chore(deps): update all non-major dependencies

release v1.1.12 [skip ci]
chore(deps): update all non-major dependencies (#47 )
2026-09-03 13:02:08 +00:00 · 2026-08-23 17:25:46 +00:00 · 2026-08-23 17:25:33 +00:00 · 2026-08-19 02:11:32 +00:00 · 2026-08-19 02:11:19 +00:00 · 2026-08-14 22:27:50 +00:00
72 changed files with 9701 additions and 6778 deletions
@@ -0,0 +1,92 @@
 name: PR
 on:
  pull_request:
 jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: https://git.keligrubb.com/actions/checkout@v7
      - name: Setup Node.js
        uses: https://git.keligrubb.com/actions/setup-node@v7
        with:
          node-version: "24"
          cache: "npm"
      - name: Install dependencies
        run: npm ci
      - name: Run lint
        run: npm run lint
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: https://git.keligrubb.com/actions/checkout@v7
      - name: Setup Node.js
        uses: https://git.keligrubb.com/actions/setup-node@v7
        with:
          node-version: "24"
          cache: "npm"
      - name: Install dependencies
        run: npm ci
      - name: Run tests
        run: npm run test
  e2e:
    runs-on: ubuntu-latest
    container:
      image: mcr.microsoft.com/playwright:v1.62.1-noble
    steps:
      - uses: https://git.keligrubb.com/actions/checkout@v7
      - name: Setup Node.js
        uses: https://git.keligrubb.com/actions/setup-node@v7
        with:
          node-version: "24"
          cache: "npm"
      - name: Install dependencies
        run: npm ci
      - name: Generate dev cert
        run: ./scripts/gen-dev-cert.sh
      - name: Run e2e tests
        run: npm run test:e2e
        env:
          NODE_TLS_REJECT_UNAUTHORIZED: "0"
  docker-build:
    runs-on: ubuntu-latest
    steps:
      - uses: https://git.keligrubb.com/actions/checkout@v7
      - name: Set Docker image tag
        id: image
        run: |
          REGISTRY="${GITHUB_SERVER_URL#https://}"
          REGISTRY="${REGISTRY#http://}"
          echo "tag=${REGISTRY}/${{ github.repository }}:latest" >> $GITHUB_OUTPUT
      - name: Set up Docker Buildx
        uses: https://git.keligrubb.com/actions/docker-setup-buildx-action@v4
      - name: Build (dry run)
        uses: https://git.keligrubb.com/actions/docker-build-push-action@v7
        env:
          # Keeps GITHUB_OUTPUT small; Gitea act-runner can choke on multiline
          # outputs when PR webhook payloads (e.g. Renovate bodies) are huge.
          DOCKER_BUILD_SUMMARY: "false"
          DOCKER_BUILD_RECORD_UPLOAD: "false"
        with:
          context: .
          push: false
          provenance: false
          sbom: false
          tags: ${{ steps.image.outputs.tag }}
@@ -0,0 +1,90 @@
 name: Push
 on:
  push:
    branches: [main]
 jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: https://git.keligrubb.com/actions/checkout@v7
        with:
          token: ${{ secrets.KESTRELOS_REPO_TOKEN }}
      - name: Get PR description for changelog
        env:
          GITEA_REPO_TOKEN: ${{ secrets.KESTRELOS_REPO_TOKEN }}
        run: |
          sudo rm -f /etc/apt/sources.list.d/microsoft*.list /etc/apt/sources.list.d/azure*.list 2>/dev/null || true
          sudo apt-get update -qq && sudo apt-get install -y -qq jq
          RESP=$(curl -sf -H "Authorization: token $GITEA_REPO_TOKEN" \
            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/commits/${{ github.sha }}/pull") || true
          if [ -n "$RESP" ]; then
            echo "$RESP" | jq -r '.body // empty' > .ci_pr_body 2>/dev/null || true
          fi
      - name: Release (bump, tag, push, create release)
        env:
          CI_REPO_OWNER: ${{ github.actor }}
          CI_REPO_NAME: ${{ github.event.repository.name }}
          CI_FORGE_URL: ${{ github.server_url }}
          CI_COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
          GITEA_REPO_TOKEN: ${{ secrets.KESTRELOS_REPO_TOKEN }}
        run: |
          sudo rm -f /etc/apt/sources.list.d/microsoft*.list /etc/apt/sources.list.d/azure*.list 2>/dev/null || true
          sudo apt-get update -qq && sudo apt-get install -y -qq git wget
          ./scripts/release.sh
  publish:
    needs: release
    runs-on: ubuntu-latest
    steps:
      - uses: https://git.keligrubb.com/actions/checkout@v7
        with:
          ref: main
          token: ${{ secrets.KESTRELOS_REPO_TOKEN }}
      - name: Log in to container registry
        uses: https://git.keligrubb.com/actions/docker-login-action@v4
        with:
          registry: git.keligrubb.com
          username: ${{ github.actor }}
          password: ${{ secrets.KESTRELOS_REPO_TOKEN }}
      - name: Set up Docker Buildx
        uses: https://git.keligrubb.com/actions/docker-setup-buildx-action@v4
      - name: Build Docker image
        uses: https://git.keligrubb.com/actions/docker-build-push-action@v7
        with:
          context: .
          load: true
          tags: kestrelos:built
      - name: Push Docker image (version + latest)
        run: |
          VERSION=$(awk '/"version"/ { match($0, /[0-9]+\.[0-9]+\.[0-9]+/); print substr($0, RSTART, RLENGTH); exit }' package.json)
          case "$VERSION" in
            [0-9]*.[0-9]*.[0-9]*) ;;
            *) echo "error: package.json version must be x.y.z (got: $VERSION)"; exit 1 ;;
          esac
          REGISTRY="git.keligrubb.com"
          IMAGE="$REGISTRY/${{ github.repository }}"
          for tag in "$VERSION" latest; do
            docker tag kestrelos:built "$IMAGE:$tag"
            docker push "$IMAGE:$tag"
          done
      - name: Set up Helm
        uses: https://git.keligrubb.com/actions/setup-helm@v5
      - name: Package and push Helm chart
        env:
          GITEA_REPO_TOKEN: ${{ secrets.KESTRELOS_REPO_TOKEN }}
        run: |
          helm package helm/kestrelos
          for f in kestrelos-*.tgz; do
            curl -sf -u "${{ github.actor }}:$GITEA_REPO_TOKEN" -X POST --upload-file "$f" \
              "${{ github.server_url }}/api/packages/${{ github.actor }}/helm/api/charts"
          done
@@ -1 +1 @@
-setups.@nuxt/test-utils="4.0.0"
+setups.@nuxt/test-utils="4.1.0"
@@ -1,41 +0,0 @@
 when:
  - event: pull_request
 steps:
  - name: install
    image: node:24-slim
    depends_on: []
    commands:
      - npm ci
  - name: lint
    image: node:24-slim
    depends_on: [install]
    commands:
      - npm run lint
  - name: test
    image: node:24-slim
    depends_on: [install]
    commands:
      - npm run test
  - name: e2e
    image: mcr.microsoft.com/playwright:v1.58.2-noble
    depends_on: [install]
    commands:
      - ./scripts/gen-dev-cert.sh
      - npm run test:e2e
    environment:
      NODE_TLS_REJECT_UNAUTHORIZED: "0"
  - name: docker-build
    image: woodpeckerci/plugin-kaniko
    depends_on: []
    settings:
      repo: ${CI_REPO_OWNER}/${CI_REPO_NAME}
      registry: git.keligrubb.com
      tags: latest
      dry-run: true
      single-snapshot: true
      cleanup: true
@@ -1,36 +0,0 @@
 when:
  - event: push
    branch: main
 steps:
  - name: release
    image: alpine
    commands:
      - apk add --no-cache git
      - ./scripts/release.sh
    environment:
      GITEA_REPO_TOKEN:
        from_secret: gitea_repo_token
  - name: docker
    image: woodpeckerci/plugin-kaniko
    depends_on: [release]
    settings:
      repo: ${CI_REPO_OWNER}/${CI_REPO_NAME}
      registry: git.keligrubb.com
      username: ${CI_REPO_OWNER}
      password:
        from_secret: gitea_registry_token
      single-snapshot: true
      cleanup: true
  - name: helm
    image: alpine/helm
    depends_on: [release]
    environment:
      GITEA_REGISTRY_TOKEN:
        from_secret: gitea_registry_token
    commands:
      - apk add --no-cache curl
      - helm package helm/kestrelos
      - curl -sf -u $CI_REPO_OWNER:$GITEA_REGISTRY_TOKEN -X POST --upload-file kestrelos-*.tgz https://git.keligrubb.com/api/packages/$CI_REPO_OWNER/helm/api/charts
@@ -1,3 +1,973 @@
 ## [1.1.12] - 2026-08-23
 ### Changed
 - update all non-major dependencies (#47)
 This PR contains the following updates:
 | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
 |---|---|---|---|
 | [@vitest/coverage-v8](https://vitest.dev/guide/coverage) ([source](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8)) | [`4.1.10` → `4.1.11`](https://renovatebot.com/diffs/npm/@vitest%2fcoverage-v8/4.1.10/4.1.11) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@vitest%2fcoverage-v8/4.1.11?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitest%2fcoverage-v8/4.1.10/4.1.11?slim=true) |
 | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | [`5.10.1` → `5.11.0`](https://renovatebot.com/diffs/npm/fast-xml-parser/5.10.1/5.11.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fast-xml-parser/5.11.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-xml-parser/5.10.1/5.11.0?slim=true) |
 | [happy-dom](https://github.com/capricorn86/happy-dom) | [`20.11.2` → `20.11.6`](https://renovatebot.com/diffs/npm/happy-dom/20.11.2/20.11.6) | ![age](https://developer.mend.io/api/mc/badges/age/npm/happy-dom/20.11.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/happy-dom/20.11.2/20.11.6?slim=true) |
 | [hls.js](https://github.com/video-dev/hls.js) | [`1.7.0` → `1.7.1`](https://renovatebot.com/diffs/npm/hls.js/1.7.0/1.7.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/hls.js/1.7.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/hls.js/1.7.0/1.7.1?slim=true) |
 | [mediasoup](https://mediasoup.org) ([source](https://github.com/versatica/mediasoup)) | [`3.24.2` → `3.26.0`](https://renovatebot.com/diffs/npm/mediasoup/3.24.2/3.26.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/mediasoup/3.26.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/mediasoup/3.24.2/3.26.0?slim=true) |
 | [openid-client](https://github.com/panva/openid-client) | [`6.8.5` → `6.8.7`](https://renovatebot.com/diffs/npm/openid-client/6.8.5/6.8.7) | ![age](https://developer.mend.io/api/mc/badges/age/npm/openid-client/6.8.7?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/openid-client/6.8.5/6.8.7?slim=true) |
 | [vitest](https://vitest.dev) ([source](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)) | [`4.1.10` → `4.1.11`](https://renovatebot.com/diffs/npm/vitest/4.1.10/4.1.11) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vitest/4.1.11?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vitest/4.1.10/4.1.11?slim=true) |
 ---
 ### Release Notes
 <details>
 <summary>vitest-dev/vitest (@&#8203;vitest/coverage-v8)</summary>
 ### [`v4.1.11`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.11)
 [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.10...v4.1.11)
 #####    🐞 Bug Fixes
 - Revive global concurrency limit for test lifecycle \[backport to v4]  -  by [@&#8203;sheremet-va](https://github.com/sheremet-va) and [@&#8203;hi-ogawa](https://github.com/hi-ogawa) in [#&#8203;10992](https://github.com/vitest-dev/vitest/issues/10992) [<samp>(5146d)</samp>](https://github.com/vitest-dev/vitest/commit/5146df80b)
 - **browser**:
  - Encode iframeId in tester iframe URL \[backport to v4]  -  by [@&#8203;sheremet-va](https://github.com/sheremet-va), **Pduhard** and **Claude Opus 4.8** in [#&#8203;10955](https://github.com/vitest-dev/vitest/issues/10955) [<samp>(10b2c)</samp>](https://github.com/vitest-dev/vitest/commit/10b2cd201)
  - Trigger playwright/chromium gc on lower disk availability \[backport to v4]  -  by [@&#8203;hi-ogawa](https://github.com/hi-ogawa), **Hiroshi Ogawa** and **OpenCode** in [#&#8203;10951](https://github.com/vitest-dev/vitest/issues/10951) [<samp>(9851d)</samp>](https://github.com/vitest-dev/vitest/commit/9851dbc41)
 - **mocker**:
  - Restrict redirect mocks to the fs allowlist \[backport to v4]  -  by [@&#8203;sheremet-va](https://github.com/sheremet-va) in [#&#8203;10974](https://github.com/vitest-dev/vitest/issues/10974) [<samp>(fe5a1)</samp>](https://github.com/vitest-dev/vitest/commit/fe5a11d3c)
 #####     [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.10...v4.1.11)
 </details>
 <details>
 <summary>NaturalIntelligence/fast-xml-parser (fast-xml-parser)</summary>
 ### [`v5.11.0`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.11.0)
 [Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.10.1...v5.11.0)
 #### What's Changed
 - add support for endIndex in node metadata (5.x edition) by [@&#8203;Wain-PC](https://github.com/Wain-PC) in [#&#8203;850](https://github.com/NaturalIntelligence/fast-xml-parser/pull/850)
 - fix: don't crash on a closing tag with no matching opening tag by [@&#8203;hdimer](https://github.com/hdimer) in [#&#8203;861](https://github.com/NaturalIntelligence/fast-xml-parser/pull/861)
 #### New Contributors
 - [@&#8203;Wain-PC](https://github.com/Wain-PC) made their first contribution in [#&#8203;850](https://github.com/NaturalIntelligence/fast-xml-parser/pull/850)
 - [@&#8203;hdimer](https://github.com/hdimer) made their first contribution in [#&#8203;861](https://github.com/NaturalIntelligence/fast-xml-parser/pull/861)
 **Full Changelog**: <https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.10.1...v5.11.0>
 </details>
 <details>
 <summary>capricorn86/happy-dom (happy-dom)</summary>
 ### [`v20.11.6`](https://github.com/capricorn86/happy-dom/releases/tag/v20.11.6)
 [Compare Source](https://github.com/capricorn86/happy-dom/compare/v20.11.5...v20.11.6)
 ##### :construction\_worker\_man: Patch fixes
 - Updates docs for the global-registrator package - By **[@&#8203;capricorn86](https://github.com/capricorn86)** in task [#&#8203;2300](https://github.com/capricorn86/happy-dom/issues/2300)
 ### [`v20.11.5`](https://github.com/capricorn86/happy-dom/releases/tag/v20.11.5)
 [Compare Source](https://github.com/capricorn86/happy-dom/compare/v20.11.4...v20.11.5)
 ##### :construction\_worker\_man: Patch fixes
 - Allow explicit element types for querySelector (e.g. `querySelector<HTMLInputElement>(".my-input")`) - By **[@&#8203;cyphercodes](https://github.com/cyphercodes)**
 ### [`v20.11.4`](https://github.com/capricorn86/happy-dom/releases/tag/v20.11.4)
 [Compare Source](https://github.com/capricorn86/happy-dom/compare/v20.11.3...v20.11.4)
 ##### :construction\_worker\_man: Patch fixes
 - Fixes the CORS check `fetch()` to match origins instead of host and protocol - By **[@&#8203;rexxars](https://github.com/rexxars)** in task [#&#8203;1490](https://github.com/capricorn86/happy-dom/issues/1490)
 ### [`v20.11.3`](https://github.com/capricorn86/happy-dom/releases/tag/v20.11.3)
 [Compare Source](https://github.com/capricorn86/happy-dom/compare/v20.11.2...v20.11.3)
 ##### :construction\_worker\_man: Patch fixes
 - Make document.links return a live HTMLCollection - By **[@&#8203;bangseongbeom](https://github.com/bangseongbeom)** in task [#&#8203;2299](https://github.com/capricorn86/happy-dom/issues/2299)
 - Copy labels array to prevent mutation of cached querySelectorAll result - By **[@&#8203;mixelburg](https://github.com/mixelburg)** in task [#&#8203;2226](https://github.com/capricorn86/happy-dom/issues/2226)
 </details>
 <details>
 <summary>video-dev/hls.js (hls.js)</summary>
 ### [`v1.7.1`](https://github.com/video-dev/hls.js/releases/tag/v1.7.1)
 [Compare Source](https://github.com/video-dev/hls.js/compare/v1.7.0...v1.7.1)
 ### Summary
 HLS.js v1.7.1 includes bug fixes and improvements over the previous release.
 #### Changes Since The Last Release
 - Fix Interstitial snap-out at live edge and `BUFFER_APPEND_NO_PROGRESS` false positives ([#&#8203;7979](https://github.com/video-dev/hls.js/issues/7979)) [@&#8203;robwalch](https://github.com/robwalch)
 - Workaround issue where `ManagedMediaSource` does not emit "startstreaming" when seeking ([#&#8203;7984](https://github.com/video-dev/hls.js/issues/7984))
 - Fix permanent stall loading fragment-hint parts of encrypted low-latency streams ([#&#8203;7976](https://github.com/video-dev/hls.js/issues/7976)) [@&#8203;zaki699-blip](https://github.com/zaki699-blip)
 - Document decode timebase change in MIGRATING ([#&#8203;7986](https://github.com/video-dev/hls.js/issues/7986)) [@&#8203;robwalch](https://github.com/robwalch)
 #### Demo Page
 <https://26ea065a.hls-js-dev.pages.dev/demo/>
 #### API and Breaking Changes
 No public exports were removed and no runtime behavior changes are required to upgrade from v1.6 to v1.7. TypeScript consumers might see new compile errors where previously loose types have been narrowed. Each is listed with upgrade guidance in the migration guide:
 <https://github.com/video-dev/hls.js/blob/v1.7.0/MIGRATING.md#migrating-from-hlsjs-16-to-17>
 Some exported type dependencies ("eventemitter3", "[@&#8203;svta/cml-cmcd](https://github.com/svta/cml-cmcd)", "[@&#8203;svta/cml-utils](https://github.com/svta/cml-utils)", "[@&#8203;svta/cml-structured-field-values](https://github.com/svta/cml-structured-field-values)") have not been bundled with hls.d.ts. Please file an issue if this is blocking you from upgrading.
 #### Feedback
 Please provide feedback via [Issues in GitHub](https://github.com/video-dev/hls.js/issues/new/choose). For more details on how to contribute to HLS.js, see our [CONTRIBUTING guide](https://github.com/video-dev/hls.js/blob/master/CONTRIBUTING.md).
 </details>
 <details>
 <summary>versatica/mediasoup (mediasoup)</summary>
 ### [`v3.26.0`](https://github.com/versatica/mediasoup/blob/HEAD/CHANGELOG.md#3260)
 [Compare Source](https://github.com/versatica/mediasoup/compare/3.25.0...3.26.0)
 - **Breaking change:** Simulcast and SVC: Limit temporal layer to the preferred one ([PR #&#8203;1892](https://github.com/versatica/mediasoup/pull/1892)).
 ### [`v3.25.0`](https://github.com/versatica/mediasoup/blob/HEAD/CHANGELOG.md#3250)
 [Compare Source](https://github.com/versatica/mediasoup/compare/3.24.2...3.25.0)
 - Worker: Fix undefined behavior in `RtpStreamRecv::UpdateScore()` when no packets were received ([PR #&#8203;1886](https://github.com/versatica/mediasoup/pull/1886)).
 - SCTP: Fix `SackChunk::GetValidatedGapAckBlocks()` returning a bogus gap-ack-block ([PR #&#8203;1891](https://github.com/versatica/mediasoup/pull/1891)).
 - Do not make generated RTCP Sender Reports depend on RTP packet arrival time ([issue #&#8203;1881](https://github.com/versatica/mediasoup/issues/1881)):
  - `RemoteClockOffsetEstimator` class ([PR #&#8203;1882](https://github.com/versatica/mediasoup/pull/1882)).
  - Prepare `RtpStream` classes for capture time based RTCP Sender Reports ([PR #&#8203;1883](https://github.com/versatica/mediasoup/pull/1883), [PR #&#8203;1888](https://github.com/versatica/mediasoup/pull/1888)).
  - `RemoteCaptureTimeEstimator` class ([PR #&#8203;1884](https://github.com/versatica/mediasoup/pull/1884)).
  - Estimate the capture instant of each received RTP packet ([PR #&#8203;1885](https://github.com/versatica/mediasoup/pull/1885)).
  - Generate RTCP Sender Reports based on the capture instant of the media rather than on the packet arrival time ([PR #&#8203;1887](https://github.com/versatica/mediasoup/pull/1887)).
  - `SimulcastProducerStreamManager`: Apply new capture time logic and fix 'abs-capture-time' rewriting ([PR #&#8203;1889](https://github.com/versatica/mediasoup/pull/1889)).
 </details>
 <details>
 <summary>panva/openid-client (openid-client)</summary>
 ### [`v6.8.7`](https://github.com/panva/openid-client/blob/HEAD/CHANGELOG.md#687-2026-08-20)
 [Compare Source](https://github.com/panva/openid-client/compare/v6.8.6...v6.8.7)
 ##### Fixes
 - allow destructuring the claims helper ([38bd8c0](https://github.com/panva/openid-client/commit/38bd8c052a7e1e6d0e2beda14d35fb38b9b26d4c)), references [#&#8203;887](https://github.com/panva/openid-client/issues/887)
 ### [`v6.8.6`](https://github.com/panva/openid-client/blob/HEAD/CHANGELOG.md#686-2026-08-18)
 [Compare Source](https://github.com/panva/openid-client/compare/v6.8.5...v6.8.6)
 ##### Fixes
 - avoid undefined user-agent in fetchProtectedResource ([492c3c3](https://github.com/panva/openid-client/commit/492c3c36aad1ac324661b808b32bc17a35d22665)), references [#&#8203;885](https://github.com/panva/openid-client/issues/885)
 </details>
 ---
 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
 <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zMy4yIiwidXBkYXRlZEluVmVyIjoiNDQuMzkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
 ## [1.1.11] - 2026-08-19
 ### Changed
 - remove unused broadcastToSession export (#45)
 ## Removed
 - `broadcastToSession` from `server/plugins/websocket.js` — an exported but never-imported, never-called dead-code function. Its dependencies (`getSessionConnections`, `addSessionConnection`, `removeSessionConnection`) are retained since they remain actively used for per-session connection tracking within the plugin.
 ## Notes
 - Full repository search confirms zero remaining references to `broadcastToSession`.
 - ESLint passes; full test suite passes (50 files, 406 tests).
 Closes #40
 ## [1.1.10] - 2026-08-14
 ### Changed
 - update dependencies and fix security vulnerabilities (#44)
 ## Summary
 Updates all out-of-date dependencies and applies `npm audit fix` to resolve 14 security vulnerabilities (3 critical, 8 high).
 ### Dependency Updates
 | Package | Current → Latest |
 |---|---|
 | `nuxt` | 4.4.8 → 4.5.2 |
 | `mediasoup` | 3.20.9 → 3.24.2 |
 | `mediasoup-client` | 3.21.0 → 3.22.0 |
 | `hls.js` | 1.6.16 → 1.7.0 |
 | `vue` | 3.5.38 → 3.5.41 |
 | `vue-router` | 5.1.0 → 5.2.0 |
 | `@nuxt/icon` | 2.2.3 → 2.5.0 |
 | `eslint` | 10.5.0 → 10.8.1 |
 | `vitest` / `@vitest/coverage-v8` | 4.1.9 → 4.1.10 |
 | `ws` | 8.21.0 → 8.21.3 |
 | `openid-client` | 6.8.4 → 6.8.5 |
 | `fast-xml-parser` | 5.9.3 → 5.10.1 |
 | `happy-dom` | 20.10.6 → 20.11.2 |
 | `@playwright/test` | 1.61.1 → 1.62.1 |
 | `@nuxt/eslint` | 1.16.0 → 1.17.0 |
 | `@nuxt/test-utils` | 4.0.3 → 4.1.0 |
 | `@iconify-json/tabler` | 1.2.35 → 1.2.38 |
 ### Security Audit Fixes (`npm audit fix`)
 - **`@nuxt/devtools`** (critical): Unauthenticated DevTools RPC allows arbitrary command execution on the developer's host
 - **`tar`** (critical): Multiple process-crash/DoS vulnerabilities via crafted tar archives
 - **`esbuild`** (high): Arbitrary file read when running dev server on Windows
 - **`brace-expansion`** (high): Multiple DoS vectors (memory exhaustion, process hang)
 - **`flatted`** (high): Prototype pollution via `parse()`
 - **`svgo`** (high): `removeScripts` plugin leaves executable scripts intact
 ### Verification
 - All 406 tests pass (3 skipped)
 - Lint clean (`eslint . --max-warnings 0`)
 - `npm audit` reports 0 vulnerabilities
 ## [1.1.9] - 2026-08-13
 ### Changed
 - update dependency fast-xml-parser to v5.10.1 [security] (#42)
 This PR contains the following updates:
 | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
 |---|---|---|---|
 | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | [`5.9.3` → `5.10.1`](https://renovatebot.com/diffs/npm/fast-xml-parser/5.9.3/5.10.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fast-xml-parser/5.10.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-xml-parser/5.9.3/5.10.1?slim=true) |
 ---
 ### fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
 [GHSA-8r6m-32jq-jx6q](https://github.com/advisories/GHSA-8r6m-32jq-jx6q)
 <details>
 <summary>More information</summary>
 #### Details
 ##### Impact
 `fast-xml-parser` processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to `@nodable/entities` through `addInputEntities()`.
 `addInputEntities()` resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation.
 This allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination.
 ##### Workarounds
 - Manually check if multiple DOCTYPEs are not present in input contents
 - Update to v5.10.1
 - Keep `processEntity` flag off
 #### Severity
 - CVSS Score: 8.7 / 10 (High)
 - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`
 #### References
 - [https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q](https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q)
 - [https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f](https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f)
 - [https://github.com/NaturalIntelligence/fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser)
 - [https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1)
 This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-8r6m-32jq-jx6q) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
 </details>
 ---
 ### Release Notes
 <details>
 <summary>NaturalIntelligence/fast-xml-parser (fast-xml-parser)</summary>
 ### [`v5.10.1`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1)
 [Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.10.0...v5.10.1)
 **Full Changelog**: <https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.10.0...v5.10.1>
 ### [`v5.10.0`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.0)
 [Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.9.3...v5.10.0)
 #### What's Changed
 - Bump actions/checkout from 6.0.3 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;849](https://github.com/NaturalIntelligence/fast-xml-parser/pull/849)
 - Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;848](https://github.com/NaturalIntelligence/fast-xml-parser/pull/848)
 **Full Changelog**: <https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.9.3...v5.10.0>
 </details>
 ---
 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
 <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yOC4wIiwidXBkYXRlZEluVmVyIjoiNDQuMjguMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwic2VjdXJpdHkiXX0=-->
 ## [1.1.8] - 2026-08-13
 ### Changed
 - update https://git.keligrubb.com/actions/setup-node action to v7 (#38)
 This PR contains the following updates:
 | Package | Type | Update | Change |
 |---|---|---|---|
 | [https://git.keligrubb.com/actions/setup-node](https://git.keligrubb.com/actions/setup-node) | action | major | `v6` → `v7` |
 ---
 ### Release Notes
 <details>
 <summary>actions/setup-node (https://git.keligrubb.com/actions/setup-node)</summary>
 ### [`v7.0.0`](https://git.keligrubb.com/actions/setup-node/compare/v7...v7)
 [Compare Source](https://git.keligrubb.com/actions/setup-node/compare/v7...v7)
 ### [`v7`](https://git.keligrubb.com/actions/setup-node/compare/v6.5.0...v7)
 [Compare Source](https://git.keligrubb.com/actions/setup-node/compare/v6.5.0...v7)
 </details>
 ---
 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
 <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuNCIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
 ## [1.1.7] - 2026-08-13
 ### Changed
 - update dependency supercluster to v9 (#41)
 This PR contains the following updates:
 | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
 |---|---|---|---|
 | [supercluster](https://github.com/mapbox/supercluster) | [`^8.0.1` → `^9.0.0`](https://renovatebot.com/diffs/npm/supercluster/8.0.1/9.0.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/supercluster/9.0.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/supercluster/8.0.1/9.0.0?slim=true) |
 ---
 ### Release Notes
 <details>
 <summary>mapbox/supercluster (supercluster)</summary>
 ### [`v9.0.0`](https://github.com/mapbox/supercluster/releases/tag/v9.0.0)
 [Compare Source](https://github.com/mapbox/supercluster/compare/v8.0.1...v9.0.0)
 - Radically optimize **memory footprint and performance** — on a sample 1M points index, Supercluster now uses 94% less transient allocation, 57% lower peak heap, 65% less retained memory, and runs 23% faster. [#&#8203;258](https://github.com/mapbox/supercluster/issues/258)
 - Improve internal coordinate precision by 6 bits (64 times).
 - ⚠️ Breaking: hard-cap `maxZoom` at 30 (it wasn't practical to use it on higher zooms anyway).
 - Add support for `MultiPoint` features. [#&#8203;263](https://github.com/mapbox/supercluster/issues/263)
 </details>
 ---
 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
 <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yNy4wIiwidXBkYXRlZEluVmVyIjoiNDQuMjcuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
 ## [1.1.6] - 2026-06-24
 ### Changed
 - Add ADS-B, AIS, and ALPR map layers with live CoT streaming (#36)
 ## Summary
 - **ADS-B & AIS:** OpenSky and AISStream OSINT feeds upsert into the CoT store; tactical tracks still arrive via adsbcot/aiscot on `:8089`. Map clients subscribe via `GET /api/cot/stream` (SSE) with viewport bbox filtering and Air / Surface / Team layer toggles.
 - **ALPR (Flock/OSM):** Toggleable license-plate reader layer sourced from OpenStreetMap, with SQLite cache, Overpass fallback, tiled viewport fetching, and clustered markers with direction cones.
 - **Map performance:** Ring-based tile selection (fixes zoom-out crash), immutable tile cache, incremental marker sync, split cluster load/query, and padded SSE bbox to reduce reconnect churn.
