@continuous-excellence/ze-great-dashboard-aws 0.18.4 → 0.20.0

package/client/index.html

@@ -11,8 +11,8 @@
     <title>Trust Dashboard</title>
 
   <script type="importmap">{"imports":{"react":"https://esm.sh/react@19.2.8","react/":"https://esm.sh/react@19.2.8/","react-dom":"https://esm.sh/react-dom@19.2.8","react-dom/":"https://esm.sh/react-dom@19.2.8/","scheduler":"https://esm.sh/scheduler@0.27.0","scheduler/":"https://esm.sh/scheduler@0.27.0/","zod":"https://esm.sh/zod@4.4.3","zod/":"https://esm.sh/zod@4.4.3/"}}</script>
-    <script type="module" crossorigin src="/__ASSET_PATH__/assets/index-mtLNXa0q.js"></script>
-    <link rel="stylesheet" crossorigin href="/__ASSET_PATH__/assets/index-BCZ7NCP8.css">
+    <script type="module" crossorigin src="/__ASSET_PATH__/assets/index-k3N7vI0h.js"></script>
+    <link rel="stylesheet" crossorigin href="/__ASSET_PATH__/assets/index-Cuk6kga3.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/cli.js

@@ -157,6 +157,16 @@ var githubActionsSourceSchema = z2.looseObject({
   branch: z2.string().min(1).optional(),
   ...sourceAuthenticationSchema
 }).superRefine(exactlyOneGithubAuthenticationMode);
+var azureDevOpsSourceSchema = z2.looseObject({
+  type: z2.literal("azure-devops"),
+  /** Azure DevOps organization name, used as one URL path segment. */
+  organization: z2.string().regex(/^[^/\s]+$/, "must be an organization name"),
+  project: z2.string().min(1),
+  /** The branch whose build health the dashboard represents. */
+  branch: z2.string().min(1).optional(),
+  /** Azure DevOps Build API access is authenticated with a read-scoped PAT. */
+  token_env: z2.string().min(1)
+});
 var sourceSchema = z2.looseObject({ type: z2.string().min(1), ...sourceAuthenticationSchema }).superRefine(exactlyOneGithubAuthenticationMode);
 var boardSchema = z2.object({
   refresh: durationSchema.optional(),
@@ -192,6 +202,33 @@ var boardConfigSchema = z2.object({
   sources: z2.record(z2.string().min(1), sourceSchema).default({}),
   boards: z2.record(z2.string().min(1), boardSchema),
   auth: authSchema.optional()
+}).superRefine((config, ctx) => {
+  for (const [sourceName, source] of Object.entries(config.sources)) {
+    if (source.type !== "azure-devops") continue;
+    const parsedSource = azureDevOpsSourceSchema.safeParse(source);
+    if (!parsedSource.success) {
+      for (const issue of parsedSource.error.issues) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["sources", sourceName, ...issue.path],
+          message: issue.message
+        });
+      }
+    }
+  }
+  for (const [boardName, board] of Object.entries(config.boards)) {
+    board.panels.forEach((panel, panelIndex) => {
+      const source = panel.source ? config.sources[panel.source] : void 0;
+      if (panel.type !== "pipeline-status" || source?.type !== "azure-devops") return;
+      if (typeof panel.pipeline !== "number" || !Number.isInteger(panel.pipeline) || panel.pipeline <= 0) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["boards", boardName, "panels", panelIndex, "pipeline"],
+          message: "Azure DevOps pipeline-status panels require a positive numeric pipeline definition id"
+        });
+      }
+    });
+  }
 });
 
 // packages/shared/src/board-config-modeline.ts
@@ -235,15 +272,13 @@ var clientEnvSchema = z3.object({
   proxyPath: z3.string().min(1),
   /** Which board this is, resolved server-side so the client parses no URLs. */
   board: z3.string().min(1),
-  /** The client version being served, so two published versions are visibly distinguishable. */
-  clientVersion: z3.string().min(1),
   /** Omitted entirely when unauthenticated — presence is what turns auth on. */
   auth: z3.object({
     issuer: z3.string().min(1),
     clientId: z3.string().min(1).optional()
   }).optional()
 });
-var clientIdentitySchema = clientEnvSchema.pick({ assetPath: true, clientVersion: true });
+var clientIdentitySchema = clientEnvSchema.pick({ assetPath: true });
 
