Rebuild the consumers main left stale (build owner, README rule 5)

check:composite-freshness found stale on main: all-people-groups
big-picture
cities-internet
country-posters
dashboard-plus-grid
demo-map
doxa-maps-spa
doxa-research-map
doxa-simple-map
gospel-resources
key-cities
my-upg-100-list
people-groups-grid
plugin-studio
pplr-data-maps
prayer-walk-planner
regions-dashboard
research-dashboard
research-map-plus-grid
stack-demo
template-bundle
upg-neighbor
wall-of-people-groups. Rebuilt, tree + SRI
regenerated; the landing precondition (fresh, one folder, SRI) passed in main-capture scan.

public/dx-maps/all-people-groups/all-people-groups/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <all-people-groups> custom element. -->
-  <script src="../all-people-groups.js" integrity="sha384-npdy7qTJnd1il1A28KBu1GtvBQE19MgD85j5NWxj/IolrBF3sKhYTzl/iqgRQAvT" crossorigin="anonymous"></script>
+  <script src="../all-people-groups.js" integrity="sha384-1Xz5+oArwB0dFAMrA6OS7QQYHa1uo8ZIk8SqvRk/bj150Htdu1RQQO0WNAR9NWVY" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"profile":"all-people-groups","dataSource":"pray-tools","instanceId":"all-people-groups-all-people-groups","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/big-picture/big-picture/big-picture/index.html

@@ -43,7 +43,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <bp-big-picture> custom element. -->
-  <script src="../../big-picture.js" integrity="sha384-VURTOPp7qXzm2yZCpoIrqEhMrC1hbAyGrNmg9RhpzTKqmxCr9fNTdPqexzzgS8OH" crossorigin="anonymous"></script>
+  <script src="../../big-picture.js" integrity="sha384-ImYc8ADuJJoFHeFxFQoAzvWrSlk23+ae2YJGFG+Fy7qwr07Z9gGkcRRclf9c70JL" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -62,20 +62,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"big-picture","provider":"maplibre","instanceId":"bp-big-picture"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -143,13 +142,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -180,7 +190,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/big-picture/big-picture/frontier/index.html

@@ -43,7 +43,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <bp-big-picture> custom element. -->
-  <script src="../../big-picture.js" integrity="sha384-VURTOPp7qXzm2yZCpoIrqEhMrC1hbAyGrNmg9RhpzTKqmxCr9fNTdPqexzzgS8OH" crossorigin="anonymous"></script>
+  <script src="../../big-picture.js" integrity="sha384-ImYc8ADuJJoFHeFxFQoAzvWrSlk23+ae2YJGFG+Fy7qwr07Z9gGkcRRclf9c70JL" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -62,20 +62,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"big-picture","provider":"maplibre","instanceId":"bp-big-picture-frontier","accent":"#22d3ee","title":"Big Picture — Frontier Focus"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -143,13 +142,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -180,7 +190,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/big-picture/big-picture/index.html

@@ -43,7 +43,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <bp-big-picture> custom element. -->
-  <script src="../big-picture.js" integrity="sha384-VURTOPp7qXzm2yZCpoIrqEhMrC1hbAyGrNmg9RhpzTKqmxCr9fNTdPqexzzgS8OH" crossorigin="anonymous"></script>
+  <script src="../big-picture.js" integrity="sha384-ImYc8ADuJJoFHeFxFQoAzvWrSlk23+ae2YJGFG+Fy7qwr07Z9gGkcRRclf9c70JL" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -62,20 +62,19 @@
       var BASE_CONFIG = {"profile":"big-picture","dataSource":"pray-tools","instanceId":"big-picture-big-picture","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = true;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -143,13 +142,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -180,7 +190,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/cities-internet/connectivity-list/index.html

@@ -32,7 +32,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <cities-internet-map> custom element. -->
-  <script src="../cities-internet.js" integrity="sha384-mrFyobv27Rez+r7D8zfx8v0zV8anFpzKWuInX4SHo96KVnQhqOitVfILY4tjdBEi" crossorigin="anonymous"></script>
+  <script src="../cities-internet.js" integrity="sha384-07GgsheJ8VeTcZnXoAegSMDp1NEw4aheXhbTzdygYEpF1VxRWc0f30KvG4bjF2cd" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"profile":"connectivity-list","dataSource":"pray-tools","instanceId":"cities-internet-connectivity-list","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/cities-internet/connectivity-map/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <cities-internet-map> custom element. -->
-  <script src="../cities-internet.js" integrity="sha384-mrFyobv27Rez+r7D8zfx8v0zV8anFpzKWuInX4SHo96KVnQhqOitVfILY4tjdBEi" crossorigin="anonymous"></script>
+  <script src="../cities-internet.js" integrity="sha384-07GgsheJ8VeTcZnXoAegSMDp1NEw4aheXhbTzdygYEpF1VxRWc0f30KvG4bjF2cd" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"pinHint":false,"profile":"connectivity-map","dataSource":"pray-tools","instanceId":"cities-internet-connectivity-map","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/cities-internet/data-tables/index.html

@@ -32,7 +32,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <cities-internet-map> custom element. -->
-  <script src="../cities-internet.js" integrity="sha384-mrFyobv27Rez+r7D8zfx8v0zV8anFpzKWuInX4SHo96KVnQhqOitVfILY4tjdBEi" crossorigin="anonymous"></script>
+  <script src="../cities-internet.js" integrity="sha384-07GgsheJ8VeTcZnXoAegSMDp1NEw4aheXhbTzdygYEpF1VxRWc0f30KvG4bjF2cd" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"profile":"data-tables","dataSource":"pray-tools","instanceId":"cities-internet-data-tables","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/country-posters/countries-map/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <country-posters-map> custom element. -->
-  <script src="../country-posters.js" integrity="sha384-n0T9rOOsC50ppZASO07UWxyFCKTfilAMgcgn3+zG48uRKivmw2cEkraA+nXic9v7" crossorigin="anonymous"></script>
+  <script src="../country-posters.js" integrity="sha384-VAW6sAD2B2Mn52Yjihq0YuQ+xD+CJ70ZeIK2eR06Lg6DeBDyVftjlen9wduubQN2" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"profile":"countries-map","dataSource":"pray-tools","instanceId":"country-posters-countries-map","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/country-posters/country-poster-wall/index.html

@@ -32,7 +32,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <country-posters-map> custom element. -->
-  <script src="../country-posters.js" integrity="sha384-n0T9rOOsC50ppZASO07UWxyFCKTfilAMgcgn3+zG48uRKivmw2cEkraA+nXic9v7" crossorigin="anonymous"></script>
+  <script src="../country-posters.js" integrity="sha384-VAW6sAD2B2Mn52Yjihq0YuQ+xD+CJ70ZeIK2eR06Lg6DeBDyVftjlen9wduubQN2" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"profile":"country-poster-wall","dataSource":"pray-tools","instanceId":"country-posters-country-poster-wall","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/country-posters/country-posters-mfe/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -47,7 +47,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <country-posters-map> custom element. -->
-  <script src="../country-posters.js" integrity="sha384-n0T9rOOsC50ppZASO07UWxyFCKTfilAMgcgn3+zG48uRKivmw2cEkraA+nXic9v7" crossorigin="anonymous"></script>
+  <script src="../country-posters.js" integrity="sha384-VAW6sAD2B2Mn52Yjihq0YuQ+xD+CJ70ZeIK2eR06Lg6DeBDyVftjlen9wduubQN2" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -66,20 +66,19 @@
       var BASE_CONFIG = {"pinHint":false,"profile":"country-posters-mfe","dataSource":"pray-tools","instanceId":"country-posters-country-posters-mfe","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = true;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -147,13 +146,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -184,7 +194,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/dashboard-plus-grid/dashboard-plus-grid/default/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -47,7 +47,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <dashboard-plus-grid> custom element. -->
-  <script src="../../dashboard-plus-grid.js" integrity="sha384-F2o7EFSzJSppnagqUHP73QA8s3LSZ+XiyNN6ltsG2sHhGpRkQFG/3gfIgHIvOa6i" crossorigin="anonymous"></script>
+  <script src="../../dashboard-plus-grid.js" integrity="sha384-NHCFT6UbfunuuoLSLNUODnWRCfVIXvHmy9HkdAADg5n24oL/s3FPMOofUde3hsIH" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -66,20 +66,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"dashboard-plus-grid"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = true;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -147,13 +146,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -184,7 +194,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/dashboard-plus-grid/dashboard-plus-grid/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -47,7 +47,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <dashboard-plus-grid> custom element. -->
-  <script src="../dashboard-plus-grid.js" integrity="sha384-F2o7EFSzJSppnagqUHP73QA8s3LSZ+XiyNN6ltsG2sHhGpRkQFG/3gfIgHIvOa6i" crossorigin="anonymous"></script>
+  <script src="../dashboard-plus-grid.js" integrity="sha384-NHCFT6UbfunuuoLSLNUODnWRCfVIXvHmy9HkdAADg5n24oL/s3FPMOofUde3hsIH" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -66,20 +66,19 @@
       var BASE_CONFIG = {"profile":"dashboard-plus-grid","dataSource":"pray-tools","instanceId":"dashboard-plus-grid-dashboard-plus-grid","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = true;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -147,13 +146,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -184,7 +194,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/demo-map/demo-map/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <demo-map> custom element. -->
-  <script src="../demo-map.js" integrity="sha384-e01v7Yez3VLCT6UVd24Qg5fSSzmX4emHdEC/9d+1K/ekrk2JFnBxi4fhPou+KweP" crossorigin="anonymous"></script>
+  <script src="../demo-map.js" integrity="sha384-PvHpgNfi1QG8ktakGMp+MHnQUAhIHOThv0lg8WsnTkfXqlyi7RUXgJPaUnuD+zb9" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"profile":"demo-map","dataSource":"pray-tools","instanceId":"demo-map-demo-map","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/demo-map/demo-map/maplibre/index.html

@@ -33,7 +33,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <demo-map> custom element. -->
-  <script src="../../demo-map.js" integrity="sha384-e01v7Yez3VLCT6UVd24Qg5fSSzmX4emHdEC/9d+1K/ekrk2JFnBxi4fhPou+KweP" crossorigin="anonymous"></script>
+  <script src="../../demo-map.js" integrity="sha384-PvHpgNfi1QG8ktakGMp+MHnQUAhIHOThv0lg8WsnTkfXqlyi7RUXgJPaUnuD+zb9" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -52,20 +52,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"demo-map","provider":"maplibre","instanceId":"demo-maplibre"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -133,13 +132,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -170,7 +180,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/doxa-maps-spa/doxa-maps-spa/app/index.html

@@ -32,7 +32,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <doxa-maps-spa> custom element. -->
-  <script src="../../doxa-maps-spa.js" integrity="sha384-OgWFHE2O/j6eIlfJW2ohSIlPJrQvY3gBw46XjMOXFivfDfF0cvV6qB3ycJwOmPoQ" crossorigin="anonymous"></script>
+  <script src="../../doxa-maps-spa.js" integrity="sha384-4XdvanwhlFCgIfHtQEmQ04N6RiXTd2NzWgqEDL0n2Kr5r3xdHj9pd56UTgWNN7yo" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"doxa-maps-spa","provider":"maplibre","instanceId":"doxa-maps-spa-app","title":"Research Gallery"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/doxa-maps-spa/doxa-maps-spa/index.html

@@ -32,7 +32,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <doxa-maps-spa> custom element. -->
-  <script src="../doxa-maps-spa.js" integrity="sha384-OgWFHE2O/j6eIlfJW2ohSIlPJrQvY3gBw46XjMOXFivfDfF0cvV6qB3ycJwOmPoQ" crossorigin="anonymous"></script>
+  <script src="../doxa-maps-spa.js" integrity="sha384-4XdvanwhlFCgIfHtQEmQ04N6RiXTd2NzWgqEDL0n2Kr5r3xdHj9pd56UTgWNN7yo" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"profile":"doxa-maps-spa","dataSource":"pray-tools","instanceId":"doxa-maps-spa-doxa-maps-spa","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/doxa-maps-spa/manifest.json