 ## Docs
 - `docs/tracking.md` — ADS-B/AIS accuracy tiers, freshness, self-hosted receivers, optional OSINT API keys
 - `docs/map-and-cameras.md` — ALPR layer and map behavior updates
 ## [1.1.5] - 2026-06-21
 ### Changed
 - update https://git.keligrubb.com/actions/checkout action to v7 (#35)
 This PR contains the following updates:
 | Package | Type | Update | Change |
 |---|---|---|---|
 | [https://git.keligrubb.com/actions/checkout](https://git.keligrubb.com/actions/checkout) | action | major | `v6` → `v7` |
 ---
 ### Release Notes
 <details>
 <summary>actions/checkout (https://git.keligrubb.com/actions/checkout)</summary>
 ### [`v7.0.0`](https://git.keligrubb.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700)
 [Compare Source](https://git.keligrubb.com/actions/checkout/compare/v7...v7)
 - Block checking out fork PR for pull\_request\_target and workflow\_run by [@&#8203;aiqiaoy](https://github.com/aiqiaoy) in [#&#8203;2454](https://github.com/actions/checkout/pull/2454)
 - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2458](https://github.com/actions/checkout/pull/2458)
 - Bump flatted from 3.3.1 to 3.4.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2460](https://github.com/actions/checkout/pull/2460)
 - Bump js-yaml from 4.1.0 to 4.2.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2461](https://github.com/actions/checkout/pull/2461)
 - Bump [@&#8203;actions/core](https://github.com/actions/core) and [@&#8203;actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2459](https://github.com/actions/checkout/pull/2459)
 - upgrade module to esm and update dependencies by [@&#8203;aiqiaoy](https://github.com/aiqiaoy) in [#&#8203;2463](https://github.com/actions/checkout/pull/2463)
 - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2462](https://github.com/actions/checkout/pull/2462)
 ### [`v7`](https://git.keligrubb.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700)
 [Compare Source](https://git.keligrubb.com/actions/checkout/compare/v6.0.3...v7)
 - Block checking out fork PR for pull\_request\_target and workflow\_run by [@&#8203;aiqiaoy](https://github.com/aiqiaoy) in [#&#8203;2454](https://github.com/actions/checkout/pull/2454)
 - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2458](https://github.com/actions/checkout/pull/2458)
 - Bump flatted from 3.3.1 to 3.4.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2460](https://github.com/actions/checkout/pull/2460)
 - Bump js-yaml from 4.1.0 to 4.2.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2461](https://github.com/actions/checkout/pull/2461)
 - Bump [@&#8203;actions/core](https://github.com/actions/core) and [@&#8203;actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2459](https://github.com/actions/checkout/pull/2459)
 - upgrade module to esm and update dependencies by [@&#8203;aiqiaoy](https://github.com/aiqiaoy) in [#&#8203;2463](https://github.com/actions/checkout/pull/2463)
 - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2462](https://github.com/actions/checkout/pull/2462)
 </details>
 ---
 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
 <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzMuNCIsInVwZGF0ZWRJblZlciI6IjQzLjIzMy40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
 ## [1.1.4] - 2026-04-29
 ### Changed
 - update all non-major dependencies (#31)
 This PR contains the following updates:
 | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
 |---|---|---|---|
 | [@vitest/coverage-v8](https://vitest.dev/guide/coverage) ([source](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8)) | [`4.1.4` → `4.1.5`](https://renovatebot.com/diffs/npm/@vitest%2fcoverage-v8/4.1.4/4.1.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@vitest%2fcoverage-v8/4.1.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitest%2fcoverage-v8/4.1.4/4.1.5?slim=true) |
 | [@vue/test-utils](https://github.com/vuejs/test-utils) | [`2.4.6` → `2.4.8`](https://renovatebot.com/diffs/npm/@vue%2ftest-utils/2.4.6/2.4.8) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@vue%2ftest-utils/2.4.8?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vue%2ftest-utils/2.4.6/2.4.8?slim=true) |
 | [eslint](https://eslint.org) ([source](https://github.com/eslint/eslint)) | [`10.2.0` → `10.2.1`](https://renovatebot.com/diffs/npm/eslint/10.2.0/10.2.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/eslint/10.2.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/eslint/10.2.0/10.2.1?slim=true) |
 | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | [`5.6.0` → `5.7.2`](https://renovatebot.com/diffs/npm/fast-xml-parser/5.6.0/5.7.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fast-xml-parser/5.7.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-xml-parser/5.6.0/5.7.2?slim=true) |
 | [mediasoup](https://mediasoup.org) ([source](https://github.com/versatica/mediasoup)) | [`3.19.19` → `3.19.21`](https://renovatebot.com/diffs/npm/mediasoup/3.19.19/3.19.21) | ![age](https://developer.mend.io/api/mc/badges/age/npm/mediasoup/3.19.21?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/mediasoup/3.19.19/3.19.21?slim=true) |
 | [mediasoup-client](https://mediasoup.org) ([source](https://github.com/versatica/mediasoup-client)) | [`3.18.8` → `3.19.0`](https://renovatebot.com/diffs/npm/mediasoup-client/3.18.8/3.19.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/mediasoup-client/3.19.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/mediasoup-client/3.18.8/3.19.0?slim=true) |
 | [vitest](https://vitest.dev) ([source](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)) | [`4.1.4` → `4.1.5`](https://renovatebot.com/diffs/npm/vitest/4.1.4/4.1.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vitest/4.1.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vitest/4.1.4/4.1.5?slim=true) |
 | [vue](https://vuejs.org/) ([source](https://github.com/vuejs/core)) | [`3.5.32` → `3.5.33`](https://renovatebot.com/diffs/npm/vue/3.5.32/3.5.33) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vue/3.5.33?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vue/3.5.32/3.5.33?slim=true) |
 | [vue-router](https://router.vuejs.org) ([source](https://github.com/vuejs/router)) | [`5.0.4` → `5.0.6`](https://renovatebot.com/diffs/npm/vue-router/5.0.4/5.0.6) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vue-router/5.0.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vue-router/5.0.4/5.0.6?slim=true) |
 ---
 ### Release Notes
 <details>
 <summary>vitest-dev/vitest (@&#8203;vitest/coverage-v8)</summary>
 ### [`v4.1.5`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.5)
 [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.4...v4.1.5)
 #####    🚀 Experimental Features
 - **coverage**: Istanbul to support `instrumenter` option  -  by [@&#8203;BartWaardenburg](https://github.com/BartWaardenburg) and [@&#8203;AriPerkkio](https://github.com/AriPerkkio) in [#&#8203;10119](https://github.com/vitest-dev/vitest/issues/10119) [<samp>(0e0ff)</samp>](https://github.com/vitest-dev/vitest/commit/0e0ff41c7)
 #####    🐞 Bug Fixes
 - \--project negation excludes browser instances  -  by [@&#8203;felamaslen](https://github.com/felamaslen) in [#&#8203;10131](https://github.com/vitest-dev/vitest/issues/10131) [<samp>(9423d)</samp>](https://github.com/vitest-dev/vitest/commit/9423dc084)
 - Project color label on html reporter  -  by [@&#8203;hi-ogawa](https://github.com/hi-ogawa) in [#&#8203;10142](https://github.com/vitest-dev/vitest/issues/10142) [<samp>(596f7)</samp>](https://github.com/vitest-dev/vitest/commit/596f73986)
 - Fix `vi.defineHelper` called as object method  -  by [@&#8203;hi-ogawa](https://github.com/hi-ogawa) in [#&#8203;10163](https://github.com/vitest-dev/vitest/issues/10163) [<samp>(122c2)</samp>](https://github.com/vitest-dev/vitest/commit/122c25b5b)
 - Alias `agent` reporter to `minimal`  -  by [@&#8203;sheremet-va](https://github.com/sheremet-va) in [#&#8203;10157](https://github.com/vitest-dev/vitest/issues/10157) [<samp>(663b9)</samp>](https://github.com/vitest-dev/vitest/commit/663b99fe3)
 - Respect diff config options in soft assertions  -  by [@&#8203;Copilot](https://github.com/Copilot), **sheremet-va** and [@&#8203;sheremet-va](https://github.com/sheremet-va) in [#&#8203;8696](https://github.com/vitest-dev/vitest/issues/8696) [<samp>(9787d)</samp>](https://github.com/vitest-dev/vitest/commit/9787dedad)
 - Respect diff config options in soft assertions "  -  by [@&#8203;sheremet-va](https://github.com/sheremet-va) in [#&#8203;8696](https://github.com/vitest-dev/vitest/issues/8696) [<samp>(7dc6d)</samp>](https://github.com/vitest-dev/vitest/commit/7dc6d54fd)
 - **ast-collect**: Recognize \_*vi\_import* prefix in static test discovery  -  by [@&#8203;Yejneshwar](https://github.com/Yejneshwar) in [#&#8203;10129](https://github.com/vitest-dev/vitest/issues/10129) [<samp>(32546)</samp>](https://github.com/vitest-dev/vitest/commit/325463ab2)
 - **coverage**: Descriptive error message when reports directory is removed during test run  -  by [@&#8203;DaveT1991](https://github.com/DaveT1991) and [@&#8203;AriPerkkio](https://github.com/AriPerkkio) in [#&#8203;10117](https://github.com/vitest-dev/vitest/issues/10117) [<samp>(14133)</samp>](https://github.com/vitest-dev/vitest/commit/1413382e1)
 - **snapshot**: Increase default snapshot max output length  -  by [@&#8203;hi-ogawa](https://github.com/hi-ogawa) and **Codex** in [#&#8203;10150](https://github.com/vitest-dev/vitest/issues/10150) [<samp>(21e66)</samp>](https://github.com/vitest-dev/vitest/commit/21e66ff63)
 - **ui**: Fix jsx/tsx syntax highlight  -  by [@&#8203;hi-ogawa](https://github.com/hi-ogawa) in [#&#8203;10152](https://github.com/vitest-dev/vitest/issues/10152) [<samp>(f1b1f)</samp>](https://github.com/vitest-dev/vitest/commit/f1b1f6c7b)
 - **web-worker**: Support MessagePort objects referenced inside postMessage data  -  by [@&#8203;whitphx](https://github.com/whitphx) and **Claude Opus 4.6 (1M context)** in [#&#8203;9927](https://github.com/vitest-dev/vitest/issues/9927) and [#&#8203;10124](https://github.com/vitest-dev/vitest/issues/10124) [<samp>(7ad7d)</samp>](https://github.com/vitest-dev/vitest/commit/7ad7d39af)
 - **api**: Make test-specification options writable  -  by [@&#8203;sheremet-va](https://github.com/sheremet-va) in [#&#8203;10154](https://github.com/vitest-dev/vitest/issues/10154) [<samp>(6abd5)</samp>](https://github.com/vitest-dev/vitest/commit/6abd557b7)
 #####     [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.4...v4.1.5)
 </details>
 <details>
 <summary>vuejs/test-utils (@&#8203;vue/test-utils)</summary>
 ### [`v2.4.8`](https://github.com/vuejs/test-utils/releases/tag/v2.4.8)
 [Compare Source](https://github.com/vuejs/test-utils/compare/v2.4.7...v2.4.8)
 [compare changes](https://github.com/vuejs/test-utils/compare/v2.4.7...v2.4.8)
 ##### 🩹 Fixes
 - Correct declaration entrypoint ([#&#8203;2826](https://github.com/vuejs/test-utils/pull/2826))
 ##### 🤖 CI
 - Enable pkg.pr.new ([#&#8203;2827](https://github.com/vuejs/test-utils/pull/2827))
 ##### ❤️ Contributors
 - Cédric Exbrayat ([@&#8203;cexbrayat](https://github.com/cexbrayat))
 - Daniel Roe ([@&#8203;danielroe](https://github.com/danielroe))
 ### [`v2.4.7`](https://github.com/vuejs/test-utils/releases/tag/v2.4.7)
 [Compare Source](https://github.com/vuejs/test-utils/compare/v2.4.6...v2.4.7)
 [compare changes](https://github.com/vuejs/test-utils/compare/v2.4.6...v2.4.7)
 ##### 🚀 Enhancements
 - Add Chinese docs translation ([#&#8203;2552](https://github.com/vuejs/test-utils/pull/2552))
 - SetData()/shallowMount with initialData for components using the Composition API / <script setup> ([#&#8203;2655](https://github.com/vuejs/test-utils/pull/2655))
 ##### 🩹 Fixes
 - Preserve code from keyboard events ([#&#8203;2434](https://github.com/vuejs/test-utils/pull/2434))
 - Switch browser and require exports definitions ([#&#8203;2501](https://github.com/vuejs/test-utils/pull/2501))
 - Re-add peer dependencies but with wider range ([#&#8203;2511](https://github.com/vuejs/test-utils/pull/2511))
 - Resolve warnings in docs:dev ([30b7491](https://github.com/vuejs/test-utils/commit/30b7491))
 - Resolve TypeScript type errors in .vitepress/config ([#&#8203;2549](https://github.com/vuejs/test-utils/pull/2549))
 - Accept FunctionalComponent<any> as selector ([0bb947f](https://github.com/vuejs/test-utils/commit/0bb947f))
 - Text() misses content for array functional component ([#&#8203;2579](https://github.com/vuejs/test-utils/pull/2579))
 - Use await in test ([c5482b4](https://github.com/vuejs/test-utils/commit/c5482b4))
 - **deps:** Update dependency vue-component-type-helpers to v3 ([#&#8203;2683](https://github.com/vuejs/test-utils/pull/2683))
 - Remove wrapper div when unmount ([#&#8203;2700](https://github.com/vuejs/test-utils/pull/2700))
 - Make mount options slots compatible with noUncheckedIndexedAccess true ([#&#8203;2713](https://github.com/vuejs/test-utils/pull/2713))
 - Add missing peerDependency [@&#8203;vue/compiler-dom](https://github.com/vue/compiler-dom) ([75801ba](https://github.com/vuejs/test-utils/commit/75801ba))
 - **docs:** Declare css module for vitepress typecheck ([ddaca97](https://github.com/vuejs/test-utils/commit/ddaca97))
 ##### 💅 Refactors
 - Enforce consistent usage of type imports ([#&#8203;2734](https://github.com/vuejs/test-utils/pull/2734))
 ##### 📖 Documentation
 - Clarify findComponent vs getComponent ([#&#8203;2435](https://github.com/vuejs/test-utils/pull/2435))
 - Update fr docs ([67064ef](https://github.com/vuejs/test-utils/commit/67064ef))
 - Add note about partial transition stub support ([#&#8203;2431](https://github.com/vuejs/test-utils/pull/2431))
 - Fix missing data at passing data section essentials guide ([dda205e](https://github.com/vuejs/test-utils/commit/dda205e))
 - Fix missing data at passing data section essentials guide fr ([ae2c72c](https://github.com/vuejs/test-utils/commit/ae2c72c))
 - Fix plugin TS declaration example ([#&#8203;2466](https://github.com/vuejs/test-utils/pull/2466))
 - Fixed incorrect checkbox value check ([#&#8203;2495](https://github.com/vuejs/test-utils/pull/2495))
 - Capital letter in sentence fix ([#&#8203;2499](https://github.com/vuejs/test-utils/pull/2499))
 - Import missing DOMWrapper on Implementation of the plugin section ([#&#8203;2519](https://github.com/vuejs/test-utils/pull/2519))
 - Add migration step for deprecated ref syntax in findAllComponents ([#&#8203;2498](https://github.com/vuejs/test-utils/pull/2498))
 - Correct anchor hash links and fix typo ([#&#8203;2551](https://github.com/vuejs/test-utils/pull/2551))
 - Center logo on home ([#&#8203;2559](https://github.com/vuejs/test-utils/pull/2559))
 - **zh-cn:** Review a-crash-course ([#&#8203;2563](https://github.com/vuejs/test-utils/pull/2563))
 - Use code-group for install commands ([#&#8203;2571](https://github.com/vuejs/test-utils/pull/2571))
 - **zh-cn:** Review event-handing.md ([#&#8203;2572](https://github.com/vuejs/test-utils/pull/2572))
 - **zh-cn:** Enhance conditional-rendering.md ([#&#8203;2562](https://github.com/vuejs/test-utils/pull/2562))
 - **zh-cn:** Review easy-to-test ([#&#8203;2567](https://github.com/vuejs/test-utils/pull/2567))
 - **zh-cn:** Review passing-data.md ([#&#8203;2575](https://github.com/vuejs/test-utils/pull/2575))
 - **zh-cn:** Review async-suspense.md ([#&#8203;2576](https://github.com/vuejs/test-utils/pull/2576))
 - **zh:** 优化 API 文档格式和内容 ([#&#8203;2569](https://github.com/vuejs/test-utils/pull/2569))
 - **zh:** 更新 Vitest 模拟日期和计时器的说明 ([#&#8203;2578](https://github.com/vuejs/test-utils/pull/2578))
 - **zh-cn:** Review http-requests.md ([#&#8203;2580](https://github.com/vuejs/test-utils/pull/2580))
 - **zh-cn:** Review forms ([#&#8203;2582](https://github.com/vuejs/test-utils/pull/2582))
 - **zh-cn:** Guide/advanced/slots.md ([#&#8203;2565](https://github.com/vuejs/test-utils/pull/2565))
 - **zh:** Review extending-vtu ([#&#8203;2583](https://github.com/vuejs/test-utils/pull/2583))
 - **zh:** Review index ([#&#8203;2584](https://github.com/vuejs/test-utils/pull/2584))
 - Fix modelValue test example ([85bfdf4](https://github.com/vuejs/test-utils/commit/85bfdf4))
 - Removes broken link from plugins.md ([69bc1ce](https://github.com/vuejs/test-utils/commit/69bc1ce))
 - **zh:** Review transitions, component-instance, and reusability-composition ([#&#8203;2616](https://github.com/vuejs/test-utils/pull/2616))
 - **zh:** Review v-model and vuex ([#&#8203;2617](https://github.com/vuejs/test-utils/pull/2617))
 - **zh:** Review all the rest advanced guide ([#&#8203;2619](https://github.com/vuejs/test-utils/pull/2619))
 - **zh:** Review migration ([#&#8203;2623](https://github.com/vuejs/test-utils/pull/2623))
 - Fix a typo in transitions.md ([#&#8203;2635](https://github.com/vuejs/test-utils/pull/2635))
 - Update crash-course to script setup ([c81aa79](https://github.com/vuejs/test-utils/commit/c81aa79))
 - Update Essentials section to setup (composition api) ([#&#8203;2647](https://github.com/vuejs/test-utils/pull/2647))
 - Typos in examples ([#&#8203;2678](https://github.com/vuejs/test-utils/pull/2678))
 - Typo in easy-to-test.md ([#&#8203;2710](https://github.com/vuejs/test-utils/pull/2710))
 - Add note about mocking requestAnimationFrame for transitions ([2324c65](https://github.com/vuejs/test-utils/commit/2324c65))
 - Updated example TodoApp to script setup ([#&#8203;2727](https://github.com/vuejs/test-utils/pull/2727))
 - Remove "Using data" section from "Conditional Rendering" guide and fix passing data test example ([#&#8203;2743](https://github.com/vuejs/test-utils/pull/2743))
 - Follow-up fixes for the conditional rendering guide ([#&#8203;2744](https://github.com/vuejs/test-utils/pull/2744))
 - Mention shallowMount stub name changes in migration guide ([80e051a](https://github.com/vuejs/test-utils/commit/80e051a))
 - Update conditional rendering documentation to clarify isVisible() usage with attachTo ([#&#8203;2799](https://github.com/vuejs/test-utils/pull/2799))
 - Restore Options API component for data() mounting example ([#&#8203;2804](https://github.com/vuejs/test-utils/pull/2804))
 - Promote Vitest as recommended test runner ([#&#8203;2805](https://github.com/vuejs/test-utils/pull/2805))
 - **api:** Note that setValue does not accept objects on `<select>` ([#&#8203;2819](https://github.com/vuejs/test-utils/pull/2819))
 ##### 🏡 Chore
 - Add api/index.md to docs:translation:compare ([6b8681c](https://github.com/vuejs/test-utils/commit/6b8681c))
 - Remove unnecessary generic arguments ([cfd70c6](https://github.com/vuejs/test-utils/commit/cfd70c6))
 - Ignore TS error in config object ([9d0a618](https://github.com/vuejs/test-utils/commit/9d0a618))
 - Simplify eslint packages ([c1d0ffd](https://github.com/vuejs/test-utils/commit/c1d0ffd))
 - Use eslint v9 with flat config ([2f19fdf](https://github.com/vuejs/test-utils/commit/2f19fdf))
 - Expose Stubs type publicly ([#&#8203;2492](https://github.com/vuejs/test-utils/pull/2492))
 - Update documentation file path ([9c96594](https://github.com/vuejs/test-utils/commit/9c96594))
 - Use pnpm v10 ([e4c2cb3](https://github.com/vuejs/test-utils/commit/e4c2cb3))
 - Pnpm approve build ([81c54e9](https://github.com/vuejs/test-utils/commit/81c54e9))
 - Use github issue forms ([#&#8203;2673](https://github.com/vuejs/test-utils/pull/2673))
 - Exclude class components from test type-checking ([0899008](https://github.com/vuejs/test-utils/commit/0899008))
 - Add explicit coverage include for vitest v4 ([51672b9](https://github.com/vuejs/test-utils/commit/51672b9))
 - Update to prettier v3.7 ([fed9e7c](https://github.com/vuejs/test-utils/commit/fed9e7c))
 - Migrate to oxfmt ([81c1de9](https://github.com/vuejs/test-utils/commit/81c1de9))
 - Migrate to oxlint ([a361908](https://github.com/vuejs/test-utils/commit/a361908))
 - Prepare TypeScript 6 migration settings ([55e1262](https://github.com/vuejs/test-utils/commit/55e1262))
 - Adjust tsd config for TypeScript 6 ([7d23eb5](https://github.com/vuejs/test-utils/commit/7d23eb5))
 - Avoid TypeScript 6 target deprecation warning ([81d063c](https://github.com/vuejs/test-utils/commit/81d063c))
 ##### 🤖 CI
 - Remove node v22 build ([7ebf58d](https://github.com/vuejs/test-utils/commit/7ebf58d))
 - Add node v22 build ([57540ee](https://github.com/vuejs/test-utils/commit/57540ee))
 - Use "pool: threads" instead of vmThreads ([d0cbb54](https://github.com/vuejs/test-utils/commit/d0cbb54))
 - Remove node v18 and add v24 ([fd9cf95](https://github.com/vuejs/test-utils/commit/fd9cf95))
 - Add trusted publishing release workflow ([#&#8203;2825](https://github.com/vuejs/test-utils/pull/2825))
 ##### ❤️ Contributors
 - Lachlan Miller ([@&#8203;lmiller1990](https://github.com/lmiller1990))
 - cexbrayat ([@&#8203;cexbrayat](https://github.com/cexbrayat))
 - Nicolas Bonamy ([@&#8203;nbonamy](https://github.com/nbonamy))
 - KatWorkGit ([@&#8203;KatWorkGit](https://github.com/KatWorkGit))
 - Wouter Kroes ([@&#8203;wouterkroes](https://github.com/wouterkroes))
 - Rama Muhammad Murshal ([@&#8203;ramammurshal](https://github.com/ramammurshal))
 - Evan You ([@&#8203;yyx990803](https://github.com/yyx990803))
 - Vlad Starkovsky ([@&#8203;starkovsky](https://github.com/starkovsky))
 - Joe ([@&#8203;joaoprp](https://github.com/joaoprp))
 - Priyadarshi Kumar ([@&#8203;Psingh132](https://github.com/Psingh132))
 - Sébastien Ronveaux ([@&#8203;sronveaux](https://github.com/sronveaux))
 - Gilliam ([@&#8203;Gi11i4m](https://github.com/Gi11i4m))
 - Baranov Dmytro ([@&#8203;dimas7001](https://github.com/dimas7001))
 - BrendonHenrique ([@&#8203;BrendonHenrique](https://github.com/BrendonHenrique))
 - Lorenz van Herwaarden ([@&#8203;lorenzvanherwaarden](https://github.com/lorenzvanherwaarden))
 - wuzhiqing ([@&#8203;DDDDD12138](https://github.com/DDDDD12138))
 - 阿菜 Cai ([@&#8203;RSS1102](https://github.com/RSS1102))
 - Jinjiang ([@&#8203;Jinjiang](https://github.com/Jinjiang))
 - Kylin ([@&#8203;lxKylin](https://github.com/lxKylin))
 - Qianhe Chen ([@&#8203;chenqianhe](https://github.com/chenqianhe))
 - 时瑶 ([@&#8203;KiritaniAyaka](https://github.com/KiritaniAyaka))
 - h7ml ([@&#8203;h7ml](https://github.com/h7ml))
 - Nicander ([@&#8203;Nicander93](https://github.com/Nicander93))
 - Take-John ([@&#8203;takejohn](https://github.com/takejohn))
 - ilyasherstoboev ([@&#8203;ilyasherstoboev](https://github.com/ilyasherstoboev))
 - aimerie ([@&#8203;aimerie](https://github.com/aimerie))
 - Miguel Rincon ([@&#8203;miguelrincon](https://github.com/miguelrincon))
 - bcastlel ([@&#8203;bcastlel](https://github.com/bcastlel))
 - Claudiu ([@&#8203;sofuxro](https://github.com/sofuxro))
 - Artem Dragunov ([@&#8203;dragunovartem99](https://github.com/dragunovartem99))
 - Robin ([@&#8203;OrbisK](https://github.com/OrbisK))
 - Koen Mertens ([@&#8203;KCMertens](https://github.com/KCMertens))
 - meomking ([@&#8203;CaptainWang98](https://github.com/CaptainWang98))
 - Pepijn Olivier ([@&#8203;pepijnolivier](https://github.com/pepijnolivier))
 - Tomina ([@&#8203;Thomaash](https://github.com/Thomaash))
 - Gareth Jones ([@&#8203;G-Rath](https://github.com/G-Rath))
 - Jerry Hogan ([@&#8203;hdJerry](https://github.com/hdJerry))
 - Marco Pasqualetti ([@&#8203;marcalexiei](https://github.com/marcalexiei))
 - guoxk ([@&#8203;guoxk-me](https://github.com/guoxk-me))
 - kimulaco ([@&#8203;kimulaco](https://github.com/kimulaco))
 - Erwan IQUEL ([@&#8203;Olympus5](https://github.com/Olympus5))
 - Matt Van Horn ([@&#8203;mvanhorn](https://github.com/mvanhorn))
 - Daniel Roe ([@&#8203;danielroe](https://github.com/danielroe))
 </details>
 <details>
 <summary>eslint/eslint (eslint)</summary>
 ### [`v10.2.1`](https://github.com/eslint/eslint/releases/tag/v10.2.1)
 [Compare Source](https://github.com/eslint/eslint/compare/v10.2.0...v10.2.1)
 #### Bug Fixes
 - [`14be92b`](https://github.com/eslint/eslint/commit/14be92b6d1fa0923b8923830f2208e5e2705b002) fix: model generator yield resumption paths in code path analysis ([#&#8203;20665](https://github.com/eslint/eslint/issues/20665)) (sethamus)
 - [`84a19d2`](https://github.com/eslint/eslint/commit/84a19d2c32255db6b9cfc08644a607aae6d5cb62) fix: no-async-promise-executor false positives for shadowed Promise ([#&#8203;20740](https://github.com/eslint/eslint/issues/20740)) (xbinaryx)
 - [`af764af`](https://github.com/eslint/eslint/commit/af764af0ec38225755fbf8a6f207f0c77b595a8d) fix: clarify language and processor validation errors ([#&#8203;20729](https://github.com/eslint/eslint/issues/20729)) (Pixel998)
 - [`e251b89`](https://github.com/eslint/eslint/commit/e251b89a38280973e468a4a9386c138f4f55d10d) fix: update eslint ([#&#8203;20715](https://github.com/eslint/eslint/issues/20715)) (renovate\[bot])
 #### Documentation
 - [`ca92ca0`](https://github.com/eslint/eslint/commit/ca92ca0fb4599e8de1e2fb914e695fe7397cbe63) docs: reuse markdown-it instance for markdown filter ([#&#8203;20768](https://github.com/eslint/eslint/issues/20768)) (Amaresh  S M)
 - [`57d2ee2`](https://github.com/eslint/eslint/commit/57d2ee213305cee0cb55ef08e0480b57396269a9) docs:  Enable Eleventy incremental mode for watch ([#&#8203;20767](https://github.com/eslint/eslint/issues/20767)) (Amaresh  S M)
 - [`c1621b9`](https://github.com/eslint/eslint/commit/c1621b915742276e5f4b25efe790ca62296330dc) docs: fix typos in code-path-analyzer.js ([#&#8203;20700](https://github.com/eslint/eslint/issues/20700)) (Ayush Shukla)
 - [`1418d52`](https://github.com/eslint/eslint/commit/1418d522d10bde1960f4942afb548bc7160ec49e) docs: Update README (GitHub Actions Bot)
 - [`39771e6`](https://github.com/eslint/eslint/commit/39771e6e600f0b0617fdeafff6dd07e4211ffde6) docs: Update README (GitHub Actions Bot)
 - [`71e0469`](https://github.com/eslint/eslint/commit/71e04693def2df57268f08f3072a2749df6bf438) docs: fix incomplete JSDoc param description in no-shadow rule ([#&#8203;20728](https://github.com/eslint/eslint/issues/20728)) (kuldeep kumar)
 - [`22119ce`](https://github.com/eslint/eslint/commit/22119ceb93e28f62262fc1d98ff1b1442d6e2dbf) docs: clarify scope of for-direction rule with dead code examples ([#&#8203;20723](https://github.com/eslint/eslint/issues/20723)) (Amaresh  S M)
 - [`8f3fb77`](https://github.com/eslint/eslint/commit/8f3fb77f122a5641d1833cad5d93f3f54fa3be0b) docs: document `meta.docs.dialects` ([#&#8203;20718](https://github.com/eslint/eslint/issues/20718)) (Pixel998)
 #### Chores
 - [`7ddfea9`](https://github.com/eslint/eslint/commit/7ddfea9c4f62add1588c5c0b0da568c299246383) chore: update dependency prettier to v3.8.2 ([#&#8203;20770](https://github.com/eslint/eslint/issues/20770)) (renovate\[bot])
 - [`fac40e1`](https://github.com/eslint/eslint/commit/fac40e1de2ba7646cc7cd2d3f93fbdd1f8819001) ci: bump pnpm/action-setup from 5.0.0 to 6.0.0 ([#&#8203;20763](https://github.com/eslint/eslint/issues/20763)) (dependabot\[bot])
 - [`7246f92`](https://github.com/eslint/eslint/commit/7246f923332522d8b3d46b6ee646fce88535f3fb) test: add tests for SuppressionsService.load() error handling ([#&#8203;20734](https://github.com/eslint/eslint/issues/20734)) (kuldeep kumar)
 - [`4f34b1e`](https://github.com/eslint/eslint/commit/4f34b1e592b0f63d766d9903998e8e36eb49d3aa) chore: update pnpm/action-setup action to v5 ([#&#8203;20762](https://github.com/eslint/eslint/issues/20762)) (renovate\[bot])
 - [`51080eb`](https://github.com/eslint/eslint/commit/51080eb5c98d619434e4835dbe9f1c6654aca3b8) test: processor service ([#&#8203;20731](https://github.com/eslint/eslint/issues/20731)) (kuldeep kumar)
 - [`e7e1889`](https://github.com/eslint/eslint/commit/e7e1889fca9b6044e08f41b38df20a1ce45808c8) chore: remove stale babel-eslint10 fixture and test  ([#&#8203;20727](https://github.com/eslint/eslint/issues/20727)) (kuldeep kumar)
 - [`4e1a87c`](https://github.com/eslint/eslint/commit/4e1a87cb8fb90e309524bc36bc5f31b9f9cfaa76) test: remove redundant async/await in flat config array tests ([#&#8203;20722](https://github.com/eslint/eslint/issues/20722)) (Pixel998)
 - [`066eabb`](https://github.com/eslint/eslint/commit/066eabb3643b12931f991594969bcc0028f71a5f) test: add rule metadata coverage for `languages` and `docs.dialects` ([#&#8203;20717](https://github.com/eslint/eslint/issues/20717)) (Pixel998)
 </details>
 <details>
 <summary>NaturalIntelligence/fast-xml-parser (fast-xml-parser)</summary>
 ### [`v5.7.2`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.7.2): backward compatibility for numerical external entity, fix #&#8203;705, #&#8203;817
 [Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.7.1...v5.7.2)
 - allow numerical external entity for backward compatibility
 - fix [#&#8203;705](https://github.com/NaturalIntelligence/fast-xml-parser/issues/705): attributesGroupName working with preserveOrder
 - fix [#&#8203;817](https://github.com/NaturalIntelligence/fast-xml-parser/issues/817): stackoverflow when tag expression is very long
 ### [`v5.7.1`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.7.1): upgrade @&#8203;nodable/entities and FXB
 [Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.7.0...v5.7.1)
 - Use `@nodable/entities` v2.1.0
  - breaking changes
    - single entity scan. You're not allowed to use entity value to form another entity name.
