fix(cctv): harden the WSDOT catalog fetch and describe its real direction codes

The catalog fetch now refuses redirects, cancels rejected bodies and reads
through the shared capped reader before the windows-1252 decode. The feed sends
cardinal codes plus B (both), O and null, not BW or diagonals; tests, comments
and docs now say so, with unchanged id-hash fallbacks. Documents the 8-1,200
per-pack range, drops the unverified low-volume compliance claim for facts and
a link to WSDOT's terms, and stops claiming the per-pack defaults fit under
the 4,000 cap: it is filled round-robin.

.env.example

@@ -220,7 +220,7 @@ AISSTREAM_API_KEY=
 # CCTV_CALGARY_MAX_SOURCES=220                         # cap cameras loaded from the Open Calgary catalog
 # CCTV_CALGARY_ROWS_URL=                               # override the Open Calgary catalog URL
 # CCTV_WSDOT_ENABLED=1                                 # set 0 to disable the WSDOT (Washington State) highway cameras
-# CCTV_WSDOT_MAX_SOURCES=250                           # cap cameras loaded from the WSDOT catalog, nearest Seattle/Spokane first
+# CCTV_WSDOT_MAX_SOURCES=250                           # cap cameras loaded from the WSDOT catalog, nearest Seattle/Spokane first; min 8, max 1200
 # CCTV_VEGVESEN_ENABLED=1                              # set 0 to disable the Statens vegvesen (Norway) road cameras
 # CCTV_VEGVESEN_MAX_SOURCES=900                        # cap cameras loaded from Statens vegvesen (default loads all ~850 live; max 1000)
 # CCTV_VEGVESEN_VIDEO=1                                # set 0 to show stills instead of live HLS for Statens vegvesen video cameras

CHANGELOG.md

@@ -3,11 +3,12 @@
 - Add WSDOT highway cameras (Washington State) as a keyless CCTV source pack:
   WSDOT's official Travel Center camera layer, with frames registered only on
   WSDOT's own image host (partner-hosted cameras such as Oregon DOT and City of
-  Seattle are skipped). Cameras with a single `CompassDirection`, cardinal or
-  diagonal, get a high-confidence heading; `BW` (Bothways) cameras use the
-  shared id-hash fallback at low confidence. By default the 250 cameras nearest
-  Seattle and Spokane load; `CCTV_WSDOT_MAX_SOURCES` sets the cap and
-  `CCTV_WSDOT_ENABLED=0` turns the pack off (bassem chagra, #644).
+  Seattle are skipped). Cameras with a single cardinal `CompassDirection` get
+  a high-confidence heading; `B` (both directions), `O`, and unset directions
+  use the shared id-hash fallback at low confidence. By default the 250
+  cameras nearest Seattle and Spokane load; `CCTV_WSDOT_MAX_SOURCES` sets the
+  cap (8–1,200) and `CCTV_WSDOT_ENABLED=0` turns the pack off (bassem chagra,
+  #644).
 
 - Stop one retired bikeshare feed from reporting the whole layer as failed.
   City feeds are fetched independently, but failure was recorded in a single

