@mapbox/mcp-server 0.13.0 → 0.15.0

package/dist/commonjs/utils/selfFetchRef.js.map

@@ -1 +1 @@
-{"version":3,"file":"selfFetchRef.js","sourceRoot":"","sources":["../../../src/utils/selfFetchRef.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;AA6BlC,8CAQC;AAED,wCAEC;AAUD,kDA2BC;AA1ED,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAIpD,MAAM,gBAAgB,GAA6B;IACjD,YAAY;IACZ,WAAW;IACX,cAAc;IACd,QAAQ;IACR,iBAAiB;IACjB,cAAc;IACd,iBAAiB;CAClB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,SAAgB,iBAAiB,CAC/B,IAAmB,EACnB,MAA+B;IAE/B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAC/D,WAAW,CACZ,CAAC;IACF,OAAO,GAAG,qBAAqB,GAAG,IAAI,SAAS,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,SAAgB,cAAc,CAAC,GAAW;IACxC,OAAO,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,GAAW;IAC7C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,IAAI,IAAY,CAAC;IACjB,IAAI,OAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAqB,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnE,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEvD,OAAO;QACL,MAAM,EAAE,EAAE;QACV,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAqB,EAAE,MAAM,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"selfFetchRef.js","sourceRoot":"","sources":["../../../src/utils/selfFetchRef.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;AA6BlC,8CAQC;AA4CD,wCAEC;AAUD,kDA4BC;AArHD,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAIpD,MAAM,gBAAgB,GAA6B;IACjD,YAAY;IACZ,WAAW;IACX,cAAc;IACd,QAAQ;IACR,iBAAiB;IACjB,cAAc;IACd,iBAAiB;CAClB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,SAAgB,iBAAiB,CAC/B,IAAmB,EACnB,MAA+B;IAE/B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAC/D,WAAW,CACZ,CAAC;IACF,OAAO,GAAG,qBAAqB,GAAG,IAAI,SAAS,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAChE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,uBAAuB,CAC9B,IAAmB,EACnB,MAA+B;IAE/B,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,CAAC,WAET,CAAC;QACd,IACE,CAAC,MAAM;YACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YACpC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EACnC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CACL,qBAAqB,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAC9C,qBAAqB,CAAC,MAAM,CAAC,eAAe,CAAC,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,cAAc,CAAC,GAAW;IACxC,OAAO,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,GAAW;IAC7C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,IAAI,IAAY,CAAC;IACjB,IAAI,OAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAqB,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnE,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC,uBAAuB,CAAC,IAAqB,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzE,OAAO;QACL,MAAM,EAAE,EAAE;QACV,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAqB,EAAE,MAAM,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC"}

package/dist/commonjs/utils/serverInstructions.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Server-level `instructions` returned from `initialize`.
+ *
+ * Hosts that load tools lazily (Claude Desktop, Claude Code) list only tool
+ * names until the model loads a tool, so tool descriptions can't steer
+ * which tool gets picked — e.g. a model asked to "show a map" loaded
+ * static_map_image_tool because of its name and never saw
+ * render_map_tool's "ALWAYS use this tool to display maps". Server
+ * instructions are shown up front, so the routing rule lives here.
+ */
+export declare function buildServerInstructions(enabledToolNames: readonly string[]): string | undefined;
+//# sourceMappingURL=serverInstructions.d.ts.map

package/dist/commonjs/utils/serverInstructions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverInstructions.d.ts","sourceRoot":"","sources":["../../../src/utils/serverInstructions.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,gBAAgB,EAAE,SAAS,MAAM,EAAE,GAClC,MAAM,GAAG,SAAS,CAYpB"}

package/dist/commonjs/utils/serverInstructions.js

@@ -0,0 +1,28 @@
+"use strict";
+// Copyright (c) Mapbox, Inc.
+// Licensed under the MIT License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildServerInstructions = buildServerInstructions;
+/**
+ * Server-level `instructions` returned from `initialize`.
+ *
+ * Hosts that load tools lazily (Claude Desktop, Claude Code) list only tool
+ * names until the model loads a tool, so tool descriptions can't steer
+ * which tool gets picked — e.g. a model asked to "show a map" loaded
+ * static_map_image_tool because of its name and never saw
+ * render_map_tool's "ALWAYS use this tool to display maps". Server
+ * instructions are shown up front, so the routing rule lives here.
+ */
+function buildServerInstructions(enabledToolNames) {
+    if (!enabledToolNames.includes('render_map_tool'))
+        return undefined;
+    const lines = [
+        'To show anything on a map, use render_map_tool: it renders an interactive Mapbox GL JS map inline.',
+        'When a tool result includes mapboxRender.ref, pass that ref unchanged in render_map_tool payload_refs (several refs can share one map). Never write or edit a ref by hand.'
+    ];
+    if (enabledToolNames.includes('static_map_image_tool')) {
+        lines.push('Use static_map_image_tool only when the user explicitly asks for a static image file (PNG/JPEG), never as the default way to show a map.');
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=serverInstructions.js.map

package/dist/commonjs/utils/serverInstructions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverInstructions.js","sourceRoot":"","sources":["../../../src/utils/serverInstructions.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;AAYlC,0DAcC;AAxBD;;;;;;;;;GASG;AACH,SAAgB,uBAAuB,CACrC,gBAAmC;IAEnC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,KAAK,GAAG;QACZ,oGAAoG;QACpG,4KAA4K;KAC7K,CAAC;IACF,IAAI,gBAAgB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACvD,KAAK,CAAC,IAAI,CACR,0IAA0I,CAC3I,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/commonjs/utils/storeMapPayload.d.ts

@@ -20,11 +20,11 @@ export type MapAppRef = z.infer<typeof MapAppRefSchema>;
  * payloads (e.g. polygon-op chains). Passing a ref instead keeps the LLM's
  * emission down to a few tokens.
  *
- * `owner` must be the same account identifier (`getUserNameFromToken`) the
- * caller resolves for its own token — `TemporaryDataResource.read()` fails
- * closed on an unowned resource, so omitting this makes the ref permanently
- * unreadable via the real `resources/read` path the render iframe uses (it
- * always 404s), even though callers that read the manager directly (like
+ * `owner` must be the same ownership key (`getOwnerKeyFromToken`) the caller
+ * resolves for its own token — `TemporaryDataResource.read()` fails closed on
+ * an unowned resource, so omitting this makes the ref permanently unreadable
+ * via the real `resources/read` path the render iframe uses (it always 404s),
+ * even though callers that read the manager directly (like
  * `resolveMapPayloadRef`) wouldn't notice anything wrong.
  */
 export declare function storeMapPayload(payload: MapAppPayload, owner?: string): string;
@@ -54,12 +54,12 @@ export declare function buildMapboxRenderField(ref: string, payload: MapAppPaylo
 export declare function renderHint(ref: string): string;
 /**
  * Resolve a `mapbox://temp/map-payload-...` ref back to its `MapAppPayload`.
- * Returns null if the ref is unknown, expired, or owned by a different
- * account than `owner` — this is the same account-scoping enforced by
- * `TemporaryDataResource.read()` (a caller passing another account's ref
- * would otherwise have it silently merged and re-served under their own
- * ref, bypassing the read-side check entirely since this goes straight to
- * the manager rather than through `resources/read`).
+ * Returns null if the ref is unknown, expired, or owned by a key other than
+ * `owner` — this is the same token-scoping enforced by
+ * `TemporaryDataResource.read()` (a caller passing someone else's ref would
+ * otherwise have it silently merged and re-served under their own ref,
+ * bypassing the read-side check entirely since this goes straight to the
+ * manager rather than through `resources/read`).
  */
 export declare function resolveMapPayloadRef(ref: string, owner: string | undefined): MapAppPayload | null;
 /**

