@continuous-excellence/ze-great-dashboard-aws 0.18.4 → 0.20.0

package/dist/lambda.mjs

@@ -3124,7 +3124,7 @@ var require_timestamp = __commonJS({
       resolve: (str) => parseSexagesimal(str, false),
       stringify: stringifySexagesimal
     };
-    var timestamp2 = {
+    var timestamp3 = {
       identify: (value) => value instanceof Date,
       default: true,
       tag: "tag:yaml.org,2002:timestamp",
@@ -3133,7 +3133,7 @@ var require_timestamp = __commonJS({
       // assumed to be 00:00:00Z (start of day, UTC).
       test: RegExp("^([0-9]{4})-([0-9]{1,2})-([0-9]{1,2})(?:(?:t|T|[ \\t]+)([0-9]{1,2}):([0-9]{1,2}):([0-9]{1,2}(\\.[0-9]+)?)(?:[ \\t]*(Z|[-+][012]?[0-9](?::[0-9]{2})?))?)?$"),
       resolve(str) {
-        const match2 = str.match(timestamp2.test);
+        const match2 = str.match(timestamp3.test);
         if (!match2)
           throw new Error("!!timestamp expects a date, starting with yyyy-mm-dd");
         const [, year2, month, day, hour, minute, second] = match2.map(Number);
@@ -3152,7 +3152,7 @@ var require_timestamp = __commonJS({
     };
     exports.floatTime = floatTime;
     exports.intTime = intTime;
-    exports.timestamp = timestamp2;
+    exports.timestamp = timestamp3;
   }
 });
 
@@ -3172,7 +3172,7 @@ var require_schema3 = __commonJS({
     var omap = require_omap();
     var pairs = require_pairs();
     var set2 = require_set();
-    var timestamp2 = require_timestamp();
+    var timestamp3 = require_timestamp();
     var schema = [
       map4.map,
       seq.seq,
@@ -3192,9 +3192,9 @@ var require_schema3 = __commonJS({
       omap.omap,
       pairs.pairs,
       set2.set,
-      timestamp2.intTime,
-      timestamp2.floatTime,
-      timestamp2.timestamp
+      timestamp3.intTime,
+      timestamp3.floatTime,
+      timestamp3.timestamp
     ];
     exports.schema = schema;
   }
@@ -3219,7 +3219,7 @@ var require_tags = __commonJS({
     var pairs = require_pairs();
     var schema$2 = require_schema3();
     var set2 = require_set();
-    var timestamp2 = require_timestamp();
+    var timestamp3 = require_timestamp();
     var schemas = /* @__PURE__ */ new Map([
       ["core", schema.schema],
       ["failsafe", [map4.map, seq.seq, string4.string]],
@@ -3233,11 +3233,11 @@ var require_tags = __commonJS({
       float: float.float,
       floatExp: float.floatExp,
       floatNaN: float.floatNaN,
-      floatTime: timestamp2.floatTime,
+      floatTime: timestamp3.floatTime,
       int: int2.int,
       intHex: int2.intHex,
       intOct: int2.intOct,
-      intTime: timestamp2.intTime,
+      intTime: timestamp3.intTime,
       map: map4.map,
       merge: merge3.merge,
       null: _null4.nullTag,
@@ -3245,7 +3245,7 @@ var require_tags = __commonJS({
       pairs: pairs.pairs,
       seq: seq.seq,
       set: set2.set,
-      timestamp: timestamp2.timestamp
+      timestamp: timestamp3.timestamp
     };
     var coreKnownTags = {
       "tag:yaml.org,2002:binary": binary.binary,
@@ -3253,7 +3253,7 @@ var require_tags = __commonJS({
       "tag:yaml.org,2002:omap": omap.omap,
       "tag:yaml.org,2002:pairs": pairs.pairs,
       "tag:yaml.org,2002:set": set2.set,
-      "tag:yaml.org,2002:timestamp": timestamp2.timestamp
+      "tag:yaml.org,2002:timestamp": timestamp3.timestamp
     };
     function getTags(customTags, schemaName, addMergeTag) {
       const schemaTags = schemas.get(schemaName);
@@ -10643,12 +10643,12 @@ var init_schema_date_utils = __esm({
         [, month, day, hour, minute, second, fraction, year2] = matches;
       }
       if (year2 && second) {
