Defense-in-depth for the public deploy: USGS/EONET place/title/category are now
HTML-escaped before interpolation into Cesium InfoBox descriptions, and the
USGS/EONET links are passed through lib.safeUrl (http(s)-only) so a hostile feed
can't inject markup or a javascript:/data: href. Entity names/labels stay raw
(Cesium renders those as text). Verified: escapeHtml neutralizes
<img onerror>, safeUrl drops javascript:/data:, 219 quakes + 500 fires still
render normally.
ship-check pass: no auth surface (dev-only history/snap not deployed); no
secrets in tree (AIS key empty, data/ gitignored); proxy upstreams are a fixed
dict (no SSRF); no money paths.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New js/layers/fires.js — fetches EONET open wildfire events directly (ACAO:*),
refreshes every 15 min, rebuilt wholesale (no time dynamics — EONET events are
slow-moving). Uses the latest dated geometry per event; Point coords direct,
Polygon reduced to first-ring centroid. Flame-teardrop billboard (new
lib.flameGlyph, drawn in #ff7a1a with dark outline, shared canvas), aggressive
label translucency so dense California/Australia clusters stay legible, cap 500.
HUD row "Wildfires (NASA EONET)".
PITFALL handled: EONET mislabels Content-Type as application/rss+xml but the
body is JSON — we call res.json() and never gate on the header.
Verified in browser: 500 fires, all finite positions, glyphs render over
North America, zero console errors.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- CesiumJS viewer (token-free, baseLayer:false), Carto dark + EOX Sentinel-2
- clock spans now +/-6h CLAMPED; built-in timeline/animation = the space-time slider
- HUD: brand, LIVE/SCRUBBED chip, Data/Photo mode toggle, layer rows, credits
- lighting is mode-aware: OFF in Data (high-contrast asset map), ON in Photo
(realistic day/night terminator) — refines SPEC 6.1's global-lighting note
- main.js defines the layer-factory contract + dynamic loader; layers land next
- serve.py now forwards OpenSky X-Rate-Limit-* headers for the aircraft status line
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
