@mapbox/mcp-server 0.15.1 → 0.16.0

package/dist/esm/resources/place-photo/PlacePhotoResource.js

@@ -0,0 +1,198 @@
+// Copyright (c) Mapbox, Inc.
+// Licensed under the MIT License.
+import { lookup } from 'node:dns/promises';
+import { MapboxApiBasedResource } from '../MapboxApiBasedResource.js';
+import { isPublicIpAddress, parseSafeExternalUrl } from '../../utils/urlSafety.js';
+const URI_PREFIX = 'mapbox://place-photo/';
+/**
+ * Largest photo the resource returns; bigger ones are treated as missing.
+ * Place Details photos are full-size originals: Union Square's ran 100 to
+ * 600 KB, so a smaller cap would drop most of them.
+ */
+export const MAX_PLACE_PHOTO_BYTES = 1024 * 1024;
+/**
+ * The cache is shared by everyone using the server process, so it's capped
+ * by size (base64, as stored) as well as by entries.
+ */
+export const MAX_PLACE_PHOTO_CACHE_BYTES = 20 * 1024 * 1024;
+const PHOTO_FETCH_TIMEOUT_MS = 5000;
+const CACHE_TTL_MS = 30 * 60 * 1000;
+const CACHE_MAX_ENTRIES = 200;
+// Raster types an <img> or CSS background can show. SVG is left out: it's a
+// document that can carry script, and thumbnails never need it.
+const ALLOWED_TYPES = new Set([
+    'image/jpeg',
+    'image/png',
+    'image/webp',
+    'image/gif'
+]);
+const lookupAll = async (hostname) => (await lookup(hostname, { all: true })).map((a) => a.address);
+/**
+ * A POI's first Place Details photo, proxied through the server for the map
+ * app's results panel.
+ *
+ * Place Details photos are hosted wherever the business's own site hosts
+ * them (Yext, Webflow and so on), so the map app's CSP can't list their
+ * hosts, and allowing any https: host would also allow scripts from
+ * anywhere. Instead the page reads this resource through the host
+ * (`resources/read`) and shows the image as a `data:` URL.
+ *
+ * The URI carries only a mapbox_id, never a URL: the server looks the place
+ * up itself and fetches the photo URL Place Details returns, so the page
+ * can't point the server at arbitrary hosts.
+ */
+export class PlacePhotoResource extends MapboxApiBasedResource {
+    uri = `${URI_PREFIX}{id}`;
+    name = 'Mapbox Place Photo';
+    description = "The first photo of a POI from Place Details, as an image, for the map app's results panel. " +
+        'Read with mapbox://place-photo/{mapbox_id}.';
+    mimeType = 'image/jpeg';
+    cache = new Map();
+    cacheBytes = 0;
+    lookupHost;
+    constructor(params) {
+        super(params);
+        this.lookupHost = params.lookupHost ?? lookupAll;
+    }
+    async execute(uri, accessToken) {
+        const id = decodeURIComponent(uri.slice(URI_PREFIX.length));
+        if (!isPlacesApiId(id)) {
+            throw new Error('Not a Places API mapbox_id');
+        }
+        const photo = await this.getPhoto(id, accessToken);
+        if (!photo) {
+            return {
+                contents: [{ uri, mimeType: 'text/plain', text: 'No photo available' }]
+            };
+        }
+        return {
+            contents: [{ uri, mimeType: photo.mimeType, blob: photo.base64 }]
+        };
+    }
+    async getPhoto(id, accessToken) {
+        const now = Date.now();
+        const cached = this.cache.get(id);
+        if (cached && cached.expires > now)
+            return cached.photo;
+        const photo = await this.fetchPhoto(id, accessToken);
+        // Places are public data, so one cache serves every caller. Misses are
+        // cached too, so a place without a photo isn't looked up on every render.
+        this.evict(id);
+        const size = photo?.base64.length ?? 0;
+        while (this.cache.size > 0 &&
+            (this.cache.size >= CACHE_MAX_ENTRIES ||
+                this.cacheBytes + size > MAX_PLACE_PHOTO_CACHE_BYTES)) {
+            this.evict(this.cache.keys().next().value);
+        }
+        this.cache.set(id, { expires: now + CACHE_TTL_MS, photo });
+        this.cacheBytes += size;
+        return photo;
+    }
+    evict(id) {
+        const entry = this.cache.get(id);
+        if (!entry)
+            return;
+        this.cacheBytes -= entry.photo?.base64.length ?? 0;
+        this.cache.delete(id);
+    }
+    async fetchPhoto(id, accessToken) {
+        const detailsUrl = new URL(`${MapboxApiBasedResource.mapboxApiEndpoint}places/v1/details/retrieve/${encodeURIComponent(id)}`);
+        detailsUrl.searchParams.append('access_token', accessToken);
+        const details = await this.httpRequest(detailsUrl.toString());
+        if (!details.ok)
+            return null;
+        const data = (await details.json());
+        const photoUrl = data.photos?.find((p) => typeof p?.url === 'string')
+            ?.url;
+        if (!photoUrl || !(await this.isPublicPhotoUrl(photoUrl)))
+            return null;
+        let response;
+        try {
+            response = await this.httpRequest(photoUrl, {
+                // A redirect could lead anywhere, including hosts isPublicHttpsUrl
+                // would have rejected, so treat it as no photo.
+                redirect: 'manual',
+                signal: AbortSignal.timeout(PHOTO_FETCH_TIMEOUT_MS)
+            });
+        }
+        catch {
+            return null;
+        }
+        if (response.status !== 200)
+            return null;
+        const mimeType = (response.headers?.get('content-type') ?? '')
+            .split(';')[0]
+            .trim()
+            .toLowerCase();
+        if (!ALLOWED_TYPES.has(mimeType))
+            return null;
+        const declared = Number(response.headers?.get('content-length'));
+        if (declared > MAX_PLACE_PHOTO_BYTES)
+            return null;
+        const bytes = await readCapped(response, MAX_PLACE_PHOTO_BYTES);
+        if (!bytes || bytes.length === 0)
+            return null;
+        return { mimeType, base64: bytes.toString('base64') };
+    }
+    /**
+     * https on the default port, a public DNS name (not an IP literal or a
+     * local name), and every address it resolves to public, so a bad photo
+     * URL in the data can't make the server request something on its own
+     * network. The fetch resolves the name again, so a host that changes its
+     * answer in between can still get through; the request can't be read
+     * back either way (no redirects, image types only).
+     */
+    async isPublicPhotoUrl(value) {
+        const url = parseSafeExternalUrl(value);
+        if (!url || url.username || url.password)
+            return false;
+        if (url.port && url.port !== '443')
+            return false;
+        const host = url.hostname;
+        if (host.startsWith('[') || isIpv4Literal(host))
+            return false;
+        try {
+            const addresses = await this.lookupHost(host);
+            return addresses.length > 0 && addresses.every(isPublicIpAddress);
+        }
+        catch {
+            return false;
+        }
+    }
+}
+function isIpv4Literal(host) {
+    return /^[\d.]+$/.test(host);
+}
+/** Reads a body, giving up (null) as soon as it passes `limit` bytes. */
+async function readCapped(response, limit) {
+    const reader = response.body?.getReader();
+    if (!reader) {
+        const whole = Buffer.from(await response.arrayBuffer());
+        return whole.length > limit ? null : whole;
+    }
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > limit) {
+            await reader.cancel().catch(() => { });
+            return null;
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks);
+}
+const PLACES_ID = /^urn:mbxpoi:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Native Places ids decode to "urn:mbxpoi:<uuid>". Others, including
+ * OSM-sourced ids and "urn:mbxpoi:mapbox-n<id>", 422 the API.
+ */
+function isPlacesApiId(id) {
+    if (!/^[A-Za-z0-9+/_=-]{8,200}$/.test(id))
+        return false;
+    return PLACES_ID.test(Buffer.from(id, 'base64').toString('utf8'));
+}
+//# sourceMappingURL=PlacePhotoResource.js.map