package/dist/commonjs/utils/storeMapPayload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storeMapPayload.d.ts","sourceRoot":"","sources":["../../../src/utils/storeMapPayload.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAMxD,eAAO,MAAM,wBAAwB,QAAY,CAAC;AAElD;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;iBAUzB,CAAC;AAEJ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAIxD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,aAAa,EACtB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAcR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,aAAa,GACrB;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAM1C;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,aAAa,GAAG,IAAI,CAMtB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,aAAa,CA8BzE"}
+{"version":3,"file":"storeMapPayload.d.ts","sourceRoot":"","sources":["../../../src/utils/storeMapPayload.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAMxD,eAAO,MAAM,wBAAwB,QAAY,CAAC;AAElD;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;iBAUzB,CAAC;AAEJ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAIxD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,aAAa,EACtB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAcR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,aAAa,GACrB;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAM1C;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,aAAa,GAAG,IAAI,CAMtB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,aAAa,CA8BzE"}

package/dist/commonjs/utils/storeMapPayload.js

@@ -11,6 +11,7 @@ exports.mergeMapPayloads = mergeMapPayloads;
 const node_crypto_1 = require("node:crypto");
 const zod_1 = require("zod");
 const temporaryResourceManager_js_1 = require("./temporaryResourceManager.js");
+const jwtUtils_js_1 = require("./jwtUtils.js");
 // Above this size, only the ref is included inline (the ref+resources/read
 // path still works for hosts that support it) - matches the 50KB threshold
 // already used elsewhere (e.g. the directions/isochrone large-response
@@ -39,11 +40,11 @@ const TEMP_URI_PREFIX = 'mapbox://temp/map-payload-';
  * payloads (e.g. polygon-op chains). Passing a ref instead keeps the LLM's
  * emission down to a few tokens.
  *
- * `owner` must be the same account identifier (`getUserNameFromToken`) the
- * caller resolves for its own token — `TemporaryDataResource.read()` fails
- * closed on an unowned resource, so omitting this makes the ref permanently
- * unreadable via the real `resources/read` path the render iframe uses (it
- * always 404s), even though callers that read the manager directly (like
+ * `owner` must be the same ownership key (`getOwnerKeyFromToken`) the caller
+ * resolves for its own token — `TemporaryDataResource.read()` fails closed on
+ * an unowned resource, so omitting this makes the ref permanently unreadable
+ * via the real `resources/read` path the render iframe uses (it always 404s),
+ * even though callers that read the manager directly (like
  * `resolveMapPayloadRef`) wouldn't notice anything wrong.
  */
 function storeMapPayload(payload, owner) {
@@ -89,17 +90,17 @@ function buildMapboxRenderField(ref, payload) {
  * URI — including the literal string in the visible text fixes that.)
  */
 function renderHint(ref) {
-    return (`\n\n📍 To show this on a live Mapbox GL JS map, call:\n` +
+    return (`\n\n📍 To show this on a map, call render_map_tool (not static_map_image_tool) with this ref unchanged:\n` +
         `   render_map_tool({ "payload_refs": ["${ref}"] })`);
 }
 /**
  * Resolve a `mapbox://temp/map-payload-...` ref back to its `MapAppPayload`.
- * Returns null if the ref is unknown, expired, or owned by a different
- * account than `owner` — this is the same account-scoping enforced by
- * `TemporaryDataResource.read()` (a caller passing another account's ref
- * would otherwise have it silently merged and re-served under their own
- * ref, bypassing the read-side check entirely since this goes straight to
- * the manager rather than through `resources/read`).
+ * Returns null if the ref is unknown, expired, or owned by a key other than
+ * `owner` — this is the same token-scoping enforced by
+ * `TemporaryDataResource.read()` (a caller passing someone else's ref would
+ * otherwise have it silently merged and re-served under their own ref,
+ * bypassing the read-side check entirely since this goes straight to the
+ * manager rather than through `resources/read`).
  */
 function resolveMapPayloadRef(ref, owner) {
     if (!ref.startsWith(TEMP_URI_PREFIX))
@@ -107,7 +108,7 @@ function resolveMapPayloadRef(ref, owner) {
     const entry = temporaryResourceManager_js_1.temporaryResourceManager.get(ref);
     if (!entry || !entry.data)
         return null;
-    if (!entry.owner || !owner || entry.owner !== owner)
+    if (!(0, jwtUtils_js_1.ownerKeyMatches)(entry.owner, owner))
         return null;
     return entry.data;
 }