DATA_SOURCES.md

@@ -143,7 +143,7 @@ The optional Local ADS-B layer and the broadcast-FM receiver use radio you recei
 - **Warendorf webcam.** The Stadt Warendorf Marktplatz webcam, registered from the curated `config/cctv_sources.warendorf.json` (the Kreis Warendorf registration-office cameras from the contributing PR are indoor waiting rooms and were left out); only the municipal image host is proxied, frames are fetched at request time and never stored or redistributed. Disable with `CCTV_WARENDORF_ENABLED=0`.
 - **Live Traffic NSW cameras.** The camera list is the keyless public `data.livetraffic.com/cameras/traffic-cam.json` feed (Transport for NSW open data, CC BY 4.0); frames are stills on `webcams.transport.nsw.gov.au`, and only that host is registered. That image host answers non-browser clients with an HTML placeholder, so the proxy identifies as a browser for that one host and as itself everywhere else. Frames are fetched at request time and never stored or redistributed. Disable with `CCTV_NSW_ENABLED=0`.
 - **Open Calgary traffic cameras.** Keyless. The camera list is the public Socrata dataset `k7p9-kppz` on `data.calgary.ca`; frames are stills on the city's own `trafficcam.calgary.ca` host, and only that host is registered. Most rows publish an `http://` frame URL and the host redirects those to HTTPS, so URLs are upgraded and pinned to that origin before registration. Frames are fetched at request time and never stored or redistributed. The dataset publishes no camera facing: the `quadrant` field and the quadrant suffix on each camera name are Calgary's address grid, not a bearing, so headings use the shared id-hash fallback at low confidence and are corrected with the in-app calibration gizmo. The licence requires the attribution statement above. Disable with `CCTV_CALGARY_ENABLED=0`.
-- **WSDOT highway cameras.** Keyless. The camera list is the Esri JSON layer `data.wsdot.wa.gov/travelcenter/Cameras.json` — the same layer WSDOT's own Travel Center map consumes (~1,700 point features, EPSG:3857 geometry converted to WGS84 on load; the body carries Windows-1252 bytes and is decoded as such). Only frames on WSDOT's own `images.wsdot.wa.gov` host are registered — the catalog also lists ~70 partner cameras (Oregon DOT, City of Seattle, lodges, airports) whose own terms apply, and those are skipped rather than proxied. WSDOT's layer metadata marks the feed for "low volume" use, which the 15-minute catalog cache and per-request frame fetches respect; frames are never stored or redistributed. `CompassDirection` codes with a single facing (N/E/S/W and the diagonals NE/SE/SW/NW, per WSDOT's layer metadata) give a high-confidence heading; `BW` ("Bothways") rows carry no single facing and use the shared id-hash fallback at low confidence. By default the 250 cameras nearest Seattle and Spokane load; `CCTV_WSDOT_MAX_SOURCES` changes the cap and `CCTV_WSDOT_ENABLED=0` turns the pack off. A keyed WSDOT Traveler Information API serves the same population for higher-volume use and is deliberately not required here.
+- **WSDOT highway cameras.** Keyless. The camera list is the Esri JSON layer `data.wsdot.wa.gov/travelcenter/Cameras.json` — the same layer WSDOT's own Travel Center map consumes (~1,700 point features, EPSG:3857 geometry converted to WGS84 on load; the body carries Windows-1252 bytes and is decoded as such). Only frames on WSDOT's own `images.wsdot.wa.gov` host are registered — the catalog also lists ~70 partner cameras (Oregon DOT, City of Seattle, lodges, airports) whose own terms apply, and those are skipped rather than proxied. WSDOT's layer metadata marks the feed for "low volume" use (see WSDOT's [travel information disclaimer](https://wsdot.wa.gov/about/policies/travel-information-disclaimer)). The catalog is fetched once per CCTV catalog refresh (every 15 minutes), and a camera's frame is fetched only when that camera is viewed; frames are never stored or redistributed. The live feed's `CompassDirection` is a single cardinal (N/E/S/W), `B` (both directions — most rows), `O`, or null. A single cardinal gives a high-confidence heading (the diagonals NE/SE/SW/NW are mapped too should they appear); `B`, `O`, null, and any other code carry no single facing and use the shared id-hash fallback at low confidence. By default the 250 cameras nearest Seattle and Spokane load; `CCTV_WSDOT_MAX_SOURCES` changes the cap (8–1,200) and `CCTV_WSDOT_ENABLED=0` turns the pack off. A keyed WSDOT Traveler Information API serves the same population for higher-volume use and is deliberately not required here.
 - **Statens vegvesen road cameras.** Keyless. The camera list is one GeoJSON request to the OGC API Features view of the official DATEX 3.1 CCTV site table (`ogckart-sn1.atlas.vegvesen.no/ogc/features/v1/collections/datex_3_1:CctvSimple/items`), so no DATEX account is needed; frames are stills on `kamera.atlas.vegvesen.no/api/images/<cameraId>`, and only that exact path per camera is registered. Cameras the feed reports as faulty are dropped. About 135 working cameras also publish live HLS (`kamera.vegvesen.no/public/<cameraId>/manifest.m3u8`, MPEG-TS); those play as live video through the bounded in-memory HLS relay, with the still as the snapshot fallback, and only that exact manifest path per camera is registered. `CCTV_VEGVESEN_VIDEO=0` keeps every camera on stills. `orientationDescription` names the place a camera faces, not a bearing, so it goes into the label and headings use the id-hash fallback at low confidence. By default every live camera loads (~850); `CCTV_VEGVESEN_MAX_SOURCES` (8–1000) lowers the cap, keeping the cameras nearest Oslo, Bergen, Stavanger, Trondheim, Kristiansand, Bodø and Tromsø and `CCTV_VEGVESEN_ENABLED=0` turns the pack off. Frames are fetched at request time and never stored or redistributed. The NLOD attribution is registered in the Data attribution popover.
 - **NYC DOT Traffic Management Center cameras.** Off by default. NYC DOT's [developer data feeds page](https://www.nyc.gov/html/dot/html/about/datafeeds.shtml) asks developers who want the camera feed to contact `[email protected]` and sign a data-sharing agreement. This project does not hold one that covers downstream installations, so the pack loads only when an operator who holds their own agreement sets `CCTV_NYC_ENABLED=1`; with the flag unset, empty or any other value, the server makes no request to NYC DOT. The endpoint needs no key. The camera list is the public `webcams.nyctmc.org/api/cameras` catalog (~980 cameras across the five boroughs); frames are stills at `webcams.nyctmc.org/api/cameras/<uuid>/image`, synthesized from a validated UUID rather than taken from the payload, and only that host is registered. Cameras the feed reports as offline are dropped. The catalog publishes no camera facing, so headings use the shared id-hash fallback at low confidence and are corrected with the in-app calibration gizmo. Once enabled, the 250 cameras nearest the borough cores load; `CCTV_NYC_MAX_SOURCES` (8–400) changes the cap. Frames are fetched at request time and never stored or redistributed. NYC DOT asks every application that uses its data to carry its disclaimer; it is registered verbatim in the Data attribution popover.
 - **Camera frame content.** Public camera frames can contain people, vehicles and license plates, and the camera layer does nothing with them beyond putting them on the map. A successful upstream response is relayed as the provider served it: nothing in the camera pipeline blurs, redacts, enhances or restores it, and nothing there runs face, plate or object detection or otherwise recognises or classifies what is in the picture. (The ALPR layer described below maps where plate-reader cameras are, from locations contributors tagged in OpenStreetMap; it reads nothing from any camera frame.) When an upstream has no frame for a camera, what you see instead is a Google Street View still or the app's own placeholder card; the panel's source badge names which of them you are looking at, and a refresh that fails after a frame has arrived leaves the last good picture on screen rather than replacing it. The browser resamples each frame for display: onto a fixed 1920x1080 surface for the camera's projection plane in the scene, and onto a 192x108 canvas for the small ambient card. That scaling is the only change made to the picture, and the only pixels the camera layer reads back are a 64x36 downscale hashed to tell whether the picture has changed. Live streams are piped through; the still path reads the image into memory to pass it on — TxDOT wraps its JPEG in a JSON envelope, which is decoded there — and no frame is written to disk (the disk cache, `.gev-cache/`, holds feed JSON for other layers and never camera imagery). Outside that pipeline, the voice assistant is the one feature that sends imagery anywhere: when it answers a question about what is in view it may attach a downscaled screenshot of the rendered scene — including any camera plane on screen — to the request it sends to the voice model. Frames are fetched only from server-registered camera URLs — a client cannot hand the proxy a URL (see [SECURITY.md](SECURITY.md)). What the app does stays inside the line README draws: no named-person search, no face recognition, no tracking individuals.