    - you cant add numeric external entity
    - entity error message when expantion limit is crossed might change
  - typings are updated for new options related to process entity
  - please follow documentation of `@nodable/entities` for more detail.
  - performance
    - if processEntities is false, then there should not be impact on performance.
    - if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
    - if processEntities is true, and you pass entity decoder separately
      - if no entity then performance should be same as before
      - if there are entities then performance should be increased from past versions
  - ignoreAttributes is not required to be set to set xml version for NCR entity value
 - update 'fast-xml-builder' to sanitize malicious CDATA and comment's content
 ### [`v5.7.0`](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.6.0...v5.7.0)
 [Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.6.0...v5.7.0)
 </details>
 <details>
 <summary>versatica/mediasoup (mediasoup)</summary>
 ### [`v3.19.21`](https://github.com/versatica/mediasoup/blob/HEAD/CHANGELOG.md#31921)
 [Compare Source](https://github.com/versatica/mediasoup/compare/3.19.20...3.19.21)
 - Worker: Fix regression in `DirectTransport` when closing a `DataProducer` or `DataConsumer` ([PR #&#8203;1780](https://github.com/versatica/mediasoup/pull/1780)).
 ### [`v3.19.20`](https://github.com/versatica/mediasoup/blob/HEAD/CHANGELOG.md#31920)
 [Compare Source](https://github.com/versatica/mediasoup/compare/3.19.19...3.19.20)
 - Worker: Add `useBuiltInSctpStack` setting (defaults to `false`) to enable mediasoup built-in SCTP stack ([PR #&#8203;1777](https://github.com/versatica/mediasoup/pull/1777)).
 </details>
 <details>
 <summary>versatica/mediasoup-client (mediasoup-client)</summary>
 ### [`v3.19.0`](https://github.com/versatica/mediasoup-client/compare/3.18.8...3.19.0)
 [Compare Source](https://github.com/versatica/mediasoup-client/compare/3.18.8...3.19.0)
 </details>
 <details>
 <summary>vuejs/core (vue)</summary>
 ### [`v3.5.33`](https://github.com/vuejs/core/blob/HEAD/CHANGELOG.md#3533-2026-04-22)
 [Compare Source](https://github.com/vuejs/core/compare/v3.5.32...v3.5.33)
 ##### Bug Fixes
 - **compiler-sfc:** handle nested :deep in selector pseudos ([#&#8203;14725](https://github.com/vuejs/core/issues/14725)) ([bb9d265](https://github.com/vuejs/core/commit/bb9d265d8dcdde2af824fc01b24f9a7b3169f5fa)), closes [#&#8203;14724](https://github.com/vuejs/core/issues/14724)
 - **reactivity:** unlink effect scopes on out-of-order off ([#&#8203;14734](https://github.com/vuejs/core/issues/14734)) ([e7659be](https://github.com/vuejs/core/commit/e7659beafc5407e892fa70f3f4ade80263b0905d)), closes [#&#8203;14733](https://github.com/vuejs/core/issues/14733)
 - **runtime-dom:** preserve textarea resize dimensions ([#&#8203;14747](https://github.com/vuejs/core/issues/14747)) ([11fb2fd](https://github.com/vuejs/core/commit/11fb2fd4a246e40f6f350701dfea73ec525b4f59)), closes [#&#8203;14741](https://github.com/vuejs/core/issues/14741)
 - **teleport:** don't move teleport children if not mounted ([#&#8203;14702](https://github.com/vuejs/core/issues/14702)) ([6a61f44](https://github.com/vuejs/core/commit/6a61f4452ba1a31fc929cadf8abe3337ac4d3a46)), closes [#&#8203;14701](https://github.com/vuejs/core/issues/14701)
 - **transition:** preserve placeholder for conditional explicit default slots ([#&#8203;14748](https://github.com/vuejs/core/issues/14748)) ([45990ce](https://github.com/vuejs/core/commit/45990cecf4604b2f39c571ab6aefa49d362af36a)), closes [#&#8203;14727](https://github.com/vuejs/core/issues/14727)
 </details>
 <details>
 <summary>vuejs/router (vue-router)</summary>
 ### [`v5.0.6`](https://github.com/vuejs/router/releases/tag/v5.0.6)
 [Compare Source](https://github.com/vuejs/router/compare/v5.0.5...v5.0.6)
 #####    🐞 Bug Fixes
 - Missing closing quote in generated import  -  by [@&#8203;zjy040525](https://github.com/zjy040525) and [@&#8203;posva](https://github.com/posva) in [#&#8203;2688](https://github.com/vuejs/router/issues/2688) [<samp>(32f78)</samp>](https://github.com/vuejs/router/commit/32f78c77)
 #####     [View changes on GitHub](https://github.com/vuejs/router/compare/v5.0.5...v5.0.6)
 ### [`v5.0.5`](https://github.com/vuejs/router/releases/tag/v5.0.5)
 [Compare Source](https://github.com/vuejs/router/compare/v5.0.4...v5.0.5)
 #####    🚀 Features
 - Enable standard schema param parsers  -  by [@&#8203;posva](https://github.com/posva) [<samp>(ea8e3)</samp>](https://github.com/vuejs/router/commit/ea8e3e21)
 - Normalize param parsers once  -  by [@&#8203;posva](https://github.com/posva) [<samp>(48087)</samp>](https://github.com/vuejs/router/commit/480877cc)
 #####    🐞 Bug Fixes
 - Track definePage imports per-file to fix named view race condition  -  by [@&#8203;posva](https://github.com/posva) [<samp>(11191)</samp>](https://github.com/vuejs/router/commit/11191bca)
 - Avoid double decoding hash on string location  -  by [@&#8203;posva](https://github.com/posva) [<samp>(1578c)</samp>](https://github.com/vuejs/router/commit/1578c9e9)
 #####     [View changes on GitHub](https://github.com/vuejs/router/compare/v5.0.4...v5.0.5)
 </details>
 ---
 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
 <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMzIuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE1MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
 ## [1.1.3] - 2026-04-19
 ### Changed
 - update dependency mediasoup-client to v3.18.8 (#30)
 This PR contains the following updates:
 | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
 |---|---|---|---|
 | [mediasoup-client](https://mediasoup.org) ([source](https://github.com/versatica/mediasoup-client)) | [`3.18.7` → `3.18.8`](https://renovatebot.com/diffs/npm/mediasoup-client/3.18.7/3.18.8) | ![age](https://developer.mend.io/api/mc/badges/age/npm/mediasoup-client/3.18.8?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/mediasoup-client/3.18.7/3.18.8?slim=true) |
 ---
 ### Release Notes
 <details>
 <summary>versatica/mediasoup-client (mediasoup-client)</summary>
 ### [`v3.18.8`](https://github.com/versatica/mediasoup-client/compare/3.18.7...3.18.8)
 [Compare Source](https://github.com/versatica/mediasoup-client/compare/3.18.7...3.18.8)
 </details>
 ---
 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
 <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMjkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjEyOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
 ## [1.1.2] - 2026-04-15
 ### Changed
 - Update dependency fast-xml-parser to v5.6.0 (#28)
 This PR contains the following updates:
 | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
 |---|---|---|---|
 | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | [`5.5.12` → `5.6.0`](https://renovatebot.com/diffs/npm/fast-xml-parser/5.5.12/5.6.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fast-xml-parser/5.6.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-xml-parser/5.5.12/5.6.0?slim=true) |
 ---
 ### Release Notes
 <details>
 <summary>NaturalIntelligence/fast-xml-parser (fast-xml-parser)</summary>
 ### [`v5.6.0`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.6.0): use @&#8203;nodable/entities to replace entities
 [Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.12...v5.6.0)
 - No API change
 - No change in performance for basic usage
 - No typing change
 - No config change
 - new dependency
 - breaking: error messages for entities might have been changed.
 -
 **Full Changelog**: <https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.12...v5.6.0>
 </details>
 ---
 ### Configuration
 📅 **Schedule**: (UTC)
 - Branch creation
  - At any time (no schedule defined)
 - Automerge
  - At any time (no schedule defined)
 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
 ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
 🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
 ---
 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
 ---
 This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
 <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMjAuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEyMC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
 ## [1.1.1] - 2026-04-15
 ### Changed
 - split push release/publish and harden workflows (#27)
 ### Added
 * Separate release from Docker/Helm publish
 * enrich releases with PRbodies when available
 * tighten release.sh validation and idempotency
 * trim PR docker-build metadata for act-runner stability
 ## [1.1.0] - 2026-04-15
 ### Changed
 - Update all non-major dependencies (#25)
 ## [1.0.10] - 2026-04-15
 ### Changed
 - Remove npm overrides for tar (#26)
 ## [1.0.9] - 2026-03-24
 ### Changed
 - update https://git.keligrubb.com/actions/setup-helm action to v5 (#23)
 ## [1.0.8] - 2026-03-12
 ### Changed
 - fix release file (#22)
 ## [1.0.7] - 2026-03-06
 ### Changed
 - chore(deps): update docker/build-push-action action to v7 (#19)
 ## [1.0.6] - 2026-03-05
 ### Changed
 - fix docker login during push stage (#18)
 ## [1.0.5] - 2026-03-05
 ### Changed
 - fix deploy pipeline stages for token registry uploads (#17)
 ## [1.0.4] - 2026-03-04
 ### Changed
 - fix deploy pipeline (#15)
 ## [1.0.3] - 2026-02-23
 ### Changed
 - fix(deps): update dependency vue-router to v5 (#12)
 ## [1.0.2] - 2026-02-22
 ### Changed
 - chore(deps): update dependency eslint to v10 (#10)
 ## [1.0.1] - 2026-02-22
 ### Changed
 - chore: Configure Renovate (#7)
@@ -56,7 +56,7 @@ See [docs/live-streaming.md](docs/live-streaming.md) for setup and usage.
 ### ATAK / CoT (Cursor on Target)
-KestrelOS can act as a **TAK Server** so ATAK and iTAK devices connect and share positions. No plugins: in ATAK, add a **Server** connection (host = KestrelOS, port **8089** for CoT). Check **Use Authentication** and enter your **KestrelOS username** and **password** (local users use their login password; OIDC users must set an **ATAK password** once under **Account** in the web app). Devices relay CoT to each other (team members see each other on the ATAK map) and appear on the KestrelOS web map; they drop off after ~90 seconds if no updates. Optional: set `COT_TTL_MS`, `COT_REQUIRE_AUTH`; CoT runs on port 8089 (default).
+KestrelOS can act as a **TAK Server** so ATAK and iTAK devices connect and share positions. No plugins: in ATAK, add a **Server** connection (host = KestrelOS, port **8089** for CoT). Check **Use Authentication** and enter your **KestrelOS username** and **password** (local users use their login password; OIDC users must set an **ATAK password** once under **Account** in the web app). Devices relay CoT to each other (team members see each other on the ATAK map) and appear on the KestrelOS web map; they drop off after ~90 seconds if no updates. CoT runs on port 8089 (default).
 ## Scripts
@@ -74,7 +74,7 @@ Full docs are in the **[docs/](docs/README.md)** directory: [installation](docs/
 ## Configuration
 - **Devices**: Manage cameras/devices via the API (`/api/devices`); see [Map and cameras](docs/map-and-cameras.md). Each device needs `name`, `device_type`, `lat`, `lng`, `stream_url`, and `source_type` (`mjpeg` or `hls`).
- **Environment**: No required env vars for basic run. For production, set `HOST=0.0.0.0` and expose ports 3000 (web/API) and 8089 (CoT). Set `COT_TTL_MS=90000`, `COT_REQUIRE_AUTH=true`. For TLS use `.dev-certs/` or set `COT_SSL_CERT` and `COT_SSL_KEY`.
+- **Environment**: No required env vars for basic run. For production, set `HOST=0.0.0.0` and expose ports 3000 (web/API) and 8089 (CoT). For TLS use `.dev-certs/` or set `COT_SSL_CERT` and `COT_SSL_KEY`.
 - **Authentication**: The login page always offers password sign-in (local). Optionally set `BOOTSTRAP_EMAIL` and `BOOTSTRAP_PASSWORD` before the first run to create the first admin; otherwise a default admin is created and its credentials are printed in the terminal. To also show an OIDC sign-in button, configure `OIDC_ISSUER`, `OIDC_CLIENT_ID`, `OIDC_CLIENT_SECRET`, and optionally `OIDC_LABEL`, `OIDC_REDIRECT_URI`. See [docs/auth.md](docs/auth.md) for local login, OIDC config, and sign up.
 - **Bootstrap admin** (when using local auth): The server initializes the database and runs bootstrap at startup. On first run (no users in the database), it creates the first admin. If you set `BOOTSTRAP_EMAIL` and `BOOTSTRAP_PASSWORD` before starting, that account is created. If you don't set them, a default admin is created (identifier: `admin`) with a random password and the credentials are printed in the terminal-copy them and sign in at `/login`, then change the password or add users via Members. Use **Members** to change roles (admin, leader, member). Only admins can change roles; admins and leaders can edit POIs.
 - **Database**: SQLite file at `data/kestrelos.db` (created automatically). Contains users, sessions, and POIs.
@@ -1,5 +1,5 @@
 <template>
  <NuxtLayout>
-    <NuxtPage :key="$route.path" />
+    <NuxtPage />
  </NuxtLayout>
 </template>
@@ -16,6 +16,9 @@
  .kestrel-btn-secondary { @apply rounded border border-kestrel-border px-4 py-2 text-sm text-kestrel-text transition-colors hover:bg-kestrel-border; }
  .kestrel-context-menu-item { @apply block w-full px-3 py-1.5 text-left text-sm text-kestrel-text transition-colors hover:bg-kestrel-border; }
  .kestrel-context-menu-item-danger { @apply block w-full px-3 py-1.5 text-left text-sm text-red-400 transition-colors hover:bg-kestrel-border; }
  .kestrel-cot-layer-btn { @apply rounded px-1.5 py-0.5 text-kestrel-muted transition-colors hover:text-kestrel-text; }
  .kestrel-cot-layer-btn-active { @apply bg-kestrel-border text-kestrel-accent; }
  .cot-icon-rotatable { @apply inline-flex origin-center; }
  .kestrel-panel-base { @apply flex flex-col border border-kestrel-border bg-kestrel-surface; }
  .kestrel-panel-inline { @apply rounded-lg shadow-glow; }
  .kestrel-panel-overlay { @apply absolute right-0 top-0 z-[1000] h-full w-full border-l shadow-glow md:w-[420px] shadow-glow-panel; }
@@ -84,12 +87,14 @@
 }
 .kestrel-map-container .leaflet-control-zoom,
 .kestrel-map-container .leaflet-control-locate,
 .kestrel-map-container .leaflet-control-alpr,
 .kestrel-map-container .savetiles.leaflet-bar {
  @apply rounded-md overflow-hidden font-mono border border-kestrel-glow shadow-glow-sm;
  border-color: rgba(34, 201, 201, 0.35) !important;
 }
 .kestrel-map-container .leaflet-control-zoom a,
 .kestrel-map-container .leaflet-control-locate,
 .kestrel-map-container .leaflet-control-alpr,
 .kestrel-map-container .savetiles.leaflet-bar a {
  @apply w-8 h-8 leading-8 bg-kestrel-surface text-kestrel-text border-none rounded-none text-lg font-semibold no-underline transition-all duration-150;
  width: 32px !important;
@@ -105,9 +110,14 @@
 }
 .kestrel-map-container .leaflet-control-zoom a:hover,
 .kestrel-map-container .leaflet-control-locate:hover,
 .kestrel-map-container .leaflet-control-alpr:hover,
 .kestrel-map-container .savetiles.leaflet-bar a:hover {
  @apply bg-kestrel-surface-hover text-kestrel-accent shadow-glow-md text-shadow-glow-md;
 }
 .kestrel-map-container .leaflet-control-alpr[aria-pressed="true"] {
  color: #ef4444 !important;
  box-shadow: 0 0 8px rgba(239, 68, 68, 0.45);
 }
 .kestrel-map-container .savetiles.leaflet-bar {
  @apply flex flex-col;
 }
@@ -119,12 +129,38 @@
  padding: 6px 10px !important;
  font-size: 11px !important;
 }
-.kestrel-map-container .leaflet-control-locate {
+.kestrel-map-container .leaflet-control-locate,
 .kestrel-map-container .leaflet-control-alpr {
  @apply flex items-center justify-center p-0 cursor-pointer;
 }
-.kestrel-map-container .leaflet-control-locate svg {
+.kestrel-map-container .leaflet-control-locate svg,
 .kestrel-map-container .leaflet-control-alpr svg {
  color: currentColor;
 }
 .kestrel-map-container .alpr-cone {
  display: inline-flex;
  transform-origin: center center;
 }
 .kestrel-map-container .alpr-cluster-icon {
  background: transparent;
  border: none;
 }
 .kestrel-map-container .alpr-cluster {
  @apply flex items-center justify-center rounded-full bg-red-500/90 font-mono text-xs font-semibold text-white;
  width: 100%;
  height: 100%;
  box-shadow: 0 0 8px rgba(239, 68, 68, 0.5);
 }
 .kestrel-map-container .cot-cluster-icon {
  background: transparent;
  border: none;
 }
 .kestrel-map-container .cot-cluster {
  @apply flex items-center justify-center rounded-full bg-sky-500/90 font-mono text-xs font-semibold text-white;
  width: 100%;
  height: 100%;
  box-shadow: 0 0 8px rgba(56, 189, 248, 0.5);
 }
 .kestrel-map-container .live-session-icon {
  animation: live-pulse 1.5s ease-in-out infinite;
 }
@@ -26,6 +26,11 @@
          :user="user"
          @signout="onLogout"
        />
        <span
          v-else-if="authPending"
          class="inline-block h-8 w-8"
          aria-hidden="true"
        />
        <NuxtLink
          v-else
          to="/login"
@@ -75,7 +80,7 @@ watch(sidebarCollapsed, (v) => {
  }
 })
-const { user, refresh } = useUser()
+const { user, authPending, refresh } = useUser()
 watch(isMobile, (mobile) => {
  if (mobile) drawerOpen.value = false
@@ -47,11 +47,41 @@
      @submit="onPoiSubmit"
      @confirm-delete="confirmDeletePoi"
    />
    <div
      v-if="mapContext"
      class="pointer-events-auto absolute right-3 top-3 z-[1000] flex gap-0.5 rounded border border-kestrel-border bg-kestrel-surface/95 p-0.5 text-xs shadow-glow"
      data-testid="cot-layer-toggles"
    >
      <button
        v-for="layer in COT_LAYERS"
        :key="layer.key"
        type="button"
        class="kestrel-cot-layer-btn"
        :class="{ 'kestrel-cot-layer-btn-active': cotLayers[layer.key] }"
        @click="emit('toggleCotLayer', layer.key)"
      >
        {{ layer.label }}
      </button>
    </div>
  </div>
 </template>
 <script setup>
 import 'leaflet/dist/leaflet.css'
 import {
  createAlprControl,
  createAlprLayer,
  setAlprControlPressed,
  syncAlprLayer,
 } from '~/utils/alprMapLayer.js'
 import {
  createCotLayer,
  getCotClusters,
  loadCotCluster,
  syncCotLayer,
 } from '~/utils/cotMapLayer.js'
 import { clearFeatureMarkers } from '~/utils/mapMarkerSync.js'
 const props = defineProps({
  devices: {
@@ -70,13 +100,25 @@ const props = defineProps({
    type: Array,
    default: () => [],
  },
  cotLayers: {
    type: Object,
    default: () => ({ air: true, surface: true, ground: true }),
  },
  alprMarkers: {
    type: Array,
    default: () => [],
  },
  showAlpr: {
    type: Boolean,
    default: false,
  },
  canEditPois: {
    type: Boolean,
    default: false,
  },
 })
-const emit = defineEmits(['select', 'selectLive', 'refreshPois'])
+const emit = defineEmits(['select', 'selectLive', 'refreshPois', 'boundsChange', 'toggleAlpr', 'toggleCotLayer'])
 const CONTEXT_MENU_EMPTY = Object.freeze({ type: null, poi: null, latlng: null, x: 0, y: 0 })
 const mapRef = ref(null)
 const contextMenuRef = ref(null)
@@ -85,7 +127,9 @@ const mapContext = ref(null)
 const markersRef = ref([])
 const poiMarkersRef = ref({})
 const liveMarkersRef = ref({})
-const cotMarkersRef = ref({})
+const cotLayerRef = ref(null)
 const cotMapView = ref(null)
 const alprLayerRef = ref(null)
 const contextMenu = ref({ ...CONTEXT_MENU_EMPTY })
 const showPoiModal = ref(false)
@@ -104,6 +148,11 @@ const DEFAULT_ZOOM = 17
 const MARKER_ICON_PATH = '/'
 const POI_TOOLTIP_CLASS = 'kestrel-poi-tooltip'
 const POI_ICON_COLORS = { pin: '#22c9c9', flag: '#e53e3e', waypoint: '#a78bfa' }
 const COT_LAYERS = Object.freeze([
  { key: 'air', label: 'Air' },
  { key: 'surface', label: 'Surface' },
  { key: 'ground', label: 'Team' },
 ])
 const ICON_SIZE = 28
@@ -141,14 +190,41 @@ function getLiveSessionIcon(L) {
  })
 }
-const COT_ICON_COLOR = '#f59e0b' /* amber - ATAK/CoT devices */
+function refreshCotMapView(map) {
-function getCotEntityIcon(L) {
+  const bounds = map.getBounds()
-  const html = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="${COT_ICON_COLOR}" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="9"/><circle cx="12" cy="8" r="2.5" fill="${COT_ICON_COLOR}"/></svg>`
+  cotMapView.value = {
-  return L.divIcon({
+    south: bounds.getSouth(),
-    className: 'poi-div-icon cot-entity-icon',
+    west: bounds.getWest(),
-    html: `<span class="poi-icon-svg">${html}</span>`,
+    north: bounds.getNorth(),
-    iconSize: [ICON_SIZE, ICON_SIZE],
+    east: bounds.getEast(),
-    iconAnchor: [ICON_SIZE / 2, ICON_SIZE],
+    zoom: map.getZoom(),
  }
 }
 function renderCotLayer() {
  const ctx = mapContext.value
  const { L } = leafletRef.value || {}
  const layer = cotLayerRef.value
  if (!ctx?.map || !L || !layer) return
  const view = cotMapView.value
  const features = view ? getCotClusters(view) : []
  syncCotLayer(L, ctx.map, layer, features)
 }
 function reloadCotCluster() {
  loadCotCluster(props.cotEntities || [])
  renderCotLayer()
 }
 function emitBounds(map) {
  refreshCotMapView(map)
  const bounds = map.getBounds()
  emit('boundsChange', {
    south: bounds.getSouth(),
    west: bounds.getWest(),
    north: bounds.getNorth(),
    east: bounds.getEast(),
    zoom: map.getZoom(),
  })
 }
@@ -160,7 +236,7 @@ function createMap(initialCenter) {
    ? initialCenter
    : DEFAULT_VIEW
-  const map = L.map(mapRef.value, { zoomControl: false, attributionControl: false }).setView(center, DEFAULT_ZOOM)
+  const map = L.map(mapRef.value, { zoomControl: false, attributionControl: false, minZoom: 1, maxZoom: 19 }).setView(center, DEFAULT_ZOOM)
  L.control.zoom({ position: 'topleft' }).addTo(map)
  const locateControl = L.control({ position: 'topleft' })
@@ -186,6 +262,14 @@ function createMap(initialCenter) {
  }
  locateControl.addTo(map)
  const alprControl = createAlprControl(L, {
    showAlpr: props.showAlpr,
    onToggle: () => emit('toggleAlpr'),
  })
  alprControl.addTo(map)
  const alprLayer = createAlprLayer(L, map)
  const cotLayer = createCotLayer(L, map)
  const baseLayer = L.tileLayer(TILE_URL, {
    attribution: ATTRIBUTION,
    subdomains: TILE_SUBDOMAINS,
@@ -214,12 +298,28 @@ function createMap(initialCenter) {
    contextMenu.value = { type: 'map', latlng: e.latlng, x: pt.x, y: pt.y }
  })
-  mapContext.value = { map, layer: baseLayer, control, locateControl }
+  map.on('moveend', () => {
    emitBounds(map)
    renderCotLayer()
  })
  map.on('zoomend', () => {
    emitBounds(map)
    renderCotLayer()
  })
  mapContext.value = { map, layer: baseLayer, control, locateControl, alprControl }
  alprLayerRef.value = alprLayer
  cotLayerRef.value = cotLayer
  refreshCotMapView(map)
  updateMarkers()
  updatePoiMarkers()
  updateLiveMarkers()
-  updateCotMarkers()
+  reloadCotCluster()
-  nextTick(() => map.invalidateSize())
+  updateAlprLayer()
  nextTick(() => {
    map.invalidateSize()
    emitBounds(map)
  })
 }
 function updateMarkers() {
@@ -309,37 +409,16 @@ function updateLiveMarkers() {
  liveMarkersRef.value = next
 }
-function updateCotMarkers() {
+function updateAlprLayer() {
  const ctx = mapContext.value
  const { L } = leafletRef.value || {}
-  if (!ctx?.map || !L) return
+  const layer = alprLayerRef.value
-
+  if (!ctx?.map || !L || !layer) return
-  const entities = (props.cotEntities || []).filter(
+  if (!props.showAlpr) {
-    e => typeof e?.lat === 'number' && typeof e?.lng === 'number' && e?.id,
+    clearFeatureMarkers(layer)
-  )
+    return
-  const byId = Object.fromEntries(entities.map(e => [e.id, e]))
+  }
-  const prev = cotMarkersRef.value
+  syncAlprLayer(L, ctx.map, layer, props.alprMarkers || [])
  const icon = getCotEntityIcon(L)
  Object.keys(prev).forEach((id) => {
    if (!byId[id]) prev[id]?.remove()
  })
  const next = entities.reduce((acc, entity) => {
    const content = `<div class="kestrel-live-popup"><strong>${escapeHtml(entity.label || entity.id)}</strong> <span class="text-kestrel-muted">ATAK</span></div>`
    const existing = prev[entity.id]
    if (existing) {
      existing.setLatLng([entity.lat, entity.lng])
      existing.setIcon(icon)
      existing.getPopup()?.setContent(content)
      return { ...acc, [entity.id]: existing }
    }
    const marker = L.marker([entity.lat, entity.lng], { icon })
      .addTo(ctx.map)
      .bindPopup(content, { className: 'kestrel-live-popup-wrap', maxWidth: 360 })
    return { ...acc, [entity.id]: marker }
  }, {})
  cotMarkersRef.value = next
 }
 function escapeHtml(text) {
@@ -427,17 +506,22 @@ function destroyMap() {
  poiMarkersRef.value = {}
  Object.values(liveMarkersRef.value).forEach(m => m?.remove())
  liveMarkersRef.value = {}
-  Object.values(cotMarkersRef.value).forEach(m => m?.remove())
+  clearFeatureMarkers(cotLayerRef.value)
-  cotMarkersRef.value = {}
+  clearFeatureMarkers(alprLayerRef.value)
  const ctx = mapContext.value
  if (ctx) {
    if (ctx.control && ctx.map) ctx.map.removeControl(ctx.control)
    if (ctx.locateControl && ctx.map) ctx.map.removeControl(ctx.locateControl)
    if (ctx.alprControl && ctx.map) ctx.map.removeControl(ctx.alprControl)
    if (cotLayerRef.value && ctx.map) ctx.map.removeLayer(cotLayerRef.value)
    if (alprLayerRef.value && ctx.map) ctx.map.removeLayer(alprLayerRef.value)
    if (ctx.layer && ctx.map) ctx.map.removeLayer(ctx.layer)
    if (ctx.map) ctx.map.remove()
    mapContext.value = null
  }
  cotLayerRef.value = null
  alprLayerRef.value = null
 }
 function initMapWithLocation() {
@@ -503,5 +587,11 @@ onBeforeUnmount(() => {
 watch(() => props.devices, () => updateMarkers(), { deep: true })
 watch([() => props.pois, () => props.canEditPois], () => updatePoiMarkers(), { deep: true })
 watch(() => props.liveSessions, () => updateLiveMarkers(), { deep: true })
-watch(() => props.cotEntities, () => updateCotMarkers(), { deep: true })
+watch(() => props.cotEntities, () => reloadCotCluster())
 watch(() => props.alprMarkers, () => updateAlprLayer())
 watch(() => props.showAlpr, (enabled) => {
  setAlprControlPressed(mapContext.value?.alprControl, enabled)
  if (enabled && mapContext.value?.map) emitBounds(mapContext.value.map)
  else updateAlprLayer()
 })
 </script>
@@ -0,0 +1,146 @@
 import { createClusterIndex } from '~/utils/mapCluster.js'
 import {
  MAX_BBOX_DEGREES,
  bboxFetchKey,
  bboxToTileKey,
  tileKey,
  tilesNearCenter,
 } from '~/utils/alprViewport.js'
 const STORAGE_KEY = 'kestrelos:showAlprLayer'
 const MIN_FETCH_ZOOM = 10
 const MAX_TILE_FETCHES = 16
 const MAX_CACHED_TILES = 64
 const TILE_RETENTION = 3
 const EMPTY_TILES = Object.freeze({})
 const mergeFeatures = lists => Object.values(
  lists.flat().reduce((acc, feature) => {
    const id = feature.id ?? feature.properties?.osmId
    return id == null ? acc : { ...acc, [id]: feature }
  }, {}),
 )
 const offsets = radius => Array.from({ length: 2 * radius + 1 }, (_, i) => i - radius)
 const retentionKeys = bounds => new Set(
  tilesNearCenter(bounds, MAX_TILE_FETCHES).flatMap((tile) => {
    const r0 = Math.floor(tile.south / MAX_BBOX_DEGREES)
    const c0 = Math.floor(tile.west / MAX_BBOX_DEGREES)
    return offsets(TILE_RETENTION).flatMap(dr =>
      offsets(TILE_RETENTION).map(dc => tileKey(r0 + dr, c0 + dc)),
    )
  }),
 )
 const pruneTileCache = (cache, bounds) => {
  const keep = retentionKeys(bounds)
  const retained = Object.fromEntries(
    Object.entries(cache).filter(([key]) => keep.has(key)),
  )
  const overflow = Object.keys(retained).length - MAX_CACHED_TILES
  if (overflow <= 0) return Object.freeze(retained)
  const cr = Math.floor((bounds.south + bounds.north) / 2 / MAX_BBOX_DEGREES)
  const cc = Math.floor((bounds.west + bounds.east) / 2 / MAX_BBOX_DEGREES)
  const drop = new Set(
    Object.keys(retained)
      .map((key) => {
        const [r, c] = key.split(',').map(Number)
        return { key, dist: Math.hypot(r - cr, c - cc) }
      })
      .sort((a, b) => b.dist - a.dist)
      .slice(0, overflow)
      .map(({ key }) => key),
  )
  return Object.freeze(
    Object.fromEntries(Object.entries(retained).filter(([key]) => !drop.has(key))),
  )
 }
 const cacheChanged = (before, after) => Object.keys(before).length !== Object.keys(after).length
 export function useAlprCameras() {
  const showAlpr = useState('showAlprLayer', () => {
    if (!import.meta.client) return true
    return localStorage.getItem(STORAGE_KEY) !== '0'
  })
  const view = ref(null)
  const tiles = ref(EMPTY_TILES)
  const cluster = createClusterIndex({ radius: 50, maxZoom: 17 })
  const debounceTimer = ref(null)
  const requestId = ref(0)
  const lastFetchKey = ref('')
  const applyTiles = (next) => {
    tiles.value = next
    cluster.load(mergeFeatures(Object.values(next)))
  }
  watch(showAlpr, (enabled) => {
    if (import.meta.client) localStorage.setItem(STORAGE_KEY, enabled ? '1' : '0')
    if (!enabled) {
      applyTiles(EMPTY_TILES)
      view.value = null
      lastFetchKey.value = ''
    }
  })
  const alprMarkers = computed(() => view.value ? cluster.query(view.value) : [])
  const toggleAlpr = () => {
    showAlpr.value = !showAlpr.value
  }
  const onBoundsChange = (bounds) => {
    if (!showAlpr.value || !bounds) return
    view.value = bounds
    const pruned = pruneTileCache(tiles.value, bounds)
    if (cacheChanged(tiles.value, pruned)) applyTiles(pruned)
    if ((bounds.zoom ?? 14) < MIN_FETCH_ZOOM) return
    const key = bboxFetchKey(bounds)
    if (key === lastFetchKey.value) return
    if (debounceTimer.value) clearTimeout(debounceTimer.value)
    debounceTimer.value = setTimeout(() => {
      lastFetchKey.value = key
      fetchViewport(bounds)
    }, 400)
  }
  const fetchViewport = async (bounds) => {
    const id = requestId.value + 1
    requestId.value = id
    const missing = tilesNearCenter(bounds, MAX_TILE_FETCHES)
      .filter(tile => !(bboxToTileKey(tile) in tiles.value))
    try {
      const fetched = missing.length
        ? await Promise.all(missing.map(async (tile) => {
            const params = new URLSearchParams({
              south: String(tile.south),
              west: String(tile.west),
              north: String(tile.north),
              east: String(tile.east),
            })
            const data = await $fetch(`/api/alpr?${params}`).catch(() => null)
            return [bboxToTileKey(tile), data?.features ?? []]
          }))
        : []
      if (id !== requestId.value) return
      const merged = Object.freeze({
        ...tiles.value,
        ...Object.fromEntries(fetched),
      })
      const pruned = pruneTileCache(merged, bounds)
      applyTiles(pruned)
    }
    catch { /* keep last good index */ }
  }
  return Object.freeze({ showAlpr, toggleAlpr, alprMarkers, onBoundsChange })
