Merge branch 'main' into fix/tomtom-cross-site-gate

# Conflicts:
#	CHANGELOG.md
#	SECURITY.md
#	docs/CURRENT-STATE.md
#	scripts/package-boundaries.json
#	src/tooling/environmentProviders.test.mjs

src/tooling/changelogFragments.test.mjs

@@ -0,0 +1,319 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import * as fs from 'node:fs/promises';
+import {
+  mkdtemp,
+  mkdir,
+  writeFile,
+  readFile,
+  readdir,
+  rm,
+} from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  FRAGMENT_DIR,
+  STAGING_DIR,
+  assembleChangelog,
+  assembleFragments,
+  orderFragmentNames,
+  recoverInterruptedBatch,
+} from '../../scripts/assemble-changelog.mjs';
+
+const EXISTING =
+  '# Changelog\n\n- An entry that was already released (someone, #1).\n';
+
+const repositoryRoot = fileURLToPath(new URL('../..', import.meta.url));
+
+async function fixture(t, fragments = {}) {
+  const root = await mkdtemp(path.join(tmpdir(), 'gev-changelog-'));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  await mkdir(path.join(root, FRAGMENT_DIR));
+  await writeFile(
+    path.join(root, FRAGMENT_DIR, 'README.md'),
+    '# How to add one\n',
+  );
+  await writeFile(path.join(root, 'CHANGELOG.md'), EXISTING);
+  for (const [name, body] of Object.entries(fragments)) {
+    await writeFile(path.join(root, FRAGMENT_DIR, name), body);
+  }
+  return root;
+}
+
+test('the batch reads newest pull request first', () => {
+  assert.deepEqual(orderFragmentNames(['7-b.md', '112-c.md', '19-a.md']), [
+    '112-c.md',
+    '19-a.md',
+    '7-b.md',
+  ]);
+});
+
+test('the directory README is documentation, never an entry', () => {
+  assert.deepEqual(orderFragmentNames(['README.md', '5-a.md']), ['5-a.md']);
+});
+
+test('two fragments claiming one pull request fail loudly, not silently', () => {
+  assert.throws(
+    () => orderFragmentNames(['5-first.md', '5-second.md']),
+    /Two fragments claim pull request 5/,
+  );
+});
+
+test('a name that is not <pull request>-<slug>.md is refused', () => {
+  for (const name of ['notes.md', '5_underscore.md', '5-Caps.md', '5-a.txt']) {
+    assert.throws(() => orderFragmentNames([name]), /Unexpected file/, name);
+  }
+});
+
+test('fragment text is spliced in unchanged, above the existing entries', () => {
+  // Wrapped, indented and punctuated the way a real entry is: the continuation
+  // indent and the blank line inside the entry are the parts a reflow would eat.
+  const entry = [
+    '- A new thing, with `code` and a — dash. The second line is indented the',
+    '  way the surrounding entries wrap, and it keeps its two spaces.',
+    '',
+    '  A second paragraph, because some entries have one (someone, #9).',
+  ].join('\n');
+  const result = assembleChangelog(EXISTING, [`${entry}\n\n\n`]);
+  assert.equal(
+    result,
+    `# Changelog\n\n${entry}\n\n- An entry that was already released (someone, #1).\n`,
+  );
+  // The entry survives byte for byte: drawTool.test.mjs reads this file as
+  // prose and slices a fixed window, so reflowing would move text across it.
+  assert.ok(result.includes(entry));
+});
+
+test('a CHANGELOG without the heading is refused rather than prepended to', () => {
+  assert.throws(
+    () => assembleChangelog('- orphan entry\n', ['- new\n']),
+    /must start with "# Changelog"/,
+  );
+});
+
+test('assembling consumes the fragments and leaves the README', async (t) => {
+  const root = await fixture(t, {
+    '20-second.md': '- Second (someone, #20).',
+    '100-first.md': '- First (someone, #100).',
+  });
+  const { consumed } = await assembleFragments(root, '--write');
+  assert.deepEqual(consumed, ['100-first.md', '20-second.md']);
+  const changelog = await readFile(path.join(root, 'CHANGELOG.md'), 'utf8');
+  assert.match(
+    changelog,
+    /# Changelog\n\n- First \(someone, #100\)\.\n\n- Second \(someone, #20\)\.\n\n- An entry that was already released/,
+  );
+  assert.deepEqual(await readdir(path.join(root, FRAGMENT_DIR)), ['README.md']);
+});
+
+test('a rejected batch leaves the directory and the file untouched', async (t) => {
+  const root = await fixture(t, {
+    '8-first.md': '- First (someone, #8).',
+    '8-again.md': '- Again (someone, #8).',
+  });
+  await assert.rejects(
+    assembleFragments(root, '--write'),
+    /Two fragments claim pull request 8/,
+  );
+  assert.equal(
+    await readFile(path.join(root, 'CHANGELOG.md'), 'utf8'),
+    EXISTING,
+  );
+  assert.deepEqual((await readdir(path.join(root, FRAGMENT_DIR))).sort(), [
+    '8-again.md',
+    '8-first.md',
+    'README.md',
+  ]);
+});
+
+test('check mode changes nothing on disk', async (t) => {
+  const root = await fixture(t, { '3-a.md': '- Something (someone, #3).' });
+  const { consumed } = await assembleFragments(root, '--check');
+  assert.deepEqual(consumed, ['3-a.md']);
+  assert.equal(
+    await readFile(path.join(root, 'CHANGELOG.md'), 'utf8'),
+    EXISTING,
+  );
+  assert.deepEqual((await readdir(path.join(root, FRAGMENT_DIR))).sort(), [
+    '3-a.md',
+    'README.md',
+  ]);
+});
+
+test('an empty directory is a no-op, so a release can always run it', async (t) => {
+  const root = await fixture(t);
+  const { consumed } = await assembleFragments(root, '--write');
+  assert.deepEqual(consumed, []);
+  assert.equal(
+    await readFile(path.join(root, 'CHANGELOG.md'), 'utf8'),
+    EXISTING,
+  );
+});
+
+test('a mode that is neither check nor write is refused', async (t) => {
+  const root = await fixture(t);
+  await assert.rejects(assembleFragments(root, '--force'), /--check\|--write/);
+});
+
+// Failure injection. Every filesystem call the write path makes is a point
+// where a release can die: a full disk, a permissions error, a killed process.
+
+const IO_CALLS = ['readdir', 'readFile', 'mkdir', 'writeFile', 'rename', 'rm'];
+const BATCH = {
+  '20-second.md': '- Second (someone, #20).',
+  '100-first.md': '- First (someone, #100).',
+  '7-third.md': '- Third (someone, #7).',
+};
+
+/**
+ * The real filesystem, except that `call` throws the `nth` time it runs. With
+ * `crash`, every later call throws as well, the way a killed process makes no
+ * further calls: the in-process rollback cannot run either, so the next
+ * invocation is the only thing that can recover.
+ */
+function failing(call, nth, { crash = false } = {}) {
+  let seen = 0;
+  let dead = false;
+  const io = { ...fs };
+  for (const name of IO_CALLS) {
+    io[name] = async (...args) => {
+      if (dead) throw new Error('process already gone');
+      if (name === call && ++seen === nth) {
+        dead = crash;
+        throw new Error(`injected ${call} failure #${nth}`);
+      }
+      return fs[name](...args);
+    };
+  }
+  return io;
+}
+
+/** How many times one uninterrupted `--write` makes each filesystem call. */
+async function countCalls(t) {
+  const root = await fixture(t, BATCH);
+  const counts = Object.fromEntries(IO_CALLS.map((name) => [name, 0]));
+  const io = { ...fs };
+  for (const name of IO_CALLS) {
+    io[name] = (...args) => {
+      counts[name] += 1;
+      return fs[name](...args);
+    };
+  }
+  await assembleFragments(root, '--write', io);
+  return {
+    counts,
+    expected: await readFile(path.join(root, 'CHANGELOG.md'), 'utf8'),
+  };
+}
+
+test('a write that fails at any call never lets a retry duplicate or lose an entry', async (t) => {
+  const { counts, expected } = await countCalls(t);
+  // The write path itself: one mkdir, one writeFile, a rename per fragment plus
+  // the commit rename, and the cleanup rm. Fewer would mean a step went missing.
+  assert.ok(counts.rename >= Object.keys(BATCH).length + 1);
+  for (const crash of [false, true]) {
+    for (const call of IO_CALLS) {
+      for (let nth = 1; nth <= counts[call]; nth += 1) {
+        const label = `${crash ? 'crash' : 'error'} at ${call} #${nth}`;
+        const root = await fixture(t, BATCH);
+        await assert.rejects(
+          assembleFragments(root, '--write', failing(call, nth, { crash })),
+          /injected|already gone/,
+          label,
+        );
+        await assembleFragments(root, '--write');
+        const changelog = await readFile(
+          path.join(root, 'CHANGELOG.md'),
+          'utf8',
+        );
+        assert.equal(changelog, expected, label);
+        for (const pr of [100, 20, 7, 1]) {
+          assert.equal(
+            changelog.split(`(someone, #${pr}).`).length - 1,
+            1,
+            `${label}: #${pr} appears exactly once`,
+          );
+        }
+        assert.deepEqual(
+          await readdir(path.join(root, FRAGMENT_DIR)),
+          ['README.md'],
+          label,
+        );
+      }
+    }
+  }
+});
+
+test('an error before the commit rolls the batch back in the same run', async (t) => {
+  const root = await fixture(t, BATCH);
+  // The second rename has already moved one fragment into the staging directory.
+  await assert.rejects(
+    assembleFragments(root, '--write', failing('rename', 2)),
+    /injected rename failure #2/,
+  );
+  assert.equal(
+    await readFile(path.join(root, 'CHANGELOG.md'), 'utf8'),
+    EXISTING,
+  );
+  assert.deepEqual(
+    (await readdir(path.join(root, FRAGMENT_DIR))).sort(),
+    [...Object.keys(BATCH), 'README.md'].sort(),
+  );
+});
+
+test('check mode reports a batch an interrupted release left staged', async (t) => {
+  const root = await fixture(t, BATCH);
+  await assert.rejects(
+    assembleFragments(root, '--write', failing('rename', 2, { crash: true })),
+  );
+  await assert.rejects(
+    assembleFragments(root, '--check'),
+    new RegExp(`${STAGING_DIR}/ holds a batch an interrupted release`),
+  );
+  assert.equal(await recoverInterruptedBatch(root), 'rolled-back');
+  assert.equal(await recoverInterruptedBatch(root), 'none');
+});
+
+test('recovery refuses to roll a fragment back over a file of the same name', async (t) => {
+  const root = await fixture(t, BATCH);
+  await assert.rejects(
+    assembleFragments(root, '--write', failing('rename', 2, { crash: true })),
+  );
+  await writeFile(
+    path.join(root, FRAGMENT_DIR, '100-first.md'),
+    '- Rewritten.',
+  );
+  await assert.rejects(
+    assembleFragments(root, '--write'),
+    /Cannot roll back .*100-first\.md/,
+  );
+  assert.equal(
+    await readFile(path.join(root, 'CHANGELOG.md'), 'utf8'),
+    EXISTING,
+  );
+});
+
+// The two below run against the repository itself, so a fragment that the
+// release could not assemble fails `npm test` in the pull request that adds it
+// rather than at release time, when its author has moved on.
+
+test('every pending fragment in the repository can be assembled', async () => {
+  const names = await readdir(path.join(repositoryRoot, FRAGMENT_DIR));
+  assert.ok(
+    names.includes('README.md'),
+    `${FRAGMENT_DIR}/README.md documents the convention and keeps the directory tracked`,
+  );
+  // Throws on a name that is not <pull request>-<slug>.md, and on two fragments
+  // claiming one pull request number. Every other file is an entry.
+  assert.equal(orderFragmentNames(names).length, names.length - 1);
+});
+
+test('CHANGELOG.md still carries the heading a release splices under', async () => {
+  const changelog = await readFile(
+    path.join(repositoryRoot, 'CHANGELOG.md'),
+    'utf8',
+  );
+  assert.ok(changelog.startsWith('# Changelog\n'));
+});

src/tooling/environmentProviders.test.mjs

@@ -61,6 +61,29 @@ function isolate(t, env = {}) {
 }
 const json = (res) => JSON.parse(res.body);
 