server/providers/cctv/constants.js

@@ -8,8 +8,8 @@ export const DEFAULT_AUSTIN_MAX_SOURCES = 250;
  * Catalog-wide safety ceiling on served cameras. Each pack already caps
  * itself (nearest-to-anchor first); this bound only matters when the packs
  * together exceed it, and it is then filled round-robin across packs (see
- * cap.js) so no region is silently dropped. Sized above the sum of the
- * default per-pack caps so a default install never trims.
+ * cap.js) so no region is silently dropped. The default per-pack caps
+ * together can exceed it, so a default install may be thinned evenly here.
  */
 export const DEFAULT_CCTV_MAX_SOURCES = 4000;
 /** Hard upper bound for CCTV_MAX_SOURCES; also sizes the health map. */
@@ -249,9 +249,9 @@ export const VEGVESEN_IMAGE_ORIGIN =
  * per-camera manifest path is registered. */
 export const VEGVESEN_VIDEO_URL = (cameraId) =>
   `https://kamera.vegvesen.no/public/${cameraId}/manifest.m3u8`;
-/** Above the ~850 working cameras so a default install keeps them all, while
- * staying close to them: the per-pack defaults are meant to sum to no more
- * than DEFAULT_CCTV_MAX_SOURCES. */
+/** Above the ~850 working cameras so the pack keeps them all on its own. The
+ * catalog-wide DEFAULT_CCTV_MAX_SOURCES cap still applies across packs and is
+ * filled round-robin, so a full default install may thin this pack. */
 export const DEFAULT_VEGVESEN_MAX_SOURCES = 900;
 /** Hard ceiling on the catalog body. The whole country is ~800 KB. */
 export const VEGVESEN_MAX_CATALOG_BYTES = 8 * 1024 * 1024;
@@ -308,8 +308,8 @@ export const DELDOT_ANCHORS = [
 