package/dist/esm/resources/place-photo/PlacePhotoResource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PlacePhotoResource.js","sourceRoot":"","sources":["../../../../src/resources/place-photo/PlacePhotoResource.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAElC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,0BAA0B,CAAC;AAElC,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE5D,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,4EAA4E;AAC5E,gEAAgE;AAChE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,WAAW;CACZ,CAAC,CAAC;AAUH,MAAM,SAAS,GAAe,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC/C,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAEhE;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAmB,SAAQ,sBAAsB;IACnD,GAAG,GAAG,GAAG,UAAU,MAAM,CAAC;IAC1B,IAAI,GAAG,oBAAoB,CAAC;IAC5B,WAAW,GAClB,6FAA6F;QAC7F,6CAA6C,CAAC;IACvC,QAAQ,GAAG,YAAY,CAAC;IAEhB,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,UAAU,GAAG,CAAC,CAAC;IACN,UAAU,CAAa;IAExC,YAAY,MAA6D;QACvE,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;IACnD,CAAC;IAES,KAAK,CAAC,OAAO,CACrB,GAAW,EACX,WAAmB;QAEnB,MAAM,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;aACxE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;SAClE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,EAAU,EACV,WAAmB;QAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,GAAG,GAAG;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QAExD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACrD,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QACvC,OACE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;YACnB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,iBAAiB;gBACnC,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,2BAA2B,CAAC,EACvD,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,GAAG,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,EAAU;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,EAAU,EACV,WAAmB;QAEnB,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,GAAG,sBAAsB,CAAC,iBAAiB,8BAA8B,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAClG,CAAC;QACF,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAEjC,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC;YACnE,EAAE,GAAyB,CAAC;QAC9B,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAEvE,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE;gBAC1C,mEAAmE;gBACnE,gDAAgD;gBAChD,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,sBAAsB,CAAC;aACpD,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAEzC,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;aAC3D,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aACb,IAAI,EAAE;aACN,WAAW,EAAE,CAAC;QACjB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACjE,IAAI,QAAQ,GAAG,qBAAqB;YAAE,OAAO,IAAI,CAAC;QAElD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxD,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAC1C,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACvD,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,UAAU,CACvB,QAAkB,EAClB,KAAa;IAEb,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7C,CAAC;IACD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAClB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,SAAS,GACb,4EAA4E,CAAC;AAE/E;;;GAGG;AACH,SAAS,aAAa,CAAC,EAAU;IAC/B,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC"}

