@continuous-excellence/ze-great-dashboard-aws 0.18.3 → 0.19.0

package/dist/lambda.mjs

@@ -3124,7 +3124,7 @@ var require_timestamp = __commonJS({
       resolve: (str) => parseSexagesimal(str, false),
       stringify: stringifySexagesimal
     };
-    var timestamp2 = {
+    var timestamp3 = {
       identify: (value) => value instanceof Date,
       default: true,
       tag: "tag:yaml.org,2002:timestamp",
@@ -3133,7 +3133,7 @@ var require_timestamp = __commonJS({
       // assumed to be 00:00:00Z (start of day, UTC).
       test: RegExp("^([0-9]{4})-([0-9]{1,2})-([0-9]{1,2})(?:(?:t|T|[ \\t]+)([0-9]{1,2}):([0-9]{1,2}):([0-9]{1,2}(\\.[0-9]+)?)(?:[ \\t]*(Z|[-+][012]?[0-9](?::[0-9]{2})?))?)?$"),
       resolve(str) {
-        const match2 = str.match(timestamp2.test);
+        const match2 = str.match(timestamp3.test);
         if (!match2)
           throw new Error("!!timestamp expects a date, starting with yyyy-mm-dd");
         const [, year2, month, day, hour, minute, second] = match2.map(Number);
@@ -3152,7 +3152,7 @@ var require_timestamp = __commonJS({
     };
     exports.floatTime = floatTime;
     exports.intTime = intTime;
-    exports.timestamp = timestamp2;
+    exports.timestamp = timestamp3;
   }
 });
 
@@ -3172,7 +3172,7 @@ var require_schema3 = __commonJS({
     var omap = require_omap();
     var pairs = require_pairs();
     var set2 = require_set();
-    var timestamp2 = require_timestamp();
+    var timestamp3 = require_timestamp();
     var schema = [
       map4.map,
       seq.seq,
@@ -3192,9 +3192,9 @@ var require_schema3 = __commonJS({
       omap.omap,
       pairs.pairs,
       set2.set,
-      timestamp2.intTime,
-      timestamp2.floatTime,
-      timestamp2.timestamp
+      timestamp3.intTime,
+      timestamp3.floatTime,
+      timestamp3.timestamp
     ];
     exports.schema = schema;
   }
@@ -3219,7 +3219,7 @@ var require_tags = __commonJS({
     var pairs = require_pairs();
     var schema$2 = require_schema3();
     var set2 = require_set();
-    var timestamp2 = require_timestamp();
+    var timestamp3 = require_timestamp();
     var schemas = /* @__PURE__ */ new Map([
       ["core", schema.schema],
       ["failsafe", [map4.map, seq.seq, string4.string]],
@@ -3233,11 +3233,11 @@ var require_tags = __commonJS({
       float: float.float,
       floatExp: float.floatExp,
       floatNaN: float.floatNaN,
-      floatTime: timestamp2.floatTime,
+      floatTime: timestamp3.floatTime,
       int: int2.int,
       intHex: int2.intHex,
       intOct: int2.intOct,
-      intTime: timestamp2.intTime,
+      intTime: timestamp3.intTime,
       map: map4.map,
       merge: merge3.merge,
       null: _null4.nullTag,
@@ -3245,7 +3245,7 @@ var require_tags = __commonJS({
       pairs: pairs.pairs,
       seq: seq.seq,
       set: set2.set,
-      timestamp: timestamp2.timestamp
+      timestamp: timestamp3.timestamp
     };
     var coreKnownTags = {
       "tag:yaml.org,2002:binary": binary.binary,
@@ -3253,7 +3253,7 @@ var require_tags = __commonJS({
       "tag:yaml.org,2002:omap": omap.omap,
       "tag:yaml.org,2002:pairs": pairs.pairs,
       "tag:yaml.org,2002:set": set2.set,
-      "tag:yaml.org,2002:timestamp": timestamp2.timestamp
+      "tag:yaml.org,2002:timestamp": timestamp3.timestamp
     };
     function getTags(customTags, schemaName, addMergeTag) {
       const schemaTags = schemas.get(schemaName);
@@ -10643,12 +10643,12 @@ var init_schema_date_utils = __esm({
         [, month, day, hour, minute, second, fraction, year2] = matches;
       }
       if (year2 && second) {
-        const timestamp2 = Date.UTC(Number(year2), months.indexOf(month), Number(day), Number(hour), Number(minute), Number(second), fraction ? Math.round(parseFloat(`0.${fraction}`) * 1e3) : 0);
+        const timestamp3 = Date.UTC(Number(year2), months.indexOf(month), Number(day), Number(hour), Number(minute), Number(second), fraction ? Math.round(parseFloat(`0.${fraction}`) * 1e3) : 0);
         range(day, 1, 31);
         range(hour, 0, 23);
         range(minute, 0, 59);
         range(second, 0, 60);
-        const date6 = new Date(timestamp2);
+        const date6 = new Date(timestamp3);
         date6.setUTCFullYear(Number(year2));
         return date6;
       }
@@ -17638,14 +17638,14 @@ var init_DefaultRateLimiter = __esm({
         this.availableTokens = this.availableTokens - amount;
       }
       refillTokenBucket() {
-        const timestamp2 = this.getCurrentTimeInSeconds();
+        const timestamp3 = this.getCurrentTimeInSeconds();
         if (!this.lastTimestamp) {
-          this.lastTimestamp = timestamp2;
+          this.lastTimestamp = timestamp3;
           return;