+/** A response that streams 1 MiB chunks of `text` well past every cap, then ends. */
+function oversizedResponse(text) {
+  const state = { pulled: 0, cancelled: false };
+  const chunk = new TextEncoder().encode(
+    text.repeat(Math.ceil((1 << 20) / text.length)),
+  );
+  const response = new Response(
+    new ReadableStream(
+      {
+        pull(controller) {
+          if (++state.pulled > 40) controller.close();
+          else controller.enqueue(chunk);
+        },
+        cancel() {
+          state.cancelled = true;
+        },
+      },
+      { highWaterMark: 0 },
+    ),
+  );
+  return { response, state };
+}
+
 test('standalone composition mounts every extracted provider exactly once without acquisition', (t) => {
   t.mock.method(globalThis, 'fetch', () => {
     throw Error('construction must not fetch');
@@ -234,6 +257,29 @@ test('traffic refuses cross-site requests in dev and preview before spending the
   }
 });
 
+test('traffic middleware answers 502 to an oversized tile without caching it', async (t) => {
+  isolate(t, { TOMTOM_API_KEY: 'fixture-key', TOMTOM_DAILY_TILE_BUDGET: '' });
+  const bodies = [];
+  t.mock.method(globalThis, 'fetch', async () => {
+    const oversized = oversizedResponse('\x01');
+    bodies.push(oversized.state);
+    return oversized.response;
+  });
+  const request = install(tomtomProxy());
+  const first = await request('/flow/8/1/1.pbf');
+  assert.equal(first.status, 502);
+  assert.equal(bodies[0].cancelled, true);
+  assert.ok(bodies[0].pulled <= 9, 'reading stops at the 8 MiB cap');
+  assert.ok(
+    !fsp.writeFile.mock.calls.some(({ arguments: [file] }) =>
+      String(file).endsWith('.pbf'),
+    ),
+    'no tile reached the disk cache',
+  );
+  assert.equal((await request('/flow/8/1/1.pbf')).status, 502);
+  assert.equal(bodies.length, 2, 'nothing was cached in memory');
+});
+
 test('FIRMS retains a large successful source during partial failure and filters stale data at serve time', async (t) => {
   isolate(t, { FIRMS_MAP_KEY: '' });
   let now = Date.UTC(2026, 8, 12, 12);

src/tooling/liveProviders.test.mjs

@@ -37,6 +37,30 @@ function install(plugin, preview = false) {
   };
 }
 
+/** A response that streams 1 MiB chunks of `text` well past every cap, then ends. */
+function oversizedResponse(text, init = {}) {
+  const state = { pulled: 0, cancelled: false };
+  const chunk = new TextEncoder().encode(
+    text.repeat(Math.ceil((1 << 20) / text.length)),
+  );
+  const response = new Response(
+    new ReadableStream(
+      {
+        pull(controller) {
+          if (++state.pulled > 40) controller.close();
+          else controller.enqueue(chunk);
+        },
+        cancel() {
+          state.cancelled = true;
+        },
+      },
+      { highWaterMark: 0 },
+    ),
+    init,
+  );
+  return { response, state };
+}
+
 function environment(t, values) {
   for (const [key, value] of Object.entries(values)) {
     const original = process.env[key];
@@ -193,6 +217,130 @@ test('OpenSky global snapshot attempts are time-limited, retried once, then fall
   assert.equal(stalled.response.headers['x-flight-source'], 'adsb.lol');
 });
 
