Merge branch 'main' into codex/fix-overpass-request-admission

server/providers/cctv/catalog.js

@@ -5,6 +5,7 @@ import { allocateSourceCap, resolveCatalogCap } from './cap.js';
 import { loadGroundHeights, joinGroundHeights } from './groundHeights.js';
 import { cameraRegion, normalizeSourceItem } from './normalize.js';
 import { loadLithuaniaSources } from './lithuania.js';
+import { loadTaiwanSources } from './taiwan.js';
 import {
   loadAustinSourcesFromOpenData,
   loadCaltransSourcesFromOpenData,
@@ -19,6 +20,7 @@ import {
   loadNswSourcesFromOpenData,
   loadCalgarySourcesFromOpenData,
   loadCataloniaSourcesFromOpenData,
+  loadHkSourcesFromOpenData,
   loadDelDOTSourcesFromOpenData,
   loadKingCountySourcesFromOpenData,
   loadWsdotSourcesFromOpenData,
@@ -106,6 +108,11 @@ const LIVE_PACKS = [
     enabled: () => envEnabled('CCTV_CATALONIA_ENABLED'),
     load: loadCataloniaSourcesFromOpenData,
   },
+  {
+    name: 'hk',
+    enabled: () => envEnabled('CCTV_HK_ENABLED'),
+    load: loadHkSourcesFromOpenData,
+  },
   {
     name: 'deldot',
     enabled: () => envEnabled('CCTV_DELDOT_ENABLED'),
@@ -153,6 +160,11 @@ const LIVE_PACKS = [
     enabled: () => envOptIn('CCTV_FLORIDA_ENABLED'),
     load: loadFloridaSourcesFromOpenData,
   },
+  {
+    name: 'taiwan',
+    enabled: () => envEnabled('CCTV_TAIWAN_ENABLED'),
+    load: loadTaiwanSources,
+  },
 ];
 /**
  * Load CCTV sources from a local JSON file (CCTV_SOURCES_FILE env or default).

server/providers/cctv/constants.js

@@ -140,7 +140,7 @@ export const TFL_IMAGE_ORIGIN =
   'https://s3-eu-west-1.amazonaws.com/jamcams.tfl.gov.uk/';
 export const DEFAULT_TFL_MAX_SOURCES = 250;
 export const LONDON_CENTER = { lat: 51.5074, lon: -0.1278 };
-/** Ontario 511: keyless CARS/511 camera catalog; frame URLs are still images. */
+/** Ontario 511: CARS/511 camera catalog, which needs a developer key (ONTARIO_511_API_KEY); frame URLs are still images. */
 export const ONTARIO_511_CAMERAS_URL =
   'https://511on.ca/api/v2/get/cameras?format=json&lang=en';
 export const ONTARIO_511_IMAGE_ORIGIN = 'https://511on.ca/map/Cctv/';
@@ -309,6 +309,36 @@ export const CATALONIA_ANCHORS = [
   { lat: 41.5636, lon: 2.0111 }, // Terrassa
 ];
 
+/** Hong Kong Transport Department traffic snapshot cameras: keyless English
+ * locations XML on DATA.GOV.HK; frames are stills on the TD CCTV host. */
+export const DEFAULT_HK_CAMERAS_URL =
+  'https://static.data.gov.hk/td/traffic-snapshot-images/code/Traffic_Camera_Locations_En.xml';
+/** The only origin HK camera frames may come from. Verified 2026-10-11: still
+ * URLs answer 200 on this host with no redirect hop. */
+export const HK_IMAGE_ORIGIN = 'https://tdcctv.data.one.gov.hk/';
+/** Above the full TD English catalog (~1,013 cameras) so a default install
+ * keeps nearly all of them. Catalog-wide round-robin still applies when the
+ * sum of packs exceeds DEFAULT_CCTV_MAX_SOURCES (Norway-style). */
+export const DEFAULT_HK_MAX_SOURCES = 1100;
+/** Prioritization anchors across Hong Kong Island, Kowloon and the New
+ * Territories so a lowered cap keeps territory-wide coverage rather than
+ * only the harbour corridor. */
+export const HK_ANCHORS = [
+  { lat: 22.2819, lon: 114.158 }, // Central
+  { lat: 22.2976, lon: 114.1722 }, // Tsim Sha Tsui
+  { lat: 22.3827, lon: 114.19 }, // Sha Tin
+  { lat: 22.3701, lon: 114.114 }, // Tsuen Wan
+  { lat: 22.4503, lon: 114.1688 }, // Tai Po
+  { lat: 22.493, lon: 114.139 }, // Fanling
+  { lat: 22.391, lon: 113.977 }, // Tuen Mun
+  { lat: 22.4445, lon: 114.022 }, // Yuen Long
+  { lat: 22.307, lon: 114.26 }, // Tseung Kwan O
+];
+/** Hard ceiling on the locations XML body. The live English list is ~400 KB
+ * for ~1,000 cameras; this only exists so an unbounded upstream cannot be
+ * buffered without limit. */
+export const HK_MAX_CATALOG_BYTES = 4 * 1024 * 1024;
+
 /** Statens vegvesen (Norway) road cameras: the keyless OGC API Features view
  * of the official DATEX 3.1 CCTV site table, one GeoJSON request for the whole
  * country (~900 cameras). The raw DATEX node needs an account; this view does

server/providers/cctv/normalize.js

@@ -399,6 +399,17 @@ export function isLikelyNycCoordinate(lat, lon) {
   );
 }
 
+/** Hong Kong SAR extent, with slack for the outlying islands. */
+export function isLikelyHongKongCoordinate(lat, lon) {
+  return (
+    isPlausibleLatLon(lat, lon) &&
+    lat >= 22.15 &&
+    lat <= 22.6 &&
+    lon >= 113.8 &&
+    lon <= 114.45
+  );
+}
+
 /** Mainland Norway, with slack for the coast and the Finnmark border. */
 export function isLikelyNorwayCoordinate(lat, lon) {
   return (

server/providers/cctv/ontario511.test.mjs

@@ -0,0 +1,129 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  _resetOntarioKeyWarningForTest,
+  loadOntarioSourcesFromOpenData,
+} from './sources.js';
+
+const ROW = {
+  Id: '42',
+  Latitude: 43.6532,
+  Longitude: -79.3832,
+  Location: 'Hwy 401 near Yonge St',
+  Direction: 'Eastbound',
+  Views: [
+    {
+      Status: 'Enabled',
+      Url: 'https://511on.ca/map/Cctv/4201',
+      Description: 'Eastbound',
+    },
+  ],
+};
+
+function captureConsole(t) {
+  const lines = [];
+  const capture = (...args) => lines.push(args.join(' '));
+  t.mock.method(console, 'warn', capture);
+  t.mock.method(console, 'log', capture);
+  return lines;
+}
+
+test.beforeEach(() => _resetOntarioKeyWarningForTest());
+
+test('without ONTARIO_511_API_KEY the Ontario pack is skipped, logged once', async (t) => {
+  const lines = captureConsole(t);
+  let fetches = 0;
+  t.mock.method(globalThis, 'fetch', async () => {
+    fetches += 1;
+    return Response.json([ROW]);
+  });
+  assert.deepEqual(await loadOntarioSourcesFromOpenData({}, {}), []);
+  assert.deepEqual(
+    await loadOntarioSourcesFromOpenData({}, { ONTARIO_511_API_KEY: '   ' }),
+    [],
+  );
+  assert.equal(fetches, 0);
+  assert.equal(lines.length, 1);
+  assert.match(lines[0], /ONTARIO_511_API_KEY/);
+});
+
+test('with a key the camera list is requested with it and parsed', async (t) => {
+  const lines = captureConsole(t);
+  const requested = [];
+  t.mock.method(globalThis, 'fetch', async (url) => {
+    requested.push(String(url));
+    return Response.json([ROW]);
+  });
+  const cameras = await loadOntarioSourcesFromOpenData(
+    { sourceRoot: '/ignored' },
+    { ONTARIO_511_API_KEY: ' test-key ' },
+  );
+  assert.equal(requested.length, 1);
+  const url = new URL(requested[0]);
+  assert.equal(url.host, '511on.ca');
+  assert.equal(url.searchParams.get('key'), 'test-key');
+  assert.equal(url.searchParams.get('format'), 'json');
+  assert.equal(cameras.length, 1);
+  assert.equal(cameras[0].id, 'on-42');
+  assert.equal(cameras[0].url, 'https://511on.ca/map/Cctv/4201');
+  // The records go to the browser through /api/cctv; the key must stay on
+  // the server-side catalog request.
+  assert.doesNotMatch(JSON.stringify(cameras), /test-key/);
+  assert.doesNotMatch(lines.join('\n'), /test-key/);
+});
+
+test('the source cap is read from the same environment as the key', async (t) => {
+  captureConsole(t);
+  const rows = Array.from({ length: 12 }, (_, i) => ({
+    ...ROW,
+    Id: String(100 + i),
+    Latitude: ROW.Latitude + i * 0.01,
+    Views: [{ ...ROW.Views[0], Url: `https://511on.ca/map/Cctv/${100 + i}` }],
+  }));
+  t.mock.method(globalThis, 'fetch', async () => Response.json(rows));
+  const cameras = await loadOntarioSourcesFromOpenData(
+    {},
+    { ONTARIO_511_API_KEY: 'test-key', CCTV_ONTARIO_MAX_SOURCES: '8' },
+  );
+  assert.equal(cameras.length, 8);
+});
+
+for (const status of [400, 401, 403]) {
+  test(`a ${status} points at the key by name, never by value`, async (t) => {
+    const lines = captureConsole(t);
+    t.mock.method(globalThis, 'fetch', async () =>
+      Response.json({ Message: 'Invalid Key' }, { status }),
+    );
+    const cameras = await loadOntarioSourcesFromOpenData(
+      {},
+      { ONTARIO_511_API_KEY: 'secret-key-value' },
+    );
+    assert.deepEqual(cameras, []);
+    assert.match(
+      lines.join('\n'),
+      new RegExp(`failed: ${status} \\(check ONTARIO_511_API_KEY\\)`),
+    );
+    assert.doesNotMatch(lines.join('\n'), /secret-key-value/);
+  });
+}
+
+for (const status of [429, 500, 503]) {
+  test(`a ${status} is reported without blaming the key`, async (t) => {
+    const lines = captureConsole(t);
+    t.mock.method(globalThis, 'fetch', async () =>
+      Response.json({}, { status }),
+    );
+    const cameras = await loadOntarioSourcesFromOpenData(
+      {},
+      { ONTARIO_511_API_KEY: 'secret-key-value' },
+    );
+    assert.deepEqual(cameras, []);
+    assert.equal(lines.length, 1);
+    assert.equal(
+      lines[0],
+      `[CCTV] Ontario 511 camera download failed: ${status}`,
+    );
+    assert.doesNotMatch(lines[0], /secret-key-value/);
+  });
+}