         }
-        const fillAmount = (timestamp2 - this.lastTimestamp) * this.fillRate;
+        const fillAmount = (timestamp3 - this.lastTimestamp) * this.fillRate;
         this.availableTokens = Math.min(this.maxCapacity, this.availableTokens + fillAmount);
-        this.lastTimestamp = timestamp2;
+        this.lastTimestamp = timestamp3;
       }
       calculateTimeWindow() {
         this.timeWindow = this.getPrecise(Math.pow(this.lastMaxRate * (1 - this.beta) / this.scaleConstant, 1 / 3));
@@ -17653,8 +17653,8 @@ var init_DefaultRateLimiter = __esm({
       cubicThrottle(rateToUse) {
         return this.getPrecise(rateToUse * this.beta);
       }
-      cubicSuccess(timestamp2) {
-        return this.getPrecise(this.scaleConstant * Math.pow(timestamp2 - this.lastThrottleTime - this.timeWindow, 3) + this.lastMaxRate);
+      cubicSuccess(timestamp3) {
+        return this.getPrecise(this.scaleConstant * Math.pow(timestamp3 - this.lastThrottleTime - this.timeWindow, 3) + this.lastMaxRate);
       }
       enableTokenBucket() {
         this.enabled = true;
@@ -49137,8 +49137,8 @@ var handle = (app, { isContentTypeBinary } = { isContentTypeBinary: void 0 }) =>
       requestContext = getRequestContext(event);
     } catch (error52) {
       console.error("Error processing request:", error52);
-      const errorResponse2 = error52 instanceof TypeError ? new Response("Invalid request", { status: 400 }) : new Response("Internal Server Error", { status: 500 });
-      return processor.createResult(event, errorResponse2, { isContentTypeBinary });
+      const errorResponse3 = error52 instanceof TypeError ? new Response("Invalid request", { status: 400 }) : new Response("Internal Server Error", { status: 500 });
+      return processor.createResult(event, errorResponse3, { isContentTypeBinary });
     }
     const res = await app.fetch(req, {
       event,
@@ -64040,14 +64040,25 @@ var githubActionsSourceSchema = external_exports.looseObject({
   branch: external_exports.string().min(1).optional(),
   ...sourceAuthenticationSchema
 }).superRefine(exactlyOneGithubAuthenticationMode);
+var azureDevOpsSourceSchema = external_exports.looseObject({
+  type: external_exports.literal("azure-devops"),
+  /** Azure DevOps organization name, used as one URL path segment. */
+  organization: external_exports.string().regex(/^[^/\s]+$/, "must be an organization name"),
+  project: external_exports.string().min(1),
+  /** The branch whose build health the dashboard represents. */
+  branch: external_exports.string().min(1).optional(),
+  /** Azure DevOps Build API access is authenticated with a read-scoped PAT. */
+  token_env: external_exports.string().min(1)
+});
 var sourceSchema = external_exports.looseObject({ type: external_exports.string().min(1), ...sourceAuthenticationSchema }).superRefine(exactlyOneGithubAuthenticationMode);
 function credentialEnvironmentNames(source) {
+  const githubApp = githubAppSchema.safeParse(source.github_app);
   return [
     ...source.token_env ? [source.token_env] : [],
-    ...source.github_app ? [
-      source.github_app.app_id_env,
-      source.github_app.private_key_env,
-      source.github_app.installation_id_env
+    ...githubApp.success ? [
+      githubApp.data.app_id_env,
+      githubApp.data.private_key_env,
+      githubApp.data.installation_id_env
     ] : []
   ];
 }
@@ -64085,6 +64096,33 @@ var boardConfigSchema = external_exports.object({
   sources: external_exports.record(external_exports.string().min(1), sourceSchema).default({}),
   boards: external_exports.record(external_exports.string().min(1), boardSchema),
   auth: authSchema.optional()
+}).superRefine((config2, ctx) => {
+  for (const [sourceName, source] of Object.entries(config2.sources)) {
+    if (source.type !== "azure-devops") continue;
+    const parsedSource = azureDevOpsSourceSchema.safeParse(source);
+    if (!parsedSource.success) {
+      for (const issue2 of parsedSource.error.issues) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["sources", sourceName, ...issue2.path],
+          message: issue2.message
+        });
+      }
+    }
+  }
+  for (const [boardName, board] of Object.entries(config2.boards)) {
+    board.panels.forEach((panel, panelIndex) => {
+      const source = panel.source ? config2.sources[panel.source] : void 0;
+      if (panel.type !== "pipeline-status" || source?.type !== "azure-devops") return;
+      if (typeof panel.pipeline !== "number" || !Number.isInteger(panel.pipeline) || panel.pipeline <= 0) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["boards", boardName, "panels", panelIndex, "pipeline"],