 }
@@ -1,6 +1,6 @@
 /** Fetches devices + live sessions; polls when tab visible. */
 const POLL_MS = 1500
-const EMPTY_RESPONSE = Object.freeze({ devices: [], liveSessions: [], cotEntities: [] })
+const EMPTY_RESPONSE = Object.freeze({ devices: [], liveSessions: [] })
 export function useCameras(options = {}) {
  const { poll: enablePoll = true } = options
@@ -12,7 +12,6 @@ export function useCameras(options = {}) {
  const devices = computed(() => Object.freeze([...(data.value?.devices ?? [])]))
  const liveSessions = computed(() => Object.freeze([...(data.value?.liveSessions ?? [])]))
  const cotEntities = computed(() => Object.freeze([...(data.value?.cotEntities ?? [])]))
  const cameras = computed(() => Object.freeze([...devices.value, ...liveSessions.value]))
  const pollInterval = ref(null)
@@ -37,5 +36,5 @@ export function useCameras(options = {}) {
  })
  onBeforeUnmount(stopPolling)
-  return Object.freeze({ data, devices, liveSessions, cotEntities, cameras, refresh, startPolling, stopPolling })
+  return Object.freeze({ data, devices, liveSessions, cameras, refresh, startPolling, stopPolling })
 }
@@ -0,0 +1,48 @@
 const STORAGE_KEY = 'kestrel-cot-layers'
 const DEFAULT_LAYERS = Object.freeze({ air: true, surface: true, ground: true })
 function loadLayers() {
  if (typeof localStorage === 'undefined') return { ...DEFAULT_LAYERS }
  try {
    const raw = localStorage.getItem(STORAGE_KEY)
    if (!raw) return { ...DEFAULT_LAYERS }
    const parsed = JSON.parse(raw)
    return {
      air: parsed.air !== false,
      surface: parsed.surface !== false,
      ground: parsed.ground !== false,
    }
  }
  catch {
    return { ...DEFAULT_LAYERS }
  }
 }
 function saveLayers(layers) {
  if (typeof localStorage === 'undefined') return
  try {
    localStorage.setItem(STORAGE_KEY, JSON.stringify(layers))
  }
  catch { /* ignore quota */ }
 }
 export function useCotLayers() {
  const layers = ref(loadLayers())
  const layerQuery = computed(() => {
    const parts = []
    if (layers.value.air) parts.push('air')
    if (layers.value.surface) parts.push('surface')
    if (layers.value.ground) parts.push('ground')
    return parts.length ? parts.join(',') : 'none'
  })
  function toggleLayer(name) {
    if (!(name in DEFAULT_LAYERS)) return
    layers.value = { ...layers.value, [name]: !layers.value[name] }
    saveLayers(layers.value)
  }
  return Object.freeze({ layers, layerQuery, toggleLayer })
 }
@@ -0,0 +1,117 @@
 import { bboxFetchKey } from '~/utils/alprViewport.js'
 const DEBOUNCE_MS = 300
 const EMPTY_ENTITIES = Object.freeze({})
 const expandBounds = (bounds, factor = 0.25) => {
  const latPad = (bounds.north - bounds.south) * factor
  const lngPad = (bounds.east - bounds.west) * factor
  return {
    south: Math.max(-90, bounds.south - latPad),
    north: Math.min(90, bounds.north + latPad),
    west: bounds.west - lngPad,
    east: bounds.east + lngPad,
  }
 }
 const entitiesFromList = list => Object.freeze(
  Object.fromEntries(
    (list ?? []).filter(entity => entity?.id).map(entity => [entity.id, entity]),
  ),
 )
 export function useCotStream(boundsRef, layerQueryRef) {
  const entities = ref(EMPTY_ENTITIES)
  const cotEntities = computed(() => Object.freeze(Object.values(entities.value)))
  const eventSource = ref(null)
  const debounceTimer = ref(null)
  const subscribedKey = ref('')
  const streamBounds = ref(null)
  const setEntities = (record) => {
    entities.value = Object.freeze(record)
  }
  const parseEvent = (e, fn) => {
    try {
      fn(JSON.parse(e.data))
    }
    catch { /* ignore */ }
  }
  const closeStream = () => {
    eventSource.value?.close()
    eventSource.value = null
  }
  const connect = () => {
    if (typeof window === 'undefined' || typeof EventSource === 'undefined') return
    const bounds = streamBounds.value ?? boundsRef.value
    if (!bounds) return
    closeStream()
    const q = new URLSearchParams({
      bbox: `${bounds.west},${bounds.south},${bounds.east},${bounds.north}`,
      layers: unref(layerQueryRef) || 'air,surface,ground',
    })
    const es = new EventSource(`/api/cot/stream?${q}`)
    eventSource.value = es
    es.addEventListener('snapshot', e => parseEvent(e, ({ entities: list }) => {
      setEntities(entitiesFromList(list))
    }))
    es.addEventListener('update', e => parseEvent(e, ({ entity }) => {
      if (!entity?.id) return
      setEntities({ ...entities.value, [entity.id]: entity })
    }))
    es.addEventListener('remove', e => parseEvent(e, ({ id }) => {
      if (!id) return
      setEntities(Object.fromEntries(
        Object.entries(entities.value).filter(([key]) => key !== String(id)),
      ))
    }))
    es.onerror = () => {
      closeStream()
      scheduleConnect()
    }
  }
  const scheduleConnect = () => {
    if (debounceTimer.value) clearTimeout(debounceTimer.value)
    debounceTimer.value = setTimeout(() => {
      debounceTimer.value = null
      if (typeof document !== 'undefined' && document.visibilityState === 'hidden') return
      connect()
    }, DEBOUNCE_MS)
  }
  const maybeReconnect = (bounds) => {
    if (!bounds) return
    const key = bboxFetchKey(bounds)
    if (key === subscribedKey.value) return
    subscribedKey.value = key
    streamBounds.value = expandBounds(bounds)
    scheduleConnect()
  }
  watch(boundsRef, maybeReconnect, { deep: true })
  watch(layerQueryRef, () => {
    subscribedKey.value = ''
    scheduleConnect()
  })
  onMounted(() => {
    if (typeof document === 'undefined') return
    document.addEventListener('visibilitychange', () => {
      document.visibilityState === 'visible' ? scheduleConnect() : closeStream()
    })
    if (document.visibilityState === 'visible') maybeReconnect(boundsRef.value)
  })
  onBeforeUnmount(() => {
    if (debounceTimer.value) clearTimeout(debounceTimer.value)
    closeStream()
  })
  return Object.freeze({ cotEntities })
 }
@@ -2,12 +2,13 @@ const EDIT_ROLES = Object.freeze(['admin', 'leader'])
 export function useUser() {
  const requestFetch = useRequestFetch()
-  const { data: user, refresh } = useAsyncData(
+  const { data: user, refresh, status } = useAsyncData(
    'user',
    () => (requestFetch ?? $fetch)('/api/me').catch(() => null),
    { default: () => null },
  )
  const authPending = computed(() => status.value === 'pending')
  const canEditPois = computed(() => EDIT_ROLES.includes(user.value?.role))
  const isAdmin = computed(() => user.value?.role === 'admin')
-  return Object.freeze({ user, canEditPois, isAdmin, refresh })
+  return Object.freeze({ user, authPending, canEditPois, isAdmin, refresh })
 }
@@ -3,7 +3,7 @@ const LOGIN_PATH = '/login'
 export default defineNuxtRouteMiddleware(async (to) => {
  if (to.path === LOGIN_PATH) return
  const { user, refresh } = useUser()
-  await refresh()
+  if (!user.value) await refresh()
  if (user.value) return
  const redirect = to.fullPath.startsWith('/') ? to.fullPath : `/${to.fullPath}`
  return navigateTo({ path: LOGIN_PATH, query: { redirect } }, { replace: true })
@@ -7,11 +7,23 @@
          :pois="pois ?? []"
          :live-sessions="liveSessions ?? []"
          :cot-entities="cotEntities ?? []"
          :cot-layers="cotLayers"
          :alpr-markers="showAlpr ? (alprMarkers ?? []) : []"
          :show-alpr="showAlpr"
          :can-edit-pois="canEditPois"
          @select="selectedCamera = $event"
          @select-live="onSelectLive($event)"
          @refresh-pois="refreshPois"
          @bounds-change="onMapBoundsChange"
          @toggle-alpr="toggleAlpr"
          @toggle-cot-layer="toggleLayer"
        />
        <template #fallback>
          <div
            class="h-full min-h-[300px] bg-kestrel-bg"
            aria-hidden="true"
          />
        </template>
      </ClientOnly>
    </div>
    <CameraViewer
@@ -23,11 +35,20 @@
 </template>
 <script setup>
-const { devices, liveSessions, cotEntities } = useCameras()
+const { devices, liveSessions } = useCameras()
 const { data: pois, refresh: refreshPois } = usePois()
 const { canEditPois } = useUser()
 const { showAlpr, toggleAlpr, alprMarkers, onBoundsChange: onAlprBoundsChange } = useAlprCameras()
 const { layers: cotLayers, layerQuery, toggleLayer } = useCotLayers()
 const mapBounds = ref(null)
 const { cotEntities } = useCotStream(mapBounds, layerQuery)
 const selectedCamera = ref(null)
 function onMapBoundsChange(bounds) {
  mapBounds.value = bounds
  onAlprBoundsChange(bounds)
 }
 function onSelectLive(session) {
  selectedCamera.value = (liveSessions.value ?? []).find(s => s.id === session?.id) ?? session
 }
@@ -0,0 +1,220 @@
 import { syncFeatureMarkers } from './mapMarkerSync.js'
 const ICON_SIZE = 28
 const CONE_SIZE = 52
 const ALPR_COLOR = '#ef4444'
 const DEFAULT_FOV = 60
 function escapeHtml(text) {
  const div = document.createElement('div')
  div.textContent = text
  return div.innerHTML
 }
 function conePath(fov) {
  const half = Math.min(Math.max(fov / 2, 10), 85)
  const cx = 26
  const cy = 26
  const r = 24
  const toRad = deg => ((deg - 90) * Math.PI) / 180
  const x1 = cx + r * Math.cos(toRad(-half))
  const y1 = cy + r * Math.sin(toRad(-half))
  const x2 = cx + r * Math.cos(toRad(half))
  const y2 = cy + r * Math.sin(toRad(half))
  return `M ${cx} ${cy} L ${x1} ${y1} A ${r} ${r} 0 0 1 ${x2} ${y2} Z`
 }
 function compassLabel(deg) {
  if (!Number.isFinite(deg)) return null
  const dirs = ['N', 'NE', 'E', 'SE', 'S', 'SW', 'W', 'NW']
  const idx = Math.round((((deg % 360) + 360) % 360) / 45) % 8
  return dirs[idx]
 }
 function wikidataLink(label, qid) {
  if (!qid) return escapeHtml(label)
  const id = escapeHtml(qid)
  return `<a href="https://www.wikidata.org/wiki/${id}" target="_blank" rel="noopener">${escapeHtml(label)}</a>`
 }
 function popupLine(parts) {
  const line = parts.filter(Boolean).join(' · ')
  return line ? `<div class="text-kestrel-muted text-xs mt-1">${line}</div>` : ''
 }
 function titleHtml(props) {
  if (props.name) return escapeHtml(props.name)
  if (props.model) {
    const mfr = props.manufacturer ? escapeHtml(props.manufacturer) : null
    return mfr ? `${mfr} <span class="text-kestrel-accent">${escapeHtml(props.model)}</span>` : escapeHtml(props.model)
  }
  const makeModel = [props.manufacturer, props.model].filter(Boolean).join(' ')
  if (makeModel) {
    if (props.manufacturerWikidata && !props.model) return wikidataLink(makeModel, props.manufacturerWikidata)
    return escapeHtml(makeModel)
  }
  if (props.operator) return wikidataLink(props.operator, props.operatorWikidata)
  if (props.ref) return escapeHtml(props.ref)
  return 'ALPR camera'
 }
 function titleText(props) {
  if (props.name) return props.name
  if (props.model) {
    return [props.manufacturer, props.model].filter(Boolean).join(' ')
  }
  const makeModel = [props.manufacturer, props.model].filter(Boolean).join(' ')
  if (makeModel) return makeModel
  if (props.operator) return props.operator
  if (props.ref) return props.ref
  return 'ALPR camera'
 }
 function modelLineHtml(props) {
  if (props.model) {
    return `<div class="text-sm mt-0.5"><span class="text-kestrel-muted">Model</span> <strong>${escapeHtml(props.model)}</strong></div>`
  }
  if (props.modelUnknown) {
    return '<div class="text-kestrel-muted text-xs mt-0.5">Model not recorded in OpenStreetMap</div>'
  }
  return ''
 }
 /** Human-readable ALPR popup (GeoJSON properties in, HTML out). */
 export function formatAlprPopup(props) {
  const title = titleHtml(props)
  const headline = titleText(props)
  const makeModel = [props.manufacturer, props.model].filter(Boolean).join(' ')
  const identity = []
  if (props.name && makeModel) identity.push(escapeHtml(makeModel))
  if (props.operator && headline !== props.operator) {
    identity.push(wikidataLink(props.operator, props.operatorWikidata))
  }
  if (props.ref && headline !== props.ref) identity.push(escapeHtml(props.ref))
  if (props.brand) identity.push(escapeHtml(props.brand))
  const view = []
  if (props.direction != null) {
    const deg = Math.round(props.direction)
    const compass = compassLabel(props.direction)
    view.push(compass ? `Facing ${compass} (${deg}°)` : `Facing ${deg}°`)
  }
  if (props.fov != null && props.direction != null) view.push(`~${Math.round(props.fov)}° view`)
  const note = props.description || props.note
  const noteHtml = note ? `<div class="text-kestrel-muted text-xs mt-1">${escapeHtml(note)}</div>` : ''
  const identityHtml = identity.length
    ? `<div class="text-kestrel-muted text-xs mt-0.5">${identity.join(' · ')}</div>`
    : ''
  const modelHtml = (props.model || props.modelUnknown) ? modelLineHtml(props) : ''
  const foot = `<div class="text-kestrel-muted text-xs mt-2"><a href="https://www.openstreetmap.org/node/${props.osmId}" target="_blank" rel="noopener">View on OpenStreetMap</a></div>`
  return `<div class="kestrel-live-popup"><strong>${title}</strong> <span class="text-kestrel-muted">License plate reader</span>${modelHtml}${identityHtml}${popupLine(view)}${noteHtml}${foot}</div>`
 }
 function popupHtml(props) {
  return formatAlprPopup(props)
 }
 function pointIcon(L, direction, fov) {
  const hasDirection = Number.isFinite(direction)
  if (!hasDirection) {
    const html = `<span class="poi-icon-svg"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="${ALPR_COLOR}" stroke-width="2"><rect x="3" y="5" width="18" height="12" rx="2"/><circle cx="12" cy="11" r="3"/><path d="M8 21h8"/></svg></span>`
    return L.divIcon({
      className: 'poi-div-icon alpr-icon',
      html,
      iconSize: [ICON_SIZE, ICON_SIZE],
      iconAnchor: [ICON_SIZE / 2, ICON_SIZE],
    })
  }
  const spread = Number.isFinite(fov) ? fov : DEFAULT_FOV
  const html = `<span class="alpr-cone" style="transform:rotate(${direction}deg)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 52 52" width="${CONE_SIZE}" height="${CONE_SIZE}"><path d="${conePath(spread)}" fill="${ALPR_COLOR}" fill-opacity="0.3" stroke="${ALPR_COLOR}" stroke-width="1.5"/><circle cx="26" cy="26" r="3" fill="${ALPR_COLOR}"/></svg></span>`
  return L.divIcon({
    className: 'poi-div-icon alpr-icon',
    html,
    iconSize: [CONE_SIZE, CONE_SIZE],
    iconAnchor: [CONE_SIZE / 2, CONE_SIZE / 2],
  })
 }
 function clusterIcon(L, count) {
  const size = count < 10 ? 28 : count < 100 ? 34 : 40
  return L.divIcon({
    className: 'alpr-cluster-icon',
    html: `<span class="alpr-cluster">${count}</span>`,
    iconSize: [size, size],
    iconAnchor: [size / 2, size / 2],
  })
 }
 export function createAlprControl(L, { showAlpr, onToggle }) {
  const control = L.control({ position: 'topleft' })
  control.onAdd = function () {
    const el = document.createElement('button')
    el.type = 'button'
    el.className = 'leaflet-bar leaflet-control-alpr'
    el.title = 'Toggle ALPR cameras (OSM)'
    el.setAttribute('aria-label', 'Toggle ALPR cameras')
    el.setAttribute('aria-pressed', showAlpr ? 'true' : 'false')
    el.innerHTML = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" width="20" height="20"><rect x="3" y="5" width="18" height="12" rx="2"/><circle cx="12" cy="11" r="3"/></svg>'
    el.addEventListener('click', onToggle)
    control._button = el
    return el
  }
  return control
 }
 export function setAlprControlPressed(control, pressed) {
  control?._button?.setAttribute('aria-pressed', pressed ? 'true' : 'false')
 }
 function featureKey(feature) {
  const props = feature.properties ?? {}
  if (props.cluster) return `c:${props.cluster_id}`
  const id = props.osmId
  return id != null ? `a:${id}` : null
 }
 function coords(feature) {
  const [lng, lat] = feature.geometry.coordinates
  return { lat, lng }
 }
 function attachClusterClick(marker, feature, map) {
  marker.on('click', () => {
    const { lat, lng } = coords(feature)
    const props = feature.properties ?? {}
    const zoom = props.expansionZoom ?? map.getZoom() + 2
    map.setView([lat, lng], Math.min(zoom, 19), { animate: true })
  })
 }
 export function createAlprLayer(L, map) {
  return L.layerGroup().addTo(map)
 }
 export function syncAlprLayer(L, map, layer, features) {
  syncFeatureMarkers(layer, features, {
    keyFor: featureKey,
    create: (feature) => {
      const { lat, lng } = coords(feature)
      const props = feature.properties ?? {}
      const isCluster = Boolean(props.cluster)
      const icon = isCluster ? clusterIcon(L, props.point_count) : pointIcon(L, props.direction, props.fov)
      const marker = L.marker([lat, lng], { icon })
      if (isCluster) attachClusterClick(marker, feature, map)
      else marker.bindPopup(popupHtml(props), { className: 'kestrel-live-popup-wrap', maxWidth: 320 })
      return marker
    },
    update: (marker, feature) => {
      const { lat, lng } = coords(feature)
      const props = feature.properties ?? {}
      const isCluster = Boolean(props.cluster)
      marker.setLatLng([lat, lng])
      const icon = isCluster ? clusterIcon(L, props.point_count) : pointIcon(L, props.direction, props.fov)
      marker.setIcon(icon)
      if (!isCluster) marker.setPopupContent(popupHtml(props))
    },
  })
 }
@@ -0,0 +1,77 @@
 export const MAX_BBOX_DEGREES = 0.5
 export function tileKey(row, col) {
  return `${row},${col}`
 }
 export function bboxToTileKey(bbox) {
  const row = Math.floor(bbox.south / MAX_BBOX_DEGREES)
  const col = Math.floor(bbox.west / MAX_BBOX_DEGREES)
  return tileKey(row, col)
 }
 function tileBox(row, col, step = MAX_BBOX_DEGREES) {
  const south = row * step
  const west = col * step
  return { south, west, north: south + step, east: west + step }
 }
 export function bboxFetchKey(bounds) {
  const zoom = bounds.zoom ?? 14
  const step = zoom >= 14 ? 0.025 : zoom >= 11 ? 0.1 : zoom >= 8 ? 0.25 : 1
  const q = v => Math.round(v / step) * step
  return [q(bounds.south), q(bounds.west), q(bounds.north), q(bounds.east)].join(',')
 }
 function ringOffsets(radius) {
  if (radius === 0) return [[0, 0]]
  return Array.from({ length: 2 * radius + 1 }, (_, i) => i - radius)
    .flatMap(dr => Array.from({ length: 2 * radius + 1 }, (_, j) => j - radius)
      .filter(dc => Math.abs(dr) === radius || Math.abs(dc) === radius)
      .map(dc => [dr, dc]))
 }
 function collectTiles(state) {
  const {
    centerRow, centerCol, minRow, maxRow, minCol, maxCol, step, limit, radius, seen, tiles,
  } = state
  if (tiles.length >= limit) return tiles
  const inBounds = (row, col) => row >= minRow && row <= maxRow && col >= minCol && col <= maxCol
  const { nextSeen, added } = ringOffsets(radius)
    .map(([dr, dc]) => [centerRow + dr, centerCol + dc])
    .filter(([row, col]) => inBounds(row, col))
    .reduce((acc, [row, col]) => {
      const key = `${row},${col}`
      if (acc.nextSeen.has(key)) return acc
      return {
        nextSeen: new Set([...acc.nextSeen, key]),
        added: [...acc.added, tileBox(row, col, step)],
      }
    }, { nextSeen: seen, added: [] })
  if (added.length === 0 && radius > 0) return tiles
  const nextTiles = [...tiles, ...added].slice(0, limit)
  if (nextTiles.length >= limit) return nextTiles
  return collectTiles({ ...state, radius: radius + 1, seen: nextSeen, tiles: nextTiles })
 }
 export function tilesNearCenter(bounds, limit) {
  const step = MAX_BBOX_DEGREES
  const lat = (bounds.south + bounds.north) / 2
  const lng = (bounds.west + bounds.east) / 2
  return collectTiles({
    centerRow: Math.floor(lat / step),
    centerCol: Math.floor(lng / step),
    minRow: Math.floor(bounds.south / step),
    maxRow: Math.ceil(bounds.north / step) - 1,
    minCol: Math.floor(bounds.west / step),
    maxCol: Math.ceil(bounds.east / step) - 1,
    step,
    limit,
    radius: 0,
    seen: new Set(),
    tiles: [],
  })
 }
@@ -0,0 +1,131 @@
 /** Map CoT / ADS-B entity display: icons and popups. */
 export const COT_COLORS = {
  air: '#60a5fa',
  helicopter: '#fbbf24',
  surface: '#38bdf8',
  ground: '#f59e0b',
 }
 export function cotCategory(type) {
  const t = typeof type === 'string' ? type : ''
  if (t.startsWith('a-f-A-')) return 'air'
  if (t.startsWith('a-f-S-')) return 'surface'
  return 'ground'
 }
 /** Whether the entity is a helicopter or fixed-wing aircraft. @returns {'helicopter' | 'fixedWing'} */
 export function cotAirIconKind(entity) {
  const type = entity?.type ?? ''
  if (type.endsWith('-C-H') || type.endsWith('-M-H')) return 'helicopter'
  return 'fixedWing'
 }
 function iconWrap(heading, inner) {
  const rotate = Number.isFinite(heading) ? ` style="transform:rotate(${heading}deg)"` : ''
  return `<span class="poi-icon-svg cot-icon-rotatable"${rotate}>${inner}</span>`
 }
 const PLANE_SVG = color =>
  `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="${color}"><path d="M21 16v-2l-8-5V3.5a1.5 1.5 0 0 0-3 0V9l-8 5v2l8-2.5V19l-2 1.5V22l3.5-1 3.5 1v-1.5L13 19v-5.5l8 2.5z"/></svg>`
 const HELI_SVG = color =>
  `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="${color}" stroke-width="1.75" stroke-linecap="round"><circle cx="12" cy="12" r="2.5" fill="${color}"/><path d="M3 8h18M3 12h18"/><path d="M12 8v8"/><path d="M9 16h6"/></svg>`
 const SHIP_SVG = color =>
  `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="${color}" stroke-width="2"><path d="M2 20c2-4 6-6 10-6s8 2 10 6"/><path d="M12 14V4"/><path d="m8 8 4-4 4 4"/></svg>`
 const GROUND_SVG = color =>
  `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="${color}" stroke-width="2"><circle cx="12" cy="12" r="9"/><circle cx="12" cy="8" r="2.5" fill="${color}"/></svg>`
 export function getCotIconHtml(entity) {
  const category = cotCategory(entity?.type)
  const heading = Number(entity?.heading)
  if (category === 'air') {
    const kind = cotAirIconKind(entity)
    const color = kind === 'helicopter' ? COT_COLORS.helicopter : COT_COLORS.air
    const svg = kind === 'helicopter' ? HELI_SVG(color) : PLANE_SVG(color)
    return { html: iconWrap(heading, svg), className: `cot-entity-${kind}` }
  }
  if (category === 'surface') {
    return { html: iconWrap(heading, SHIP_SVG(COT_COLORS.surface)), className: 'cot-entity-surface' }
  }
  return { html: iconWrap(undefined, GROUND_SVG(COT_COLORS.ground)), className: 'cot-entity-ground' }
 }
 function msToKnots(ms) {
  return Number.isFinite(ms) ? Math.round(ms * 1.94384) : null
 }
 function metersToFeet(m) {
  return Number.isFinite(m) ? Math.round(m * 3.28084) : null
 }
 function fmtHeading(deg) {
  return Number.isFinite(deg) ? `${Math.round(deg)}°` : null
 }
 function fmtVerticalFpm(ms) {
  if (!Number.isFinite(ms) || ms === 0) return null
  const fpm = Math.round(ms * 196.85)
  return `${fpm > 0 ? '+' : ''}${fpm} fpm`
 }
 function icaoFromEntity(entity) {
  if (entity?.icao) return String(entity.icao).toUpperCase()
  if (typeof entity?.id === 'string' && entity.id.startsWith('ICAO.')) {
    return entity.id.slice(5).toUpperCase()
  }
  return null
 }
 function mmsiFromEntity(entity) {
  if (entity?.mmsi) return String(entity.mmsi)
  if (typeof entity?.id === 'string' && entity.id.startsWith('MMSI.')) return entity.id.slice(5)
  return null
 }
 function popupLine(escape, parts) {
  const line = parts.filter(Boolean).join(' · ')
  return line ? `<div class="text-kestrel-muted text-xs mt-1">${line}</div>` : ''
 }
 /**
 * @param {Record<string, unknown>} entity
 * @param {(s: string) => string} escape
 */
 export function formatCotPopup(entity, escape) {
  const category = cotCategory(entity?.type)
  const label = escape(entity?.label || entity?.id || 'Unknown')
  if (entity?.source === 'adsb' || category === 'air') {
    const tag = cotAirIconKind(entity) === 'helicopter' ? 'Helicopter' : 'Aircraft'
    const icao = icaoFromEntity(entity)
    const meta = [
      icao ? `ICAO ${icao}` : null,
      entity?.originCountry ? escape(String(entity.originCountry)) : null,
    ].filter(Boolean).join(' · ')
    const alt = metersToFeet(entity?.altitude)
    const stats = [
      alt != null ? `${alt.toLocaleString()} ft` : null,
      entity?.onGround ? 'On ground' : null,
      msToKnots(entity?.speed) != null ? `${msToKnots(entity.speed)} kt` : null,
      fmtHeading(entity?.heading),
      fmtVerticalFpm(entity?.verticalRate),
      entity?.squawk ? `Squawk ${escape(String(entity.squawk))}` : null,
    ]
    return `<div class="kestrel-live-popup"><strong>${label}</strong> <span class="text-kestrel-muted">${tag}</span>${meta ? `<div class="text-kestrel-muted text-xs mt-0.5">${meta}</div>` : ''}${popupLine(escape, stats)}</div>`
  }
  if (entity?.source === 'ais' || category === 'surface') {
    const mmsi = mmsiFromEntity(entity)
    const meta = mmsi ? `MMSI ${escape(mmsi)}` : ''
    const stats = [
      Number.isFinite(entity?.speed) ? `${Number(entity.speed).toFixed(1)} kt` : null,
      fmtHeading(entity?.heading),
    ]
    return `<div class="kestrel-live-popup"><strong>${label}</strong> <span class="text-kestrel-muted">Vessel</span>${meta ? `<div class="text-kestrel-muted text-xs mt-0.5">${meta}</div>` : ''}${popupLine(escape, stats)}</div>`
  }
  return `<div class="kestrel-live-popup"><strong>${label}</strong> <span class="text-kestrel-muted">Team</span></div>`
 }
@@ -0,0 +1,107 @@
 import { createClusterIndex } from './mapCluster.js'
 import { syncFeatureMarkers } from './mapMarkerSync.js'
 import { cotCategory, formatCotPopup, getCotIconHtml } from './cotDisplay.js'
 const ICON_SIZE = 28
 const CLUSTER = createClusterIndex({ radius: 50, maxZoom: 14, minPoints: 2 })
 function escapeHtml(text) {
  const div = document.createElement('div')
  div.textContent = text
  return div.innerHTML
 }
 export function entitiesToFeatures(entities) {
  return (entities || [])
    .filter(e => typeof e?.lat === 'number' && typeof e?.lng === 'number' && e?.id)
    .map(e => ({
      type: 'Feature',
      geometry: { type: 'Point', coordinates: [e.lng, e.lat] },
      properties: { entity: e, cotCategory: cotCategory(e.type) },
    }))
 }
 export function loadCotCluster(entities) {
  CLUSTER.load(entitiesToFeatures(entities))
 }
 export function getCotClusters(view) {
  return CLUSTER.query(view)
 }
 function featureKey(feature) {
  const props = feature.properties ?? {}
  if (props.cluster) return `c:${props.cluster_id}`
  const id = props.entity?.id
  return id != null ? `e:${id}` : null
 }
 function clusterIcon(L, count) {
  const size = count < 10 ? 28 : count < 100 ? 34 : 40
  return L.divIcon({
    className: 'cot-cluster-icon',
    html: `<span class="cot-cluster">${count}</span>`,
    iconSize: [size, size],
    iconAnchor: [size / 2, size / 2],
  })
 }
 function entityIcon(L, entity) {
  const { html, className } = getCotIconHtml(entity)
  return L.divIcon({
    className: `poi-div-icon cot-entity-icon ${className}`,
    html,
    iconSize: [ICON_SIZE, ICON_SIZE],
    iconAnchor: [ICON_SIZE / 2, ICON_SIZE / 2],
  })
 }
 function coords(feature) {
  const [lng, lat] = feature.geometry.coordinates
  return { lat, lng }
 }
 function attachClusterClick(marker, feature, map) {
  marker.on('click', () => {
    const { lat, lng } = coords(feature)
    const props = feature.properties ?? {}
    const zoom = props.expansionZoom ?? map.getZoom() + 2
    map.setView([lat, lng], Math.min(zoom, 19), { animate: true })
  })
 }
 export function createCotLayer(L, map) {
  return L.layerGroup().addTo(map)
 }
 export function syncCotLayer(L, map, layer, features) {
  syncFeatureMarkers(layer, features, {
    keyFor: featureKey,
    create: (feature) => {
      const { lat, lng } = coords(feature)
      const props = feature.properties ?? {}
      const isCluster = Boolean(props.cluster)
      const icon = isCluster ? clusterIcon(L, props.point_count) : entityIcon(L, props.entity)
      const marker = L.marker([lat, lng], { icon })
      if (isCluster) attachClusterClick(marker, feature, map)
      else if (props.entity) {
        marker.bindPopup(
          formatCotPopup(props.entity, escapeHtml),
          { className: 'kestrel-live-popup-wrap', maxWidth: 360 },
        )
      }
      return marker
    },
    update: (marker, feature) => {
      const { lat, lng } = coords(feature)
      const props = feature.properties ?? {}
      const isCluster = Boolean(props.cluster)
      marker.setLatLng([lat, lng])
      const icon = isCluster ? clusterIcon(L, props.point_count) : entityIcon(L, props.entity)
      marker.setIcon(icon)
      if (!isCluster && props.entity) {
        marker.setPopupContent(formatCotPopup(props.entity, escapeHtml))
      }
    },
  })
 }
@@ -0,0 +1,31 @@
 import Supercluster from 'supercluster'
 export function createClusterIndex(options = {}) {
  const index = new Supercluster(options)
  const state = { features: Object.freeze([]) }
  return {
    load(features) {
      const list = Object.freeze([...(features ?? [])])
      index.load(list)
      state.features = list
    },
    query(view) {
      if (!view || state.features.length === 0) return []
      const { west, south, east, north, zoom } = view
      return index.getClusters(
        [west, south, east, north],
        Math.floor(zoom ?? 14),
      ).map((feature) => {
        if (!feature.properties?.cluster) return feature
        return {
          ...feature,
          properties: {
            ...feature.properties,
            expansionZoom: index.getClusterExpansionZoom(feature.properties.cluster_id),
          },
        }
      })
    },
  }
 }
@@ -0,0 +1,37 @@
 const SYNC_KEY = '_kestrelMarkerSync'
 const pointFeatures = (features, keyFor) => (features ?? [])
  .filter(f => f?.geometry?.type === 'Point')
  .map(f => ({ feature: f, key: keyFor(f) }))
  .filter(({ key }) => key != null)
 export function syncFeatureMarkers(layer, features, { keyFor, create, update }) {
  const prev = layer[SYNC_KEY] ?? new Map()
  const next = pointFeatures(features, keyFor).reduce((map, { feature, key }) => {
    const existing = prev.get(key)
    if (existing) {
      update(existing, feature)
      return new Map([...map, [key, existing]])
    }
    const marker = create(feature)
    layer.addLayer(marker)
    return new Map([...map, [key, marker]])
  }, new Map())
  Array.from(prev.entries())
    .filter(([key]) => !next.has(key))
    .forEach(([, marker]) => layer.removeLayer(marker))
  layer[SYNC_KEY] = next
 }
 export function clearFeatureMarkers(layer) {
  if (!layer) return
  const prev = layer[SYNC_KEY]
  if (prev) {
    Array.from(prev.values()).forEach(marker => layer.removeLayer(marker))
    layer[SYNC_KEY] = new Map()
    return
  }
  layer.clearLayers()
 }
@@ -2,6 +2,8 @@
 KestrelOS acts as a **TAK Server**. ATAK (Android) and iTAK (iOS) connect on **port 8089** (CoT). Devices relay positions to each other and appear on the KestrelOS map.