package/dist/commonjs/utils/storeMapPayload.js.map

@@ -1 +1 @@
-{"version":3,"file":"storeMapPayload.js","sourceRoot":"","sources":["../../../src/utils/storeMapPayload.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;;AAmDlC,0CAiBC;AAeD,wDASC;AASD,gCAKC;AAWD,oDASC;AAOD,4CA8BC;AAjKD,6CAAyC;AACzC,6BAAwB;AACxB,+EAAyE;AAGzE,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,4DAA4D;AAC/C,QAAA,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD;;;;;GAKG;AACU,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,GAAG,EAAE,OAAC;SACH,MAAM,EAAE;SACR,QAAQ,CACP,6IAA6I,CAC9I;CACJ,CAAC;KACD,QAAQ,CACP,wHAAwH,CACzH,CAAC;AAIJ,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAErD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,eAAe,CAC7B,OAAsB,EACtB,KAAc;IAEd,MAAM,EAAE,GAAG,IAAA,wBAAU,GAAE,CAAC;IACxB,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,EAAE,EAAE,CAAC;IACtC,sEAAsE;IACtE,sEAAsE;IACtE,0BAA0B;IAC1B,sDAAwB,CAAC,MAAM,CAAC;QAC9B,EAAE;QACF,GAAG;QACH,IAAI,EAAE,OAAO;QACb,KAAK;QACL,QAAQ,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;KACtC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,sBAAsB,CACpC,GAAW,EACX,OAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IACpE,IAAI,QAAQ,GAAG,gCAAwB,EAAE,CAAC;QACxC,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,UAAU,CAAC,GAAW;IACpC,OAAO,CACL,yDAAyD;QACzD,0CAA0C,GAAG,OAAO,CACrD,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAClC,GAAW,EACX,KAAyB;IAEzB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,KAAK,GAAG,sDAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,KAAK,CAAC,IAAqB,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,QAAyB;IACxD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAyC,EAAE,CAAC;IACxD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,SAAS,GAA4C,EAAE,CAAC;IAE9D,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,OAAO;YAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC7B,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;gBAClB,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,EAAE,GAAG,GAAG,KAAK,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC3D,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QACjE,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACjD,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC9C,SAAS,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACxD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"storeMapPayload.js","sourceRoot":"","sources":["../../../src/utils/storeMapPayload.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;;AAoDlC,0CAiBC;AAeD,wDASC;AASD,gCAKC;AAWD,oDASC;AAOD,4CA8BC;AAlKD,6CAAyC;AACzC,6BAAwB;AACxB,+EAAyE;AACzE,+CAAgD;AAGhD,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,4DAA4D;AAC/C,QAAA,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD;;;;;GAKG;AACU,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,GAAG,EAAE,OAAC;SACH,MAAM,EAAE;SACR,QAAQ,CACP,6IAA6I,CAC9I;CACJ,CAAC;KACD,QAAQ,CACP,wHAAwH,CACzH,CAAC;AAIJ,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAErD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,eAAe,CAC7B,OAAsB,EACtB,KAAc;IAEd,MAAM,EAAE,GAAG,IAAA,wBAAU,GAAE,CAAC;IACxB,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,EAAE,EAAE,CAAC;IACtC,sEAAsE;IACtE,sEAAsE;IACtE,0BAA0B;IAC1B,sDAAwB,CAAC,MAAM,CAAC;QAC9B,EAAE;QACF,GAAG;QACH,IAAI,EAAE,OAAO;QACb,KAAK;QACL,QAAQ,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;KACtC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,sBAAsB,CACpC,GAAW,EACX,OAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IACpE,IAAI,QAAQ,GAAG,gCAAwB,EAAE,CAAC;QACxC,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,UAAU,CAAC,GAAW;IACpC,OAAO,CACL,2GAA2G;QAC3G,0CAA0C,GAAG,OAAO,CACrD,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAClC,GAAW,EACX,KAAyB;IAEzB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,KAAK,GAAG,sDAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC,IAAA,6BAAe,EAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,KAAK,CAAC,IAAqB,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,QAAyB;IACxD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAyC,EAAE,CAAC;IACxD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,SAAS,GAA4C,EAAE,CAAC;IAE9D,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,OAAO;YAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC7B,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;gBAClB,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,EAAE,GAAG,GAAG,KAAK,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC3D,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QACjE,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACjD,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC9C,SAAS,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACxD,CAAC;AACJ,CAAC"}

package/dist/commonjs/utils/temporaryResourceManager.d.ts

@@ -13,10 +13,16 @@ export interface TemporaryResource {
     created: number;
     ttl: number;
     /**
-     * Account (Mapbox username) that created this resource. Reads are restricted
-     * to the same account so one account cannot read another account's temporary
-     * data. Undefined means no owner could be determined, in which case reads
-     * fail closed.
+     * Opaque ownership key for the token that created this resource — a SHA-256
+     * fingerprint of that token, produced by `getOwnerKeyFromToken`. Reads are
+     * restricted to a caller presenting the same token so one caller cannot read
+     * another's temporary data. Undefined means no owner could be determined, in
+     * which case reads fail closed.
+     *
+     * Deliberately NOT the Mapbox username: that comes from an unsigned, locally
+     * unverifiable `u` claim, so a username-scoped check could be defeated by
+     * fabricating a token asserting the victim's name. Never store or compare a
+     * username here.
      */
     owner?: string;
     metadata?: {

package/dist/commonjs/utils/temporaryResourceManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"temporaryResourceManager.d.ts","sourceRoot":"","sources":["../../../src/utils/temporaryResourceManager.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,qBAAa,wBAAwB;IAMjC,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,QAAQ;IANlB,OAAO,CAAC,SAAS,CAAwC;IACzD,OAAO,CAAC,eAAe,CAAC,CAAiB;IACzC,OAAO,CAAC,UAAU,CAAK;gBAGb,UAAU,GAAE,MAAuB,EAAE,aAAa;IAClD,QAAQ,GAAE,MAAyB;IAM7C;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE;QACb,EAAE,EAAE,MAAM,CAAC;QACX,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACzC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,iBAAiB;IAiCrB;;OAEG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAiB/C;;OAEG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQ5B;;OAEG;IACH,OAAO,IAAI,MAAM;IAejB;;OAEG;IACH,KAAK,IAAI,MAAM;IAIf;;OAEG;IACH,gBAAgB,IAAI,MAAM;IAI1B;;OAEG;IACH,KAAK,IAAI,IAAI;IAKb;;OAEG;IACH,OAAO,IAAI,IAAI;CAOhB;AAGD,eAAO,MAAM,wBAAwB,0BAAiC,CAAC"}
+{"version":3,"file":"temporaryResourceManager.d.ts","sourceRoot":"","sources":["../../../src/utils/temporaryResourceManager.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,qBAAa,wBAAwB;IAMjC,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,QAAQ;IANlB,OAAO,CAAC,SAAS,CAAwC;IACzD,OAAO,CAAC,eAAe,CAAC,CAAiB;IACzC,OAAO,CAAC,UAAU,CAAK;gBAGb,UAAU,GAAE,MAAuB,EAAE,aAAa;IAClD,QAAQ,GAAE,MAAyB;IAM7C;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE;QACb,EAAE,EAAE,MAAM,CAAC;QACX,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACzC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,iBAAiB;IAiCrB;;OAEG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAiB/C;;OAEG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQ5B;;OAEG;IACH,OAAO,IAAI,MAAM;IAejB;;OAEG;IACH,KAAK,IAAI,MAAM;IAIf;;OAEG;IACH,gBAAgB,IAAI,MAAM;IAI1B;;OAEG;IACH,KAAK,IAAI,IAAI;IAKb;;OAEG;IACH,OAAO,IAAI,IAAI;CAOhB;AAGD,eAAO,MAAM,wBAAwB,0BAAiC,CAAC"}

