Merge main and switch Cesium and Navara in place through Vue

Preserve the camera, map source and layer selection across engine sessions. Restore the previous engine if startup fails and retain local history navigation.

build/application-html.js

@@ -1,40 +0,0 @@
-import { readFileSync } from 'node:fs';
-
-export const APPLICATION_TEMPLATES = Object.freeze([
-  'scene-chrome',
-  'cockpit',
-  'display-controls',
-  'command-dock',
-  'layer-panels',
-  'context',
-  'welcome',
-  'provider-settings',
-  'hud-loading',
-]);
-const allowed = new Set(APPLICATION_TEMPLATES);
-
-/** Expand only known component templates; markers cannot name filesystem paths. */
-export function expandApplicationHtml(html) {
-  return html.replace(
-    /^[ \t]*<!-- gev:template ([^\s]+) -->\r?\n?/gm,
-    (_, name) => {
-      if (!allowed.has(name))
-        throw new Error(`Unknown application template: ${name}`);
-      return readFileSync(
-        new URL(`../src/ui/templates/${name}.html`, import.meta.url),
-        'utf8',
-      );
-    },
-  );
-}
-
-/** Assemble static application markup before Vite processes scripts and assets. */
-export function applicationHtmlPlugin() {
-  return {
-    name: 'application-component-templates',
-    transformIndexHtml: {
-      order: 'pre',
-      handler: expandApplicationHtml,
-    },
-  };
-}

build/registerVue.js

@@ -0,0 +1,8 @@
+import { registerHooks } from 'node:module';
+import { load } from './vueLoader.js';
+
+// Lets Node import single-file components: `node --import=<this file>`.
+// Hosts reach it as `<core package>/build/register-vue`. The hooks run on the
+// loading thread: off-thread hooks (module.register) would add a round trip
+// to every module a test imports, not only the components.
+registerHooks({ load });

build/vite.js

@@ -1,6 +1,7 @@
 import { fileURLToPath } from 'node:url';
-import { applicationHtmlPlugin } from './application-html.js';
 import cesium from 'vite-plugin-cesium';
+import vue from '@vitejs/plugin-vue';
+import { VUE_PLUGIN_OPTIONS } from './vueOptions.js';
 import { DEFAULT_ALLOWED_HOSTS, hostCheckPlugin } from './allowedHosts.js';
 import { embedFramingPlugin } from './embed-framing.js';
 import { panelBuildPlugin } from './panel.js';
@@ -8,6 +9,25 @@ import { navaraChunkFileNames, navaraWorkerAssets } from './navaraAssets.js';
 import { initialChunkGuard } from './initialChunkGuard.js';
 import { navaraOnlyPackages, packagePattern } from './navaraDependencies.js';
 
+/**
+ * The repository root (this file lives at `<root>/build/vite.js`), as a
+ * forward-slash path for glob matching. Vite's `fs.deny` patterns are
+ * matched against the full absolute file path, and a bare `**\/dist/**`
+ * matches a `dist` directory at *any* depth — including dependencies that
+ * ship their own, such as `node_modules/vite/dist/client/client.mjs` (the
+ * dev client itself). Anchoring to this repository's root denies only the
+ * project's own build output.
+ */
+const REPO_ROOT = fileURLToPath(new URL('..', import.meta.url))
+  .replace(/\\/g, '/')
+  .replace(/\/$/, '');
+
+export function escapeFsDenyPath(path) {
+  return path.replace(/[()[\]{}*?!+@|]/g, '\\$&');
+}
+
+const REPO_ROOT_GLOB = escapeFsDenyPath(REPO_ROOT);
+
 /**
  * Content-Security-Policy for every document the dev/preview server serves.
  * No inline script is permitted, and the only foreign script origins are the
@@ -51,6 +71,75 @@ export const BROWSER_HEADERS = Object.freeze({
   'X-Content-Type-Options': 'nosniff',
 });
 
