CAAC,eAAe,CAAC,CAAiB;IACzC,OAAO,CAAC,UAAU,CAAK;gBAGb,UAAU,GAAE,MAAuB,EAAE,aAAa;IAClD,QAAQ,GAAE,MAAyB;IAM7C;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE;QACb,EAAE,EAAE,MAAM,CAAC;QACX,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACzC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,iBAAiB;IAiCrB;;OAEG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAiB/C;;OAEG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQ5B;;OAEG;IACH,OAAO,IAAI,MAAM;IAejB;;OAEG;IACH,KAAK,IAAI,MAAM;IAIf;;OAEG;IACH,gBAAgB,IAAI,MAAM;IAI1B;;OAEG;IACH,KAAK,IAAI,IAAI;IAKb;;OAEG;IACH,OAAO,IAAI,IAAI;CAOhB;AAGD,eAAO,MAAM,wBAAwB,0BAAiC,CAAC"}

package/dist/esm/utils/temporaryResourceManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"temporaryResourceManager.js","sourceRoot":"","sources":["../../../src/utils/temporaryResourceManager.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AA8BlC,MAAM,OAAO,wBAAwB;IAMzB;IACA;IANF,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAC;IACjD,eAAe,CAAkB;IACjC,UAAU,GAAG,CAAC,CAAC;IAEvB,YACU,aAAqB,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IAClD,WAAmB,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,OAAO;;QAD3C,eAAU,GAAV,UAAU,CAAyB;QACnC,aAAQ,GAAR,QAAQ,CAA2B;QAE3C,8BAA8B;QAC9B,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1E,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,MAQN;QACC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QACjE,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEpD,0CAA0C;QAC1C,OACE,IAAI,CAAC,UAAU,GAAG,QAAQ,GAAG,IAAI,CAAC,QAAQ;YAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,EACvB,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC;YAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;YAC9C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GAAsB;YAClC,EAAE;YACF,GAAG;YACH,IAAI;YACJ,QAAQ;YACR,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;YACnB,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,UAAU;YAC3B,KAAK;YACL,QAAQ;SACT,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC;QAC5B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,GAAW;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC;YACrC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,GAAW;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACvD,IAAI,GAAG,GAAG,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAC1C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC3B,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC;gBACrC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;CACF;AAED,qBAAqB;AACrB,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,wBAAwB,EAAE,CAAC"}
+{"version":3,"file":"temporaryResourceManager.js","sourceRoot":"","sources":["../../../src/utils/temporaryResourceManager.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAoClC,MAAM,OAAO,wBAAwB;IAMzB;IACA;IANF,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAC;IACjD,eAAe,CAAkB;IACjC,UAAU,GAAG,CAAC,CAAC;IAEvB,YACU,aAAqB,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IAClD,WAAmB,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,OAAO;;QAD3C,eAAU,GAAV,UAAU,CAAyB;QACnC,aAAQ,GAAR,QAAQ,CAA2B;QAE3C,8BAA8B;QAC9B,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1E,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,MAQN;QACC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QACjE,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEpD,0CAA0C;QAC1C,OACE,IAAI,CAAC,UAAU,GAAG,QAAQ,GAAG,IAAI,CAAC,QAAQ;YAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,EACvB,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC;YAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;YAC9C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GAAsB;YAClC,EAAE;YACF,GAAG;YACH,IAAI;YACJ,QAAQ;YACR,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;YACnB,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,UAAU;YAC3B,KAAK;YACL,QAAQ;SACT,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC;QAC5B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,GAAW;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC;YACrC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,GAAW;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACvD,IAAI,GAAG,GAAG,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAC1C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC3B,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC;gBACrC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;CACF;AAED,qBAAqB;AACrB,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,wBAAwB,EAAE,CAAC"}

package/dist/esm/utils/tracing.d.ts

@@ -59,6 +59,10 @@ export declare function isTracingInitialized(): boolean;
  * Get the default tracer for the MCP server
  */
 export declare function getTracer(): import("@opentelemetry/api").Tracer;
+export declare function setClientInfo(info: {
+    name?: string;
+    version?: string;
+} | undefined): void;
 /**
  * Create a span for tool execution with comprehensive attributes
  */

