@superrouteca/smap 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -1,6 +1,25 @@
 # Changelog
 
-## 1.0.0 (unreleased)
+## 1.0.1 — 2026-10-27
+
+- Every map shows a small sMap badge (the sMap icon and name on a semi-transparent pill that reads on all five colour
+  schemes) in its bottom-right corner, left of the attribution (above it when the map is too narrow for both). It is
+  always shown and is not a link; the map data attribution stays visible. The badge is styled by `smap.css` and loads
+  nothing.
+- The package description starts with "sMap"; the README starts with the sMap logo.
+- The browser build is in the package: `dist/smap.js` (global `sMap`), `dist/smap.css` and `dist/smap-client.js`
+  (global `SMapClient`, types in `dist/smap-client.d.ts`). The map service no longer serves the SDK.
+- A map reads from `https://tile.srsr.ca` unless `baseUrl` is given, wherever the script was loaded from.
+- The Web SDK reports the package version (1.0.1).
+- The bundled map renderer is upgraded to its version 6.16.0, which fixes a security advisory in how it cleans the map
+  data credit (GHSA-jrc7-96c5-q579). Maps now need WebGL 2, and the renderer's worker starts from a `blob:` URL
+  (`worker-src blob:` under a Content Security Policy). Feature properties that hold objects reach `popup` and
+  `onClick` as objects instead of JSON text.
+- A `popup` may return a DOM node as well as an HTML string; an HTML string is inserted as it is (never sanitized), so
+  it must be trusted.
+- The browser build no longer sets a renderer global beside `sMap`; use `sMap.engine`.
+
+## 1.0.0 — 2026-10-27
 
 - The Web SDK as an npm package: ES module and CommonJS entry points with types, the map renderer bundled, safe to
   import on a server.

package/README.md

@@ -1,14 +1,21 @@
-# @superrouteca/smap
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/Goodneo-Solutions/smap-sdk/main/assets/smap-logo-dark.svg">
+  <img src="https://raw.githubusercontent.com/Goodneo-Solutions/smap-sdk/main/assets/smap-logo.svg" alt="sMap" height="56">
+</picture>
+
+# sMap for the web: `@superrouteca/smap`
 
 Maps from Superroute's sMap service for the web: five colour schemes, labels in any language, your points, lines and
 areas drawn on the GPU (hundreds of thousands of points, clustered or not), 3D buildings and areas, and tokens that
 renew themselves. Also the JS client (no map view) for servers and workers: tokens, the nearest node, styles, tiles
 and raw reads.
 
-- Version 1.0.0, MIT licence (see `LICENSE` at the repository root)
+- Version 1.0.1, MIT licence (see `LICENSE` at the repository root)
 - Works with bundlers (Vite, webpack, Next.js and others): ES module and CommonJS entry points with types
 - Nothing else to install: the map renderer is bundled in the package
 - Importing is safe on a server; a map is created in the browser only
+- Browsers with WebGL 2 (every current browser). The renderer's worker starts from a `blob:` URL: a page with a
+  Content Security Policy allows `worker-src blob:`
 
 ## Installation
 
@@ -16,13 +23,17 @@ and raw reads.
 npm install @superrouteca/smap
 ```
 
-Without a bundler, the same SDK is served by the service:
+Without a bundler, use the browser build in the package (also on the downloads page of the Superroute Open Platform
+developer center): `dist/smap.js` sets the global `sMap`, `dist/smap.css` is its stylesheet, and `dist/smap-client.js`
+(types in `dist/smap-client.d.ts`) is the JS client as `window.SMapClient`. Host the files with your page:
 
 ```html
-<link rel="stylesheet" href="https://tile.srsr.ca/sdk/v1/smap.css">
-<script src="https://tile.srsr.ca/sdk/v1/smap.js"></script>
+<link rel="stylesheet" href="smap.css">
+<script src="smap.js"></script>
 ```
 
+The map reads from the public sMap service (`https://tile.srsr.ca`) unless `baseUrl` names another.