-        const timestamp2 = Date.UTC(Number(year2), months.indexOf(month), Number(day), Number(hour), Number(minute), Number(second), fraction ? Math.round(parseFloat(`0.${fraction}`) * 1e3) : 0);
+        const timestamp3 = Date.UTC(Number(year2), months.indexOf(month), Number(day), Number(hour), Number(minute), Number(second), fraction ? Math.round(parseFloat(`0.${fraction}`) * 1e3) : 0);
         range(day, 1, 31);
         range(hour, 0, 23);
         range(minute, 0, 59);
         range(second, 0, 60);
-        const date6 = new Date(timestamp2);
+        const date6 = new Date(timestamp3);
         date6.setUTCFullYear(Number(year2));
         return date6;
       }
@@ -17638,14 +17638,14 @@ var init_DefaultRateLimiter = __esm({
         this.availableTokens = this.availableTokens - amount;
       }
       refillTokenBucket() {
-        const timestamp2 = this.getCurrentTimeInSeconds();
+        const timestamp3 = this.getCurrentTimeInSeconds();
         if (!this.lastTimestamp) {
-          this.lastTimestamp = timestamp2;
+          this.lastTimestamp = timestamp3;
           return;
         }
-        const fillAmount = (timestamp2 - this.lastTimestamp) * this.fillRate;
+        const fillAmount = (timestamp3 - this.lastTimestamp) * this.fillRate;
         this.availableTokens = Math.min(this.maxCapacity, this.availableTokens + fillAmount);
-        this.lastTimestamp = timestamp2;
+        this.lastTimestamp = timestamp3;
       }
       calculateTimeWindow() {
         this.timeWindow = this.getPrecise(Math.pow(this.lastMaxRate * (1 - this.beta) / this.scaleConstant, 1 / 3));
@@ -17653,8 +17653,8 @@ var init_DefaultRateLimiter = __esm({
       cubicThrottle(rateToUse) {
         return this.getPrecise(rateToUse * this.beta);
       }
-      cubicSuccess(timestamp2) {
-        return this.getPrecise(this.scaleConstant * Math.pow(timestamp2 - this.lastThrottleTime - this.timeWindow, 3) + this.lastMaxRate);
+      cubicSuccess(timestamp3) {
+        return this.getPrecise(this.scaleConstant * Math.pow(timestamp3 - this.lastThrottleTime - this.timeWindow, 3) + this.lastMaxRate);
       }
       enableTokenBucket() {
         this.enabled = true;
@@ -49137,8 +49137,8 @@ var handle = (app, { isContentTypeBinary } = { isContentTypeBinary: void 0 }) =>
       requestContext = getRequestContext(event);
     } catch (error52) {
       console.error("Error processing request:", error52);
-      const errorResponse2 = error52 instanceof TypeError ? new Response("Invalid request", { status: 400 }) : new Response("Internal Server Error", { status: 500 });
-      return processor.createResult(event, errorResponse2, { isContentTypeBinary });
+      const errorResponse3 = error52 instanceof TypeError ? new Response("Invalid request", { status: 400 }) : new Response("Internal Server Error", { status: 500 });
+      return processor.createResult(event, errorResponse3, { isContentTypeBinary });
     }
     const res = await app.fetch(req, {
       event,
@@ -64040,14 +64040,25 @@ var githubActionsSourceSchema = external_exports.looseObject({
   branch: external_exports.string().min(1).optional(),
   ...sourceAuthenticationSchema
 }).superRefine(exactlyOneGithubAuthenticationMode);
+var azureDevOpsSourceSchema = external_exports.looseObject({
+  type: external_exports.literal("azure-devops"),
+  /** Azure DevOps organization name, used as one URL path segment. */
+  organization: external_exports.string().regex(/^[^/\s]+$/, "must be an organization name"),
+  project: external_exports.string().min(1),
+  /** The branch whose build health the dashboard represents. */
+  branch: external_exports.string().min(1).optional(),
+  /** Azure DevOps Build API access is authenticated with a read-scoped PAT. */