 /** WSDOT Travel Center cameras (Washington State): keyless Esri JSON on the
  * official open-data host — ~1,700 point features in EPSG:3857 (Web Mercator),
- * ETag/Last-Modified served. WSDOT's metadata marks the feed "low volume" use,
- * which the 15-minute catalog cache respects. */
+ * ETag/Last-Modified served. WSDOT's metadata marks the feed "low volume" use;
+ * the catalog is fetched once per CCTV_SOURCE_CACHE_MS refresh. */
 export const WSDOT_CAMERAS_URL =
   'https://data.wsdot.wa.gov/travelcenter/Cameras.json';
 /** Only frames on WSDOT's own image host are registered; the catalog also
@@ -317,6 +317,10 @@ export const WSDOT_CAMERAS_URL =
  * whose own terms apply. */
 export const WSDOT_IMAGE_ORIGIN = 'https://images.wsdot.wa.gov/';
 export const DEFAULT_WSDOT_MAX_SOURCES = 250;
+/** Hard ceiling on the WSDOT catalog body. The live layer is ~400 KB; this
+ * only exists so an upstream that streams an unbounded body cannot be
+ * buffered without limit. */
+export const WSDOT_MAX_CATALOG_BYTES = 4 * 1024 * 1024;
 /** Prioritization anchors: downtown Seattle and Spokane. */
 export const WSDOT_ANCHORS = [
   { lat: 47.6062, lon: -122.3321 }, // Seattle

server/providers/cctv/sources.js

@@ -63,6 +63,7 @@ import {
   WSDOT_IMAGE_ORIGIN,
   DEFAULT_WSDOT_MAX_SOURCES,
   WSDOT_ANCHORS,
+  WSDOT_MAX_CATALOG_BYTES,
   DEFAULT_VEGVESEN_CCTV_URL,
   VEGVESEN_IMAGE_ORIGIN,
   VEGVESEN_VIDEO_URL,
@@ -100,7 +101,10 @@ import {
   prioritizeSources,
 } from './normalize.js';
 import { directionToHeading } from '../../../src/data/directionText.js';
-import { readResponseJsonCapped } from '../common/http.js';
+import {
+  readResponseBytesCapped,
+  readResponseJsonCapped,
+} from '../common/http.js';
 /**
  * Fetch and parse Austin traffic camera records from the city Open Data portal.
  *
@@ -1721,10 +1725,10 @@ export async function loadDelDOTSourcesFromOpenData() {
   }
 }
 