server/providers/cctv/sources.js

@@ -76,6 +76,11 @@ import {
   TORONTO_DOWNTOWN,
   TORONTO_GROUND_ELEVATION_M,
   TORONTO_MAX_CATALOG_BYTES,
+  DEFAULT_HK_CAMERAS_URL,
+  HK_IMAGE_ORIGIN,
+  DEFAULT_HK_MAX_SOURCES,
+  HK_ANCHORS,
+  HK_MAX_CATALOG_BYTES,
   CCTV_SOURCE_FETCH_TIMEOUT_MS,
   TARKTEE_FETCH_TIMEOUT_MS,
   DELDOT_CCTV_URL,
@@ -138,6 +143,7 @@ import {
   isLikelyCataloniaCoordinate,
   decodeNumericEntities,
   isLikelyNycCoordinate,
+  isLikelyHongKongCoordinate,
   isLikelyNorwayCoordinate,
   isLikelyTorontoCoordinate,
   cameraDisplayCode,
@@ -524,22 +530,56 @@ function pickOntarioCctvView(views) {
   );
 }
 
+let ontarioKeyMissingLogged = false;
+
+/** Test seam: let the next keyless call log the missing-key line again. */
+export function _resetOntarioKeyWarningForTest() {
+  ontarioKeyMissingLogged = false;
+}
+
 /**
- * Fetch Ontario 511 CCTV cameras. Keyless: the catalog is exposed by the
- * public 511 API, while frame URLs are stable still-image endpoints under
- * 511on.ca/map/Cctv/. Only rows with finite Ontario coords and at least one
- * enabled official still view are kept.
+ * Fetch Ontario 511 CCTV cameras. The camera list comes from the 511 API,
+ * which now requires a free developer key (511on.ca/developers/doc, "Requires a
+ * developer key"; unkeyed calls answer 400 "Invalid Key"), read from
+ * ONTARIO_511_API_KEY. Without one the pack is skipped with a single log line.
+ * Frame URLs are stable still-image endpoints under 511on.ca/map/Cctv/. Only
+ * rows with finite Ontario coords and at least one enabled official still
+ * view are kept.
  *
+ * @param {object} [_options] The catalog's loader options (unused).
+ * @param {object} [env] Environment to read the key and the source cap from.
  * @returns {Promise<Array<object>>} Normalized camera source objects.
  */
-export async function loadOntarioSourcesFromOpenData() {
+export async function loadOntarioSourcesFromOpenData(
+  _options = {},
+  env = process.env,
+) {
+  const key = String(env.ONTARIO_511_API_KEY ?? '').trim();
+  if (!key) {
+    if (!ontarioKeyMissingLogged) {
+      ontarioKeyMissingLogged = true;
+      console.warn(
+        '[CCTV] Ontario 511 cameras skipped: the 511on.ca API needs a free developer key (set ONTARIO_511_API_KEY)',
+      );
+    }
+    return [];
+  }
   try {
-    const resp = await fetch(ONTARIO_511_CAMERAS_URL, {
+    const url = new URL(ONTARIO_511_CAMERAS_URL);
+    url.searchParams.set('key', key);
+    const resp = await fetch(url, {
       headers: { Accept: 'application/json' },
       signal: AbortSignal.timeout(CCTV_SOURCE_FETCH_TIMEOUT_MS),
     });
     if (!resp.ok) {
-      console.warn('[CCTV] Ontario 511 camera download failed:', resp.status);
+      // The API answers 400 "Invalid Key" to a wrong or revoked key.
+      const keyHint =
+        resp.status === 400 || resp.status === 401 || resp.status === 403
+          ? ' (check ONTARIO_511_API_KEY)'
+          : '';
+      console.warn(
+        `[CCTV] Ontario 511 camera download failed: ${resp.status}${keyHint}`,
+      );
       return [];
     }
     const rows = await resp.json();
@@ -602,7 +642,7 @@ export async function loadOntarioSourcesFromOpenData() {
       new Map(cameras.map((camera) => [camera.id, camera])).values(),
     );
     const maxRaw = Number(
-      process.env.CCTV_ONTARIO_MAX_SOURCES || DEFAULT_ONTARIO_MAX_SOURCES,
+      env.CCTV_ONTARIO_MAX_SOURCES || DEFAULT_ONTARIO_MAX_SOURCES,
     );
     const maxCount = Number.isFinite(maxRaw)
       ? Math.max(8, Math.min(1000, Math.floor(maxRaw)))
@@ -1969,6 +2009,226 @@ export async function loadCataloniaSourcesFromOpenData() {
   }
 }
 
+/**
+ * Read one XML child tag's text from an `<image>` block.
+ *
+ * @param {string} body
+ * @param {string} tag
+ * @returns {string}
+ */
+function hkXmlTag(body, tag) {
+  const match = new RegExp(`<${tag}>\\s*([^<]*?)\\s*</${tag}>`, 'i').exec(
+    String(body || ''),
+  );
+  return match ? match[1].trim() : '';
+}
+
+/**
+ * Parse the Transport Department English camera-locations XML into rows.
+ *
+ * Schema-specific: each `<image>` carries key, description, lat/lon and a
+ * still URL. No XML dependency — same regex style as the Tarktee DATEX parser.
+ *
+ * @param {string} xml
+ * @returns {Array<object>}
+ */
+export function parseHkCameraLocationsXml(xml) {
+  const rows = [];
+  const blockRe = /<image>([\s\S]*?)<\/image>/gi;
+  let match;
+  while ((match = blockRe.exec(String(xml || ''))) !== null) {
+    const body = match[1];
+    rows.push({
+      key: hkXmlTag(body, 'key'),
+      region: hkXmlTag(body, 'region'),
+      district: hkXmlTag(body, 'district'),
+      description: hkXmlTag(body, 'description'),
+      latitude: hkXmlTag(body, 'latitude'),
+      longitude: hkXmlTag(body, 'longitude'),
+      url: hkXmlTag(body, 'url'),
+    });
+  }
+  return rows;
+}
+
+/**
+ * Build a host-pinned still URL from a Transport Department camera key.
+ *
+ * The catalog also publishes a URL; the registered frame is always rebuilt
+ * from the key so a catalog edit cannot steer the proxy off-origin.
+ *
+ * @param {string|null|undefined} key
+ * @returns {?string}
+ */
+export function hkImageUrlFromKey(key) {
+  const id = String(key ?? '')
+    .trim()
+    .toUpperCase();
+  if (!/^[A-Z0-9]{1,32}$/.test(id)) return null;
+  return `${HK_IMAGE_ORIGIN}${id}.JPG`;
+}
+
+/**
+ * Pin a catalog frame URL to the Transport Department still host.
+ *
+ * @param {string|null|undefined} raw
+ * @returns {?string}
+ */
+export function normalizeHkImageUrl(raw) {
+  const text = String(raw ?? '').trim();
+  if (!text) return null;
+  let parsed;
+  try {
+    parsed = new URL(text);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return null;
+  parsed.protocol = 'https:';
+  const upgraded = parsed.toString();
+  return upgraded.startsWith(HK_IMAGE_ORIGIN) ? upgraded : null;
+}
+
+/**
+ * Label for one HK camera: the published English description, else the key.
+ *
+ * @param {object} record
+ * @param {string} cameraId
+ * @returns {string}
+ */
+export function hkCameraName(record, cameraId) {
+  const description = String(record?.description ?? '').trim();
+  if (description) return description;
+  const key = String(record?.key ?? '').trim();
+  if (key) return key;
+  return `HK Camera ${String(cameraId).replace(/^hk-/, '')}`;
+}
+
+/**
+ * One Transport Department locations row -> one catalog source, or null.
+ *
+ * The dataset publishes no camera facing, so headings use the shared id-hash
+ * fallback at low confidence and are corrected with the calibration gizmo.
+ *
+ * @param {object} record
+ * @returns {?object}
+ */
+export function hkCameraToSource(record) {
+  if (!record || typeof record !== 'object') return null;
+  const key = String(record.key ?? '')
+    .trim()
+    .toUpperCase();
+  if (!key) return null;
+  const lat = toFiniteNumber(record.latitude);
+  const lon = toFiniteNumber(record.longitude);
+  if (!isLikelyHongKongCoordinate(lat, lon)) return null;
+
+  const imageUrl = hkImageUrlFromKey(key);
+  if (!imageUrl) return null;
+  // If the catalog carries a URL, it must already be on the pinned host.
+  const catalogUrl = String(record.url ?? '').trim();
+  if (catalogUrl) {
+    const pinnedCatalog = normalizeHkImageUrl(catalogUrl);
+    if (!pinnedCatalog) return null;
+  }
+
+  const cameraId = `hk-${key.toLowerCase()}`;
+  const name = hkCameraName(record, cameraId);
+  const region = String(record.region ?? '').trim();
+
+  return {
+    id: cameraId,
+    name,
+    city: region || 'Hong Kong',
+    cityId: 'hk',
+    provider: 'Transport Department',
+    lat,
+    lon,
+    headingDeg: fallbackHeadingFromId(cameraId),
+    headingConfidence: 'low',
+    pitchDeg: -18,
+    fovDeg: 44,
+    rangeM: 145,
+    mountHeightM: 8,
+    // Coastal / harbour prior; the client's one-shot ground snap corrects.
+    groundElevationM: 15,
+    feedType: 'image',
+    url: imageUrl,
+    snapshotUrl: imageUrl,
+    sourceKind: 'hk-td-open-data',
+    license:
+      'Hong Kong Transport Department / DATA.GOV.HK — attribution required',
+    code: cameraDisplayCode(name.toUpperCase()),
+  };
+}
+
+/**
+ * Fetch Hong Kong Transport Department traffic snapshot cameras from the
+ * keyless DATA.GOV.HK English locations XML. Frames are stills on
+ * tdcctv.data.one.gov.hk.
+ *
+ * @returns {Promise<Array<object>>} Normalized camera source objects.
+ */
+export async function loadHkSourcesFromOpenData() {
+  try {
+    const endpoint = process.env.CCTV_HK_CAMERAS_URL || DEFAULT_HK_CAMERAS_URL;
+    const resp = await fetch(endpoint, {
+      headers: { Accept: 'application/xml,text/xml,*/*' },
+      redirect: 'manual',
+      signal: AbortSignal.timeout(CCTV_SOURCE_FETCH_TIMEOUT_MS),
+    });
+    const discard = async () => {
+      try {
+        await resp.body?.cancel();
+      } catch {
+        /* no-op */
+      }
+      return [];
+    };
+    if (resp.status >= 300 && resp.status < 400) {
+      console.warn('[CCTV] HK catalog redirected; redirects are not followed');
+      return discard();
+    }
+    if (!resp.ok) {
+      console.warn('[CCTV] HK camera download failed:', resp.status);
+      return discard();
+    }
+    let xml;
+    try {
+      xml = await readResponseTextCapped(resp, HK_MAX_CATALOG_BYTES);
+    } catch (error) {
+      if (error?.code === 'RESPONSE_TOO_LARGE') {
+        console.warn('[CCTV] HK catalog body exceeded byte ceiling');
+        return [];
+      }
+      throw error;
+    }
+    const rows = parseHkCameraLocationsXml(xml);
+    const cameras = [];
+    const seen = new Set();
+    for (const record of rows) {
+      const camera = hkCameraToSource(record);
+      if (!camera || seen.has(camera.id)) continue;
+      seen.add(camera.id);
+      cameras.push(camera);
+    }
+    const maxRaw = Number(
+      process.env.CCTV_HK_MAX_SOURCES || DEFAULT_HK_MAX_SOURCES,
+    );
+    const maxCount = Number.isFinite(maxRaw)
+      ? Math.max(8, Math.min(1200, Math.floor(maxRaw)))
+      : DEFAULT_HK_MAX_SOURCES;
+    const prioritized = prioritizeSources(cameras, maxCount, HK_ANCHORS);
+    console.log(
+      `[CCTV] Loaded HK camera sources: ${cameras.length} (using nearest ${prioritized.length})`,
+    );
+    return prioritized;
+  } catch (error) {
+    console.warn('[CCTV] HK camera download error:', error?.message || error);
+    return [];
+  }
+}
+
 export async function loadDelDOTSourcesFromOpenData() {
   try {
     const resp = await fetch(DELDOT_CCTV_URL, {