+          message: "Azure DevOps pipeline-status panels require a positive numeric pipeline definition id"
+        });
+      }
+    });
+  }
 });
 
 // packages/shared/src/board-config-modeline.ts
@@ -64129,15 +64167,13 @@ var clientEnvSchema = external_exports.object({
   proxyPath: external_exports.string().min(1),
   /** Which board this is, resolved server-side so the client parses no URLs. */
   board: external_exports.string().min(1),
-  /** The client version being served, so two published versions are visibly distinguishable. */
-  clientVersion: external_exports.string().min(1),
   /** Omitted entirely when unauthenticated — presence is what turns auth on. */
   auth: external_exports.object({
     issuer: external_exports.string().min(1),
     clientId: external_exports.string().min(1).optional()
   }).optional()
 });
-var clientIdentitySchema = clientEnvSchema.pick({ assetPath: true, clientVersion: true });
+var clientIdentitySchema = clientEnvSchema.pick({ assetPath: true });
 
 // packages/shared/src/envelope.ts
 var errorKindSchema = external_exports.enum([
@@ -66400,6 +66436,275 @@ var Hono2 = class extends Hono {
 // packages/server/src/app.ts
 var import_yaml = __toESM(require_dist(), 1);
 
+// packages/server/src/upstream.ts
+function forwardValidators(requestHeaders, upstreamHeaders) {
+  for (const name of ["if-none-match", "if-modified-since"]) {
+    const value = requestHeaders.get(name);
+    if (value) upstreamHeaders.set(name, value);
+  }
+}
+function observedAt(upstreamDate) {
+  const parsed = upstreamDate ? new Date(upstreamDate) : void 0;
+  return parsed && !Number.isNaN(parsed.valueOf()) ? parsed.toISOString() : (/* @__PURE__ */ new Date()).toISOString();
+}
+function upstreamErrorEnvelope(args) {
+  return {
+    panelId: args.panelId,
+    state: "error",
+    observedAt: observedAt(args.upstreamDate),
+    link: args.link,
+    error: {
+      kind: args.kind,
+      message: args.error instanceof Error ? args.error.message : String(args.error)
+    }
+  };
+}
+function upstreamErrorResponse(envelope) {
+  return new Response(JSON.stringify(envelope), { status: 200 });
+}
+function upstreamErrorKind(status) {
+  if (status === 401 || status === 403) return "unauthorized";
+  if (status === 404) return "not-found";
+  return "upstream-error";
+}
+async function adapterRouteResponse(result) {
+  const headers = passthroughHeaders(result.response.headers);
+  if (result.response.status === 304) return new Response(null, { status: 304, headers });
+  const envelope = result.envelope ?? JSON.parse(await result.response.text());
+  headers.set("content-type", "application/json; charset=utf-8");
+  return new Response(JSON.stringify(envelope), { status: 200, headers });
+}
+function passthroughHeaders(upstream) {
+  const headers = new Headers();
+  for (const name of ["cache-control", "etag", "last-modified", "date", "vary"]) {
+    const value = upstream.get(name);
+    if (value) headers.set(name, value);
+  }
+  return headers;
+}
+
+// packages/server/src/adapters/azure-devops.ts
+var pipelinePanelSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  type: external_exports.literal("pipeline-status"),
+  source: external_exports.string().min(1),
+  pipeline: external_exports.number().int().positive()
+});
+var buildSchema = external_exports.object({
+  id: external_exports.number().int().positive(),
+  buildNumber: external_exports.string().min(1),
+  status: external_exports.string().nullable().optional(),
+  result: external_exports.string().nullable().optional(),
+  sourceBranch: external_exports.string().min(1).nullable().optional(),
+  startTime: external_exports.string().nullable().optional(),
+  finishTime: external_exports.string().nullable().optional(),
+  lastChangedDate: external_exports.string().nullable().optional()
+});
+var buildsSchema = external_exports.object({ value: external_exports.array(buildSchema) });
+var timelineSchema = external_exports.object({
+  records: external_exports.array(
+    external_exports.object({
+      id: external_exports.string().min(1),
+      parentId: external_exports.string().min(1).nullable().optional(),
+      type: external_exports.string().min(1),
+      name: external_exports.string().min(1),
+      state: external_exports.string().nullable().optional()
+    })
+  )
+});
+function permittedAzureDevOpsCalls(panel, source) {
+  const parsedPanel = pipelinePanelSchema.parse(panel);
+  const parsedSource = azureDevOpsSourceSchema.parse(source);
+  return [buildsCall(parsedPanel.pipeline, parsedSource)];
+}
+async function fetchAzureDevOpsPipeline(args) {
+  const panel = pipelinePanelSchema.parse(args.panel);
+  const source = azureDevOpsSourceSchema.parse(args.source);