+const openSkyAnonEnv = {
+  OPENSKY_CLIENT_ID: undefined,
+  OPENSKY_CLIENT_SECRET: undefined,
+  OPENSKY_AUTH_MODE: 'anon',
+  OPENSKY_USERNAME: undefined,
+  OPENSKY_PASSWORD: undefined,
+};
+const regionalFallback = () =>
+  Response.json({
+    now: Date.now() / 1000,
+    ac: [{ hex: 'abc123', lat: 30, lon: -97, alt_baro: 10000 }],
+  });
+
+test('OpenSky 429 starts the cooldown from headers and cancels the body unread', async (t) => {
+  environment(t, openSkyAnonEnv);
+  t.mock.method(console, 'warn', () => {});
+  t.mock.method(console, 'error', () => {});
+  let states = 0;
+  let limited;
+  t.mock.method(globalThis, 'fetch', async (url) => {
+    if (url.includes('/states/')) {
+      states++;
+      limited = oversizedResponse('x', {
+        status: 429,
+        headers: { 'x-rate-limit-retry-after-seconds': '600' },
+      });
+      return limited.response;
+    }
+    if (url.includes('/lat/')) return regionalFallback();
+    throw Error(`Unexpected URL: ${url}`);
+  });
+  const fresh = await import(
+    `../../server/providers/aircraft/opensky.js?ratelimit=${Math.random()}`
+  );
+  const request = install(fresh.openSkyProxy());
+  const first = await request('/api/flights', '?lat=30&lon=-97');
+  assert.equal(first.statusCode, 200);
+  assert.equal(first.headers['x-flight-source'], 'adsb.lol');
+  assert.equal(states, 1, 'a rate-limited snapshot is not retried');
+  assert.equal(limited.state.cancelled, true);
+  assert.ok(limited.state.pulled <= 1, 'the 429 body is not read');
+  const cooling = await request('/api/flights', '?lat=30&lon=-97');
+  assert.equal(cooling.statusCode, 200);
+  assert.equal(
+    cooling.headers['x-opensky-auth-reason'],
+    'opensky_cooldown_regional_fallback',
+  );
+  assert.equal(states, 1, 'the cooldown holds off the next upstream attempt');
+});
+
+test('OpenSky 429 without retry-after cools down for the 2 minute default', async (t) => {
+  environment(t, openSkyAnonEnv);
+  t.mock.method(console, 'warn', () => {});
+  t.mock.method(console, 'error', () => {});
+  const start = Date.now();
+  let now = start;
+  t.mock.method(Date, 'now', () => now);
+  let states = 0;
+  t.mock.method(globalThis, 'fetch', async (url) => {
+    if (url.includes('/states/')) {
+      states++;
+      return new Response('{}', { status: 429 });
+    }
+    if (url.includes('/lat/')) return regionalFallback();
+    throw Error(`Unexpected URL: ${url}`);
+  });
+  const fresh = await import(
+    `../../server/providers/aircraft/opensky.js?ratelimit-default=${Math.random()}`
+  );
+  const request = install(fresh.openSkyProxy());
+  await request('/api/flights', '?lat=30&lon=-97');
+  assert.equal(states, 1);
+  // Past the 30 s floor but inside the 2 minute default.
+  now = start + 90_000;
+  await request('/api/flights', '?lat=30&lon=-97');
+  assert.equal(states, 1, 'a missing header is not read as a zero wait');
+});
+
+test('OpenSky does not retry a snapshot body over the cap', async (t) => {
+  environment(t, openSkyAnonEnv);
+  t.mock.method(console, 'warn', () => {});
+  t.mock.method(console, 'error', () => {});
+  const bodies = [];
+  t.mock.method(globalThis, 'fetch', async (url) => {
+    if (url.includes('/states/')) {
+      const oversized = oversizedResponse(' ');
+      bodies.push(oversized.state);
+      return oversized.response;
+    }
+    if (url.includes('/lat/')) return regionalFallback();
+    throw Error(`Unexpected URL: ${url}`);
+  });
+  const fresh = await import(
+    `../../server/providers/aircraft/opensky.js?oversize=${Math.random()}`
+  );
+  const response = await install(fresh.openSkyProxy())(
+    '/api/flights',
+    '?lat=30&lon=-97',
+  );
+  assert.equal(response.statusCode, 200);
+  assert.equal(response.headers['x-flight-source'], 'adsb.lol');
+  assert.equal(bodies.length, 1, 'an oversized body is not fetched twice');
+  assert.equal(bodies[0].cancelled, true);
+  assert.ok(bodies[0].pulled <= 9, 'reading stops at the 8 MiB cap');
+});
+
+test('military aircraft route answers 502 to an oversized body without caching it', async (t) => {
+  t.mock.method(console, 'error', () => {});
+  const bodies = [];
+  t.mock.method(globalThis, 'fetch', async () => {
+    const oversized = oversizedResponse('{"ac":[]}');
+    bodies.push(oversized.state);
+    return oversized.response;
+  });
+  const request = install(providers.adsbLolProxy());
+  const first = await request('/api/military');
+  assert.equal(first.statusCode, 502);
+  assert.equal(bodies[0].cancelled, true);
+  assert.ok(bodies[0].pulled <= 9, 'reading stops at the 8 MiB cap');
+  const again = await request('/api/military');
+  assert.equal(again.statusCode, 502, 'nothing was cached');
+  assert.equal(bodies.length, 2);
+});
+
 test('military aircraft route preserves fresh cache and stale response after upstream failure', async (t) => {
   let now = Date.now();
   let calls = 0;

src/tooling/previewServing.test.mjs

@@ -10,6 +10,7 @@ import { makeFixtureRoot } from './fixtureRoot.mjs';
 test('data providers have both hooks; credential editing stays development-only', () => {
   const plugins = localProviderPlugins();
   assert.ok(plugins.some(({ name }) => name === 'fire-perimeters'));
+  assert.ok(plugins.some(({ name }) => name === 'gnss-integrity'));
   for (const plugin of plugins) {
     if (plugin.name === 'gev-key-setup') {
       assert.equal(plugin.configurePreviewServer, undefined);
@@ -103,6 +104,7 @@ test('real dev and built-preview servers serve provider JSON and terminate unkno
         ['/api/adsbdb/type/invalid', 400],
         ['/api/firms/status', 200],
         ['/api/fire-perimeters/inciweb/publication/invalid', 400],
+        ['/api/gnss-integrity?lat=invalid', 400],
         ['/api/terrain/heights?points=invalid', 400],
         ['/api/overpass', 405],
         ['/api/overpass/status', 200],

src/tooling/spaceProviders.test.mjs

@@ -47,6 +47,29 @@ function isolateDisk(t) {
   t.mock.method(fsp, 'writeFile', async () => {});
 }
 
+/** A response that streams 1 MiB chunks of `text` well past every cap, then ends. */
+function oversizedResponse(text) {
+  const state = { pulled: 0, cancelled: false };
+  const chunk = new TextEncoder().encode(
+    text.repeat(Math.ceil((1 << 20) / text.length)),
+  );
+  const response = new Response(
+    new ReadableStream(
+      {
+        pull(controller) {
+          if (++state.pulled > 40) controller.close();
+          else controller.enqueue(chunk);
+        },
+        cancel() {
+          state.cancelled = true;
+        },
+      },
+      { highWaterMark: 0 },
+    ),
+  );
+  return { response, state };
+}
+
 test('portable requests keep fixed origins, encode group data and preserve the 30-day UTC window', () => {
   const tle = celestrakTleUrl('stations&FORMAT=json');
   assert.equal(tle.origin, 'https://celestrak.org');
@@ -120,6 +143,27 @@ test('exported CelesTrak plugin coalesces refreshes, retains stale TLEs, and rea
   assert.equal(disk.body, tle);
 });
 