+  token_env: external_exports.string().min(1)
+});
 var sourceSchema = external_exports.looseObject({ type: external_exports.string().min(1), ...sourceAuthenticationSchema }).superRefine(exactlyOneGithubAuthenticationMode);
 function credentialEnvironmentNames(source) {
+  const githubApp = githubAppSchema.safeParse(source.github_app);
   return [
     ...source.token_env ? [source.token_env] : [],
-    ...source.github_app ? [
-      source.github_app.app_id_env,
-      source.github_app.private_key_env,
-      source.github_app.installation_id_env
+    ...githubApp.success ? [
+      githubApp.data.app_id_env,
+      githubApp.data.private_key_env,
+      githubApp.data.installation_id_env
     ] : []
   ];
 }
@@ -64085,6 +64096,33 @@ var boardConfigSchema = external_exports.object({
   sources: external_exports.record(external_exports.string().min(1), sourceSchema).default({}),
   boards: external_exports.record(external_exports.string().min(1), boardSchema),
   auth: authSchema.optional()
+}).superRefine((config2, ctx) => {
+  for (const [sourceName, source] of Object.entries(config2.sources)) {
+    if (source.type !== "azure-devops") continue;
+    const parsedSource = azureDevOpsSourceSchema.safeParse(source);
+    if (!parsedSource.success) {
+      for (const issue2 of parsedSource.error.issues) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["sources", sourceName, ...issue2.path],
+          message: issue2.message
+        });
+      }
+    }
+  }
+  for (const [boardName, board] of Object.entries(config2.boards)) {
+    board.panels.forEach((panel, panelIndex) => {
+      const source = panel.source ? config2.sources[panel.source] : void 0;
+      if (panel.type !== "pipeline-status" || source?.type !== "azure-devops") return;
+      if (typeof panel.pipeline !== "number" || !Number.isInteger(panel.pipeline) || panel.pipeline <= 0) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["boards", boardName, "panels", panelIndex, "pipeline"],
+          message: "Azure DevOps pipeline-status panels require a positive numeric pipeline definition id"
+        });
+      }
+    });
+  }
 });
 
 // packages/shared/src/board-config-modeline.ts
@@ -64129,15 +64167,13 @@ var clientEnvSchema = external_exports.object({
   proxyPath: external_exports.string().min(1),
   /** Which board this is, resolved server-side so the client parses no URLs. */
   board: external_exports.string().min(1),
-  /** The client version being served, so two published versions are visibly distinguishable. */
-  clientVersion: external_exports.string().min(1),
   /** Omitted entirely when unauthenticated — presence is what turns auth on. */
   auth: external_exports.object({
     issuer: external_exports.string().min(1),
     clientId: external_exports.string().min(1).optional()
   }).optional()
 });
-var clientIdentitySchema = clientEnvSchema.pick({ assetPath: true, clientVersion: true });
+var clientIdentitySchema = clientEnvSchema.pick({ assetPath: true });
 
 // packages/shared/src/envelope.ts
 var errorKindSchema = external_exports.enum([
@@ -64211,7 +64247,32 @@ var pullRequestHealthSchema = external_exports.object({
   status: pipelineStatusSchema.shape.status,
   summary: external_exports.string().min(1),
   workflows: external_exports.array(pullRequestHealthItemSchema),
-  pullRequests: external_exports.array(pullRequestHealthItemSchema)
+  pullRequests: external_exports.array(pullRequestHealthItemSchema),
+  /** Missing component reads remain visible even when the evidence we did get is reassuring. */
+  incompleteObservations: external_exports.array(external_exports.object({ label: external_exports.string().min(1), message: external_exports.string().min(1) })).optional(),