@@ -5,15 +5,14 @@
   "bundleCount": 23,
   "profileCount": 35,
   "runtime": {
-    "apiBaseUrl": "https://pray.doxa.life",
+    "apiBaseUrl": "https://pray.doxa.life"
-    "token": "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ"
   },
   "bundles": [
     {
       "bundle": "all-people-groups",
       "scriptUrl": "./all-people-groups/all-people-groups.js",
       "output": "dx-maps/all-people-groups/all-people-groups.js",
-      "integrity": "sha384-npdy7qTJnd1il1A28KBu1GtvBQE19MgD85j5NWxj/IolrBF3sKhYTzl/iqgRQAvT",
+      "integrity": "sha384-1Xz5+oArwB0dFAMrA6OS7QQYHa1uo8ZIk8SqvRk/bj150Htdu1RQQO0WNAR9NWVY",
       "elements": [
         "all-people-groups"
       ],
@@ -29,7 +28,7 @@
           "scriptUrl": "./all-people-groups/all-people-groups.js",
           "embed": {
             "iframe": "<iframe src=\"./all-people-groups/all-people-groups/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./all-people-groups/all-people-groups.js\" integrity=\"sha384-npdy7qTJnd1il1A28KBu1GtvBQE19MgD85j5NWxj/IolrBF3sKhYTzl/iqgRQAvT\" crossorigin=\"anonymous\"></script>\n<all-people-groups profile-config='{\"profile\":\"all-people-groups\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></all-people-groups>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./all-people-groups/all-people-groups.js\" integrity=\"sha384-1Xz5+oArwB0dFAMrA6OS7QQYHa1uo8ZIk8SqvRk/bj150Htdu1RQQO0WNAR9NWVY\" crossorigin=\"anonymous\"></script>\n<all-people-groups profile-config='{\"profile\":\"all-people-groups\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></all-people-groups>"
           },
           "bundle": "all-people-groups"
         }
@@ -39,7 +38,7 @@
       "bundle": "big-picture",
       "scriptUrl": "./big-picture/big-picture.js",
       "output": "dx-maps/big-picture/big-picture.js",
-      "integrity": "sha384-VURTOPp7qXzm2yZCpoIrqEhMrC1hbAyGrNmg9RhpzTKqmxCr9fNTdPqexzzgS8OH",
+      "integrity": "sha384-ImYc8ADuJJoFHeFxFQoAzvWrSlk23+ae2YJGFG+Fy7qwr07Z9gGkcRRclf9c70JL",
       "elements": [
         "bp-big-picture",
         "bp-research-header",
@@ -61,7 +60,7 @@
           "scriptUrl": "./big-picture/big-picture.js",
           "embed": {
             "iframe": "<iframe src=\"./big-picture/big-picture/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./big-picture/big-picture.js\" integrity=\"sha384-VURTOPp7qXzm2yZCpoIrqEhMrC1hbAyGrNmg9RhpzTKqmxCr9fNTdPqexzzgS8OH\" crossorigin=\"anonymous\"></script>\n<bp-big-picture profile-config='{\"profile\":\"big-picture\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></bp-big-picture>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./big-picture/big-picture.js\" integrity=\"sha384-ImYc8ADuJJoFHeFxFQoAzvWrSlk23+ae2YJGFG+Fy7qwr07Z9gGkcRRclf9c70JL\" crossorigin=\"anonymous\"></script>\n<bp-big-picture profile-config='{\"profile\":\"big-picture\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></bp-big-picture>"
           },
           "instances": [
             {
@@ -105,7 +104,7 @@
       "bundle": "cities-internet",
       "scriptUrl": "./cities-internet/cities-internet.js",
       "output": "dx-maps/cities-internet/cities-internet.js",
-      "integrity": "sha384-mrFyobv27Rez+r7D8zfx8v0zV8anFpzKWuInX4SHo96KVnQhqOitVfILY4tjdBEi",
+      "integrity": "sha384-07GgsheJ8VeTcZnXoAegSMDp1NEw4aheXhbTzdygYEpF1VxRWc0f30KvG4bjF2cd",
       "elements": [
         "cities-internet-map"
       ],
@@ -121,7 +120,7 @@
           "scriptUrl": "./cities-internet/cities-internet.js",
           "embed": {
             "iframe": "<iframe src=\"./cities-internet/connectivity-list/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./cities-internet/cities-internet.js\" integrity=\"sha384-mrFyobv27Rez+r7D8zfx8v0zV8anFpzKWuInX4SHo96KVnQhqOitVfILY4tjdBEi\" crossorigin=\"anonymous\"></script>\n<cities-internet-map profile-config='{\"profile\":\"connectivity-list\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></cities-internet-map>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./cities-internet/cities-internet.js\" integrity=\"sha384-07GgsheJ8VeTcZnXoAegSMDp1NEw4aheXhbTzdygYEpF1VxRWc0f30KvG4bjF2cd\" crossorigin=\"anonymous\"></script>\n<cities-internet-map profile-config='{\"profile\":\"connectivity-list\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></cities-internet-map>"
           }
         },
         {
@@ -135,7 +134,7 @@
           "scriptUrl": "./cities-internet/cities-internet.js",
           "embed": {
             "iframe": "<iframe src=\"./cities-internet/connectivity-map/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./cities-internet/cities-internet.js\" integrity=\"sha384-mrFyobv27Rez+r7D8zfx8v0zV8anFpzKWuInX4SHo96KVnQhqOitVfILY4tjdBEi\" crossorigin=\"anonymous\"></script>\n<cities-internet-map profile-config='{\"profile\":\"connectivity-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></cities-internet-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./cities-internet/cities-internet.js\" integrity=\"sha384-07GgsheJ8VeTcZnXoAegSMDp1NEw4aheXhbTzdygYEpF1VxRWc0f30KvG4bjF2cd\" crossorigin=\"anonymous\"></script>\n<cities-internet-map profile-config='{\"profile\":\"connectivity-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></cities-internet-map>"
           }
         },
         {
@@ -149,7 +148,7 @@
           "scriptUrl": "./cities-internet/cities-internet.js",
           "embed": {
             "iframe": "<iframe src=\"./cities-internet/data-tables/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./cities-internet/cities-internet.js\" integrity=\"sha384-mrFyobv27Rez+r7D8zfx8v0zV8anFpzKWuInX4SHo96KVnQhqOitVfILY4tjdBEi\" crossorigin=\"anonymous\"></script>\n<cities-internet-map profile-config='{\"profile\":\"data-tables\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></cities-internet-map>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./cities-internet/cities-internet.js\" integrity=\"sha384-07GgsheJ8VeTcZnXoAegSMDp1NEw4aheXhbTzdygYEpF1VxRWc0f30KvG4bjF2cd\" crossorigin=\"anonymous\"></script>\n<cities-internet-map profile-config='{\"profile\":\"data-tables\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></cities-internet-map>"
           }
         }
       ]
@@ -158,7 +157,7 @@
       "bundle": "country-posters",
       "scriptUrl": "./country-posters/country-posters.js",
       "output": "dx-maps/country-posters/country-posters.js",
-      "integrity": "sha384-n0T9rOOsC50ppZASO07UWxyFCKTfilAMgcgn3+zG48uRKivmw2cEkraA+nXic9v7",
+      "integrity": "sha384-VAW6sAD2B2Mn52Yjihq0YuQ+xD+CJ70ZeIK2eR06Lg6DeBDyVftjlen9wduubQN2",
       "elements": [
         "country-posters-map"
       ],
@@ -178,7 +177,7 @@
           "scriptUrl": "./country-posters/country-posters.js",
           "embed": {
             "iframe": "<iframe src=\"./country-posters/countries-map/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./country-posters/country-posters.js\" integrity=\"sha384-n0T9rOOsC50ppZASO07UWxyFCKTfilAMgcgn3+zG48uRKivmw2cEkraA+nXic9v7\" crossorigin=\"anonymous\"></script>\n<country-posters-map profile-config='{\"profile\":\"countries-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></country-posters-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./country-posters/country-posters.js\" integrity=\"sha384-VAW6sAD2B2Mn52Yjihq0YuQ+xD+CJ70ZeIK2eR06Lg6DeBDyVftjlen9wduubQN2\" crossorigin=\"anonymous\"></script>\n<country-posters-map profile-config='{\"profile\":\"countries-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></country-posters-map>"
           }
         },
         {
@@ -192,7 +191,7 @@
           "scriptUrl": "./country-posters/country-posters.js",
           "embed": {
             "iframe": "<iframe src=\"./country-posters/country-poster-wall/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./country-posters/country-posters.js\" integrity=\"sha384-n0T9rOOsC50ppZASO07UWxyFCKTfilAMgcgn3+zG48uRKivmw2cEkraA+nXic9v7\" crossorigin=\"anonymous\"></script>\n<country-posters-map profile-config='{\"profile\":\"country-poster-wall\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></country-posters-map>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./country-posters/country-posters.js\" integrity=\"sha384-VAW6sAD2B2Mn52Yjihq0YuQ+xD+CJ70ZeIK2eR06Lg6DeBDyVftjlen9wduubQN2\" crossorigin=\"anonymous\"></script>\n<country-posters-map profile-config='{\"profile\":\"country-poster-wall\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></country-posters-map>"
           }
         },
         {
@@ -206,7 +205,7 @@
           "scriptUrl": "./country-posters/country-posters.js",
           "embed": {
             "iframe": "<iframe src=\"./country-posters/country-posters-mfe/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./country-posters/country-posters.js\" integrity=\"sha384-n0T9rOOsC50ppZASO07UWxyFCKTfilAMgcgn3+zG48uRKivmw2cEkraA+nXic9v7\" crossorigin=\"anonymous\"></script>\n<country-posters-map profile-config='{\"profile\":\"country-posters-mfe\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></country-posters-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./country-posters/country-posters.js\" integrity=\"sha384-VAW6sAD2B2Mn52Yjihq0YuQ+xD+CJ70ZeIK2eR06Lg6DeBDyVftjlen9wduubQN2\" crossorigin=\"anonymous\"></script>\n<country-posters-map profile-config='{\"profile\":\"country-posters-mfe\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></country-posters-map>"
           }
         }
       ]
@@ -215,7 +214,7 @@
       "bundle": "dashboard-plus-grid",
       "scriptUrl": "./dashboard-plus-grid/dashboard-plus-grid.js",
       "output": "dx-maps/dashboard-plus-grid/dashboard-plus-grid.js",
-      "integrity": "sha384-F2o7EFSzJSppnagqUHP73QA8s3LSZ+XiyNN6ltsG2sHhGpRkQFG/3gfIgHIvOa6i",
+      "integrity": "sha384-NHCFT6UbfunuuoLSLNUODnWRCfVIXvHmy9HkdAADg5n24oL/s3FPMOofUde3hsIH",
       "elements": [
         "dashboard-plus-grid"
       ],
@@ -235,7 +234,7 @@
           "scriptUrl": "./dashboard-plus-grid/dashboard-plus-grid.js",
           "embed": {
             "iframe": "<iframe src=\"./dashboard-plus-grid/dashboard-plus-grid/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./dashboard-plus-grid/dashboard-plus-grid.js\" integrity=\"sha384-F2o7EFSzJSppnagqUHP73QA8s3LSZ+XiyNN6ltsG2sHhGpRkQFG/3gfIgHIvOa6i\" crossorigin=\"anonymous\"></script>\n<dashboard-plus-grid profile-config='{\"profile\":\"dashboard-plus-grid\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></dashboard-plus-grid>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./dashboard-plus-grid/dashboard-plus-grid.js\" integrity=\"sha384-NHCFT6UbfunuuoLSLNUODnWRCfVIXvHmy9HkdAADg5n24oL/s3FPMOofUde3hsIH\" crossorigin=\"anonymous\"></script>\n<dashboard-plus-grid profile-config='{\"profile\":\"dashboard-plus-grid\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></dashboard-plus-grid>"
           },
           "instances": [
             {
@@ -259,7 +258,7 @@
       "bundle": "demo-map",
       "scriptUrl": "./demo-map/demo-map.js",
       "output": "dx-maps/demo-map/demo-map.js",
-      "integrity": "sha384-e01v7Yez3VLCT6UVd24Qg5fSSzmX4emHdEC/9d+1K/ekrk2JFnBxi4fhPou+KweP",
+      "integrity": "sha384-PvHpgNfi1QG8ktakGMp+MHnQUAhIHOThv0lg8WsnTkfXqlyi7RUXgJPaUnuD+zb9",
       "elements": [
         "demo-map"
       ],
@@ -275,7 +274,7 @@
           "scriptUrl": "./demo-map/demo-map.js",
           "embed": {
             "iframe": "<iframe src=\"./demo-map/demo-map/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./demo-map/demo-map.js\" integrity=\"sha384-e01v7Yez3VLCT6UVd24Qg5fSSzmX4emHdEC/9d+1K/ekrk2JFnBxi4fhPou+KweP\" crossorigin=\"anonymous\"></script>\n<demo-map profile-config='{\"profile\":\"demo-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></demo-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./demo-map/demo-map.js\" integrity=\"sha384-PvHpgNfi1QG8ktakGMp+MHnQUAhIHOThv0lg8WsnTkfXqlyi7RUXgJPaUnuD+zb9\" crossorigin=\"anonymous\"></script>\n<demo-map profile-config='{\"profile\":\"demo-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></demo-map>"
           },
           "instances": [
             {
@@ -302,7 +301,7 @@
       "bundle": "doxa-maps-spa",
       "scriptUrl": "./doxa-maps-spa/doxa-maps-spa.js",
       "output": "dx-maps/doxa-maps-spa/doxa-maps-spa.js",
-      "integrity": "sha384-OgWFHE2O/j6eIlfJW2ohSIlPJrQvY3gBw46XjMOXFivfDfF0cvV6qB3ycJwOmPoQ",
+      "integrity": "sha384-4XdvanwhlFCgIfHtQEmQ04N6RiXTd2NzWgqEDL0n2Kr5r3xdHj9pd56UTgWNN7yo",
       "elements": [
         "doxa-maps-spa"
       ],
@@ -327,7 +326,7 @@
           "scriptUrl": "./doxa-maps-spa/doxa-maps-spa.js",
           "embed": {
             "iframe": "<iframe src=\"./doxa-maps-spa/doxa-maps-spa/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./doxa-maps-spa/doxa-maps-spa.js\" integrity=\"sha384-OgWFHE2O/j6eIlfJW2ohSIlPJrQvY3gBw46XjMOXFivfDfF0cvV6qB3ycJwOmPoQ\" crossorigin=\"anonymous\"></script>\n<doxa-maps-spa profile-config='{\"profile\":\"doxa-maps-spa\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></doxa-maps-spa>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./doxa-maps-spa/doxa-maps-spa.js\" integrity=\"sha384-4XdvanwhlFCgIfHtQEmQ04N6RiXTd2NzWgqEDL0n2Kr5r3xdHj9pd56UTgWNN7yo\" crossorigin=\"anonymous\"></script>\n<doxa-maps-spa profile-config='{\"profile\":\"doxa-maps-spa\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></doxa-maps-spa>"
           },
           "instances": [
             {
@@ -354,7 +353,7 @@
       "bundle": "doxa-research-map",
       "scriptUrl": "./doxa-research-map/doxa-research-map.js",
       "output": "dx-maps/doxa-research-map/doxa-research-map.js",
-      "integrity": "sha384-E/9wPeCVKfJRE0Oh2yOw3aHvEtVUFiBTtr3MpcUQ+U27nv7X81s+Y9UqAJM5IVDd",
+      "integrity": "sha384-R03LQu0QZONADlLjXUjGB+qOSDUFsroSTZ6eOYMU65gJsr9XNFGlJYE8VHVxn/4R",
       "elements": [
         "doxa-research-map"
       ],
@@ -370,7 +369,7 @@
           "scriptUrl": "./doxa-research-map/doxa-research-map.js",
           "embed": {
             "iframe": "<iframe src=\"./doxa-research-map/research-map/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./doxa-research-map/doxa-research-map.js\" integrity=\"sha384-E/9wPeCVKfJRE0Oh2yOw3aHvEtVUFiBTtr3MpcUQ+U27nv7X81s+Y9UqAJM5IVDd\" crossorigin=\"anonymous\"></script>\n<doxa-research-map profile-config='{\"profile\":\"research-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></doxa-research-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./doxa-research-map/doxa-research-map.js\" integrity=\"sha384-R03LQu0QZONADlLjXUjGB+qOSDUFsroSTZ6eOYMU65gJsr9XNFGlJYE8VHVxn/4R\" crossorigin=\"anonymous\"></script>\n<doxa-research-map profile-config='{\"profile\":\"research-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></doxa-research-map>"
           },
           "instances": [
             {
@@ -396,7 +395,7 @@
       "bundle": "doxa-simple-map",
       "scriptUrl": "./doxa-simple-map/doxa-simple-map.js",
       "output": "dx-maps/doxa-simple-map/doxa-simple-map.js",
-      "integrity": "sha384-juW40EsX6wSWnZbeU3bCfd4vAIasOy4AH1mRPcQKDzs+AKorOE47T27hp4X9Lsse",
+      "integrity": "sha384-3+FfGNlYUCrjnaK7YSErNuE6vgyPgI9jEoidjDt4tnnBmKGoW6uPVhiFPuWApGKJ",
       "elements": [
         "doxa-map",
         "doxa-simple-map"
@@ -413,7 +412,7 @@
           "scriptUrl": "./doxa-simple-map/doxa-simple-map.js",
           "embed": {
             "iframe": "<iframe src=\"./doxa-simple-map/doxa-simple-map/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./doxa-simple-map/doxa-simple-map.js\" integrity=\"sha384-juW40EsX6wSWnZbeU3bCfd4vAIasOy4AH1mRPcQKDzs+AKorOE47T27hp4X9Lsse\" crossorigin=\"anonymous\"></script>\n<doxa-map profile-config='{\"profile\":\"doxa-simple-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></doxa-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./doxa-simple-map/doxa-simple-map.js\" integrity=\"sha384-3+FfGNlYUCrjnaK7YSErNuE6vgyPgI9jEoidjDt4tnnBmKGoW6uPVhiFPuWApGKJ\" crossorigin=\"anonymous\"></script>\n<doxa-map profile-config='{\"profile\":\"doxa-simple-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></doxa-map>"
           },
           "instances": [
             {
@@ -579,7 +578,7 @@
       "bundle": "gospel-resources",
       "scriptUrl": "./gospel-resources/gospel-resources.js",
       "output": "dx-maps/gospel-resources/gospel-resources.js",
-      "integrity": "sha384-D8a8LhZ5rU23MoNsMV17MoxiHdfL3UHfO4jlX/RFcfJeA+PijBCtOqjiGdDSFDZj",
+      "integrity": "sha384-quKfQFNu9QRc/z49QTA+Qs4TCKzeylqAVeeWWJnmHsbN7gUqUbFmNVJ277vsT9tz",
       "elements": [
         "gospel-resources-map"
       ],
@@ -599,7 +598,7 @@
           "scriptUrl": "./gospel-resources/gospel-resources.js",
           "embed": {
             "iframe": "<iframe src=\"./gospel-resources/charts/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-D8a8LhZ5rU23MoNsMV17MoxiHdfL3UHfO4jlX/RFcfJeA+PijBCtOqjiGdDSFDZj\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"charts\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-quKfQFNu9QRc/z49QTA+Qs4TCKzeylqAVeeWWJnmHsbN7gUqUbFmNVJ277vsT9tz\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"charts\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
           }
         },
         {
@@ -613,7 +612,7 @@
           "scriptUrl": "./gospel-resources/gospel-resources.js",
           "embed": {
             "iframe": "<iframe src=\"./gospel-resources/data-tables/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-D8a8LhZ5rU23MoNsMV17MoxiHdfL3UHfO4jlX/RFcfJeA+PijBCtOqjiGdDSFDZj\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"data-tables\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-quKfQFNu9QRc/z49QTA+Qs4TCKzeylqAVeeWWJnmHsbN7gUqUbFmNVJ277vsT9tz\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"data-tables\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
           }
         },
         {
@@ -627,7 +626,7 @@
           "scriptUrl": "./gospel-resources/gospel-resources.js",
           "embed": {
             "iframe": "<iframe src=\"./gospel-resources/gospel-dashboard/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-D8a8LhZ5rU23MoNsMV17MoxiHdfL3UHfO4jlX/RFcfJeA+PijBCtOqjiGdDSFDZj\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"gospel-dashboard\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-quKfQFNu9QRc/z49QTA+Qs4TCKzeylqAVeeWWJnmHsbN7gUqUbFmNVJ277vsT9tz\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"gospel-dashboard\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
           }
         },
         {
@@ -641,7 +640,7 @@
           "scriptUrl": "./gospel-resources/gospel-resources.js",
           "embed": {
             "iframe": "<iframe src=\"./gospel-resources/resources-list/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-D8a8LhZ5rU23MoNsMV17MoxiHdfL3UHfO4jlX/RFcfJeA+PijBCtOqjiGdDSFDZj\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"resources-list\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-quKfQFNu9QRc/z49QTA+Qs4TCKzeylqAVeeWWJnmHsbN7gUqUbFmNVJ277vsT9tz\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"resources-list\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
           }
         },
         {
@@ -655,7 +654,7 @@
           "scriptUrl": "./gospel-resources/gospel-resources.js",
           "embed": {