+test('CelesTrak answers 502 to an oversized TLE body without caching it', async (t) => {
+  isolateDisk(t);
+  t.mock.method(console, 'warn', () => {});
+  const bodies = [];
+  t.mock.method(globalThis, 'fetch', async () => {
+    const oversized = oversizedResponse(
+      'ISS\n1 25544U fixture\n2 25544 fixture\n',
+    );
+    bodies.push(oversized.state);
+    return oversized.response;
+  });
+  const request = install(celestrakProxy());
+  const first = await request('/api/celestrak', '/stations');
+  assert.equal(first.status, 502);
+  assert.equal(bodies[0].cancelled, true);
+  assert.ok(bodies[0].pulled <= 17, 'reading stops at the 16 MiB cap');
+  assert.equal(fsp.writeFile.mock.callCount(), 0);
+  assert.equal((await request('/api/celestrak', '/stations')).status, 502);
+  assert.equal(bodies.length, 2, 'nothing was cached in memory');
+});
+
 for (const preview of [false, true])
   test(`exported launch plugin preserves optional server auth and cache in ${preview ? 'preview' : 'development'}`, async (t) => {
     isolateDisk(t);

src/tooling/streetLevelQa.test.mjs

@@ -1,6 +1,7 @@
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import test from 'node:test';
+import { inflateSync } from 'node:zlib';
 import { createApplicationStreetLevel } from '../app/layers/streetLevel.js';
 import {
   fixtureTile,
@@ -20,6 +21,24 @@ import {
   THUMB_HOST,
 } from '../../scripts/fixtures/street-level/mapillaryGraph.mjs';
 import { redact } from '../../scripts/qa-browserEvidence.mjs';
+import {
+  answerKartaViewRequest,
+  describeKartaViewCall,
+  KV_LINE,
+  KV_OLD_STREET,
+  KV_SEQUENCE_ID,
+  kartaViewPhotos,
+  resetKartaViewFixture,
+} from '../../scripts/fixtures/street-level/kartaView.mjs';
+import {
+  maskedSegments,
+  tileSegments,
+} from '../layers/streetLevel/providers/kartaview/decode.js';
+import { lonToTileX, latToTileY } from '../layers/streetLevel/tileMath.js';
+import {
+  normalizePhoto,
+  resizedImageUrl,
+} from '../layers/streetLevel/providers/kartaview/policy.js';
 
 // The press helpers wait for paint; Node has no frames, so a tick stands in.
 globalThis.requestAnimationFrame ??= (callback) =>
@@ -515,15 +534,20 @@ test('evidence never carries a Mapillary token', () => {
 test('--strict accepts only the documented skips', () => {
   assert.deepEqual(
     [...STRICT_ALLOWED_SKIPS],
-    ['no Google 3D', 'fixtures only'],
+    ['no Google 3D', 'no Google key', 'fixtures only'],
   );
   assert.deepEqual(
     strictViolations([
       { reason: 'no Google 3D', label: 'terrain' },
+      { reason: 'no Google key', label: 'street view' },
       { reason: 'fixtures only', label: 'keyless page' },
       { reason: 'no Mapillary key', label: 'the keyed steps' },
+      { reason: 'Google key refused', label: 'street view' },
     ]),
-    [{ reason: 'no Mapillary key', label: 'the keyed steps' }],
+    [
+      { reason: 'no Mapillary key', label: 'the keyed steps' },
+      { reason: 'Google key refused', label: 'street view' },
+    ],
   );
 });
 