+  /** The latest component reading, disclosed beside the oldest aggregate evidence. */
+  newestObservedAt: external_exports.iso.datetime().optional()
+});
+var pullRequestCandidateSchema = external_exports.object({
+  number: external_exports.number().int().positive(),
+  branch: external_exports.string().min(1),
+  link: external_exports.url()
+});
+var pullRequestCandidatesSchema = external_exports.object({
+  type: external_exports.literal("pull-request-candidates"),
+  pullRequests: external_exports.array(pullRequestCandidateSchema),
+  /** GitHub's first page is a deliberate bounded observation, not proof that no later PR exists. */
+  truncated: external_exports.boolean().optional()
+});
+var pullRequestWorkflowObservationSchema = external_exports.object({
+  type: external_exports.literal("pull-request-workflow"),
+  workflow: external_exports.string().min(1),
+  item: pullRequestHealthItemSchema
+});
+var pullRequestBuildObservationSchema = external_exports.object({
+  type: external_exports.literal("pull-request-build"),
+  branch: external_exports.string().min(1),
+  item: pullRequestHealthItemSchema
 });
 var httpValueSchema = external_exports.object({
   type: external_exports.literal("http-value"),
@@ -66400,6 +66461,275 @@ var Hono2 = class extends Hono {
 // packages/server/src/app.ts
 var import_yaml = __toESM(require_dist(), 1);
 
+// packages/server/src/upstream.ts
+function forwardValidators(requestHeaders, upstreamHeaders) {
+  for (const name of ["if-none-match", "if-modified-since"]) {
+    const value = requestHeaders.get(name);
+    if (value) upstreamHeaders.set(name, value);
+  }
+}
+function observedAt(upstreamDate) {
+  const parsed = upstreamDate ? new Date(upstreamDate) : void 0;
+  return parsed && !Number.isNaN(parsed.valueOf()) ? parsed.toISOString() : (/* @__PURE__ */ new Date()).toISOString();
+}
+function upstreamErrorEnvelope(args) {
+  return {
+    panelId: args.panelId,
+    state: "error",
+    observedAt: observedAt(args.upstreamDate),
+    link: args.link,
+    error: {
+      kind: args.kind,
+      message: args.error instanceof Error ? args.error.message : String(args.error)
+    }
+  };
+}
+function upstreamErrorResponse(envelope) {
+  return new Response(JSON.stringify(envelope), { status: 200 });
+}
+function upstreamErrorKind(status) {
+  if (status === 401 || status === 403) return "unauthorized";
+  if (status === 404) return "not-found";
+  return "upstream-error";
+}
+async function adapterRouteResponse(result) {
+  const headers = passthroughHeaders(result.response.headers);
+  if (result.response.status === 304) return new Response(null, { status: 304, headers });
+  const envelope = result.envelope ?? JSON.parse(await result.response.text());
+  headers.set("content-type", "application/json; charset=utf-8");
+  return new Response(JSON.stringify(envelope), { status: 200, headers });
+}
+function passthroughHeaders(upstream) {
+  const headers = new Headers();
+  for (const name of ["cache-control", "etag", "last-modified", "date", "vary"]) {
+    const value = upstream.get(name);
+    if (value) headers.set(name, value);
+  }
+  return headers;
+}
+
+// packages/server/src/adapters/azure-devops.ts
+var pipelinePanelSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  type: external_exports.literal("pipeline-status"),
+  source: external_exports.string().min(1),
+  pipeline: external_exports.number().int().positive()
+});
+var buildSchema = external_exports.object({
+  id: external_exports.number().int().positive(),
+  buildNumber: external_exports.string().min(1),