 ADS-B and AIS via [adsbcot](https://github.com/snstac/adsbcot) / [aiscot](https://github.com/snstac/aiscot): see [tracking.md](tracking.md).
 ## Connection
 **Host:** KestrelOS hostname/IP  
@@ -59,7 +61,6 @@ OIDC users must set an **ATAK password** first:
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `COT_PORT` | `8089` | CoT server port |
 | `COT_TTL_MS` | `90000` | Device timeout (~90s) |
 | `COT_REQUIRE_AUTH` | `true` | Require authentication |
 | `COT_SSL_CERT` | `.dev-certs/cert.pem` | TLS cert path |
 | `COT_SSL_KEY` | `.dev-certs/key.pem` | TLS key path |
@@ -5,6 +5,7 @@ KestrelOS shows a **map** with devices, POIs, live sessions (Share live), and AT
 ## Map Layers
 - **Devices** - Fixed feeds (IPTV, ALPR, CCTV, NVR, etc.) added via API
 - **ALPR (OSM / DeFlock)** - Crowdsourced license-plate cameras from OpenStreetMap; toggle on the map (camera icon control). Reference only, no stream.
 - **POIs** - Points of interest (admin/leader can edit)
 - **Live sessions** - Mobile devices streaming via Share live
 - **CoT (ATAK/iTAK)** - Amber markers for connected TAK devices (position only)
@@ -47,6 +48,15 @@ Stream URLs must be `http://` or `https://`.
 **Cameras endpoint:** `GET /api/cameras` returns devices + live sessions + CoT entities.
 ## ALPR layer (DeFlock / OpenStreetMap)
 deflock.me has no bulk download API. KestrelOS queries OpenStreetMap via Overpass (`surveillance:type=ALPR`) and returns **GeoJSON FeatureCollection** from `GET /api/alpr`.
 - **Map:** ALPR layer is on by default (toggle top-left to hide). Marker popups show OSM identifying tags (manufacturer, model, operator, ref, Wikidata, etc.) when contributors tagged them.
 - **Offline:** Run `npm run import:alpr` to preload SQLite; cache serves automatically when Overpass is unreachable.
 Attribution: © OpenStreetMap contributors.
 ## POIs
 Admins/leaders add/edit from **POI** page (sidebar). POIs appear as map pins (reference only, no stream).
@@ -0,0 +1,48 @@
 # ADS-B and AIS
 Aircraft and vessels use the same **CoT** store as ATAK/iTAK. The map consumes `GET /api/cot/stream` (SSE, viewport bbox). Toggle **Air**, **Surface**, and **Team** on the map.
 ## Accuracy tiers
 1. **Tactical (best):** local SDR/AIS receiver → [adsbcot](https://github.com/snstac/adsbcot) / [aiscot](https://github.com/snstac/aiscot) → KestrelOS CoT `:8089` (sub-second updates).
 2. **Vessels (live OSINT):** AISStream WebSocket push as vessels transmit.
 3. **Aircraft (awareness OSINT):** OpenSky bbox poll — not a live stream; typical lag ~5s.
 For tactical use, run local receivers. Do not rely on OpenSky alone.
 ## Freshness
 Tracks update via SSE `update` events (CoT `:8089`, AISStream) or coalesced `snapshot` after each OpenSky poll. Stale tracks are removed automatically (team ~90s, OSINT ~30s without a new fix).
 OSINT feeds run only while a map client is connected (SSE subscriber). Keep the map tab visible for live updates.
 ## Self-hosted
 **ADS-B:** [adsbcot](https://github.com/snstac/adsbcot) → `tls://host:8089`
 ```ini
 [adsbcot]
 COT_URL = tls://kestrelos.example.com:8089
 FEED_URL = tcp+beast://127.0.0.1:30005
 ```
 **AIS:** [aiscot](https://github.com/snstac/aiscot) → `tls://host:8089`
 ```ini
 [aiscot]
 COT_URL = tls://kestrelos.example.com:8089
 FEED_URL = tcp://127.0.0.1:10110
 ```
 Use KestrelOS credentials (see [atak-itak.md](atak-itak.md)).
 ## OSINT APIs (optional)
 Set these only if you want viewport OSINT without local receivers:
 | Variable | Purpose |
 |----------|---------|
 | `AISSTREAM_API_KEY` | AISStream WebSocket |
 | `OPENSKY_CLIENT_ID` / `OPENSKY_CLIENT_SECRET` | OpenSky OAuth (recommended for production) |
 UIDs: `ICAO.*` (ADS-B), `MMSI.*` (AIS). Icons follow CoT type (`a-f-A-*`, `a-f-S-*`, `a-f-G-*`).
@@ -2,5 +2,5 @@ apiVersion: v2
 name: kestrelos
 description: KestrelOS TOC for OSINT feeds - map, camera feeds, offline tiles
 type: application
-version: 1.0.1
+version: 1.1.12
-appVersion: "1.0.1"
+appVersion: "1.1.12"
@@ -2,7 +2,7 @@ replicaCount: 1
 image:
  repository: git.keligrubb.com/keligrubb/kestrelos
-  tag: 1.0.1
+  tag: 1.1.12
  pullPolicy: IfNotPresent
 service:
@@ -32,9 +32,11 @@ export default defineNuxtConfig({
    public: {
      version: pkg.version ?? '',
    },
    cotTtlMs: 90_000,
    cotRequireAuth: true,
    cotDebug: false,
    aisstreamApiKey: process.env.AISSTREAM_API_KEY || '',
    openskyClientId: process.env.OPENSKY_CLIENT_ID || '',
    openskyClientSecret: process.env.OPENSKY_CLIENT_SECRET || '',
  },
  devServer: {
    host: '0.0.0.0',
@@ -1,6 +1,6 @@
 {
  "name": "kestrelos",
-  "version": "1.0.1",
+  "version": "1.1.12",
  "private": true,
  "type": "module",
  "scripts": {
@@ -16,38 +16,36 @@
    "test:e2e:ui": "playwright test --ui test/e2e",
    "test:e2e:debug": "playwright test --debug test/e2e",
    "test:e2e:install": "playwright install --with-deps webkit chromium firefox",
-    "lint": "eslint . --max-warnings 0"
+    "lint": "eslint . --max-warnings 0",
    "import:alpr": "node scripts/import-alpr.js"
  },
  "dependencies": {
-    "@nuxt/icon": "^2.2.1",
+    "@nuxt/icon": "^2.5.0",
    "@nuxtjs/tailwindcss": "^6.14.0",
-    "fast-xml-parser": "^5.3.6",
+    "fast-xml-parser": "^5.10.1",
-    "hls.js": "^1.5.0",
+    "hls.js": "^1.7.0",
    "jszip": "^3.10.1",
    "leaflet": "^1.9.4",
-    "leaflet.offline": "^3.2.0",
+    "leaflet.offline": "^3.2.1",
-    "mediasoup": "^3.19.14",
+    "mediasoup": "^3.24.2",
-    "mediasoup-client": "^3.18.6",
+    "mediasoup-client": "^3.22.0",
-    "nuxt": "^4.0.0",
+    "nuxt": "^4.5.2",
-    "openid-client": "^6.8.2",
+    "openid-client": "^6.8.5",
    "qrcode": "^1.5.4",
-    "sqlite3": "^5.1.7",
+    "supercluster": "^9.0.0",
-    "vue": "^3.4.0",
+    "vue": "^3.5.41",
-    "vue-router": "^4.4.0",
+    "vue-router": "^5.2.0",
-    "ws": "^8.18.0"
+    "ws": "^8.21.3"
  },
  "devDependencies": {
-    "@iconify-json/tabler": "^1.2.26",
+    "@iconify-json/tabler": "^1.2.38",
-    "@nuxt/eslint": "^1.15.0",
+    "@nuxt/eslint": "^1.17.0",
-    "@nuxt/test-utils": "^4.0.0",
+    "@nuxt/test-utils": "^4.1.0",
-    "@playwright/test": "^1.58.2",
+    "@playwright/test": "^1.62.1",
-    "@vitest/coverage-v8": "^4.0.0",
+    "@vitest/coverage-v8": "^4.1.10",
-    "@vue/test-utils": "^2.4.0",
+    "@vue/test-utils": "^2.4.11",
-    "eslint": "^9.0.0",
+    "eslint": "^10.8.1",
-    "happy-dom": "^20.6.1",
+    "happy-dom": "^20.11.2",
-    "vitest": "^4.0.0"
+    "vitest": "^4.1.10"
  },
  "overrides": {
    "tar": "^7.5.7"
  }
 }
@@ -0,0 +1,17 @@
 #!/usr/bin/env node
 import { getDb, closeDb } from '../server/utils/db.js'
 import { importAllAlprNodes } from '../server/utils/alpr.js'
 try {
  const db = await getDb()
  console.log('[import-alpr] Fetching ALPR nodes from Overpass…')
  const count = await importAllAlprNodes(db)
  console.log(`[import-alpr] Cached ${count} nodes in SQLite.`)
 }
 catch (error) {
  console.error('[import-alpr] Failed:', error?.message || error)
  process.exitCode = 1
 }
 finally {
  closeDb()
 }
@@ -3,18 +3,51 @@ set -e
 # version
 msg="${CI_COMMIT_MESSAGE:-}"
 # optional PR body (written by workflow from Gitea API when this commit is a merged PR)
 if [ -f .ci_pr_body ]; then
  CI_PR_DESCRIPTION=$(cat .ci_pr_body); rm -f .ci_pr_body
 else
  CI_PR_DESCRIPTION=""
 fi
 export CI_PR_DESCRIPTION
 bump=patch
-echo "$msg" | grep -qi minor: && bump=minor
+# Conventional commits: chore/fix => patch, feat => minor
 echo "$msg" | grep -Eqi '(^|[[:space:]])(fix|chore)(\([^)]*\))?:' && bump=patch
 echo "$msg" | grep -Eqi '(^|[[:space:]])feat(\([^)]*\))?:' && bump=minor
 # Conventional commits breaking change: type!:
 echo "$msg" | grep -Eqi '(^|[[:space:]])[a-zA-Z]+(\([^)]*\))?!:' && bump=major
 # Explicit bump prefixes still supported (but never downgrade a major bump)
 echo "$msg" | grep -qi minor: && [ "$bump" != "major" ] && bump=minor
 echo "$msg" | grep -qi major: && bump=major
 cur=$(awk '/"version"/ { match($0, /[0-9]+\.[0-9]+\.[0-9]+/); print substr($0, RSTART, RLENGTH); exit }' package.json)
 case "$cur" in
  [0-9]*.[0-9]*.[0-9]*) ;;
  *) echo "error: package.json version must be x.y.z (got: $cur)"; exit 1 ;;
 esac
 major=$(echo "$cur" | cut -d. -f1); minor=$(echo "$cur" | cut -d. -f2); patch=$(echo "$cur" | cut -d. -f3)
 case "$bump" in major) major=$((major+1)); minor=0; patch=0 ;; minor) minor=$((minor+1)); patch=0 ;; patch) patch=$((patch+1)) ;; esac
 newVersion="$major.$minor.$patch"
 [ -z "$cur" ] && { echo "error: could not read version from package.json"; exit 1; }
-# changelog entry (strip prefix from first line)
+url="https://${CI_REPO_OWNER}:${GITEA_REPO_TOKEN}@${CI_FORGE_URL#https://}/${CI_REPO_OWNER}/${CI_REPO_NAME}.git"
-changelogEntry=$(echo "$msg" | head -1 | awk '{sub(/^[mM]ajor:[ \t]*/,""); sub(/^[mM]inor:[ \t]*/,""); sub(/^[pP]atch:[ \t]*/,""); print}')
+if [ -n "$(git ls-remote "$url" "refs/tags/v$newVersion" 2>/dev/null)" ]; then
  exit 0
 fi
 # changelog entry (strip explicit bump prefixes & any conventional-commit type(scope):); optional PR description enriches it
 changelogEntry=$(
  echo "$msg" \
    | head -1 \
    | sed -E 's/^[[:space:]]*[mM]ajor:[[:space:]]*//; s/^[[:space:]]*[mM]inor:[[:space:]]*//; s/^[[:space:]]*[pP]atch:[[:space:]]*//' \
    | sed -E 's/^[[:space:]]*[a-zA-Z]+(\([^)]*\))?:[[:space:]]*//'
 )
 [ -z "$changelogEntry" ] && changelogEntry="Release v$newVersion"
 if [ -n "$CI_PR_DESCRIPTION" ]; then
  changelogFull="- $changelogEntry
 $CI_PR_DESCRIPTION"
 else
  changelogFull="- $changelogEntry"
 fi
 # bump files
 awk -v v="$newVersion" '/"version"/ { sub(/[0-9]+\.[0-9]+\.[0-9]+/, v) } { print }' package.json > package.json.tmp && mv package.json.tmp package.json
@@ -24,18 +57,18 @@ awk -v v="$newVersion" '/^  tag:/ { $0 = "  tag: " v }; { print }' helm/kestrelo
 # changelog
 new="## [$newVersion] - $(date +%Y-%m-%d)
 ### Changed
- $changelogEntry
+$changelogFull
 "
-{ [ ! -f CHANGELOG.md ] && printf '# Changelog\n\n'; printf '%s' "$new"; [ -f CHANGELOG.md ] && cat CHANGELOG.md; } > CHANGELOG.md.tmp && mv CHANGELOG.md.tmp CHANGELOG.md
+# Create CHANGELOG.md if missing (first release); otherwise prepend new entry to existing content.
 { [ ! -f CHANGELOG.md ] && printf '# Changelog\n\n'; printf '%s' "$new"; [ -f CHANGELOG.md ] && cat CHANGELOG.md || true; } > CHANGELOG.md.tmp && mv CHANGELOG.md.tmp CHANGELOG.md
 # git
 git config user.email "ci@kestrelos" && git config user.name "CI"
 git add package.json helm/kestrelos/Chart.yaml helm/kestrelos/values.yaml CHANGELOG.md
 git commit -m "release v$newVersion [skip ci]"
 url="https://${CI_REPO_OWNER}:${GITEA_REPO_TOKEN}@${CI_FORGE_URL#https://}/${CI_REPO_OWNER}/${CI_REPO_NAME}.git"
 git tag "v$newVersion"
-# artifact for kaniko (tag list)
+# artifact for docker (tag list)
 printf '%s\n%s\n' "$newVersion" "latest" > .tags
 retry() { n=0; while ! "$@"; do n=$((n+1)); [ $n -ge 3 ] && return 1; sleep 2; done; }
 retry git push "$url" HEAD:main "v$newVersion"
@@ -43,7 +76,7 @@ retry git push "$url" HEAD:main "v$newVersion"
 # gitea release
 body="## Changelog
 ### Changed
- $changelogEntry
+$changelogFull
 ## Installation
 - [Docker image](${CI_FORGE_URL}/${CI_REPO_OWNER}/-/packages/container/${CI_REPO_NAME})
@@ -0,0 +1,19 @@
 import { getDb } from '../utils/db.js'
 import { requireAuth } from '../utils/authHelpers.js'
 import { getAlprCameras, parseBbox } from '../utils/alpr.js'
 export default defineEventHandler(async (event) => {
  requireAuth(event)
  let bbox
  try {
    bbox = parseBbox(getQuery(event))
  }
  catch (error) {
    throw createError({
      statusCode: error?.statusCode || 400,
      message: error?.message || 'invalid bbox',
    })
  }
  const db = await getDb()
  return getAlprCameras(db, bbox)
 })
@@ -1,19 +1,15 @@
 import { getDb } from '../utils/db.js'
 import { requireAuth } from '../utils/authHelpers.js'
 import { getActiveSessions } from '../utils/liveSessions.js'
 import { getActiveEntities } from '../utils/cotStore.js'
 import { rowToDevice, sanitizeDeviceForResponse } from '../utils/deviceUtils.js'
 export default defineEventHandler(async (event) => {
  requireAuth(event)
-  const config = useRuntimeConfig()
+  const [db, sessions] = await Promise.all([
  const ttlMs = Number(config.cotTtlMs ?? 90_000) || 90_000
  const [db, sessions, cotEntities] = await Promise.all([
    getDb(),
    getActiveSessions(),
    getActiveEntities(ttlMs),
  ])
  const rows = await db.all('SELECT id, name, device_type, vendor, lat, lng, stream_url, source_type, config FROM devices ORDER BY id')
  const devices = rows.map(rowToDevice).filter(Boolean).map(sanitizeDeviceForResponse)
-  return { devices, liveSessions: sessions, cotEntities }
+  return { devices, liveSessions: sessions }
 })
@@ -0,0 +1,45 @@
 import { createEventStream } from 'h3'
 import { requireAuth } from '../../utils/authHelpers.js'
 import { getActiveEntitiesInBbox } from '../../utils/cotStore.js'
 import { registerSubscriber } from '../../utils/cotSubscribers.js'
 import { getCotSnapshotOpts } from '../../utils/cotSnapshot.js'
 import { COT_SSE_HEARTBEAT_MS } from '../../utils/constants.js'
 import { parseBboxParam, parseLayersParam } from '../../utils/cotEntityUtils.js'
 import { scheduleTrackingFeedRefresh } from '../../utils/trackingFeed.js'
 export default defineEventHandler((event) => {
  requireAuth(event)
  const query = getQuery(event)
  const bbox = parseBboxParam(typeof query.bbox === 'string' ? query.bbox : undefined)
  const layers = parseLayersParam(typeof query.layers === 'string' ? query.layers : undefined)
  const snapshotOpts = getCotSnapshotOpts()
  const stream = createEventStream(event)
  const push = (eventName, data) => stream.push({ event: eventName, data })
  const sendSnapshot = async () => {
    const entities = await getActiveEntitiesInBbox(bbox, { ...snapshotOpts, layers })
    await push('snapshot', JSON.stringify({ entities }))
  }
  const unregister = registerSubscriber({ bbox, layers, push })
  let heartbeat
  stream.onClosed(async () => {
    clearInterval(heartbeat)
    unregister()
    scheduleTrackingFeedRefresh()
  })
  void (async () => {
    scheduleTrackingFeedRefresh()
    await sendSnapshot()
    heartbeat = setInterval(() => {
      push('heartbeat', '{}').catch(() => {})
    }, COT_SSE_HEARTBEAT_MS)
  })()
  return stream.send()
 })
@@ -108,7 +108,7 @@ async function processFrame(socket, rawMessage, payload, authenticated) {
      socket.destroy()
      return
    }
-    updateFromCot(parsed).catch((err) => {
+    updateFromCot({ ...parsed, type: parsed.eventType }).catch((err) => {
      console.error('[cot] Error updating from CoT:', err?.message)
    })
    if (authenticated) broadcast(socket, rawMessage)
@@ -0,0 +1,32 @@
 import { registerCleanup } from '../utils/shutdown.js'
 import { onCotChange, pruneStaleEntities } from '../utils/cotStore.js'
 import { getCotSnapshotOpts } from '../utils/cotSnapshot.js'
 import {
  notifySubscribersForEntity,
  notifySubscribersRemove,
 } from '../utils/cotSubscribers.js'
 import { COT_PRUNE_INTERVAL_MS } from '../utils/constants.js'
 let pruneTimer = null
 let offChange = () => {}
 export default defineNitroPlugin(() => {
  offChange = onCotChange((changeEvent, payload) => {
    if (changeEvent === 'update' && payload?.entity) {
      notifySubscribersForEntity('update', { entity: payload.entity }, payload.entity).catch(() => {})
    }
    else if (changeEvent === 'remove' && payload?.id) {
      notifySubscribersRemove(payload.id).catch(() => {})
    }
  })
  pruneTimer = setInterval(() => {
    pruneStaleEntities(getCotSnapshotOpts()).catch(() => {})
  }, COT_PRUNE_INTERVAL_MS)
  registerCleanup(() => {
    offChange()
    if (pruneTimer) clearInterval(pruneTimer)
    pruneTimer = null
  })
 })
@@ -0,0 +1,7 @@
 import { registerCleanup } from '../utils/shutdown.js'
 import { startTrackingFeed, stopTrackingFeed } from '../utils/trackingFeed.js'
 export default defineNitroPlugin(() => {
  startTrackingFeed()
  registerCleanup(stopTrackingFeed)
 })
@@ -43,16 +43,6 @@ export function removeSessionConnection(sessionId, ws) {
  }
 }
 export function broadcastToSession(sessionId, message) {
  const conns = getSessionConnections(sessionId)
  const data = JSON.stringify(message)
  for (const ws of conns) {
    if (ws.readyState === 1) { // OPEN
      ws.send(data)
    }
  }
 }
 export default defineNitroPlugin((nitroApp) => {
  nitroApp.hooks.hook('ready', async () => {
    const server = nitroApp.h3App.server || nitroApp.h3App.nodeServer
@@ -0,0 +1,263 @@
 import { cameraToFeature, featureCollection } from './alprGeo.js'
 const OVERPASS_URL = 'https://overpass.deflock.org/api/interpreter'
 const MAX_BBOX_DEGREES = 0.5
 const CACHE_TTL_MS = 86_400_000
 const TILE_SCALE = 10
 function httpError(statusCode, message) {
  const err = new Error(message)
  err.statusCode = statusCode
  return err
 }
 /**
 * @param {unknown} tags
 * @returns {Record<string, string>} String OSM tags only
 */
 function normalizeTags(tags) {
  if (!tags || typeof tags !== 'object') return {}
  return Object.fromEntries(
    Object.entries(/** @type {Record<string, unknown>} */ (tags))
      .filter(([, v]) => typeof v === 'string')
      .map(([k, v]) => [k, /** @type {string} */ (v)]),
  )
 }
 /**
 * @param {unknown} element
 * @returns {{ osmId: number, lat: number, lng: number, manufacturer: string | null, direction: number | null, tags: Record<string, string> } | null} Parsed camera or null
 */
 export function parseOverpassElement(element) {
  if (!element || typeof element !== 'object') return null
  const el = /** @type {Record<string, unknown>} */ (element)
  if (el.type !== 'node' || typeof el.id !== 'number') return null
  const lat = Number(el.lat)
  const lng = Number(el.lon ?? el.lng)
  if (!Number.isFinite(lat) || !Number.isFinite(lng)) return null
  const tags = normalizeTags(el.tags)
  const directionRaw = tags['camera:direction'] ?? tags.direction
  const direction = directionRaw != null && directionRaw !== '' ? Number(directionRaw) : null
  const fovRaw = tags['camera:angle'] ?? tags['surveillance:angle']
  const fov = fovRaw != null && fovRaw !== '' ? Number(fovRaw) : null
  return {
    osmId: el.id,
    lat,
    lng,
    manufacturer: tags.manufacturer ?? tags.brand ?? null,
    direction: Number.isFinite(direction) ? direction : null,
    fov: Number.isFinite(fov) ? fov : null,
    tags,
  }
 }
 export function parseBbox(query) {
  const south = Number(query.south)
  const west = Number(query.west)
  const north = Number(query.north)
  const east = Number(query.east)
  if (![south, west, north, east].every(Number.isFinite)) {
    throw httpError(400, 'south, west, north, east required')
  }
  if (south >= north || west >= east) {
    throw httpError(400, 'invalid bbox')
  }
  if (north - south > MAX_BBOX_DEGREES || east - west > MAX_BBOX_DEGREES) {
    throw httpError(400, `bbox exceeds ${MAX_BBOX_DEGREES}°`)
  }
  return { south, west, north, east }
 }
 /** @param {{ south: number, west: number, north: number, east: number }} bbox */
 export function tileKeysForBbox(bbox) {
  const latMin = Math.floor(bbox.south * TILE_SCALE)
  const latMax = Math.floor(bbox.north * TILE_SCALE)
  const lngMin = Math.floor(bbox.west * TILE_SCALE)
  const lngMax = Math.floor(bbox.east * TILE_SCALE)
  const keys = []
  for (let lat = latMin; lat <= latMax; lat++) {
    for (let lng = lngMin; lng <= lngMax; lng++) {
      keys.push(`${lat}:${lng}`)
    }
  }
  return keys
 }
 export function buildBboxQuery(bbox) {
  const { south, west, north, east } = bbox
  return `[out:json][timeout:25];node["surveillance:type"="ALPR"](${south},${west},${north},${east});out body;`
 }
 export function buildGlobalQuery() {
  return '[out:json][timeout:300];node["surveillance:type"="ALPR"];out body;'
 }
 function rowToCamera(row, source) {
  const tags = (() => {
    try {
      return JSON.parse(row.tags)
    }
    catch {
      return {}
    }
  })()
  const fovRaw = tags['camera:angle'] ?? tags['surveillance:angle']
  const fov = fovRaw != null && fovRaw !== '' ? Number(fovRaw) : null
  return {
    osmId: row.osm_id,
    lat: row.lat,
    lng: row.lng,
    manufacturer: row.manufacturer ?? null,
    direction: row.direction ?? null,
    fov: Number.isFinite(fov) ? fov : null,
    tags,
    source,
  }
 }
 /** @param {Awaited<ReturnType<typeof import('./db.js').getDb>>} db */
 export async function upsertAlprNode(db, camera) {
  const now = new Date().toISOString()
  await db.run(
    `INSERT INTO alpr_nodes (osm_id, lat, lng, manufacturer, direction, tags, fetched_at)
     VALUES (?, ?, ?, ?, ?, ?, ?)