@@ -634,3 +658,279 @@ test('CI runs the gates hermetically against a production build, strict, with ev
     'a missed header press fails CI now that the rail settles',
   );
 });
+
+test('KartaView fixtures draw the drive, answer nearest first, and refuse the storage host the API names', () => {
+  const body = (answer) => JSON.parse(answer.body);
+  const lat = (KV_LINE.south + KV_LINE.north) / 2;
+  const x = lonToTileX(KV_LINE.lon, 14);
+  const y = latToTileY(lat, 14);
+  const tile = answerKartaViewRequest({
+    method: 'GET',
+    url: `https://api.kartaview.org/2.0/sequence/tiles/${x}/${y}/14.json`,
+  });
+  assert.equal(tile.known, true);
+  assert.ok(body(tile).lines.length >= 1);
+  const empty = answerKartaViewRequest({
+    method: 'GET',
+    url: `https://api.kartaview.org/2.0/sequence/tiles/${x + 3}/${y}/14.json`,
+  });
+  assert.deepEqual(body(empty).lines, []);
+  const nearUrl = `https://api.kartaview.org/2.0/photo/?lat=${lat}&lng=${KV_LINE.lon + 0.0001}&zoomLevel=18&itemsPerPage=10`;
+  resetKartaViewFixture();
+  // The first lookup is rate-limited, readable cross-origin; the retry answers.
+  const limited = answerKartaViewRequest({ method: 'GET', url: nearUrl });
+  assert.equal(limited.status, 429);
+  assert.equal(limited.known, true);
+  assert.equal(limited.headers['Retry-After'], '0');
+  assert.match(limited.headers['Access-Control-Expose-Headers'], /Retry-After/);
+  const near = answerKartaViewRequest({ method: 'GET', url: nearUrl });
+  assert.equal(near.status, 200);
+  const records = body(near).result.data;
+  assert.ok(records.length > 1);
+  assert.ok(Number(records[0].distance) <= Number(records[1].distance));
+  const photo = normalizePhoto(records[0]);
+  assert.match(photo.urls.view, /^https:\/\/storage2\.openstreetcam\.org\//);
+  assert.equal(
+    answerKartaViewRequest({ method: 'GET', url: photo.urls.view }).known,
+    true,
+  );
+  // Every odd photo is archived: its file answers 409, an even one the image.
+  const photos = kartaViewPhotos();
+  const storageAnswer = (index) =>
+    answerKartaViewRequest({
+      method: 'GET',
+      url: normalizePhoto(
+        body(
+          answerKartaViewRequest({
+            method: 'GET',
+            url: `https://api.kartaview.org/2.0/photo/${photos[index].id}`,
+          }),
+        ).result.data,
+      ).urls.view,
+    });
+  assert.equal(photos[3].archived, true);
+  assert.equal(storageAnswer(3).status, 409);
+  assert.equal(storageAnswer(3).known, true);
+  assert.equal(photos[4].archived, false);
+  assert.equal(storageAnswer(4).status, 200);
+  assert.equal(storageAnswer(4).contentType, 'image/jpeg');
+  // The image proxy still serves an archived photo: the 360° step opens one.
+  const pano = photos.find((p) => p.isPano);
+  assert.equal(pano.archived, true);
+  const panoRecord = body(
+    answerKartaViewRequest({
+      method: 'GET',
+      url: `https://api.kartaview.org/2.0/photo/${pano.id}`,
+    }),
+  ).result.data;
+  assert.equal(
+    answerKartaViewRequest({
+      method: 'GET',
+      url: resizedImageUrl(normalizePhoto(panoRecord).urls.pano, [1024, 512]),
+    }).status,
+    200,
+  );
+  assert.equal(
+    answerKartaViewRequest({ method: 'GET', url: records[0].fileurlLTh }).known,
+    false,
+    'the storage1 address the API gives is not where the photo is',
+  );
+  const page = answerKartaViewRequest({
+    method: 'GET',
+    url: `https://api.kartaview.org/2.0/sequence/${KV_SEQUENCE_ID}/photos?page=1&itemsPerPage=1000`,
+  });
+  assert.equal(body(page).result.data.length, kartaViewPhotos().length);
+  assert.ok(kartaViewPhotos().some((p) => p.isPano));
+  assert.equal(
+    describeKartaViewCall(
+      'GET',
+      new URL('https://api.kartaview.org/2.0/photo/77000001'),
+    ),
+    'GET api.kartaview.org/2.0/photo/{id}',
+  );
+});
+
+test('Panoramax fixtures: two sequences on one street, searches honour sequence and filters, unknown calls are flagged', async () => {
+  const {
+    answerPanoramaxRequest,
+    describePanoramaxCall,
+    PNX_LINE,
+    PNX_SEQUENCES,
+    panoramaxHdDownloads,
+    panoramaxPictures,
+    panoramaxTile,
+    resetPanoramaxFixture,
+  } = await import('../../scripts/fixtures/street-level/panoramax.mjs');
+  const { decodeCoverageTile, decodePictures } =
+    await import('../layers/streetLevel/providers/panoramax/decode.js');
+  const { normalizeItem } =
+    await import('../layers/streetLevel/providers/panoramax/policy.js');
+  resetPanoramaxFixture();
+  const pictures = panoramaxPictures();
+  assert.deepEqual(
+    [...new Set(pictures.map((p) => p.sequenceId))],
+    [...PNX_SEQUENCES],
+  );
+  assert.ok(pictures.some((p) => p.isPano));
+  // Coverage: both lines in a z14 tile on the street; cones in z15.
+  const z = 14;
+  const x = lonToTileX((PNX_LINE.west + PNX_LINE.east) / 2, z);
+  const y = latToTileY(PNX_LINE.lat, z);
+  const lines = decodeCoverageTile(panoramaxTile(z, x, y), { x, y, z });
+  assert.deepEqual(
+    lines.sequences.map((s) => s.id).sort(),
+    [...PNX_SEQUENCES].sort(),
+  );
+  const t15 = {
+    x: lonToTileX(pictures[20].lon, 15),
+    y: latToTileY(PNX_LINE.lat, 15),
+    z: 15,
+  };
+  assert.ok(
+    decodePictures(panoramaxTile(15, t15.x, t15.y), t15, PNX_SEQUENCES[0])
+      .length > 0,
+  );
+  // A search for one sequence near the street gives only its pictures, nearest first.
+  const at = pictures[30];
+  const ask = (query) =>
+    JSON.parse(
+      answerPanoramaxRequest({