+  status: external_exports.string().nullable().optional(),
+  result: external_exports.string().nullable().optional(),
+  sourceBranch: external_exports.string().min(1).nullable().optional(),
+  startTime: external_exports.string().nullable().optional(),
+  finishTime: external_exports.string().nullable().optional(),
+  lastChangedDate: external_exports.string().nullable().optional()
+});
+var buildsSchema = external_exports.object({ value: external_exports.array(buildSchema) });
+var timelineSchema = external_exports.object({
+  records: external_exports.array(
+    external_exports.object({
+      id: external_exports.string().min(1),
+      parentId: external_exports.string().min(1).nullable().optional(),
+      type: external_exports.string().min(1),
+      name: external_exports.string().min(1),
+      state: external_exports.string().nullable().optional()
+    })
+  )
+});
+function permittedAzureDevOpsCalls(panel, source) {
+  const parsedPanel = pipelinePanelSchema.parse(panel);
+  const parsedSource = azureDevOpsSourceSchema.parse(source);
+  return [buildsCall(parsedPanel.pipeline, parsedSource)];
+}
+async function fetchAzureDevOpsPipeline(args) {
+  const panel = pipelinePanelSchema.parse(args.panel);
+  const source = azureDevOpsSourceSchema.parse(args.source);
+  const token = args.credentials.get(source.token_env);
+  if (!token) {
+    return {
+      response: errorResponse(
+        errorEnvelope(
+          panel.id,
+          "unauthorized",
+          `Credential ${source.token_env} is not available.`,
+          sourceLink(panel.pipeline, source)
+        )
+      )
+    };
+  }
+  const call = buildsCall(panel.pipeline, source);
+  copyValidators(args.requestHeaders, call.headers);
+  call.headers.set("authorization", `Basic ${btoa(`:${token}`)}`);
+  let upstream;
+  try {
+    upstream = await args.fetcher(call.url, { headers: call.headers });
+  } catch (error52) {
+    return {
+      response: errorResponse(
+        errorEnvelope(panel.id, "unreachable", error52, sourceLink(panel.pipeline, source))
+      )
+    };
+  }
+  if (upstream.status === 304) return { response: upstream };
+  if (!upstream.ok) {
+    return {
+      response: errorResponse(
+        errorEnvelope(
+          panel.id,
+          errorKind(upstream.status),
+          `${upstream.status} ${upstream.statusText}`,
+          sourceLink(panel.pipeline, source),
+          observedAt2(upstream.headers.get("date"))
+        )
+      )
+    };
+  }
+  try {
+    const build = buildsSchema.parse(await upstream.json()).value[0];
+    if (!build) {
+      return {
+        response: errorResponse(
+          errorEnvelope(
+            panel.id,
+            "no-runs",
+            source.branch ? `No builds found for branch "${source.branch}". Check the source's branch setting.` : "No builds found.",
+            sourceLink(panel.pipeline, source),
+            observedAt2(upstream.headers.get("date"))
+          )
+        )
+      };
+    }
+    const signal = {
+      type: "pipeline-status",
+      status: normalizeStatus(build.status, build.result),
+      rawStatus: build.result ?? build.status ?? "unknown",
+      name: build.buildNumber,
+      ...build.sourceBranch ?? source.branch ? { branch: build.sourceBranch ?? source.branch } : {},
+      ...timestamp(build.startTime) ? { runStartedAt: timestamp(build.startTime) } : {},
+      ...timestamp(build.lastChangedDate) ? { sourceUpdatedAt: timestamp(build.lastChangedDate) } : {},
+      sourceRunId: String(build.id),
+      ...completedBuildDuration(build)
+    };
+    if (signal.status === "running") {
+      const activity = await activeAzureDevOpsActivity({