+  const token = args.credentials.get(source.token_env);
+  if (!token) {
+    return {
+      response: errorResponse(
+        errorEnvelope(
+          panel.id,
+          "unauthorized",
+          `Credential ${source.token_env} is not available.`,
+          sourceLink(panel.pipeline, source)
+        )
+      )
+    };
+  }
+  const call = buildsCall(panel.pipeline, source);
+  copyValidators(args.requestHeaders, call.headers);
+  call.headers.set("authorization", `Basic ${btoa(`:${token}`)}`);
+  let upstream;
+  try {
+    upstream = await args.fetcher(call.url, { headers: call.headers });
+  } catch (error52) {
+    return {
+      response: errorResponse(
+        errorEnvelope(panel.id, "unreachable", error52, sourceLink(panel.pipeline, source))
+      )
+    };
+  }
+  if (upstream.status === 304) return { response: upstream };
+  if (!upstream.ok) {
+    return {
+      response: errorResponse(
+        errorEnvelope(
+          panel.id,
+          errorKind(upstream.status),
+          `${upstream.status} ${upstream.statusText}`,
+          sourceLink(panel.pipeline, source),
+          observedAt2(upstream.headers.get("date"))
+        )
+      )
+    };
+  }
+  try {
+    const build = buildsSchema.parse(await upstream.json()).value[0];
+    if (!build) {
+      return {
+        response: errorResponse(
+          errorEnvelope(
+            panel.id,
+            "no-runs",
+            source.branch ? `No builds found for branch "${source.branch}". Check the source's branch setting.` : "No builds found.",
+            sourceLink(panel.pipeline, source),
+            observedAt2(upstream.headers.get("date"))
+          )
+        )
+      };
+    }
+    const signal = {
+      type: "pipeline-status",
+      status: normalizeStatus(build.status, build.result),
+      rawStatus: build.result ?? build.status ?? "unknown",
+      name: build.buildNumber,
+      ...build.sourceBranch ?? source.branch ? { branch: build.sourceBranch ?? source.branch } : {},
+      ...timestamp(build.startTime) ? { runStartedAt: timestamp(build.startTime) } : {},
+      ...timestamp(build.lastChangedDate) ? { sourceUpdatedAt: timestamp(build.lastChangedDate) } : {},
+      sourceRunId: String(build.id),
+      ...completedBuildDuration(build)
+    };
+    if (signal.status === "running") {
+      const activity = await activeAzureDevOpsActivity({
+        buildId: build.id,
+        source,
+        fetcher: args.fetcher,
+        authorization: call.headers.get("authorization") ?? ""
+      });
+      if (activity) signal.activity = activity;
+    }
+    return {
+      envelope: {
+        panelId: panel.id,
+        state: "ok",
+        observedAt: observedAt2(upstream.headers.get("date")),
+        link: buildLink(build.id, source),
+        signal
+      },
+      response: upstream
+    };
+  } catch (error52) {
+    return {
+      response: errorResponse(
+        errorEnvelope(
+          panel.id,
+          "upstream-error",
+          error52,
+          sourceLink(panel.pipeline, source),
+          observedAt2(upstream.headers.get("date"))
+        )
+      )
+    };
+  }
+}
+function buildsCall(definitionId, source) {
+  const url2 = apiUrl(source, "build/builds");
+  url2.searchParams.set("definitions", String(definitionId));
+  if (source.branch) url2.searchParams.set("branchName", adoBranch(source.branch));
+  url2.searchParams.set("queryOrder", "queueTimeDescending");
+  url2.searchParams.set("$top", "1");
+  return { url: url2.toString(), headers: new Headers({ accept: "application/json" }) };
+}
+function timelineCall(buildId, source) {
+  return {
+    url: apiUrl(source, `build/builds/${buildId}/timeline`).toString(),
+    headers: new Headers({ accept: "application/json" })
+  };
+}
+function apiUrl(source, suffix) {
+  const url2 = new URL(
+    `https://dev.azure.com/${encodeURIComponent(source.organization)}/${encodeURIComponent(source.project)}/_apis/${suffix}`
+  );
+  url2.searchParams.set("api-version", "7.1");
+  return url2;
+}
+function adoBranch(branch) {
+  return branch.startsWith("refs/") ? branch : `refs/heads/${branch}`;
+}
+async function activeAzureDevOpsActivity(args) {
+  const call = timelineCall(args.buildId, args.source);
+  call.headers.set("authorization", args.authorization);
+  try {
+    const response = await args.fetcher(call.url, { headers: call.headers });
+    if (!response.ok) return void 0;
+    const records = timelineSchema.parse(await response.json()).records;
+    const active = records.find((record2) => record2.state === "inProgress");
+    if (!active) return void 0;
+    const parent = active.parentId ? records.find((record2) => record2.id === active.parentId) : void 0;