package/dist/commonjs/utils/temporaryResourceManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"temporaryResourceManager.js","sourceRoot":"","sources":["../../../src/utils/temporaryResourceManager.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;;AA8BlC,MAAa,wBAAwB;IAMzB;IACA;IANF,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAC;IACjD,eAAe,CAAkB;IACjC,UAAU,GAAG,CAAC,CAAC;IAEvB,YACU,aAAqB,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IAClD,WAAmB,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,OAAO;;QAD3C,eAAU,GAAV,UAAU,CAAyB;QACnC,aAAQ,GAAR,QAAQ,CAA2B;QAE3C,8BAA8B;QAC9B,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1E,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,MAQN;QACC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QACjE,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEpD,0CAA0C;QAC1C,OACE,IAAI,CAAC,UAAU,GAAG,QAAQ,GAAG,IAAI,CAAC,QAAQ;YAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,EACvB,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC;YAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;YAC9C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GAAsB;YAClC,EAAE;YACF,GAAG;YACH,IAAI;YACJ,QAAQ;YACR,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;YACnB,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,UAAU;YAC3B,KAAK;YACL,QAAQ;SACT,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC;QAC5B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,GAAW;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC;YACrC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,GAAW;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACvD,IAAI,GAAG,GAAG,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAC1C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC3B,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC;gBACrC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;CACF;AA3ID,4DA2IC;AAED,qBAAqB;AACR,QAAA,wBAAwB,GAAG,IAAI,wBAAwB,EAAE,CAAC"}
+{"version":3,"file":"temporaryResourceManager.js","sourceRoot":"","sources":["../../../src/utils/temporaryResourceManager.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;;AAoClC,MAAa,wBAAwB;IAMzB;IACA;IANF,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAC;IACjD,eAAe,CAAkB;IACjC,UAAU,GAAG,CAAC,CAAC;IAEvB,YACU,aAAqB,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IAClD,WAAmB,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,OAAO;;QAD3C,eAAU,GAAV,UAAU,CAAyB;QACnC,aAAQ,GAAR,QAAQ,CAA2B;QAE3C,8BAA8B;QAC9B,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1E,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,MAQN;QACC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QACjE,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEpD,0CAA0C;QAC1C,OACE,IAAI,CAAC,UAAU,GAAG,QAAQ,GAAG,IAAI,CAAC,QAAQ;YAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,EACvB,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC;YAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;YAC9C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GAAsB;YAClC,EAAE;YACF,GAAG;YACH,IAAI;YACJ,QAAQ;YACR,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;YACnB,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,UAAU;YAC3B,KAAK;YACL,QAAQ;SACT,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC;QAC5B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,GAAW;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC;YACrC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,GAAW;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACvD,IAAI,GAAG,GAAG,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAC1C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC3B,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC;gBACrC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;CACF;AA3ID,4DA2IC;AAED,qBAAqB;AACR,QAAA,wBAAwB,GAAG,IAAI,wBAAwB,EAAE,CAAC"}

package/dist/commonjs/utils/tracing.d.ts

@@ -59,6 +59,10 @@ export declare function isTracingInitialized(): boolean;
  * Get the default tracer for the MCP server
  */
 export declare function getTracer(): import("@opentelemetry/api").Tracer;
+export declare function setClientInfo(info: {
+    name?: string;
+    version?: string;
+} | undefined): void;
 /**
  * Create a span for tool execution with comprehensive attributes
  */

package/dist/commonjs/utils/tracing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tracing.d.ts","sourceRoot":"","sources":["../../../src/utils/tracing.ts"],"names":[],"mappings":"AAWA,OAAO,EAIL,KAAK,IAAI,EAGV,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AA+B9C;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,IAAI,CAAC;IACX,cAAc,EAAE;QACd,UAAU,CAAC,EAAE,IAAI,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,IAAI,CAAC;IACX,cAAc,EAAE;QACd,UAAU,CAAC,EAAE,IAAI,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,yBAAyB,CAqB3B;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,WAAW,EACxB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,oBAAoB,CAsBtB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAoFvD;AAED;;GAEG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED;;GAEG;AACH,wBAAgB,SAAS,wCAExB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE;IACN,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,IAAI,CAkBN;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE;IACN,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,IAAI,CAkBN;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,IAAI,EACV,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GACrD,IAAI,CAMN;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK,GAAG,MAAM,EACrB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GACrD,IAAI,CAoBN;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;IACrD,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAmBA;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAMlD"}
+{"version":3,"file":"tracing.d.ts","sourceRoot":"","sources":["../../../src/utils/tracing.ts"],"names":[],"mappings":"AAWA,OAAO,EAIL,KAAK,IAAI,EAGV,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AA+B9C;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,IAAI,CAAC;IACX,cAAc,EAAE;QACd,UAAU,CAAC,EAAE,IAAI,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,IAAI,CAAC;IACX,cAAc,EAAE;QACd,UAAU,CAAC,EAAE,IAAI,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,yBAAyB,CAqB3B;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,WAAW,EACxB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,oBAAoB,CAsBtB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAsFvD;AAED;;GAEG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED;;GAEG;AACH,wBAAgB,SAAS,wCAExB;AAaD,wBAAgB,aAAa,CAC3B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GACpD,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE;IACN,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,IAAI,CAwBN;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE;IACN,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,IAAI,CAkBN;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,IAAI,EACV,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GACrD,IAAI,CAMN;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK,GAAG,MAAM,EACrB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GACrD,IAAI,CAoBN;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;IACrD,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAmBA;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAMlD"}

package/dist/commonjs/utils/tracing.js

@@ -8,6 +8,7 @@ exports.initializeTracing = initializeTracing;
 exports.shutdownTracing = shutdownTracing;
 exports.isTracingInitialized = isTracingInitialized;
 exports.getTracer = getTracer;
+exports.setClientInfo = setClientInfo;
 exports.createToolSpan = createToolSpan;
 exports.createHttpSpan = createHttpSpan;
 exports.markSpanSuccess = markSpanSuccess;
@@ -21,6 +22,7 @@ const semantic_conventions_1 = require("@opentelemetry/semantic-conventions");
 const exporter_trace_otlp_http_1 = require("@opentelemetry/exporter-trace-otlp-http");
 const api_1 = require("@opentelemetry/api");
 const versionUtils_js_1 = require("./versionUtils.js");
+const redactingSpanExporter_js_1 = require("./redactingSpanExporter.js");
 const incubating_1 = require("@opentelemetry/semantic-conventions/incubating");
 // Suppress OpenTelemetry diagnostic logging IMMEDIATELY to avoid polluting stdio
 // This must happen at module load time, before any OTEL operations
@@ -142,7 +144,9 @@ async function initializeTracing() {
         // Create SDK instance
         sdk = new sdk_node_1.NodeSDK({
             resource,
-            traceExporter: exporters[0],
+            // Wrap the exporter so access tokens recorded in HTTP client span
+            // attributes (url.full, url.query) never reach the trace backend
+            traceExporter: new redactingSpanExporter_js_1.RedactingSpanExporter(exporters[0]),
             instrumentations: [
                 (0, auto_instrumentations_node_1.getNodeAutoInstrumentations)({
                     // Disable instrumentations that might be too noisy
@@ -194,6 +198,19 @@ function isTracingInitialized() {
 function getTracer() {
     return api_1.trace.getTracer('mapbox-mcp-server');
 }
+/**
+ * The connected client's `clientInfo` (name/version), as reported in its
+ * `initialize` request. There is exactly one client per stdio server
+ * process, so this is safe as module-level state; set once via
+ * `setClientInfo` after the initialize handshake completes (see
+ * `server.server.oninitialized` in index.ts) and read by every tool span
+ * created afterward, so traces can be filtered/grouped by which MCP client
+ * (Claude Desktop, Cursor, VS Code, etc.) made the call.
+ */
+let currentClientInfo;
+function setClientInfo(info) {
+    currentClientInfo = info;
+}
 /**
  * Create a span for tool execution with comprehensive attributes
  */
@@ -205,6 +222,12 @@ function createToolSpan(toolName, inputSize, extra) {
             'tool.name': toolName,
             'tool.input.size': inputSize,
             'operation.type': 'tool_execution',
+            ...(currentClientInfo?.name && {
+                'mcp.client.name': currentClientInfo.name
+            }),
+            ...(currentClientInfo?.version && {
+                'mcp.client.version': currentClientInfo.version
+            }),
             ...(extra?.sessionId && { 'session.id': extra.sessionId }),
             ...(extra?.userId && { 'user.id': extra.userId }),
             ...(extra?.accountId && { 'account.id': extra.accountId }),