+/**
+ * Content-Security-Policy for every `/api` response. API routes return data,
+ * never a document, so a response opened directly in a tab gets no origin and
+ * can load nothing.
+ */
+export const API_CSP = "default-src 'none'; sandbox";
+
+/** Response headers every `/api` response carries. */
+export const API_HEADERS = Object.freeze({
+  'Content-Security-Policy': API_CSP,
+  'X-Content-Type-Options': 'nosniff',
+});
+
+/**
+ * Whether a request reaches an `/api` mount, by the router's own rule: the
+ * prefix compared without case and followed by the end, `/` or `.`. The router
+ * reads an absolute-form target's path without resolving dot segments, so the
+ * path is taken here the same way (scheme and authority dropped, backslashes as
+ * slashes), alongside the raw and the fully parsed path; any match counts.
+ */
+function isApiPath(url) {
+  const raw = String(url || '/');
+  const target = raw
+    .trim()
+    .split(/[?#]/, 1)[0]
+    .replace(/\\/g, '/')
+    .replace(/^[a-z][a-z0-9+.-]*:(?:\/\/[^/]*)?/i, '');
+  let parsed = '';
+  try {
+    parsed = new URL(raw, 'http://localhost').pathname;
+  } catch {
+    /* the unparsed paths still decide */
+  }
+  return [raw.split(/[?#]/, 1)[0], target, parsed].some((path) =>
+    /^\/api(?:$|[/.])/i.test(path),
+  );
+}
+
+/**
+ * Vite plugin that sets API_HEADERS on every API response before any other
+ * middleware runs, so success, error, partial, refused and unknown-route
+ * answers all carry them. Vite's `server.headers` and `preview.headers` only
+ * reach the documents and assets Vite serves itself. A route may still add
+ * headers; a route's own Content-Security-Policy is sent as an additional
+ * policy, which can only restrict further, never replace this one.
+ */
+export function apiResponseHeadersPlugin() {
+  const install = (server) => {
+    server.middlewares.use((req, res, next) => {
+      if (!isApiPath(req.url)) return next();
+      for (const [name, value] of Object.entries(API_HEADERS))
+        res.setHeader(name, value);
+      const setHeader = res.setHeader.bind(res);
+      res.setHeader = (name, value) =>
+        String(name).toLowerCase() === 'content-security-policy' &&
+        String(value) !== API_CSP
+          ? setHeader(name, `${API_CSP}, ${value}`)
+          : setHeader(name, value);
+      next();
+    });
+  };
+  return {
+    name: 'api-response-headers',
+    enforce: 'pre',
+    configureServer: install,
+    configurePreviewServer: install,
+  };
+}
+
 /** Build browser assets with explicit inputs; never load environment or providers. */
 export function createBrowserViteConfig({
   plugins = [],
@@ -65,10 +154,13 @@ export function createBrowserViteConfig({
 } = {}) {
   return {
     plugins: [
-      // First, so no provider route answers a Host the server does not allow.
+      // First, so every API response, including a Host refusal, carries them.
+      apiResponseHeadersPlugin(),
+      // Next, so no provider route answers a Host the server does not allow.
       hostCheckPlugin(),
       cesium(),
-      applicationHtmlPlugin(),
+      // Application views are Vue single-file components.
+      vue(VUE_PLUGIN_OPTIONS),
       ...plugins,
       embedFramingPlugin(),
       panelBuildPlugin(),
@@ -110,7 +202,19 @@ export function createBrowserViteConfig({
       // build/allowedHosts.js); IP addresses are always accepted.
       allowedHosts: [...allowedHosts],
       fs: {
-        deny: ['.env', '.env.*', '*.{crt,pem}', '**/.git/**', '**/ENVIRONMENT'],
+        deny: [
+          '.env',
+          '.env.*',
+          '*.{crt,pem}',
+          '**/.git/**',
+          '**/ENVIRONMENT',
+          '**/.gev-logs/**',
+          '**/.gev-cache/**',
+          // Root-anchored: a bare '**/dist/**' would also deny every
+          // dependency's own dist/ (e.g. node_modules/vite/dist/client),
+          // breaking /@vite/client and other dev-client assets.
+          `${REPO_ROOT_GLOB}/dist/**`,
+        ],
       },
       // These headers protect the document containing Provider Settings and
       // give the whole page a real Content-Security-Policy (BROWSER_CSP).
@@ -122,6 +226,12 @@ export function createBrowserViteConfig({
     // framing + CSP hardening (one constant, no drift).
     preview: { headers: BROWSER_HEADERS },
     define: {
+      // vue-i18n holds the locale and catalogs; Core formats the messages
+      // (src/ui/i18n.js), so the build drops vue-i18n's message compiler.
+      __VUE_I18N_FULL_INSTALL__: 'false',
+      __VUE_I18N_LEGACY_API__: 'false',
+      __INTLIFY_PROD_DEVTOOLS__: 'false',
+      __INTLIFY_DROP_MESSAGE_COMPILER__: 'true',
       'import.meta.env.GOOGLE_MAPS_API_KEY': JSON.stringify(googleApiKey),
       'import.meta.env.CESIUM_ION_TOKEN': JSON.stringify(cesiumToken),
       // Mapillary client tokens are public by design (see SECURITY.md).