+
 ## A minimal map
 
 ```js
@@ -46,6 +57,9 @@ map.setBuildings3D(true);
 map.fitLayer('stops');
 ```
 
+A `popup` option returns an HTML string, which is inserted as it is and never sanitized (escape any feature data you
+put in it), or a DOM node.
+
 `setStyle()` and `setLanguage()` keep your layers. Other calls: `setData`, `setVisible`, `removeLayer`, `layers`,
 `flyTo`, `setProjection`, `on` / `off` / `once`, `remove`. `map.engine` is the renderer's own map for anything the
 SDK does not wrap, and `getEngine()` gives the renderer itself.
@@ -79,12 +93,15 @@ Runs wherever `fetch` exists (browsers, Node.js 18+, workers); elsewhere pass `f
 
 ## Data attribution
 
-The map data credit stays visible on every map, as the data licence requires.
+The map data credit stays visible on every map, as the data licence requires. Every map shows a small sMap badge in
+its bottom-right corner, left of the attribution (above it when the map is too narrow for both).
 
 ## Where the code comes from
 
-`dist/` is copied from the sMap service repository by `tools/sync-js.sh`; `dist/SOURCE.json` records the commit.
-It is never edited here. The type declarations in `types/` are kept in this repository.
+The sources are in `src/` (the Web SDK `smap.js` and `smap.css`, the JS client `smap-client.js` and its types).
+`npm run build` writes `dist/` from them and the rendering engine (an exact devDependency); `dist/SOURCE.json`
+records the version, the engine and the hash of every file. `dist/` is committed and never edited by hand. The type
+declarations of the map SDK are in `types/`.
 
 ## Tests
 

package/dist/SOURCE.json

@@ -1,18 +1,17 @@
 {
-  "repository": "sMap",
-  "commit": "54f7117da908fd02d8df09c85a61777299263e06",
-  "commitSubject": "Version 1.0.1 (was 1.1.0, unreleased)",
-  "uncommittedSources": false,
   "sdkVersion": "1.0.1",
-  "engine": "maplibre-gl 5.24.0",
+  "engine": "maplibre-gl 6.16.0",
   "files": {
-    "smap.mjs": "33375b7d5167ed8aab6e9351cf1e5074200d8654f91d4a5f0aa2c680ada603b8",
-    "smap.cjs": "b878b5a59c6422ed5d98e95848755e549f473574d5366b3babe0a11796825acc",
-    "smap.css": "ab1e70d59ec40465bae7e7030da2f3ccf28133fd502e62bd598eefbadfd7a732",
-    "smap-client.cjs": "fdc7ab0c8e53a2e941c5d28af51fb6c0508b2690d0beec5369a9fa94ceba0392",
-    "smap-client.mjs": "d0bd9ce3a42484888f7627d548f0cd0ff85854c2f9919be867175aae33bf8929",
-    "smap-client.d.cts": "a87a12d46ac61971a5c294afe4df49c481552aed65c7404537dacdc0afaff512",
-    "smap-client.d.mts": "009474b826fb3016b0200cbf40a969ea42ba331c6ff37cfb363c61ce54084e28",
+    "smap.js": "b48a84d65d3937c122f3f67b6cead8b9348913e2447782cca2a3f7a6c5d48ae7",
+    "smap.css": "558e15e5dfb3676e90f4cdfdb277c58f78c3d8de5527c8df1707f6c572241668",
+    "smap-client.js": "8029946bec62ce4806e47e2324f3020b3d049b0a73bb98352cdd307474ae776c",
+    "smap-client.d.ts": "ad701612630a290b2dc0e49250ae25cea965ecb3a145c016bb462cd30f108cf7",
+    "smap.mjs": "b59530982e07703ce3e3ffeaea328f18a86855e99076e737ee41c4dbd186104d",
+    "smap.cjs": "22f7b7248f40d5436cb1cd4c865f06e1a38ab8f9beed96ec3828abf058549a71",
+    "smap-client.cjs": "9956892bea8d367c1d278de11c3850293ad7d963d74d9692ce7194f6deff6f15",
+    "smap-client.mjs": "176a70faf2b4ecb3f998e5823202097b2a9d1bce546c41f6411f2567e2f7e5ae",
+    "smap-client.d.cts": "80b96f5a907caf6295ca073816dc526e8d285f22670c809adaab5242a018e686",
