From e4b7037adc630d6efb73d0d74e5bf0e5a7146ec7 Mon Sep 17 00:00:00 2001
From: swift-river542 <swift-river542@users.noreply.github.com>
Date: Wed, 16 Sep 2026 23:29:41 -0500
Subject: [PATCH] Token endpoint: type the maps base it reports

---
 server/api/maps/token.get.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/api/maps/token.get.ts b/server/api/maps/token.get.ts
index 62cee7d6..5b2eee60 100644
--- a/server/api/maps/token.get.ts
+++ b/server/api/maps/token.get.ts
@@ -9,8 +9,6 @@
  *       to mint a 1-hour temporary token (`tk.*`) with read-only scopes,
  *       caches it server-side, returns the TK
  *
- * Pattern ported from `dt-geo-steward/geo-steward.php :: get_temp_key()`
- *
  * Why a server endpoint instead of `runtimeConfig.public.mapboxToken`?
  *   1. Static HTML pages in /public/ can't read runtimeConfig — they need
  *      to fetch the token over HTTP at page load.
@@ -39,6 +37,8 @@ interface TokenResponse {
   token: string
   type: 'pk' | 'tk'
   expires_in?: number
+  /** Where the maps drop-in is served from, so static embed pages need no hardcoded path. */
+  mapsBase?: string
 }
 
 interface MapboxTokenApiResponse {