+        method: 'GET',
+        url: `https://api.panoramax.xyz/api/search?${query}`,
+      }).body,
+    ).features.map(normalizeItem);
+  const own = ask(
+    `place_position=${at.lon},${at.lat}&place_distance=0-50&limit=5&collections=${PNX_SEQUENCES[1]}`,
+  );
+  assert.ok(own.length > 0);
+  assert.ok(own.every((p) => p.sequenceId === PNX_SEQUENCES[1]));
+  assert.equal(own[0].nextId && typeof own[0].nextId, 'string');
+  const panos = ask(
+    `place_position=${at.lon},${at.lat}&place_distance=0-200&limit=50&filter=field_of_view%3D360`,
+  );
+  assert.ok(panos.length > 0 && panos.every((p) => p.isPano));
+  assert.deepEqual(
+    ask(
+      `place_position=${at.lon},${at.lat}&place_distance=0-200&limit=50&datetime=2024-01-01T00:00:00.000Z/..`,
+    ).every((p) => p.sequenceId === PNX_SEQUENCES[0]),
+    true,
+    'the second sequence is older',
+  );
+  // A box has every picture in it, those looking away included; a place
+  // search leaves out pictures the point is behind (all look east).
+  const d = 0.0002;
+  const boxed = ask(
+    `bbox=${at.lon - d},${at.lat - d},${at.lon + d},${at.lat + d}&limit=100`,
+  );
+  assert.ok(
+    boxed.some((p) => p.lon < at.lon) && boxed.some((p) => p.lon > at.lon),
+  );
+  const placed = ask(
+    `place_position=${at.lon},${at.lat}&place_distance=0-30&limit=50`,
+  );
+  assert.ok(placed.length > 0);
+  assert.ok(
+    placed.every((p) => p.lon <= at.lon + 1e-7),
+    'none it is behind',
+  );
+  const one = ask(`ids=${at.id}&limit=1`);
+  assert.equal(one[0].id, at.id);
+  // Its pictures, and only those, are served; HD downloads are counted.
+  const file = (name) =>
+    answerPanoramaxRequest({
+      method: 'GET',
+      url: `https://panoramax.openstreetmap.fr/derivates/${name}`,
+    });
+  assert.equal(file(`${at.id}/sd.jpg`).status, 200);
+  assert.equal(file(`${at.id}/hd.jpg`).status, 200);
+  assert.equal(panoramaxHdDownloads(), 1);
+  assert.equal(file('nope/sd.jpg').known, false);
+  const unknown = answerPanoramaxRequest({
+    method: 'GET',
+    url: 'https://api.panoramax.xyz/api/collections/x/items',
+  });
+  assert.equal(unknown.known, false);
+  assert.equal(
+    describePanoramaxCall(
+      'GET',
+      new URL('https://api.panoramax.xyz/api/map/14/1/2.mvt'),
+    ),
+    'GET api.panoramax.xyz/api/map/{z}/{x}/{y}.mvt',
+  );
+});
+
+/** The alpha of a fixture PNG (8-bit RGBA, unfiltered rows, as it writes them). */
+function fixturePngAlpha(bytes) {
+  const width = bytes.readUInt32BE(16);
+  const height = bytes.readUInt32BE(20);
+  const idat = [];
+  for (let at = 8; at < bytes.length;) {
+    const length = bytes.readUInt32BE(at);
+    const type = bytes.toString('ascii', at + 4, at + 8);
+    if (type === 'IDAT') idat.push(bytes.subarray(at + 8, at + 8 + length));
+    at += 12 + length;
+  }
+  const rows = inflateSync(Buffer.concat(idat));
+  const alpha = new Uint8Array(width * height);
+  for (let y = 0; y < height; y++)
+    for (let x = 0; x < width; x++)
+      alpha[y * width + x] = rows[y * (width * 4 + 1) + 1 + x * 4 + 3];
+  return { width, height, alpha };
+}
+
+test('KartaView fixtures filter like KartaView: PNG tiles by view and upload date, the photo search by projection', () => {
+  const body = (answer) => JSON.parse(answer.body);
+  const z = 14;
+  const x = lonToTileX(KV_LINE.lon, z);
+  const y = latToTileY((KV_LINE.south + KV_LINE.north) / 2, z);
+  assert.equal(x, lonToTileX(KV_OLD_STREET.lon, z), 'both streets in a tile');
+  const base = `https://api.kartaview.org/2.0/sequence/tiles/${x}/${y}/${z}`;
+  const segments = tileSegments(
+    body(answerKartaViewRequest({ method: 'GET', url: `${base}.json` })),
+  );
+  const lons = (kept) => [...new Set(kept.map((segment) => segment[0][0]))];
+  const keptFor = (query) => {
+    const answer = answerKartaViewRequest({
+      method: 'GET',
+      url: `${base}.png?${query}`,
+    });
+    assert.equal(answer.contentType, 'image/png');
+    assert.equal(answer.known, true);
+    return lons(
+      maskedSegments(segments, fixturePngAlpha(answer.body), { x, y, z }),
+    );
+  };
+  assert.deepEqual(
+    lons(segments).sort(),
+    [KV_LINE.lon, KV_OLD_STREET.lon].sort(),
+  );
+  assert.deepEqual(keptFor('fieldOfView=360'), [KV_LINE.lon]);
+  assert.deepEqual(keptFor('fieldOfView=plane').sort(), lons(segments).sort());
+  const lastYear = new Date(Date.now() - 365 * 86_400_000)
+    .toISOString()
+    .slice(0, 10);
+  assert.deepEqual(keptFor(`startDate=${lastYear}`), [KV_LINE.lon]);
+  assert.deepEqual(keptFor('startDate=2099-01-01'), []);
+  assert.equal(
+    describeKartaViewCall('GET', new URL(`${base}.png?fieldOfView=360`)),
+    'GET api.kartaview.org/2.0/sequence/tiles/{x}/{y}/{z}.png?fieldOfView',
+  );
+  // The photo search: 360° only, and nothing uploaded after the drive.
+  resetKartaViewFixture();
+  const search = (extra) => {
+    answerKartaViewRequest({
+      method: 'GET',
+      url: 'https://api.kartaview.org/2.0/photo/?lat=0&lng=0',
+    });
+    return body(
+      answerKartaViewRequest({
+        method: 'GET',
+        url: `https://api.kartaview.org/2.0/photo/?lat=${KV_LINE.south + 0.002}&lng=${KV_LINE.lon}&zoomLevel=18&itemsPerPage=10${extra}`,
+      }),
+    ).result.data;
+  };
+  const panos = search('&projection=SPHERE');
+  assert.ok(panos.length > 0);
+  assert.ok(panos.every((record) => record.projection === 'SPHERE'));
+  assert.deepEqual(search('&startDate=2099-01-01'), []);
+});