     ON CONFLICT(osm_id) DO UPDATE SET
       lat = excluded.lat,
       lng = excluded.lng,
       manufacturer = excluded.manufacturer,
       direction = excluded.direction,
       tags = excluded.tags,
       fetched_at = excluded.fetched_at`,
    [
      camera.osmId,
      camera.lat,
      camera.lng,
      camera.manufacturer,
      camera.direction,
      JSON.stringify(camera.tags),
      now,
    ],
  )
 }
 /** @param {Awaited<ReturnType<typeof import('./db.js').getDb>>} db */
 export async function upsertAlprNodesBatch(db, cameras) {
  if (!cameras.length) return
  await db.run('BEGIN TRANSACTION')
  try {
    for (const camera of cameras) {
      await upsertAlprNode(db, camera)
    }
    await db.run('COMMIT')
  }
  catch (error) {
    await db.run('ROLLBACK').catch(() => {})
    throw error
  }
 }
 /** @param {Awaited<ReturnType<typeof import('./db.js').getDb>>} db */
 export async function markTilesFetched(db, keys) {
  if (!keys.length) return
  const now = new Date().toISOString()
  await db.run('BEGIN TRANSACTION')
  try {
    for (const key of keys) {
      await db.run('INSERT OR REPLACE INTO alpr_tiles (tile_key, fetched_at) VALUES (?, ?)', [key, now])
    }
    await db.run('COMMIT')
  }
  catch (error) {
    await db.run('ROLLBACK').catch(() => {})
    throw error
  }
 }
 /** @param {Awaited<ReturnType<typeof import('./db.js').getDb>>} db */
 async function tilesAreFresh(db, keys) {
  if (!keys.length) return false
  const placeholders = keys.map(() => '?').join(',')
  const rows = await db.all(
    `SELECT tile_key, fetched_at FROM alpr_tiles WHERE tile_key IN (${placeholders})`,
    keys,
  )
  if (rows.length !== keys.length) return false
  const cutoff = Date.now() - CACHE_TTL_MS
  return rows.every(row => Date.parse(row.fetched_at) >= cutoff)
 }
 /** @param {Awaited<ReturnType<typeof import('./db.js').getDb>>} db */
 export async function getCachedAlprNodes(db, bbox) {
  const rows = await db.all(
    `SELECT osm_id, lat, lng, manufacturer, direction, tags
     FROM alpr_nodes
     WHERE lat >= ? AND lat <= ? AND lng >= ? AND lng <= ?`,
    [bbox.south, bbox.north, bbox.west, bbox.east],
  )
  return rows.map(row => rowToCamera(row, 'cache'))
 }
 export async function fetchOverpass(query) {
  const res = await fetch(OVERPASS_URL, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: `data=${encodeURIComponent(query)}`,
    signal: AbortSignal.timeout(120_000),
  })
  if (!res.ok) {
    throw httpError(502, `Overpass error: ${res.status}`)
  }
  const data = await res.json()
  const elements = Array.isArray(data?.elements) ? data.elements : []
  return elements.map(parseOverpassElement).filter(Boolean)
 }
 /** @param {Awaited<ReturnType<typeof import('./db.js').getDb>>} db */
 async function fetchAndCacheBbox(db, bbox, tileKeys) {
  const live = await fetchOverpass(buildBboxQuery(bbox))
  await upsertAlprNodesBatch(db, live)
  await markTilesFetched(db, tileKeys)
  return live.map(c => ({ ...c, source: 'live' }))
 }
 const refreshInFlight = new Map()
 /** @param {Awaited<ReturnType<typeof import('./db.js').getDb>>} db */
 function refreshBboxInBackground(db, bbox, tileKeys) {
  const key = tileKeys.join('|')
  if (refreshInFlight.has(key)) return
  const job = fetchAndCacheBbox(db, bbox, tileKeys)
    .catch(() => {})
    .finally(() => refreshInFlight.delete(key))
  refreshInFlight.set(key, job)
 }
 /** @param {Awaited<ReturnType<typeof import('./db.js').getDb>>} db */
 export async function getAlprCameras(db, bbox) {
  const tileKeys = tileKeysForBbox(bbox)
  const cached = await getCachedAlprNodes(db, bbox)
  if (await tilesAreFresh(db, tileKeys)) {
    return featureCollection(cached.map(cameraToFeature), 'cache')
  }
  if (cached.length > 0) {
    refreshBboxInBackground(db, bbox, tileKeys)
    return featureCollection(cached.map(cameraToFeature), 'cache')
  }
  try {
    const live = await fetchAndCacheBbox(db, bbox, tileKeys)
    return featureCollection(live.map(cameraToFeature), 'live')
  }
  catch {
    return featureCollection(cached.map(cameraToFeature), 'cache')
  }
 }
 /** @param {Awaited<ReturnType<typeof import('./db.js').getDb>>} db */
 export async function importAllAlprNodes(db) {
  const cameras = await fetchOverpass(buildGlobalQuery())
  await upsertAlprNodesBatch(db, cameras)
  return cameras.length
 }
@@ -0,0 +1,175 @@
 const ATTRIBUTION = '© OpenStreetMap contributors'
 /** Longest match first — Flock, Genetec, Leonardo, etc. */
 const KNOWN_ALPR_MODELS = [
  'Falcon Flex',
  'AutoVu CR-H2',
  'AutoVu Sharp',
  'UnicamVELOCITY3',
  'Falcon',
  'Sparrow',
  'Raven',
  'Condor',
  'Wing',
  'Pelican',
 ]
 const GENERIC_CAMERA_NAMES = new Set([
  'flock alpr camera',
  'flock alpr cameera',
  'flock camera',
  'flock alpr',
  'flock',
  'flock camera',
  'automatic license plate reader (alpr)',
  'alpr camera',
  'alpr',
 ])
 const SKIP_EXTRA_TAGS = new Set([
  'surveillance:type',
  'man_made',
  'camera:direction',
  'direction',
  'camera:angle',
  'surveillance:angle',
  'manufacturer',
  'brand',
  'model',
  'operator',
  'name',
  'ref',
  'surveillance',
  'camera:type',
  'description',
  'note',
  'colour',
  'color',
  'manufacturer:wikidata',
  'model:wikidata',
  'operator:wikidata',
 ])
 function escapeRegex(text) {
  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
 }
 /** @param {string} value */
 export function normalizeModelName(value) {
  const trimmed = value.trim()
  if (!trimmed) return null
  const lower = trimmed.toLowerCase()
  for (const model of KNOWN_ALPR_MODELS) {
    if (model.toLowerCase() === lower) return model
  }
  return trimmed.split(/\s+/).map(word =>
    word.charAt(0).toUpperCase() + word.slice(1).toLowerCase(),
  ).join(' ')
 }
 /** @param {string} text */
 function matchKnownModel(text) {
  for (const model of KNOWN_ALPR_MODELS) {
    const re = new RegExp(`\\b${escapeRegex(model)}\\b`, 'i')
    if (re.test(text)) return model
  }
  const flock = text.match(/\bFlock\s+([a-z][\w -]*)/i)
  if (flock) {
    const fragment = flock[1].trim()
    if (!fragment || /^safety$/i.test(fragment)) return null
    return matchKnownModel(fragment)
  }
  return null
 }
 /** @param {Record<string, string>} tags */
 export function inferModelFromTags(tags) {
  const t = tags ?? {}
  if (t.model?.trim()) return normalizeModelName(t.model)
  for (const key of ['name', 'description', 'note']) {
    const value = t[key]
    if (!value?.trim()) continue
    const model = matchKnownModel(value)
    if (model) return model
  }
  return null
 }
 /** @param {string | null | undefined} name */
 export function isGenericCameraName(name) {
  if (!name?.trim()) return false
  const normalized = name.trim().toLowerCase()
  if (GENERIC_CAMERA_NAMES.has(normalized)) return true
  if (/^flock\s+alpr\b/i.test(name) && !matchKnownModel(name)) return true
  if (matchKnownModel(name) && /\bflock\b/i.test(name)) return true
  return false
 }
 /** @param {Record<string, string>} tags */
 export function displayNameFromTags(tags) {
  const name = tags?.name?.trim()
  if (!name || isGenericCameraName(name)) return null
  if (matchKnownModel(name)) return null
  return name
 }
 /** @param {Record<string, string>} tags */
 export function identifyingProperties(tags, manufacturer = null) {
  const t = tags ?? {}
  const mfr = manufacturer ?? t.manufacturer ?? t.brand ?? null
  const model = inferModelFromTags(t)
  const name = displayNameFromTags(t)
  /** @type {Record<string, string | boolean>} */
  const props = {}
  if (mfr) props.manufacturer = mfr
  if (model) props.model = model
  if (mfr && !model) props.modelUnknown = true
  if (t.brand && t.brand !== mfr) props.brand = t.brand
  if (t.operator) props.operator = t.operator
  if (name) props.name = name
  if (t.ref) props.ref = t.ref
  if (t.surveillance) props.surveillance = t.surveillance
  if (t['camera:type']) props.cameraType = t['camera:type']
  if (t.description) props.description = t.description
  if (t.note) props.note = t.note
  const colour = t.colour ?? t.color
  if (colour) props.colour = colour
  if (t['manufacturer:wikidata']) props.manufacturerWikidata = t['manufacturer:wikidata']
  if (t['model:wikidata']) props.modelWikidata = t['model:wikidata']
  if (t['operator:wikidata']) props.operatorWikidata = t['operator:wikidata']
  const extra = {}
  for (const [key, value] of Object.entries(t)) {
    if (SKIP_EXTRA_TAGS.has(key) || !value?.trim()) continue
    extra[key] = value
  }
  if (Object.keys(extra).length) props.tags = extra
  return props
 }
 /** @param {{ osmId: number, lat: number, lng: number, manufacturer: string | null, direction: number | null, fov: number | null, tags: Record<string, string> }} camera */
 export function cameraToFeature(camera) {
  return {
    type: 'Feature',
    id: camera.osmId,
    geometry: { type: 'Point', coordinates: [camera.lng, camera.lat] },
    properties: {
      osmId: camera.osmId,
      direction: camera.direction,
      fov: camera.fov,
      ...identifyingProperties(camera.tags, camera.manufacturer),
    },
  }
 }
 /** @param {ReturnType<typeof cameraToFeature>[]} features */
 export function featureCollection(features, source) {
  return {
    type: 'FeatureCollection',
    features,
    attribution: ATTRIBUTION,
    source,
  }
 }
 export { ATTRIBUTION }
@@ -19,6 +19,8 @@ export const SKIP_PATHS = Object.freeze([
 ])
 export const PROTECTED_PATH_PREFIXES = Object.freeze([
  '/api/alpr',
  '/api/cot',
  '/api/cameras',
  '/api/devices',
  '/api/live',
@@ -2,10 +2,22 @@
 * Application constants with environment variable support.
 */
 // CoT / tracking (fixed defaults — not env-configurable)
 export const COT_TTL_MS = 90_000
 /** @deprecated Use COT_TTL_MS */
 export const COT_ENTITY_TTL_MS = COT_TTL_MS
 export const COT_OSINT_TTL_MS = 30_000
 export const COT_PRUNE_INTERVAL_MS = 15_000
 export const COT_SSE_HEARTBEAT_MS = 15_000
 export const OPENSKY_CACHE_MS = 5_000
 export const TRACKING_FEED_DEBOUNCE_MS = 500
 export const COT_TAK_FILTER_BBOX = false
 export const COT_SSE_MAX_ENTITIES = 2000
 export const MAX_OPENSKY_BBOX_DEGREES = 10
 // Timeouts (milliseconds)
 export const COT_AUTH_TIMEOUT_MS = Number(process.env.COT_AUTH_TIMEOUT_MS) || 15_000
 export const LIVE_SESSION_TTL_MS = Number(process.env.LIVE_SESSION_TTL_MS) || 60_000
 export const COT_ENTITY_TTL_MS = Number(process.env.COT_ENTITY_TTL_MS) || 90_000
 export const POLL_INTERVAL_MS = Number(process.env.POLL_INTERVAL_MS) || 1500
 export const SHUTDOWN_TIMEOUT_MS = Number(process.env.SHUTDOWN_TIMEOUT_MS) || 30_000
@@ -0,0 +1,191 @@
 /**
 * CoT entity helpers: filters and OSINT → CoT mapping.
 */
 /**
 * @param {string} id
 * @returns {'adsb' | 'ais' | 'tak'} Inferred track source.
 */
 export function inferSourceFromId(id) {
  if (typeof id !== 'string') return 'tak'
  if (id.startsWith('ICAO.')) return 'adsb'
  if (id.startsWith('MMSI.')) return 'ais'
  return 'tak'
 }
 /**
 * @param {string} [type]
 * @returns {'air' | 'surface' | 'ground'} CoT display category.
 */
 export function cotCategoryFromType(type) {
  const t = typeof type === 'string' ? type : ''
  if (t.startsWith('a-f-A-')) return 'air'
  if (t.startsWith('a-f-S-')) return 'surface'
  return 'ground'
 }
 /**
 * @param {{ lat: number, lng: number }} point
 * @param {{ west: number, south: number, east: number, north: number }} bbox
 */
 export function isInBbox(point, bbox) {
  if (!point || !bbox) return false
  const { lat, lng } = point
  if (!Number.isFinite(lat) || !Number.isFinite(lng)) return false
  return lat >= bbox.south && lat <= bbox.north && lng >= bbox.west && lng <= bbox.east
 }
 /**
 * @param {Set<string> | string[] | undefined} layers
 * @param {{ type?: string, source?: string }} entity
 */
 export function matchesLayerFilter(layers, entity) {
  if (!layers || layers.size === 0) return true
  const category = cotCategoryFromType(entity.type)
  if (layers.has('air') && category === 'air') return true
  if (layers.has('surface') && category === 'surface') return true
  if (layers.has('ground') && category === 'ground') return true
  return false
 }
 /** OpenSky emitter category → MilStd CoT air type. */
 function openSkyCategoryToType(category) {
  if (category === 8) return 'a-f-A-C-H' // rotorcraft
  if (category === 14) return 'a-f-A-C-F' // UAV — plane icon
  return 'a-f-A-C-F'
 }
 /** OpenSky state vector → CoT upsert. */
 export function openSkyStateToCot(state) {
  if (!Array.isArray(state) || state.length < 11) return null
  const icao24 = String(state[0] ?? '').trim().toLowerCase()
  if (!icao24) return null
  const lat = Number(state[6])
  const lng = Number(state[5])
  if (!Number.isFinite(lat) || !Number.isFinite(lng)) return null
  const callsign = typeof state[1] === 'string' ? state[1].trim() : ''
  const originCountry = typeof state[2] === 'string' ? state[2].trim() : ''
  const category = Number(state[17])
  const type = Number.isFinite(category) ? openSkyCategoryToType(category) : 'a-f-A-C-F'
  const heading = Number(state[10])
  const speed = Number(state[9])
  const altitude = Number(state[7])
  const verticalRate = Number(state[11])
  const onGround = state[8] === true
  const squawk = state[14] != null ? String(state[14]).padStart(4, '0') : undefined
  return {
    id: `ICAO.${icao24}`,
    lat,
    lng,
    label: callsign || icao24.toUpperCase(),
    type,
    source: 'adsb',
    icao: icao24,
    originCountry: originCountry || undefined,
    heading: Number.isFinite(heading) ? heading : undefined,
    speed: Number.isFinite(speed) ? speed : undefined,
    altitude: Number.isFinite(altitude) ? altitude : undefined,
    verticalRate: Number.isFinite(verticalRate) ? verticalRate : undefined,
    onGround: onGround || undefined,
    squawk: squawk && squawk !== '0000' ? squawk : undefined,
  }
 }
 /** AISStream position report → CoT upsert. */
 export function aisStreamMessageToCot(message) {
  if (!message || typeof message !== 'object') return null
  const meta = /** @type {Record<string, unknown>} */ (message.MetaData)
  const msg = /** @type {Record<string, unknown>} */ (message.Message)
  if (!msg || typeof msg !== 'object') return null
  const report = /** @type {Record<string, unknown>} */ (
    msg.PositionReport ?? msg.StandardClassBPositionReport ?? msg.ExtendedClassBPositionReport
  )
  if (!report || typeof report !== 'object') return null
  const mmsi = Number(meta?.MMSI ?? report.UserID)
  if (!Number.isFinite(mmsi)) return null
  const lat = Number(report.Latitude)
  const lng = Number(report.Longitude)
  if (!Number.isFinite(lat) || !Number.isFinite(lng)) return null
  const shipName = typeof meta?.ShipName === 'string' ? meta.ShipName.trim() : ''
  const heading = Number(report.Cog ?? report.TrueHeading)
  const speed = Number(report.Sog)
  return {
    id: `MMSI.${mmsi}`,
    lat,
    lng,
    label: shipName || `MMSI ${mmsi}`,
    type: 'a-f-S-C',
    source: 'ais',
    mmsi: String(mmsi),
    heading: Number.isFinite(heading) ? heading : undefined,
    speed: Number.isFinite(speed) ? speed : undefined,
  }
 }
 /**
 * Union of subscriber bboxes.
 * @param {Array<{ west: number, south: number, east: number, north: number } | null | undefined>} boxes
 */
 export function unionBboxes(boxes) {
  let west = Infinity
  let south = Infinity
  let east = -Infinity
  let north = -Infinity
  let has = false
  for (const bbox of boxes) {
    if (!bbox) continue
    has = true
    west = Math.min(west, bbox.west)
    south = Math.min(south, bbox.south)
    east = Math.max(east, bbox.east)
    north = Math.max(north, bbox.north)
  }
  return has ? { west, south, east, north } : null
 }
 /**
 * Shrink bbox to max span (degrees per axis), centered on midpoint.
 * @param {{ west: number, south: number, east: number, north: number } | null} bbox
 * @param {number} maxDegrees
 */
 export function clampBbox(bbox, maxDegrees) {
  if (!bbox || !Number.isFinite(maxDegrees) || maxDegrees <= 0) return bbox
  const latSpan = bbox.north - bbox.south
  const lngSpan = bbox.east - bbox.west
  if (latSpan <= maxDegrees && lngSpan <= maxDegrees) return bbox
  const latMid = (bbox.north + bbox.south) / 2
  const lngMid = (bbox.east + bbox.west) / 2
  const half = maxDegrees / 2
  return {
    south: latMid - half,
    north: latMid + half,
    west: lngMid - half,
    east: lngMid + half,
  }
 }
 /**
 * @param {string | undefined} raw
 * @returns {Set<string>} Enabled layer names.
 */
 export function parseLayersParam(raw) {
  if (!raw || typeof raw !== 'string') {
    return new Set(['air', 'surface', 'ground'])
  }
  const parts = raw.split(',').map(s => s.trim().toLowerCase()).filter(Boolean)
  if (parts.length === 0 || parts.includes('none')) return new Set()
  return new Set(parts)
 }
 /**
 * @param {string | undefined} raw
 * @returns {{ west: number, south: number, east: number, north: number } | null} Parsed bbox or null.
 */
 export function parseBboxParam(raw) {
  if (!raw || typeof raw !== 'string') return null
  const parts = raw.split(',').map(s => Number(s.trim()))
  if (parts.length !== 4 || parts.some(n => !Number.isFinite(n))) return null
  const [west, south, east, north] = parts
  if (south > north || west > east) return null
  return { west, south, east, north }
 }
@@ -0,0 +1,15 @@
 import {
  COT_OSINT_TTL_MS,
  COT_SSE_MAX_ENTITIES,
  COT_TAK_FILTER_BBOX,
  COT_TTL_MS,
 } from './constants.js'
 export function getCotSnapshotOpts() {
  return {
    ttlMs: COT_TTL_MS,
    osintTtlMs: COT_OSINT_TTL_MS,
    takFilterBbox: COT_TAK_FILTER_BBOX,
    maxEntities: COT_SSE_MAX_ENTITIES,
  }
 }
@@ -1,66 +1,210 @@
 /**
- * In-memory CoT entity store: upsert by id, prune on read by TTL.
+ * In-memory CoT store (TAK, ADS-B, AIS).
 * Single source of truth; getActiveEntities returns new objects (no mutation of returned refs).
 */
 import { acquire } from './asyncLock.js'
-import { COT_ENTITY_TTL_MS } from './constants.js'
+import { COT_OSINT_TTL_MS, COT_TTL_MS } from './constants.js'
 import { inferSourceFromId, isInBbox, matchesLayerFilter } from './cotEntityUtils.js'
 const entities = new Map()
 /** @type {Set<(event: string, payload: unknown) => void>} */
 const listeners = new Set()
 /**
 * @param {(event: string, payload: unknown) => void} fn
 * @returns {() => void} Unsubscribe function.
 */
 export function onCotChange(fn) {
  listeners.add(fn)
  return () => listeners.delete(fn)
 }
 function emitChange(event, payload) {
  for (const fn of listeners) {
    try {
      fn(event, payload)
    }
    catch {
      /* ignore listener errors */
    }
  }
 }
 function pickOptionalNumber(value, fallback) {
  if (value === undefined || value === null) return fallback
  const n = Number(value)
  return Number.isFinite(n) ? n : fallback
 }
 /**
 * @param {Record<string, unknown>} entity
 */
 function toSnapshot(entity) {
  return {
    id: entity.id,
    lat: entity.lat,
    lng: entity.lng,
    label: entity.label ?? entity.id,
    type: entity.type ?? '',
    source: entity.source ?? 'tak',
    heading: entity.heading,
    speed: entity.speed,
    altitude: entity.altitude,
    verticalRate: entity.verticalRate,
    onGround: entity.onGround,
    originCountry: entity.originCountry,
    icao: entity.icao,
    mmsi: entity.mmsi,
    squawk: entity.squawk,
    updatedAt: entity.updatedAt,
  }
 }
 /**
 * @param {Record<string, unknown>} entity
 * @param {{ ttlMs?: number, osintTtlMs?: number }} opts
 */
 function entityTtlMs(entity, opts) {
  const source = entity.source
  if (source === 'adsb' || source === 'ais') {
    return opts.osintTtlMs ?? COT_OSINT_TTL_MS
  }
  return opts.ttlMs ?? COT_TTL_MS
 }
 function isEntityExpired(entity, now, opts) {
  return now - entity.updatedAt > entityTtlMs(entity, opts)
 }
 /**
 * Upsert entity by id. Input is not mutated; stored value is a new object.
- * @param {{ id: string, lat: number, lng: number, label?: string, eventType?: string, type?: string }} parsed
+ * @param {{ id: string, lat: number, lng: number, label?: string, eventType?: string, type?: string, source?: string, heading?: number, speed?: number, altitude?: number }} parsed
 * @param {{ silent?: boolean }} [options]
 */
-export async function updateFromCot(parsed) {
+export async function updateFromCot(parsed, options = {}) {
  if (!parsed || typeof parsed.id !== 'string') return
  const lat = Number(parsed.lat)
  const lng = Number(parsed.lng)
  if (!Number.isFinite(lat) || !Number.isFinite(lng)) return
  let snapshot = null
  await acquire(`cot-${parsed.id}`, async () => {
    const now = Date.now()
    const existing = entities.get(parsed.id)
    const label = typeof parsed.label === 'string' ? parsed.label : (existing?.label ?? parsed.id)
-    const type = typeof parsed.eventType === 'string' ? parsed.eventType : (typeof parsed.type === 'string' ? parsed.type : (existing?.type ?? ''))
+    const type = typeof parsed.eventType === 'string'
      ? parsed.eventType
      : (typeof parsed.type === 'string' ? parsed.type : (existing?.type ?? ''))
    const explicitSource = parsed.source
    const source = explicitSource === 'adsb' || explicitSource === 'ais' || explicitSource === 'tak'
      ? explicitSource
      : inferSourceFromId(parsed.id)
-    entities.set(parsed.id, {
+    const stored = {
      id: parsed.id,
      lat,
      lng,
      label,
      type,
      source,
      heading: pickOptionalNumber(parsed.heading, existing?.heading),
      speed: pickOptionalNumber(parsed.speed, existing?.speed),
      altitude: pickOptionalNumber(parsed.altitude, existing?.altitude),
      verticalRate: pickOptionalNumber(parsed.verticalRate, existing?.verticalRate),
      onGround: typeof parsed.onGround === 'boolean' ? parsed.onGround : existing?.onGround,
      originCountry: typeof parsed.originCountry === 'string' ? parsed.originCountry : existing?.originCountry,
      icao: typeof parsed.icao === 'string' ? parsed.icao : existing?.icao,
      mmsi: typeof parsed.mmsi === 'string' ? parsed.mmsi : existing?.mmsi,
      squawk: typeof parsed.squawk === 'string' ? parsed.squawk : existing?.squawk,
      updatedAt: now,
-    })
+    }
    entities.set(parsed.id, stored)
    snapshot = toSnapshot(stored)
  })
  if (snapshot && !options.silent) emitChange('update', { entity: snapshot })
 }
 /**
 * @param {number} now
 * @param {{ ttlMs?: number, osintTtlMs?: number }} opts
 */
 function pruneExpired(now, opts) {
  const expired = []
  for (const entity of entities.values()) {
    if (isEntityExpired(entity, now, opts)) expired.push(entity.id)
  }
  for (const id of expired) {
    entities.delete(id)
    emitChange('remove', { id })
  }
 }
 /**
 * @param {{ ttlMs?: number, osintTtlMs?: number }} [opts]
 */
 export async function pruneStaleEntities(opts = {}) {
  const ttlMs = opts.ttlMs ?? COT_TTL_MS
  const osintTtlMs = opts.osintTtlMs ?? COT_OSINT_TTL_MS
  await acquire('cot-prune', async () => {
    pruneExpired(Date.now(), { ttlMs, osintTtlMs })
  })
 }
 /**
- * Active entities (updated within ttlMs). Prunes expired. Returns new array of new objects.
+ * @param {Record<string, unknown>} entity
- * @param {number} [ttlMs]
+ * @param {{ west: number, south: number, east: number, north: number } | null | undefined} bbox
- * @returns {Promise<Array<{ id: string, lat: number, lng: number, label: string, type: string, updatedAt: number }>>} Snapshot of active entities.
+ * @param {boolean} takFilterBbox
 */
-export async function getActiveEntities(ttlMs = COT_ENTITY_TTL_MS) {
+function passesBboxFilter(entity, bbox, takFilterBbox) {
  if (!bbox) return true
  const inBox = isInBbox(entity, bbox)
  if (entity.source === 'tak' && !takFilterBbox) return true
  return inBox
 }
 /**
 * Active entities (updated within ttlMs). Prunes expired. Returns new array of new objects.
 * @param {{ ttlMs?: number, osintTtlMs?: number }} [opts]
 */
 export async function getActiveEntities(opts = {}) {
  const ttlMs = opts.ttlMs ?? COT_TTL_MS
  const osintTtlMs = opts.osintTtlMs ?? COT_OSINT_TTL_MS
  return acquire('cot-prune', async () => {
    const now = Date.now()
    pruneExpired(now, { ttlMs, osintTtlMs })
    return [...entities.values()].map(toSnapshot)
  })
 }
 /**
 * Active entities filtered by viewport bbox and layer set.
 * @param {{ west: number, south: number, east: number, north: number } | null} bbox
 * @param {{ ttlMs?: number, osintTtlMs?: number, layers?: Set<string>, takFilterBbox?: boolean, maxEntities?: number }} [opts]
 */
 export async function getActiveEntitiesInBbox(bbox, opts = {}) {
  const ttlMs = opts.ttlMs ?? COT_TTL_MS
  const osintTtlMs = opts.osintTtlMs ?? COT_OSINT_TTL_MS
  const layers = opts.layers
  const takFilterBbox = Boolean(opts.takFilterBbox)
  const ttlOpts = { ttlMs, osintTtlMs }
  return acquire('cot-prune', async () => {
    const now = Date.now()
    pruneExpired(now, ttlOpts)
    const active = []
    const expired = []
    for (const entity of entities.values()) {
-      if (now - entity.updatedAt <= ttlMs) {
+      if (isEntityExpired(entity, now, ttlOpts)) continue
-        active.push({
+      const snap = toSnapshot(entity)
-          id: entity.id,
+      if (!passesBboxFilter(snap, bbox, takFilterBbox)) continue
-          lat: entity.lat,
+      if (!matchesLayerFilter(layers, snap)) continue
-          lng: entity.lng,
+      active.push(snap)
-          label: entity.label ?? entity.id,
+    }
-          type: entity.type ?? '',
+    const maxEntities = opts.maxEntities
-          updatedAt: entity.updatedAt,
+    if (maxEntities != null && active.length > maxEntities) {
-        })
+      active.sort((a, b) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0))
-      }
+      active.length = maxEntities
      else {
        expired.push(entity.id)
      }
    }
    for (const id of expired) entities.delete(id)
    return active
  })
 }
@@ -0,0 +1,70 @@
 /** SSE subscriber registry; bbox union drives OSINT feeds. */
 import { getActiveEntitiesInBbox } from './cotStore.js'
 import { isInBbox, matchesLayerFilter, unionBboxes } from './cotEntityUtils.js'
 /** @typedef {{ west: number, south: number, east: number, north: number }} Bbox */
 /** @typedef {(event: string, data: string) => Promise<void> | void} PushFn */
 /** @type {Map<string, { bbox: Bbox | null, layers: Set<string>, push: PushFn }>} */
 const subscribers = new Map()
 let nextId = 1
 /**
 * @param {{ bbox: Bbox | null, layers: Set<string>, push: PushFn }} sub
 * @returns {() => void} Unregister function.