server/providers/cctv/taiwan.js

@@ -0,0 +1,303 @@
+import { CCTV_SOURCE_FETCH_TIMEOUT_MS } from './constants.js';
+import {
+  cameraDisplayCode,
+  fallbackHeadingFromId,
+  prioritizeSources,
+} from './normalize.js';
+import { readResponseTextCapped } from '../common/http.js';
+
+/** Freeway Bureau (MOTC) CCTV static table in the national MOTC 2.0 XML
+ * standard, published keyless and refreshed daily (~1,800 cameras). */
+export const TAIWAN_FREEWAY_CCTV_URL =
+  'https://tisvcloud.freeway.gov.tw/history/motc20/CCTV.xml';
+/** The whole network is ~1.2 MB. */
+export const TAIWAN_MAX_CATALOG_BYTES = 6 * 1024 * 1024;
+export const DEFAULT_TAIWAN_MAX_SOURCES = 600;
+/** After a failed download, wait this long before asking again. The catalog
+ * host does not answer from some networks outside Taiwan, and every attempt
+ * there holds the shared catalog refresh until the connect timeout. */
+export const TAIWAN_RETRY_AFTER_FAILURE_MS = 60 * 60 * 1000;
+/** The table is republished daily; a good copy stands in for a failed
+ * download for up to this long. */
+export const TAIWAN_LAST_GOOD_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+
+// The table publishes each camera's MJPEG stream. The same camera servers
+// answer a single JPEG for the same camera ID on a sibling path, which is what
+// the frame proxy can relay; only these exact pairs are ever registered.
+const STREAM_TO_FRAME = new Map([
+  ['cctvn.freeway.gov.tw', ['/abs2mjpg/bmjpg', '/abs2mjpg/jpg']],
+  ['cctvn5.freeway.gov.tw', ['/abs2mjpg/bmjpg', '/abs2mjpg/jpg']],
+  ['cctvc.freeway.gov.tw', ['/abs2mjpg/bmjpg', '/abs2mjpg/jpg']],
+  [
+    'cctvs.freeway.gov.tw',
+    ['/live-view/mjpg/video.cgi', '/live-view/jpg/image.cgi'],
+  ],
+]);
+
+const DIRECTIONS = { N: 'N', S: 'S', E: 'E', W: 'W' };
+
+/** Prioritization anchors, north to south, so a cap keeps the whole island
+ * rather than only greater Taipei. */
+const ANCHORS = [
+  { lat: 25.033, lon: 121.5654 }, // Taipei
+  { lat: 24.9936, lon: 121.301 }, // Taoyuan
+  { lat: 24.8138, lon: 120.9675 }, // Hsinchu
+  { lat: 24.7021, lon: 121.7378 }, // Yilan
+  { lat: 24.1477, lon: 120.6736 }, // Taichung
+  { lat: 22.9999, lon: 120.227 }, // Tainan
+  { lat: 22.6273, lon: 120.3014 }, // Kaohsiung
+];
+
+/** Taiwan main island with slack for the coast; the freeway network has no
+ * offshore-island cameras. */
+export function isLikelyTaiwanCoordinate(lat, lon) {
+  return (
+    Number.isFinite(lat) &&
+    Number.isFinite(lon) &&
+    lat >= 21.8 &&
+    lat <= 25.4 &&
+    lon >= 119.9 &&
+    lon <= 122.1
+  );
+}
+
+const XML_ENTITIES = {
+  amp: '&',
+  lt: '<',
+  gt: '>',
+  quot: '"',
+  apos: "'",
+};
+
+function codePoint(value, radix) {
+  const code = parseInt(value, radix);
+  return Number.isInteger(code) && code > 0 && code <= 0x10ffff
+    ? String.fromCodePoint(code)
+    : '';
+}
+
+function decodeXml(text) {
+  return String(text ?? '')
+    .replace(
+      /&(?:(amp|lt|gt|quot|apos)|#(\d{1,7})|#x([0-9a-fA-F]{1,6}));/g,
+      (_, name, dec, hex) =>
+        name ? XML_ENTITIES[name] : codePoint(dec ?? hex, dec ? 10 : 16),
+    )
+    .trim();
+}
+
+function tag(block, name) {
+  const match = new RegExp(`<${name}>([^<]*)</${name}>`).exec(block);
+  return match ? decodeXml(match[1]) : '';
+}
+
+/**
+ * Parse the MOTC 2.0 `CCTVList` document into flat rows. Regex-based like the
+ * Catalonia and Tarktee parsers: the schema is flat, and only the fields used
+ * below are read.
+ *
+ * @param {string} xml
+ * @returns {Array<object>}
+ */
+export function parseTaiwanCctvXml(xml) {
+  const rows = [];
+  const blockRe = /<CCTV>([\s\S]*?)<\/CCTV>/g;
+  let match;
+  while ((match = blockRe.exec(String(xml || ''))) !== null) {
+    const block = match[1];
+    rows.push({
+      cctvId: tag(block, 'CCTVID'),
+      streamUrl: tag(block, 'VideoStreamURL'),
+      lat: Number(tag(block, 'PositionLat')),
+      lon: Number(tag(block, 'PositionLon')),
+      roadName: tag(block, 'RoadName'),
+      direction: tag(block, 'RoadDirection'),
+      sectionStart: tag(block, 'Start'),
+      sectionEnd: tag(block, 'End'),
+      mile: tag(block, 'LocationMile'),
+    });
+  }
+  return rows;
+}
+
+/**
+ * Published MJPEG stream URL -> the same camera's still, plus the host and
+ * camera number that identify it, or null.
+ *
+ * @param {string} streamUrl
+ * @returns {?{frameUrl: string, host: string, camera: string}}
+ */
+export function taiwanFrame(streamUrl) {
+  let url;
+  try {
+    url = new URL(String(streamUrl ?? ''));
+  } catch {
+    return null;
+  }
+  if (url.protocol !== 'https:' || url.username || url.password || url.port)
+    return null;
+  const paths = STREAM_TO_FRAME.get(url.hostname);
+  if (!paths || url.pathname !== paths[0]) return null;
+  const camera = url.searchParams.get('camera') || '';
+  if (!/^[A-Za-z0-9-]{1,40}$/.test(camera)) return null;
+  return {
+    // Reconstruct so extra query parameters cannot alter the request.
+    frameUrl: `https://${url.hostname}${paths[1]}?camera=${camera}`,
+    host: url.hostname.split('.')[0],
+    camera,
+  };
+}
+
+/**
+ * One parsed Freeway Bureau row -> one catalog source, or null.
+ *
+ * @param {object} row - Output of parseTaiwanCctvXml.
+ * @returns {?object}
+ */
+export function taiwanCameraToSource(row) {
+  if (!row || typeof row !== 'object') return null;
+  const { lat, lon } = row;
+  if (!isLikelyTaiwanCoordinate(lat, lon)) return null;
+  const frame = taiwanFrame(row.streamUrl);
+  if (!frame) return null;
+  const imageUrl = frame.frameUrl;
+  // CCTVID carries Chinese place names and a few IDs repeat across distinct
+  // cameras, so the stable key is the camera server plus its camera number.
+  const rawId = String(row.cctvId ?? '')
+    .trim()
+    .slice(0, 80);
+  const cameraId = `tw-freeway-${frame.host}-${frame.camera.toLowerCase()}`;
+  const road = String(row.roadName ?? '').trim();
+  const direction = DIRECTIONS[String(row.direction ?? '').trim()] || '';
+  const mile = String(row.mile ?? '').trim();
+  const section = [row.sectionStart, row.sectionEnd]
+    .map((part) => String(part ?? '').trim())
+    .filter(Boolean)
+    .join('→');
+  // A bare carriageway letter is not a name; fall back to the published ID.
+  const name =
+    (road || mile || section
+      ? [road, direction, mile, section].filter(Boolean).join(' ')
+      : '') ||
+    rawId ||
+    `Freeway camera ${frame.camera}`;
+
+  return {
+    id: cameraId,
+    name: name.slice(0, 160),
+    // One island-wide category in the camera picker, like Finland and Norway.
+    city: 'Taiwan / 臺灣',
+    cityId: 'taiwan',
+    provider: 'Freeway Bureau, MOTC',
+    lat,
+    lon,
+    // The table gives the carriageway direction, not the camera's bearing,
+    // so the pose uses the shared low-confidence prior.
+    headingDeg: fallbackHeadingFromId(cameraId),
+    headingConfidence: 'low',
+    pitchDeg: -18,
+    fovDeg: 44,
+    rangeM: 145,
+    mountHeightM: 8,
+    feedType: 'image',
+    url: imageUrl,
+    snapshotUrl: imageUrl,
+    sourceKind: 'tw-freeway-motc',
+    license:
+      'Freeway Bureau, MOTC open data, Open Government Data License, Taiwan (Version 1.0)',
+    code: cameraDisplayCode(
+      `${road} ${mile}`.trim().toUpperCase() || frame.camera,