+        buildId: build.id,
+        source,
+        fetcher: args.fetcher,
+        authorization: call.headers.get("authorization") ?? ""
+      });
+      if (activity) signal.activity = activity;
+    }
+    return {
+      envelope: {
+        panelId: panel.id,
+        state: "ok",
+        observedAt: observedAt2(upstream.headers.get("date")),
+        link: buildLink(build.id, source),
+        signal
+      },
+      response: upstream
+    };
+  } catch (error52) {
+    return {
+      response: errorResponse(
+        errorEnvelope(
+          panel.id,
+          "upstream-error",
+          error52,
+          sourceLink(panel.pipeline, source),
+          observedAt2(upstream.headers.get("date"))
+        )
+      )
+    };
+  }
+}
+function buildsCall(definitionId, source) {
+  const url2 = apiUrl(source, "build/builds");
+  url2.searchParams.set("definitions", String(definitionId));
+  if (source.branch) url2.searchParams.set("branchName", adoBranch(source.branch));
+  url2.searchParams.set("queryOrder", "queueTimeDescending");
+  url2.searchParams.set("$top", "1");
+  return { url: url2.toString(), headers: new Headers({ accept: "application/json" }) };
+}
+function timelineCall(buildId, source) {
+  return {
+    url: apiUrl(source, `build/builds/${buildId}/timeline`).toString(),
+    headers: new Headers({ accept: "application/json" })
+  };
+}
+function apiUrl(source, suffix) {
+  const url2 = new URL(
+    `https://dev.azure.com/${encodeURIComponent(source.organization)}/${encodeURIComponent(source.project)}/_apis/${suffix}`
+  );
+  url2.searchParams.set("api-version", "7.1");
+  return url2;
+}
+function adoBranch(branch) {
+  return branch.startsWith("refs/") ? branch : `refs/heads/${branch}`;
+}
+async function activeAzureDevOpsActivity(args) {
+  const call = timelineCall(args.buildId, args.source);
+  call.headers.set("authorization", args.authorization);
+  try {
+    const response = await args.fetcher(call.url, { headers: call.headers });
+    if (!response.ok) return void 0;
+    const records = timelineSchema.parse(await response.json()).records;
+    const active = records.find((record2) => record2.state === "inProgress");
+    if (!active) return void 0;
+    const parent = active.parentId ? records.find((record2) => record2.id === active.parentId) : void 0;
+    const kind = active.type.toLowerCase();
+    return {
+      kind: kind === "stage" ? "stage" : kind === "job" ? "job" : "step",
+      name: active.name,
+      ...parent ? { parent: parent.name } : {}
+    };
+  } catch {
+    return void 0;
+  }
+}
+function normalizeStatus(status, result) {
+  if (status === "notStarted" || status === "postponed" || status === "inProgress" || status === "cancelling")
+    return "running";
+  if (status !== "completed") return "unknown";
+  if (result === "succeeded") return "passed";
+  if (result === "failed") return "failed";
+  if (result === "canceled") return "cancelled";
+  return "unknown";
+}
+function completedBuildDuration(build) {
+  const startedAt = timestamp(build.startTime);
+  const finishedAt = timestamp(build.finishTime);
+  if (!startedAt || !finishedAt) return {};
+  const durationMs = new Date(finishedAt).valueOf() - new Date(startedAt).valueOf();
+  return Number.isFinite(durationMs) && durationMs >= 0 ? { durationMs } : {};
+}
+function timestamp(value) {
+  if (!value || !external_exports.iso.datetime().safeParse(value).success) return void 0;
+  return Number.isFinite(new Date(value).valueOf()) ? value : void 0;
+}
+function copyValidators(requestHeaders, upstreamHeaders) {
+  forwardValidators(requestHeaders, upstreamHeaders);
+}