package/dist/esm/utils/tracing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tracing.d.ts","sourceRoot":"","sources":["../../../src/utils/tracing.ts"],"names":[],"mappings":"AAWA,OAAO,EAIL,KAAK,IAAI,EAGV,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AA+B9C;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,IAAI,CAAC;IACX,cAAc,EAAE;QACd,UAAU,CAAC,EAAE,IAAI,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,IAAI,CAAC;IACX,cAAc,EAAE;QACd,UAAU,CAAC,EAAE,IAAI,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,yBAAyB,CAqB3B;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,WAAW,EACxB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,oBAAoB,CAsBtB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAoFvD;AAED;;GAEG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED;;GAEG;AACH,wBAAgB,SAAS,wCAExB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE;IACN,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,IAAI,CAkBN;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE;IACN,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,IAAI,CAkBN;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,IAAI,EACV,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GACrD,IAAI,CAMN;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK,GAAG,MAAM,EACrB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GACrD,IAAI,CAoBN;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;IACrD,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAmBA;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAMlD"}
+{"version":3,"file":"tracing.d.ts","sourceRoot":"","sources":["../../../src/utils/tracing.ts"],"names":[],"mappings":"AAWA,OAAO,EAIL,KAAK,IAAI,EAGV,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AA+B9C;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,IAAI,CAAC;IACX,cAAc,EAAE;QACd,UAAU,CAAC,EAAE,IAAI,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,IAAI,CAAC;IACX,cAAc,EAAE;QACd,UAAU,CAAC,EAAE,IAAI,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,yBAAyB,CAqB3B;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,WAAW,EACxB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,oBAAoB,CAsBtB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAsFvD;AAED;;GAEG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED;;GAEG;AACH,wBAAgB,SAAS,wCAExB;AAaD,wBAAgB,aAAa,CAC3B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GACpD,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE;IACN,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,IAAI,CAwBN;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE;IACN,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,IAAI,CAkBN;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,IAAI,EACV,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GACrD,IAAI,CAMN;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK,GAAG,MAAM,EACrB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GACrD,IAAI,CAoBN;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;IACrD,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAmBA;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAMlD"}

package/dist/esm/utils/tracing.js

@@ -7,6 +7,7 @@ import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from '@opentelemetry/semantic
 import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http';
 import { trace, SpanStatusCode, SpanKind, diag, DiagLogLevel } from '@opentelemetry/api';
 import { getVersionInfo } from './versionUtils.js';
+import { RedactingSpanExporter } from './redactingSpanExporter.js';
 import { ATTR_SERVICE_INSTANCE_ID } from '@opentelemetry/semantic-conventions/incubating';
 // Suppress OpenTelemetry diagnostic logging IMMEDIATELY to avoid polluting stdio
 // This must happen at module load time, before any OTEL operations
@@ -128,7 +129,9 @@ export async function initializeTracing() {
         // Create SDK instance
         sdk = new NodeSDK({
             resource,
-            traceExporter: exporters[0],
+            // Wrap the exporter so access tokens recorded in HTTP client span
+            // attributes (url.full, url.query) never reach the trace backend
+            traceExporter: new RedactingSpanExporter(exporters[0]),
             instrumentations: [
                 getNodeAutoInstrumentations({
                     // Disable instrumentations that might be too noisy
@@ -180,6 +183,19 @@ export function isTracingInitialized() {
 export function getTracer() {
     return trace.getTracer('mapbox-mcp-server');
 }
+/**
+ * The connected client's `clientInfo` (name/version), as reported in its
+ * `initialize` request. There is exactly one client per stdio server
+ * process, so this is safe as module-level state; set once via
+ * `setClientInfo` after the initialize handshake completes (see
+ * `server.server.oninitialized` in index.ts) and read by every tool span
+ * created afterward, so traces can be filtered/grouped by which MCP client
+ * (Claude Desktop, Cursor, VS Code, etc.) made the call.
+ */
+let currentClientInfo;
+export function setClientInfo(info) {
+    currentClientInfo = info;
+}
 /**
  * Create a span for tool execution with comprehensive attributes
  */
@@ -191,6 +207,12 @@ export function createToolSpan(toolName, inputSize, extra) {
             'tool.name': toolName,
             'tool.input.size': inputSize,
             'operation.type': 'tool_execution',
+            ...(currentClientInfo?.name && {
+                'mcp.client.name': currentClientInfo.name
+            }),
+            ...(currentClientInfo?.version && {
+                'mcp.client.version': currentClientInfo.version
+            }),
             ...(extra?.sessionId && { 'session.id': extra.sessionId }),
             ...(extra?.userId && { 'user.id': extra.userId }),
             ...(extra?.accountId && { 'account.id': extra.accountId }),