package/dist/esm/resources/resourceRegistry.d.ts

@@ -2,9 +2,11 @@ import { CategoryListResource } from './category-list/CategoryListResource.js';
 import { TemporaryDataResource } from './temporary/TemporaryDataResource.js';
 import { ComputeResource } from './compute/ComputeResource.js';
 import { InlinePayloadResource } from './inline-payload/InlinePayloadResource.js';
+import { ToolResponseResource } from './tool-response/ToolResponseResource.js';
 import { MapAppUIResource } from './ui-apps/MapAppUIResource.js';
 import { VersionResource } from './version/VersionResource.js';
-export declare const ALL_RESOURCES: readonly [CategoryListResource, TemporaryDataResource, ComputeResource, InlinePayloadResource, MapAppUIResource, VersionResource];
+import { PlacePhotoResource } from './place-photo/PlacePhotoResource.js';
+export declare const ALL_RESOURCES: readonly [CategoryListResource, TemporaryDataResource, ComputeResource, InlinePayloadResource, ToolResponseResource, MapAppUIResource, PlacePhotoResource, VersionResource];
 export type ResourceInstance = (typeof ALL_RESOURCES)[number];
 export declare function getAllResources(): readonly ResourceInstance[];
 export declare function getResourceByUri(uri: string): ResourceInstance | undefined;

package/dist/esm/resources/resourceRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resourceRegistry.d.ts","sourceRoot":"","sources":["../../../src/resources/resourceRegistry.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAI/D,eAAO,MAAM,aAAa,mIAShB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,wBAAgB,eAAe,IAAI,SAAS,gBAAgB,EAAE,CAE7D;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAkB1E"}
+{"version":3,"file":"resourceRegistry.d.ts","sourceRoot":"","sources":["../../../src/resources/resourceRegistry.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAIzE,eAAO,MAAM,aAAa,6KAYhB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,wBAAgB,eAAe,IAAI,SAAS,gBAAgB,EAAE,CAE7D;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAkB1E"}

