From d2c80cffdb6d8a25d6c271e6548df57d0c957c8e Mon Sep 17 00:00:00 2001
From: Bortlesboat <169967362+Bortlesboat@users.noreply.github.com>
Date: Sun, 18 Oct 2026 23:57:29 -0400
Subject: [PATCH 1/2] fix(gbfs): exclude stations with invalid coordinates

Reject non-numeric and out-of-range feed coordinates before they reach the
map or bike-share queries. Preserve numeric strings, aliases and zero.

Cover malformed records at the parser and public query boundaries.

Signed-off-by: Bortlesboat <169967362+Bortlesboat@users.noreply.github.com>
---
 changelog.d/0-gbfs-invalid-coordinates.md |  3 +
 docs/CURRENT-STATE.md                     |  6 +-
 src/sources/gbfsStations.js               | 20 ++++++-
 src/sources/gbfsStations.test.mjs         | 67 +++++++++++++++++++++++
 src/tools/queries/mobility.test.mjs       | 40 ++++++++++++++
 5 files changed, 132 insertions(+), 4 deletions(-)
 create mode 100644 changelog.d/0-gbfs-invalid-coordinates.md

diff --git a/changelog.d/0-gbfs-invalid-coordinates.md b/changelog.d/0-gbfs-invalid-coordinates.md
new file mode 100644
index 000000000..ed1f0824e
--- /dev/null
+++ b/changelog.d/0-gbfs-invalid-coordinates.md
@@ -0,0 +1,3 @@
+- Skip bike-share stations with missing, blank or invalid coordinates instead
+  of placing them at coerced zero coordinates or accepting out-of-range values.
+  Explicit zero coordinates and numeric strings remain supported (Bortlesboat, #0).
diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 9562dc9f5..8aedf558a 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -1265,7 +1265,11 @@ camera is refused there with a JSON 404 and is served solely through
 ## GBFS upstream bounds
 
 Station information is normalized in `src/sources/gbfsStations.js` for both the
-globe layer and `get_bike_share`. Names accept legacy strings or GBFS v3 Localized
+globe layer and `get_bike_share`. Stations with missing, blank, nonnumeric or
+out-of-range coordinates (latitude outside ±90, longitude outside ±180) are
+skipped. Numbers and nonblank numeric strings are accepted, including genuine
+zero and the `latitude`/`longitude` aliases; other JSON types are rejected.
+Names accept legacy strings or GBFS v3 Localized
 String arrays regardless of the reported feed version. Nonempty English text
 (including regional `en-*` tags, case-insensitive) takes precedence, then the first
 usable translation. An unusable `name` falls back to `short_name` with the same
diff --git a/src/sources/gbfsStations.js b/src/sources/gbfsStations.js
index c37c2fae4..c942579db 100644
--- a/src/sources/gbfsStations.js
+++ b/src/sources/gbfsStations.js
@@ -98,6 +98,13 @@ function dockCapacity(raw) {
   return capacity - geofenced;
 }
 
+/** Read a numeric coordinate without treating blank text or other JSON types as zero. */
+function coordinateNumber(value) {
+  if (typeof value !== 'number' && (typeof value !== 'string' || !value.trim()))
+    return NaN;
+  return Number(value);
+}
+
 /**
  * Parse a GBFS station_information payload into a Map of station metadata.
  * Handles field-name variations across different GBFS providers
@@ -113,9 +120,16 @@ export function parseStationInformation(payload) {
   for (const raw of stations) {
     // Accept both GBFS (station_id) and alternate (id) field names
     const stationId = String(raw?.station_id ?? raw?.id ?? '').trim();
-    const lat = Number(raw?.lat ?? raw?.latitude);
-    const lon = Number(raw?.lon ?? raw?.longitude);
-    if (!stationId || !Number.isFinite(lat) || !Number.isFinite(lon)) continue;
+    const lat = coordinateNumber(raw?.lat ?? raw?.latitude);
+    const lon = coordinateNumber(raw?.lon ?? raw?.longitude);
+    if (
+      !stationId ||
+      !Number.isFinite(lat) ||
+      !Number.isFinite(lon) ||
+      Math.abs(lat) > 90 ||
+      Math.abs(lon) > 180
+    )
+      continue;
 
     stationMap.set(stationId, {
       stationId,
diff --git a/src/sources/gbfsStations.test.mjs b/src/sources/gbfsStations.test.mjs
index 91983df98..1ab273556 100644
--- a/src/sources/gbfsStations.test.mjs
+++ b/src/sources/gbfsStations.test.mjs
@@ -19,6 +19,73 @@ const parseCapacity = (fields) =>
   parseStationInformation({ data: { stations: [station(fields)] } }).get('s1')
     .capacity;
 