package/dist/commonjs/utils/tracing.js.map

@@ -1 +1 @@
-{"version":3,"file":"tracing.js","sourceRoot":"","sources":["../../../src/utils/tracing.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;AAuFlC,0EAyBC;AAKD,gEA2BC;AASD,8CAoFC;AAKD,0CAMC;AAKD,oDAEC;AAKD,8BAEC;AAKD,wCA4BC;AAKD,wCA0BC;AAKD,0CASC;AAKD,sCAwBC;AAKD,sDAsBC;AAKD,sCAMC;AArZD,sDAAkD;AAClD,0FAAwF;AACxF,wDAAkE;AAClE,8EAG6C;AAC7C,sFAA4E;AAC5E,4CAO4B;AAC5B,uDAAmD;AACnD,+EAA0F;AAG1F,iFAAiF;AACjF,mEAAmE;AACnE,iEAAiE;AACjE,MAAM,wBAAwB,GAAG,GAAG,EAAE;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc;QACzC,CAAC,CAAC,kBAAY,CACV,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAA+B,CACtE;QACH,CAAC,CAAC,kBAAY,CAAC,IAAI,CAAC;IAEtB,UAAI,CAAC,SAAS,CACZ;QACE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;QACjB,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;QACf,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;KAChB,EACD,QAAQ,CACT,CAAC;AACJ,CAAC,CAAC;AAEF,4CAA4C;AAC5C,wBAAwB,EAAE,CAAC;AAE3B,sBAAsB;AACtB,IAAI,GAAG,GAAmB,IAAI,CAAC;AAC/B,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAmC7B;;GAEG;AACH,SAAgB,+BAA+B,CAC7C,QAAgB,EAChB,SAAiB,EACjB,KAA+B;IAE/B,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE;QAC/C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;QAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;QACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,cAAc,EAAE;YACd,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;YAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;YACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;SAChD;QACD,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,0BAA0B,CACxC,QAAgB,EAChB,SAAiB,EACjB,WAAwB,EACxB,KAA+B;IAE/B,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE;QAC/C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;QAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;QACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,cAAc,EAAE;YACd,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;YAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;YACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;SAChD;QACD,WAAW;QACX,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,iBAAiB;IACrC,+EAA+E;IAC/E,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACjE,OAAO;IACT,CAAC;IAED,yCAAyC;IACzC,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,OAAO,EAAE,CAAC;QACjD,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,IAAA,gCAAc,GAAE,CAAC;IAErC,IAAI,CAAC;QACH,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,IAAA,kCAAsB,EAAC;YACtC,CAAC,wCAAiB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,WAAW,CAAC,IAAI;YACtE,CAAC,2CAAoB,CAAC,EAAE,WAAW,CAAC,OAAO;YAC3C,CAAC,qCAAwB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS;YAC7D,iBAAiB,EAAE,WAAW,CAAC,GAAG;YAClC,oBAAoB,EAAE,WAAW,CAAC,MAAM;YACxC,iBAAiB,EAAE,WAAW,CAAC,GAAG;SACnC,CAAC,CAAC;QAEH,sBAAsB;QACtB,MAAM,SAAS,GAAG,EAAE,CAAC;QAErB,8DAA8D;QAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,MAAM,EAAE,CAAC;YACzD,MAAM,EAAE,mBAAmB,EAAE,GAC3B,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,oCAAoC;QACpC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;QAC7D,IAAI,YAAY,EAAE,CAAC;YACjB,SAAS,CAAC,IAAI,CACZ,IAAI,4CAAiB,CAAC;gBACpB,GAAG,EAAE,GAAG,YAAY,YAAY;gBAChC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;oBAC7C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;oBACpD,CAAC,CAAC,EAAE;aACP,CAAC,CACH,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,sBAAsB;QACtB,GAAG,GAAG,IAAI,kBAAO,CAAC;YAChB,QAAQ;YACR,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;YAC3B,gBAAgB,EAAE;gBAChB,IAAA,wDAA2B,EAAC;oBAC1B,mDAAmD;oBACnD,mCAAmC,EAAE;wBACnC,OAAO,EAAE,KAAK;qBACf;oBACD,oCAAoC,EAAE;wBACpC,OAAO,EAAE,KAAK;qBACf;oBACD,2DAA2D;oBAC3D,qCAAqC,EAAE;wBACrC,OAAO,EAAE,IAAI;qBACd;oBACD,iDAAiD;oBACjD,uCAAuC,EAAE;wBACvC,OAAO,EAAE,IAAI;qBACd;iBACF,CAAC;aACH;SACF,CAAC,CAAC;QAEH,gBAAgB;QAChB,GAAG,CAAC,KAAK,EAAE,CAAC;QACZ,gBAAgB,GAAG,IAAI,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,gBAAgB,GAAG,KAAK,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,eAAe;IACnC,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrB,GAAG,GAAG,IAAI,CAAC;QACX,gBAAgB,GAAG,KAAK,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB;IAClC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,SAAgB,SAAS;IACvB,OAAO,WAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAC5B,QAAgB,EAChB,SAAiB,EACjB,KAMC;IAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,QAAQ,EAAE,EAAE;QAChD,IAAI,EAAE,cAAQ,CAAC,QAAQ;QACvB,UAAU,EAAE;YACV,WAAW,EAAE,QAAQ;YACrB,iBAAiB,EAAE,SAAS;YAC5B,gBAAgB,EAAE,gBAAgB;YAClC,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,EAAE,aAAa,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;YACvE,GAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SACxD;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAC5B,MAAc,EACd,GAAW,EACX,KAIC;IAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE;QAC5D,IAAI,EAAE,cAAQ,CAAC,MAAM;QACrB,UAAU,EAAE;YACV,aAAa,EAAE,MAAM;YACrB,UAAU,EAAE,GAAG;YACf,gBAAgB,EAAE,cAAc;YAChC,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,EAAE,aAAa,IAAI;gBAC1B,6BAA6B,EAAE,KAAK,CAAC,aAAa;aACnD,CAAC;YACF,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SAC3D;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAC7B,IAAU,EACV,UAAsD;IAEtD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,oBAAc,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;AACb,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAC3B,IAAU,EACV,KAAqB,EACrB,UAAsD;IAEtD,MAAM,YAAY,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACvE,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;IAE/D,IAAI,CAAC,aAAa,CAAC;QACjB,YAAY,EAAE,SAAS;QACvB,eAAe,EAAE,YAAY;QAC7B,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;KACtB,CAAC,CAAC;IAEH,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,SAAS,CAAC;QACb,IAAI,EAAE,oBAAc,CAAC,KAAK;QAC1B,OAAO,EAAE,YAAY;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,CAAC;AACb,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,KAAc;IAIlD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,+BAA+B;IAC3D,CAAC;IAED,yDAAyD;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,CAAC;QACH,wEAAwE;QACxE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,GAAY;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}