package/dist/esm/resources/resourceRegistry.js

@@ -5,8 +5,10 @@ import { CategoryListResource } from './category-list/CategoryListResource.js';
 import { TemporaryDataResource } from './temporary/TemporaryDataResource.js';
 import { ComputeResource } from './compute/ComputeResource.js';
 import { InlinePayloadResource } from './inline-payload/InlinePayloadResource.js';
+import { ToolResponseResource } from './tool-response/ToolResponseResource.js';
 import { MapAppUIResource } from './ui-apps/MapAppUIResource.js';
 import { VersionResource } from './version/VersionResource.js';
+import { PlacePhotoResource } from './place-photo/PlacePhotoResource.js';
 import { httpRequest } from '../utils/httpPipeline.js';
 // Central registry of all resources
 export const ALL_RESOURCES = [
@@ -15,8 +17,11 @@ export const ALL_RESOURCES = [
     new TemporaryDataResource(),
     new ComputeResource(),
     new InlinePayloadResource(),
+    new ToolResponseResource({ httpRequest }),
     // Single shared map renderer, targeted exclusively by render_map_tool.
     new MapAppUIResource({ httpRequest }),
+    // Photos for the map app's results panel, which its CSP can't load directly.
+    new PlacePhotoResource({ httpRequest }),
     new VersionResource()
 ];
 export function getAllResources() {

package/dist/esm/resources/resourceRegistry.js.map

@@ -1 +1 @@
-{"version":3,"file":"resourceRegistry.js","sourceRoot":"","sources":["../../../src/resources/resourceRegistry.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAElC,kCAAkC;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,oCAAoC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,oCAAoC;IACpC,IAAI,oBAAoB,CAAC,EAAE,WAAW,EAAE,CAAC;IACzC,IAAI,qBAAqB,EAAE;IAC3B,IAAI,eAAe,EAAE;IACrB,IAAI,qBAAqB,EAAE;IAC3B,uEAAuE;IACvE,IAAI,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC;IACrC,IAAI,eAAe,EAAE;CACb,CAAC;AAIX,MAAM,UAAU,eAAe;IAC7B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,yBAAyB;IACzB,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC1E,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,gFAAgF;IAChF,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,iEAAiE;IACjE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACrC,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,UAAU,GACd,aAAa,KAAK,CAAC,CAAC;YAClB,CAAC,CAAC,QAAQ,CAAC,GAAG;YACd,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QAC3C,OAAO,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"resourceRegistry.js","sourceRoot":"","sources":["../../../src/resources/resourceRegistry.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAElC,kCAAkC;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,oCAAoC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,oCAAoC;IACpC,IAAI,oBAAoB,CAAC,EAAE,WAAW,EAAE,CAAC;IACzC,IAAI,qBAAqB,EAAE;IAC3B,IAAI,eAAe,EAAE;IACrB,IAAI,qBAAqB,EAAE;IAC3B,IAAI,oBAAoB,CAAC,EAAE,WAAW,EAAE,CAAC;IACzC,uEAAuE;IACvE,IAAI,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC;IACrC,6EAA6E;IAC7E,IAAI,kBAAkB,CAAC,EAAE,WAAW,EAAE,CAAC;IACvC,IAAI,eAAe,EAAE;CACb,CAAC;AAIX,MAAM,UAAU,eAAe;IAC7B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,yBAAyB;IACzB,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC1E,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,gFAAgF;IAChF,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,iEAAiE;IACjE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACrC,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,UAAU,GACd,aAAa,KAAK,CAAC,CAAC;YAClB,CAAC,CAAC,QAAQ,CAAC,GAAG;YACd,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QAC3C,OAAO,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/resources/tool-response/ToolResponseResource.d.ts