+    ),
+  };
+}
+
+let lastGood = null;
+let lastGoodAt = 0;
+let retryAfter = 0;
+
+/** Forget the last good table and any failure backoff (tests only). */
+export function resetTaiwanSourcesCache() {
+  lastGood = null;
+  lastGoodAt = 0;
+  retryAfter = 0;
+}
+
+function fallbackSources() {
+  return lastGood && Date.now() - lastGoodAt <= TAIWAN_LAST_GOOD_MAX_AGE_MS
+    ? lastGood
+    : [];
+}
+
+function taiwanSourceCap() {
+  const rawCap = Number(
+    process.env.CCTV_TAIWAN_MAX_SOURCES || DEFAULT_TAIWAN_MAX_SOURCES,
+  );
+  return Number.isFinite(rawCap)
+    ? Math.max(1, Math.min(2000, Math.floor(rawCap)))
+    : DEFAULT_TAIWAN_MAX_SOURCES;
+}
+
+/**
+ * Fetch Taiwan Freeway Bureau cameras from the keyless MOTC 2.0 XML table.
+ * One bounded request per shared catalog refresh. A failed download serves the
+ * last good table (up to a day old) and is not retried for an hour, so a host
+ * that cannot reach the Freeway Bureau does not wait on it every refresh.
+ *
+ * @returns {Promise<Array<object>>}
+ */
+export async function loadTaiwanSources() {
+  if (Date.now() < retryAfter) return fallbackSources();
+  try {
+    const signal = AbortSignal.timeout(CCTV_SOURCE_FETCH_TIMEOUT_MS);
+    const response = await fetch(
+      process.env.CCTV_TAIWAN_URL || TAIWAN_FREEWAY_CCTV_URL,
+      {
+        headers: { Accept: 'application/xml,text/xml' },
+        redirect: 'manual',
+        signal,
+      },
+    );
+    if (!response.ok) {
+      await response.body?.cancel().catch(() => {});
+      throw new Error(
+        response.status >= 300 && response.status < 400
+          ? 'catalog redirected; redirects are not followed'
+          : `HTTP ${response.status}`,
+      );
+    }
+    const xml = await readResponseTextCapped(
+      response,
+      TAIWAN_MAX_CATALOG_BYTES,
+      signal,
+    );
+    const cameras = new Map();
+    for (const row of parseTaiwanCctvXml(xml)) {
+      const camera = taiwanCameraToSource(row);
+      if (camera && !cameras.has(camera.id)) cameras.set(camera.id, camera);
+    }
+    if (!cameras.size) throw new Error('no usable cameras in the table');
+    const sources = prioritizeSources(
+      [...cameras.values()],
+      taiwanSourceCap(),
+      ANCHORS,
+    );
+    console.log(
+      `[CCTV] Loaded Taiwan camera sources: ${cameras.size} (using ${sources.length})`,
+    );
+    lastGood = sources;
+    lastGoodAt = Date.now();
+    retryAfter = 0;
+    return sources;
+  } catch (error) {
+    retryAfter = Date.now() + TAIWAN_RETRY_AFTER_FAILURE_MS;
+    const fallback = fallbackSources();
+    console.warn(
+      `[CCTV] Taiwan camera download failed (${error?.message || error}); ` +
+        (fallback.length
+          ? `serving the last good ${fallback.length} cameras`
+          : 'no Taiwan cameras') +
+        ', next attempt in 1 h',
+    );
+    return fallback;
+  }
+}

server/providers/mapillary.js

@@ -1,19 +1,106 @@
-import { installMapillaryRoutes } from './mapillary/routes.js';
+import { sameSiteGated } from './common/same-site.js';
+import { makeRateLimiter, clientKey } from './common/rate-limit.js';
+import {
+  fetchTile,
+  mapillaryToken,
+  parseTilePath,
+  retryAfterWait,
+  TileUpstreamError,
+} from './mapillary/tiles.js';
 
 /**
- * Vite plugin: cached Mapillary coverage tiles (token added server-side) and a
- * status route that says whether a token is configured.
+ * Tile requests per client IP per minute, cache hits included: over 60 new
+ * 9-tile views a minute, more than a person flying the camera reaches.
  */
-function mapillaryProxy() {
-  return {
-    name: 'mapillary-proxy',
-    configureServer(server) {
-      installMapillaryRoutes(server.middlewares);
-    },
-    configurePreviewServer(server) {
-      installMapillaryRoutes(server.middlewares);
-    },
-  };
+export const TILE_ROUTE_MAX_PER_MIN = 600;
+
+function sendJson(res, status, payload) {
+  res.statusCode = status;
+  res.setHeader('Content-Type', 'application/json; charset=utf-8');
+  res.setHeader('Cache-Control', 'no-store');
+  res.end(JSON.stringify(payload));
 }
 
-export { mapillaryProxy };
+/** GET /api/mapillary/status — whether a token is configured, never its value. */
+function handleStatus(req, res) {
+  if (req.method !== 'GET')
+    return sendJson(res, 405, { error: 'Method not allowed' });
+  sendJson(res, 200, { configured: Boolean(mapillaryToken()) });
+}
+
+/** GET /api/mapillary/tiles/coverage/{z}/{x}/{y} — trimmed protobuf tile. */
+async function handleTile(req, res, allow) {
+  if (req.method !== 'GET')
+    return sendJson(res, 405, { error: 'Method not allowed' });
+  if (!allow(clientKey(req))) {
+    res.setHeader('Retry-After', '5');
+    return sendJson(res, 429, {
+      error: 'Too many tile requests',
+      retryAfter: 5,
+    });
+  }
+  const address = parseTilePath((req.url || '').split('?')[0]);
+  if (!address)
+    return sendJson(res, 400, {
+      error: 'Tile path must be /coverage/{z}/{x}/{y} with z 11–14',
+    });
+  if (!mapillaryToken())
+    return sendJson(res, 503, { error: 'no_key', keyRequired: true });
+  // A client that leaves (a tile the camera moved past) cancels its fetch.
+  const left = new AbortController();
+  res.on?.('close', () => {
+    if (!res.writableEnded) left.abort();
+  });
+  try {
+    const { bytes, source } = await fetchTile(address, { signal: left.signal });
+    res.statusCode = bytes.length ? 200 : 204;
+    res.setHeader('Content-Type', 'application/x-protobuf');
+    res.setHeader('Cache-Control', 'public, max-age=3600');
+    res.setHeader('X-Gev-Cache', source);
+    res.end(bytes.length ? bytes : undefined);
+  } catch (error) {
+    if (left.signal.aborted) return;
+    const status = error instanceof TileUpstreamError ? error.status : 0;
+    // A rejected token is a key problem the panel can name, not a fault.
+    if (status === 401 || status === 403)
+      return sendJson(res, 403, {
+        error: 'Mapillary rejected the access token',
+        keyRejected: true,
+      });
+    if (status === 429) {
+      const retryAfter = retryAfterWait(error.retryAfter);
+      res.setHeader('Retry-After', String(retryAfter));
+      return sendJson(res, 429, {
+        error: 'Mapillary is rate-limiting tile requests',
+        retryAfter,
+      });
+    }
+    // An upstream 400 must not read as a malformed request to this proxy.
+    sendJson(res, 502, { error: error?.message || 'Tile fetch failed' });
+  }
+}
+
+/**
+ * Vite plugin: Mapillary coverage tiles with the token added server-side, and
+ * a status route. Both refuse cross-site requests so another page cannot
+ * spend the token.
+ */
+export function mapillaryProxy() {
+  const install = (middlewares) => {
+    const allow = makeRateLimiter({
+      windowMs: 60_000,
+      max: TILE_ROUTE_MAX_PER_MIN,
+      globalMax: TILE_ROUTE_MAX_PER_MIN * 4,
+    });
+    middlewares.use('/api/mapillary/status', sameSiteGated(handleStatus));
+    middlewares.use(
+      '/api/mapillary/tiles',
+      sameSiteGated((req, res) => handleTile(req, res, allow)),
+    );
+  };
+  return {
+    name: 'mapillary-proxy',
+    configureServer: (server) => install(server.middlewares),
+    configurePreviewServer: (server) => install(server.middlewares),
+  };
+}