package/dist/esm/utils/tracing.js.map

@@ -1 +1 @@
-{"version":3,"file":"tracing.js","sourceRoot":"","sources":["../../../src/utils/tracing.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAElC,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,EACL,KAAK,EACL,cAAc,EACd,QAAQ,EAER,IAAI,EACJ,YAAY,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAG1F,iFAAiF;AACjF,mEAAmE;AACnE,iEAAiE;AACjE,MAAM,wBAAwB,GAAG,GAAG,EAAE;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc;QACzC,CAAC,CAAC,YAAY,CACV,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAA+B,CACtE;QACH,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC;IAEtB,IAAI,CAAC,SAAS,CACZ;QACE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;QACjB,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;QACf,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;KAChB,EACD,QAAQ,CACT,CAAC;AACJ,CAAC,CAAC;AAEF,4CAA4C;AAC5C,wBAAwB,EAAE,CAAC;AAE3B,sBAAsB;AACtB,IAAI,GAAG,GAAmB,IAAI,CAAC;AAC/B,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAmC7B;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAgB,EAChB,SAAiB,EACjB,KAA+B;IAE/B,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE;QAC/C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;QAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;QACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,cAAc,EAAE;YACd,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;YAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;YACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;SAChD;QACD,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAgB,EAChB,SAAiB,EACjB,WAAwB,EACxB,KAA+B;IAE/B,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE;QAC/C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;QAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;QACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,cAAc,EAAE;YACd,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;YAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;YACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;SAChD;QACD,WAAW;QACX,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,+EAA+E;IAC/E,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACjE,OAAO;IACT,CAAC;IAED,yCAAyC;IACzC,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,OAAO,EAAE,CAAC;QACjD,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IAErC,IAAI,CAAC;QACH,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,sBAAsB,CAAC;YACtC,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,WAAW,CAAC,IAAI;YACtE,CAAC,oBAAoB,CAAC,EAAE,WAAW,CAAC,OAAO;YAC3C,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS;YAC7D,iBAAiB,EAAE,WAAW,CAAC,GAAG;YAClC,oBAAoB,EAAE,WAAW,CAAC,MAAM;YACxC,iBAAiB,EAAE,WAAW,CAAC,GAAG;SACnC,CAAC,CAAC;QAEH,sBAAsB;QACtB,MAAM,SAAS,GAAG,EAAE,CAAC;QAErB,8DAA8D;QAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,MAAM,EAAE,CAAC;YACzD,MAAM,EAAE,mBAAmB,EAAE,GAC3B,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,oCAAoC;QACpC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;QAC7D,IAAI,YAAY,EAAE,CAAC;YACjB,SAAS,CAAC,IAAI,CACZ,IAAI,iBAAiB,CAAC;gBACpB,GAAG,EAAE,GAAG,YAAY,YAAY;gBAChC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;oBAC7C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;oBACpD,CAAC,CAAC,EAAE;aACP,CAAC,CACH,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,sBAAsB;QACtB,GAAG,GAAG,IAAI,OAAO,CAAC;YAChB,QAAQ;YACR,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;YAC3B,gBAAgB,EAAE;gBAChB,2BAA2B,CAAC;oBAC1B,mDAAmD;oBACnD,mCAAmC,EAAE;wBACnC,OAAO,EAAE,KAAK;qBACf;oBACD,oCAAoC,EAAE;wBACpC,OAAO,EAAE,KAAK;qBACf;oBACD,2DAA2D;oBAC3D,qCAAqC,EAAE;wBACrC,OAAO,EAAE,IAAI;qBACd;oBACD,iDAAiD;oBACjD,uCAAuC,EAAE;wBACvC,OAAO,EAAE,IAAI;qBACd;iBACF,CAAC;aACH;SACF,CAAC,CAAC;QAEH,gBAAgB;QAChB,GAAG,CAAC,KAAK,EAAE,CAAC;QACZ,gBAAgB,GAAG,IAAI,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,gBAAgB,GAAG,KAAK,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrB,GAAG,GAAG,IAAI,CAAC;QACX,gBAAgB,GAAG,KAAK,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,KAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,SAAiB,EACjB,KAMC;IAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,QAAQ,EAAE,EAAE;QAChD,IAAI,EAAE,QAAQ,CAAC,QAAQ;QACvB,UAAU,EAAE;YACV,WAAW,EAAE,QAAQ;YACrB,iBAAiB,EAAE,SAAS;YAC5B,gBAAgB,EAAE,gBAAgB;YAClC,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,EAAE,aAAa,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;YACvE,GAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SACxD;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,GAAW,EACX,KAIC;IAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE;QAC5D,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,UAAU,EAAE;YACV,aAAa,EAAE,MAAM;YACrB,UAAU,EAAE,GAAG;YACf,gBAAgB,EAAE,cAAc;YAChC,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,EAAE,aAAa,IAAI;gBAC1B,6BAA6B,EAAE,KAAK,CAAC,aAAa;aACnD,CAAC;YACF,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SAC3D;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAU,EACV,UAAsD;IAEtD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAU,EACV,KAAqB,EACrB,UAAsD;IAEtD,MAAM,YAAY,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACvE,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;IAE/D,IAAI,CAAC,aAAa,CAAC;QACjB,YAAY,EAAE,SAAS;QACvB,eAAe,EAAE,YAAY;QAC7B,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;KACtB,CAAC,CAAC;IAEH,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,SAAS,CAAC;QACb,IAAI,EAAE,cAAc,CAAC,KAAK;QAC1B,OAAO,EAAE,YAAY;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAIlD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,+BAA+B;IAC3D,CAAC;IAED,yDAAyD;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,CAAC;QACH,wEAAwE;QACxE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}