@@ -0,0 +1,20 @@
+import type { ReadResourceResult } from '@modelcontextprotocol/sdk/types.js';
+import { MapboxApiBasedResource } from '../MapboxApiBasedResource.js';
+import type { HttpRequest } from '../../utils/types.js';
+/**
+ * Full `directions_tool` / `isochrone_tool` responses that were too large
+ * to return inline. The `mapbox://response/{tool}?data=...` ref carries the
+ * call's inputs (see responseRef.ts), and reading it runs the same request
+ * again with the reader's token, so any server process can answer it.
+ */
+export declare class ToolResponseResource extends MapboxApiBasedResource {
+    readonly name = "Full Tool Response";
+    readonly uri = "mapbox://response/{spec}";
+    readonly description = "The full response of a directions_tool or isochrone_tool call that was too large to return inline, fetched again from its ref.";
+    readonly mimeType = "application/json";
+    constructor(params: {
+        httpRequest: HttpRequest;
+    });
+    protected execute(uri: string, accessToken: string): Promise<ReadResourceResult>;
+}
+//# sourceMappingURL=ToolResponseResource.d.ts.map

package/dist/esm/resources/tool-response/ToolResponseResource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ToolResponseResource.d.ts","sourceRoot":"","sources":["../../../../src/resources/tool-response/ToolResponseResource.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AASxD;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,sBAAsB;IAC9D,QAAQ,CAAC,IAAI,wBAAwB;IACrC,QAAQ,CAAC,GAAG,8BAA8B;IAC1C,QAAQ,CAAC,WAAW,oIAC+G;IACnI,QAAQ,CAAC,QAAQ,sBAAsB;gBAE3B,MAAM,EAAE;QAAE,WAAW,EAAE,WAAW,CAAA;KAAE;cAIhC,OAAO,CACrB,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC;CAgE/B"}

package/dist/esm/resources/tool-response/ToolResponseResource.js

@@ -0,0 +1,79 @@
+// Copyright (c) Mapbox, Inc.
+// Licensed under the MIT License.
+import { MapboxApiBasedResource } from '../MapboxApiBasedResource.js';
+import { resolveResponseRef } from '../../utils/responseRef.js';
+import { DirectionsInputSchema } from '../../tools/directions-tool/DirectionsTool.input.schema.js';
+import { buildDirectionsRequestUrl } from '../../tools/directions-tool/buildDirectionsRequestUrl.js';
+import { cleanResponseData } from '../../tools/directions-tool/cleanResponseData.js';
+import { IsochroneInputSchema } from '../../tools/isochrone-tool/IsochroneTool.input.schema.js';
+import { buildIsochroneRequestUrl } from '../../tools/isochrone-tool/buildIsochroneRequestUrl.js';
+/**
+ * Full `directions_tool` / `isochrone_tool` responses that were too large
+ * to return inline. The `mapbox://response/{tool}?data=...` ref carries the
+ * call's inputs (see responseRef.ts), and reading it runs the same request
+ * again with the reader's token, so any server process can answer it.
+ */
+export class ToolResponseResource extends MapboxApiBasedResource {
+    name = 'Full Tool Response';
+    uri = 'mapbox://response/{spec}';
+    description = 'The full response of a directions_tool or isochrone_tool call that was too large to return inline, fetched again from its ref.';
+    mimeType = 'application/json';
+    constructor(params) {
+        super(params);
+    }
+    async execute(uri, accessToken) {
+        const spec = resolveResponseRef(uri);
+        const apiEndpoint = MapboxApiBasedResource.mapboxApiEndpoint;
+        let url = null;
+        let directionsInput = null;
+        if (spec?.tool === 'directions') {
+            const parsed = DirectionsInputSchema.safeParse(spec.input);
+            if (parsed.success) {
+                directionsInput = parsed.data;
+                url = buildDirectionsRequestUrl({
+                    input: parsed.data,
+                    accessToken,
+                    apiEndpoint
+                });
+            }
+        }
+        else if (spec?.tool === 'isochrone') {
+            const parsed = IsochroneInputSchema.safeParse(spec.input);
+            if (parsed.success &&
+                (parsed.data.contours_minutes || parsed.data.contours_meters)) {
+                url = buildIsochroneRequestUrl({
+                    input: parsed.data,
+                    accessToken,
+                    apiEndpoint
+                });
+            }
+        }
+        if (!url) {
+            return text(uri, 'Response ref was malformed or unsupported.');
+        }
+        const response = await this.httpRequest(url);
+        if (!response.ok) {
+            return text(uri, `Fetching the full response failed: ${response.status} ${response.statusText}`);
+        }
+        let data = await response.json();
+        if (directionsInput) {
+            // The same cast DirectionsTool makes on its own response.
+            let cleaned = cleanResponseData(directionsInput, data);
+            // Same route the user picked when the original call was made.
+            const index = spec?.selectedRouteIndex;
+            if (index !== undefined && cleaned.routes?.[index]) {
+                cleaned = { ...cleaned, routes: [cleaned.routes[index]] };
+            }
+            data = cleaned;
+        }
+        return {
+            contents: [
+                { uri, mimeType: this.mimeType, text: JSON.stringify(data, null, 2) }
+            ]
+        };
+    }
+}
+function text(uri, message) {
+    return { contents: [{ uri, mimeType: 'text/plain', text: message }] };
+}
+//# sourceMappingURL=ToolResponseResource.js.map