server/providers/mapillary/constants.js

@@ -1,72 +0,0 @@
-import path from 'node:path';
-
-/** Mapillary vector tile root; the path template is /{layer}/2/{z}/{x}/{y}. */
-export const MAPILLARY_TILE_HOST = 'https://tiles.mapillary.com/maps/vtp';
-
-/** Public tile layer names this proxy exposes, mapped to Mapillary's ids. */
-export const TILE_LAYERS = Object.freeze({
-  // Region-sized z6–10 tiles are refused; the app never asks for them. The
-  // z14 `image` layer is ~98% of a tile and unused (positions come from the
-  // graph API), so it is dropped in transit.
-  coverage: Object.freeze({
-    upstream: 'mly1_public',
-    zoomRanges: Object.freeze([Object.freeze([0, 5]), Object.freeze([11, 14])]),
-    dropLayers: Object.freeze(['image']),
-  }),
-});
-
-/** Disk cache root, alongside the other providers' caches. */
-export const MAPILLARY_CACHE_DIR = path.join(
-  process.cwd(),
-  '.gev-cache',
-  'mapillary',
-);
-export const TILE_DISK_DIR = path.join(MAPILLARY_CACHE_DIR, 'tiles');
-
-/**
- * Longer than the 15-minute upstream Cache-Control: tiles change only when new
- * imagery is processed, and a day avoids re-downloading a city per camera move.
- */
-export const TILE_DISK_TTL_MS = 24 * 60 * 60 * 1000;
-
-/**
- * A tile write starts a background sweep at most this often: expired files go
- * first, then the oldest until the cache fits in TILE_DISK_MAX_BYTES.
- */
-export const TILE_DISK_SWEEP_INTERVAL_MS = 15 * 60 * 1000;
-export const TILE_DISK_MAX_BYTES = 1024 * 1024 * 1024;
-/** Per-file cost on top of its size, so empty tiles still count. */
-export const TILE_DISK_FILE_OVERHEAD_BYTES = 4096;
-
-/** A z14 image tile over a dense city is ~11 MB; anything past this is wrong. */
-export const TILE_MAX_BYTES = 48 * 1024 * 1024;
-
-export const TILE_MEMORY_BUDGET_BYTES = 96 * 1024 * 1024;
-/** Per-entry cost on top of its bytes, so empty tiles still count. */
-export const TILE_MEMORY_ENTRY_OVERHEAD_BYTES = 1024;
-export const TILE_FETCH_TIMEOUT_MS = 60_000;
-/**
- * Upstream fetches at once; further misses queue. A view needs at most 25
- * tiles, and the cap stops a burst of misses opening thousands of requests.
- */
-export const TILE_UPSTREAM_CONCURRENCY = 6;
-/**
- * Tile requests per client IP per minute, cache hits included. 600 is 24 new
- * 25-tile views a minute, more than a person flying the camera reaches, but it
- * stops one page draining the shared token into a Mapillary rate limit.
- */
-export const TILE_ROUTE_MAX_PER_MIN = 600;
-/**
- * How long a 401/403 answers tile misses before asking Mapillary again. A
- * changed token is tried at once.
- */
-export const TILE_KEY_REJECTED_HOLD_MS = 5 * 60 * 1000;
-/** After a 429 without a usable Retry-After, hold tile misses this long. */
-export const TILE_RATE_LIMIT_HOLD_MS = 60_000;
-/** The longest Retry-After honoured, so a bad header cannot stall coverage. */
-export const TILE_RATE_LIMIT_MAX_HOLD_MS = 10 * 60 * 1000;
-
-/** The client token lives in the browser by design; the server adds it to tile URLs too. */
-export function mapillaryToken() {
-  return String(process.env.MAPILLARY_CLIENT_TOKEN || '').trim();
-}

server/providers/mapillary/routes.js

@@ -1,95 +0,0 @@
-import { sameSiteGated } from '../common/same-site.js';
-import { makeRateLimiter, clientKey } from '../common/rate-limit.js';
-import { fetchTile, TileRequestError, TileUpstreamError } from './tiles.js';
-import { mapillaryToken, TILE_ROUTE_MAX_PER_MIN } from './constants.js';
-
-function sendJson(res, status, payload) {
-  res.statusCode = status;
-  res.setHeader('Content-Type', 'application/json; charset=utf-8');
-  res.setHeader('Cache-Control', 'no-store');
-  res.end(JSON.stringify(payload));
-}
-
-/** GET /api/mapillary/status — whether a token is configured, never its value. */
-function handleStatus(req, res) {
-  if (req.method !== 'GET')
-    return sendJson(res, 405, { error: 'Method not allowed' });
-  sendJson(res, 200, { configured: Boolean(mapillaryToken()) });
-}
-
-/** GET /api/mapillary/tiles/coverage/{z}/{x}/{y} — cached protobuf tile. */
-async function handleTile(req, res, allow) {
-  if (req.method !== 'GET')
-    return sendJson(res, 405, { error: 'Method not allowed' });
-  if (!allow(clientKey(req))) {
-    res.setHeader('Retry-After', '5');
-    return sendJson(res, 429, {
-      error: 'Too many tile requests',
-      retryAfter: 5,
-    });
-  }
-  const match = /^\/(coverage)\/(\d{1,2})\/(\d{1,6})\/(\d{1,6})$/.exec(
-    (req.url || '').split('?')[0],
-  );
-  if (!match)
-    return sendJson(res, 400, {
-      error: 'Tile path must be /coverage/{z}/{x}/{y}',
-    });
-  if (!mapillaryToken())
-    return sendJson(res, 503, { error: 'no_key', keyRequired: true });
-  const abandoned = new AbortController();
-  req.on?.('aborted', () => abandoned.abort());
-  res.on?.('close', () => abandoned.abort());
-  try {
-    const { bytes, source } = await fetchTile(
-      { layer: match[1], z: match[2], x: match[3], y: match[4] },
-      { signal: abandoned.signal },
-    );
-    if (res.writableEnded) return;
-    res.statusCode = bytes.length ? 200 : 204;
-    res.setHeader('Content-Type', 'application/x-protobuf');
-    res.setHeader('Cache-Control', 'public, max-age=3600');
-    res.setHeader('X-Gev-Cache', source);
-    res.end(bytes.length ? bytes : undefined);
-  } catch (error) {
-    if (res.writableEnded || abandoned.signal.aborted) return;
-    if (error instanceof TileRequestError)
-      return sendJson(res, error.status, { error: error.message });
-    if (error instanceof TileUpstreamError) {
-      // A rejected token is a key problem the panel can name, not a fault.
-      if (error.keyRejected)
-        return sendJson(res, 403, {
-          error: 'Mapillary rejected the access token',
-          keyRejected: true,
-        });
-      if (error.status === 429) {
-        const retryAfter = error.retryAfterSec || 60;
-        res.setHeader('Retry-After', String(retryAfter));
-        return sendJson(res, 429, {
-          error: 'Mapillary is rate-limiting tile requests',
-          retryAfter,
-        });
-      }
-      // An upstream 400 must not read as a malformed request to this proxy.
-      return sendJson(res, 502, { error: error.message });
-    }
-    sendJson(res, 502, { error: error?.message || 'Tile fetch failed' });
-  }
-}
-
-/**
- * Attach the Mapillary routes. Both refuse cross-site requests so another page
- * cannot spend the token or provoke a 429 that holds every tile miss.
- */
-export function installMapillaryRoutes(middlewares) {
-  const allow = makeRateLimiter({
-    windowMs: 60_000,
-    max: TILE_ROUTE_MAX_PER_MIN,
-    globalMax: TILE_ROUTE_MAX_PER_MIN * 4,
-  });
-  middlewares.use('/api/mapillary/status', sameSiteGated(handleStatus));
-  middlewares.use(
-    '/api/mapillary/tiles',
-    sameSiteGated((req, res) => handleTile(req, res, allow)),
-  );
-}

server/providers/mapillary/tiles.js

@@ -1,518 +1,265 @@
-import path from 'node:path';
-import { promises as fsp } from 'node:fs';
 import { readResponseBytesCapped } from '../common/http.js';
 import { stripTileLayers } from './trim.js';
-import {
-  MAPILLARY_TILE_HOST,
-  TILE_LAYERS,
-  TILE_DISK_DIR,
-  TILE_DISK_TTL_MS,
-  TILE_DISK_SWEEP_INTERVAL_MS,
-  TILE_DISK_MAX_BYTES,
-  TILE_DISK_FILE_OVERHEAD_BYTES,
-  TILE_MAX_BYTES,
-  TILE_MEMORY_BUDGET_BYTES,
-  TILE_MEMORY_ENTRY_OVERHEAD_BYTES,
-  TILE_FETCH_TIMEOUT_MS,
-  TILE_UPSTREAM_CONCURRENCY,
-  TILE_KEY_REJECTED_HOLD_MS,
-  TILE_RATE_LIMIT_HOLD_MS,
-  TILE_RATE_LIMIT_MAX_HOLD_MS,
-  mapillaryToken,
-} from './constants.js';
 