+{"version":3,"file":"tracing.js","sourceRoot":"","sources":["../../../src/utils/tracing.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;AAwFlC,0EAyBC;AAKD,gEA2BC;AASD,8CAsFC;AAKD,0CAMC;AAKD,oDAEC;AAKD,8BAEC;AAaD,sCAIC;AAKD,wCAkCC;AAKD,wCA0BC;AAKD,0CASC;AAKD,sCAwBC;AAKD,sDAsBC;AAKD,sCAMC;AA/aD,sDAAkD;AAClD,0FAAwF;AACxF,wDAAkE;AAClE,8EAG6C;AAC7C,sFAA4E;AAC5E,4CAO4B;AAC5B,uDAAmD;AACnD,yEAAmE;AACnE,+EAA0F;AAG1F,iFAAiF;AACjF,mEAAmE;AACnE,iEAAiE;AACjE,MAAM,wBAAwB,GAAG,GAAG,EAAE;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc;QACzC,CAAC,CAAC,kBAAY,CACV,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAA+B,CACtE;QACH,CAAC,CAAC,kBAAY,CAAC,IAAI,CAAC;IAEtB,UAAI,CAAC,SAAS,CACZ;QACE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;QACjB,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;QACf,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;KAChB,EACD,QAAQ,CACT,CAAC;AACJ,CAAC,CAAC;AAEF,4CAA4C;AAC5C,wBAAwB,EAAE,CAAC;AAE3B,sBAAsB;AACtB,IAAI,GAAG,GAAmB,IAAI,CAAC;AAC/B,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAmC7B;;GAEG;AACH,SAAgB,+BAA+B,CAC7C,QAAgB,EAChB,SAAiB,EACjB,KAA+B;IAE/B,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE;QAC/C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;QAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;QACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,cAAc,EAAE;YACd,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;YAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;YACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;SAChD;QACD,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,0BAA0B,CACxC,QAAgB,EAChB,SAAiB,EACjB,WAAwB,EACxB,KAA+B;IAE/B,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE;QAC/C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;QAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;QACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;QACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,cAAc,EAAE;YACd,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,MAAM,EAAE,KAAK,EAAE,MAA4B;YAC3C,SAAS,EAAE,KAAK,EAAE,SAA+B;YACjD,aAAa,EAAE,KAAK,EAAE,aAAmC;YACzD,QAAQ,EAAE,KAAK,EAAE,QAA8B;SAChD;QACD,WAAW;QACX,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,iBAAiB;IACrC,+EAA+E;IAC/E,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACjE,OAAO;IACT,CAAC;IAED,yCAAyC;IACzC,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,OAAO,EAAE,CAAC;QACjD,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,IAAA,gCAAc,GAAE,CAAC;IAErC,IAAI,CAAC;QACH,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,IAAA,kCAAsB,EAAC;YACtC,CAAC,wCAAiB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,WAAW,CAAC,IAAI;YACtE,CAAC,2CAAoB,CAAC,EAAE,WAAW,CAAC,OAAO;YAC3C,CAAC,qCAAwB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS;YAC7D,iBAAiB,EAAE,WAAW,CAAC,GAAG;YAClC,oBAAoB,EAAE,WAAW,CAAC,MAAM;YACxC,iBAAiB,EAAE,WAAW,CAAC,GAAG;SACnC,CAAC,CAAC;QAEH,sBAAsB;QACtB,MAAM,SAAS,GAAG,EAAE,CAAC;QAErB,8DAA8D;QAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,MAAM,EAAE,CAAC;YACzD,MAAM,EAAE,mBAAmB,EAAE,GAC3B,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,oCAAoC;QACpC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;QAC7D,IAAI,YAAY,EAAE,CAAC;YACjB,SAAS,CAAC,IAAI,CACZ,IAAI,4CAAiB,CAAC;gBACpB,GAAG,EAAE,GAAG,YAAY,YAAY;gBAChC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;oBAC7C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;oBACpD,CAAC,CAAC,EAAE;aACP,CAAC,CACH,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,sBAAsB;QACtB,GAAG,GAAG,IAAI,kBAAO,CAAC;YAChB,QAAQ;YACR,kEAAkE;YAClE,iEAAiE;YACjE,aAAa,EAAE,IAAI,gDAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtD,gBAAgB,EAAE;gBAChB,IAAA,wDAA2B,EAAC;oBAC1B,mDAAmD;oBACnD,mCAAmC,EAAE;wBACnC,OAAO,EAAE,KAAK;qBACf;oBACD,oCAAoC,EAAE;wBACpC,OAAO,EAAE,KAAK;qBACf;oBACD,2DAA2D;oBAC3D,qCAAqC,EAAE;wBACrC,OAAO,EAAE,IAAI;qBACd;oBACD,iDAAiD;oBACjD,uCAAuC,EAAE;wBACvC,OAAO,EAAE,IAAI;qBACd;iBACF,CAAC;aACH;SACF,CAAC,CAAC;QAEH,gBAAgB;QAChB,GAAG,CAAC,KAAK,EAAE,CAAC;QACZ,gBAAgB,GAAG,IAAI,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,gBAAgB,GAAG,KAAK,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,eAAe;IACnC,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrB,GAAG,GAAG,IAAI,CAAC;QACX,gBAAgB,GAAG,KAAK,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB;IAClC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,SAAgB,SAAS;IACvB,OAAO,WAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,IAAI,iBAAkE,CAAC;AAEvE,SAAgB,aAAa,CAC3B,IAAqD;IAErD,iBAAiB,GAAG,IAAI,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAC5B,QAAgB,EAChB,SAAiB,EACjB,KAMC;IAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,QAAQ,EAAE,EAAE;QAChD,IAAI,EAAE,cAAQ,CAAC,QAAQ;QACvB,UAAU,EAAE;YACV,WAAW,EAAE,QAAQ;YACrB,iBAAiB,EAAE,SAAS;YAC5B,gBAAgB,EAAE,gBAAgB;YAClC,GAAG,CAAC,iBAAiB,EAAE,IAAI,IAAI;gBAC7B,iBAAiB,EAAE,iBAAiB,CAAC,IAAI;aAC1C,CAAC;YACF,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI;gBAChC,oBAAoB,EAAE,iBAAiB,CAAC,OAAO;aAChD,CAAC;YACF,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,EAAE,aAAa,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;YACvE,GAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SACxD;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAC5B,MAAc,EACd,GAAW,EACX,KAIC;IAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE;QAC5D,IAAI,EAAE,cAAQ,CAAC,MAAM;QACrB,UAAU,EAAE;YACV,aAAa,EAAE,MAAM;YACrB,UAAU,EAAE,GAAG;YACf,gBAAgB,EAAE,cAAc;YAChC,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,EAAE,aAAa,IAAI;gBAC1B,6BAA6B,EAAE,KAAK,CAAC,aAAa;aACnD,CAAC;YACF,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SAC3D;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAC7B,IAAU,EACV,UAAsD;IAEtD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,oBAAc,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;AACb,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAC3B,IAAU,EACV,KAAqB,EACrB,UAAsD;IAEtD,MAAM,YAAY,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACvE,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;IAE/D,IAAI,CAAC,aAAa,CAAC;QACjB,YAAY,EAAE,SAAS;QACvB,eAAe,EAAE,YAAY;QAC7B,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;KACtB,CAAC,CAAC;IAEH,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,SAAS,CAAC;QACb,IAAI,EAAE,oBAAc,CAAC,KAAK;QAC1B,OAAO,EAAE,YAAY;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,CAAC;AACb,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,KAAc;IAIlD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,+BAA+B;IAC3D,CAAC;IAED,yDAAyD;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,CAAC;QACH,wEAAwE;QACxE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,GAAY;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/commonjs/utils/urlSafety.d.ts