+    "smap-client.d.mts": "a66834cab868a6a0eaf943c1b185a236916cb00ecf32a871f972ab3213eddeba",
     "vendor-licenses.txt": "ee5fc05a0677eaf69601d2c7db0d9ecd6cc27c3abc1d0733bc9ed34707cf8ef2"
   }
 }

package/dist/smap-client.cjs

@@ -1,4 +1,4 @@
-/* Generated by tools/sync-js.sh from the sMap repository (see SOURCE.json). Do not edit. */
+/* Generated by js/build.mjs from js/src (see SOURCE.json). Do not edit. */
 /*! sMap JS client 1.0.1 — tokens, the nearest node, styles, tiles and raw reads, without a map view. */
 /*
  * Runs wherever `fetch` exists: browsers, Node.js 18+, workers; elsewhere (mini programs, older runtimes) pass your

package/dist/smap-client.d.cts

@@ -1,4 +1,4 @@
-// Generated by tools/sync-js.sh. Do not edit.
+// Generated by js/build.mjs. Do not edit.
 // sMap JS client — type declarations (UMD: `require('smap-client')`, `import SMapClient from …`, `window.SMapClient`).
 declare namespace SMapClient {
   interface Options {

package/dist/smap-client.d.mts

@@ -1,4 +1,4 @@
-// Generated by tools/sync-js.sh. Do not edit.
+// Generated by js/build.mjs. Do not edit.
 // sMap JS client — type declarations (UMD: `require('smap-client')`, `import SMapClient from …`, `window.SMapClient`).
 declare namespace SMapClient {
   interface Options {

package/dist/smap-client.d.ts

@@ -0,0 +1,42 @@
+// sMap JS client — type declarations (UMD: `require('smap-client')`, `import SMapClient from …`, `window.SMapClient`).
+declare namespace SMapClient {
+  interface Options {
+    /** The public sMap address, e.g. https://tile.srsr.ca */
+    baseUrl: string;
+    token?: string;
+    getToken?: () => string | Promise<string>;
+    /** A map key (`smk_…`); with a token both are sent and the token is checked first. */
+    apiKey?: string;
+    /** Node URLs known in advance, used while baseUrl is down. */
+    nodes?: string[];
+    /** Read from the nearest node (default true). */
+    nearest?: boolean;
+    fetch?: typeof fetch;
+    /** Per request, default 15000. */
+    timeoutMs?: number;
+  }
+  type StyleFlavor = 'light' | 'white' | 'grayscale' | 'dark' | 'black';
+  interface SMapError extends Error {
+    status: number;
+    url: string;
+  }
+}
+
+declare class SMapClient {
+  constructor(options: SMapClient.Options);
+  static readonly version: string;
+  static tokenExpiry(token: string): number;
+  readonly baseUrl: string;
+  token(): Promise<string | null>;
+  nodes(): Promise<string[]>;
+  resetNodes(): void;
+  request(path: string, headers?: Record<string, string>): Promise<Response>;
+  style(flavor?: SMapClient.StyleFlavor, language?: string): Promise<Record<string, unknown>>;
+  tileJSON(source?: string): Promise<Record<string, unknown>>;
+  tile(source: string, z: number, x: number, y: number): Promise<Uint8Array | null>;
+  range(source: string, start: number, end: number): Promise<Uint8Array>;
+  glyphs(fontstack: string, range: string): Promise<Uint8Array>;
+  authorize(url: string): Promise<{ url: string; headers: Record<string, string> }>;
+}
+
+export = SMapClient;

package/dist/smap-client.js

@@ -0,0 +1,300 @@
+/*! sMap JS client 1.0.1 — tokens, the nearest node, styles, tiles and raw reads, without a map view. */
+/*
+ * Runs wherever `fetch` exists: browsers, Node.js 18+, workers; elsewhere (mini programs, older runtimes) pass your
+ * own `fetch`. UMD: `window.SMapClient`, `require('smap-client')`, or an AMD module.