+    const kind = active.type.toLowerCase();
+    return {
+      kind: kind === "stage" ? "stage" : kind === "job" ? "job" : "step",
+      name: active.name,
+      ...parent ? { parent: parent.name } : {}
+    };
+  } catch {
+    return void 0;
+  }
+}
+function normalizeStatus(status, result) {
+  if (status === "notStarted" || status === "postponed" || status === "inProgress" || status === "cancelling")
+    return "running";
+  if (status !== "completed") return "unknown";
+  if (result === "succeeded") return "passed";
+  if (result === "failed") return "failed";
+  if (result === "canceled") return "cancelled";
+  return "unknown";
+}
+function completedBuildDuration(build) {
+  const startedAt = timestamp(build.startTime);
+  const finishedAt = timestamp(build.finishTime);
+  if (!startedAt || !finishedAt) return {};
+  const durationMs = new Date(finishedAt).valueOf() - new Date(startedAt).valueOf();
+  return Number.isFinite(durationMs) && durationMs >= 0 ? { durationMs } : {};
+}
+function timestamp(value) {
+  if (!value || !external_exports.iso.datetime().safeParse(value).success) return void 0;
+  return Number.isFinite(new Date(value).valueOf()) ? value : void 0;
+}
+function copyValidators(requestHeaders, upstreamHeaders) {
+  forwardValidators(requestHeaders, upstreamHeaders);
+}
+function buildLink(buildId, source) {
+  return `https://dev.azure.com/${encodeURIComponent(source.organization)}/${encodeURIComponent(source.project)}/_build/results?buildId=${buildId}`;
+}
+function sourceLink(definitionId, source) {
+  return `https://dev.azure.com/${encodeURIComponent(source.organization)}/${encodeURIComponent(source.project)}/_build?definitionId=${definitionId}`;
+}
+function errorResponse(envelope) {
+  return upstreamErrorResponse(envelope);
+}
+function errorEnvelope(panelId, kind, error52, link, date6) {
+  return upstreamErrorEnvelope({ panelId, kind, error: error52, link, upstreamDate: date6 });
+}
+function errorKind(status) {
+  return upstreamErrorKind(status);
+}
+function observedAt2(value) {
+  return observedAt(value);
+}
+
 // packages/server/src/credentials.ts
 var import_client_secrets_manager = __toESM(require_dist_cjs16(), 1);
 var import_client_ssm = __toESM(require_dist_cjs17(), 1);
@@ -66509,10 +66814,7 @@ function createGithubClient(credentials, now = Date.now) {
 }
 function githubHeaders(requestHeaders) {
   const headers = new Headers({ accept: "application/vnd.github+json" });
-  for (const name of ["if-none-match", "if-modified-since"]) {
-    const value = requestHeaders.get(name);
-    if (value) headers.set(name, value);
-  }
+  forwardValidators(requestHeaders, headers);
   return headers;
 }
 async function exchangeInstallationToken(args) {
@@ -66565,7 +66867,7 @@ function base64url3(value) {
 }
 
 // packages/server/src/adapters/github-actions.ts
-var pipelinePanelSchema = external_exports.object({
+var pipelinePanelSchema2 = external_exports.object({
   id: external_exports.string().min(1),
   type: external_exports.literal("pipeline-status"),
   source: external_exports.string().min(1),
@@ -66616,7 +66918,7 @@ var pullRequestsSchema = external_exports.array(
   })
 );
 function permittedGithubActionsCalls(panel, source, _credentials) {
-  const parsedPanel = pipelinePanelSchema.parse(panel);
+  const parsedPanel = pipelinePanelSchema2.parse(panel);
   const parsedSource = githubActionsSourceSchema.parse(source);
   const url2 = new URL(
     `https://api.github.com/repos/${parsedSource.repo}/actions/workflows/${encodeURIComponent(parsedPanel.pipeline)}/runs`
@@ -66706,7 +67008,7 @@ async function fetchGithubActionsPullRequestHealth(args) {
     return {
       response: new Response(
         JSON.stringify(
-          errorEnvelope(
+          errorEnvelope2(
             panel.id,
             error52 instanceof GithubAuthenticationError ? "unauthorized" : "upstream-error",
             error52,
@@ -66767,7 +67069,7 @@ function githubRunsCall(source, workflow, branch, event, perPage = 1) {
 function healthItem(label, run, detail, link) {
   return {
     label,
-    status: run ? normalizeStatus(run.status, run.conclusion) : "unknown",
+    status: run ? normalizeStatus2(run.status, run.conclusion) : "unknown",
     detail: run ? `${detail} \xB7 ${run.conclusion ?? run.status}` : `${detail} \xB7 No run found`,
     link: link ?? run?.html_url ?? null
   };
@@ -66803,11 +67105,11 @@ async function fetchGithubActionsPipeline(args) {
     return {
       response: new Response(
         JSON.stringify(
-          errorEnvelope(
+          errorEnvelope2(
             args.panel.id,