-/** WSDOT `CompassDirection` codes as headings in degrees, per the layer's own
- * metadata (N/E/S/W, NE/NW/SE/SW, BW = Bothways). `BW` and anything else
- * (`O`, null, unknown codes) carry no single facing and fall through to the
- * id hash. */
+/** WSDOT `CompassDirection` codes as headings in degrees. The live feed sends
+ * single cardinals (N/E/S/W), `B` (both directions — most rows), `O`, and
+ * null; the diagonals are mapped in case they appear. `B`, `O`, null, and any
+ * other code carry no single facing and fall through to the id hash. */
 const WSDOT_COMPASS_HEADINGS = Object.freeze({
   N: 0,
   NE: 45,
@@ -1770,9 +1774,9 @@ function isLikelyWashingtonCoordinate(lat, lon) {
  * finite in-state coordinates, and a frame on WSDOT's own image host are
  * kept — the catalog's ~70 partner cameras (Oregon DOT, City of Seattle,
  * lodges, airports) are skipped rather than proxied under someone else's
- * terms. A single-facing `CompassDirection` (cardinal or diagonal) gives a
- * high-confidence heading; `BW` (Bothways) and `O`/null fall back to the id
- * hash.
+ * terms. A single-facing `CompassDirection` (a cardinal) gives a
+ * high-confidence heading; `B` (both directions), `O`, and null fall back to
+ * the id hash.
  * The feed carries Windows-1252 bytes (en-dashes in titles) with no charset
  * declaration, so the body is decoded explicitly before parsing.
  *
@@ -1782,14 +1786,31 @@ export async function loadWsdotSourcesFromOpenData() {
   try {
     const resp = await fetch(WSDOT_CAMERAS_URL, {
       headers: { Accept: 'application/json' },
+      redirect: 'manual',
       signal: AbortSignal.timeout(CCTV_SOURCE_FETCH_TIMEOUT_MS),
     });
+    const discard = async () => {
+      try {
+        await resp.body?.cancel();
+      } catch {
+        /* no-op */
+      }
+      return [];
+    };
+    if (resp.status >= 300 && resp.status < 400) {
+      console.warn(
+        '[CCTV] WSDOT catalog redirected; redirects are not followed',
+      );
+      return discard();
+    }
     if (!resp.ok) {
       console.warn('[CCTV] WSDOT camera download failed:', resp.status);
-      return [];
+      return discard();
     }
     const payload = JSON.parse(
-      new TextDecoder('windows-1252').decode(await resp.arrayBuffer()),
+      new TextDecoder('windows-1252').decode(
+        await readResponseBytesCapped(resp, WSDOT_MAX_CATALOG_BYTES),
+      ),
     );
     const rows = Array.isArray(payload?.features) ? payload.features : [];
 

src/data/cctvDriveBcSource.test.mjs

@@ -221,7 +221,7 @@ test('CCTV catalog merges DriveBC cameras and CCTV_DRIVEBC_ENABLED=0 skips the r
   );
 });
 
-test('default per-pack camera caps fit inside the default catalog cap', () => {
+test('default caps of the original packs fit inside the default catalog cap', () => {
   // Every default pack at its own cap (Warendorf ships 1 curated camera).
   const packs =
     DEFAULT_AUSTIN_MAX_SOURCES +

src/data/cctvWsdotSource.test.mjs

@@ -1,8 +1,13 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createCctvCatalog } from '../../server/providers/cctv/catalog.js';
 import {
   DEFAULT_WSDOT_MAX_SOURCES,
   WSDOT_CAMERAS_URL,
+  WSDOT_MAX_CATALOG_BYTES,
 } from '../../server/providers/cctv/constants.js';
 import {
   loadWsdotSourcesFromOpenData,
@@ -89,7 +94,7 @@ test('WSDOT loader keeps official-host cameras and maps compass directions', asy
           },
         }),
         wsdotFeature(9059, 47.66, -117.43, {
-          attributes: { CompassDirection: 'BW' },
+          attributes: { CompassDirection: 'B' },
         }),
         // Partner-hosted frame (Oregon DOT): skipped, never proxied.
         wsdotFeature(1002, 45.62, -122.675, {
@@ -127,7 +132,7 @@ test('WSDOT loader keeps official-host cameras and maps compass directions', asy
   assert.ok(Math.abs(seattle.lat - 47.6097) < 0.001);
   assert.ok(Math.abs(seattle.lon - -122.3331) < 0.001);
 
-  // `BW` (Bothways) carries no single facing: id-hash fallback at low
+  // `B` (both directions) carries no single facing: id-hash fallback at low
   // confidence, with the low-confidence pose personality.
   const spokane = cameras.find((camera) => camera.id === 'wsdot-9059');
   assert.equal(spokane.headingConfidence, 'low');
@@ -135,7 +140,7 @@ test('WSDOT loader keeps official-host cameras and maps compass directions', asy
   assert.ok(spokane.headingDeg >= 0 && spokane.headingDeg < 360);
 });
 