package/dist/esm/resources/tool-response/ToolResponseResource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ToolResponseResource.js","sourceRoot":"","sources":["../../../../src/resources/tool-response/ToolResponseResource.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAGlC,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4DAA4D,CAAC;AACnG,OAAO,EAAE,yBAAyB,EAAE,MAAM,0DAA0D,CAAC;AACrG,OAAO,EAAE,iBAAiB,EAAE,MAAM,kDAAkD,CAAC;AAErF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAElG;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,sBAAsB;IACrD,IAAI,GAAG,oBAAoB,CAAC;IAC5B,GAAG,GAAG,0BAA0B,CAAC;IACjC,WAAW,GAClB,gIAAgI,CAAC;IAC1H,QAAQ,GAAG,kBAAkB,CAAC;IAEvC,YAAY,MAAoC;QAC9C,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAES,KAAK,CAAC,OAAO,CACrB,GAAW,EACX,WAAmB;QAEnB,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,sBAAsB,CAAC,iBAAiB,CAAC;QAC7D,IAAI,GAAG,GAAkB,IAAI,CAAC;QAC9B,IAAI,eAAe,GACjB,IAAI,CAAC;QAEP,IAAI,IAAI,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC;gBAC9B,GAAG,GAAG,yBAAyB,CAAC;oBAC9B,KAAK,EAAE,MAAM,CAAC,IAAI;oBAClB,WAAW;oBACX,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1D,IACE,MAAM,CAAC,OAAO;gBACd,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAC7D,CAAC;gBACD,GAAG,GAAG,wBAAwB,CAAC;oBAC7B,KAAK,EAAE,MAAM,CAAC,IAAI;oBAClB,WAAW;oBACX,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,GAAG,EAAE,4CAA4C,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CACT,GAAG,EACH,sCAAsC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAC/E,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE1C,IAAI,eAAe,EAAE,CAAC;YACpB,0DAA0D;YAC1D,IAAI,OAAO,GAAG,iBAAiB,CAC7B,eAAe,EACf,IAA0B,CAC3B,CAAC;YACF,8DAA8D;YAC9D,MAAM,KAAK,GAAG,IAAI,EAAE,kBAAkB,CAAC;YACvC,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnD,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5D,CAAC;YACD,IAAI,GAAG,OAAO,CAAC;QACjB,CAAC;QAED,OAAO;YACL,QAAQ,EAAE;gBACR,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;aACtE;SACF,CAAC;IACJ,CAAC;CACF;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,OAAe;IACxC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AACxE,CAAC"}

package/dist/esm/resources/ui-apps/mapAppHtml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mapAppHtml.d.ts","sourceRoot":"","sources":["../../../../src/resources/ui-apps/mapAppHtml.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE;;;;;;;;;GASG;AAMH,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B,GAAG,MAAM,CA2oDT"}
+{"version":3,"file":"mapAppHtml.d.ts","sourceRoot":"","sources":["../../../../src/resources/ui-apps/mapAppHtml.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE;;;;;;;;;GASG;AAMH,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B,GAAG,MAAM,CAomET"}