             "iframe": "<iframe src=\"./gospel-resources/resources-map/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-D8a8LhZ5rU23MoNsMV17MoxiHdfL3UHfO4jlX/RFcfJeA+PijBCtOqjiGdDSFDZj\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"resources-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-quKfQFNu9QRc/z49QTA+Qs4TCKzeylqAVeeWWJnmHsbN7gUqUbFmNVJ277vsT9tz\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"resources-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
           }
         }
       ]
@@ -664,7 +663,7 @@
       "bundle": "my-upg-100-list",
       "scriptUrl": "./my-upg-100-list/my-upg-100-list.js",
       "output": "dx-maps/my-upg-100-list/my-upg-100-list.js",
-      "integrity": "sha384-rwEZFr0I9/+aFfKJDojxPrQ6BwIafYom66bzxvaCxnURiVr4ALaoZWPqqcwByUeF",
+      "integrity": "sha384-IMHvWXNPtmWShnySI7xyT6bz2kNJ+HGi6OIqWXYnpaXHKSElAEK2kF8G5YjJfA24",
       "elements": [
         "my-upg-100-list-map"
       ],
@@ -684,7 +683,7 @@
           "scriptUrl": "./my-upg-100-list/my-upg-100-list.js",
           "embed": {
             "iframe": "<iframe src=\"./my-upg-100-list/poster-wall/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./my-upg-100-list/my-upg-100-list.js\" integrity=\"sha384-rwEZFr0I9/+aFfKJDojxPrQ6BwIafYom66bzxvaCxnURiVr4ALaoZWPqqcwByUeF\" crossorigin=\"anonymous\"></script>\n<my-upg-100-list-map profile-config='{\"profile\":\"poster-wall\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></my-upg-100-list-map>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./my-upg-100-list/my-upg-100-list.js\" integrity=\"sha384-IMHvWXNPtmWShnySI7xyT6bz2kNJ+HGi6OIqWXYnpaXHKSElAEK2kF8G5YjJfA24\" crossorigin=\"anonymous\"></script>\n<my-upg-100-list-map profile-config='{\"profile\":\"poster-wall\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></my-upg-100-list-map>"
           }
         },
         {
@@ -698,7 +697,7 @@
           "scriptUrl": "./my-upg-100-list/my-upg-100-list.js",
           "embed": {
             "iframe": "<iframe src=\"./my-upg-100-list/upg-100-list/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./my-upg-100-list/my-upg-100-list.js\" integrity=\"sha384-rwEZFr0I9/+aFfKJDojxPrQ6BwIafYom66bzxvaCxnURiVr4ALaoZWPqqcwByUeF\" crossorigin=\"anonymous\"></script>\n<my-upg-100-list-map profile-config='{\"profile\":\"upg-100-list\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></my-upg-100-list-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./my-upg-100-list/my-upg-100-list.js\" integrity=\"sha384-IMHvWXNPtmWShnySI7xyT6bz2kNJ+HGi6OIqWXYnpaXHKSElAEK2kF8G5YjJfA24\" crossorigin=\"anonymous\"></script>\n<my-upg-100-list-map profile-config='{\"profile\":\"upg-100-list\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></my-upg-100-list-map>"
           }
         },
         {
@@ -712,7 +711,7 @@
           "scriptUrl": "./my-upg-100-list/my-upg-100-list.js",
           "embed": {
             "iframe": "<iframe src=\"./my-upg-100-list/upg-100-mfe/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./my-upg-100-list/my-upg-100-list.js\" integrity=\"sha384-rwEZFr0I9/+aFfKJDojxPrQ6BwIafYom66bzxvaCxnURiVr4ALaoZWPqqcwByUeF\" crossorigin=\"anonymous\"></script>\n<my-upg-100-list-map profile-config='{\"profile\":\"upg-100-mfe\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></my-upg-100-list-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./my-upg-100-list/my-upg-100-list.js\" integrity=\"sha384-IMHvWXNPtmWShnySI7xyT6bz2kNJ+HGi6OIqWXYnpaXHKSElAEK2kF8G5YjJfA24\" crossorigin=\"anonymous\"></script>\n<my-upg-100-list-map profile-config='{\"profile\":\"upg-100-mfe\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></my-upg-100-list-map>"
           }
         }
       ]
@@ -721,7 +720,7 @@
       "bundle": "people-groups-grid",
       "scriptUrl": "./people-groups-grid/people-groups-grid.js",
       "output": "dx-maps/people-groups-grid/people-groups-grid.js",
-      "integrity": "sha384-jRC+t4Fp5Vc7bBAG6wqHSlnBfH58NiOpDXRk4LITH38reLiDwln0dJd8a7LyYtdw",
+      "integrity": "sha384-+e7nyKn7MYFP5eUCwvrnF9NfutCJW6oUbLxymwIiEpdNcvfrQQxMSLm0wiYZMEyq",
       "elements": [
         "people-groups-grid"
       ],
@@ -737,7 +736,7 @@
           "scriptUrl": "./people-groups-grid/people-groups-grid.js",
           "embed": {
             "iframe": "<iframe src=\"./people-groups-grid/people-groups-grid/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./people-groups-grid/people-groups-grid.js\" integrity=\"sha384-jRC+t4Fp5Vc7bBAG6wqHSlnBfH58NiOpDXRk4LITH38reLiDwln0dJd8a7LyYtdw\" crossorigin=\"anonymous\"></script>\n<people-groups-grid profile-config='{\"profile\":\"people-groups-grid\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></people-groups-grid>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./people-groups-grid/people-groups-grid.js\" integrity=\"sha384-+e7nyKn7MYFP5eUCwvrnF9NfutCJW6oUbLxymwIiEpdNcvfrQQxMSLm0wiYZMEyq\" crossorigin=\"anonymous\"></script>\n<people-groups-grid profile-config='{\"profile\":\"people-groups-grid\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></people-groups-grid>"
           },
           "instances": [
             {
@@ -782,7 +781,7 @@
       "bundle": "plugin-studio",
       "scriptUrl": "./plugin-studio/plugin-studio.js",
       "output": "dx-maps/plugin-studio/plugin-studio.js",
-      "integrity": "sha384-lYyH0iKEqJ0Ps32Bbzbe3XVdfJZbYAZ6SaeP7DURDmt6yVbxMY1bYrJNUdLDcf4d",
+      "integrity": "sha384-w2ejRW2EFGUTSC77YRgdoyVQayeLlt9KL9OSz/KJxsUUWu3oA+hDP0RiwktzjYZL",
       "elements": [
         "plugin-studio"
       ],
@@ -810,7 +809,7 @@
           "scriptUrl": "./plugin-studio/plugin-studio.js",
           "embed": {
             "iframe": "<iframe src=\"./plugin-studio/plugin-studio/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./plugin-studio/plugin-studio.js\" integrity=\"sha384-lYyH0iKEqJ0Ps32Bbzbe3XVdfJZbYAZ6SaeP7DURDmt6yVbxMY1bYrJNUdLDcf4d\" crossorigin=\"anonymous\"></script>\n<plugin-studio profile-config='{\"profile\":\"plugin-studio\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></plugin-studio>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./plugin-studio/plugin-studio.js\" integrity=\"sha384-w2ejRW2EFGUTSC77YRgdoyVQayeLlt9KL9OSz/KJxsUUWu3oA+hDP0RiwktzjYZL\" crossorigin=\"anonymous\"></script>\n<plugin-studio profile-config='{\"profile\":\"plugin-studio\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></plugin-studio>"
           },
           "instances": [
             {
@@ -837,7 +836,7 @@
       "bundle": "pplr-data-maps",
       "scriptUrl": "./pplr-data-maps/pplr-data-maps.js",
       "output": "dx-maps/pplr-data-maps/pplr-data-maps.js",
-      "integrity": "sha384-Oxw1YTi/plI/0RTJeZQvJCan7XV0CzIJvkPRN0tDjLpVfz0qwVV7gN6vMU3P6tx4",
+      "integrity": "sha384-N6t6ynJj6kszViW0/GXZV6KflEYl7oApl3sUG0R+yjYLJWNeu3saq7Jmr6WZ/H3p",
       "elements": [
         "pplr-data-maps"
       ],
@@ -853,7 +852,7 @@
           "scriptUrl": "./pplr-data-maps/pplr-data-maps.js",
           "embed": {
             "iframe": "<iframe src=\"./pplr-data-maps/pplr-data-maps/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./pplr-data-maps/pplr-data-maps.js\" integrity=\"sha384-Oxw1YTi/plI/0RTJeZQvJCan7XV0CzIJvkPRN0tDjLpVfz0qwVV7gN6vMU3P6tx4\" crossorigin=\"anonymous\"></script>\n<pplr-data-maps profile-config='{\"profile\":\"pplr-data-maps\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></pplr-data-maps>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./pplr-data-maps/pplr-data-maps.js\" integrity=\"sha384-N6t6ynJj6kszViW0/GXZV6KflEYl7oApl3sUG0R+yjYLJWNeu3saq7Jmr6WZ/H3p\" crossorigin=\"anonymous\"></script>\n<pplr-data-maps profile-config='{\"profile\":\"pplr-data-maps\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></pplr-data-maps>"
           },
           "bundle": "pplr-data-maps"
         }
@@ -863,7 +862,7 @@
       "bundle": "prayer-walk-planner",
       "scriptUrl": "./prayer-walk-planner/prayer-walk-planner.js",
       "output": "dx-maps/prayer-walk-planner/prayer-walk-planner.js",
-      "integrity": "sha384-PqvBFQWuX/MKP2Jv7p/ir8zBvb6tNbyWh00ZHCZU/Q0dpaE7XvF36tMhmC9tixcJ",
+      "integrity": "sha384-T7I7/ETH/dJgyRGSEJg+44bi4Y4UAxToZzScKFQJa2xX+Ao1Mo8GSaux5Hu3ukzw",
       "elements": [
         "prayer-walk-planner"
       ],
@@ -879,7 +878,7 @@
           "scriptUrl": "./prayer-walk-planner/prayer-walk-planner.js",
           "embed": {
             "iframe": "<iframe src=\"./prayer-walk-planner/prayer-walk-planner/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./prayer-walk-planner/prayer-walk-planner.js\" integrity=\"sha384-PqvBFQWuX/MKP2Jv7p/ir8zBvb6tNbyWh00ZHCZU/Q0dpaE7XvF36tMhmC9tixcJ\" crossorigin=\"anonymous\"></script>\n<prayer-walk-planner profile-config='{\"profile\":\"prayer-walk-planner\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></prayer-walk-planner>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./prayer-walk-planner/prayer-walk-planner.js\" integrity=\"sha384-T7I7/ETH/dJgyRGSEJg+44bi4Y4UAxToZzScKFQJa2xX+Ao1Mo8GSaux5Hu3ukzw\" crossorigin=\"anonymous\"></script>\n<prayer-walk-planner profile-config='{\"profile\":\"prayer-walk-planner\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></prayer-walk-planner>"
           }
         }
       ]
@@ -888,7 +887,7 @@
       "bundle": "regions-dashboard",
       "scriptUrl": "./regions-dashboard/regions-dashboard.js",
       "output": "dx-maps/regions-dashboard/regions-dashboard.js",
-      "integrity": "sha384-nhQdaK/mbo+hByXAKQ9TRmewlRyzN10YWiPqijosjdijLmJfwla30Gd4D7Ithb6t",
+      "integrity": "sha384-6gpfo5njwcp+yyo/iahc09r2JkPZvfUjhWdoXdxlzNvzg/qqAfcAYZttBYb5q6t2",
       "elements": [
         "regions-dashboard"
       ],
@@ -908,7 +907,7 @@
           "scriptUrl": "./regions-dashboard/regions-dashboard.js",
           "embed": {
             "iframe": "<iframe src=\"./regions-dashboard/region-dashboards/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./regions-dashboard/regions-dashboard.js\" integrity=\"sha384-nhQdaK/mbo+hByXAKQ9TRmewlRyzN10YWiPqijosjdijLmJfwla30Gd4D7Ithb6t\" crossorigin=\"anonymous\"></script>\n<regions-dashboard profile-config='{\"profile\":\"region-dashboards\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></regions-dashboard>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./regions-dashboard/regions-dashboard.js\" integrity=\"sha384-6gpfo5njwcp+yyo/iahc09r2JkPZvfUjhWdoXdxlzNvzg/qqAfcAYZttBYb5q6t2\" crossorigin=\"anonymous\"></script>\n<regions-dashboard profile-config='{\"profile\":\"region-dashboards\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></regions-dashboard>"
           }
         },
         {
@@ -922,7 +921,7 @@
           "scriptUrl": "./regions-dashboard/regions-dashboard.js",
           "embed": {
             "iframe": "<iframe src=\"./regions-dashboard/regions-list/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./regions-dashboard/regions-dashboard.js\" integrity=\"sha384-nhQdaK/mbo+hByXAKQ9TRmewlRyzN10YWiPqijosjdijLmJfwla30Gd4D7Ithb6t\" crossorigin=\"anonymous\"></script>\n<regions-dashboard profile-config='{\"profile\":\"regions-list\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></regions-dashboard>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./regions-dashboard/regions-dashboard.js\" integrity=\"sha384-6gpfo5njwcp+yyo/iahc09r2JkPZvfUjhWdoXdxlzNvzg/qqAfcAYZttBYb5q6t2\" crossorigin=\"anonymous\"></script>\n<regions-dashboard profile-config='{\"profile\":\"regions-list\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></regions-dashboard>"
           }
         },
         {
@@ -936,7 +935,7 @@
           "scriptUrl": "./regions-dashboard/regions-dashboard.js",
           "embed": {
             "iframe": "<iframe src=\"./regions-dashboard/regions-mfe/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./regions-dashboard/regions-dashboard.js\" integrity=\"sha384-nhQdaK/mbo+hByXAKQ9TRmewlRyzN10YWiPqijosjdijLmJfwla30Gd4D7Ithb6t\" crossorigin=\"anonymous\"></script>\n<regions-dashboard profile-config='{\"profile\":\"regions-mfe\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></regions-dashboard>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./regions-dashboard/regions-dashboard.js\" integrity=\"sha384-6gpfo5njwcp+yyo/iahc09r2JkPZvfUjhWdoXdxlzNvzg/qqAfcAYZttBYb5q6t2\" crossorigin=\"anonymous\"></script>\n<regions-dashboard profile-config='{\"profile\":\"regions-mfe\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></regions-dashboard>"
           }
         }
       ]
@@ -945,7 +944,7 @@
       "bundle": "research-dashboard",
       "scriptUrl": "./research-dashboard/research-dashboard.js",
       "output": "dx-maps/research-dashboard/research-dashboard.js",
-      "integrity": "sha384-N8ZJTvr/l0jCSaV+3iP3gk/5R7SEwoJpMJFKEO9TYDC33wufmanR0eijkwSTO6mz",
+      "integrity": "sha384-s3pFfmYB+8irEnGByL45IAivZlETx+tQ0WScmy6x6hi7zYONjStXqQcTtZXjiQZ6",
       "elements": [
         "research-dashboard-map"
       ],
@@ -961,7 +960,7 @@
           "scriptUrl": "./research-dashboard/research-dashboard.js",
           "embed": {
             "iframe": "<iframe src=\"./research-dashboard/research-dashboard/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./research-dashboard/research-dashboard.js\" integrity=\"sha384-N8ZJTvr/l0jCSaV+3iP3gk/5R7SEwoJpMJFKEO9TYDC33wufmanR0eijkwSTO6mz\" crossorigin=\"anonymous\"></script>\n<research-dashboard-map profile-config='{\"profile\":\"research-dashboard\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></research-dashboard-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./research-dashboard/research-dashboard.js\" integrity=\"sha384-s3pFfmYB+8irEnGByL45IAivZlETx+tQ0WScmy6x6hi7zYONjStXqQcTtZXjiQZ6\" crossorigin=\"anonymous\"></script>\n<research-dashboard-map profile-config='{\"profile\":\"research-dashboard\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></research-dashboard-map>"
           },
           "bundle": "research-dashboard"
         }
@@ -971,7 +970,7 @@
       "bundle": "research-map-plus-grid",
       "scriptUrl": "./research-map-plus-grid/research-map-plus-grid.js",
       "output": "dx-maps/research-map-plus-grid/research-map-plus-grid.js",
-      "integrity": "sha384-q6MGCvQSGtk5CaASt5uu1mD7qDGoBwo17PDg3lW9jDzBQ5hMGj56TngLR/o6fc05",
+      "integrity": "sha384-47lmpj8ueP5gozXxvFShNBG1eR3x47apL6uVV+iFVSlKpp5lwF6+zTk146vRyASr",
       "elements": [
         "research-map-plus-grid"
       ],
@@ -991,7 +990,7 @@
           "scriptUrl": "./research-map-plus-grid/research-map-plus-grid.js",
           "embed": {
             "iframe": "<iframe src=\"./research-map-plus-grid/research-map-plus-grid/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./research-map-plus-grid/research-map-plus-grid.js\" integrity=\"sha384-q6MGCvQSGtk5CaASt5uu1mD7qDGoBwo17PDg3lW9jDzBQ5hMGj56TngLR/o6fc05\" crossorigin=\"anonymous\"></script>\n<research-map-plus-grid profile-config='{\"profile\":\"research-map-plus-grid\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></research-map-plus-grid>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./research-map-plus-grid/research-map-plus-grid.js\" integrity=\"sha384-47lmpj8ueP5gozXxvFShNBG1eR3x47apL6uVV+iFVSlKpp5lwF6+zTk146vRyASr\" crossorigin=\"anonymous\"></script>\n<research-map-plus-grid profile-config='{\"profile\":\"research-map-plus-grid\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></research-map-plus-grid>"
           },
           "instances": [
             {
@@ -1015,7 +1014,7 @@
       "bundle": "stack-demo",
       "scriptUrl": "./stack-demo/stack-demo.js",
       "output": "dx-maps/stack-demo/stack-demo.js",
-      "integrity": "sha384-D/F6egHTM6ENUVz/R50TwOy9dNkRbLJurypEZLYMyakjV+rDwQ3XwAYgs+H7IywP",
+      "integrity": "sha384-9/bRDfPfFGVpqL8wP329Awt3U0PqrieIL89Dp4k6Nkp+D9S5GUCWxvj8fMGphzXo",
       "elements": [
         "stack-demo"
       ],
@@ -1035,7 +1034,7 @@
           "scriptUrl": "./stack-demo/stack-demo.js",
           "embed": {
             "iframe": "<iframe src=\"./stack-demo/stack-demo/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./stack-demo/stack-demo.js\" integrity=\"sha384-D/F6egHTM6ENUVz/R50TwOy9dNkRbLJurypEZLYMyakjV+rDwQ3XwAYgs+H7IywP\" crossorigin=\"anonymous\"></script>\n<stack-demo profile-config='{\"profile\":\"stack-demo\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></stack-demo>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./stack-demo/stack-demo.js\" integrity=\"sha384-9/bRDfPfFGVpqL8wP329Awt3U0PqrieIL89Dp4k6Nkp+D9S5GUCWxvj8fMGphzXo\" crossorigin=\"anonymous\"></script>\n<stack-demo profile-config='{\"profile\":\"stack-demo\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></stack-demo>"
           },
           "instances": [
             {
@@ -1059,7 +1058,7 @@
       "bundle": "upg-neighbor",
       "scriptUrl": "./upg-neighbor/upg-neighbor.js",
       "output": "dx-maps/upg-neighbor/upg-neighbor.js",
-      "integrity": "sha384-pfgq/jUvzR6Is/zMBujuN0Rk+t7KUQslO7vU9OVGVJzAiRsGjsUsC/6dQ4fZ/hn5",
+      "integrity": "sha384-8RBR+NR4mrXAe1EuAKwAJrqRQIpB/gkMiBgvLI9QehL51IU2HQACfqdQp+sYB7Si",
       "elements": [
         "upg-neighbor"
       ],
@@ -1075,7 +1074,7 @@
           "scriptUrl": "./upg-neighbor/upg-neighbor.js",
           "embed": {
             "iframe": "<iframe src=\"./upg-neighbor/upg-neighbor/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./upg-neighbor/upg-neighbor.js\" integrity=\"sha384-pfgq/jUvzR6Is/zMBujuN0Rk+t7KUQslO7vU9OVGVJzAiRsGjsUsC/6dQ4fZ/hn5\" crossorigin=\"anonymous\"></script>\n<upg-neighbor profile-config='{\"profile\":\"upg-neighbor\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></upg-neighbor>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./upg-neighbor/upg-neighbor.js\" integrity=\"sha384-8RBR+NR4mrXAe1EuAKwAJrqRQIpB/gkMiBgvLI9QehL51IU2HQACfqdQp+sYB7Si\" crossorigin=\"anonymous\"></script>\n<upg-neighbor profile-config='{\"profile\":\"upg-neighbor\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></upg-neighbor>"
           },
           "instances": [
             {
@@ -1157,7 +1156,7 @@
       "bundle": "wall-of-people-groups",
       "scriptUrl": "./wall-of-people-groups/wall-of-people-groups.js",
       "output": "dx-maps/wall-of-people-groups/wall-of-people-groups.js",
-      "integrity": "sha384-/RvE4YrpW+WAsLi3FHzq/2wxmCVo9kBnA3VtSY+RI1v2B8zzMsHXjqwVlN6Fhg30",
+      "integrity": "sha384-XZHKc5fvUZEpa14aUYb6+CVPiJenH0bDPt3C2TCOMUbmLzj7jakSV9mmUUR4ou4x",
       "elements": [
         "wall-of-people-groups"
       ],
@@ -1173,7 +1172,7 @@
           "scriptUrl": "./wall-of-people-groups/wall-of-people-groups.js",
           "embed": {
             "iframe": "<iframe src=\"./wall-of-people-groups/wall-of-people-groups/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./wall-of-people-groups/wall-of-people-groups.js\" integrity=\"sha384-/RvE4YrpW+WAsLi3FHzq/2wxmCVo9kBnA3VtSY+RI1v2B8zzMsHXjqwVlN6Fhg30\" crossorigin=\"anonymous\"></script>\n<wall-of-people-groups profile-config='{\"profile\":\"wall-of-people-groups\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></wall-of-people-groups>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./wall-of-people-groups/wall-of-people-groups.js\" integrity=\"sha384-XZHKc5fvUZEpa14aUYb6+CVPiJenH0bDPt3C2TCOMUbmLzj7jakSV9mmUUR4ou4x\" crossorigin=\"anonymous\"></script>\n<wall-of-people-groups profile-config='{\"profile\":\"wall-of-people-groups\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></wall-of-people-groups>"
           },
           "bundle": "wall-of-people-groups"
         }