+{"version":3,"file":"tracing.js","sourceRoot":"","sources":["../../../src/utils/tracing.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAElC,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,EACL,KAAK,EACL,cAAc,EACd,QAAQ,EAER,IAAI,EACJ,YAAY,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAG1F,iFAAiF;AACjF,mEAAmE;AACnE,iEAAiE;AACjE,MAAM,wBAAwB,GAAG,GAAG,EAAE;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc;QACzC,CAAC,CAAC,YAAY,CACV,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAA+B,CACtE;QACH,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC;IAEtB,IAAI,CAAC,SAAS,CACZ;QACE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;QACjB,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;QACf,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;KAChB,EACD,QAAQ,CACT,CAAC;AACJ,CAAC,CAAC;AAEF,4CAA4C;AAC5C,wBAAwB,EAAE,CAAC;AAE3B,sBAAsB;AACtB,IAAI,GAAG,GAAmB,IAAI,CAAC;AAC/B,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAmC7B;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAgB,EAChB,SAAiB,EACjB,KAA+B;IAE/B,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE;QAC/C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;QAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;QACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,cAAc,EAAE;YACd,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;YAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;YACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;SAChD;QACD,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAgB,EAChB,SAAiB,EACjB,WAAwB,EACxB,KAA+B;IAE/B,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE;QAC/C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;QAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;QACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,cAAc,EAAE;YACd,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;YAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;YACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;SAChD;QACD,WAAW;QACX,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,+EAA+E;IAC/E,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACjE,OAAO;IACT,CAAC;IAED,yCAAyC;IACzC,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,OAAO,EAAE,CAAC;QACjD,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IAErC,IAAI,CAAC;QACH,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,sBAAsB,CAAC;YACtC,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,WAAW,CAAC,IAAI;YACtE,CAAC,oBAAoB,CAAC,EAAE,WAAW,CAAC,OAAO;YAC3C,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS;YAC7D,iBAAiB,EAAE,WAAW,CAAC,GAAG;YAClC,oBAAoB,EAAE,WAAW,CAAC,MAAM;YACxC,iBAAiB,EAAE,WAAW,CAAC,GAAG;SACnC,CAAC,CAAC;QAEH,sBAAsB;QACtB,MAAM,SAAS,GAAG,EAAE,CAAC;QAErB,8DAA8D;QAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,MAAM,EAAE,CAAC;YACzD,MAAM,EAAE,mBAAmB,EAAE,GAC3B,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,oCAAoC;QACpC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;QAC7D,IAAI,YAAY,EAAE,CAAC;YACjB,SAAS,CAAC,IAAI,CACZ,IAAI,iBAAiB,CAAC;gBACpB,GAAG,EAAE,GAAG,YAAY,YAAY;gBAChC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;oBAC7C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;oBACpD,CAAC,CAAC,EAAE;aACP,CAAC,CACH,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,sBAAsB;QACtB,GAAG,GAAG,IAAI,OAAO,CAAC;YAChB,QAAQ;YACR,kEAAkE;YAClE,iEAAiE;YACjE,aAAa,EAAE,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtD,gBAAgB,EAAE;gBAChB,2BAA2B,CAAC;oBAC1B,mDAAmD;oBACnD,mCAAmC,EAAE;wBACnC,OAAO,EAAE,KAAK;qBACf;oBACD,oCAAoC,EAAE;wBACpC,OAAO,EAAE,KAAK;qBACf;oBACD,2DAA2D;oBAC3D,qCAAqC,EAAE;wBACrC,OAAO,EAAE,IAAI;qBACd;oBACD,iDAAiD;oBACjD,uCAAuC,EAAE;wBACvC,OAAO,EAAE,IAAI;qBACd;iBACF,CAAC;aACH;SACF,CAAC,CAAC;QAEH,gBAAgB;QAChB,GAAG,CAAC,KAAK,EAAE,CAAC;QACZ,gBAAgB,GAAG,IAAI,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,gBAAgB,GAAG,KAAK,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrB,GAAG,GAAG,IAAI,CAAC;QACX,gBAAgB,GAAG,KAAK,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,KAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,IAAI,iBAAkE,CAAC;AAEvE,MAAM,UAAU,aAAa,CAC3B,IAAqD;IAErD,iBAAiB,GAAG,IAAI,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,SAAiB,EACjB,KAMC;IAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,QAAQ,EAAE,EAAE;QAChD,IAAI,EAAE,QAAQ,CAAC,QAAQ;QACvB,UAAU,EAAE;YACV,WAAW,EAAE,QAAQ;YACrB,iBAAiB,EAAE,SAAS;YAC5B,gBAAgB,EAAE,gBAAgB;YAClC,GAAG,CAAC,iBAAiB,EAAE,IAAI,IAAI;gBAC7B,iBAAiB,EAAE,iBAAiB,CAAC,IAAI;aAC1C,CAAC;YACF,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI;gBAChC,oBAAoB,EAAE,iBAAiB,CAAC,OAAO;aAChD,CAAC;YACF,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,EAAE,aAAa,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;YACvE,GAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SACxD;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,GAAW,EACX,KAIC;IAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE;QAC5D,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,UAAU,EAAE;YACV,aAAa,EAAE,MAAM;YACrB,UAAU,EAAE,GAAG;YACf,gBAAgB,EAAE,cAAc;YAChC,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,EAAE,aAAa,IAAI;gBAC1B,6BAA6B,EAAE,KAAK,CAAC,aAAa;aACnD,CAAC;YACF,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SAC3D;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAU,EACV,UAAsD;IAEtD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAU,EACV,KAAqB,EACrB,UAAsD;IAEtD,MAAM,YAAY,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACvE,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;IAE/D,IAAI,CAAC,aAAa,CAAC;QACjB,YAAY,EAAE,SAAS;QACvB,eAAe,EAAE,YAAY;QAC7B,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;KACtB,CAAC,CAAC;IAEH,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,SAAS,CAAC;QACb,IAAI,EAAE,cAAc,CAAC,KAAK;QAC1B,OAAO,EAAE,YAAY;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAIlD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,+BAA+B;IAC3D,CAAC;IAED,yDAAyD;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,CAAC;QACH,wEAAwE;QACxE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/esm/utils/urlSafety.d.ts