src/tooling/transitQa.test.mjs

@@ -675,7 +675,7 @@ test('public transit documentation uses courtesy attribution and the approved gr
   );
   assert.ok(
     readme.includes(
-      'Twenty layers and map sources. **Seventeen have a keyless path.**',
+      'Twenty layers and map sources. **Eighteen have a keyless path.**',
     ),
   );
   assert.ok(

src/tooling/viteBuild.test.mjs

@@ -183,7 +183,7 @@ test('only embed-mode documents may be framed, and only by the allowed ancestors
   }
 });
 
-test('the CSP admits the event media embeds, and no other script origin', async () => {
+test('the CSP admits the event media embeds and the Maps JavaScript API, and no other script origin', async () => {
   const { embeddedMediaFrameUrl, resolveEmbeddedMediaSource } =
     await import('../../src/data/bhoteKoshiEmbeddedMedia.js');
   const directive = (name) =>
@@ -201,7 +201,8 @@ test('the CSP admits the event media embeds, and no other script origin', async
     'https://platform.twitter.com',
   ])
     assert.ok(scripts.includes(origin), origin);
-  // Only those three, and never a wildcard or a scheme.
+  // Only those three and Google Street View's Maps JavaScript API, never a
+  // wildcard or a scheme.
   assert.deepEqual(
     scripts.filter(
       (source) => source.startsWith('http') || source === 'https:',
@@ -210,6 +211,7 @@ test('the CSP admits the event media embeds, and no other script origin', async
       'https://www.youtube.com',
       'https://connect.facebook.net',
       'https://platform.twitter.com',
+      'https://maps.googleapis.com',
     ],
   );
   assert.ok(!scripts.some((source) => source.includes('*')));