public/dx-maps/doxa-research-map/research-map/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <doxa-research-map> custom element. -->
-  <script src="../doxa-research-map.js" integrity="sha384-E/9wPeCVKfJRE0Oh2yOw3aHvEtVUFiBTtr3MpcUQ+U27nv7X81s+Y9UqAJM5IVDd" crossorigin="anonymous"></script>
+  <script src="../doxa-research-map.js" integrity="sha384-R03LQu0QZONADlLjXUjGB+qOSDUFsroSTZ6eOYMU65gJsr9XNFGlJYE8VHVxn/4R" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"profile":"research-map","dataSource":"pray-tools","instanceId":"doxa-research-map-research-map","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/doxa-research-map/research-map/maplibre/index.html

@@ -33,7 +33,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <doxa-research-map> custom element. -->
-  <script src="../../doxa-research-map.js" integrity="sha384-E/9wPeCVKfJRE0Oh2yOw3aHvEtVUFiBTtr3MpcUQ+U27nv7X81s+Y9UqAJM5IVDd" crossorigin="anonymous"></script>
+  <script src="../../doxa-research-map.js" integrity="sha384-R03LQu0QZONADlLjXUjGB+qOSDUFsroSTZ6eOYMU65gJsr9XNFGlJYE8VHVxn/4R" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -52,20 +52,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"research-map","provider":"maplibre","instanceId":"research-map-maplibre"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -133,13 +132,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -170,7 +180,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/doxa-simple-map/doxa-simple-map/adoption/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <doxa-map> custom element. -->
-  <script src="../../doxa-simple-map.js" integrity="sha384-juW40EsX6wSWnZbeU3bCfd4vAIasOy4AH1mRPcQKDzs+AKorOE47T27hp4X9Lsse" crossorigin="anonymous"></script>
+  <script src="../../doxa-simple-map.js" integrity="sha384-3+FfGNlYUCrjnaK7YSErNuE6vgyPgI9jEoidjDt4tnnBmKGoW6uPVhiFPuWApGKJ" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"doxa-simple-map","instanceId":"embed-adoption","dataSource":"pray-tools","tabs":[{"id":"adoption","colorStrategy":"adoption","legend":"adoption","popup":"adoption"}]};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/doxa-simple-map/doxa-simple-map/engagement/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <doxa-map> custom element. -->
-  <script src="../../doxa-simple-map.js" integrity="sha384-juW40EsX6wSWnZbeU3bCfd4vAIasOy4AH1mRPcQKDzs+AKorOE47T27hp4X9Lsse" crossorigin="anonymous"></script>
+  <script src="../../doxa-simple-map.js" integrity="sha384-3+FfGNlYUCrjnaK7YSErNuE6vgyPgI9jEoidjDt4tnnBmKGoW6uPVhiFPuWApGKJ" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"doxa-simple-map","instanceId":"embed-engagement","dataSource":"pray-tools","tabs":[{"id":"engagement","colorStrategy":"engagement","legend":"engagement","popup":"engagement"}]};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/doxa-simple-map/doxa-simple-map/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <doxa-map> custom element. -->
-  <script src="../doxa-simple-map.js" integrity="sha384-juW40EsX6wSWnZbeU3bCfd4vAIasOy4AH1mRPcQKDzs+AKorOE47T27hp4X9Lsse" crossorigin="anonymous"></script>
+  <script src="../doxa-simple-map.js" integrity="sha384-3+FfGNlYUCrjnaK7YSErNuE6vgyPgI9jEoidjDt4tnnBmKGoW6uPVhiFPuWApGKJ" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"profile":"doxa-simple-map","dataSource":"pray-tools","instanceId":"doxa-simple-map-doxa-simple-map","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/doxa-simple-map/doxa-simple-map/prayer/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <doxa-map> custom element. -->
-  <script src="../../doxa-simple-map.js" integrity="sha384-juW40EsX6wSWnZbeU3bCfd4vAIasOy4AH1mRPcQKDzs+AKorOE47T27hp4X9Lsse" crossorigin="anonymous"></script>
+  <script src="../../doxa-simple-map.js" integrity="sha384-3+FfGNlYUCrjnaK7YSErNuE6vgyPgI9jEoidjDt4tnnBmKGoW6uPVhiFPuWApGKJ" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"doxa-simple-map","instanceId":"embed-prayer","dataSource":"pray-tools","tabs":[{"id":"prayer","colorStrategy":"prayer","legend":"prayer","popup":"prayer"}]};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/doxa-vision-card/doxa-vision-card/default/index.html

@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"doxa-vision-card","provider":"maplibre","instanceId":"vision-card-default"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/doxa-vision-card/doxa-vision-card/frontier/index.html

@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"doxa-vision-card","provider":"maplibre","instanceId":"vision-card-frontier","accent":"#22d3ee","title":"The last frontier of the gospel.","tagline":"Frontier people groups: fewer than one person in a thousand is an evangelical believer."};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/doxa-vision-card/doxa-vision-card/index.html

@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"profile":"doxa-vision-card","dataSource":"pray-tools","instanceId":"doxa-vision-card-doxa-vision-card","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/golden-path-check/golden-path-check/index.html

@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"profile":"golden-path-check","dataSource":"pray-tools","instanceId":"golden-path-check-golden-path-check","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/gospel-resources/charts/index.html

@@ -32,7 +32,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <gospel-resources-map> custom element. -->
-  <script src="../gospel-resources.js" integrity="sha384-D8a8LhZ5rU23MoNsMV17MoxiHdfL3UHfO4jlX/RFcfJeA+PijBCtOqjiGdDSFDZj" crossorigin="anonymous"></script>
+  <script src="../gospel-resources.js" integrity="sha384-quKfQFNu9QRc/z49QTA+Qs4TCKzeylqAVeeWWJnmHsbN7gUqUbFmNVJ277vsT9tz" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"profile":"charts","dataSource":"pray-tools","instanceId":"gospel-resources-charts","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/gospel-resources/data-tables/index.html

@@ -32,7 +32,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <gospel-resources-map> custom element. -->
-  <script src="../gospel-resources.js" integrity="sha384-D8a8LhZ5rU23MoNsMV17MoxiHdfL3UHfO4jlX/RFcfJeA+PijBCtOqjiGdDSFDZj" crossorigin="anonymous"></script>
+  <script src="../gospel-resources.js" integrity="sha384-quKfQFNu9QRc/z49QTA+Qs4TCKzeylqAVeeWWJnmHsbN7gUqUbFmNVJ277vsT9tz" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"profile":"data-tables","dataSource":"pray-tools","instanceId":"gospel-resources-data-tables","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/gospel-resources/gospel-dashboard/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -47,7 +47,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <gospel-resources-map> custom element. -->
-  <script src="../gospel-resources.js" integrity="sha384-D8a8LhZ5rU23MoNsMV17MoxiHdfL3UHfO4jlX/RFcfJeA+PijBCtOqjiGdDSFDZj" crossorigin="anonymous"></script>
+  <script src="../gospel-resources.js" integrity="sha384-quKfQFNu9QRc/z49QTA+Qs4TCKzeylqAVeeWWJnmHsbN7gUqUbFmNVJ277vsT9tz" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -66,20 +66,19 @@
       var BASE_CONFIG = {"profile":"gospel-dashboard","dataSource":"pray-tools","instanceId":"gospel-resources-gospel-dashboard","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = true;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -147,13 +146,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -184,7 +194,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/gospel-resources/resources-list/index.html

@@ -32,7 +32,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <gospel-resources-map> custom element. -->
-  <script src="../gospel-resources.js" integrity="sha384-D8a8LhZ5rU23MoNsMV17MoxiHdfL3UHfO4jlX/RFcfJeA+PijBCtOqjiGdDSFDZj" crossorigin="anonymous"></script>
+  <script src="../gospel-resources.js" integrity="sha384-quKfQFNu9QRc/z49QTA+Qs4TCKzeylqAVeeWWJnmHsbN7gUqUbFmNVJ277vsT9tz" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"profile":"resources-list","dataSource":"pray-tools","instanceId":"gospel-resources-resources-list","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/gospel-resources/resources-map/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <gospel-resources-map> custom element. -->
-  <script src="../gospel-resources.js" integrity="sha384-D8a8LhZ5rU23MoNsMV17MoxiHdfL3UHfO4jlX/RFcfJeA+PijBCtOqjiGdDSFDZj" crossorigin="anonymous"></script>
+  <script src="../gospel-resources.js" integrity="sha384-quKfQFNu9QRc/z49QTA+Qs4TCKzeylqAVeeWWJnmHsbN7gUqUbFmNVJ277vsT9tz" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"pinHint":false,"profile":"resources-map","dataSource":"pray-tools","instanceId":"gospel-resources-resources-map","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/index.html