@@ -6,14 +6,30 @@
  * Rejects:
  *  - non-http(s) schemes (e.g. file:, gopher:, data:, javascript:)
  *  - non-https URLs (markers should always be fetched over TLS)
- *  - URLs whose host is an IP literal in a loopback, private, link-local,
- *    unique-local, or otherwise non-routable range (CWE-918 SSRF)
- *  - URLs whose host is a well-known local hostname
+ *  - IPv4/IPv6 literals outside ipaddr.js's plain "unicast" range —
+ *    deny-by-default, so loopback, private, link-local, multicast,
+ *    broadcast, CGNAT, reserved, and every IPv4-in-IPv6 transition/
+ *    translation mechanism (mapped, compatible, 6to4, NAT64, SIIT, Teredo,
+ *    AMT, ORCHID, etc.) are all rejected without needing to be named
+ *    individually (CWE-918 SSRF)
+ *  - well-known local hostnames, reserved local/internal-use suffixes
+ *    (.internal, .local, .arpa), and dotless single-label hostnames
  *
- * Note: we do not perform DNS resolution here — the upstream service will
- * still resolve the hostname when fetching. This validation is a defense in
- * depth against the most common SSRF vectors that prompt-injected agents
- * tend to produce (IP literals and "localhost").
+ * Out of scope, by design, for this pre-fetch string check — all three
+ * require validating the actual connection, not the URL string, so they
+ * belong where the fetch happens, not here:
+ *  - DNS rebinding (an ordinary hostname resolving to an internal address
+ *    at fetch time)
+ *  - port restriction
+ *  - network-specific hostname suffixes (.corp, .lan, .home, etc.) —
+ *    unlike .internal/.local/.arpa, these aren't globally reserved, so
+ *    they can't be enumerated in general
  */
 export declare function isSafeExternalUrl(rawUrl: string): boolean;
+/**
+ * Same validation as isSafeExternalUrl, but returns the parsed URL on
+ * success (null otherwise) so callers that need the WHATWG-canonical form
+ * of the validated URL don't have to re-parse the raw string.
+ */
+export declare function parseSafeExternalUrl(rawUrl: string): URL | null;
 //# sourceMappingURL=urlSafety.d.ts.map