+ *
+ *   const client = new SMapClient({ baseUrl: 'https://tile.srsr.ca', getToken: () => myServer.mapToken() });
+ *   const keyed = new SMapClient({ baseUrl: 'https://tile.srsr.ca', apiKey: 'smk_…' });   // or a map key
+ *   const tile = await client.tile('basemap', 12, 1143, 1493);   // Uint8Array (vector tile)
+ *   const style = await client.style('light', 'en');             // style document
+ *
+ * Every request goes to the nearest node that answers (asked of baseUrl, remembered for an hour) and moves to the
+ * next one when a node fails.
+ */
+(function (root, factory) {
+  if (typeof define === 'function' && define.amd) { define([], factory); }
+  else if (typeof module === 'object' && module.exports) { module.exports = factory(); }
+  else { root.SMapClient = factory(); }
+}(typeof self !== 'undefined' ? self : this, function () {
+  'use strict';
+
+  var VERSION = '1.0.1';
+  var NODE_TTL = 3600 * 1000;          // the measured order
+  var KNOWN_TTL = 30 * 86400 * 1000;   // the last node list received, used when none can be read
+
+  function unique(list) {
+    var seen = {};
+    return list.filter(function (u) { if (!u || seen[u]) { return false; } seen[u] = true; return true; });
+  }
+  var memory = {};
+
+  function store() {
+    try {
+      if (typeof localStorage !== 'undefined') { localStorage.getItem('smap'); return localStorage; }
+    } catch (e) { /* storage unavailable */ }
+    return { getItem: function (k) { return memory[k] || null; }, setItem: function (k, v) { memory[k] = v; } };
+  }
+
+  function decodeBase64Url(s) {
+    s = s.replace(/-/g, '+').replace(/_/g, '/');
+    while (s.length % 4) { s += '='; }
+    if (typeof atob === 'function') { return atob(s); }
+    return Buffer.from(s, 'base64').toString('binary');
+  }
+
+  /** Seconds since 1970 when a token expires; 0 when it cannot be read. */
+  function tokenExpiry(token) {
+    try { return JSON.parse(decodeBase64Url(String(token).split('.')[1])).exp || 0; } catch (e) { return 0; }
+  }
+
+  function SMapError(message, status, url) {
+    var e = new Error(message);
+    e.name = 'SMapError';
+    e.status = status || 0;
+    e.url = url || '';
+    return e;
+  }
+
+  /**
+   * @param {Object} options
+   * @param {string} options.baseUrl                   the public sMap address (e.g. https://tile.srsr.ca)
+   * @param {string} [options.token]                   a map token; or
+   * @param {function(): (string|Promise<string>)} [options.getToken]  called at start and before each token expires
+   * @param {string} [options.apiKey]                  a map key (`smk_…`); with a token both are sent (token first)
+   * @param {string[]} [options.nodes]                 node URLs known in advance (used while baseUrl is down)
+   * @param {boolean} [options.nearest=true]           read from the nearest node
+   * @param {function} [options.fetch]                 a fetch implementation (default: the global one)
+   * @param {number} [options.timeoutMs=15000]         per request
+   */
+  function SMapClient(options) {
+    if (!(this instanceof SMapClient)) { return new SMapClient(options); }
+    options = options || {};
+    if (!options.baseUrl) { throw SMapError('sMap: baseUrl is required'); }
+    this.baseUrl = String(options.baseUrl).replace(/\/$/, '');
+    this._fetch = options.fetch || (typeof fetch === 'function' ? fetch.bind(typeof self !== 'undefined' ? self : globalThis) : null);
