Bake a Mapbox token that is not URL-restricted, so basemaps actually paint

The Driver's report was exact: the pins load and the underlying map does not —
a grey field with data floating on it. That is the URL-restriction signature. The
baked token was scoped to doxa.life, so tiles returned 403 from nuxtbase.app,
from localhost, and from a bare origin, while the style document returned 200
everywhere. The map therefore booted, drew every dot, and showed no basemap.

The Driver supplied a token with no URL restriction. Measured side by side: it
serves tiles 200 with no Referer, from nuxtbase.app and from localhost, where the
previous one returns 403 in all three cases.

Also empties tokenUrl. It pointed at the endpoint that serves the restricted
token, and that endpoint sits above the baked token in the ladder — leaving it
set would fetch the broken token at runtime and overwrite the good one.

All 43 leaves rebuilt and carry the new token; none carries the old one. Verified
in a browser with no Referer sent, the way a real visitor arrives: nine of nine
tile requests returned 200.

This unblocks the interoperability work, which could not be judged while the map
underneath was blank.

public/.build.lock

@@ -1 +1 @@
-pid=3232086 started=2026-09-22T10:59:21Z by=lk10x
+pid=3289553 started=2026-09-22T11:09:19Z by=lk10x

public/doxa-maps/all-people-groups/all-people-groups/index.html

@@ -49,8 +49,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = false;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/big-picture/big-picture/big-picture/index.html

@@ -57,8 +57,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/big-picture/big-picture/frontier/index.html

@@ -57,8 +57,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/big-picture/big-picture/index.html

@@ -57,8 +57,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/cities-internet/connectivity-list/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/cities-internet/connectivity-map/index.html

@@ -49,8 +49,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = false;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/cities-internet/data-tables/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/country-posters/countries-map/index.html

@@ -49,8 +49,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = false;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/country-posters/country-poster-wall/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/dashboard-plus-grid/dashboard-plus-grid/default/index.html

@@ -60,8 +60,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = false;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/dashboard-plus-grid/dashboard-plus-grid/index.html

@@ -60,8 +60,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = false;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/demo-map/demo-map/index.html

@@ -49,8 +49,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = false;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/demo-map/demo-map/maplibre/index.html

@@ -47,8 +47,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/doxa-maps-spa/doxa-maps-spa/app/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/doxa-maps-spa/doxa-maps-spa/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/doxa-research-map/research-map/index.html

@@ -49,8 +49,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = false;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/doxa-simple-map/doxa-simple-map/adoption/index.html

@@ -49,8 +49,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = false;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/doxa-simple-map/doxa-simple-map/engagement/index.html

@@ -49,8 +49,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = false;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/doxa-simple-map/doxa-simple-map/index.html

@@ -49,8 +49,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = false;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/doxa-simple-map/doxa-simple-map/prayer/index.html

@@ -49,8 +49,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = false;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/doxa-vision-card/doxa-vision-card/default/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/doxa-vision-card/doxa-vision-card/frontier/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/doxa-vision-card/doxa-vision-card/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/golden-path-check/golden-path-check/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/gospel-resources/charts/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/gospel-resources/data-tables/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/gospel-resources/resources-list/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/gospel-resources/resources-map/index.html

@@ -49,8 +49,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = false;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/my-upg-100-list/poster-wall/index.html

@@ -49,8 +49,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = false;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/my-upg-100-list/upg-100-list/index.html

@@ -49,8 +49,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = false;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/my-upg-100-list/upg-100-mfe/index.html

@@ -60,8 +60,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = false;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/people-groups-grid/people-groups-grid/driven/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/people-groups-grid/people-groups-grid/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/people-groups-grid/people-groups-grid/people-groups-grid/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/plugin-studio/plugin-studio/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/plugin-studio/plugin-studio/studio/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/research-dashboard/research-dashboard/index.html

@@ -49,8 +49,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = false;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/research-map-plus-grid/research-map-plus-grid/default/index.html

@@ -57,8 +57,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/research-map-plus-grid/research-map-plus-grid/index.html

@@ -57,8 +57,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/stack-demo/stack-demo/index.html

@@ -57,8 +57,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/stack-demo/stack-demo/pair/index.html

@@ -57,8 +57,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/template-bundle/template-map-a/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

public/doxa-maps/template-bundle/template-map-b/index.html

@@ -46,8 +46,8 @@
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
       var TOKEN_FREE = true;
-      var TOKEN_SRC = "https://doxa.life/api/maps/token";
+      var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg";
+      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.