build/vueLoader.js

@@ -0,0 +1,170 @@
+import { createHash, randomBytes } from 'node:crypto';
+import {
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { VUE_TEMPLATE_OPTIONS } from './vueOptions.js';
+
+const require = createRequire(import.meta.url);
+
+// The compiler loads on the first component that is not cached, so a test
+// process that imports no views, or only cached ones, never pays for it.
+let compiler = null;
+const sfcCompiler = () => (compiler ??= require('vue/compiler-sfc'));
+
+/**
+ * Compile a single-file component to an ES module for Node, so unit tests (the
+ * application's and a host's) can import components without a bundler.
+ * Styles are dropped: tests read the global stylesheet separately.
+ */
+export function compileVueModule(source, filename) {
+  const { compileScript, compileTemplate, parse } = sfcCompiler();
+  // The template is parsed with the SFC; parse it as the browser build does.
+  const { descriptor, errors } = parse(source, {
+    filename,
+    templateParseOptions: VUE_TEMPLATE_OPTIONS.compilerOptions,
+  });
+  if (errors.length) throw errors[0];
+  const id = filename;
+  if (descriptor.scriptSetup) {
+    return compileScript(descriptor, {
+      id,
+      inlineTemplate: true,
+      templateOptions: VUE_TEMPLATE_OPTIONS,
+    }).content;
+  }
+  const script = descriptor.script
+    ? compileScript(descriptor, { id, genDefaultAs: '__sfc__' }).content
+    : 'const __sfc__ = {};';
+  let template = '';
+  if (descriptor.template) {
+    const compiled = compileTemplate({
+      source: descriptor.template.content,
+      filename,
+      id,
+      ...VUE_TEMPLATE_OPTIONS,
+    });
+    if (compiled.errors.length) throw compiled.errors[0];
+    template = compiled.code;
+  }
+  return `${script}\n${template}\nif (typeof render === 'function') __sfc__.render = render;\nexport default __sfc__;\n`;
+}
+
+// The loader's own code is part of every key, so a change to how components
+// compile never reuses output from before it.
+let loaderFingerprint = null;
+const fingerprint = () =>
+  (loaderFingerprint ??= createHash('sha256')
+    .update(readFileSync(fileURLToPath(import.meta.url)))
+    .update(readFileSync(new URL('./vueOptions.js', import.meta.url)))
+    .update(require('vue/package.json').version)
+    .digest('hex'));
+
+/**
+ * Where compiled components are kept between test processes, never a
+ * package's own tree (a host's checks refuse files inside Core): the system
+ * temp directory, or on Windows the per-user local app data directory, since
+ * a temp directory there may be shared and its ownership is not checked.
+ * GEV_VUE_CACHE=0 compiles every time.
+ */
+export function vueCacheDirectory(
+  env = process.env,
+  platform = process.platform,
+) {
+  if (env.GEV_VUE_CACHE === '0') return null;
+  if (platform === 'win32') {
+    return env.LOCALAPPDATA ? path.join(env.LOCALAPPDATA, 'gev-vue-sfc') : null;
+  }
+  return path.join(tmpdir(), `gev-vue-sfc-${process.getuid()}`);
+}
+
+/** The cache entry for one component: its path, its text and the loader. */
+export function vueCacheKey(source, filename) {
+  return createHash('sha256')
+    .update(JSON.stringify([fingerprint(), filename]))
+    .update('\0')
+    .update(source)