+    if (!this._fetch) { throw SMapError('sMap: no fetch available; pass options.fetch'); }
+    this._token = options.token || null;
+    this._getToken = options.getToken || null;
+    this._apiKey = options.apiKey || null;
+    this._nearest = options.nearest !== false;
+    this._seeds = (options.nodes || []).map(function (u) { return String(u).replace(/\/$/, ''); });
+    this._timeout = options.timeoutMs || 15000;
+    this._nodes = null;      // ordered: nearest first
+    this._picking = null;
+    this._tokening = null;
+  }
+
+  SMapClient.version = VERSION;
+  SMapClient.tokenExpiry = tokenExpiry;
+
+  SMapClient.prototype._timed = function (url, init, ms) {
+    var ctrl = typeof AbortController !== 'undefined' ? new AbortController() : null;
+    var timer = ctrl ? setTimeout(function () { ctrl.abort(); }, ms) : null;
+    init = init || {};
+    if (ctrl) { init.signal = ctrl.signal; }
+    return this._fetch(url, init).then(function (res) { clearTimeout(timer); return res; }, function (e) { clearTimeout(timer); throw e; });
+  };
+
+  /** The token to send now, asking getToken again two minutes before it expires. */
+  SMapClient.prototype.token = function () {
+    var self = this;
+    var exp = this._token ? tokenExpiry(this._token) : 0;
+    var fresh = this._token && (!exp || exp - Date.now() / 1000 > 120);
+    if (fresh || !this._getToken) { return Promise.resolve(this._token); }
+    if (!this._tokening) {
+      this._tokening = Promise.resolve(this._getToken()).then(function (t) {
+        self._token = t;
+        self._tokening = null;
+        return t;
+      }, function (e) { self._tokening = null; throw e; });
+    }
+    return this._tokening;
+  };
+
+  /**
+   * The nodes in the order they are tried: nearest first, then the others; baseUrl alone when nearest is off or the
+   * list cannot be read.
+   *
+   * @returns {Promise<string[]>}
+   */
+  SMapClient.prototype.nodes = function () {
+    var self = this;
+    if (this._nodes) { return Promise.resolve(this._nodes); }
+    if (!this._nearest) { this._nodes = [this.baseUrl]; return Promise.resolve(this._nodes); }
+    if (this._picking) { return this._picking; }
+    var key = 'smap.nodes:' + this.baseUrl;
+    var storage = store();
+    var saved = null;
+    try { saved = JSON.parse(storage.getItem(key) || 'null'); } catch (e) { saved = null; }
+    if (saved && saved.urls && saved.urls.length && Date.now() - saved.at < NODE_TTL) {
+      this._nodes = saved.urls;
+      return Promise.resolve(this._nodes);
+    }
+    // Every node this client knows of: the kept list (30 days), the seed list, then baseUrl.
+    var kept = saved && saved.known && Date.now() - (saved.knownAt || 0) < KNOWN_TTL ? saved.known : [];
+    var known = unique([this.baseUrl].concat(this._seeds, kept));
+    this._picking = this._discover(known)
+      .then(function (list) {
+        var urls = list || unique(self._seeds.concat(kept));
+        if (urls.length === 0) { return { order: [self.baseUrl], known: null }; }
+        return self._measure(urls).then(function (order) { return { order: order, known: list }; });
+      })
+      .then(function (r) {
+        self._nodes = r.order;
+        self._picking = null;
+        // An order is remembered for the hour only when a node list was read; a guess made while nothing answered
+        // is tried again by the next client instead of being kept.
