Review follow-up:
- Drop the Next.js route. CARTO_API_KEY is now a regular backend registry
key (env, .env, or the API Keys panel) served by public
GET /api/basemap-config. Every frontend mode already proxies /api/* to
the backend (Next.js proxy in web mode, companion server in packaged
desktop), so this covers web and desktop with one mechanism and leaves
the static export untouched. Also removes the invalid non-handler
export from the route module by removing the module.
- useBasemapConfig: fail open to the unkeyed style after 3 s, abort the
request at 15 s, apply a late key when it arrives, cache successes per
page and retry failures on the next mount.
- Declare OSM/CARTO attribution on the raster source (same markup as the
viewer's existing AttributionControl so MapLibre de-duplicates it).
- Tests: backend endpoint (unset / set+trimmed / persisted operator key /
registry), hook behaviour (success, non-OK, network error, soft timeout
then late key, hard abort, shared request and retry), attribution and
gating source checks.
- CARTO_API_KEY moves to the backend service in docker-compose.yml; docs
updated accordingly.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
CARTO now requires an API key for its basemap tiles; without one every
tile in the DEFAULT dark/light map carries an "API KEY REQUIRED"
watermark. The tile URLs were hardcoded in mapStyles.ts with no way to
supply a key, and because the frontend ships as a prebuilt image a
NEXT_PUBLIC_ variable would be baked in empty for every Docker user.
- New frontend-local route GET /api/basemap-config reads CARTO_API_KEY
from the frontend container's environment at request time (same
pattern as BACKEND_URL), so no image rebuild is needed.
- useBasemapConfig() fetches it once per page load; MaplibreViewer
builds the MapLibre style from it via buildBasemapStyle(theme, key)
and defers the map's first style load until the config has settled,
avoiding a burst of unkeyed tile requests followed by a style swap.
- Tile URLs move to CARTO's documented rastertiles/ path with ?key=
appended when configured. Unkeyed URLs serve byte-identical tiles to
the old path, so deployments without a key behave exactly as before.
- CARTO_API_KEY wired through docker-compose.yml and documented in
.env.example, README (data source table + frontend env table) and
docs/OUTBOUND_DATA.md.
- Tests cover the route (unset / set / trimmed) and the style builder.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Each install pulls ~60-day sightings from nuforc.org every Monday; disk cache
matches weekly cadence so users keep current pins between restarts.
Co-authored-by: Cursor <cursoragent@cursor.com>
- User-Agent is per-install handle only (no Shadowbroker product token)
- LiveUAMap: Windows UI consent when enabling Global Incidents; env override
- Meshtastic callsign upstream header off by default (opt-in true)
- Expanded docs/OUTBOUND_DATA.md and README link for CCTV, basemap, Broadcastify
Co-authored-by: Cursor <cursoragent@cursor.com>
Operators can set DEEPSTATE_MIRROR_COMMIT for immutable frontline ingest; Madrid KML tries HTTPS then HTTP without changing camera image URLs or proxy Referers.
Co-authored-by: Cursor <cursoragent@cursor.com>