             error52 instanceof GithubAuthenticationError ? "unauthorized" : "unreachable",
             error52,
-            sourceLink(args.panel, args.source)
+            sourceLink2(args.panel, args.source)
           )
         ),
         { status: 200 }
@@ -66819,12 +67121,12 @@ async function fetchGithubActionsPipeline(args) {
     return {
       response: new Response(
         JSON.stringify(
-          errorEnvelope(
+          errorEnvelope2(
             args.panel.id,
-            errorKind(upstream.status),
+            errorKind2(upstream.status),
             `${upstream.status} ${upstream.statusText}`,
-            sourceLink(args.panel, args.source),
-            observedAt(upstream.headers.get("date"))
+            sourceLink2(args.panel, args.source),
+            observedAt3(upstream.headers.get("date"))
           )
         ),
         { status: 200 }
@@ -66838,12 +67140,12 @@ async function fetchGithubActionsPipeline(args) {
       return {
         response: new Response(
           JSON.stringify(
-            errorEnvelope(
+            errorEnvelope2(
               args.panel.id,
               "no-runs",
               parsedSource.branch ? `No workflow runs found for branch "${parsedSource.branch}". Check the source's branch setting.` : "No workflow runs found.",
-              sourceLink(args.panel, args.source),
-              observedAt(upstream.headers.get("date"))
+              sourceLink2(args.panel, args.source),
+              observedAt3(upstream.headers.get("date"))
             )
           ),
           { status: 200 }
@@ -66852,12 +67154,12 @@ async function fetchGithubActionsPipeline(args) {
     }
     const signal = {
       type: "pipeline-status",
-      status: normalizeStatus(run.status, run.conclusion),
+      status: normalizeStatus2(run.status, run.conclusion),
       rawStatus: run.conclusion ?? run.status,
       name: run.name,
       ...run.head_branch ?? parsedSource.branch ? { branch: run.head_branch ?? parsedSource.branch } : {},
-      ...timestamp(run.updated_at) ? { sourceUpdatedAt: timestamp(run.updated_at) } : {},
-      ...timestamp(run.run_started_at) ? { runStartedAt: timestamp(run.run_started_at) } : {},
+      ...timestamp2(run.updated_at) ? { sourceUpdatedAt: timestamp2(run.updated_at) } : {},
+      ...timestamp2(run.run_started_at) ? { runStartedAt: timestamp2(run.run_started_at) } : {},
       ...run.id !== void 0 ? { sourceRunId: String(run.id) } : {},
       ...run.status === "completed" ? completedRunDuration(run) : {}
     };
@@ -66874,7 +67176,7 @@ async function fetchGithubActionsPipeline(args) {
     const envelope = {
       panelId: args.panel.id,
       state: "ok",
-      observedAt: observedAt(upstream.headers.get("date")),
+      observedAt: observedAt3(upstream.headers.get("date")),
       link: run.html_url,
       signal
     };
@@ -66883,12 +67185,12 @@ async function fetchGithubActionsPipeline(args) {
     return {
       response: new Response(
         JSON.stringify(
-          errorEnvelope(
+          errorEnvelope2(
             args.panel.id,
             "upstream-error",
             error52,
-            sourceLink(args.panel, args.source),
-            observedAt(upstream.headers.get("date"))
+            sourceLink2(args.panel, args.source),
+            observedAt3(upstream.headers.get("date"))
           )
         ),
         { status: 200 }
@@ -66927,45 +67229,36 @@ function githubJobsCall(source, runId) {
   return { url: url2.toString(), headers: new Headers() };
 }
 function completedRunDuration(run) {
-  const startedAt = timestamp(run.run_started_at);
-  const updatedAt = timestamp(run.updated_at);
+  const startedAt = timestamp2(run.run_started_at);
+  const updatedAt = timestamp2(run.updated_at);
   if (!startedAt || !updatedAt) return {};
   const durationMs = new Date(updatedAt).valueOf() - new Date(startedAt).valueOf();
   return Number.isFinite(durationMs) && durationMs >= 0 ? { durationMs } : {};
 }
-function timestamp(value) {
+function timestamp2(value) {
   if (!value || !external_exports.iso.datetime().safeParse(value).success) return void 0;
   return Number.isFinite(new Date(value).valueOf()) ? value : void 0;
 }
-function normalizeStatus(status, conclusion) {
+function normalizeStatus2(status, conclusion) {
   if (status !== "completed") return "running";
   if (conclusion === "success") return "passed";
   if (conclusion === "failure" || conclusion === "timed_out") return "failed";
   if (conclusion === "cancelled") return "cancelled";
   return "unknown";
 }
-function errorKind(status) {
-  if (status === 401 || status === 403) return "unauthorized";
-  if (status === 404) return "not-found";