package/dist/esm/utils/urlSafety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"urlSafety.d.ts","sourceRoot":"","sources":["../../../src/utils/urlSafety.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CA0EzD"}
+{"version":3,"file":"urlSafety.d.ts","sourceRoot":"","sources":["../../../src/utils/urlSafety.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAoF/D"}

package/dist/esm/utils/urlSafety.js

@@ -1,5 +1,6 @@
 // Copyright (c) Mapbox, Inc.
 // Licensed under the MIT License.
+import ipaddr from 'ipaddr.js';
 /**
  * Validates that a URL is safe for server-side fetching by an upstream service
  * (in particular, the Mapbox Static Images API which fetches custom marker
@@ -8,30 +9,55 @@
  * Rejects:
  *  - non-http(s) schemes (e.g. file:, gopher:, data:, javascript:)
  *  - non-https URLs (markers should always be fetched over TLS)
- *  - URLs whose host is an IP literal in a loopback, private, link-local,
- *    unique-local, or otherwise non-routable range (CWE-918 SSRF)
- *  - URLs whose host is a well-known local hostname
+ *  - IPv4/IPv6 literals outside ipaddr.js's plain "unicast" range —
+ *    deny-by-default, so loopback, private, link-local, multicast,
+ *    broadcast, CGNAT, reserved, and every IPv4-in-IPv6 transition/
+ *    translation mechanism (mapped, compatible, 6to4, NAT64, SIIT, Teredo,
+ *    AMT, ORCHID, etc.) are all rejected without needing to be named
+ *    individually (CWE-918 SSRF)
+ *  - well-known local hostnames, reserved local/internal-use suffixes
+ *    (.internal, .local, .arpa), and dotless single-label hostnames
  *
- * Note: we do not perform DNS resolution here — the upstream service will
- * still resolve the hostname when fetching. This validation is a defense in
- * depth against the most common SSRF vectors that prompt-injected agents
- * tend to produce (IP literals and "localhost").
+ * Out of scope, by design, for this pre-fetch string check — all three
+ * require validating the actual connection, not the URL string, so they
+ * belong where the fetch happens, not here:
+ *  - DNS rebinding (an ordinary hostname resolving to an internal address
+ *    at fetch time)
+ *  - port restriction
+ *  - network-specific hostname suffixes (.corp, .lan, .home, etc.) —
+ *    unlike .internal/.local/.arpa, these aren't globally reserved, so
+ *    they can't be enumerated in general
  */
 export function isSafeExternalUrl(rawUrl) {
+    return parseSafeExternalUrl(rawUrl) !== null;
+}
+/**
+ * Same validation as isSafeExternalUrl, but returns the parsed URL on
+ * success (null otherwise) so callers that need the WHATWG-canonical form
+ * of the validated URL don't have to re-parse the raw string.
+ */
+export function parseSafeExternalUrl(rawUrl) {
     let parsed;
     try {
         parsed = new URL(rawUrl);
     }
     catch {
-        return false;
+        return null;
     }
     if (parsed.protocol !== 'https:') {
-        return false;
+        return null;
     }
-    // Strip optional surrounding brackets from IPv6 literals
-    const host = parsed.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    // Strip optional surrounding brackets from IPv6 literals and a trailing
+    // root-label dot (e.g. "localhost." is equivalent to "localhost"). The
+    // dotless-hostname check further below relies on this running first —
+    // without it, "intranet." would still contain a dot and slip past that
+    // check.
+    const host = parsed.hostname
+        .replace(/^\[|\]$/g, '')
+        .replace(/\.$/, '')
+        .toLowerCase();
     if (host.length === 0) {
-        return false;
+        return null;
     }
     // Block well-known local hostnames
     const blockedHostnames = new Set([
@@ -40,62 +66,50 @@ export function isSafeExternalUrl(rawUrl) {
         'ip6-loopback',
         'broadcasthost'
     ]);
-    if (blockedHostnames.has(host) || host.endsWith('.localhost')) {
-        return false;
+    // Suffixes reserved for local/internal use that no public marker image
+    // host is ever legitimately under: cloud-internal DNS zones (.internal,
+    // used by GCP/AWS service discovery — covers metadata.google.internal,
+    // the GCP metadata endpoint's actual hostname), mDNS (.local), and
+    // reverse-DNS / home-network zones reserved by RFC 6761/8375 (.arpa