vite.doxa-maps-build-config.json

@@ -1,11 +1,11 @@
 {
-  "//": "THE single build-config for this STANDALONE doxa-maps bundler. Edit this ONE file, then run `bun run build`. FIELDS: 'name' = the output folder name the tree is written as. 'paths' = EXTRA folders to copy the whole tree into. EMPTY and normally stays empty: the build writes into public/<name>/ directly, because public/ is the committed served web-root rather than something assembled at build time. STANDALONE NOTE (2026-07-30): the old value ['../../../public/js'] pointed into the dx-life Nuxt app's public dir — meaningless in this repo, and the whole point of standing this bundler up on its own is that dx-life consumes maps from the CDN instead of hosting a copy. So 'paths' is now EMPTY: the tree is written to ./app/<name>/ only, and that ONE tree is what all three targets consume (Railway/CDN static host, Capacitor webDir, local staging). If you ever want to ALSO publish into a local dx-life checkout, add its path back here. 'embedBaseUrl' = public URL where the <name>/ tree is served, used to build ABSOLUTE paste-anywhere embed snippets for partner sites ('' = RELATIVE ./bundle/profile/... URLs so the dropped folder is position-independent — keeps the drop-portability gate green and is what Capacitor needs, since the app loads from https://localhost). 'tokenUrl' = the endpoint every generated map page fetches its Mapbox token from — a URL, NOT a secret. Set it ABSOLUTE (https://doxa.life/api/maps/token) so both a CDN-hosted folder and the mobile app work; the token stays remote and only the URL ships. window.MAP_TOKEN_URL overrides at runtime. Your endpoint must send CORS headers permitting https://localhost (the Capacitor origin) and any partner domain. 'token' = OPT-IN literal token baked into every page — LEAVE EMPTY; prefer tokenUrl. 'assetsBaseUrl' = where the SHARED asset tree (previews, posters, boundaries) is served from. Vite no longer copies public/ into each bundle (publicDir:false in vite.config.js), so pages are TOLD where the one shared copy lives. EMPTY = a relative path derived per page depth, which keeps a dropped folder self-contained under one web-root. Set it ABSOLUTE (https://maps.doxa.life/assets) for partner embeds and the mobile app, where there is no shared web-root to climb to. Same modular pattern as tokenUrl and window.MAP_APP_API_URL. 'dropin.include' = THE drop-in contract, declared here and nowhere else: the only root entries of public/ that `sync-dropin --from-config` copies into a host — index.html (the generated root page — the built plugin gallery, internal/generate-gallery.mjs), assets/ (data) and <name>/ (the bundle folders + manifest.json); with --prune everything else in the host's drop-in folder is removed, and `public-hygiene-check --strict` fails on any other root entry. 'dropin.exclude' = built files INSIDE the allowlist that are still not shipped: data no page fetches (the full people-groups CSV, the tables only internal scripts read, the table index). They stay in public/ for the scripts; `sync-dropin --from-config` skips them and counts them as 'excluded (not shipped)', and a copy already in the host is removed like any stale file.",
+  "//": "THE single build-config for this STANDALONE doxa-maps bundler. Edit this ONE file, then run `bun run build`. FIELDS: 'name' = the output folder name the tree is written as. 'paths' = EXTRA folders to copy the whole tree into. EMPTY and normally stays empty: the build writes into public/<name>/ directly, because public/ is the committed served web-root rather than something assembled at build time. STANDALONE NOTE (2026-07-30): the old value ['../../../public/js'] pointed into the dx-life Nuxt app's public dir \u2014 meaningless in this repo, and the whole point of standing this bundler up on its own is that dx-life consumes maps from the CDN instead of hosting a copy. So 'paths' is now EMPTY: the tree is written to ./app/<name>/ only, and that ONE tree is what all three targets consume (Railway/CDN static host, Capacitor webDir, local staging). If you ever want to ALSO publish into a local dx-life checkout, add its path back here. 