-/** Log without the stack; the token is never in scope here. */
-function warn(what, error) {
-  console.warn(`[Mapillary Proxy] ${what}:`, error?.message || error);
+/** Mapillary vector tiles, /{layer}/2/{z}/{x}/{y}: the only host the token goes to. */
+const TILE_HOST = 'https://tiles.mapillary.com/maps/vtp';
+/** Only the street zooms the app draws are proxied. */
+const MIN_ZOOM = 11;
+const MAX_ZOOM = 14;
+/**
+ * The z14 `image` layer is ~98% of a tile (12 MB over a dense city) and unused
+ * (positions come from the Graph API), so it is dropped in transit.
+ */
+const DROP_LAYERS = ['image'];
+/** A z14 tile with its image layer is ~12 MB; anything past this is wrong. */
+export const TILE_MAX_BYTES = 48 * 1024 * 1024;
+const FETCH_TIMEOUT_MS = 60_000;
+/** Upstream fetches at once; more wait their turn. */
+export const TILE_UPSTREAM_CONCURRENCY = 6;
+/** Tiles change only when new imagery is processed. */
+export const TILE_TTL_MS = 24 * 60 * 60 * 1000;
+/** Trimmed tiles are ~80 KB: a dozen 9-tile views, well under 100 MB. */
+export const TILE_MEMORY_MAX_TILES = 120;
+/** A trimmed tile is ~80 KB; a body this big failed to trim and is not kept. */
+export const TILE_MEMORY_MAX_TILE_BYTES = 4 * 1024 * 1024;
+/** The longest upstream Retry-After honoured, in seconds. */
+export const MAX_RETRY_AFTER_SEC = 600;
+
+/** The client token lives in the browser by design; the server adds it to tile URLs too. */
+export function mapillaryToken() {
+  return String(process.env.MAPILLARY_CLIENT_TOKEN || '').trim();
 }
 
-/** Thrown for a request this proxy refuses before contacting Mapillary. */
-export class TileRequestError extends Error {
-  constructor(message, status = 400) {
-    super(message);
-    this.name = 'TileRequestError';
-    this.status = status;
-  }
-}
-
-/** Mapillary answered with an error status; 401/403 set `keyRejected`. */
+/** Mapillary answered with an error status (or a size this proxy refuses). */
 export class TileUpstreamError extends Error {
-  constructor(status, message, { retryAfterSec = null } = {}) {
+  constructor(status, message, retryAfter = null) {
     super(message || `Mapillary tiles HTTP ${status}`);
     this.name = 'TileUpstreamError';
     this.status = status;
-    this.keyRejected = status === 401 || status === 403;
-    this.retryAfterSec = retryAfterSec;
+    /** The upstream Retry-After header, as sent. */
+    this.retryAfter = retryAfter;
   }
 }
 
-/**
- * A rejected token or rate limit that answers every tile miss until it expires
- * (or the token changes). Cached tiles are still served meanwhile.
- * @type {{status: number, until: number, token: string}|null}
- */
-let _upstreamHold = null;
-
-/** Milliseconds to wait from a Retry-After header (seconds or an HTTP date). */
-function retryAfterMs(header, now = Date.now()) {
+/** Seconds a Retry-After header asks for (an integer or an HTTP date), else null. */
+export function retryAfterSeconds(header, now = Date.now()) {
   const text = String(header ?? '').trim();
-  let ms = NaN;
-  if (/^\d+$/.test(text)) ms = Number(text) * 1000;
-  else if (text) ms = Date.parse(text) - now;
-  if (!Number.isFinite(ms) || ms <= 0) return TILE_RATE_LIMIT_HOLD_MS;
-  return Math.min(ms, TILE_RATE_LIMIT_MAX_HOLD_MS);
+  if (!text) return null;
+  const seconds = /^\d+$/.test(text)
+    ? Number(text)
+    : (Date.parse(text) - now) / 1000;
+  return Number.isFinite(seconds) && seconds > 0 ? Math.ceil(seconds) : null;
 }
 
-function heldRefusal(token) {
-  const hold = _upstreamHold;
-  if (!hold) return null;
-  const left = hold.until - Date.now();
-  if (left <= 0 || hold.token !== token) {
-    _upstreamHold = null;
+/** The wait a 429 asks for, bounded; a missing or malformed header means a minute. */
+export function retryAfterWait(header, now = Date.now()) {
+  return Math.min(retryAfterSeconds(header, now) ?? 60, MAX_RETRY_AFTER_SEC);
+}
+
+/**
+ * While Mapillary rate-limits, tile misses are refused here until the wait is
+ * over, so the rest of a view (and the fetches queued behind the first 429)
+ * do not go on asking. Scoped to the token that was refused.
+ * @type {{until: number, token: string}|null}
+ */
+let refusal = null;
+
+/** The refusal still in force for `token`, as the error to answer with. */
+function refusedNow(token) {
+  if (!refusal) return null;
+  const left = refusal.until - Date.now();
+  if (left <= 0 || refusal.token !== token) {
+    refusal = null;
     return null;
   }
-  return new TileUpstreamError(hold.status, undefined, {
-    retryAfterSec: Math.ceil(left / 1000),
-  });
+  return new TileUpstreamError(429, undefined, String(Math.ceil(left / 1000)));
 }
 
 /**
- * Validate a tile address against the layer's zoom ranges.
- * @returns {{layer:string, upstream:string, z:number, x:number, y:number, key:string}}
+ * Parse `/coverage/{z}/{x}/{y}`; null unless z is 11–14 and x/y are on the grid.
+ * @returns {{z: number, x: number, y: number, key: string}|null}
  */
-export function normalizeTileAddress({ layer, z, x, y }) {
-  const spec = Object.hasOwn(TILE_LAYERS, layer) ? TILE_LAYERS[layer] : null;
-  if (!spec) throw new TileRequestError(`Unknown tile layer: ${layer}`);
-  const zi = Number(z);
-  const xi = Number(x);
-  const yi = Number(y);
-  if (
-    ![zi, xi, yi].every((v) => Number.isInteger(v) && v >= 0) ||
-    !spec.zoomRanges.some(([min, max]) => zi >= min && zi <= max)
-  )
-    throw new TileRequestError(
-      `Tile zoom for ${layer} must be ${spec.zoomRanges
-        .map(([min, max]) => `${min}–${max}`)
-        .join(' or ')}`,
-    );
-  const n = 2 ** zi;
-  if (xi >= n || yi >= n)
-    throw new TileRequestError('Tile address out of range');
-  return {
-    layer,
-    upstream: spec.upstream,
-    dropLayers: spec.dropLayers || [],
-    z: zi,
-    x: xi,
-    y: yi,
-    key: `${layer}/${zi}/${xi}/${yi}`,
-  };
+export function parseTilePath(pathname) {
+  const match = /^\/coverage\/(\d{1,2})\/(\d{1,6})\/(\d{1,6})$/.exec(pathname);
+  if (!match) return null;
+  const [z, x, y] = match.slice(1).map(Number);
+  if (z < MIN_ZOOM || z > MAX_ZOOM || x >= 2 ** z || y >= 2 ** z) return null;
+  return { z, x, y, key: `${z}/${x}/${y}` };
 }
 