+    .digest('hex');
+}
+
+/**
+ * Compile a component, reusing a previous process's result for the same text.
+ * A cache that cannot be read or written only costs the compile.
+ */
+export function cachedVueModule(
+  source,
+  filename,
+  directory = vueCacheDirectory(),
+) {
+  if (!directory || !ownCacheDirectory(directory)) {
+    return compileVueModule(source, filename);
+  }
+  const entry = path.join(directory, `${vueCacheKey(source, filename)}.mjs`);
+  try {
+    return readFileSync(entry, 'utf8');
+  } catch {
+    // Not compiled yet.
+  }
+  const compiled = compileVueModule(source, filename);
+  // Concurrent test processes and threads may compile the same component;
+  // each writes its own new file and the rename makes the entry appear whole.
+  const partial = `${entry}.${randomBytes(6).toString('hex')}.tmp`;
+  try {
+    writeFileSync(partial, compiled, { flag: 'wx', mode: 0o600 });
+    renameSync(partial, entry);
+  } catch {
+    // An unwritable directory, or a rename another process holds open,
+    // leaves the cache without this entry.
+    try {
+      rmSync(partial, { force: true });
+    } catch {
+      // A partial file that cannot be removed is only clutter.
+    }
+  }
+  return compiled;
+}
+
+/**
+ * Cached modules run as code, so the directory must be this user's own: a
+ * real directory (not a link), owned by the current user and writable by no
+ * one else. In a shared temp directory another user could otherwise create it
+ * first and plant modules. On Windows it sits in the user's own profile.
+ */
+const checkedDirectories = new Map();
+export function ownCacheDirectory(directory) {
+  if (!checkedDirectories.has(directory)) {
+    checkedDirectories.set(directory, isOwnDirectory(directory));
+  }
+  return checkedDirectories.get(directory);
+}
+
+function isOwnDirectory(directory) {
+  try {
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const stats = lstatSync(directory);
+    if (!stats.isDirectory()) return false;
+    if (process.platform === 'win32') return true;
+    return stats.uid === process.getuid() && (stats.mode & 0o022) === 0;
+  } catch {
+    return false;
+  }
+}
+
+/** Synchronous module hook (module.registerHooks): `.vue` loads compiled. */
+export function load(url, context, nextLoad) {
+  if (!url.endsWith('.vue')) return nextLoad(url, context);
+  const filename = fileURLToPath(url);
+  return {
+    format: 'module',
+    source: cachedVueModule(readFileSync(filename, 'utf8'), filename),
+    shortCircuit: true,
+  };
+}

build/vueOptions.js

@@ -0,0 +1,16 @@
+/**
+ * Template options shared by the browser build, the boundary check and the
+ * unit-test loader. Whitespace between nodes is kept (as a single space) so
+ * an application view renders as its static markup did; Prettier formats
+ * single-file components with strict whitespace sensitivity to match. Asset
+ * URLs such as `/pin.svg` stay literal instead of becoming module imports.
+ */
+export const VUE_TEMPLATE_OPTIONS = Object.freeze({
+  compilerOptions: Object.freeze({ whitespace: 'preserve' }),
+  transformAssetUrls: false,
+});
+
+/** `@vitejs/plugin-vue` options for application builds. */
+export const VUE_PLUGIN_OPTIONS = Object.freeze({
+  template: VUE_TEMPLATE_OPTIONS,
+});