 */
 export function registerSubscriber(sub) {
  const id = String(nextId++)
  subscribers.set(id, sub)
  return () => subscribers.delete(id)
 }
 /** @returns {Bbox | null} Union of all subscriber bboxes. */
 export function getSubscriberBboxUnion() {
  return unionBboxes([...subscribers.values()].map(s => s.bbox))
 }
 export function getSubscriberCount() {
  return subscribers.size
 }
 export function clearSubscribers() {
  subscribers.clear()
 }
 export async function notifySubscribersForEntity(event, payload, entity) {
  const data = JSON.stringify(payload)
  const tasks = []
  for (const sub of subscribers.values()) {
    if (sub.bbox && !isInBbox(entity, sub.bbox)) continue
    if (!matchesLayerFilter(sub.layers, entity)) continue
    tasks.push(Promise.resolve(sub.push(event, data)))
  }
  await Promise.all(tasks)
 }
 export async function notifySubscribersRemove(id) {
  const data = JSON.stringify({ id })
  await Promise.all(
    [...subscribers.values()].map(sub => Promise.resolve(sub.push('remove', data))),
  )
 }
 /**
 * Push a filtered snapshot to each active SSE subscriber.
 * @param {{ ttlMs?: number, osintTtlMs?: number, takFilterBbox?: boolean, maxEntities?: number }} snapshotOpts
 */
 export async function broadcastSubscriberSnapshots(snapshotOpts) {
  const tasks = []
  for (const sub of subscribers.values()) {
    tasks.push((async () => {
      const entities = await getActiveEntitiesInBbox(sub.bbox, {
        ...snapshotOpts,
        layers: sub.layers,
      })
      await sub.push('snapshot', JSON.stringify({ entities }))
    })())
  }
  await Promise.all(tasks)
 }
@@ -1,16 +1,14 @@
 import { join, dirname } from 'node:path'
 import { mkdirSync, existsSync } from 'node:fs'
 import { randomBytes, randomUUID } from 'node:crypto'
 import { createRequire } from 'node:module'
 import { promisify } from 'node:util'
 import { randomBytes } from 'node:crypto'
 import { hashPassword } from './password.js'
 import { registerCleanup } from './shutdown.js'
 // Resolve from project root so bundled server (e.g. .output) finds node_modules/sqlite3
 const requireFromRoot = createRequire(join(process.cwd(), 'package.json'))
-const sqlite3 = requireFromRoot('sqlite3')
+const { DatabaseSync } = requireFromRoot('node:sqlite')
-const SCHEMA_VERSION = 4
+const SCHEMA_VERSION = 6
 const DB_BUSY_TIMEOUT_MS = 5000
 let dbInstance = null
@@ -61,6 +59,20 @@ const SCHEMA = {
    source_type TEXT NOT NULL DEFAULT 'mjpeg',
    config TEXT
  )`,
  alpr_nodes: `CREATE TABLE IF NOT EXISTS alpr_nodes (
    osm_id INTEGER PRIMARY KEY,
    lat REAL NOT NULL,
    lng REAL NOT NULL,
    manufacturer TEXT,
    direction INTEGER,
    tags TEXT NOT NULL,
    fetched_at TEXT NOT NULL
  )`,
  alpr_nodes_index: 'CREATE INDEX IF NOT EXISTS idx_alpr_lat_lng ON alpr_nodes(lat, lng)',
  alpr_tiles: `CREATE TABLE IF NOT EXISTS alpr_tiles (
    tile_key TEXT PRIMARY KEY,
    fetched_at TEXT NOT NULL
  )`,
 }
 const getDbPath = () => {
@@ -120,6 +132,19 @@ const migrateToV4 = async (run, all) => {
  await run('ALTER TABLE users ADD COLUMN cot_password_hash TEXT')
 }
 const migrateToV5 = async (run, all) => {
  const tables = await all('SELECT name FROM sqlite_master WHERE type=\'table\' AND name=\'alpr_nodes\'')
  if (tables.length > 0) return
  await run(SCHEMA.alpr_nodes)
  await run(SCHEMA.alpr_nodes_index)
 }
 const migrateToV6 = async (run, all) => {
  const tables = await all('SELECT name FROM sqlite_master WHERE type=\'table\' AND name=\'alpr_tiles\'')
  if (tables.length > 0) return
  await run(SCHEMA.alpr_tiles)
 }
 const runMigrations = async (run, all, get) => {
  const version = await getSchemaVersion(get)
  if (version >= SCHEMA_VERSION) return
@@ -135,6 +160,14 @@ const runMigrations = async (run, all, get) => {
    await migrateToV4(run, all)
    await setSchemaVersion(run, 4)
  }
  if (version < 5) {
    await migrateToV5(run, all)
    await setSchemaVersion(run, 5)
  }
  if (version < 6) {
    await migrateToV6(run, all)
    await setSchemaVersion(run, 6)
  }
 }
 const initDb = async (db, run, all, get) => {
@@ -144,7 +177,6 @@ const initDb = async (db, run, all, get) => {
  catch {
    // WAL not supported (e.g., network filesystem)
  }
  db.configure('busyTimeout', DB_BUSY_TIMEOUT_MS)
  await run(SCHEMA.schema_version)
  await run(SCHEMA.users)
@@ -152,6 +184,9 @@ const initDb = async (db, run, all, get) => {
  await run(SCHEMA.sessions)
  await run(SCHEMA.pois)
  await run(SCHEMA.devices)
  await run(SCHEMA.alpr_nodes)
  await run(SCHEMA.alpr_nodes_index)
  await run(SCHEMA.alpr_tiles)
  if (!testPath) {
    // Bootstrap admin user on first run
@@ -168,7 +203,7 @@ const initDb = async (db, run, all, get) => {
      await run(
        'INSERT INTO users (id, identifier, password_hash, role, created_at, auth_provider, oidc_issuer, oidc_sub) VALUES (?, ?, ?, ?, ?, ?, ?, ?)',
-        [crypto.randomUUID(), identifier, hashPassword(plainPassword), 'admin', new Date().toISOString(), 'local', null, null],
+        [randomUUID(), identifier, hashPassword(plainPassword), 'admin', new Date().toISOString(), 'local', null, null],
      )
      if (!email || !password) {
@@ -181,37 +216,104 @@ const initDb = async (db, run, all, get) => {
 export async function getDb() {
  if (dbInstance) return dbInstance
-  const db = new sqlite3.Database(getDbPath(), (err) => {
+  const sqliteDb = (() => {
-    if (err) {
+    try {
      return new DatabaseSync(getDbPath(), { timeout: DB_BUSY_TIMEOUT_MS })
    }
    catch (err) {
      console.error('[db] Failed to open database:', err.message)
      throw err
    }
-  })
+  })()
-  const run = promisify(db.run.bind(db))
+  const run = (sql, params = []) =>
-  const all = promisify(db.all.bind(db))
+    new Promise((resolve, reject) => {
-  const get = promisify(db.get.bind(db))
+      const stmt = sqliteDb.prepare(sql)
      try {
        stmt.run(...params)
        resolve()
      }
      catch (error) {
        reject(error)
      }
      finally {
        try {
          stmt.finalize()
        }
        catch {
          // ignore finalize errors
        }
      }
    })
  const all = (sql, params = []) =>
    new Promise((resolve, reject) => {
      const stmt = sqliteDb.prepare(sql)
      try {
        const rows = stmt.all(...params)
        resolve(rows)
      }
      catch (error) {
        reject(error)
      }
      finally {
        try {
          stmt.finalize()
        }
        catch {
          // ignore finalize errors
        }
      }
    })
  const get = (sql, params = []) =>
    new Promise((resolve, reject) => {
      const stmt = sqliteDb.prepare(sql)
      try {
        const row = stmt.get(...params)
        resolve(row)
      }
      catch (error) {
        reject(error)
      }
      finally {
        try {
          stmt.finalize()
        }
        catch {
          // ignore finalize errors
        }
      }
    })
  const wrappedDb = {
    close(callback) {
      try {
        sqliteDb.close()
        if (typeof callback === 'function') callback(null)
      }
      catch (error) {
        if (typeof callback === 'function') callback(error)
        else throw error
      }
    },
  }
  try {
-    await initDb(db, run, all, get)
+    await initDb(wrappedDb, run, all, get)
  }
  catch (error) {
-    db.close()
+    wrappedDb.close()
    console.error('[db] Database initialization failed:', error.message)
    throw error
  }
-  dbInstance = { db, run, all, get }
+  dbInstance = { db: wrappedDb, run, all, get }
  registerCleanup(async () => {
    if (dbInstance) {
      try {
-        await new Promise((resolve, reject) => {
+        dbInstance.db.close()
          dbInstance.db.close((err) => {
            if (err) reject(err)
            else resolve()
          })
        })
      }
      catch (error) {
        console.error('[db] Error closing database during shutdown:', error?.message)
@@ -290,9 +392,7 @@ export async function withTransaction(db, callback) {
 export function closeDb() {
  if (!dbInstance) return
  try {
-    dbInstance.db.close((err) => {
+    dbInstance.db.close()
      if (err) console.error('[db] Error closing database:', err.message)
    })
  }
  catch (error) {
    console.error('[db] Error closing database:', error.message)
@@ -0,0 +1,280 @@
 /** OSINT feeds (AISStream, OpenSky) → cotStore. */
 import WebSocket from 'ws'
 import { updateFromCot } from './cotStore.js'
 import {
  broadcastSubscriberSnapshots,
  getSubscriberBboxUnion,
 } from './cotSubscribers.js'
 import { getCotSnapshotOpts } from './cotSnapshot.js'
 import { openSkyStateToCot, aisStreamMessageToCot, clampBbox } from './cotEntityUtils.js'
 import { OPENSKY_CACHE_MS, TRACKING_FEED_DEBOUNCE_MS, MAX_OPENSKY_BBOX_DEGREES } from './constants.js'
 const COALESCE_MS = 150
 const state = {
  aisSocket: null,
  aisReconnectTimer: null,
  aisBackoffMs: 1000,
  openSkyTimer: null,
  bboxDebounceTimer: null,
  coalesceTimer: null,
  openSkyToken: null,
  openSkyTokenExpiresAt: 0,
  /** @type {Map<string, { fetchedAt: number, states: unknown[][] }>} */
  openSkyCache: new Map(),
  lastAisBbox: null,
  stopped: false,
 }
 function getConfig() {
  return useRuntimeConfig()
 }
 function openskyPollMs() {
  return OPENSKY_CACHE_MS
 }
 async function fetchOpenSkyToken(clientId, clientSecret) {
  const now = Date.now()
  if (state.openSkyToken && state.openSkyTokenExpiresAt > now + 60_000) {
    return state.openSkyToken
  }
  const body = new URLSearchParams({
    grant_type: 'client_credentials',
    client_id: clientId,
    client_secret: clientSecret,
  })
  const res = await fetch('https://auth.opensky-network.org/auth/realms/opensky-network/protocol/openid-connect/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body,
  })
  if (!res.ok) throw new Error(`OpenSky auth failed: ${res.status}`)
  const json = await res.json()
  state.openSkyToken = json.access_token
  state.openSkyTokenExpiresAt = now + (Number(json.expires_in) || 1800) * 1000
  return state.openSkyToken
 }
 function cacheKeyForBbox(bbox) {
  const round = n => Math.round(n * 10) / 10
  return `${round(bbox.west)},${round(bbox.south)},${round(bbox.east)},${round(bbox.north)}`
 }
 async function fetchOpenSkyForBbox(bbox) {
  const config = getConfig()
  const clientId = config.openskyClientId
  const clientSecret = config.openskyClientSecret
  const cacheMs = openskyPollMs()
  const key = cacheKeyForBbox(bbox)
  const cached = state.openSkyCache.get(key)
  if (cached && Date.now() - cached.fetchedAt < cacheMs) {
    return cached.states
  }
  const params = new URLSearchParams({
    lamin: String(bbox.south),
    lomin: String(bbox.west),
    lamax: String(bbox.north),
    lomax: String(bbox.east),
  })
  const headers = {}
  if (clientId && clientSecret) {
    const token = await fetchOpenSkyToken(clientId, clientSecret)
    headers.Authorization = `Bearer ${token}`
  }
  const res = await fetch(`https://opensky-network.org/api/states/all?${params}`, { headers })
  if (!res.ok) {
    console.error('[trackingFeed] OpenSky fetch failed:', res.status)
    return []
  }
  const json = await res.json()
  const states = Array.isArray(json?.states) ? json.states : []
  state.openSkyCache.set(key, { fetchedAt: Date.now(), states })
  return states
 }
 export function scheduleCoalescedSnapshot() {
  if (state.coalesceTimer) clearTimeout(state.coalesceTimer)
  state.coalesceTimer = setTimeout(() => {
    state.coalesceTimer = null
    broadcastSubscriberSnapshots(getCotSnapshotOpts()).catch(() => {})
  }, COALESCE_MS)
 }
 async function ingestOpenSkyBbox(bbox) {
  try {
    const states = await fetchOpenSkyForBbox(bbox)
    for (const row of states) {
      const parsed = openSkyStateToCot(row)
      if (parsed) await updateFromCot(parsed, { silent: true })
    }
    if (states.length > 0) scheduleCoalescedSnapshot()
  }
  catch (err) {
    console.error('[trackingFeed] OpenSky error:', err?.message)
  }
 }
 async function pollOpenSky() {
  if (state.stopped) return
  const union = getSubscriberBboxUnion()
  const bbox = clampBbox(union, MAX_OPENSKY_BBOX_DEGREES)
  if (!bbox) return
  await ingestOpenSkyBbox(bbox)
 }
 function stopOpenSkyPoll() {
  if (state.openSkyTimer) {
    clearInterval(state.openSkyTimer)
    state.openSkyTimer = null
  }
 }
 /** Tests only. @internal */
 export function scheduleOpenSkyPollForTests() {
  scheduleOpenSkyPoll()
 }
 function scheduleOpenSkyPoll() {
  if (state.openSkyTimer || state.stopped) return
  if (!getSubscriberBboxUnion()) return
  const intervalMs = openskyPollMs()
  state.openSkyTimer = setInterval(() => {
    pollOpenSky().catch((err) => {
      console.error('[trackingFeed] OpenSky poll error:', err?.message)
    })
  }, intervalMs)
 }
 function aisBboxKey(bbox) {
  if (!bbox) return null
  return `${bbox.west},${bbox.south},${bbox.east},${bbox.north}`
 }
 function closeAisSocket() {
  if (state.aisSocket) {
    try {
      state.aisSocket.removeAllListeners()
      state.aisSocket.close()
    }
    catch { /* ignore */ }
    state.aisSocket = null
  }
 }
 function scheduleAisReconnect() {
  if (state.stopped || state.aisReconnectTimer) return
  state.aisReconnectTimer = setTimeout(() => {
    state.aisReconnectTimer = null
    connectAisStream()
  }, state.aisBackoffMs)
  state.aisBackoffMs = Math.min(state.aisBackoffMs * 2, 60_000)
 }
 function subscribeAisBbox(ws, bbox) {
  const apiKey = getConfig().aisstreamApiKey
  if (!apiKey || !bbox) return
  const key = aisBboxKey(bbox)
  if (key === state.lastAisBbox) return
  state.lastAisBbox = key
  ws.send(JSON.stringify({
    APIKey: apiKey,
    BoundingBoxes: [[[bbox.south, bbox.west], [bbox.north, bbox.east]]],
  }))
 }
 function connectAisStream() {
  const apiKey = getConfig().aisstreamApiKey
  if (!apiKey || state.stopped) return
  closeAisSocket()
  const ws = new WebSocket('wss://stream.aisstream.io/v0/stream')
  state.aisSocket = ws
  ws.on('open', () => {
    state.aisBackoffMs = 1000
    const union = getSubscriberBboxUnion()
    const bbox = clampBbox(union, MAX_OPENSKY_BBOX_DEGREES)
    if (bbox) subscribeAisBbox(ws, bbox)
  })
  ws.on('message', (data) => {
    try {
      const message = JSON.parse(data.toString())
      const parsed = aisStreamMessageToCot(message)
      if (parsed) updateFromCot(parsed).catch(() => {})
    }
    catch {
      /* ignore malformed AIS messages */
    }
  })
  ws.on('close', () => {
    state.aisSocket = null
    if (!state.stopped) scheduleAisReconnect()
  })
  ws.on('error', (err) => {
    console.error('[trackingFeed] AISStream error:', err?.message)
  })
 }
 function refreshFeedBboxes() {
  if (state.stopped) return
  const union = getSubscriberBboxUnion()
  const bbox = clampBbox(union, MAX_OPENSKY_BBOX_DEGREES)
  if (!bbox) {
    stopOpenSkyPoll()
    return
  }
  if (getConfig().aisstreamApiKey) {
    if (state.aisSocket?.readyState === WebSocket.OPEN) {
      subscribeAisBbox(state.aisSocket, bbox)
    }
    else if (!state.aisSocket) {
      connectAisStream()
    }
  }
  pollOpenSky().catch(() => {})
  scheduleOpenSkyPoll()
 }
 export function scheduleTrackingFeedRefresh() {
  if (state.bboxDebounceTimer) clearTimeout(state.bboxDebounceTimer)
  state.bboxDebounceTimer = setTimeout(() => {
    state.bboxDebounceTimer = null
    refreshFeedBboxes()
  }, TRACKING_FEED_DEBOUNCE_MS)
 }
 export function startTrackingFeed() {
  state.stopped = false
 }
 export function stopTrackingFeed() {
  state.stopped = true
  if (state.bboxDebounceTimer) clearTimeout(state.bboxDebounceTimer)
  if (state.coalesceTimer) clearTimeout(state.coalesceTimer)
  state.coalesceTimer = null
  stopOpenSkyPoll()
  if (state.aisReconnectTimer) clearTimeout(state.aisReconnectTimer)
  state.aisReconnectTimer = null
  closeAisSocket()
  state.openSkyCache.clear()
  state.lastAisBbox = null
 }
 /** Tests only. @internal */
 export function resetTrackingFeedForTests() {
  stopTrackingFeed()
  state.stopped = false
 }
 /** Tests only. @internal */
 export function isOpenSkyPollActive() {
  return state.openSkyTimer != null
 }
@@ -23,7 +23,7 @@ const ensureDevCerts = () => {
    )
  }
  catch (error) {
-    throw new Error(`Failed to generate dev certificates: ${error.message}`)
+    throw new Error(`Failed to generate dev certificates: ${error.message}`, { cause: error })
  }
 }
@@ -35,7 +35,7 @@ export function ensureDevCerts() {
    console.log('[test] Generated .dev-certs/key.pem and .dev-certs/cert.pem')
  }
  catch (error) {
-    throw new Error(`Failed to generate dev certificates: ${error.message}`)
+    throw new Error(`Failed to generate dev certificates: ${error.message}`, { cause: error })
  }
 }
@@ -7,6 +7,7 @@
 import { describe, it, expect, beforeAll, afterAll } from 'vitest'
 import { spawn, execSync } from 'node:child_process'
 import { connect } from 'node:tls'
 import { createServer } from 'node:net'
 import { existsSync, mkdirSync } from 'node:fs'
 import { join, dirname } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -21,11 +22,21 @@ const devCertsDir = join(projectRoot, '.dev-certs')
 const devKey = join(devCertsDir, 'key.pem')
 const devCert = join(devCertsDir, 'cert.pem')
 const API_PORT = 3000
 const COT_PORT = 8089
 const COT_AUTH_USER = 'test'
 const COT_AUTH_PASS = 'test'
 function getFreePort() {
  return new Promise((resolve, reject) => {
    const server = createServer()
    server.listen(0, () => {
      const address = server.address()
      const port = typeof address === 'object' && address ? address.port : 0
      server.close(() => resolve(port))
    })
    server.on('error', reject)
  })
 }
 function ensureDevCerts() {
  if (existsSync(devKey) && existsSync(devCert)) return
  mkdirSync(devCertsDir, { recursive: true })
@@ -37,12 +48,12 @@ function ensureDevCerts() {
 const FETCH_TIMEOUT_MS = 5000
-async function waitForHealth(timeoutMs = 90000) {
+async function waitForHealth(apiPort, timeoutMs = 90000) {
  const start = Date.now()
  while (Date.now() - start < timeoutMs) {
    for (const protocol of ['https', 'http']) {
      try {
-        const baseURL = `${protocol}://localhost:${API_PORT}`
+        const baseURL = `${protocol}://localhost:${apiPort}`
        const ctrl = new AbortController()
        const t = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT_MS)
        const res = await fetch(`${baseURL}/health`, { method: 'GET', signal: ctrl.signal })
@@ -55,16 +66,20 @@ async function waitForHealth(timeoutMs = 90000) {
    }
    await new Promise(r => setTimeout(r, 1000))
  }
-  throw new Error(`Health not OK on ${API_PORT} within ${timeoutMs}ms`)
+  throw new Error(`Health not OK on ${apiPort} within ${timeoutMs}ms`)
 }
 describe('Server and CoT integration', () => {
  const testState = {
    serverProcess: null,
    apiPort: 0,
    cotPort: 0,
  }
  beforeAll(async () => {
    ensureDevCerts()
    testState.apiPort = await getFreePort()
    testState.cotPort = await getFreePort()
    const serverPath = join(projectRoot, '.output', 'server', 'index.mjs')
    if (!existsSync(serverPath)) {
      execSync('npm run build', { cwd: projectRoot, stdio: 'pipe' })
@@ -72,6 +87,8 @@ describe('Server and CoT integration', () => {
    const dbPath = join(tmpdir(), `kestrelos-it-${process.pid}-${Date.now()}.db`)
    const env = {
      ...process.env,
      PORT: String(testState.apiPort),
      COT_PORT: String(testState.cotPort),
      DB_PATH: dbPath,
      BOOTSTRAP_EMAIL: COT_AUTH_USER,
      BOOTSTRAP_PASSWORD: COT_AUTH_PASS,
@@ -83,7 +100,7 @@ describe('Server and CoT integration', () => {
    })
    testState.serverProcess.stdout?.on('data', d => process.stdout.write(d))
    testState.serverProcess.stderr?.on('data', d => process.stderr.write(d))
-    await waitForHealth(90000)
+    await waitForHealth(testState.apiPort, 90000)
  }, 120000)
  afterAll(() => {
@@ -92,11 +109,11 @@ describe('Server and CoT integration', () => {
    }
  })
-  it('serves health on port 3000', async () => {
+  it('serves health on the configured API port', async () => {
    const tryProtocols = async (protocols) => {
      if (protocols.length === 0) throw new Error('No protocol succeeded')
      try {
-        const res = await fetch(`${protocols[0]}://localhost:${API_PORT}/health`, { method: 'GET', headers: { Accept: 'application/json' } })
+        const res = await fetch(`${protocols[0]}://localhost:${testState.apiPort}/health`, { method: 'GET', headers: { Accept: 'application/json' } })
        if (res?.ok) return res
        return tryProtocols(protocols.slice(1))
      }
@@ -112,10 +129,10 @@ describe('Server and CoT integration', () => {
    expect(body.endpoints).toHaveProperty('ready', '/health/ready')
  })
-  it('CoT on 8089: TAK client auth with username/password succeeds (socket stays open)', async () => {
+  it('CoT: TAK client auth with username/password succeeds (socket stays open)', async () => {
    const payload = buildAuthCotXml({ username: COT_AUTH_USER, password: COT_AUTH_PASS })
    const socket = await new Promise((resolve, reject) => {
-      const s = connect(COT_PORT, '127.0.0.1', { rejectUnauthorized: false }, () => {
+      const s = connect(testState.cotPort, '127.0.0.1', { rejectUnauthorized: false }, () => {
        s.write(payload, () => resolve(s))
      })
      s.on('error', reject)
@@ -1,27 +1,24 @@
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
 import { SHUTDOWN_TIMEOUT_MS } from '../../server/utils/constants.js'
 import { registerCleanup, graceful, initShutdownHandlers, clearCleanup } from '../../server/utils/shutdown.js'
 describe('shutdown integration', () => {
-  const testState = {
+  /** @type {import('vitest').MockInstance} */
-    originalExit: null,
+  let exitSpy
-    exitCalls: [],
+  /** @type {typeof process.on} */
-    originalOn: null,
+  let originalOn
  }
  beforeEach(() => {
    clearCleanup()
-    testState.exitCalls = []
+    exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {})
-    testState.originalExit = process.exit
+    originalOn = process.on
    process.exit = vi.fn((code) => {
      testState.exitCalls.push(code)
    })
    testState.originalOn = process.on
  })
  afterEach(() => {
-    process.exit = testState.originalExit
+    exitSpy.mockRestore()
-    process.on = testState.originalOn
+    process.on = originalOn
    clearCleanup()
    vi.useRealTimers()
  })
  it('initializes signal handlers', () => {
@@ -32,7 +29,6 @@ describe('shutdown integration', () => {
    initShutdownHandlers()
    expect(process.on).toHaveBeenCalledWith('SIGTERM', expect.any(Function))
    expect(process.on).toHaveBeenCalledWith('SIGINT', expect.any(Function))
    process.on = testState.originalOn
  })
  it('signal handler calls graceful', async () => {
@@ -43,9 +39,10 @@ describe('shutdown integration', () => {
    initShutdownHandlers()
    const sigtermHandler = handlers.SIGTERM
    expect(sigtermHandler).toBeDefined()
-    await sigtermHandler()
+    sigtermHandler()
-    expect(testState.exitCalls.length).toBeGreaterThan(0)
+    await vi.waitFor(() => {
-    process.on = testState.originalOn
+      expect(exitSpy).toHaveBeenCalled()
    })
  })
  it('signal handler handles graceful error', async () => {
@@ -59,18 +56,20 @@ describe('shutdown integration', () => {
    registerCleanup(async () => {
      throw new Error('Force error')
    })
-    await sigintHandler()
+    sigintHandler()
-    expect(testState.exitCalls.length).toBeGreaterThan(0)
+    await vi.waitFor(() => {
-    process.on = testState.originalOn
+      expect(exitSpy).toHaveBeenCalled()
    })
  })
  it('covers timeout path in graceful', async () => {
    vi.useFakeTimers()
    registerCleanup(async () => {
-      await new Promise(resolve => setTimeout(resolve, 40000))
+      await new Promise(resolve => setTimeout(resolve, SHUTDOWN_TIMEOUT_MS + 5_000))
    })
    graceful()
-    await new Promise(resolve => setTimeout(resolve, 100))
+    await vi.advanceTimersByTimeAsync(SHUTDOWN_TIMEOUT_MS + 1)
-    expect(testState.exitCalls.length).toBeGreaterThan(0)
+    expect(exitSpy).toHaveBeenCalledWith(1)
  })
  it('covers graceful catch block', async () => {
@@ -78,6 +77,6 @@ describe('shutdown integration', () => {
      throw new Error('Test error')
    })
    await graceful()
-    expect(testState.exitCalls.length).toBeGreaterThan(0)
+    expect(exitSpy).toHaveBeenCalled()
  })
 })
@@ -75,4 +75,12 @@ describe('KestrelMap', () => {
    expect(wrapper.props('pois')).toHaveLength(1)
    expect(wrapper.props('canEditPois')).toBe(false)
  })
  it('includes CoT layer toggles and supercluster layer', async () => {
    const componentPath = resolve(__dirname, '../../app/components/KestrelMap.vue')
    const source = readFileSync(componentPath, 'utf-8')
    expect(source).toContain('cot-layer-toggles')
    expect(source).toContain('cotMapLayer')
    expect(source).toContain('syncCotLayer')
  })
 })
@@ -15,26 +15,12 @@ describe('useCameras', () => {
    setupEndpoints(() => ({
      devices: [{ id: '1', name: 'Test', lat: 37.7, lng: -122.4, streamUrl: '', sourceType: 'mjpeg', device_type: 'feed' }],
      liveSessions: [],
      cotEntities: [],
    }))
    const wrapper = await mountSuspended(Index)
    await wait()
    expect(wrapper.findComponent({ name: 'KestrelMap' }).exists()).toBe(true)
  })
  it('exposes cotEntities from API', async () => {
    const cotEntities = [{ id: 'cot-1', lat: 38, lng: -123, label: 'ATAK1' }]
    setupEndpoints(() => ({
      devices: [],
      liveSessions: [],
      cotEntities,
    }))
    const wrapper = await mountSuspended(Index)
    await wait()
    const map = wrapper.findComponent({ name: 'KestrelMap' })
    expect(map.props('cotEntities')).toEqual(cotEntities)
  })
  it('handles API error and falls back to empty devices and liveSessions', async () => {
    setupEndpoints(() => {
      throw new Error('network')
@@ -0,0 +1,38 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest'
 import { useCotLayers } from '../../app/composables/useCotLayers.js'
 describe('useCotLayers', () => {
  beforeEach(() => {
    localStorage.clear()
  })
  afterEach(() => {
    localStorage.clear()
  })
  it('defaults all layers on', () => {
    const { layers, layerQuery } = useCotLayers()
    expect(layers.value).toEqual({ air: true, surface: true, ground: true })
    expect(layerQuery.value).toBe('air,surface,ground')
  })
  it('toggles layers and persists to localStorage', () => {
    const { layers, toggleLayer, layerQuery } = useCotLayers()
    toggleLayer('air')
    expect(layers.value.air).toBe(false)
    expect(layerQuery.value).toBe('surface,ground')
    const stored = JSON.parse(localStorage.getItem('kestrel-cot-layers'))
    expect(stored.air).toBe(false)
  })
 })
 describe('useCotStream helpers', () => {
  it('layer query none when all off', () => {
    localStorage.clear()
    const { toggleLayer, layerQuery } = useCotLayers()
    toggleLayer('air')
    toggleLayer('surface')
    toggleLayer('ground')
    expect(layerQuery.value).toBe('none')
  })
 })
@@ -0,0 +1,154 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import {