@@ -6,14 +6,30 @@
  * Rejects:
  *  - non-http(s) schemes (e.g. file:, gopher:, data:, javascript:)
  *  - non-https URLs (markers should always be fetched over TLS)
- *  - URLs whose host is an IP literal in a loopback, private, link-local,
- *    unique-local, or otherwise non-routable range (CWE-918 SSRF)
- *  - URLs whose host is a well-known local hostname
+ *  - IPv4/IPv6 literals outside ipaddr.js's plain "unicast" range —
+ *    deny-by-default, so loopback, private, link-local, multicast,
+ *    broadcast, CGNAT, reserved, and every IPv4-in-IPv6 transition/
+ *    translation mechanism (mapped, compatible, 6to4, NAT64, SIIT, Teredo,
+ *    AMT, ORCHID, etc.) are all rejected without needing to be named
+ *    individually (CWE-918 SSRF)
+ *  - well-known local hostnames, reserved local/internal-use suffixes
+ *    (.internal, .local, .arpa), and dotless single-label hostnames
  *
- * Note: we do not perform DNS resolution here — the upstream service will
- * still resolve the hostname when fetching. This validation is a defense in
- * depth against the most common SSRF vectors that prompt-injected agents
- * tend to produce (IP literals and "localhost").
+ * Out of scope, by design, for this pre-fetch string check — all three
+ * require validating the actual connection, not the URL string, so they
+ * belong where the fetch happens, not here:
+ *  - DNS rebinding (an ordinary hostname resolving to an internal address
+ *    at fetch time)
+ *  - port restriction
+ *  - network-specific hostname suffixes (.corp, .lan, .home, etc.) —
+ *    unlike .internal/.local/.arpa, these aren't globally reserved, so
+ *    they can't be enumerated in general
  */
 export declare function isSafeExternalUrl(rawUrl: string): boolean;
+/**
+ * Same validation as isSafeExternalUrl, but returns the parsed URL on
+ * success (null otherwise) so callers that need the WHATWG-canonical form
+ * of the validated URL don't have to re-parse the raw string.
+ */
+export declare function parseSafeExternalUrl(rawUrl: string): URL | null;
 //# sourceMappingURL=urlSafety.d.ts.map

package/dist/commonjs/utils/urlSafety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"urlSafety.d.ts","sourceRoot":"","sources":["../../../src/utils/urlSafety.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CA0EzD"}
+{"version":3,"file":"urlSafety.d.ts","sourceRoot":"","sources":["../../../src/utils/urlSafety.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAoF/D"}