-/** @type {Map<string, {bytes: Buffer, at: number}>} insertion-ordered LRU */
-const _memory = new Map();
-let _memoryBytes = 0;
-const memoryCost = (bytes) => bytes.length + TILE_MEMORY_ENTRY_OVERHEAD_BYTES;
-/**
- * Upstream fetches shared by every request for the same tile; the last waiter
- * to leave cancels it (see `joinFlight`).
- * @type {Map<string, {controller: AbortController, promise: Promise<Buffer>, waiters: number}>}
- */
-const _inFlight = new Map();
-
-function memoryGet(key) {
-  const hit = _memory.get(key);
-  if (!hit) return null;
-  // Same life as the disk copy, so a long-running server never serves stale
-  // coverage.
-  if (Date.now() - hit.at > TILE_DISK_TTL_MS) {
-    _memory.delete(key);
-    _memoryBytes -= memoryCost(hit.bytes);
-    return null;
-  }
-  _memory.delete(key);
-  _memory.set(key, hit);
-  return hit.bytes;
-}
-
-/** `at` is when Mapillary served the bytes (a disk tile's mtime). */
-function memoryPut(key, bytes, at = Date.now()) {
-  if (memoryCost(bytes) > TILE_MEMORY_BUDGET_BYTES / 2) return;
-  const existing = _memory.get(key);
-  if (existing) _memoryBytes -= memoryCost(existing.bytes);
-  _memory.set(key, { bytes, at });
-  _memoryBytes += memoryCost(bytes);
-  while (_memoryBytes > TILE_MEMORY_BUDGET_BYTES && _memory.size) {
-    const [oldest, entry] = _memory.entries().next().value;
-    _memory.delete(oldest);
-    _memoryBytes -= memoryCost(entry.bytes);
-  }
-}
-
-/** Disk cache root; tests point it at a temporary directory. */
-let _diskDir = TILE_DISK_DIR;
-
-function diskPath({ layer, z, x, y }, root = _diskDir) {
-  return path.join(root, layer, String(z), `${x}-${y}.pbf`);
-}
-
-async function readDisk(address) {
-  const file = diskPath(address);
+function trim(bytes) {
   try {
-    const stat = await fsp.stat(file);
-    if (Date.now() - stat.mtimeMs > TILE_DISK_TTL_MS) return null;
-    return { bytes: await fsp.readFile(file), at: stat.mtimeMs };
-  } catch {
-    return null;
-  }
-}
-
-/** Unsettled background writes and sweeps; requests never wait on them. */
-const _background = new Set();
-
-function track(task) {
-  const settled = task
-    .catch(() => {})
-    .finally(() => _background.delete(settled));
-  _background.add(settled);
-  return settled;
-}
-
-/** @type {Map<string, number>} cache file to its newest write's sequence */
-const _diskWrites = new Map();
-let _diskWriteSeq = 0;
-
-function diskWritePending(address) {
-  return _diskWrites.has(diskPath(address));
-}
-
-/**
- * Write a tile in the background. `at` keeps a rewrite's original fetch time
- * so it does not extend the tile's life. An overtaken write steps aside.
- */
-function writeDisk(address, bytes, at = null) {
-  // Sweep this write's root even if the cache dir has moved since.
-  const root = _diskDir;
-  const file = diskPath(address, root);
-  const seq = ++_diskWriteSeq;
-  const tmp = `${file}.${process.pid}-${seq}.tmp`;
-  const newest = () => _diskWrites.get(file) === seq;
-  _diskWrites.set(file, seq);
-  return track(
-    fsp
-      .mkdir(path.dirname(file), { recursive: true })
-      .then(() => fsp.writeFile(tmp, bytes))
-      .then(() => at != null && fsp.utimes(tmp, new Date(), new Date(at)))
-      .then(() => {
-        if (!newest()) return fsp.rm(tmp, { force: true });
-        return fsp.rename(tmp, file).then(() => scheduleSweep(root));
-      })
-      .catch(async (error) => {
-        await fsp.rm(tmp, { force: true }).catch(() => {});
-        warn('tile cache write failed', error);
-      })
-      .finally(() => {
-        if (newest()) _diskWrites.delete(file);
-      }),
-  );
-}
-
-let _lastSweepAt = 0;
-let _sweeping = null;
-let _sweepWarned = false;
-
-function scheduleSweep(root) {
-  if (_sweeping || Date.now() - _lastSweepAt < TILE_DISK_SWEEP_INTERVAL_MS)
-    return;
-  _lastSweepAt = Date.now();
-  const sweep = sweepTileDisk({ root })
-    .catch((error) => {
-      if (_sweepWarned) return;
-      _sweepWarned = true;
-      warn('tile cache sweep failed', error);
-    })
-    .finally(() => {
-      if (_sweeping === tracked) _sweeping = null;
-    });
-  const tracked = track(sweep);
-  _sweeping = tracked;
-}
-
-/** Every file under `dir` with size and mtime; a missing dir is empty. */
-async function listCacheFiles(dir) {
-  let entries;
-  try {
-    entries = await fsp.readdir(dir, { withFileTypes: true });
+    return stripTileLayers(bytes, DROP_LAYERS);
   } catch (error) {
-    if (error?.code === 'ENOENT') return [];
-    throw error;
-  }
-  const files = [];
-  for (const entry of entries) {
-    const file = path.join(dir, entry.name);
-    if (entry.isDirectory()) files.push(...(await listCacheFiles(file)));
-    else if (entry.isFile()) {
-      const stat = await fsp.stat(file).catch(() => null);
-      if (stat) files.push({ file, size: stat.size, at: stat.mtimeMs });
-    }
-  }
-  return files;
-}
-
-/**
- * Delete expired tiles, then the oldest until the rest fit in `maxBytes`.
- * @returns {Promise<{removed: number, bytes: number}>} files deleted, charged bytes kept
- */
-export async function sweepTileDisk({
-  root = _diskDir,
-  maxBytes = TILE_DISK_MAX_BYTES,
-} = {}) {
-  const now = Date.now();
-  const files = (await listCacheFiles(root)).sort((a, b) => a.at - b.at);
-  const cost = (size) => size + TILE_DISK_FILE_OVERHEAD_BYTES;
-  let bytes = files.reduce((sum, { size }) => sum + cost(size), 0);
-  let removed = 0;
-  for (const { file, size, at } of files) {
-    if (now - at <= TILE_DISK_TTL_MS && bytes <= maxBytes) break;
-    await fsp.rm(file, { force: true });
-    bytes -= cost(size);
-    removed++;
-  }
-  return { removed, bytes };
-}
-
-/** The one origin the tile token may be sent to, at every redirect hop. */
-const TILE_ORIGIN = new URL(MAPILLARY_TILE_HOST).origin;
-export const TILE_MAX_REDIRECTS = 3;
-const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
-
-/**
- * Follow redirects by hand so every hop stays HTTPS on the tile origin and the
- * token in the query never reaches another host. A bad redirect is a 502.
- */
-async function fetchPinned(url, init) {
-  let next = url;
-  for (let hop = 0; ; hop++) {
-    const response = await fetch(next, { ...init, redirect: 'manual' });
-    if (!REDIRECT_STATUSES.has(response.status)) return response;
-    await response.body?.cancel().catch(() => {});
-    if (hop >= TILE_MAX_REDIRECTS)
-      throw new TileUpstreamError(502, 'Mapillary tile redirected too often');
-    let target = null;
-    try {
-      target = new URL(response.headers.get('location') ?? '', next);
-    } catch {
-      /* unparseable Location */
-    }
-    if (
-      !response.headers.get('location') ||
-      target?.protocol !== 'https:' ||
-      target.origin !== TILE_ORIGIN ||
-      target.username ||
-      target.password
-    )
-      throw new TileUpstreamError(
-        502,
-        'Mapillary tile redirect left the tile origin',
-      );
-    next = target.href;
-  }
-}
-
-async function fetchUpstream(address, signal) {
-  const token = mapillaryToken();
-  if (!token) throw new TileRequestError('Mapillary token not configured', 503);
-  const held = heldRefusal(token);
-  if (held) throw held;
-  const url = `${MAPILLARY_TILE_HOST}/${address.upstream}/2/${address.z}/${address.x}/${address.y}?access_token=${encodeURIComponent(token)}`;
-  const timeout = AbortSignal.timeout(TILE_FETCH_TIMEOUT_MS);
-  const oversize = new AbortController();
-  const response = await fetchPinned(url, {
-    signal: AbortSignal.any([signal, timeout, oversize.signal].filter(Boolean)),
-    headers: { Accept: 'application/x-protobuf' },
-  });
-  if (response.status === 404 || response.status === 204) {
-    await response.body?.cancel().catch(() => {});
-    return Buffer.alloc(0);
-  }
-  if (!response.ok) {
-    await response.body?.cancel().catch(() => {});
-    const error = new TileUpstreamError(response.status);
-    if (error.keyRejected)
-      _upstreamHold = {
-        status: response.status,
-        until: Date.now() + TILE_KEY_REJECTED_HOLD_MS,
-        token,
-      };
-    else if (response.status === 429) {
-      const wait = retryAfterMs(response.headers.get('retry-after'));
-      _upstreamHold = { status: 429, until: Date.now() + wait, token };
-      error.retryAfterSec = Math.ceil(wait / 1000);
-    }
-    throw error;
-  }
-  // Chunked or compressed bodies have no Content-Length: the cap applies as
-  // the body streams, and an oversized one also aborts the request.
-  try {
-    const bytes = await readResponseBytesCapped(
-      response,
-      TILE_MAX_BYTES,
-      signal,
-    );
-    return Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-  } catch (error) {
-    if (error?.code !== 'RESPONSE_TOO_LARGE') throw error;
-    oversize.abort();
-    throw new TileUpstreamError(502, 'Mapillary tile exceeds size cap');
-  }
-}
-
-/** @type {{active: number, queue: Array<() => void>}} upstream slots */
-let _slots = { active: 0, queue: [] };
-
-/**
- * Resolve with a release function once a slot is free. An abort while
- * queued leaves the queue.
- * @returns {Promise<() => void>}
- */
-function acquireUpstreamSlot(signal) {
-  const slots = _slots;
-  return new Promise((resolve, reject) => {
-    if (signal.aborted) return reject(signal.reason);
-    const onAbort = () => {
-      const index = slots.queue.indexOf(grant);
-      if (index !== -1) slots.queue.splice(index, 1);
-      reject(signal.reason);
-    };
-    function grant() {
-      signal.removeEventListener('abort', onAbort);
-      slots.active++;
-      let released = false;
-      resolve(() => {
-        if (released) return;
-        released = true;
-        slots.active--;
-        slots.queue.shift()?.();
-      });
-    }
-    if (slots.active < TILE_UPSTREAM_CONCURRENCY) return grant();
-    signal.addEventListener('abort', onAbort, { once: true });
-    slots.queue.push(grant);
-  });
-}
-
-function trim(address, bytes) {
-  if (!address.dropLayers.length || !bytes.length) return bytes;
-  try {
-    return stripTileLayers(bytes, address.dropLayers);
-  } catch (error) {
-    warn('tile trim failed, serving raw', error);
+    console.warn('[Mapillary Proxy] tile trim failed:', error?.message);
     return bytes;
   }
 }
 