@@ -11,7 +11,6 @@
   <script>window.MAP_OWNS_PAGE = true;</script>
   <title>dx-maps plugin studio</title>
   <link rel="icon" href="data:,">
-  <script>window.MAP_TOKEN="pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";</script>
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <style>
     html, body { margin: 0; padding: 0; height: 100%; background: #f3f3f1; }
@@ -20,6 +19,6 @@
 </head>
 <body>
   <plugin-studio tree-base="."></plugin-studio>
-  <script src="./plugin-studio/plugin-studio.js" integrity="sha384-lYyH0iKEqJ0Ps32Bbzbe3XVdfJZbYAZ6SaeP7DURDmt6yVbxMY1bYrJNUdLDcf4d" crossorigin="anonymous"></script>
+  <script src="./plugin-studio/plugin-studio.js" integrity="sha384-w2ejRW2EFGUTSC77YRgdoyVQayeLlt9KL9OSz/KJxsUUWu3oA+hDP0RiwktzjYZL" crossorigin="anonymous"></script>
 </body>
 </html>

public/dx-maps/manifest.json

@@ -5,15 +5,14 @@
   "bundleCount": 23,
   "profileCount": 35,
   "runtime": {
-    "apiBaseUrl": "https://pray.doxa.life",
+    "apiBaseUrl": "https://pray.doxa.life"
-    "token": "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ"
   },
   "bundles": [
     {
       "bundle": "all-people-groups",
       "scriptUrl": "./all-people-groups/all-people-groups.js",
       "output": "dx-maps/all-people-groups/all-people-groups.js",
-      "integrity": "sha384-npdy7qTJnd1il1A28KBu1GtvBQE19MgD85j5NWxj/IolrBF3sKhYTzl/iqgRQAvT",
+      "integrity": "sha384-1Xz5+oArwB0dFAMrA6OS7QQYHa1uo8ZIk8SqvRk/bj150Htdu1RQQO0WNAR9NWVY",
       "elements": [
         "all-people-groups"
       ],
@@ -29,7 +28,7 @@
           "scriptUrl": "./all-people-groups/all-people-groups.js",
           "embed": {
             "iframe": "<iframe src=\"./all-people-groups/all-people-groups/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./all-people-groups/all-people-groups.js\" integrity=\"sha384-npdy7qTJnd1il1A28KBu1GtvBQE19MgD85j5NWxj/IolrBF3sKhYTzl/iqgRQAvT\" crossorigin=\"anonymous\"></script>\n<all-people-groups profile-config='{\"profile\":\"all-people-groups\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></all-people-groups>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./all-people-groups/all-people-groups.js\" integrity=\"sha384-1Xz5+oArwB0dFAMrA6OS7QQYHa1uo8ZIk8SqvRk/bj150Htdu1RQQO0WNAR9NWVY\" crossorigin=\"anonymous\"></script>\n<all-people-groups profile-config='{\"profile\":\"all-people-groups\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></all-people-groups>"
           },
           "bundle": "all-people-groups"
         }
@@ -39,7 +38,7 @@
       "bundle": "big-picture",
       "scriptUrl": "./big-picture/big-picture.js",
       "output": "dx-maps/big-picture/big-picture.js",
-      "integrity": "sha384-VURTOPp7qXzm2yZCpoIrqEhMrC1hbAyGrNmg9RhpzTKqmxCr9fNTdPqexzzgS8OH",
+      "integrity": "sha384-ImYc8ADuJJoFHeFxFQoAzvWrSlk23+ae2YJGFG+Fy7qwr07Z9gGkcRRclf9c70JL",
       "elements": [
         "bp-big-picture",
         "bp-research-header",
@@ -61,7 +60,7 @@
           "scriptUrl": "./big-picture/big-picture.js",
           "embed": {
             "iframe": "<iframe src=\"./big-picture/big-picture/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./big-picture/big-picture.js\" integrity=\"sha384-VURTOPp7qXzm2yZCpoIrqEhMrC1hbAyGrNmg9RhpzTKqmxCr9fNTdPqexzzgS8OH\" crossorigin=\"anonymous\"></script>\n<bp-big-picture profile-config='{\"profile\":\"big-picture\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></bp-big-picture>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./big-picture/big-picture.js\" integrity=\"sha384-ImYc8ADuJJoFHeFxFQoAzvWrSlk23+ae2YJGFG+Fy7qwr07Z9gGkcRRclf9c70JL\" crossorigin=\"anonymous\"></script>\n<bp-big-picture profile-config='{\"profile\":\"big-picture\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></bp-big-picture>"
           },
           "instances": [
             {
@@ -105,7 +104,7 @@
       "bundle": "cities-internet",
       "scriptUrl": "./cities-internet/cities-internet.js",
       "output": "dx-maps/cities-internet/cities-internet.js",
-      "integrity": "sha384-mrFyobv27Rez+r7D8zfx8v0zV8anFpzKWuInX4SHo96KVnQhqOitVfILY4tjdBEi",
+      "integrity": "sha384-07GgsheJ8VeTcZnXoAegSMDp1NEw4aheXhbTzdygYEpF1VxRWc0f30KvG4bjF2cd",
       "elements": [
         "cities-internet-map"
       ],
@@ -121,7 +120,7 @@
           "scriptUrl": "./cities-internet/cities-internet.js",
           "embed": {
             "iframe": "<iframe src=\"./cities-internet/connectivity-list/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./cities-internet/cities-internet.js\" integrity=\"sha384-mrFyobv27Rez+r7D8zfx8v0zV8anFpzKWuInX4SHo96KVnQhqOitVfILY4tjdBEi\" crossorigin=\"anonymous\"></script>\n<cities-internet-map profile-config='{\"profile\":\"connectivity-list\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></cities-internet-map>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./cities-internet/cities-internet.js\" integrity=\"sha384-07GgsheJ8VeTcZnXoAegSMDp1NEw4aheXhbTzdygYEpF1VxRWc0f30KvG4bjF2cd\" crossorigin=\"anonymous\"></script>\n<cities-internet-map profile-config='{\"profile\":\"connectivity-list\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></cities-internet-map>"
           }
         },
         {
@@ -135,7 +134,7 @@
           "scriptUrl": "./cities-internet/cities-internet.js",
           "embed": {
             "iframe": "<iframe src=\"./cities-internet/connectivity-map/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./cities-internet/cities-internet.js\" integrity=\"sha384-mrFyobv27Rez+r7D8zfx8v0zV8anFpzKWuInX4SHo96KVnQhqOitVfILY4tjdBEi\" crossorigin=\"anonymous\"></script>\n<cities-internet-map profile-config='{\"profile\":\"connectivity-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></cities-internet-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./cities-internet/cities-internet.js\" integrity=\"sha384-07GgsheJ8VeTcZnXoAegSMDp1NEw4aheXhbTzdygYEpF1VxRWc0f30KvG4bjF2cd\" crossorigin=\"anonymous\"></script>\n<cities-internet-map profile-config='{\"profile\":\"connectivity-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></cities-internet-map>"
           }
         },
         {
@@ -149,7 +148,7 @@
           "scriptUrl": "./cities-internet/cities-internet.js",
           "embed": {
             "iframe": "<iframe src=\"./cities-internet/data-tables/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./cities-internet/cities-internet.js\" integrity=\"sha384-mrFyobv27Rez+r7D8zfx8v0zV8anFpzKWuInX4SHo96KVnQhqOitVfILY4tjdBEi\" crossorigin=\"anonymous\"></script>\n<cities-internet-map profile-config='{\"profile\":\"data-tables\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></cities-internet-map>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./cities-internet/cities-internet.js\" integrity=\"sha384-07GgsheJ8VeTcZnXoAegSMDp1NEw4aheXhbTzdygYEpF1VxRWc0f30KvG4bjF2cd\" crossorigin=\"anonymous\"></script>\n<cities-internet-map profile-config='{\"profile\":\"data-tables\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></cities-internet-map>"
           }
         }
       ]
@@ -158,7 +157,7 @@
       "bundle": "country-posters",
       "scriptUrl": "./country-posters/country-posters.js",
       "output": "dx-maps/country-posters/country-posters.js",
-      "integrity": "sha384-n0T9rOOsC50ppZASO07UWxyFCKTfilAMgcgn3+zG48uRKivmw2cEkraA+nXic9v7",
+      "integrity": "sha384-VAW6sAD2B2Mn52Yjihq0YuQ+xD+CJ70ZeIK2eR06Lg6DeBDyVftjlen9wduubQN2",
       "elements": [
         "country-posters-map"
       ],
@@ -178,7 +177,7 @@
           "scriptUrl": "./country-posters/country-posters.js",
           "embed": {
             "iframe": "<iframe src=\"./country-posters/countries-map/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./country-posters/country-posters.js\" integrity=\"sha384-n0T9rOOsC50ppZASO07UWxyFCKTfilAMgcgn3+zG48uRKivmw2cEkraA+nXic9v7\" crossorigin=\"anonymous\"></script>\n<country-posters-map profile-config='{\"profile\":\"countries-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></country-posters-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./country-posters/country-posters.js\" integrity=\"sha384-VAW6sAD2B2Mn52Yjihq0YuQ+xD+CJ70ZeIK2eR06Lg6DeBDyVftjlen9wduubQN2\" crossorigin=\"anonymous\"></script>\n<country-posters-map profile-config='{\"profile\":\"countries-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></country-posters-map>"
           }
         },
         {
@@ -192,7 +191,7 @@
           "scriptUrl": "./country-posters/country-posters.js",
           "embed": {
             "iframe": "<iframe src=\"./country-posters/country-poster-wall/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./country-posters/country-posters.js\" integrity=\"sha384-n0T9rOOsC50ppZASO07UWxyFCKTfilAMgcgn3+zG48uRKivmw2cEkraA+nXic9v7\" crossorigin=\"anonymous\"></script>\n<country-posters-map profile-config='{\"profile\":\"country-poster-wall\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></country-posters-map>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./country-posters/country-posters.js\" integrity=\"sha384-VAW6sAD2B2Mn52Yjihq0YuQ+xD+CJ70ZeIK2eR06Lg6DeBDyVftjlen9wduubQN2\" crossorigin=\"anonymous\"></script>\n<country-posters-map profile-config='{\"profile\":\"country-poster-wall\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></country-posters-map>"
           }
         },
         {
@@ -206,7 +205,7 @@
           "scriptUrl": "./country-posters/country-posters.js",
           "embed": {
             "iframe": "<iframe src=\"./country-posters/country-posters-mfe/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./country-posters/country-posters.js\" integrity=\"sha384-n0T9rOOsC50ppZASO07UWxyFCKTfilAMgcgn3+zG48uRKivmw2cEkraA+nXic9v7\" crossorigin=\"anonymous\"></script>\n<country-posters-map profile-config='{\"profile\":\"country-posters-mfe\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></country-posters-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./country-posters/country-posters.js\" integrity=\"sha384-VAW6sAD2B2Mn52Yjihq0YuQ+xD+CJ70ZeIK2eR06Lg6DeBDyVftjlen9wduubQN2\" crossorigin=\"anonymous\"></script>\n<country-posters-map profile-config='{\"profile\":\"country-posters-mfe\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></country-posters-map>"
           }
         }
       ]
@@ -215,7 +214,7 @@
       "bundle": "dashboard-plus-grid",
       "scriptUrl": "./dashboard-plus-grid/dashboard-plus-grid.js",
       "output": "dx-maps/dashboard-plus-grid/dashboard-plus-grid.js",
-      "integrity": "sha384-F2o7EFSzJSppnagqUHP73QA8s3LSZ+XiyNN6ltsG2sHhGpRkQFG/3gfIgHIvOa6i",
+      "integrity": "sha384-NHCFT6UbfunuuoLSLNUODnWRCfVIXvHmy9HkdAADg5n24oL/s3FPMOofUde3hsIH",
       "elements": [
         "dashboard-plus-grid"
       ],
@@ -235,7 +234,7 @@
           "scriptUrl": "./dashboard-plus-grid/dashboard-plus-grid.js",
           "embed": {
             "iframe": "<iframe src=\"./dashboard-plus-grid/dashboard-plus-grid/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./dashboard-plus-grid/dashboard-plus-grid.js\" integrity=\"sha384-F2o7EFSzJSppnagqUHP73QA8s3LSZ+XiyNN6ltsG2sHhGpRkQFG/3gfIgHIvOa6i\" crossorigin=\"anonymous\"></script>\n<dashboard-plus-grid profile-config='{\"profile\":\"dashboard-plus-grid\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></dashboard-plus-grid>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./dashboard-plus-grid/dashboard-plus-grid.js\" integrity=\"sha384-NHCFT6UbfunuuoLSLNUODnWRCfVIXvHmy9HkdAADg5n24oL/s3FPMOofUde3hsIH\" crossorigin=\"anonymous\"></script>\n<dashboard-plus-grid profile-config='{\"profile\":\"dashboard-plus-grid\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></dashboard-plus-grid>"
           },
           "instances": [
             {
@@ -259,7 +258,7 @@
       "bundle": "demo-map",
       "scriptUrl": "./demo-map/demo-map.js",
       "output": "dx-maps/demo-map/demo-map.js",
-      "integrity": "sha384-e01v7Yez3VLCT6UVd24Qg5fSSzmX4emHdEC/9d+1K/ekrk2JFnBxi4fhPou+KweP",
+      "integrity": "sha384-PvHpgNfi1QG8ktakGMp+MHnQUAhIHOThv0lg8WsnTkfXqlyi7RUXgJPaUnuD+zb9",
       "elements": [
         "demo-map"
       ],
@@ -275,7 +274,7 @@
           "scriptUrl": "./demo-map/demo-map.js",
           "embed": {
             "iframe": "<iframe src=\"./demo-map/demo-map/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./demo-map/demo-map.js\" integrity=\"sha384-e01v7Yez3VLCT6UVd24Qg5fSSzmX4emHdEC/9d+1K/ekrk2JFnBxi4fhPou+KweP\" crossorigin=\"anonymous\"></script>\n<demo-map profile-config='{\"profile\":\"demo-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></demo-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./demo-map/demo-map.js\" integrity=\"sha384-PvHpgNfi1QG8ktakGMp+MHnQUAhIHOThv0lg8WsnTkfXqlyi7RUXgJPaUnuD+zb9\" crossorigin=\"anonymous\"></script>\n<demo-map profile-config='{\"profile\":\"demo-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></demo-map>"
           },
           "instances": [
             {
@@ -302,7 +301,7 @@
       "bundle": "doxa-maps-spa",
       "scriptUrl": "./doxa-maps-spa/doxa-maps-spa.js",
       "output": "dx-maps/doxa-maps-spa/doxa-maps-spa.js",
-      "integrity": "sha384-OgWFHE2O/j6eIlfJW2ohSIlPJrQvY3gBw46XjMOXFivfDfF0cvV6qB3ycJwOmPoQ",
+      "integrity": "sha384-4XdvanwhlFCgIfHtQEmQ04N6RiXTd2NzWgqEDL0n2Kr5r3xdHj9pd56UTgWNN7yo",
       "elements": [
         "doxa-maps-spa"
       ],
@@ -327,7 +326,7 @@
           "scriptUrl": "./doxa-maps-spa/doxa-maps-spa.js",
           "embed": {
             "iframe": "<iframe src=\"./doxa-maps-spa/doxa-maps-spa/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./doxa-maps-spa/doxa-maps-spa.js\" integrity=\"sha384-OgWFHE2O/j6eIlfJW2ohSIlPJrQvY3gBw46XjMOXFivfDfF0cvV6qB3ycJwOmPoQ\" crossorigin=\"anonymous\"></script>\n<doxa-maps-spa profile-config='{\"profile\":\"doxa-maps-spa\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></doxa-maps-spa>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./doxa-maps-spa/doxa-maps-spa.js\" integrity=\"sha384-4XdvanwhlFCgIfHtQEmQ04N6RiXTd2NzWgqEDL0n2Kr5r3xdHj9pd56UTgWNN7yo\" crossorigin=\"anonymous\"></script>\n<doxa-maps-spa profile-config='{\"profile\":\"doxa-maps-spa\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></doxa-maps-spa>"
           },
           "instances": [
             {
@@ -354,7 +353,7 @@
       "bundle": "doxa-research-map",
       "scriptUrl": "./doxa-research-map/doxa-research-map.js",
       "output": "dx-maps/doxa-research-map/doxa-research-map.js",
-      "integrity": "sha384-E/9wPeCVKfJRE0Oh2yOw3aHvEtVUFiBTtr3MpcUQ+U27nv7X81s+Y9UqAJM5IVDd",
+      "integrity": "sha384-R03LQu0QZONADlLjXUjGB+qOSDUFsroSTZ6eOYMU65gJsr9XNFGlJYE8VHVxn/4R",
       "elements": [
         "doxa-research-map"
       ],
@@ -370,7 +369,7 @@
           "scriptUrl": "./doxa-research-map/doxa-research-map.js",
           "embed": {
             "iframe": "<iframe src=\"./doxa-research-map/research-map/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./doxa-research-map/doxa-research-map.js\" integrity=\"sha384-E/9wPeCVKfJRE0Oh2yOw3aHvEtVUFiBTtr3MpcUQ+U27nv7X81s+Y9UqAJM5IVDd\" crossorigin=\"anonymous\"></script>\n<doxa-research-map profile-config='{\"profile\":\"research-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></doxa-research-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./doxa-research-map/doxa-research-map.js\" integrity=\"sha384-R03LQu0QZONADlLjXUjGB+qOSDUFsroSTZ6eOYMU65gJsr9XNFGlJYE8VHVxn/4R\" crossorigin=\"anonymous\"></script>\n<doxa-research-map profile-config='{\"profile\":\"research-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></doxa-research-map>"
           },
           "instances": [
             {
@@ -396,7 +395,7 @@
       "bundle": "doxa-simple-map",
       "scriptUrl": "./doxa-simple-map/doxa-simple-map.js",
       "output": "dx-maps/doxa-simple-map/doxa-simple-map.js",
-      "integrity": "sha384-juW40EsX6wSWnZbeU3bCfd4vAIasOy4AH1mRPcQKDzs+AKorOE47T27hp4X9Lsse",
+      "integrity": "sha384-3+FfGNlYUCrjnaK7YSErNuE6vgyPgI9jEoidjDt4tnnBmKGoW6uPVhiFPuWApGKJ",
       "elements": [
         "doxa-map",
         "doxa-simple-map"
@@ -413,7 +412,7 @@
           "scriptUrl": "./doxa-simple-map/doxa-simple-map.js",
           "embed": {
             "iframe": "<iframe src=\"./doxa-simple-map/doxa-simple-map/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./doxa-simple-map/doxa-simple-map.js\" integrity=\"sha384-juW40EsX6wSWnZbeU3bCfd4vAIasOy4AH1mRPcQKDzs+AKorOE47T27hp4X9Lsse\" crossorigin=\"anonymous\"></script>\n<doxa-map profile-config='{\"profile\":\"doxa-simple-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></doxa-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./doxa-simple-map/doxa-simple-map.js\" integrity=\"sha384-3+FfGNlYUCrjnaK7YSErNuE6vgyPgI9jEoidjDt4tnnBmKGoW6uPVhiFPuWApGKJ\" crossorigin=\"anonymous\"></script>\n<doxa-map profile-config='{\"profile\":\"doxa-simple-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></doxa-map>"
           },
           "instances": [
             {
@@ -579,7 +578,7 @@
       "bundle": "gospel-resources",
       "scriptUrl": "./gospel-resources/gospel-resources.js",
       "output": "dx-maps/gospel-resources/gospel-resources.js",
-      "integrity": "sha384-D8a8LhZ5rU23MoNsMV17MoxiHdfL3UHfO4jlX/RFcfJeA+PijBCtOqjiGdDSFDZj",
+      "integrity": "sha384-quKfQFNu9QRc/z49QTA+Qs4TCKzeylqAVeeWWJnmHsbN7gUqUbFmNVJ277vsT9tz",
       "elements": [
         "gospel-resources-map"
       ],
@@ -599,7 +598,7 @@
           "scriptUrl": "./gospel-resources/gospel-resources.js",
           "embed": {
             "iframe": "<iframe src=\"./gospel-resources/charts/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-D8a8LhZ5rU23MoNsMV17MoxiHdfL3UHfO4jlX/RFcfJeA+PijBCtOqjiGdDSFDZj\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"charts\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-quKfQFNu9QRc/z49QTA+Qs4TCKzeylqAVeeWWJnmHsbN7gUqUbFmNVJ277vsT9tz\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"charts\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
           }
         },
         {
@@ -613,7 +612,7 @@
           "scriptUrl": "./gospel-resources/gospel-resources.js",
           "embed": {
             "iframe": "<iframe src=\"./gospel-resources/data-tables/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-D8a8LhZ5rU23MoNsMV17MoxiHdfL3UHfO4jlX/RFcfJeA+PijBCtOqjiGdDSFDZj\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"data-tables\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-quKfQFNu9QRc/z49QTA+Qs4TCKzeylqAVeeWWJnmHsbN7gUqUbFmNVJ277vsT9tz\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"data-tables\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
           }
         },
         {
@@ -627,7 +626,7 @@
           "scriptUrl": "./gospel-resources/gospel-resources.js",
           "embed": {
             "iframe": "<iframe src=\"./gospel-resources/gospel-dashboard/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-D8a8LhZ5rU23MoNsMV17MoxiHdfL3UHfO4jlX/RFcfJeA+PijBCtOqjiGdDSFDZj\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"gospel-dashboard\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-quKfQFNu9QRc/z49QTA+Qs4TCKzeylqAVeeWWJnmHsbN7gUqUbFmNVJ277vsT9tz\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"gospel-dashboard\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
           }
         },
         {
@@ -641,7 +640,7 @@
           "scriptUrl": "./gospel-resources/gospel-resources.js",
           "embed": {
             "iframe": "<iframe src=\"./gospel-resources/resources-list/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-D8a8LhZ5rU23MoNsMV17MoxiHdfL3UHfO4jlX/RFcfJeA+PijBCtOqjiGdDSFDZj\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"resources-list\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-quKfQFNu9QRc/z49QTA+Qs4TCKzeylqAVeeWWJnmHsbN7gUqUbFmNVJ277vsT9tz\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"resources-list\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
           }
         },
         {
@@ -655,7 +654,7 @@
           "scriptUrl": "./gospel-resources/gospel-resources.js",
           "embed": {