+test('station information skips missing, blank and malformed coordinates', () => {
+  for (const field of ['lat', 'lon', 'latitude', 'longitude']) {
+    for (const value of [
+      undefined,
+      null,
+      '',
+      ' \t ',
+      false,
+      true,
+      [],
+      [0],
+      {},
+      'bad',
+      NaN,
+      Infinity,
+    ]) {
+      const raw = { station_id: 'bad', lat: 0, lon: 0 };
+      if (field === 'latitude') delete raw.lat;
+      if (field === 'longitude') delete raw.lon;
+      raw[field] = value;
+      const parsed = parseStationInformation({
+        data: { stations: [raw, station({ station_id: 'good' })] },
+      });
+      assert.deepEqual(
+        [...parsed.keys()],
+        ['good'],
+        `${field} = ${JSON.stringify(value)}`,
+      );
+    }
+  }
+});
+
+test('station information skips coordinates outside latitude and longitude bounds', () => {
+  for (const fields of [
+    { lat: 90.001 },
+    { lat: -90.001 },
+    { lon: 180.001 },
+    { lon: -180.001 },
+    { lat: undefined, latitude: '91' },
+    { lon: undefined, longitude: '-181' },
+  ]) {
+    const parsed = parseStationInformation({
+      data: { stations: [station(fields)] },
+    });
+    assert.equal(parsed.size, 0, JSON.stringify(fields));
+  }
+});
+
+test('station information preserves zero, boundary coordinates and numeric aliases', () => {
+  for (const [fields, expected] of [
+    [{ lat: 0, lon: 0 }, [0, 0]],
+    [{ lat: ' 0 ', lon: '0' }, [0, 0]],
+    [{ lat: 90, lon: 180 }, [90, 180]],
+    [{ lat: '-90', lon: '-180' }, [-90, -180]],
+    [
+      { lat: null, lon: undefined, latitude: '30.2681', longitude: '-97.7469' },
+      [30.2681, -97.7469],
+    ],
+  ]) {
+    const parsed = parseStationInformation({
+      data: { stations: [station(fields)] },
+    }).get('s1');
+    assert.ok(parsed, JSON.stringify(fields));
+    assert.deepEqual([parsed.lat, parsed.lon], expected);
+  }
+});
+
 test('capacity counts docks, not the geofenced area PBSC adds to it', () => {
   // Bilbao Bizi, BiciMAD and Dbizi as published on 2026-10-17.
   assert.equal(parseCapacity({ capacity: 839, geofenced_capacity: 800 }), 39);
diff --git a/src/tools/queries/mobility.test.mjs b/src/tools/queries/mobility.test.mjs
index 011e431fd..323173f03 100644
--- a/src/tools/queries/mobility.test.mjs
+++ b/src/tools/queries/mobility.test.mjs
@@ -171,6 +171,46 @@ test('bike share reports uncovered areas and failed systems honestly', async ()
   );
 });
 
+test('bike share excludes blank coordinates without losing stations on the prime meridian', async () => {
+  const stations = [
+    { station_id: 'blank', lat: 51.5, lon: ' ' },
+    { station_id: 'zero', lat: 51.5, lon: 0 },
+  ];
+  const catalog = composeCatalog({
+    tools: coreTools,
+    services: {
+      bikeshare: {
+        systems: [system('fixture', 'Fixture Bikes', 51.5, 0)],
+        async getStations(url) {
+          return {
+            data: {
+              stations: url.endsWith('station_information.json')
+                ? stations
+                : stations.map(({ station_id }) => ({
+                    station_id,
+                    num_bikes_available: 4,
+                  })),
+            },
+          };
+        },
+      },
+    },
+  });
+  const result = await catalog.call('get_bike_share', {
+    area: { lat: 51.5, lon: 0, radius_km: 2 },
+  });
+  assert.deepEqual(
+    result.data.rows.map((row) => row.station_id),
+    ['zero'],
+  );
+  assert.equal(result.data.total, 1);
+  assert.equal(result.data.rows[0].lon, 0);
+  assert.equal(
+    result.summary,
+    '1 bike-share station in 2 km around 51.500, 0.000 with 4 bikes available.',
+  );
+});
+
 const feed = {
   id: 'capmetro',
   name: 'CapMetro',

From dd6e01353ab7897edc6d840177661ec481f5b394 Mon Sep 17 00:00:00 2001
From: Bortlesboat <169967362+Bortlesboat@users.noreply.github.com>
Date: Sun, 18 Oct 2026 23:58:01 -0400
Subject: [PATCH 2/2] docs(gbfs): assign changelog fragment to PR 1232

Signed-off-by: Bortlesboat <169967362+Bortlesboat@users.noreply.github.com>
---
 ...-invalid-coordinates.md => 1232-gbfs-invalid-coordinates.md} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename changelog.d/{0-gbfs-invalid-coordinates.md => 1232-gbfs-invalid-coordinates.md} (90%)

diff --git a/changelog.d/0-gbfs-invalid-coordinates.md b/changelog.d/1232-gbfs-invalid-coordinates.md
similarity index 90%
rename from changelog.d/0-gbfs-invalid-coordinates.md
rename to changelog.d/1232-gbfs-invalid-coordinates.md
index ed1f0824e..4f3da2a97 100644
--- a/changelog.d/0-gbfs-invalid-coordinates.md
+++ b/changelog.d/1232-gbfs-invalid-coordinates.md
@@ -1,3 +1,3 @@
 - Skip bike-share stations with missing, blank or invalid coordinates instead
   of placing them at coerced zero coordinates or accepting out-of-range values.
-  Explicit zero coordinates and numeric strings remain supported (Bortlesboat, #0).
+  Explicit zero coordinates and numeric strings remain supported (Bortlesboat, #1232).