+    // covers .in-addr.arpa, .ip6.arpa, and .home.arpa as suffixes of it).
+    const blockedSuffixes = ['.localhost', '.internal', '.local', '.arpa'];
+    if (blockedHostnames.has(host) ||
+        blockedSuffixes.some((suffix) => host.endsWith(suffix))) {
+        return null;
     }
-    // IPv4 literal check (dotted quad)
-    const ipv4Match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
-    if (ipv4Match) {
-        const octets = ipv4Match.slice(1, 5).map((o) => Number(o));
-        if (octets.some((o) => o < 0 || o > 255)) {
-            return false;
-        }
-        const [a, b] = octets;
-        // 0.0.0.0/8, 10/8, 127/8
-        // 0.0.0.0/8 — "this network" (unspecified + reserved); block conservatively
-        if (a === 0 || a === 10 || a === 127)
-            return false;
-        // 169.254/16 (link-local, includes cloud metadata 169.254.169.254)
-        if (a === 169 && b === 254)
-            return false;
-        // 172.16/12
-        if (a === 172 && b >= 16 && b <= 31)
-            return false;
-        // 192.168/16
-        if (a === 192 && b === 168)
-            return false;
-        // 100.64/10 (CGNAT)
-        if (a === 100 && b >= 64 && b <= 127)
-            return false;
-        // 224/4 multicast and 240/4 reserved
-        if (a >= 224)
-            return false;
-        return true;
+    // If the host isn't a parseable IP literal at all, it's an ordinary
+    // hostname — allowed here (subject to the checks above), except that a
+    // public marker image host always has at least one dot; a dotless,
+    // single-label hostname only resolves via the fetcher's own network
+    // search-domain suffixing (e.g. "intranet", "metadata"), which is never
+    // the case for a legitimate external image URL. DNS rebinding on a
+    // multi-label hostname is out of scope for this pre-fetch check, see the
+    // module doc comment.
+    if (!ipaddr.isValid(host)) {
+        return host.includes('.') ? parsed : null;
+    }
+    const addr = ipaddr.parse(host);
+    // Deny by default for both IPv4 and IPv6: only plain global unicast
+    // addresses are allowed. Every other named range (private, loopback,
+    // link-local, multicast, broadcast, CGNAT, reserved, unique-local, and
+    // every IPv4-in-IPv6 transition/translation mechanism) is rejected,
+    // regardless of what it does or doesn't embed.
+    if (addr.range() !== 'unicast') {
+        return null;
     }
-    // IPv6 literal check (presence of ':' indicates IPv6 since IPv4 was handled)
-    if (host.includes(':')) {
-        // ::1 loopback, :: unspecified
-        if (host === '::1' || host === '::')
-            return false;
-        // fc00::/7 unique local (fc.. or fd..)
-        if (/^f[cd][0-9a-f]{2}:/.test(host))
-            return false;
-        // fe80::/10 link-local
-        if (/^fe[89ab][0-9a-f]:/.test(host))
-            return false;
-        // ff00::/8 multicast
-        if (/^ff[0-9a-f]{2}:/.test(host))
-            return false;
-        // IPv4-mapped / IPv4-compatible IPv6: ::ffff:a.b.c.d or ::a.b.c.d
-        // (Node's URL parser normalises ::ffff:127.0.0.1 to ::ffff:7f00:1, so
-        // detect the embedded IPv4 either as a dotted-quad or as the
-        // ::ffff:xxxx:xxxx hex form.)
-        if (/\d+\.\d+\.\d+\.\d+/.test(host))
-            return false;
-        if (/^::ffff:[0-9a-f]{1,4}:[0-9a-f]{1,4}$/.test(host))
-            return false;
-        return true;
+    if (addr.kind() === 'ipv6') {
+        // ipaddr.js does not classify the deprecated IPv4-compatible form
+        // (::a.b.c.d, i.e. the leading 96 bits all zero) as a special range
+        // when written in plain hex, which is exactly the form Node's URL
+        // parser normalises a dotted-quad IPv4-compatible literal to — so it
+        // reaches here as ordinary 'unicast' and needs an explicit check.
+        // (::1 and :: are already excluded above via the loopback/unspecified
+        // ranges, so this only affects addresses with a genuine embedded IPv4.)
+        const bytes = addr.toByteArray();
+        if (bytes.slice(0, 12).every((b) => b === 0)) {
+            return null;
+        }
     }
-    return true;
+    return parsed;
 }
 //# sourceMappingURL=urlSafety.js.map