src/tooling/webAppIcons.test.mjs

@@ -0,0 +1,149 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { rm, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import sharp from 'sharp';
+import { build } from 'vite';
+import { makeFixtureRoot } from './fixtureRoot.mjs';
+
+const REPO_ROOT = path.resolve(
+  fileURLToPath(new URL('.', import.meta.url)),
+  '../..',
+);
+const PUBLIC_ROOT = path.join(REPO_ROOT, 'public');
+const INDEX_HTML = readFileSync(path.join(REPO_ROOT, 'index.html'), 'utf8');
+
+/** `public/` is served at the site root, so an index.html href maps to a file by dropping the leading slash. */
+function publicFile(href) {
+  assert.ok(href.startsWith('/'), `${href} must be a root-relative URL`);
+  return path.join(PUBLIC_ROOT, href.slice(1));
+}
+
+const manifestHref = INDEX_HTML.match(
+  /<link[^>]+rel="manifest"[^>]+href="([^"]+)"/,
+)?.[1];
+
+/**
+ * Manifest URLs resolve against the manifest, not the page. Keeping them
+ * relative is what lets a build served under a path prefix install inside it.
+ */
+function manifestFile(src) {
+  assert.ok(
+    !src.startsWith('/') && !/^[a-z][a-z\d+.-]*:/i.test(src),
+    `${src} must be relative to the manifest`,
+  );
+  return path.join(path.dirname(publicFile(manifestHref)), src);
+}
+
+test('index.html links a web app manifest', () => {
+  assert.ok(manifestHref, 'no <link rel="manifest"> in index.html');
+});
+
+test('iOS gets a raster home-screen icon', () => {
+  // Safari ignores SVG for apple-touch-icon and falls back to a screenshot of
+  // the page, which is the blank tile this whole file exists to prevent. The
+  // existing `rel="icon"` SVG covers the browser tab and nothing else.
+  const href = INDEX_HTML.match(
+    /<link[^>]+rel="apple-touch-icon"[^>]+href="([^"]+)"/,
+  )?.[1];
+  assert.ok(href, 'no <link rel="apple-touch-icon"> in index.html');
+  assert.match(href, /\.png$/, 'apple-touch-icon must be a PNG');
+  assert.doesNotThrow(() => readFileSync(publicFile(href)));
+});
+
+test('the manifest declares a standalone installable app', () => {
+  const manifest = JSON.parse(readFileSync(publicFile(manifestHref), 'utf8'));
+  assert.equal(manifest.display, 'standalone');
+  assert.equal(manifest.start_url, '.');
+  assert.equal(manifest.scope, '.');
+  for (const field of ['name', 'short_name', 'background_color', 'theme_color'])
+    assert.ok(manifest[field], `manifest is missing ${field}`);
+  // Android's install prompt needs both, and uses the 512 for the splash screen.
+  const sizes = new Set(manifest.icons.map((icon) => icon.sizes));
+  for (const required of ['192x192', '512x512'])
+    assert.ok(sizes.has(required), `manifest declares no ${required} icon`);
+  // Without a maskable icon Android pads the square into a circle and clips
+  // the mark; with one it crops to the safe zone instead.
+  assert.ok(
+    manifest.icons.some((icon) => icon.purpose?.includes('maskable')),
+    'manifest declares no maskable icon',
+  );
+});
+
+test('every declared icon is a square PNG at its declared size', async () => {
+  const manifest = JSON.parse(readFileSync(publicFile(manifestHref), 'utf8'));
+  for (const icon of manifest.icons) {
+    const meta = await sharp(manifestFile(icon.src)).metadata();
+    const [width, height] = icon.sizes.split('x').map(Number);
+    assert.equal(meta.format, 'png', `${icon.src} is not a PNG`);
+    // A size the manifest overstates is worse than a missing one: the platform
+    // trusts the declaration and scales whatever it finds.
+    assert.equal(meta.width, width, `${icon.src} width`);
+    assert.equal(meta.height, height, `${icon.src} height`);
+  }
+});
+
+test('install assets stay inside a non-root Vite base', async (t) => {
+  // The real index.html pulls the whole Cesium app into a build, so only its
+  // install links are copied, verbatim, into a fixture page.
+  const tags = INDEX_HTML.match(
+    /<link[^>]+rel="(?:icon|apple-touch-icon|manifest)"[^>]*>/g,
+  );
+  assert.ok(tags?.length >= 3, 'index.html lost its install links');
+  const root = await makeFixtureRoot('gev-webapp-icons-');
+  t.after(() => rm(root, { recursive: true, force: true }));
+  await writeFile(
+    path.join(root, 'index.html'),
+    `<!doctype html><html><head>${tags.join('')}</head><body></body></html>`,
+  );
+  const base = '/example/';
+  const origin = 'https://host.test';
+  const result = await build({
+    root,
+    configFile: false,
+    envFile: false,
+    logLevel: 'silent',
+    base,
+    publicDir: PUBLIC_ROOT,
+    build: { write: false },
+  });
+  const html = result.output.find(
+    (item) => item.fileName === 'index.html',
+  ).source;
+  const hrefs = [...html.matchAll(/<link[^>]+href="([^"]+)"/g)].map(
+    (match) => match[1],
+  );
+  assert.equal(hrefs.length, tags.length);
+  for (const href of hrefs) {
+    assert.ok(href.startsWith(base), `${href} escapes ${base}`);
+    assert.doesNotThrow(() =>
+      readFileSync(path.join(PUBLIC_ROOT, href.slice(base.length))),
+    );
+  }
+
+  // Vite copies public/ only when it writes, and copies it verbatim, so the
+  // deployed manifest is the committed one, served at the emitted href.
+  const manifestUrl = new URL(
+    html.match(/<link[^>]+rel="manifest"[^>]+href="([^"]+)"/)[1],
+    origin,
+  );
+  const manifest = JSON.parse(readFileSync(publicFile(manifestHref), 'utf8'));
+  const inBase = (value) => {
+    const url = new URL(value, manifestUrl);
+    assert.ok(
+      url.href.startsWith(origin + base),
+      `${value} resolves to ${url.href}, outside ${base}`,
+    );
+    return url;
+  };
+  assert.equal(inBase(manifest.start_url).href, origin + base);
+  assert.equal(inBase(manifest.scope).href, origin + base);
+  for (const icon of manifest.icons) {
+    const url = inBase(icon.src);
+    assert.doesNotThrow(() =>
+      readFileSync(path.join(PUBLIC_ROOT, url.pathname.slice(base.length))),
+    );
+  }
+});