-  return "upstream-error";
+function errorKind2(status) {
+  return upstreamErrorKind(status);
 }
-function errorEnvelope(panelId, kind, error52, link, observedAt3 = (/* @__PURE__ */ new Date()).toISOString()) {
-  return {
-    panelId,
-    state: "error",
-    observedAt: observedAt3,
-    link,
-    error: { kind, message: error52 instanceof Error ? error52.message : String(error52) }
-  };
+function errorEnvelope2(panelId, kind, error52, link, observedAt4 = (/* @__PURE__ */ new Date()).toISOString()) {
+  return upstreamErrorEnvelope({ panelId, kind, error: error52, link, upstreamDate: observedAt4 });
 }
-function sourceLink(panel, source) {
-  const parsedPanel = pipelinePanelSchema.parse(panel);
+function sourceLink2(panel, source) {
+  const parsedPanel = pipelinePanelSchema2.parse(panel);
   const parsedSource = githubActionsSourceSchema.parse(source);
   return `https://github.com/${parsedSource.repo}/actions/workflows/${encodeURIComponent(parsedPanel.pipeline)}`;
 }
-function observedAt(value) {
-  const parsed = value ? new Date(value) : void 0;
-  return parsed && !Number.isNaN(parsed.valueOf()) ? parsed.toISOString() : (/* @__PURE__ */ new Date()).toISOString();
+function observedAt3(value) {
+  return observedAt(value);
 }
 
 // packages/server/src/adapters/http-value.ts
@@ -66988,22 +67281,21 @@ async function fetchHttpValue(args) {
   const panel = httpValuePanelSchema.parse(args.panel);
   const [call] = permittedHttpValueCalls(args.panel);
   if (!call) throw new Error("http-value adapter declared no permitted call");
-  for (const name of ["if-none-match", "if-modified-since"]) {
-    const value = args.requestHeaders.get(name);
-    if (value) call.headers.set(name, value);
-  }
+  forwardValidators(args.requestHeaders, call.headers);
   let upstream;
   try {
     upstream = await args.fetcher(call.url, { headers: call.headers });
   } catch (error52) {
-    return { response: errorResponse(errorEnvelope2(panel.id, "unreachable", error52, panel)) };
+    return { response: errorResponse2("unreachable", error52, panel) };
   }
   if (upstream.status === 304) return { response: upstream };
   if (!upstream.ok) {
-    const kind = upstream.status === 401 || upstream.status === 403 ? "unauthorized" : upstream.status === 404 ? "not-found" : "upstream-error";
     return {
-      response: errorResponse(
-        errorEnvelope2(panel.id, kind, `${upstream.status} ${upstream.statusText}`, panel, upstream)
+      response: errorResponse2(
+        upstreamErrorKind(upstream.status),
+        `${upstream.status} ${upstream.statusText}`,
+        panel,
+        upstream
       )
     };
   }
@@ -67015,7 +67307,7 @@ async function fetchHttpValue(args) {
       envelope: {
         panelId: panel.id,
         state: "ok",
-        observedAt: observedAt2(upstream.headers.get("date")),
+        observedAt: observedAt(upstream.headers.get("date")),
         link: panel.link ?? panel.url,
         signal
       },
@@ -67023,7 +67315,7 @@ async function fetchHttpValue(args) {
     };
   } catch (error52) {
     return {
-      response: errorResponse(errorEnvelope2(panel.id, "upstream-error", error52, panel, upstream))
+      response: errorResponse2("upstream-error", error52, panel, upstream)
     };
   }
 }
@@ -67050,21 +67342,16 @@ function extractJsonPath(value, path) {
   }
   return current;
 }
-function errorResponse(envelope) {
-  return new Response(JSON.stringify(envelope), { status: 200 });
-}
-function errorEnvelope2(panelId, kind, error52, panel, response) {
-  return {
-    panelId,
-    state: "error",
-    observedAt: observedAt2(response?.headers.get("date") ?? null),
-    link: panel.link ?? panel.url,
-    error: { kind, message: error52 instanceof Error ? error52.message : String(error52) }
-  };
-}
-function observedAt2(value) {
-  const parsed = value ? new Date(value) : void 0;
-  return parsed && !Number.isNaN(parsed.valueOf()) ? parsed.toISOString() : (/* @__PURE__ */ new Date()).toISOString();
+function errorResponse2(kind, error52, panel, response) {
+  return upstreamErrorResponse(
+    upstreamErrorEnvelope({
+      panelId: panel.id,
+      kind,
+      error: error52,
+      link: panel.link ?? panel.url,
+      upstreamDate: response?.headers.get("date")
+    })
+  );
 }
 
 // packages/server/src/allowlist.ts
@@ -67083,6 +67370,9 @@ function callsFor(panel, source) {
   if (panel.type === "pipeline-status" && source?.type === "github-actions") {
     return permittedGithubActionsCalls(panel, source);
   }
+  if (panel.type === "pipeline-status" && source?.type === "azure-devops") {
+    return permittedAzureDevOpsCalls(panel, source);
+  }