  parseOverpassElement,
  parseBbox,
  tileKeysForBbox,
  getAlprCameras,
  markTilesFetched,
 } from '../../server/utils/alpr.js'
 import { cameraToFeature, identifyingProperties, inferModelFromTags, isGenericCameraName } from '../../server/utils/alprGeo.js'
 import { getDb, setDbPathForTest, closeDb } from '../../server/utils/db.js'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { randomUUID } from 'node:crypto'
 describe('alpr utils', () => {
  describe('parseOverpassElement', () => {
    it('parses a valid OSM node', () => {
      const out = parseOverpassElement({
        type: 'node',
        id: 123,
        lat: 33.75,
        lon: -84.39,
        tags: { 'manufacturer': 'Flock Safety', 'camera:direction': '90' },
      })
      expect(out?.osmId).toBe(123)
      expect(out?.manufacturer).toBe('Flock Safety')
    })
  })
  describe('cameraToFeature', () => {
    it('returns GeoJSON Point feature with identifying tags', () => {
      const feature = cameraToFeature({
        osmId: 1,
        lat: 33.5,
        lng: -84.5,
        manufacturer: 'Flock Safety',
        direction: 90,
        fov: 45,
        tags: {
          'model': 'Falcon',
          'operator': 'City PD',
          'ref': 'CAM-12',
          'operator:wikidata': 'Q123',
          'fixme': 'verify mount',
        },
      })
      expect(feature.properties.manufacturer).toBe('Flock Safety')
      expect(feature.properties.model).toBe('Falcon')
      expect(feature.properties.operator).toBe('City PD')
      expect(feature.properties.ref).toBe('CAM-12')
      expect(feature.properties.operatorWikidata).toBe('Q123')
      expect(feature.properties.tags).toEqual({ fixme: 'verify mount' })
    })
  })
  describe('identifyingProperties', () => {
    it('omits brand when same as manufacturer', () => {
      const props = identifyingProperties({ manufacturer: 'Flock Safety', brand: 'Flock Safety', model: 'Falcon' })
      expect(props.manufacturer).toBe('Flock Safety')
      expect(props.model).toBe('Falcon')
      expect(props.brand).toBeUndefined()
    })
    it('infers model from lowercase name tag', () => {
      const props = identifyingProperties({
        manufacturer: 'Flock Safety',
        name: 'falcon',
      })
      expect(props.model).toBe('Falcon')
      expect(props.name).toBeUndefined()
      expect(props.modelUnknown).toBeUndefined()
    })
    it('drops generic camera names and flags unknown model', () => {
      const props = identifyingProperties({
        manufacturer: 'Flock Safety',
        name: 'Flock ALPR camera',
      })
      expect(props.name).toBeUndefined()
      expect(props.model).toBeUndefined()
      expect(props.modelUnknown).toBe(true)
    })
  })
  describe('inferModelFromTags', () => {
    it('reads model tag and mis-tagged Flock Falcon name', () => {
      expect(inferModelFromTags({ model: 'Sparrow' })).toBe('Sparrow')
      expect(inferModelFromTags({ name: 'Flock Falcon' })).toBe('Falcon')
      expect(isGenericCameraName('Flock ALPR camera')).toBe(true)
      expect(isGenericCameraName('Peachtree & 5th')).toBe(false)
    })
  })
  describe('parseBbox', () => {
    it('parses valid bbox', () => {
      expect(parseBbox({ south: 33.0, west: -85.0, north: 33.4, east: -84.6 })).toEqual({
        south: 33.0,
        west: -85.0,
        north: 33.4,
        east: -84.6,
      })
    })
    it('rejects oversized bbox', () => {
      expect(() => parseBbox({ south: 0, west: 0, north: 2, east: 1 })).toThrow(/bbox exceeds/)
    })
  })
  describe('cache and fetch', () => {
    let dbPath
    beforeEach(async () => {
      dbPath = join(tmpdir(), `kestrelos-alpr-${randomUUID()}.db`)
      setDbPathForTest(dbPath)
      await getDb()
    })
    afterEach(() => {
      closeDb()
      setDbPathForTest(null)
    })
    it('returns GeoJSON FeatureCollection from cache', async () => {
      const db = await getDb()
      const bbox = { south: 33.4, west: -85.0, north: 33.6, east: -84.0 }
      await db.run(
        `INSERT INTO alpr_nodes (osm_id, lat, lng, manufacturer, direction, tags, fetched_at)
         VALUES (?, ?, ?, ?, ?, ?, ?)`,
        [99, 33.5, -84.5, 'Acme', 180, '{}', new Date().toISOString()],
      )
      await markTilesFetched(db, tileKeysForBbox(bbox))
      vi.stubGlobal('fetch', vi.fn())
      const result = await getAlprCameras(db, bbox)
      expect(result.type).toBe('FeatureCollection')
      expect(result.features).toHaveLength(1)
      expect(result.source).toBe('cache')
      vi.unstubAllGlobals()
    })
    it('falls back to cache when Overpass fails', async () => {
      const db = await getDb()
      await db.run(
        `INSERT INTO alpr_nodes (osm_id, lat, lng, manufacturer, direction, tags, fetched_at)
         VALUES (?, ?, ?, ?, ?, ?, ?)`,
        [42, 33.5, -84.5, null, null, '{}', new Date().toISOString()],
      )
      vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new Error('network down')))
      const result = await getAlprCameras(db, { south: 33.4, west: -85.0, north: 33.6, east: -84.0 })
      expect(result.type).toBe('FeatureCollection')
      expect(result.features).toHaveLength(1)
      vi.unstubAllGlobals()
    })
  })
 })
@@ -0,0 +1,57 @@
 import { describe, it, expect } from 'vitest'
 import { formatAlprPopup } from '../../app/utils/alprMapLayer.js'
 describe('formatAlprPopup', () => {
  it('summarizes manufacturer, model, and operator', () => {
    const html = formatAlprPopup({
      osmId: 1,
      manufacturer: 'Flock Safety',
      model: 'Falcon',
      operator: 'City PD',
      direction: 90,
      fov: 60,
    })
    expect(html).toContain('Flock Safety')
    expect(html).toContain('Falcon')
    expect(html).toContain('License plate reader')
    expect(html).toContain('City PD')
    expect(html).toContain('Facing E (90°)')
    expect(html).toContain('~60° view')
    expect(html).not.toContain('Manufacturer')
    expect(html).not.toContain('fixme')
  })
  it('uses name as title with make/model below', () => {
    const html = formatAlprPopup({
      osmId: 2,
      name: 'Peachtree & 5th',
      manufacturer: 'Flock Safety',
      model: 'Falcon',
    })
    expect(html).toContain('<strong>Peachtree &amp; 5th</strong>')
    expect(html).toContain('Model</span> <strong>Falcon</strong>')
    expect(html).toContain('Flock Safety Falcon')
  })
  it('links operator wikidata inline', () => {
    const html = formatAlprPopup({
      osmId: 3,
      operator: 'Atlanta Police',
      operatorWikidata: 'Q123',
    })
    expect(html).toContain('<strong>')
    expect(html).toContain('href="https://www.wikidata.org/wiki/Q123"')
    expect(html).toContain('Atlanta Police')
    expect(html).not.toContain('Wikidata')
  })
  it('shows model unknown when OSM lacks model tag', () => {
    const html = formatAlprPopup({
      osmId: 4,
      manufacturer: 'Flock Safety',
      modelUnknown: true,
    })
    expect(html).toContain('Flock Safety')
    expect(html).toContain('Model not recorded in OpenStreetMap')
  })
 })
@@ -0,0 +1,10 @@
 import { describe, it, expect } from 'vitest'
 import { tilesNearCenter } from '../../app/utils/alprViewport.js'
 describe('tilesNearCenter', () => {
  it('returns a single tile for a small viewport', () => {
    const tiles = tilesNearCenter({ south: 37.7, west: -122.5, north: 37.8, east: -122.4 }, 16)
    expect(tiles).toHaveLength(1)
    expect(tiles[0]).toEqual({ south: 37.5, west: -122.5, north: 38, east: -122 })
  })
 })
@@ -10,6 +10,7 @@ describe('authSkipPaths', () => {
  it('does not skip any protected path', () => {
    const protectedPaths = [
      ...PROTECTED_PATH_PREFIXES,
      '/api/alpr',
      '/api/cameras',
      '/api/devices',
      '/api/devices/any-id',
@@ -2,7 +2,10 @@ import { describe, it, expect } from 'vitest'
 import {
  COT_AUTH_TIMEOUT_MS,
  LIVE_SESSION_TTL_MS,
  COT_TTL_MS,
  COT_ENTITY_TTL_MS,
  COT_OSINT_TTL_MS,
  COT_PRUNE_INTERVAL_MS,
  POLL_INTERVAL_MS,
  SHUTDOWN_TIMEOUT_MS,
  COT_PORT,
@@ -18,7 +21,10 @@ describe('constants', () => {
  it('uses default values when env vars not set', () => {
    expect(COT_AUTH_TIMEOUT_MS).toBe(15000)
    expect(LIVE_SESSION_TTL_MS).toBe(60000)
    expect(COT_TTL_MS).toBe(90000)
    expect(COT_ENTITY_TTL_MS).toBe(90000)
    expect(COT_OSINT_TTL_MS).toBe(30000)
    expect(COT_PRUNE_INTERVAL_MS).toBe(15000)
    expect(POLL_INTERVAL_MS).toBe(1500)
    expect(SHUTDOWN_TIMEOUT_MS).toBe(30000)
    expect(COT_PORT).toBe(8089)
@@ -0,0 +1,68 @@
 import { describe, it, expect } from 'vitest'
 import {
  cotAirIconKind,
  cotCategory,
  formatCotPopup,
  getCotIconHtml,
 } from '../../app/utils/cotDisplay.js'
 const esc = s => String(s)
 describe('cotDisplay', () => {
  it('detects helicopter from CoT type', () => {
    expect(cotAirIconKind({ type: 'a-f-A-C-H' })).toBe('helicopter')
    expect(cotAirIconKind({ type: 'a-f-A-C-F' })).toBe('fixedWing')
  })
  it('renders distinct air icon kinds', () => {
    const plane = getCotIconHtml({ type: 'a-f-A-C-F', heading: 90 })
    const heli = getCotIconHtml({ type: 'a-f-A-C-H', heading: 180 })
    expect(plane.className).toBe('cot-entity-fixedWing')
    expect(heli.className).toBe('cot-entity-helicopter')
    expect(plane.html).toContain('rotate(90deg)')
    expect(heli.html).toContain('rotate(180deg)')
  })
  it('formats rich ADS-B popup', () => {
    const html = formatCotPopup({
      source: 'adsb',
      type: 'a-f-A-C-F',
      label: 'UAL123',
      icao: 'abc123',
      originCountry: 'United States',
      altitude: 10000,
      speed: 200,
      heading: 270,
      verticalRate: 5,
      squawk: '1200',
    }, esc)
    expect(html).toContain('UAL123')
    expect(html).toContain('Aircraft')
    expect(html).toContain('ICAO ABC123')
    expect(html).toContain('United States')
    expect(html).toContain('ft')
    expect(html).toContain('kt')
    expect(html).toContain('270°')
    expect(html).toContain('Squawk 1200')
  })
  it('formats vessel popup with MMSI', () => {
    const html = formatCotPopup({
      source: 'ais',
      type: 'a-f-S-C',
      label: 'TEST SHIP',
      id: 'MMSI.366123456',
      speed: 12,
      heading: 90,
    }, esc)
    expect(html).toContain('Vessel')
    expect(html).toContain('MMSI 366123456')
  })
  it('formats team popup', () => {
    expect(cotCategory('a-f-G-U-C')).toBe('ground')
    const html = formatCotPopup({ type: 'a-f-G-U-C', label: 'Alpha 1' }, esc)
    expect(html).toContain('Team')
    expect(html).toContain('Alpha 1')
  })
 })
@@ -0,0 +1,111 @@
 import { describe, it, expect } from 'vitest'
 import {
  inferSourceFromId,
  cotCategoryFromType,
  isInBbox,
  matchesLayerFilter,
  openSkyStateToCot,
  aisStreamMessageToCot,
  unionBboxes,
  clampBbox,
  parseBboxParam,
  parseLayersParam,
 } from '../../../server/utils/cotEntityUtils.js'
 describe('cotEntityUtils', () => {
  it('infers source from UID prefix', () => {
    expect(inferSourceFromId('ICAO.abc123')).toBe('adsb')
    expect(inferSourceFromId('MMSI.366123456')).toBe('ais')
    expect(inferSourceFromId('ANDROID-deadbeef')).toBe('tak')
  })
  it('maps CoT type to category', () => {
    expect(cotCategoryFromType('a-f-A-C-F')).toBe('air')
    expect(cotCategoryFromType('a-f-S-C')).toBe('surface')
    expect(cotCategoryFromType('a-f-G-U-C')).toBe('ground')
  })
  it('checks bbox membership', () => {
    const bbox = { west: -123, south: 37, east: -122, north: 38 }
    expect(isInBbox({ lat: 37.5, lng: -122.5 }, bbox)).toBe(true)
    expect(isInBbox({ lat: 40, lng: -122.5 }, bbox)).toBe(false)
  })
  it('filters by layer set', () => {
    const airOnly = new Set(['air'])
    expect(matchesLayerFilter(airOnly, { type: 'a-f-A-C-F' })).toBe(true)
    expect(matchesLayerFilter(airOnly, { type: 'a-f-S-C' })).toBe(false)
  })
  it('maps OpenSky state vector to CoT', () => {
    const state = ['abc123', 'UAL123  ', 'United States', 1, 2, -122.4, 37.7, 10000, false, 200, 90, 5, null, null, 1200, false, 0, 0]
    const cot = openSkyStateToCot(state)
    expect(cot).toMatchObject({
      id: 'ICAO.abc123',
      lat: 37.7,
      lng: -122.4,
      label: 'UAL123',
      source: 'adsb',
      type: 'a-f-A-C-F',
      icao: 'abc123',
      originCountry: 'United States',
      heading: 90,
      speed: 200,
      altitude: 10000,
      verticalRate: 5,
      squawk: '1200',
    })
  })
  it('maps OpenSky rotorcraft to helicopter CoT type', () => {
    const state = ['heli01', 'N123HC  ', 'United States', 1, 2, -122.4, 37.7, 500, false, 50, 180, 0, null, null, null, false, 0, 8]
    const cot = openSkyStateToCot(state)
    expect(cot?.type).toBe('a-f-A-C-H')
  })
  it('maps AISStream message to CoT', () => {
    const cot = aisStreamMessageToCot({
      MetaData: { MMSI: 366123456, ShipName: 'TEST SHIP' },
      Message: {
        PositionReport: {
          UserID: 366123456,
          Latitude: 37.8,
          Longitude: -122.3,
          Sog: 12.5,
          Cog: 180,
        },
      },
    })
    expect(cot).toMatchObject({
      id: 'MMSI.366123456',
      lat: 37.8,
      lng: -122.3,
      label: 'TEST SHIP',
      source: 'ais',
      type: 'a-f-S-C',
    })
  })
  it('unions bboxes', () => {
    expect(unionBboxes([
      { west: -123, south: 37, east: -122, north: 38 },
      { west: -124, south: 36, east: -121, north: 39 },
    ])).toEqual({ west: -124, south: 36, east: -121, north: 39 })
  })
  it('clamps oversized bbox to max span', () => {
    const huge = { west: -125, south: 32, east: -115, north: 42 }
    const clamped = clampBbox(huge, 10)
    expect(clamped.north - clamped.south).toBeCloseTo(10)
    expect(clamped.east - clamped.west).toBeCloseTo(10)
    expect((clamped.north + clamped.south) / 2).toBeCloseTo(37)
    expect((clamped.east + clamped.west) / 2).toBeCloseTo(-120)
  })
  it('parses bbox and layers query params', () => {
    expect(parseBboxParam('-123,37,-122,38')).toEqual({ west: -123, south: 37, east: -122, north: 38 })
    expect(parseBboxParam('bad')).toBeNull()
    expect(parseLayersParam('air,surface')).toEqual(new Set(['air', 'surface']))
    expect(parseLayersParam('none').size).toBe(0)
  })
 })
@@ -0,0 +1,46 @@
 import { describe, it, expect } from 'vitest'
 import {
  entitiesToFeatures,
  getCotClusters,
  loadCotCluster,
 } from '../../app/utils/cotMapLayer.js'
 function makeEntities(n, centerLat = 37.7, centerLng = -122.4) {
  return Array.from({ length: n }, (_, i) => ({
    id: `ICAO.${i}`,
    lat: centerLat + (i % 10) * 0.01,
    lng: centerLng + Math.floor(i / 10) * 0.01,
    type: 'a-f-A-C-F',
    label: `AC${i}`,
  }))
 }
 describe('cotMapLayer', () => {
  it('converts entities to GeoJSON points', () => {
    const features = entitiesToFeatures([
      { id: 'ICAO.1', lat: 37.7, lng: -122.4, type: 'a-f-A-C-F' },
      { id: 'bad', lat: 'x', lng: 0 },
    ])
    expect(features).toHaveLength(1)
    expect(features[0].geometry.coordinates).toEqual([-122.4, 37.7])
    expect(features[0].properties.entity.id).toBe('ICAO.1')
  })
  it('clusters dense tracks at low zoom', () => {
    loadCotCluster(makeEntities(50))
    const view = { west: -123, south: 37, east: -122, north: 38, zoom: 6 }
    const clusters = getCotClusters(view)
    const clusterCount = clusters.filter(f => f.properties?.cluster).length
    const pointCount = clusters.filter(f => !f.properties?.cluster).length
    expect(clusterCount).toBeGreaterThan(0)
    expect(clusterCount + pointCount).toBeLessThan(50)
  })
  it('shows individual markers at high zoom', () => {
    loadCotCluster(makeEntities(20))
    const view = { west: -123, south: 37, east: -122, north: 38, zoom: 15 }
    const clusters = getCotClusters(view)
    expect(clusters.every(f => !f.properties?.cluster)).toBe(true)
    expect(clusters).toHaveLength(20)
  })
 })
@@ -44,4 +44,17 @@ describe('cotServer (parse-and-store path)', () => {
    expect(active[0].lng).toBe(4)
    expect(active[0].label).toBe('Updated')
  })
  it('infers adsb source from ICAO uid when ingesting CoT position', async () => {
    await updateFromCot({
      id: 'ICAO.abc123',
      lat: 37.7,
      lng: -122.4,
      label: 'N12345',
      eventType: 'a-f-A-C-F',
    })
    const active = await getActiveEntities()
    expect(active[0].source).toBe('adsb')
    expect(active[0].type).toBe('a-f-A-C-F')
  })
 })
@@ -1,5 +1,12 @@
 import { describe, it, expect, beforeEach } from 'vitest'
-import { updateFromCot, getActiveEntities, clearCotStore } from '../../../server/utils/cotStore.js'
+import {
  updateFromCot,
  getActiveEntities,
  getActiveEntitiesInBbox,
  clearCotStore,
  onCotChange,
  pruneStaleEntities,
 } from '../../../server/utils/cotStore.js'
 describe('cotStore', () => {
  beforeEach(() => {
@@ -14,6 +21,28 @@ describe('cotStore', () => {
    expect(active[0].lat).toBe(37.7)
    expect(active[0].lng).toBe(-122.4)
    expect(active[0].label).toBe('Alpha')
    expect(active[0].source).toBe('tak')
  })
  it('stores enriched ADS-B fields and infers source', async () => {
    await updateFromCot({
      id: 'ICAO.abc123',
      lat: 37.7,
      lng: -122.4,
      label: 'UAL1',
      type: 'a-f-A-C-F',
      heading: 90,
      speed: 200,
      altitude: 10000,
    })
    const active = await getActiveEntities()
    expect(active[0]).toMatchObject({
      source: 'adsb',
      heading: 90,
      speed: 200,
      altitude: 10000,
      type: 'a-f-A-C-F',
    })
  })
  it('updates same uid', async () => {
@@ -41,10 +70,10 @@ describe('cotStore', () => {
  it('prunes expired entities after getActiveEntities', async () => {
    await updateFromCot({ id: 'uid-1', lat: 37, lng: -122 })
-    const active1 = await getActiveEntities(100)
+    const active1 = await getActiveEntities({ ttlMs: 100 })
    expect(active1).toHaveLength(1)
    await new Promise(r => setTimeout(r, 150))
-    const active2 = await getActiveEntities(100)
+    const active2 = await getActiveEntities({ ttlMs: 100 })
    expect(active2).toHaveLength(0)
  })
@@ -55,4 +84,56 @@ describe('cotStore', () => {
    expect(active).toHaveLength(2)
    expect(active.map(e => e.id).sort()).toEqual(['a', 'b'])
  })
  it('filters OSINT entities by bbox but keeps team globally', async () => {
    await updateFromCot({ id: 'ICAO.abc', lat: 37.5, lng: -122.5, type: 'a-f-A-C-F' })
    await updateFromCot({ id: 'MMSI.123', lat: 40, lng: -100, type: 'a-f-S-C' })
    await updateFromCot({ id: 'ANDROID-1', lat: 50, lng: 10, source: 'tak' })
    const bbox = { west: -123, south: 37, east: -122, north: 38 }
    const active = await getActiveEntitiesInBbox(bbox, { takFilterBbox: false })
    const ids = active.map(e => e.id).sort()
    expect(ids).toEqual(['ANDROID-1', 'ICAO.abc'])
  })
  it('filters team by bbox when COT_TAK_FILTER_BBOX enabled', async () => {
    await updateFromCot({ id: 'ANDROID-1', lat: 50, lng: 10, source: 'tak' })
    const bbox = { west: -123, south: 37, east: -122, north: 38 }
    const active = await getActiveEntitiesInBbox(bbox, { takFilterBbox: true })
    expect(active).toHaveLength(0)
  })
  it('caps bbox query results at maxEntities', async () => {
    for (let i = 0; i < 5; i++) {
      await updateFromCot({ id: `ICAO.${i}`, lat: 37.5 + i * 0.01, lng: -122.4, type: 'a-f-A-C-F' })
    }
    const bbox = { west: -123, south: 37, east: -122, north: 38 }
    const active = await getActiveEntitiesInBbox(bbox, { maxEntities: 3 })
    expect(active).toHaveLength(3)
  })
  it('skips emit when silent upsert', async () => {
    const updates = []
    const off = onCotChange((event) => {
      if (event === 'update') updates.push(event)
    })
    await updateFromCot({ id: 'ICAO.silent', lat: 37, lng: -122, type: 'a-f-A-C-F' }, { silent: true })
    off()
    expect(updates).toHaveLength(0)
    const active = await getActiveEntities()
    expect(active.some(e => e.id === 'ICAO.silent')).toBe(true)
  })
  it('pruneStaleEntities uses shorter TTL for OSINT sources', async () => {
    await updateFromCot({ id: 'ICAO.old', lat: 37, lng: -122, source: 'adsb', type: 'a-f-A-C-F' })
    await updateFromCot({ id: 'ANDROID-1', lat: 37, lng: -122, source: 'tak' })
    const removed = []
    const off = onCotChange((event, payload) => {
      if (event === 'remove') removed.push(payload.id)
    })
    await new Promise(r => setTimeout(r, 60))
    await pruneStaleEntities({ ttlMs: 10_000, osintTtlMs: 50 })
    off()
    expect(removed).toContain('ICAO.old')
    expect(removed).not.toContain('ANDROID-1')
  })
 })
@@ -0,0 +1,96 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest'
 import {
  registerSubscriber,
  getSubscriberBboxUnion,
  clearSubscribers,
  notifySubscribersForEntity,
  notifySubscribersRemove,
  broadcastSubscriberSnapshots,
 } from '../../../server/utils/cotSubscribers.js'
 import { updateFromCot, clearCotStore } from '../../../server/utils/cotStore.js'
 describe('cotSubscribers', () => {
  beforeEach(() => {
    clearSubscribers()
  })
  it('unions subscriber bboxes', () => {
    registerSubscriber({
      bbox: { west: -123, south: 37, east: -122, north: 38 },
      layers: new Set(['air']),
      push: vi.fn(),
    })
    registerSubscriber({
      bbox: { west: -124, south: 36, east: -121, north: 39 },
      layers: new Set(['surface']),
      push: vi.fn(),
    })
    expect(getSubscriberBboxUnion()).toEqual({ west: -124, south: 36, east: -121, north: 39 })
  })
  it('notifies subscribers inside bbox and matching layer', async () => {
    const push = vi.fn()
    registerSubscriber({
      bbox: { west: -123, south: 37, east: -122, north: 38 },
      layers: new Set(['air']),
      push,
    })
    await notifySubscribersForEntity('update', { entity: { id: 'ICAO.x' } }, {
      id: 'ICAO.x',
      lat: 37.5,
      lng: -122.5,
      type: 'a-f-A-C-F',
    })
    expect(push).toHaveBeenCalledWith('update', expect.any(String))
  })
  it('skips subscribers when entity outside bbox', async () => {
    const push = vi.fn()
    registerSubscriber({
      bbox: { west: -123, south: 37, east: -122, north: 38 },
      layers: new Set(['air']),
      push,
    })
    await notifySubscribersForEntity('update', { entity: { id: 'ICAO.x' } }, {
      id: 'ICAO.x',
      lat: 40,
      lng: -122.5,
      type: 'a-f-A-C-F',
    })
    expect(push).not.toHaveBeenCalled()
  })
  it('notifySubscribersRemove pushes to all subscribers', async () => {
    const pushA = vi.fn()
    const pushB = vi.fn()
    registerSubscriber({
      bbox: { west: -123, south: 37, east: -122, north: 38 },
      layers: new Set(['air']),
      push: pushA,
    })
    registerSubscriber({
      bbox: { west: -125, south: 35, east: -120, north: 40 },
      layers: new Set(['surface']),
      push: pushB,
    })
    await notifySubscribersRemove('ICAO.removed')
    expect(pushA).toHaveBeenCalledWith('remove', JSON.stringify({ id: 'ICAO.removed' }))
    expect(pushB).toHaveBeenCalledWith('remove', JSON.stringify({ id: 'ICAO.removed' }))
  })
  it('broadcastSubscriberSnapshots sends per-subscriber filtered snapshot', async () => {
    clearCotStore()
    await updateFromCot({ id: 'ICAO.in', lat: 37.5, lng: -122.5, type: 'a-f-A-C-F' })
    await updateFromCot({ id: 'ICAO.out', lat: 40, lng: -100, type: 'a-f-A-C-F' })
    const push = vi.fn()
    registerSubscriber({
      bbox: { west: -123, south: 37, east: -122, north: 38 },
      layers: new Set(['air']),
      push,
    })
    await broadcastSubscriberSnapshots({ ttlMs: 90_000, osintTtlMs: 30_000, takFilterBbox: false })
    expect(push).toHaveBeenCalledWith('snapshot', expect.any(String))
    const payload = JSON.parse(push.mock.calls[0][1])
    expect(payload.entities.map(e => e.id)).toEqual(['ICAO.in'])
  })
 })
@@ -0,0 +1,55 @@
 import { describe, it, expect, vi } from 'vitest'
 import { createClusterIndex } from '../../app/utils/mapCluster.js'
 import { clearFeatureMarkers, syncFeatureMarkers } from '../../app/utils/mapMarkerSync.js'
 import { bboxFetchKey, tilesNearCenter } from '../../app/utils/alprViewport.js'
 describe('mapCluster', () => {
  it('loads once and queries by viewport', () => {
    const index = createClusterIndex({ radius: 50, maxZoom: 14, minPoints: 2 })
    const features = Array.from({ length: 20 }, (_, i) => ({
      type: 'Feature',
      geometry: { type: 'Point', coordinates: [-122.4 + i * 0.01, 37.7] },
      properties: { id: i },
    }))
    index.load(features)
    const zoomedOut = index.query({ west: -123, south: 37, east: -122, north: 38, zoom: 6 })
    expect(zoomedOut.some(f => f.properties?.cluster)).toBe(true)
    const zoomedIn = index.query({ west: -123, south: 37, east: -122, north: 38, zoom: 15 })
    expect(zoomedIn).toHaveLength(20)
  })
 })
 describe('mapMarkerSync', () => {
  it('reuses markers by key', () => {
    const layer = {
      _layers: [],
      addLayer(m) { this._layers.push(m) },
      removeLayer(m) { this._layers = this._layers.filter(x => x !== m) },
    }
    const create = vi.fn(f => ({ id: f.properties.id }))
    const update = vi.fn()
    const opts = { keyFor: f => f.properties.id, create, update }
    const pt = (id, lng, lat) => ({ type: 'Feature', geometry: { type: 'Point', coordinates: [lng, lat] }, properties: { id } })
    syncFeatureMarkers(layer, [pt(1, -122, 37)], opts)
    syncFeatureMarkers(layer, [pt(1, -121.9, 37.1)], opts)
    expect(create).toHaveBeenCalledTimes(1)
    expect(update).toHaveBeenCalledTimes(1)
    clearFeatureMarkers(layer)
    expect(layer._layers).toHaveLength(0)
  })
 })
 describe('alprViewport', () => {
  it('selects nearby tiles without scanning the world', () => {
    const world = { south: -85, west: -180, north: 85, east: 180 }
    expect(tilesNearCenter(world, 16)).toHaveLength(16)
    expect(tilesNearCenter(world, 1)[0]).toEqual({ south: 0, west: 0, north: 0.5, east: 0.5 })
  })
  it('coarsens fetch keys when zoomed out', () => {
    const bounds = { south: 37.01, west: -122.51, north: 37.99, east: -122.01, zoom: 6 }
    expect(bboxFetchKey(bounds)).toBe(bboxFetchKey({ ...bounds, south: bounds.south + 0.05 }))
    expect(bboxFetchKey({ ...bounds, zoom: 14 })).not.toBe(bboxFetchKey(bounds))
  })
 })
@@ -0,0 +1,29 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest'
 import { clearSubscribers, registerSubscriber } from '../../../server/utils/cotSubscribers.js'
 import {
  isOpenSkyPollActive,
  resetTrackingFeedForTests,
  scheduleOpenSkyPollForTests,
 } from '../../../server/utils/trackingFeed.js'
 describe('trackingFeed', () => {
  beforeEach(() => {
    clearSubscribers()
    resetTrackingFeedForTests()
  })
  it('does not start OpenSky poll without SSE subscribers', () => {
    scheduleOpenSkyPollForTests()
    expect(isOpenSkyPollActive()).toBe(false)
  })
  it('starts OpenSky poll when a subscriber is registered', () => {
    registerSubscriber({
      bbox: { west: -123, south: 37, east: -122, north: 38 },
      layers: new Set(['air']),
      push: vi.fn(),
    })
    scheduleOpenSkyPollForTests()
    expect(isOpenSkyPollActive()).toBe(true)
  })
 })
		`@@ -1 +1 @@`
			`setups.@nuxt/test-utils="4.0.0"`				`setups.@nuxt/test-utils="4.1.0"`