             "iframe": "<iframe src=\"./gospel-resources/resources-map/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-D8a8LhZ5rU23MoNsMV17MoxiHdfL3UHfO4jlX/RFcfJeA+PijBCtOqjiGdDSFDZj\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"resources-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./gospel-resources/gospel-resources.js\" integrity=\"sha384-quKfQFNu9QRc/z49QTA+Qs4TCKzeylqAVeeWWJnmHsbN7gUqUbFmNVJ277vsT9tz\" crossorigin=\"anonymous\"></script>\n<gospel-resources-map profile-config='{\"profile\":\"resources-map\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></gospel-resources-map>"
           }
         }
       ]
@@ -664,7 +663,7 @@
       "bundle": "my-upg-100-list",
       "scriptUrl": "./my-upg-100-list/my-upg-100-list.js",
       "output": "dx-maps/my-upg-100-list/my-upg-100-list.js",
-      "integrity": "sha384-rwEZFr0I9/+aFfKJDojxPrQ6BwIafYom66bzxvaCxnURiVr4ALaoZWPqqcwByUeF",
+      "integrity": "sha384-IMHvWXNPtmWShnySI7xyT6bz2kNJ+HGi6OIqWXYnpaXHKSElAEK2kF8G5YjJfA24",
       "elements": [
         "my-upg-100-list-map"
       ],
@@ -684,7 +683,7 @@
           "scriptUrl": "./my-upg-100-list/my-upg-100-list.js",
           "embed": {
             "iframe": "<iframe src=\"./my-upg-100-list/poster-wall/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./my-upg-100-list/my-upg-100-list.js\" integrity=\"sha384-rwEZFr0I9/+aFfKJDojxPrQ6BwIafYom66bzxvaCxnURiVr4ALaoZWPqqcwByUeF\" crossorigin=\"anonymous\"></script>\n<my-upg-100-list-map profile-config='{\"profile\":\"poster-wall\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></my-upg-100-list-map>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./my-upg-100-list/my-upg-100-list.js\" integrity=\"sha384-IMHvWXNPtmWShnySI7xyT6bz2kNJ+HGi6OIqWXYnpaXHKSElAEK2kF8G5YjJfA24\" crossorigin=\"anonymous\"></script>\n<my-upg-100-list-map profile-config='{\"profile\":\"poster-wall\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></my-upg-100-list-map>"
           }
         },
         {
@@ -698,7 +697,7 @@
           "scriptUrl": "./my-upg-100-list/my-upg-100-list.js",
           "embed": {
             "iframe": "<iframe src=\"./my-upg-100-list/upg-100-list/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./my-upg-100-list/my-upg-100-list.js\" integrity=\"sha384-rwEZFr0I9/+aFfKJDojxPrQ6BwIafYom66bzxvaCxnURiVr4ALaoZWPqqcwByUeF\" crossorigin=\"anonymous\"></script>\n<my-upg-100-list-map profile-config='{\"profile\":\"upg-100-list\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></my-upg-100-list-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./my-upg-100-list/my-upg-100-list.js\" integrity=\"sha384-IMHvWXNPtmWShnySI7xyT6bz2kNJ+HGi6OIqWXYnpaXHKSElAEK2kF8G5YjJfA24\" crossorigin=\"anonymous\"></script>\n<my-upg-100-list-map profile-config='{\"profile\":\"upg-100-list\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></my-upg-100-list-map>"
           }
         },
         {
@@ -712,7 +711,7 @@
           "scriptUrl": "./my-upg-100-list/my-upg-100-list.js",
           "embed": {
             "iframe": "<iframe src=\"./my-upg-100-list/upg-100-mfe/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./my-upg-100-list/my-upg-100-list.js\" integrity=\"sha384-rwEZFr0I9/+aFfKJDojxPrQ6BwIafYom66bzxvaCxnURiVr4ALaoZWPqqcwByUeF\" crossorigin=\"anonymous\"></script>\n<my-upg-100-list-map profile-config='{\"profile\":\"upg-100-mfe\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></my-upg-100-list-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./my-upg-100-list/my-upg-100-list.js\" integrity=\"sha384-IMHvWXNPtmWShnySI7xyT6bz2kNJ+HGi6OIqWXYnpaXHKSElAEK2kF8G5YjJfA24\" crossorigin=\"anonymous\"></script>\n<my-upg-100-list-map profile-config='{\"profile\":\"upg-100-mfe\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></my-upg-100-list-map>"
           }
         }
       ]
@@ -721,7 +720,7 @@
       "bundle": "people-groups-grid",
       "scriptUrl": "./people-groups-grid/people-groups-grid.js",
       "output": "dx-maps/people-groups-grid/people-groups-grid.js",
-      "integrity": "sha384-jRC+t4Fp5Vc7bBAG6wqHSlnBfH58NiOpDXRk4LITH38reLiDwln0dJd8a7LyYtdw",
+      "integrity": "sha384-+e7nyKn7MYFP5eUCwvrnF9NfutCJW6oUbLxymwIiEpdNcvfrQQxMSLm0wiYZMEyq",
       "elements": [
         "people-groups-grid"
       ],
@@ -737,7 +736,7 @@
           "scriptUrl": "./people-groups-grid/people-groups-grid.js",
           "embed": {
             "iframe": "<iframe src=\"./people-groups-grid/people-groups-grid/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./people-groups-grid/people-groups-grid.js\" integrity=\"sha384-jRC+t4Fp5Vc7bBAG6wqHSlnBfH58NiOpDXRk4LITH38reLiDwln0dJd8a7LyYtdw\" crossorigin=\"anonymous\"></script>\n<people-groups-grid profile-config='{\"profile\":\"people-groups-grid\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></people-groups-grid>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./people-groups-grid/people-groups-grid.js\" integrity=\"sha384-+e7nyKn7MYFP5eUCwvrnF9NfutCJW6oUbLxymwIiEpdNcvfrQQxMSLm0wiYZMEyq\" crossorigin=\"anonymous\"></script>\n<people-groups-grid profile-config='{\"profile\":\"people-groups-grid\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></people-groups-grid>"
           },
           "instances": [
             {
@@ -782,7 +781,7 @@
       "bundle": "plugin-studio",
       "scriptUrl": "./plugin-studio/plugin-studio.js",
       "output": "dx-maps/plugin-studio/plugin-studio.js",
-      "integrity": "sha384-lYyH0iKEqJ0Ps32Bbzbe3XVdfJZbYAZ6SaeP7DURDmt6yVbxMY1bYrJNUdLDcf4d",
+      "integrity": "sha384-w2ejRW2EFGUTSC77YRgdoyVQayeLlt9KL9OSz/KJxsUUWu3oA+hDP0RiwktzjYZL",
       "elements": [
         "plugin-studio"
       ],
@@ -810,7 +809,7 @@
           "scriptUrl": "./plugin-studio/plugin-studio.js",
           "embed": {
             "iframe": "<iframe src=\"./plugin-studio/plugin-studio/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./plugin-studio/plugin-studio.js\" integrity=\"sha384-lYyH0iKEqJ0Ps32Bbzbe3XVdfJZbYAZ6SaeP7DURDmt6yVbxMY1bYrJNUdLDcf4d\" crossorigin=\"anonymous\"></script>\n<plugin-studio profile-config='{\"profile\":\"plugin-studio\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></plugin-studio>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./plugin-studio/plugin-studio.js\" integrity=\"sha384-w2ejRW2EFGUTSC77YRgdoyVQayeLlt9KL9OSz/KJxsUUWu3oA+hDP0RiwktzjYZL\" crossorigin=\"anonymous\"></script>\n<plugin-studio profile-config='{\"profile\":\"plugin-studio\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></plugin-studio>"
           },
           "instances": [
             {
@@ -837,7 +836,7 @@
       "bundle": "pplr-data-maps",
       "scriptUrl": "./pplr-data-maps/pplr-data-maps.js",
       "output": "dx-maps/pplr-data-maps/pplr-data-maps.js",
-      "integrity": "sha384-Oxw1YTi/plI/0RTJeZQvJCan7XV0CzIJvkPRN0tDjLpVfz0qwVV7gN6vMU3P6tx4",
+      "integrity": "sha384-N6t6ynJj6kszViW0/GXZV6KflEYl7oApl3sUG0R+yjYLJWNeu3saq7Jmr6WZ/H3p",
       "elements": [
         "pplr-data-maps"
       ],
@@ -853,7 +852,7 @@
           "scriptUrl": "./pplr-data-maps/pplr-data-maps.js",
           "embed": {
             "iframe": "<iframe src=\"./pplr-data-maps/pplr-data-maps/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./pplr-data-maps/pplr-data-maps.js\" integrity=\"sha384-Oxw1YTi/plI/0RTJeZQvJCan7XV0CzIJvkPRN0tDjLpVfz0qwVV7gN6vMU3P6tx4\" crossorigin=\"anonymous\"></script>\n<pplr-data-maps profile-config='{\"profile\":\"pplr-data-maps\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></pplr-data-maps>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./pplr-data-maps/pplr-data-maps.js\" integrity=\"sha384-N6t6ynJj6kszViW0/GXZV6KflEYl7oApl3sUG0R+yjYLJWNeu3saq7Jmr6WZ/H3p\" crossorigin=\"anonymous\"></script>\n<pplr-data-maps profile-config='{\"profile\":\"pplr-data-maps\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></pplr-data-maps>"
           },
           "bundle": "pplr-data-maps"
         }
@@ -863,7 +862,7 @@
       "bundle": "prayer-walk-planner",
       "scriptUrl": "./prayer-walk-planner/prayer-walk-planner.js",
       "output": "dx-maps/prayer-walk-planner/prayer-walk-planner.js",
-      "integrity": "sha384-PqvBFQWuX/MKP2Jv7p/ir8zBvb6tNbyWh00ZHCZU/Q0dpaE7XvF36tMhmC9tixcJ",
+      "integrity": "sha384-T7I7/ETH/dJgyRGSEJg+44bi4Y4UAxToZzScKFQJa2xX+Ao1Mo8GSaux5Hu3ukzw",
       "elements": [
         "prayer-walk-planner"
       ],
@@ -879,7 +878,7 @@
           "scriptUrl": "./prayer-walk-planner/prayer-walk-planner.js",
           "embed": {
             "iframe": "<iframe src=\"./prayer-walk-planner/prayer-walk-planner/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./prayer-walk-planner/prayer-walk-planner.js\" integrity=\"sha384-PqvBFQWuX/MKP2Jv7p/ir8zBvb6tNbyWh00ZHCZU/Q0dpaE7XvF36tMhmC9tixcJ\" crossorigin=\"anonymous\"></script>\n<prayer-walk-planner profile-config='{\"profile\":\"prayer-walk-planner\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></prayer-walk-planner>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./prayer-walk-planner/prayer-walk-planner.js\" integrity=\"sha384-T7I7/ETH/dJgyRGSEJg+44bi4Y4UAxToZzScKFQJa2xX+Ao1Mo8GSaux5Hu3ukzw\" crossorigin=\"anonymous\"></script>\n<prayer-walk-planner profile-config='{\"profile\":\"prayer-walk-planner\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></prayer-walk-planner>"
           }
         }
       ]
@@ -888,7 +887,7 @@
       "bundle": "regions-dashboard",
       "scriptUrl": "./regions-dashboard/regions-dashboard.js",
       "output": "dx-maps/regions-dashboard/regions-dashboard.js",
-      "integrity": "sha384-nhQdaK/mbo+hByXAKQ9TRmewlRyzN10YWiPqijosjdijLmJfwla30Gd4D7Ithb6t",
+      "integrity": "sha384-6gpfo5njwcp+yyo/iahc09r2JkPZvfUjhWdoXdxlzNvzg/qqAfcAYZttBYb5q6t2",
       "elements": [
         "regions-dashboard"
       ],
@@ -908,7 +907,7 @@
           "scriptUrl": "./regions-dashboard/regions-dashboard.js",
           "embed": {
             "iframe": "<iframe src=\"./regions-dashboard/region-dashboards/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./regions-dashboard/regions-dashboard.js\" integrity=\"sha384-nhQdaK/mbo+hByXAKQ9TRmewlRyzN10YWiPqijosjdijLmJfwla30Gd4D7Ithb6t\" crossorigin=\"anonymous\"></script>\n<regions-dashboard profile-config='{\"profile\":\"region-dashboards\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></regions-dashboard>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./regions-dashboard/regions-dashboard.js\" integrity=\"sha384-6gpfo5njwcp+yyo/iahc09r2JkPZvfUjhWdoXdxlzNvzg/qqAfcAYZttBYb5q6t2\" crossorigin=\"anonymous\"></script>\n<regions-dashboard profile-config='{\"profile\":\"region-dashboards\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></regions-dashboard>"
           }
         },
         {
@@ -922,7 +921,7 @@
           "scriptUrl": "./regions-dashboard/regions-dashboard.js",
           "embed": {
             "iframe": "<iframe src=\"./regions-dashboard/regions-list/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./regions-dashboard/regions-dashboard.js\" integrity=\"sha384-nhQdaK/mbo+hByXAKQ9TRmewlRyzN10YWiPqijosjdijLmJfwla30Gd4D7Ithb6t\" crossorigin=\"anonymous\"></script>\n<regions-dashboard profile-config='{\"profile\":\"regions-list\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></regions-dashboard>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./regions-dashboard/regions-dashboard.js\" integrity=\"sha384-6gpfo5njwcp+yyo/iahc09r2JkPZvfUjhWdoXdxlzNvzg/qqAfcAYZttBYb5q6t2\" crossorigin=\"anonymous\"></script>\n<regions-dashboard profile-config='{\"profile\":\"regions-list\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></regions-dashboard>"
           }
         },
         {
@@ -936,7 +935,7 @@
           "scriptUrl": "./regions-dashboard/regions-dashboard.js",
           "embed": {
             "iframe": "<iframe src=\"./regions-dashboard/regions-mfe/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./regions-dashboard/regions-dashboard.js\" integrity=\"sha384-nhQdaK/mbo+hByXAKQ9TRmewlRyzN10YWiPqijosjdijLmJfwla30Gd4D7Ithb6t\" crossorigin=\"anonymous\"></script>\n<regions-dashboard profile-config='{\"profile\":\"regions-mfe\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></regions-dashboard>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./regions-dashboard/regions-dashboard.js\" integrity=\"sha384-6gpfo5njwcp+yyo/iahc09r2JkPZvfUjhWdoXdxlzNvzg/qqAfcAYZttBYb5q6t2\" crossorigin=\"anonymous\"></script>\n<regions-dashboard profile-config='{\"profile\":\"regions-mfe\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></regions-dashboard>"
           }
         }
       ]
@@ -945,7 +944,7 @@
       "bundle": "research-dashboard",
       "scriptUrl": "./research-dashboard/research-dashboard.js",
       "output": "dx-maps/research-dashboard/research-dashboard.js",
-      "integrity": "sha384-N8ZJTvr/l0jCSaV+3iP3gk/5R7SEwoJpMJFKEO9TYDC33wufmanR0eijkwSTO6mz",
+      "integrity": "sha384-s3pFfmYB+8irEnGByL45IAivZlETx+tQ0WScmy6x6hi7zYONjStXqQcTtZXjiQZ6",
       "elements": [
         "research-dashboard-map"
       ],
@@ -961,7 +960,7 @@
           "scriptUrl": "./research-dashboard/research-dashboard.js",
           "embed": {
             "iframe": "<iframe src=\"./research-dashboard/research-dashboard/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./research-dashboard/research-dashboard.js\" integrity=\"sha384-N8ZJTvr/l0jCSaV+3iP3gk/5R7SEwoJpMJFKEO9TYDC33wufmanR0eijkwSTO6mz\" crossorigin=\"anonymous\"></script>\n<research-dashboard-map profile-config='{\"profile\":\"research-dashboard\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></research-dashboard-map>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./research-dashboard/research-dashboard.js\" integrity=\"sha384-s3pFfmYB+8irEnGByL45IAivZlETx+tQ0WScmy6x6hi7zYONjStXqQcTtZXjiQZ6\" crossorigin=\"anonymous\"></script>\n<research-dashboard-map profile-config='{\"profile\":\"research-dashboard\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></research-dashboard-map>"
           },
           "bundle": "research-dashboard"
         }
@@ -971,7 +970,7 @@
       "bundle": "research-map-plus-grid",
       "scriptUrl": "./research-map-plus-grid/research-map-plus-grid.js",
       "output": "dx-maps/research-map-plus-grid/research-map-plus-grid.js",
-      "integrity": "sha384-q6MGCvQSGtk5CaASt5uu1mD7qDGoBwo17PDg3lW9jDzBQ5hMGj56TngLR/o6fc05",
+      "integrity": "sha384-47lmpj8ueP5gozXxvFShNBG1eR3x47apL6uVV+iFVSlKpp5lwF6+zTk146vRyASr",
       "elements": [
         "research-map-plus-grid"
       ],
@@ -991,7 +990,7 @@
           "scriptUrl": "./research-map-plus-grid/research-map-plus-grid.js",
           "embed": {
             "iframe": "<iframe src=\"./research-map-plus-grid/research-map-plus-grid/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./research-map-plus-grid/research-map-plus-grid.js\" integrity=\"sha384-q6MGCvQSGtk5CaASt5uu1mD7qDGoBwo17PDg3lW9jDzBQ5hMGj56TngLR/o6fc05\" crossorigin=\"anonymous\"></script>\n<research-map-plus-grid profile-config='{\"profile\":\"research-map-plus-grid\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></research-map-plus-grid>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./research-map-plus-grid/research-map-plus-grid.js\" integrity=\"sha384-47lmpj8ueP5gozXxvFShNBG1eR3x47apL6uVV+iFVSlKpp5lwF6+zTk146vRyASr\" crossorigin=\"anonymous\"></script>\n<research-map-plus-grid profile-config='{\"profile\":\"research-map-plus-grid\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></research-map-plus-grid>"
           },
           "instances": [
             {
@@ -1015,7 +1014,7 @@
       "bundle": "stack-demo",
       "scriptUrl": "./stack-demo/stack-demo.js",
       "output": "dx-maps/stack-demo/stack-demo.js",
-      "integrity": "sha384-D/F6egHTM6ENUVz/R50TwOy9dNkRbLJurypEZLYMyakjV+rDwQ3XwAYgs+H7IywP",
+      "integrity": "sha384-9/bRDfPfFGVpqL8wP329Awt3U0PqrieIL89Dp4k6Nkp+D9S5GUCWxvj8fMGphzXo",
       "elements": [
         "stack-demo"
       ],
@@ -1035,7 +1034,7 @@
           "scriptUrl": "./stack-demo/stack-demo.js",
           "embed": {
             "iframe": "<iframe src=\"./stack-demo/stack-demo/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./stack-demo/stack-demo.js\" integrity=\"sha384-D/F6egHTM6ENUVz/R50TwOy9dNkRbLJurypEZLYMyakjV+rDwQ3XwAYgs+H7IywP\" crossorigin=\"anonymous\"></script>\n<stack-demo profile-config='{\"profile\":\"stack-demo\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></stack-demo>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./stack-demo/stack-demo.js\" integrity=\"sha384-9/bRDfPfFGVpqL8wP329Awt3U0PqrieIL89Dp4k6Nkp+D9S5GUCWxvj8fMGphzXo\" crossorigin=\"anonymous\"></script>\n<stack-demo profile-config='{\"profile\":\"stack-demo\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></stack-demo>"
           },
           "instances": [
             {
@@ -1059,7 +1058,7 @@
       "bundle": "upg-neighbor",
       "scriptUrl": "./upg-neighbor/upg-neighbor.js",
       "output": "dx-maps/upg-neighbor/upg-neighbor.js",
-      "integrity": "sha384-pfgq/jUvzR6Is/zMBujuN0Rk+t7KUQslO7vU9OVGVJzAiRsGjsUsC/6dQ4fZ/hn5",
+      "integrity": "sha384-8RBR+NR4mrXAe1EuAKwAJrqRQIpB/gkMiBgvLI9QehL51IU2HQACfqdQp+sYB7Si",
       "elements": [
         "upg-neighbor"
       ],
@@ -1075,7 +1074,7 @@
           "scriptUrl": "./upg-neighbor/upg-neighbor.js",
           "embed": {
             "iframe": "<iframe src=\"./upg-neighbor/upg-neighbor/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<!-- Mapbox engine, fetched early; remove this line if you set \"provider\":\"maplibre\" -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./upg-neighbor/upg-neighbor.js\" integrity=\"sha384-pfgq/jUvzR6Is/zMBujuN0Rk+t7KUQslO7vU9OVGVJzAiRsGjsUsC/6dQ4fZ/hn5\" crossorigin=\"anonymous\"></script>\n<upg-neighbor profile-config='{\"profile\":\"upg-neighbor\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></upg-neighbor>"
+            "script": "<!-- Mapbox engine, fetched early. Keep it only with a real Mapbox token in \"tk\": without one (or with \"provider\":\"maplibre\") the map draws with MapLibre and this line must go -->\n<link rel=\"preload\" as=\"script\" href=\"https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js\">\n<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./upg-neighbor/upg-neighbor.js\" integrity=\"sha384-8RBR+NR4mrXAe1EuAKwAJrqRQIpB/gkMiBgvLI9QehL51IU2HQACfqdQp+sYB7Si\" crossorigin=\"anonymous\"></script>\n<upg-neighbor profile-config='{\"profile\":\"upg-neighbor\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></upg-neighbor>"
           },
           "instances": [
             {
@@ -1157,7 +1156,7 @@
       "bundle": "wall-of-people-groups",
       "scriptUrl": "./wall-of-people-groups/wall-of-people-groups.js",
       "output": "dx-maps/wall-of-people-groups/wall-of-people-groups.js",
-      "integrity": "sha384-/RvE4YrpW+WAsLi3FHzq/2wxmCVo9kBnA3VtSY+RI1v2B8zzMsHXjqwVlN6Fhg30",
+      "integrity": "sha384-XZHKc5fvUZEpa14aUYb6+CVPiJenH0bDPt3C2TCOMUbmLzj7jakSV9mmUUR4ou4x",
       "elements": [
         "wall-of-people-groups"
       ],
@@ -1173,7 +1172,7 @@
           "scriptUrl": "./wall-of-people-groups/wall-of-people-groups.js",
           "embed": {
             "iframe": "<iframe src=\"./wall-of-people-groups/wall-of-people-groups/index.html?utm_source=YOUR_SOURCE\" width=\"100%\" height=\"600\" style=\"border:none;border-radius:12px;\" allowfullscreen></iframe>",
-            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./wall-of-people-groups/wall-of-people-groups.js\" integrity=\"sha384-/RvE4YrpW+WAsLi3FHzq/2wxmCVo9kBnA3VtSY+RI1v2B8zzMsHXjqwVlN6Fhg30\" crossorigin=\"anonymous\"></script>\n<wall-of-people-groups profile-config='{\"profile\":\"wall-of-people-groups\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></wall-of-people-groups>"
+            "script": "<script>window.MAP_APP_API_URL=\"https://pray.doxa.life\";</script>\n<script src=\"./wall-of-people-groups/wall-of-people-groups.js\" integrity=\"sha384-XZHKc5fvUZEpa14aUYb6+CVPiJenH0bDPt3C2TCOMUbmLzj7jakSV9mmUUR4ou4x\" crossorigin=\"anonymous\"></script>\n<wall-of-people-groups profile-config='{\"profile\":\"wall-of-people-groups\",\"tk\":\"YOUR_MAPBOX_TOKEN\",\"utmSource\":\"YOUR_SOURCE\",\"assetsBase\":\"YOUR_TREE_URL/assets\"}'></wall-of-people-groups>"
           },
           "bundle": "wall-of-people-groups"
         }