   if (panel.type === "pull-request-health" && source?.type === "github-actions") {
     return permittedGithubActionsPullRequestHealthCalls(panel, source);
   }
@@ -67169,7 +67459,6 @@ function serializeForScriptTag(value) {
 function createApp(deps) {
   const { config: config2 } = deps;
   const templates = new TemplateCache(deps.fetcher ?? globalThis.fetch);
-  const clientVersion = deps.clientVersion ?? deriveVersionLabel(config2.assetPath);
   const selectedBoard = config2.board ?? Object.keys(deps.boardConfig?.boards ?? {})[0] ?? "ze-great-team";
   const allowlist = deps.boardConfig ? deriveAllowlist(deps.boardConfig) : /* @__PURE__ */ new Map();
   const credentials = deps.credentials ?? environmentCredentials();
@@ -67178,7 +67467,7 @@ function createApp(deps) {
   app.get("/health", (c5) => c5.json({ status: "ok" }));
   app.use("/api/*", async (_c5, next) => next());
   app.get(`${config2.proxyPath}/client`, (c5) => {
-    const identity = { assetPath: config2.assetPath, clientVersion };
+    const identity = { assetPath: config2.assetPath };
     return c5.json(identity, 200, { "cache-control": "no-store" });
   });
   app.get("/", (c5) => renderEntrypoint(c5.req.raw, selectedBoard));
@@ -67246,11 +67535,17 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
         fetcher: deps.fetcher ?? globalThis.fetch,
         githubClient
       });
-      const headers = passthroughHeaders(result.response.headers);
-      if (result.response.status === 304) return new Response(null, { status: 304, headers });
-      const envelope = result.envelope ?? JSON.parse(await result.response.text());
-      headers.set("content-type", "application/json; charset=utf-8");
-      return new Response(JSON.stringify(envelope), { status: 200, headers });
+      return adapterRouteResponse(result);
+    }
+    if (panel.type === "pipeline-status" && source?.type === "azure-devops" && source) {
+      const result = await fetchAzureDevOpsPipeline({
+        panel,
+        source,
+        requestHeaders: c5.req.raw.headers,
+        fetcher: deps.fetcher ?? globalThis.fetch,
+        credentials
+      });
+      return adapterRouteResponse(result);
     }
     if (panel.type === "pull-request-health" && source?.type === "github-actions" && source) {
       const result = await fetchGithubActionsPullRequestHealth({
@@ -67260,10 +67555,7 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
         fetcher: deps.fetcher ?? globalThis.fetch,
         githubClient
       });
-      const headers = passthroughHeaders(result.response.headers);
-      const envelope = result.envelope ?? JSON.parse(await result.response.text());
-      headers.set("content-type", "application/json; charset=utf-8");
-      return new Response(JSON.stringify(envelope), { status: 200, headers });
+      return adapterRouteResponse(result);
     }
     if (panel.type === "http-value") {
       const result = await fetchHttpValue({
@@ -67271,11 +67563,7 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
         requestHeaders: c5.req.raw.headers,
         fetcher: deps.fetcher ?? globalThis.fetch
       });
-      const headers = passthroughHeaders(result.response.headers);
-      if (result.response.status === 304) return new Response(null, { status: 304, headers });
-      const envelope = result.envelope ?? JSON.parse(await result.response.text());
-      headers.set("content-type", "application/json; charset=utf-8");
-      return new Response(JSON.stringify(envelope), { status: 200, headers });
+      return adapterRouteResponse(result);
     }
     return c5.notFound();
   });
@@ -67284,8 +67572,7 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
     const env2 = {
       assetPath: config2.assetPath,
       proxyPath: config2.proxyPath,
-      board,
-      clientVersion
+      board
     };
     return new Response(renderIndexHtml(template, env2), {
       headers: {
@@ -67302,20 +67589,6 @@ function safeDownloadFilename(value) {
   const sanitized = value.replace(/[\\/\r\n"%*:|<>?]/g, "_").trim();
   return sanitized || "board";
 }
-function passthroughHeaders(upstream) {
-  const headers = new Headers();
-  for (const name of ["cache-control", "etag", "last-modified", "date", "vary"]) {
-    const value = upstream.get(name);
-    if (value) headers.set(name, value);
-  }
-  return headers;
-}
-function deriveVersionLabel(assetPath) {
-  const segments = assetPath.split("/").filter((segment) => segment !== "");
-  const last = segments.at(-1);
-  if (last === void 0) return "unknown";
-  return last === ASSET_PATH_SENTINEL.replace("/", "") ? "dev" : last;
-}
 
 // packages/server/src/board-config.ts
 import { readFile as readFile3 } from "node:fs/promises";