 // packages/shared/src/envelope.ts
 import { z as z4 } from "zod";
@@ -318,7 +353,32 @@ var pullRequestHealthSchema = z4.object({
   status: pipelineStatusSchema.shape.status,
   summary: z4.string().min(1),
   workflows: z4.array(pullRequestHealthItemSchema),
-  pullRequests: z4.array(pullRequestHealthItemSchema)
+  pullRequests: z4.array(pullRequestHealthItemSchema),
+  /** Missing component reads remain visible even when the evidence we did get is reassuring. */
+  incompleteObservations: z4.array(z4.object({ label: z4.string().min(1), message: z4.string().min(1) })).optional(),
+  /** The latest component reading, disclosed beside the oldest aggregate evidence. */
+  newestObservedAt: z4.iso.datetime().optional()
+});
+var pullRequestCandidateSchema = z4.object({
+  number: z4.number().int().positive(),
+  branch: z4.string().min(1),
+  link: z4.url()
+});
+var pullRequestCandidatesSchema = z4.object({
+  type: z4.literal("pull-request-candidates"),
+  pullRequests: z4.array(pullRequestCandidateSchema),
+  /** GitHub's first page is a deliberate bounded observation, not proof that no later PR exists. */
+  truncated: z4.boolean().optional()
+});
+var pullRequestWorkflowObservationSchema = z4.object({
+  type: z4.literal("pull-request-workflow"),
+  workflow: z4.string().min(1),
+  item: pullRequestHealthItemSchema
+});
+var pullRequestBuildObservationSchema = z4.object({
+  type: z4.literal("pull-request-build"),
+  branch: z4.string().min(1),
+  item: pullRequestHealthItemSchema
 });
 var httpValueSchema = z4.object({
   type: z4.literal("http-value"),
@@ -416,11 +476,25 @@ function credentialEnvironmentNames2(source) {
 // packages/aws/src/release.ts
 var CORE_RUNTIME_VERSION = "1.0.0";
 var CANONICAL_ASSET_DOMAIN = "https://public-assets.zegreatrob.com";
-function clientAssetUrl(version, domain = CANONICAL_ASSET_DOMAIN) {
+function legacyAssetPath(version, domain = CANONICAL_ASSET_DOMAIN) {
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(version))
     throw new Error(`Invalid dashboard version: ${version}`);
   return `${domain.replace(/\/+$/, "")}/dashboard/${version}`;
 }
+function normalizeAssetPath(value2) {
+  const assetPath = value2.replace(/\/+$/, "");
+  let url;
+  try {
+    url = new URL(assetPath);
+  } catch {
+    throw new Error("--asset-path must be an absolute HTTP(S) URL");
+  }
+  if (!["http:", "https:"].includes(url.protocol) || !url.hostname || url.username || url.password || url.search || url.hash)
+    throw new Error(
+      "--asset-path must be an absolute HTTP(S) URL without credentials, query, or fragment"
+    );
+  return assetPath;
+}
 async function validateBoardConfig(path, expectedSchemaUrl) {
   const source = await readFile(resolve(path), "utf8");
   const authoredSchemaUrl = readBoardSchemaModeline(source, expectedSchemaUrl);
@@ -442,10 +516,14 @@ ${stringify(result.data, { sortMapEntries: true })}`;
   };
 }
 async function assembleRelease(input) {
-  const assetUrl = clientAssetUrl(input.version, input.assetDomain);
+  if (input.assetPath && input.assetDomain)
+    throw new Error("--asset-path and --asset-domain cannot be used together");
+  const assetPath = normalizeAssetPath(
+    input.assetPath ?? legacyAssetPath(input.version, input.assetDomain)
+  );
   const board = await validateBoardConfig(
     input.boardConfigPath,
-    `${assetUrl}/${boardSchemaFileName}`
+    `${assetPath}/${boardSchemaFileName}`
   );
   if (board.usesCredentials && !input.secretReference)
     throw new Error(
@@ -456,7 +534,7 @@ async function assembleRelease(input) {
   await writeFile(join(outputDir, "board.yaml"), board.yaml);
   const metadata = {
     dashboardVersion: input.version,
-    clientAssetUrl: assetUrl,
+    assetPath,
     serverRuntimeVersion: CORE_RUNTIME_VERSION,