+        var record = { urls: r.known ? r.order : [], at: r.known ? Date.now() : 0, known: r.known || kept, knownAt: r.known ? Date.now() : (saved && saved.knownAt) || 0 };
+        try { storage.setItem(key, JSON.stringify(record)); } catch (e) { /* ignore */ }
+        return r.order;
+      });
+    return this._picking;
+  };
+
+  /** Asks each node in turn for the node list (any node answers the whole list); null when none answers. */
+  SMapClient.prototype._discover = function (candidates) {
+    var self = this;
+    function ask(i) {
+      if (i >= candidates.length) { return Promise.resolve(null); }
+      return self._timed(candidates[i] + '/v1/nodes', {}, 2000)
+        .then(function (res) { return res.ok ? res.json() : null; })
+        .then(function (body) {
+          var urls = ((body && body.nodes) || []).map(function (n) { return String(n.url).replace(/\/$/, ''); });
+          return urls.length ? urls : ask(i + 1);
+        }, function () { return ask(i + 1); });
+    }
+    return ask(0);
+  };
+
+  /** Times one small request to each node: fastest first, silent ones after, baseUrl last when not listed. */
+  SMapClient.prototype._measure = function (urls) {
+    var self = this;
+    return Promise.all(urls.map(function (url) {
+      var t0 = Date.now();
+      return self._timed(url + '/v1/ping', { cache: 'no-store' }, 1500)
+        .then(function (res) { return { url: url, ms: res.ok ? Date.now() - t0 : Infinity }; }, function () { return { url: url, ms: Infinity }; });
+    })).then(function (timed) {
+      timed.sort(function (a, b) { return a.ms - b.ms; });
+      var order = timed.map(function (t) { return t.url; });
+      if (order.indexOf(self.baseUrl) < 0) { order.push(self.baseUrl); }
+      return order;
+    });
+  };
+
+  /** Forgets the chosen node order, so the next request measures again. */
+  SMapClient.prototype.resetNodes = function () {
+    this._nodes = null;
+    var key = 'smap.nodes:' + this.baseUrl;
+    try {
+      var saved = JSON.parse(store().getItem(key) || 'null');
+      // The kept node list survives a reset; only the measured order is forgotten.
+      store().setItem(key, JSON.stringify(saved ? { urls: [], at: 0, known: saved.known, knownAt: saved.knownAt } : null));
+    } catch (e) { /* ignore */ }
+  };
+
+  /**
+   * GET `path` from the nearest node that answers, with the token; a node that fails (network error, 5xx) is moved
+   * to the end and the next one is tried. 4xx answers are final.
+   *
+   * @param {string} path      starting with /
+   * @param {Object} [headers]
+   * @returns {Promise<Response>}
+   */
+  SMapClient.prototype.request = function (path, headers) {
+    var self = this;
+    return Promise.all([this.nodes(), this.token()]).then(function (r) {
+      var nodes = r[0].slice();
+      var token = r[1];
+      var last = null;
+      function attempt(i) {
+        if (i >= nodes.length) { throw last || SMapError('sMap: no node answered', 0, path); }
+        var h = {};
+        for (var k in (headers || {})) { if (Object.prototype.hasOwnProperty.call(headers, k)) { h[k] = headers[k]; } }
+        if (token) { h.Authorization = 'Bearer ' + token; }
+        if (self._apiKey) { h['X-SMap-Key'] = self._apiKey; }
+        var url = nodes[i] + path;
+        return self._timed(url, { headers: h }, self._timeout).then(function (res) {
+          if (res.status >= 500) {
+            last = SMapError('sMap: HTTP ' + res.status, res.status, url);
+            self._demote(nodes[i]);
+            return attempt(i + 1);
+          }
+          if (!res.ok && res.status !== 206) {
+            return res.text().then(function (text) { throw SMapError('sMap: ' + (text || ('HTTP ' + res.status)), res.status, url); });
+          }
+          return res;
+        }, function (e) {
+          last = SMapError('sMap: ' + (e && e.message ? e.message : 'network error'), 0, url);
+          self._demote(nodes[i]);
+          return attempt(i + 1);
+        });
+      }
+      return attempt(0);
+    });
+  };
+
+  SMapClient.prototype._demote = function (url) {
+    if (!this._nodes || this._nodes.length < 2) { return; }
+    var i = this._nodes.indexOf(url);
+    if (i >= 0) { this._nodes.splice(i, 1); this._nodes.push(url); }
+  };
+
+  function bytes(res) { return res.arrayBuffer().then(function (b) { return new Uint8Array(b); }); }
+
+  // A map key also goes in the query of styles and TileJSON: the service carries it into their tile URLs, so a
+  // renderer given the document reads its tiles with the key.