package/dist/esm/utils/urlSafety.js.map

@@ -1 +1 @@
-{"version":3,"file":"urlSafety.js","sourceRoot":"","sources":["../../../src/utils/urlSafety.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAElC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,yDAAyD;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAEnE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mCAAmC;IACnC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;QAC/B,WAAW;QACX,eAAe;QACf,cAAc;QACd,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mCAAmC;IACnC,MAAM,SAAS,GAAG,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;QACtB,yBAAyB;QACzB,4EAA4E;QAC5E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACnD,mEAAmE;QACnE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACzC,YAAY;QACZ,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;QAClD,aAAa;QACb,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACzC,oBAAoB;QACpB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC;QACnD,qCAAqC;QACrC,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,+BAA+B;QAC/B,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAClD,uCAAuC;QACvC,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,uBAAuB;QACvB,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,qBAAqB;QACrB,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,kEAAkE;QAClE,sEAAsE;QACtE,6DAA6D;QAC7D,8BAA8B;QAC9B,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"urlSafety.js","sourceRoot":"","sources":["../../../src/utils/urlSafety.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAElC,OAAO,MAAM,MAAM,WAAW,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,oBAAoB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,SAAS;IACT,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ;SACzB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,WAAW,EAAE,CAAC;IAEjB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mCAAmC;IACnC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;QAC/B,WAAW;QACX,eAAe;QACf,cAAc;QACd,eAAe;KAChB,CAAC,CAAC;IACH,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,mEAAmE;IACnE,oEAAoE;IACpE,sEAAsE;IACtE,MAAM,eAAe,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvE,IACE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;QAC1B,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EACvD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,mEAAmE;IACnE,oEAAoE;IACpE,wEAAwE;IACxE,mEAAmE;IACnE,yEAAyE;IACzE,sBAAsB;IACtB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEhC,oEAAoE;IACpE,qEAAqE;IACrE,uEAAuE;IACvE,oEAAoE;IACpE,+CAA+C;IAC/C,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;QAC3B,kEAAkE;QAClE,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/esm/version.json

@@ -1,6 +1,6 @@
 {
-  "sha": "88ba37c5e1013138c5baea75c8db90e8ae8731b1",
-  "tag": "v0.12.7-4-g88ba37c",
+  "sha": "9c8813eadef3e523a7f995ca87e1ed892933a2b9",
+  "tag": "v0.14.0-16-g9c8813e",
   "branch": "HEAD",
-  "version": "0.13.0"
+  "version": "0.15.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mapbox/mcp-server",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Mapbox MCP server.",
   "mcpName": "io.github.mapbox/mcp-server",
   "main": "./dist/commonjs/index.js",
@@ -78,7 +78,7 @@
   ],
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^1.1.1",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/auto-instrumentations-node": "^0.74.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.216.0",
@@ -88,6 +88,7 @@
     "@opentelemetry/sdk-trace-base": "^2.7.1",
     "@opentelemetry/semantic-conventions": "^1.40.0",
     "@turf/turf": "^7.3.1",
+    "ipaddr.js": "^2.4.0",
     "patch-package": "^8.0.1",
     "zod": "^4.3.6"
   },

package/patches/{@modelcontextprotocol+sdk+1.29.0.patch → @modelcontextprotocol+sdk+1.30.0.patch}

@@ -1,6 +1,8 @@
+diff --git a/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/mcp.js b/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/mcp.js
+index 9e1c874..2de8d57 100644
 --- a/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/mcp.js
 +++ b/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/mcp.js
-@@ -197,15 +197,20 @@
+@@ -197,15 +197,20 @@ class McpServer {
              return;
          }
          if (!result.structuredContent) {
@@ -29,9 +31,11 @@
          }
      }
      /**
+diff --git a/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js b/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+index 2314d88..94aaef1 100644
 --- a/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
 +++ b/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
-@@ -194,15 +194,20 @@
+@@ -194,15 +194,20 @@ export class McpServer {
              return;
          }
          if (!result.structuredContent) {

package/dist/commonjs/resources/ui-apps/StaticMapUIResource.d.ts

@@ -1,15 +0,0 @@
-import type { RequestHandlerExtra } from '@modelcontextprotocol/sdk/shared/protocol.js';
-import type { ReadResourceResult, ServerNotification, ServerRequest } from '@modelcontextprotocol/sdk/types.js';
-import { BaseResource } from '../BaseResource.js';
-/**
- * Serves UI App HTML for Static Map Preview
- * Implements MCP Apps pattern with ui:// scheme
- */
-export declare class StaticMapUIResource extends BaseResource {
-    readonly name = "Static Map Preview UI";
-    readonly uri = "ui://mapbox/static-map/index.html";
-    readonly description = "Interactive UI for previewing static map images (MCP Apps)";
-    readonly mimeType = "text/html;profile=mcp-app";
-    read(_uri: string, _extra?: RequestHandlerExtra<ServerRequest, ServerNotification>): Promise<ReadResourceResult>;
-}
-//# sourceMappingURL=StaticMapUIResource.d.ts.map