     supportedProviders: input.providers ?? ["aws-lambda"],
     artifactChecksums: { "board.yaml": board.sha256 },
@@ -2700,6 +2778,7 @@ async function packageLambda(options) {
     outputDir: runtimeDir,
     version: options.version,
     providers: ["aws-lambda"],
+    assetPath: options.assetPath,
     assetDomain: options.assetDomain,
     secretReference: options.secretReference
   });
@@ -2745,7 +2824,7 @@ async function packageLambda(options) {
     deploymentTemplate(await cloudFormationTemplate("lambda"), {
       ComputeMode: "lambda",
       LambdaArtifactKey: packagedRelease.artifactKey,
-      DashboardVersion: packagedRelease.dashboardVersion
+      AssetPath: packagedRelease.assetPath
     })
   );
   return packagedRelease;
@@ -2759,6 +2838,7 @@ async function packageEcs(options) {
     outputDir,
     version: options.version,
     providers: ["aws-ecs-fargate"],
+    assetPath: options.assetPath,
     assetDomain: options.assetDomain,
     secretReference: options.secretReference
   });
@@ -2775,7 +2855,7 @@ async function packageEcs(options) {
     deploymentTemplate(await cloudFormationTemplate("ecs"), {
       ComputeMode: "ecs",
       Image: imageReference,
-      DashboardVersion: packagedRelease.dashboardVersion
+      AssetPath: packagedRelease.assetPath
     })
   );
   await writeFile3(
@@ -2944,10 +3024,8 @@ async function runDoctor(options, dependencies = actualDependencies) {
     return `${bucket} exists in ${bucketRegion}`;
   });
   await check("Hosted client", async () => {
-    const baseUrl = parameterData?.definitions.AssetBaseUrl?.Default;
-    if (typeof baseUrl !== "string") throw new Error("template has no AssetBaseUrl default");
     if (!dependencies.packageVersion) throw new Error("installed package version is unavailable");
-    const url = `${baseUrl.replace(/\/+$/, "")}/dashboard/${dependencies.packageVersion}/index.html`;
+    const url = `https://public-assets.zegreatrob.com/dashboard/${dependencies.packageVersion}/index.html`;
     const response = await dependencies.fetch(url);
     if (!response.ok) throw new Error(`${url} returned HTTP ${response.status}`);
     return `${url} returned HTTP ${response.status}`;
@@ -3583,6 +3661,8 @@ ${shellCommand(awsCommand)}`,
     if (!boardConfig) throw new Error("--board-config is required");
     if (!version)
       throw new Error("Unable to determine the package version; pass --version explicitly");
+    if (option("--asset-domain"))
+      console.warn("--asset-domain is deprecated; use --asset-path with the complete asset URL");
     const outputDir = option("--output", "aws-dashboard-release") ?? "aws-dashboard-release";
     const parametersPath = option("--parameters", "aws-dashboard-parameters.json") ?? "aws-dashboard-parameters.json";
     const rawParameters = await existingParameters(parametersPath);
@@ -3597,12 +3677,14 @@ ${shellCommand(awsCommand)}`,
       boardConfigPath: boardConfig,
       outputDir,
       version,
+      assetPath: option("--asset-path"),
       assetDomain: option("--asset-domain"),
       secretReference
     }) : await packageEcs({
       boardConfigPath: boardConfig,
       outputDir,
       version,
+      assetPath: option("--asset-path"),
       assetDomain: option("--asset-domain"),
       secretReference,
       imageReference: option("--image")
@@ -3611,7 +3693,7 @@ ${shellCommand(awsCommand)}`,
       ComputeMode: mode,
       LambdaArtifactKey: metadata.artifactKey,
       Image: metadata.image ?? "",
-      DashboardVersion: metadata.dashboardVersion
+      AssetPath: metadata.assetPath
     });
     if (mode === "lambda" && !rawParameters.some(({ ParameterKey }) => ParameterKey === "ComputeMode"))
       resolvedParameters.splice(