-/**
- * Fetch one tile from memory, disk, a shared flight, then Mapillary. Empty
- * bytes mean no coverage.
- * @param {{layer:string,z:number|string,x:number|string,y:number|string}} request
- * @param {{signal?: AbortSignal}} [options]
- * @returns {Promise<{bytes: Buffer, source: 'memory'|'disk'|'inflight'|'upstream', address: object}>}
- */
-export async function fetchTile(request, { signal } = {}) {
-  const address = normalizeTileAddress(request);
-  const memory = memoryGet(address.key);
-  if (memory) return { bytes: memory, source: 'memory', address };
-  const disk = await readDisk(address);
-  if (disk) {
-    // Older cache files may be untrimmed: rewrite once, keeping the fetch time.
-    const bytes = trim(address, disk.bytes);
-    if (bytes !== disk.bytes && !diskWritePending(address))
-      writeDisk(address, bytes, disk.at);
-    memoryPut(address.key, bytes, disk.at);
-    return { bytes, source: 'disk', address };
+/** One tile from Mapillary, trimmed; empty bytes mean no coverage. */
+async function fetchUpstream({ z, x, y }, signal) {
+  const token = mapillaryToken();
+  const refused = refusedNow(token);
+  if (refused) throw refused;
+  const response = await fetch(
+    `${TILE_HOST}/mly1_public/2/${z}/${x}/${y}?access_token=${encodeURIComponent(token)}`,
+    {
+      signal: AbortSignal.any([signal, AbortSignal.timeout(FETCH_TIMEOUT_MS)]),
+      // The token is in the query: a redirect is never followed (a 3xx is a 502).
+      redirect: 'manual',
+      headers: { Accept: 'application/x-protobuf' },
+    },
+  );
+  if (!response.ok || response.status === 204) {
+    await response.body?.cancel().catch(() => {});
+    if (response.status === 204 || response.status === 404)
+      return Buffer.alloc(0);
+    const retryAfter = response.headers.get('retry-after');
+    if (response.status === 429)
+      refusal = {
+        token,
+        until: Date.now() + retryAfterWait(retryAfter) * 1000,
+      };
+    throw new TileUpstreamError(response.status, undefined, retryAfter);
+  }
+  try {
+    const bytes = await readResponseBytesCapped(response, TILE_MAX_BYTES);
+    return trim(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.length));
+  } catch (error) {
+    if (error?.code !== 'RESPONSE_TOO_LARGE') throw error;
+    throw new TileUpstreamError(502, 'Mapillary tile exceeds size cap');
   }
-  // A caller gone while the disk was read must not start a fetch nobody joins.
-  signal?.throwIfAborted();
-  let flight = _inFlight.get(address.key);
-  const joined = Boolean(flight) && !flight.controller.signal.aborted;
-  if (!joined) flight = startFlight(address);
-  const bytes = await joinFlight(flight, signal);
-  return { bytes, source: joined ? 'inflight' : 'upstream', address };
 }
 
-/** Start the shared upstream fetch; it holds a slot until the body is read. */
+let upstreamActive = 0;
+/** @type {Array<() => void>} fetches waiting for a slot, oldest first */
+const upstreamWaiting = [];
+
+/**
+ * Run `task` in an upstream slot, waiting for one unless `signal` aborts
+ * first. A freed slot passes straight to the oldest waiter, still counted, so
+ * a request arriving meanwhile cannot take it first.
+ */
+async function withUpstreamSlot(signal, task) {
+  if (upstreamActive < TILE_UPSTREAM_CONCURRENCY) upstreamActive++;
+  else
+    await new Promise((resolve, reject) => {
+      const wake = () => {
+        signal.removeEventListener('abort', leave);
+        resolve();
+      };
+      const leave = () => {
+        const at = upstreamWaiting.indexOf(wake);
+        if (at !== -1) upstreamWaiting.splice(at, 1);
+        reject(signal.reason);
+      };
+      upstreamWaiting.push(wake);
+      signal.addEventListener('abort', leave, { once: true });
+    });
+  try {
+    // Handed a slot after leaving: it goes on to the next waiter.
+    signal.throwIfAborted();
+    return await task();
+  } finally {
+    const next = upstreamWaiting.shift();
+    if (next) next();
+    else upstreamActive--;
+  }
+}
+
+/** `promise`, or a rejection as soon as `signal` aborts. */
+function unlessAborted(promise, signal) {
+  if (!signal) return promise;
+  signal.throwIfAborted();
+  return new Promise((resolve, reject) => {
+    const leave = () => reject(signal.reason);
+    signal.addEventListener('abort', leave, { once: true });
+    promise
+      .then(resolve, reject)
+      .finally(() => signal.removeEventListener('abort', leave));
+  });
+}
+
+/** @type {Map<string, {bytes: Buffer, at: number}>} least recently used first */
+const memory = new Map();
+/**
+ * Upstream fetches shared per tile, with the requests still waiting on each.
+ * @type {Map<string, {promise: Promise<Buffer>, controller: AbortController, waiters: number}>}
+ */
+const inFlight = new Map();
+
+function remember(key, bytes, at = Date.now()) {
+  if (bytes.length > TILE_MEMORY_MAX_TILE_BYTES) return;
+  memory.delete(key);
+  memory.set(key, { bytes, at });
+  for (const oldest of memory.keys()) {
+    if (memory.size <= TILE_MEMORY_MAX_TILES) break;
+    memory.delete(oldest);
+  }
+}
+
+function recall(key) {
+  const hit = memory.get(key);
+  if (!hit) return null;
+  if (Date.now() - hit.at > TILE_TTL_MS) {
+    memory.delete(key);
+    return null;
+  }
+  remember(key, hit.bytes, hit.at); // most recently used again
+  return hit.bytes;
+}
+
+/** Start the upstream fetch for a tile, shared until its last request leaves. */
 function startFlight(address) {
   const controller = new AbortController();
-  const flight = { controller, waiters: 0, promise: null };
-  flight.promise = acquireUpstreamSlot(controller.signal)
-    .then((release) =>
-      fetchUpstream(address, controller.signal).finally(release),
-    )
-    .then((raw) => trim(address, raw))
+  const flight = { controller, waiters: 0 };
+  flight.promise = withUpstreamSlot(controller.signal, () =>
+    fetchUpstream(address, controller.signal),
+  )
     .then((bytes) => {
-      memoryPut(address.key, bytes);
-      writeDisk(address, bytes);
+      remember(address.key, bytes);
       return bytes;
     })
     .finally(() => {
-      if (_inFlight.get(address.key) === flight) _inFlight.delete(address.key);
+      if (inFlight.get(address.key) === flight) inFlight.delete(address.key);
     });
-  // Every waiter may have left before it settles; nobody awaits it then.
+  // Every request may have left; the rejection is then nobody's.
   flight.promise.catch(() => {});
-  _inFlight.set(address.key, flight);
+  inFlight.set(address.key, flight);
   return flight;
 }
 
 /**
- * Wait on a shared flight. A caller's abort rejects only that caller; the
- * fetch is cancelled when the last waiter leaves.
+ * One tile from memory, a shared in-flight fetch, or Mapillary. `signal`
+ * aborts when the request's client leaves; the fetch stops once all have.
+ * @param {{z: number, x: number, y: number, key: string}} address from parseTilePath
+ * @param {{signal?: AbortSignal}} [options]
+ * @returns {Promise<{bytes: Buffer, source: 'memory'|'inflight'|'upstream'}>}
  */
-function joinFlight(flight, signal) {
-  signal?.throwIfAborted();
+export async function fetchTile(address, { signal } = {}) {
+  const cached = recall(address.key);
+  if (cached) return { bytes: cached, source: 'memory' };
+  let flight = inFlight.get(address.key);
+  const shared = Boolean(flight);
+  flight ||= startFlight(address);
   flight.waiters++;
-  return new Promise((resolve, reject) => {
-    let done = false;
-    const leave = () => {
-      if (done) return false;
-      done = true;
-      signal?.removeEventListener('abort', onAbort);
-      flight.waiters--;
-      return true;
-    };
-    const onAbort = () => {
-      if (!leave()) return;
-      if (flight.waiters === 0) flight.controller.abort();
-      reject(signal.reason);
-    };
-    signal?.addEventListener('abort', onAbort, { once: true });
-    flight.promise.then(
-      (bytes) => leave() && resolve(bytes),
-      (error) => leave() && reject(error),
-    );
-  });
+  try {
+    const bytes = await unlessAborted(flight.promise, signal);
+    return { bytes, source: shared ? 'inflight' : 'upstream' };
+  } finally {
+    if (--flight.waiters === 0) {
+      // A later request for the tile must not join a cancelled fetch.
+      if (inFlight.get(address.key) === flight) inFlight.delete(address.key);
+      flight.controller.abort();
+    }
+  }
 }
 
-/** Test seam: forget every cached tile held in memory. */
-export function _resetTileMemoryForTest() {
-  _memory.clear();
-  _memoryBytes = 0;
-  _inFlight.clear();
-  _upstreamHold = null;
-  _slots = { active: 0, queue: [] };
-}
-
-/** Test seam: how many tiles memory holds and the bytes charged for them. */
-export function _tileMemoryForTest() {
-  return { entries: _memory.size, bytes: _memoryBytes };
-}
-
-/** Test seam: wait for every background write and the sweeps they start. */
-export async function _settleTileWritesForTest() {
-  while (_background.size) await Promise.allSettled([..._background]);
-}
-
-/** Test seam: keep the disk cache in `dir` (null restores the default). */
-export function _setTileCacheDirForTest(dir) {
-  _diskDir = dir || TILE_DISK_DIR;
-  _lastSweepAt = 0;
+/** Test seam: forget every cached and in-flight tile. */
+export function _resetTileCacheForTest() {
+  memory.clear();
+  inFlight.clear();
+  refusal = null;
+  upstreamActive = 0;
+  upstreamWaiting.length = 0;
 }

server/providers/mapillary/trim.js

@@ -41,16 +41,3 @@ export function stripTileLayers(bytes, dropNames) {
   }, null);
   return dropped ? Buffer.from(writer.finish()) : bytes;
 }
-
-/** Names of the layers inside a vector tile, in order. */
-export function listTileLayers(bytes) {
-  const names = [];
-  if (!bytes?.length) return names;
-  new PbfReader(bytes).readFields((tag, _result, pbf) => {
-    if (tag !== TILE_LAYER_FIELD) return;
-    const end = pbf.readVarint() + pbf.pos;
-    names.push(layerName(bytes.subarray(pbf.pos, end)));
-    pbf.pos = end;
-  }, null);
-  return names;
-}