package/dist/commonjs/utils/urlSafety.js

@@ -1,8 +1,13 @@
 "use strict";
 // Copyright (c) Mapbox, Inc.
 // Licensed under the MIT License.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isSafeExternalUrl = isSafeExternalUrl;
+exports.parseSafeExternalUrl = parseSafeExternalUrl;
+const ipaddr_js_1 = __importDefault(require("ipaddr.js"));
 /**
  * Validates that a URL is safe for server-side fetching by an upstream service
  * (in particular, the Mapbox Static Images API which fetches custom marker
@@ -11,30 +16,55 @@ exports.isSafeExternalUrl = isSafeExternalUrl;
  * Rejects:
  *  - non-http(s) schemes (e.g. file:, gopher:, data:, javascript:)
  *  - non-https URLs (markers should always be fetched over TLS)
- *  - URLs whose host is an IP literal in a loopback, private, link-local,
- *    unique-local, or otherwise non-routable range (CWE-918 SSRF)
- *  - URLs whose host is a well-known local hostname
+ *  - IPv4/IPv6 literals outside ipaddr.js's plain "unicast" range —
+ *    deny-by-default, so loopback, private, link-local, multicast,
+ *    broadcast, CGNAT, reserved, and every IPv4-in-IPv6 transition/
+ *    translation mechanism (mapped, compatible, 6to4, NAT64, SIIT, Teredo,
+ *    AMT, ORCHID, etc.) are all rejected without needing to be named
+ *    individually (CWE-918 SSRF)
+ *  - well-known local hostnames, reserved local/internal-use suffixes
+ *    (.internal, .local, .arpa), and dotless single-label hostnames
  *
- * Note: we do not perform DNS resolution here — the upstream service will
- * still resolve the hostname when fetching. This validation is a defense in
- * depth against the most common SSRF vectors that prompt-injected agents
- * tend to produce (IP literals and "localhost").
+ * Out of scope, by design, for this pre-fetch string check — all three
+ * require validating the actual connection, not the URL string, so they
+ * belong where the fetch happens, not here:
+ *  - DNS rebinding (an ordinary hostname resolving to an internal address
+ *    at fetch time)
+ *  - port restriction
+ *  - network-specific hostname suffixes (.corp, .lan, .home, etc.) —
+ *    unlike .internal/.local/.arpa, these aren't globally reserved, so
+ *    they can't be enumerated in general
  */
 function isSafeExternalUrl(rawUrl) {
+    return parseSafeExternalUrl(rawUrl) !== null;
+}
+/**
+ * Same validation as isSafeExternalUrl, but returns the parsed URL on
+ * success (null otherwise) so callers that need the WHATWG-canonical form
+ * of the validated URL don't have to re-parse the raw string.
+ */
+function parseSafeExternalUrl(rawUrl) {
     let parsed;
     try {
         parsed = new URL(rawUrl);
     }
     catch {
-        return false;
+        return null;
     }
     if (parsed.protocol !== 'https:') {
-        return false;
+        return null;
     }
-    // Strip optional surrounding brackets from IPv6 literals
-    const host = parsed.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    // Strip optional surrounding brackets from IPv6 literals and a trailing
+    // root-label dot (e.g. "localhost." is equivalent to "localhost"). The
+    // dotless-hostname check further below relies on this running first —
+    // without it, "intranet." would still contain a dot and slip past that
+    // check.
+    const host = parsed.hostname
+        .replace(/^\[|\]$/g, '')
+        .replace(/\.$/, '')
+        .toLowerCase();
     if (host.length === 0) {
-        return false;
+        return null;
     }
     // Block well-known local hostnames
     const blockedHostnames = new Set([
@@ -43,62 +73,50 @@ function isSafeExternalUrl(rawUrl) {
         'ip6-loopback',
         'broadcasthost'
     ]);
-    if (blockedHostnames.has(host) || host.endsWith('.localhost')) {
-        return false;
+    // Suffixes reserved for local/internal use that no public marker image
+    // host is ever legitimately under: cloud-internal DNS zones (.internal,
+    // used by GCP/AWS service discovery — covers metadata.google.internal,
+    // the GCP metadata endpoint's actual hostname), mDNS (.local), and
+    // reverse-DNS / home-network zones reserved by RFC 6761/8375 (.arpa
+    // covers .in-addr.arpa, .ip6.arpa, and .home.arpa as suffixes of it).
+    const blockedSuffixes = ['.localhost', '.internal', '.local', '.arpa'];
+    if (blockedHostnames.has(host) ||
+        blockedSuffixes.some((suffix) => host.endsWith(suffix))) {
+        return null;
     }
-    // IPv4 literal check (dotted quad)
-    const ipv4Match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
-    if (ipv4Match) {
-        const octets = ipv4Match.slice(1, 5).map((o) => Number(o));
-        if (octets.some((o) => o < 0 || o > 255)) {
-            return false;
-        }
-        const [a, b] = octets;
-        // 0.0.0.0/8, 10/8, 127/8
-        // 0.0.0.0/8 — "this network" (unspecified + reserved); block conservatively
-        if (a === 0 || a === 10 || a === 127)
-            return false;
-        // 169.254/16 (link-local, includes cloud metadata 169.254.169.254)
-        if (a === 169 && b === 254)
-            return false;
-        // 172.16/12
-        if (a === 172 && b >= 16 && b <= 31)
-            return false;
-        // 192.168/16
-        if (a === 192 && b === 168)
-            return false;
-        // 100.64/10 (CGNAT)
-        if (a === 100 && b >= 64 && b <= 127)
-            return false;
-        // 224/4 multicast and 240/4 reserved
-        if (a >= 224)
-            return false;
-        return true;
+    // If the host isn't a parseable IP literal at all, it's an ordinary
+    // hostname — allowed here (subject to the checks above), except that a
+    // public marker image host always has at least one dot; a dotless,
+    // single-label hostname only resolves via the fetcher's own network
+    // search-domain suffixing (e.g. "intranet", "metadata"), which is never
+    // the case for a legitimate external image URL. DNS rebinding on a
+    // multi-label hostname is out of scope for this pre-fetch check, see the
+    // module doc comment.
+    if (!ipaddr_js_1.default.isValid(host)) {
+        return host.includes('.') ? parsed : null;
+    }
+    const addr = ipaddr_js_1.default.parse(host);
+    // Deny by default for both IPv4 and IPv6: only plain global unicast
+    // addresses are allowed. Every other named range (private, loopback,
+    // link-local, multicast, broadcast, CGNAT, reserved, unique-local, and
+    // every IPv4-in-IPv6 transition/translation mechanism) is rejected,
+    // regardless of what it does or doesn't embed.
+    if (addr.range() !== 'unicast') {
+        return null;
     }
-    // IPv6 literal check (presence of ':' indicates IPv6 since IPv4 was handled)
-    if (host.includes(':')) {
-        // ::1 loopback, :: unspecified
-        if (host === '::1' || host === '::')
-            return false;
-        // fc00::/7 unique local (fc.. or fd..)
-        if (/^f[cd][0-9a-f]{2}:/.test(host))
-            return false;
-        // fe80::/10 link-local
-        if (/^fe[89ab][0-9a-f]:/.test(host))
-            return false;
-        // ff00::/8 multicast
-        if (/^ff[0-9a-f]{2}:/.test(host))
-            return false;
-        // IPv4-mapped / IPv4-compatible IPv6: ::ffff:a.b.c.d or ::a.b.c.d
-        // (Node's URL parser normalises ::ffff:127.0.0.1 to ::ffff:7f00:1, so
-        // detect the embedded IPv4 either as a dotted-quad or as the
-        // ::ffff:xxxx:xxxx hex form.)
-        if (/\d+\.\d+\.\d+\.\d+/.test(host))
-            return false;
-        if (/^::ffff:[0-9a-f]{1,4}:[0-9a-f]{1,4}$/.test(host))
-            return false;
-        return true;
+    if (addr.kind() === 'ipv6') {
+        // ipaddr.js does not classify the deprecated IPv4-compatible form
+        // (::a.b.c.d, i.e. the leading 96 bits all zero) as a special range
+        // when written in plain hex, which is exactly the form Node's URL
+        // parser normalises a dotted-quad IPv4-compatible literal to — so it
+        // reaches here as ordinary 'unicast' and needs an explicit check.
+        // (::1 and :: are already excluded above via the loopback/unspecified
+        // ranges, so this only affects addresses with a genuine embedded IPv4.)
+        const bytes = addr.toByteArray();
+        if (bytes.slice(0, 12).every((b) => b === 0)) {
+            return null;
+        }
     }
-    return true;
+    return parsed;
 }
 //# sourceMappingURL=urlSafety.js.map