public/dx-maps/my-upg-100-list/poster-wall/index.html

@@ -32,7 +32,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <my-upg-100-list-map> custom element. -->
-  <script src="../my-upg-100-list.js" integrity="sha384-rwEZFr0I9/+aFfKJDojxPrQ6BwIafYom66bzxvaCxnURiVr4ALaoZWPqqcwByUeF" crossorigin="anonymous"></script>
+  <script src="../my-upg-100-list.js" integrity="sha384-IMHvWXNPtmWShnySI7xyT6bz2kNJ+HGi6OIqWXYnpaXHKSElAEK2kF8G5YjJfA24" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"profile":"poster-wall","dataSource":"pray-tools","instanceId":"my-upg-100-list-poster-wall","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/my-upg-100-list/upg-100-list/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <my-upg-100-list-map> custom element. -->
-  <script src="../my-upg-100-list.js" integrity="sha384-rwEZFr0I9/+aFfKJDojxPrQ6BwIafYom66bzxvaCxnURiVr4ALaoZWPqqcwByUeF" crossorigin="anonymous"></script>
+  <script src="../my-upg-100-list.js" integrity="sha384-IMHvWXNPtmWShnySI7xyT6bz2kNJ+HGi6OIqWXYnpaXHKSElAEK2kF8G5YjJfA24" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"profile":"upg-100-list","dataSource":"pray-tools","instanceId":"my-upg-100-list-upg-100-list","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/my-upg-100-list/upg-100-mfe/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -47,7 +47,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <my-upg-100-list-map> custom element. -->
-  <script src="../my-upg-100-list.js" integrity="sha384-rwEZFr0I9/+aFfKJDojxPrQ6BwIafYom66bzxvaCxnURiVr4ALaoZWPqqcwByUeF" crossorigin="anonymous"></script>
+  <script src="../my-upg-100-list.js" integrity="sha384-IMHvWXNPtmWShnySI7xyT6bz2kNJ+HGi6OIqWXYnpaXHKSElAEK2kF8G5YjJfA24" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -66,20 +66,19 @@
       var BASE_CONFIG = {"profile":"upg-100-mfe","dataSource":"pray-tools","instanceId":"my-upg-100-list-upg-100-mfe","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = true;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -147,13 +146,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -184,7 +194,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/people-groups-grid/people-groups-grid/driven/index.html

@@ -32,7 +32,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <people-groups-grid> custom element. -->
-  <script src="../../people-groups-grid.js" integrity="sha384-jRC+t4Fp5Vc7bBAG6wqHSlnBfH58NiOpDXRk4LITH38reLiDwln0dJd8a7LyYtdw" crossorigin="anonymous"></script>
+  <script src="../../people-groups-grid.js" integrity="sha384-+e7nyKn7MYFP5eUCwvrnF9NfutCJW6oUbLxymwIiEpdNcvfrQQxMSLm0wiYZMEyq" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"people-groups-grid","provider":"maplibre","instanceId":"people-groups-grid-driven","pray-base-url":"https://pray.doxa.life","show-search":"false","show-filters":"false"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/people-groups-grid/people-groups-grid/index.html

@@ -32,7 +32,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <people-groups-grid> custom element. -->
-  <script src="../people-groups-grid.js" integrity="sha384-jRC+t4Fp5Vc7bBAG6wqHSlnBfH58NiOpDXRk4LITH38reLiDwln0dJd8a7LyYtdw" crossorigin="anonymous"></script>
+  <script src="../people-groups-grid.js" integrity="sha384-+e7nyKn7MYFP5eUCwvrnF9NfutCJW6oUbLxymwIiEpdNcvfrQQxMSLm0wiYZMEyq" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"profile":"people-groups-grid","dataSource":"pray-tools","instanceId":"people-groups-grid-people-groups-grid","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/people-groups-grid/people-groups-grid/people-groups-grid/index.html

@@ -32,7 +32,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <people-groups-grid> custom element. -->
-  <script src="../../people-groups-grid.js" integrity="sha384-jRC+t4Fp5Vc7bBAG6wqHSlnBfH58NiOpDXRk4LITH38reLiDwln0dJd8a7LyYtdw" crossorigin="anonymous"></script>
+  <script src="../../people-groups-grid.js" integrity="sha384-+e7nyKn7MYFP5eUCwvrnF9NfutCJW6oUbLxymwIiEpdNcvfrQQxMSLm0wiYZMEyq" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"people-groups-grid","provider":"maplibre","instanceId":"people-groups-grid","pray-base-url":"https://pray.doxa.life"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/plugin-studio/plugin-studio/index.html

@@ -32,7 +32,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <plugin-studio> custom element. -->
-  <script src="../plugin-studio.js" integrity="sha384-lYyH0iKEqJ0Ps32Bbzbe3XVdfJZbYAZ6SaeP7DURDmt6yVbxMY1bYrJNUdLDcf4d" crossorigin="anonymous"></script>
+  <script src="../plugin-studio.js" integrity="sha384-w2ejRW2EFGUTSC77YRgdoyVQayeLlt9KL9OSz/KJxsUUWu3oA+hDP0RiwktzjYZL" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"profile":"plugin-studio","dataSource":"pray-tools","instanceId":"plugin-studio-plugin-studio","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/plugin-studio/plugin-studio/studio/index.html