-test('WSDOT loader maps every documented CompassDirection code', async (t) => {
+test('WSDOT loader maps every CompassDirection code', async (t) => {
   quiet(t);
   withEnv(t, { CCTV_WSDOT_MAX_SOURCES: undefined });
   const codes = {
@@ -150,7 +155,8 @@ test('WSDOT loader maps every documented CompassDirection code', async (t) => {
     // Lower-case and padded codes are the same code.
     ' nw ': 315,
   };
-  const noFacing = ['BW', 'O', null];
+  // The live feed's no-facing codes, plus an unknown one.
+  const noFacing = ['B', 'O', null, 'BW'];
   const entries = [...Object.keys(codes), ...noFacing];
   t.mock.method(globalThis, 'fetch', async () =>
     cp1252Response({
@@ -207,3 +213,90 @@ test('WSDOT loader defaults its cap and survives upstream failure', async (t) =>
   });
   assert.deepEqual(await loadWsdotSourcesFromOpenData(), []);
 });
+
+test('the catalog fetch refuses a redirect and cancels its body', async (t) => {
+  quiet(t);
+  // A redirect is never followed, and its still-open body is cancelled.
+  const seen = [];
+  const state = { cancelled: false };
+  t.mock.method(globalThis, 'fetch', async (url, init) => {
+    seen.push([String(url), init.redirect]);
+    const body = new ReadableStream({
+      start(controller) {
+        controller.enqueue(new TextEncoder().encode('{'));
+      },
+      cancel() {
+        state.cancelled = true;
+      },
+    });
+    return new Response(body, {
+      status: 302,
+      headers: { location: 'https://evil.example/Cameras.json' },
+    });
+  });
+  assert.deepEqual(await loadWsdotSourcesFromOpenData(), []);
+  assert.deepEqual(seen, [[WSDOT_CAMERAS_URL, 'manual']]);
+  assert.equal(state.cancelled, true, 'the redirect body is cancelled');
+});
+
+test('the catalog fetch refuses a body over the byte cap', async (t) => {
+  quiet(t);
+  // A valid catalog padded past the cap is refused rather than buffered.
+  t.mock.method(globalThis, 'fetch', async () => {
+    const text = JSON.stringify({
+      features: [wsdotFeature(1001, 47.6097, -122.3331)],
+    });
+    const padded = text + ' '.repeat(WSDOT_MAX_CATALOG_BYTES);
+    return new Response(
+      new ReadableStream({
+        start(controller) {
+          controller.enqueue(new TextEncoder().encode(padded));
+          controller.close();
+        },
+      }),
+      { headers: { 'Content-Type': 'application/json' } },
+    );
+  });
+  assert.deepEqual(await loadWsdotSourcesFromOpenData(), []);
+});
+
+test('CCTV_WSDOT_ENABLED=0 skips the WSDOT request', async (t) => {
+  quiet(t);
+  const sourceRoot = fs.mkdtempSync(
+    path.join(os.tmpdir(), 'gev-cctv-catalog-'),
+  );
+  t.after(() => fs.rmSync(sourceRoot, { recursive: true, force: true }));
+  withEnv(t, {
+    CCTV_SOURCES_FILE: undefined,
+    CCTV_SOURCES_JSON: undefined,
+    CCTV_FORCE_AUSTIN: undefined,
+    CCTV_PREFER_AUSTIN: undefined,
+    CCTV_MAX_SOURCES: undefined,
+    CCTV_WSDOT_ENABLED: undefined,
+    CCTV_WSDOT_MAX_SOURCES: undefined,
+  });
+  const requested = [];
+  t.mock.method(globalThis, 'fetch', async (url) => {
+    requested.push(String(url));
+    // Every other live pack is down; only WSDOT answers.
+    return String(url) === WSDOT_CAMERAS_URL
+      ? cp1252Response({ features: [wsdotFeature(1001, 47.6097, -122.3331)] })
+      : new Response('unavailable', { status: 503 });
+  });
+
+  const sources = await createCctvCatalog({ sourceRoot })();
+  assert.deepEqual(
+    sources.map((source) => source.id),
+    ['wsdot-1001'],
+  );
+
+  process.env.CCTV_WSDOT_ENABLED = '0';
+  requested.length = 0;
+  assert.deepEqual(await createCctvCatalog({ sourceRoot })(), []);
+  assert.ok(requested.length > 0, 'the other live packs still load');
+  assert.equal(
+    requested.includes(WSDOT_CAMERAS_URL),
+    false,
+    'a disabled pack makes no request',
+  );
+});