'embedBaseUrl' = public URL where the <name>/ tree is served, used to build ABSOLUTE paste-anywhere embed snippets for partner sites ('' = RELATIVE ./bundle/profile/... URLs so the dropped folder is position-independent \u2014 keeps the drop-portability gate green and is what Capacitor needs, since the app loads from https://localhost). 'tokenUrl' = the endpoint every generated map page fetches its Mapbox token from \u2014 a URL, NOT a secret. Set it ABSOLUTE (https://doxa.life/api/maps/token) so both a CDN-hosted folder and the mobile app work; the token stays remote and only the URL ships. window.MAP_TOKEN_URL overrides at runtime. Your endpoint must send CORS headers permitting https://localhost (the Capacitor origin) and any partner domain. 'token' = OPT-IN literal token baked into every page \u2014 LEAVE EMPTY; prefer tokenUrl. 'assetsBaseUrl' = where the SHARED asset tree (previews, posters, boundaries) is served from. Vite no longer copies public/ into each bundle (publicDir:false in vite.config.js), so pages are TOLD where the one shared copy lives. EMPTY = a relative path derived per page depth, which keeps a dropped folder self-contained under one web-root. Set it ABSOLUTE (https://maps.doxa.life/assets) for partner embeds and the mobile app, where there is no shared web-root to climb to. Same modular pattern as tokenUrl and window.MAP_APP_API_URL. 'dropin.include' = THE drop-in contract, declared here and nowhere else: the only root entries of public/ that `sync-dropin --from-config` copies into a host \u2014 index.html (the generated root page \u2014 the built plugin gallery, internal/generate-gallery.mjs), assets/ (data) and <name>/ (the bundle folders + manifest.json); with --prune everything else in the host's drop-in folder is removed, and `public-hygiene-check --strict` fails on any other root entry. 'dropin.exclude' = built files INSIDE the allowlist that are still not shipped: data no page fetches (the full people-groups CSV, the tables only internal scripts read, the table index). They stay in public/ for the scripts; `sync-dropin --from-config` skips them and counts them as 'excluded (not shipped)', and a copy already in the host is removed like any stale file.",
   "name": "doxa-maps",
   "paths": [],
   "embedBaseUrl": "",
   "assetsBaseUrl": "",
-  "tokenUrl": "https://doxa.life/api/maps/token",
+  "tokenUrl": "",
-  "token": "pk.eyJ1IjoiZG94YWxpZmUiLCJhIjoiY211YXkxa25yMDI2YTJ3cTV6ZXhydTZzcyJ9.fBMmvu0Y0S9u8tnHOyVhxg",
+  "token": "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ",
   "dropin": {
     "dest": "../doxa-life/public/embed/doxa-maps-build",
     "include": [
@@ -27,13 +27,14 @@
   "qaWidget": false,
   "//token": [
     "THE PUBLIC MAPBOX KEY, BAKED ON PURPOSE (Driver ruling 2026-09-21): 'all maps can use the pk",
-    "from the api, no problem — if they want to set a mapbox sk they can'. This is token-ladder",
+    "from the api, no problem \u2014 if they want to set a mapbox sk they can'. This is token-ladder",
     "RUNG 3 (see internal/generate-tree.mjs:595): rungs 1-3 are used DIRECTLY with no network call,",
-    "so baking it makes every map work out of the box on ANY host — including one with no",
+    "so baking it makes every map work out of the box on ANY host \u2014 including one with no",
     "/api/maps/token endpoint and no CORS on the fallback, which is exactly why nuxtbase.app maps",
     "were blank. SOURCE OF TRUTH: https://doxa.life/api/maps/token (see",
     "_qa-cycle/01-ideation-research/REFERENCE-mapbox-token-endpoint.md). Re-fetch from there rather",
     "than copying this literal around. A pk. is a PUBLIC key protected by URL restrictions, not by",
-    "secrecy — never put an sk. here; check:public-hygiene still fails the build on sk./tk."
+    "secrecy \u2014 never put an sk. here; check:public-hygiene still fails the build on sk./tk."
-  ]
+  ],
+  "//tokenUrl-2026-09-22": "EMPTIED 2026-09-22. It pointed at https://doxa.life/api/maps/token, which serves the URL-RESTRICTED doxalife token \u2014 tiles 403 from every origin except doxa.life, so the basemap rendered as an empty void while pins drew fine (the Driver's exact report: 'it's loading the pins, but it's not loading the actual underlying map'). That endpoint sits ABOVE the baked token in the ladder, so leaving it set would fetch the broken token and overwrite the good one. Measured: gosystems token = 200 from no-Referer, nuxtbase.app AND localhost; doxalife token = 403 from all three."
 }