+  SMapClient.prototype._withKey = function (path) {
+    if (!this._apiKey) { return path; }
+    return path + (path.indexOf('?') >= 0 ? '&' : '?') + 'key=' + encodeURIComponent(this._apiKey);
+  };
+
+  /**
+   * A style document ('light', 'white', 'grayscale', 'dark', 'black') with labels in `language`.
+   * Its tile URLs point at the node that answered.
+   */
+  SMapClient.prototype.style = function (flavor, language) {
+    var q = language ? '?lang=' + encodeURIComponent(language) : '';
+    return this.request(this._withKey('/v1/styles/' + encodeURIComponent(flavor || 'light') + q)).then(function (r) { return r.json(); });
+  };
+
+  /** TileJSON of a source (bounds, zooms, layers, tile URL template). */
+  SMapClient.prototype.tileJSON = function (source) {
+    return this.request(this._withKey('/v1/tiles/' + encodeURIComponent(source || 'basemap'))).then(function (r) { return r.json(); });
+  };
+
+  /** One vector tile as bytes; null where the source has no tile (204 / 404). */
+  SMapClient.prototype.tile = function (source, z, x, y) {
+    var path = '/v1/tiles/' + encodeURIComponent(source) + '/' + (z | 0) + '/' + (x | 0) + '/' + (y | 0);
+    return this.request(path).then(function (r) { return r.status === 204 ? null : bytes(r); }, function (e) {
+      if (e && e.status === 404) { return null; }
+      throw e;
+    });
+  };
+
+  /** Raw bytes `[start, end]` (inclusive) of a source's archive, where your access allows raw reads. */
+  SMapClient.prototype.range = function (source, start, end) {
+    return this.request('/' + encodeURIComponent(source) + '.pmtiles', { Range: 'bytes=' + start + '-' + end }).then(bytes);
+  };
+
+  /** A font glyph range (`0-255.pbf` style), for renderers that load fonts themselves. */
+  SMapClient.prototype.glyphs = function (fontstack, range) {
+    return this.request('/v1/fonts/' + encodeURIComponent(fontstack) + '/' + range + '.pbf').then(bytes);
+  };
+
+  /**
+   * Headers and URL rewriting for a renderer that fetches by itself: returns the URL unchanged plus the
+   * Authorization (and map key) headers to add for sMap URLs; none for any other host.
+   */
+  SMapClient.prototype.authorize = function (url) {
+    var self = this;
+    return this.token().then(function (token) {
+      var ours = url.indexOf(self.baseUrl) === 0 || self._seeds.concat(self._nodes || []).some(function (n) { return url.indexOf(n) === 0; });
+      var headers = {};
+      if (ours && token) { headers.Authorization = 'Bearer ' + token; }
+      if (ours && self._apiKey) { headers['X-SMap-Key'] = self._apiKey; }
+      return { url: url, headers: headers };
+    });
+  };
+
+  return SMapClient;
+}));

package/dist/smap-client.mjs

@@ -1,4 +1,4 @@
-/* Generated by tools/sync-js.sh from the sMap repository (see SOURCE.json). Do not edit. */
+/* Generated by js/build.mjs from js/src (see SOURCE.json). Do not edit. */
 var smapClientModule = { exports: {} };
 (function (module, exports, define) {
 /*! sMap JS client 1.0.1 — tokens, the nearest node, styles, tiles and raw reads, without a map view. */