package/dist/index.d.ts

@@ -7,7 +7,7 @@ export { type BootstrapAffectedStack, type BootstrapRecoveryCommand, type Bootst
 export type ReleaseMetadata = {
     computeMode: ComputeMode;
     dashboardVersion: string;
-    clientAssetUrl: string;
+    assetPath: string;
     serverRuntimeVersion: string;
     supportedProviders: string[];
     artifactChecksums: Record<string, string>;
@@ -23,6 +23,8 @@ export type LambdaPackageOptions = {
     boardConfigPath: string;
     outputDir: string;
     version: string;
+    assetPath?: string;
+    /** @deprecated Use assetPath. */
     assetDomain?: string;
     /** ARN of the consumer-owned JSON credential-map secret, never a secret value. */
     secretReference?: string;

package/dist/index.js

@@ -839,6 +839,16 @@ var githubActionsSourceSchema = z2.looseObject({
   branch: z2.string().min(1).optional(),
   ...sourceAuthenticationSchema
 }).superRefine(exactlyOneGithubAuthenticationMode);
+var azureDevOpsSourceSchema = z2.looseObject({
+  type: z2.literal("azure-devops"),
+  /** Azure DevOps organization name, used as one URL path segment. */
+  organization: z2.string().regex(/^[^/\s]+$/, "must be an organization name"),
+  project: z2.string().min(1),
+  /** The branch whose build health the dashboard represents. */
+  branch: z2.string().min(1).optional(),
+  /** Azure DevOps Build API access is authenticated with a read-scoped PAT. */
+  token_env: z2.string().min(1)
+});
 var sourceSchema = z2.looseObject({ type: z2.string().min(1), ...sourceAuthenticationSchema }).superRefine(exactlyOneGithubAuthenticationMode);
 var boardSchema = z2.object({
   refresh: durationSchema.optional(),
@@ -874,6 +884,33 @@ var boardConfigSchema = z2.object({
   sources: z2.record(z2.string().min(1), sourceSchema).default({}),
   boards: z2.record(z2.string().min(1), boardSchema),
   auth: authSchema.optional()
+}).superRefine((config, ctx) => {
+  for (const [sourceName, source] of Object.entries(config.sources)) {
+    if (source.type !== "azure-devops") continue;
+    const parsedSource = azureDevOpsSourceSchema.safeParse(source);
+    if (!parsedSource.success) {
+      for (const issue of parsedSource.error.issues) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["sources", sourceName, ...issue.path],
+          message: issue.message
+        });
+      }
+    }
+  }
+  for (const [boardName, board] of Object.entries(config.boards)) {
+    board.panels.forEach((panel, panelIndex) => {
+      const source = panel.source ? config.sources[panel.source] : void 0;
+      if (panel.type !== "pipeline-status" || source?.type !== "azure-devops") return;
+      if (typeof panel.pipeline !== "number" || !Number.isInteger(panel.pipeline) || panel.pipeline <= 0) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["boards", boardName, "panels", panelIndex, "pipeline"],
+          message: "Azure DevOps pipeline-status panels require a positive numeric pipeline definition id"
+        });
+      }
+    });
+  }
 });
 
 // packages/shared/src/board-config-modeline.ts
@@ -917,15 +954,13 @@ var clientEnvSchema = z3.object({
   proxyPath: z3.string().min(1),
   /** Which board this is, resolved server-side so the client parses no URLs. */
   board: z3.string().min(1),
-  /** The client version being served, so two published versions are visibly distinguishable. */
-  clientVersion: z3.string().min(1),
   /** Omitted entirely when unauthenticated — presence is what turns auth on. */
   auth: z3.object({
     issuer: z3.string().min(1),
     clientId: z3.string().min(1).optional()
   }).optional()
 });
-var clientIdentitySchema = clientEnvSchema.pick({ assetPath: true, clientVersion: true });
+var clientIdentitySchema = clientEnvSchema.pick({ assetPath: true });
 