@@ -32,7 +32,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <plugin-studio> custom element. -->
-  <script src="../../plugin-studio.js" integrity="sha384-lYyH0iKEqJ0Ps32Bbzbe3XVdfJZbYAZ6SaeP7DURDmt6yVbxMY1bYrJNUdLDcf4d" crossorigin="anonymous"></script>
+  <script src="../../plugin-studio.js" integrity="sha384-w2ejRW2EFGUTSC77YRgdoyVQayeLlt9KL9OSz/KJxsUUWu3oA+hDP0RiwktzjYZL" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"plugin-studio","provider":"maplibre","instanceId":"plugin-studio","title":"Plugin Studio"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/pplr-data-maps/pplr-data-maps/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <pplr-data-maps> custom element. -->
-  <script src="../pplr-data-maps.js" integrity="sha384-Oxw1YTi/plI/0RTJeZQvJCan7XV0CzIJvkPRN0tDjLpVfz0qwVV7gN6vMU3P6tx4" crossorigin="anonymous"></script>
+  <script src="../pplr-data-maps.js" integrity="sha384-N6t6ynJj6kszViW0/GXZV6KflEYl7oApl3sUG0R+yjYLJWNeu3saq7Jmr6WZ/H3p" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"profile":"pplr-data-maps","dataSource":"pray-tools","instanceId":"pplr-data-maps-pplr-data-maps","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/prayer-walk-planner/prayer-walk-planner/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <prayer-walk-planner> custom element. -->
-  <script src="../prayer-walk-planner.js" integrity="sha384-PqvBFQWuX/MKP2Jv7p/ir8zBvb6tNbyWh00ZHCZU/Q0dpaE7XvF36tMhmC9tixcJ" crossorigin="anonymous"></script>
+  <script src="../prayer-walk-planner.js" integrity="sha384-T7I7/ETH/dJgyRGSEJg+44bi4Y4UAxToZzScKFQJa2xX+Ao1Mo8GSaux5Hu3ukzw" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"profile":"prayer-walk-planner","dataSource":"pray-tools","instanceId":"prayer-walk-planner-prayer-walk-planner","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/regions-dashboard/region-dashboards/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <regions-dashboard> custom element. -->
-  <script src="../regions-dashboard.js" integrity="sha384-nhQdaK/mbo+hByXAKQ9TRmewlRyzN10YWiPqijosjdijLmJfwla30Gd4D7Ithb6t" crossorigin="anonymous"></script>
+  <script src="../regions-dashboard.js" integrity="sha384-6gpfo5njwcp+yyo/iahc09r2JkPZvfUjhWdoXdxlzNvzg/qqAfcAYZttBYb5q6t2" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"pinHint":false,"profile":"region-dashboards","dataSource":"pray-tools","instanceId":"regions-dashboard-region-dashboards","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/regions-dashboard/regions-list/index.html

@@ -32,7 +32,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <regions-dashboard> custom element. -->
-  <script src="../regions-dashboard.js" integrity="sha384-nhQdaK/mbo+hByXAKQ9TRmewlRyzN10YWiPqijosjdijLmJfwla30Gd4D7Ithb6t" crossorigin="anonymous"></script>
+  <script src="../regions-dashboard.js" integrity="sha384-6gpfo5njwcp+yyo/iahc09r2JkPZvfUjhWdoXdxlzNvzg/qqAfcAYZttBYb5q6t2" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"pinHint":false,"profile":"regions-list","dataSource":"pray-tools","instanceId":"regions-dashboard-regions-list","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/regions-dashboard/regions-mfe/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -47,7 +47,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <regions-dashboard> custom element. -->
-  <script src="../regions-dashboard.js" integrity="sha384-nhQdaK/mbo+hByXAKQ9TRmewlRyzN10YWiPqijosjdijLmJfwla30Gd4D7Ithb6t" crossorigin="anonymous"></script>
+  <script src="../regions-dashboard.js" integrity="sha384-6gpfo5njwcp+yyo/iahc09r2JkPZvfUjhWdoXdxlzNvzg/qqAfcAYZttBYb5q6t2" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -66,20 +66,19 @@
       var BASE_CONFIG = {"pinHint":false,"profile":"regions-mfe","dataSource":"pray-tools","instanceId":"regions-dashboard-regions-mfe","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = true;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -147,13 +146,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -184,7 +194,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/research-dashboard/research-dashboard/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <research-dashboard-map> custom element. -->
-  <script src="../research-dashboard.js" integrity="sha384-N8ZJTvr/l0jCSaV+3iP3gk/5R7SEwoJpMJFKEO9TYDC33wufmanR0eijkwSTO6mz" crossorigin="anonymous"></script>
+  <script src="../research-dashboard.js" integrity="sha384-s3pFfmYB+8irEnGByL45IAivZlETx+tQ0WScmy6x6hi7zYONjStXqQcTtZXjiQZ6" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"profile":"research-dashboard","dataSource":"pray-tools","instanceId":"research-dashboard-research-dashboard","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/research-map-plus-grid/research-map-plus-grid/default/index.html

@@ -43,7 +43,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <research-map-plus-grid> custom element. -->
-  <script src="../../research-map-plus-grid.js" integrity="sha384-q6MGCvQSGtk5CaASt5uu1mD7qDGoBwo17PDg3lW9jDzBQ5hMGj56TngLR/o6fc05" crossorigin="anonymous"></script>
+  <script src="../../research-map-plus-grid.js" integrity="sha384-47lmpj8ueP5gozXxvFShNBG1eR3x47apL6uVV+iFVSlKpp5lwF6+zTk146vRyASr" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -62,20 +62,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"research-map-plus-grid"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = true;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -143,13 +142,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -180,7 +190,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/research-map-plus-grid/research-map-plus-grid/index.html

@@ -43,7 +43,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <research-map-plus-grid> custom element. -->
-  <script src="../research-map-plus-grid.js" integrity="sha384-q6MGCvQSGtk5CaASt5uu1mD7qDGoBwo17PDg3lW9jDzBQ5hMGj56TngLR/o6fc05" crossorigin="anonymous"></script>
+  <script src="../research-map-plus-grid.js" integrity="sha384-47lmpj8ueP5gozXxvFShNBG1eR3x47apL6uVV+iFVSlKpp5lwF6+zTk146vRyASr" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -62,20 +62,19 @@
       var BASE_CONFIG = {"profile":"research-map-plus-grid","dataSource":"pray-tools","instanceId":"research-map-plus-grid-research-map-plus-grid","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = true;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -143,13 +142,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -180,7 +190,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/stack-demo/stack-demo/index.html

@@ -43,7 +43,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <stack-demo> custom element. -->
-  <script src="../stack-demo.js" integrity="sha384-D/F6egHTM6ENUVz/R50TwOy9dNkRbLJurypEZLYMyakjV+rDwQ3XwAYgs+H7IywP" crossorigin="anonymous"></script>
+  <script src="../stack-demo.js" integrity="sha384-9/bRDfPfFGVpqL8wP329Awt3U0PqrieIL89Dp4k6Nkp+D9S5GUCWxvj8fMGphzXo" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -62,20 +62,19 @@
       var BASE_CONFIG = {"profile":"stack-demo","dataSource":"pray-tools","instanceId":"stack-demo-stack-demo","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = true;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -143,13 +142,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -180,7 +190,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/stack-demo/stack-demo/pair/index.html

@@ -43,7 +43,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <stack-demo> custom element. -->
-  <script src="../../stack-demo.js" integrity="sha384-D/F6egHTM6ENUVz/R50TwOy9dNkRbLJurypEZLYMyakjV+rDwQ3XwAYgs+H7IywP" crossorigin="anonymous"></script>
+  <script src="../../stack-demo.js" integrity="sha384-9/bRDfPfFGVpqL8wP329Awt3U0PqrieIL89Dp4k6Nkp+D9S5GUCWxvj8fMGphzXo" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -62,20 +62,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"stack-demo"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = true;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -143,13 +142,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -180,7 +190,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/upg-neighbor/upg-neighbor/bloom-cockpit/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <upg-neighbor> custom element. -->
-  <script src="../../upg-neighbor.js" integrity="sha384-pfgq/jUvzR6Is/zMBujuN0Rk+t7KUQslO7vU9OVGVJzAiRsGjsUsC/6dQ4fZ/hn5" crossorigin="anonymous"></script>
+  <script src="../../upg-neighbor.js" integrity="sha384-8RBR+NR4mrXAe1EuAKwAJrqRQIpB/gkMiBgvLI9QehL51IU2HQACfqdQp+sYB7Si" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"upg-neighbor","view":"cockpit"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/upg-neighbor/upg-neighbor/flower-mesh/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <upg-neighbor> custom element. -->
-  <script src="../../upg-neighbor.js" integrity="sha384-pfgq/jUvzR6Is/zMBujuN0Rk+t7KUQslO7vU9OVGVJzAiRsGjsUsC/6dQ4fZ/hn5" crossorigin="anonymous"></script>
+  <script src="../../upg-neighbor.js" integrity="sha384-8RBR+NR4mrXAe1EuAKwAJrqRQIpB/gkMiBgvLI9QehL51IU2HQACfqdQp+sYB7Si" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"upg-neighbor","view":"flower-mesh"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/upg-neighbor/upg-neighbor/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <upg-neighbor> custom element. -->
-  <script src="../upg-neighbor.js" integrity="sha384-pfgq/jUvzR6Is/zMBujuN0Rk+t7KUQslO7vU9OVGVJzAiRsGjsUsC/6dQ4fZ/hn5" crossorigin="anonymous"></script>
+  <script src="../upg-neighbor.js" integrity="sha384-8RBR+NR4mrXAe1EuAKwAJrqRQIpB/gkMiBgvLI9QehL51IU2HQACfqdQp+sYB7Si" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"profile":"upg-neighbor","dataSource":"pray-tools","instanceId":"upg-neighbor-upg-neighbor","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/upg-neighbor/upg-neighbor/lang-cluster/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <upg-neighbor> custom element. -->
-  <script src="../../upg-neighbor.js" integrity="sha384-pfgq/jUvzR6Is/zMBujuN0Rk+t7KUQslO7vU9OVGVJzAiRsGjsUsC/6dQ4fZ/hn5" crossorigin="anonymous"></script>
+  <script src="../../upg-neighbor.js" integrity="sha384-8RBR+NR4mrXAe1EuAKwAJrqRQIpB/gkMiBgvLI9QehL51IU2HQACfqdQp+sYB7Si" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"upg-neighbor","view":"lang-cluster"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/upg-neighbor/upg-neighbor/send-map/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <upg-neighbor> custom element. -->
-  <script src="../../upg-neighbor.js" integrity="sha384-pfgq/jUvzR6Is/zMBujuN0Rk+t7KUQslO7vU9OVGVJzAiRsGjsUsC/6dQ4fZ/hn5" crossorigin="anonymous"></script>
+  <script src="../../upg-neighbor.js" integrity="sha384-8RBR+NR4mrXAe1EuAKwAJrqRQIpB/gkMiBgvLI9QehL51IU2HQACfqdQp+sYB7Si" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"upg-neighbor","view":"send-map"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/upg-neighbor/upg-neighbor/upg-neighbors/index.html

@@ -15,7 +15,7 @@
        geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
        so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
        (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
+       → ?provider= → window.MAP_PROVIDER → auto), and the element's own runtime loaders load
        exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
        geocoder's on-demand loader — the path composite leaves already run on. Gate:
        check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->
@@ -36,7 +36,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <upg-neighbor> custom element. -->
-  <script src="../../upg-neighbor.js" integrity="sha384-pfgq/jUvzR6Is/zMBujuN0Rk+t7KUQslO7vU9OVGVJzAiRsGjsUsC/6dQ4fZ/hn5" crossorigin="anonymous"></script>
+  <script src="../../upg-neighbor.js" integrity="sha384-8RBR+NR4mrXAe1EuAKwAJrqRQIpB/gkMiBgvLI9QehL51IU2HQACfqdQp+sYB7Si" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -55,20 +55,19 @@
       var BASE_CONFIG = {"assetsBase":"../../../assets","profile":"upg-neighbor","view":"cockpit"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = false;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = false || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -136,13 +135,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -173,7 +183,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');

public/dx-maps/wall-of-people-groups/wall-of-people-groups/index.html

@@ -32,7 +32,7 @@
 
   <script>window.MAP_APP_API_URL = "https://pray.doxa.life";</script>
   <!-- Bundle IIFE — registers the <wall-of-people-groups> custom element. -->
-  <script src="../wall-of-people-groups.js" integrity="sha384-/RvE4YrpW+WAsLi3FHzq/2wxmCVo9kBnA3VtSY+RI1v2B8zzMsHXjqwVlN6Fhg30" crossorigin="anonymous"></script>
+  <script src="../wall-of-people-groups.js" integrity="sha384-XZHKc5fvUZEpa14aUYb6+CVPiJenH0bDPt3C2TCOMUbmLzj7jakSV9mmUUR4ou4x" crossorigin="anonymous"></script>
 
   <script>
     // Mapbox token resolution — the A3 ladder, in precedence order:
@@ -51,20 +51,19 @@
       var BASE_CONFIG = {"profile":"wall-of-people-groups","dataSource":"pray-tools","instanceId":"wall-of-people-groups-wall-of-people-groups","assetsBase":"../../assets"};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // (A leaf whose engine is MapLibre at RUNTIME joins them — see PROVIDER below.)
-      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      var TOKEN_FREE = true;
-      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
-      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
-      var TOKEN_FREE = true || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.
       var NESTS_MAPS = false;
       var TOKEN_SRC = "window.MAP_TOKEN_URL";
-      var BAKED_TOKEN = "pk.eyJ1IjoiZ29zeXN0ZW1zIiwiYSI6ImNtZm9vM291czA3amQya3BzYW42YW9ibTcifQ.52WM0IpxY9FcB0zc9f1zbQ";
+      var BAKED_TOKEN = "";
       // Expose the baked token as window.MAP_TOKEN so a BAKED composite (a compiled element that mounts
       // a map component directly, with no ProfileLoader/profile-config wrapper) still finds a token —
       // useMapInstance falls back to window.MAP_TOKEN. No effect when BAKED_TOKEN is empty.
+      // A token the HOST set before this page ran outranks the baked one (measured: it used to lose).
+      var HOST_TOKEN = (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN) || '';
       if (BAKED_TOKEN && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = BAKED_TOKEN; }
       var DEFAULT_TOKEN_URL = '/api/maps/token';
 
@@ -132,13 +131,24 @@
       try { stored = localStorage.getItem('MAPS_STAGING_TK') || ''; } catch (e) {}
       var urlTk = qp('tk');
       if (urlTk) { try { localStorage.setItem('MAPS_STAGING_TK', urlTk); } catch (e) {} }
-      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || BAKED_TOKEN;
+      var directToken = (BASE_CONFIG && BASE_CONFIG.tk) || urlTk || stored || HOST_TOKEN || BAKED_TOKEN;
+      // PROVIDER — the same ladder as resolveMapProvider (library/composables/useMapProvider.js):
+      // profile-config.provider → ?provider= → window.MAP_PROVIDER → 'auto'. An explicit engine wins.
+      // 'auto' = Mapbox when a token is available (a rung above, a host-set window.MAP_TOKEN, or a token
+      // endpoint to ask), otherwise MapLibre, keyless: no token prompt, no request to Mapbox. The
+      // element decides the same way from the token this page hands it, so the two cannot disagree.
+      var ASKED = String((BASE_CONFIG && BASE_CONFIG.provider) || qp('provider') || window.MAP_PROVIDER || '').toLowerCase().trim();
+      var EXPLICIT = (ASKED === 'mapbox' || ASKED === 'maplibre') ? ASKED : '';
+      var HAS_TOKEN = !!(directToken || (typeof window.MAP_TOKEN === 'string' && window.MAP_TOKEN));
+      var HAS_ENDPOINT = !!(window.MAP_TOKEN_URL || (TOKEN_SRC && TOKEN_SRC !== 'window.MAP_TOKEN_URL'));
+      if (EXPLICIT === 'maplibre' || (!EXPLICIT && !HAS_TOKEN && !HAS_ENDPOINT)) { TOKEN_FREE = true; }
       if (TOKEN_FREE) {
         if (directToken && typeof window !== 'undefined' && !window.MAP_TOKEN) { window.MAP_TOKEN = directToken; }
         mount('');
         // A token-free composite with no token anywhere: its content renders, but its nested maps
         // cannot. Ask once; the token is stored for the whole tree and the page reloads with it.
-        if (NESTS_MAPS && !directToken) {
+        // Only when Mapbox was ASKED for: under 'auto' the nested maps draw with MapLibre instead.
+        if (NESTS_MAPS && !directToken && EXPLICIT === 'mapbox') {
           var bar = document.createElement('div');
           bar.id = 'status';
           bar.setAttribute('style', 'position:fixed;left:12px;right:12px;bottom:12px;z-index:2147483000;padding:10px 12px;border-radius:10px;background:#0e1623;color:#eef2f7;font:13px system-ui,sans-serif;box-shadow:0 6px 24px rgba(0,0,0,.25)');
@@ -169,7 +179,9 @@
 
       function fetchToken(i, errors) {
         if (i >= candidates.length) {
-          // Every endpoint failed: say which, and still offer the paste-once box (no dead ends).
+          // Every endpoint failed. Under 'auto' that means no token: draw with MapLibre, keyless.
+          if (!EXPLICIT) { TOKEN_FREE = true; return mount(''); }
+          // Mapbox was asked for: say which endpoints failed, and still offer the paste-once box.
           askToken();
           if (status) {
             var d = document.createElement('div');