 // packages/shared/src/envelope.ts
 import { z as z4 } from "zod";
@@ -1000,7 +1035,32 @@ var pullRequestHealthSchema = z4.object({
   status: pipelineStatusSchema.shape.status,
   summary: z4.string().min(1),
   workflows: z4.array(pullRequestHealthItemSchema),
-  pullRequests: z4.array(pullRequestHealthItemSchema)
+  pullRequests: z4.array(pullRequestHealthItemSchema),
+  /** Missing component reads remain visible even when the evidence we did get is reassuring. */
+  incompleteObservations: z4.array(z4.object({ label: z4.string().min(1), message: z4.string().min(1) })).optional(),
+  /** The latest component reading, disclosed beside the oldest aggregate evidence. */
+  newestObservedAt: z4.iso.datetime().optional()
+});
+var pullRequestCandidateSchema = z4.object({
+  number: z4.number().int().positive(),
+  branch: z4.string().min(1),
+  link: z4.url()
+});
+var pullRequestCandidatesSchema = z4.object({
+  type: z4.literal("pull-request-candidates"),
+  pullRequests: z4.array(pullRequestCandidateSchema),
+  /** GitHub's first page is a deliberate bounded observation, not proof that no later PR exists. */
+  truncated: z4.boolean().optional()
+});
+var pullRequestWorkflowObservationSchema = z4.object({
+  type: z4.literal("pull-request-workflow"),
+  workflow: z4.string().min(1),
+  item: pullRequestHealthItemSchema
+});
+var pullRequestBuildObservationSchema = z4.object({
+  type: z4.literal("pull-request-build"),
+  branch: z4.string().min(1),
+  item: pullRequestHealthItemSchema
 });
 var httpValueSchema = z4.object({
   type: z4.literal("http-value"),
@@ -1098,11 +1158,25 @@ function credentialEnvironmentNames2(source) {
 // packages/aws/src/release.ts
 var CORE_RUNTIME_VERSION = "1.0.0";
 var CANONICAL_ASSET_DOMAIN = "https://public-assets.zegreatrob.com";
-function clientAssetUrl(version, domain = CANONICAL_ASSET_DOMAIN) {
+function legacyAssetPath(version, domain = CANONICAL_ASSET_DOMAIN) {
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(version))
     throw new Error(`Invalid dashboard version: ${version}`);
   return `${domain.replace(/\/+$/, "")}/dashboard/${version}`;
 }
+function normalizeAssetPath(value2) {
+  const assetPath = value2.replace(/\/+$/, "");
+  let url;
+  try {
+    url = new URL(assetPath);
+  } catch {
+    throw new Error("--asset-path must be an absolute HTTP(S) URL");
+  }
+  if (!["http:", "https:"].includes(url.protocol) || !url.hostname || url.username || url.password || url.search || url.hash)
+    throw new Error(
+      "--asset-path must be an absolute HTTP(S) URL without credentials, query, or fragment"
+    );
+  return assetPath;
+}
 async function validateBoardConfig(path, expectedSchemaUrl) {
   const source = await readFile(resolve(path), "utf8");
   const authoredSchemaUrl = readBoardSchemaModeline(source, expectedSchemaUrl);
@@ -1124,10 +1198,14 @@ ${stringify(result.data, { sortMapEntries: true })}`;
   };
 }
 async function assembleRelease(input) {
-  const assetUrl = clientAssetUrl(input.version, input.assetDomain);
+  if (input.assetPath && input.assetDomain)
+    throw new Error("--asset-path and --asset-domain cannot be used together");
+  const assetPath = normalizeAssetPath(
+    input.assetPath ?? legacyAssetPath(input.version, input.assetDomain)
+  );
   const board = await validateBoardConfig(
     input.boardConfigPath,
-    `${assetUrl}/${boardSchemaFileName}`
+    `${assetPath}/${boardSchemaFileName}`
   );
   if (board.usesCredentials && !input.secretReference)
     throw new Error(
@@ -1138,7 +1216,7 @@ async function assembleRelease(input) {
   await writeFile(join(outputDir, "board.yaml"), board.yaml);
   const metadata = {
     dashboardVersion: input.version,
-    clientAssetUrl: assetUrl,
+    assetPath,
     serverRuntimeVersion: CORE_RUNTIME_VERSION,
     supportedProviders: input.providers ?? ["aws-lambda"],
     artifactChecksums: { "board.yaml": board.sha256 },
@@ -2688,6 +2766,7 @@ async function packageLambda(options) {
     outputDir: runtimeDir,
     version: options.version,
     providers: ["aws-lambda"],
+    assetPath: options.assetPath,
     assetDomain: options.assetDomain,
     secretReference: options.secretReference
   });
@@ -2733,7 +2812,7 @@ async function packageLambda(options) {
     deploymentTemplate(await cloudFormationTemplate("lambda"), {
       ComputeMode: "lambda",
       LambdaArtifactKey: packagedRelease.artifactKey,
-      DashboardVersion: packagedRelease.dashboardVersion
+      AssetPath: packagedRelease.assetPath
     })
   );
   return packagedRelease;
@@ -2747,6 +2826,7 @@ async function packageEcs(options) {
     outputDir,
     version: options.version,
     providers: ["aws-ecs-fargate"],
+    assetPath: options.assetPath,
     assetDomain: options.assetDomain,
     secretReference: options.secretReference
   });
@@ -2763,7 +2843,7 @@ async function packageEcs(options) {
     deploymentTemplate(await cloudFormationTemplate("ecs"), {
       ComputeMode: "ecs",
       Image: imageReference,
-      DashboardVersion: packagedRelease.dashboardVersion
+      AssetPath: packagedRelease.assetPath
     })
   );
   await writeFile3(