+function buildLink(buildId, source) {
+  return `https://dev.azure.com/${encodeURIComponent(source.organization)}/${encodeURIComponent(source.project)}/_build/results?buildId=${buildId}`;
+}
+function sourceLink(definitionId, source) {
+  return `https://dev.azure.com/${encodeURIComponent(source.organization)}/${encodeURIComponent(source.project)}/_build?definitionId=${definitionId}`;
+}
+function errorResponse(envelope) {
+  return upstreamErrorResponse(envelope);
+}
+function errorEnvelope(panelId, kind, error52, link, date6) {
+  return upstreamErrorEnvelope({ panelId, kind, error: error52, link, upstreamDate: date6 });
+}
+function errorKind(status) {
+  return upstreamErrorKind(status);
+}
+function observedAt2(value) {
+  return observedAt(value);
+}
+
 // packages/server/src/credentials.ts
 var import_client_secrets_manager = __toESM(require_dist_cjs16(), 1);
 var import_client_ssm = __toESM(require_dist_cjs17(), 1);
@@ -66509,10 +66839,7 @@ function createGithubClient(credentials, now = Date.now) {
 }
 function githubHeaders(requestHeaders) {
   const headers = new Headers({ accept: "application/vnd.github+json" });
-  for (const name of ["if-none-match", "if-modified-since"]) {
-    const value = requestHeaders.get(name);
-    if (value) headers.set(name, value);
-  }
+  forwardValidators(requestHeaders, headers);
   return headers;
 }
 async function exchangeInstallationToken(args) {
@@ -66565,7 +66892,7 @@ function base64url3(value) {
 }
 
 // packages/server/src/adapters/github-actions.ts
-var pipelinePanelSchema = external_exports.object({
+var pipelinePanelSchema2 = external_exports.object({
   id: external_exports.string().min(1),
   type: external_exports.literal("pipeline-status"),
   source: external_exports.string().min(1),
@@ -66616,7 +66943,7 @@ var pullRequestsSchema = external_exports.array(
   })
 );
 function permittedGithubActionsCalls(panel, source, _credentials) {
-  const parsedPanel = pipelinePanelSchema.parse(panel);
+  const parsedPanel = pipelinePanelSchema2.parse(panel);
   const parsedSource = githubActionsSourceSchema.parse(source);
   const url2 = new URL(
     `https://api.github.com/repos/${parsedSource.repo}/actions/workflows/${encodeURIComponent(parsedPanel.pipeline)}/runs`
@@ -66625,90 +66952,117 @@ function permittedGithubActionsCalls(panel, source, _credentials) {
   url2.searchParams.set("per_page", "1");
   return [{ url: url2.toString(), headers: new Headers() }];
 }
-function permittedGithubActionsPullRequestHealthCalls(panel, source) {
-  const parsedPanel = pullRequestHealthPanelSchema.parse(panel);
-  const parsedSource = githubActionsSourceSchema.parse(source);
-  const calls = parsedPanel.update_workflows.map(
-    ({ workflow }) => githubRunsCall(parsedSource, workflow)
+function pullRequestHealthCapabilities(panel) {
+  const parsed = pullRequestHealthPanelSchema.parse(panel);
+  return {
+    panel: parsed,
+    configuredUpdateWorkflow(workflow) {
+      return parsed.update_workflows.find((candidate) => candidate.workflow === workflow);
+    },
+    permitsBuildBranch(branch) {
+      return parsed.update_workflows.some(
+        ({ branch_prefixes }) => branch_prefixes.some((prefix) => branch.startsWith(prefix))
+      );
+    }
+  };
+}
+async function fetchGithubActionsPullRequestCandidates(args) {
+  const capabilities = pullRequestHealthCapabilities(args.panel);
+  const panel = capabilities.panel;
+  const source = githubActionsSourceSchema.parse(args.source);
+  return githubObservation(
+    args,
+    source,
+    pullRequestsCall(source, panel.base_branch, 1),
+    (value, observedAt4) => {
+      const page = pullRequestsSchema.parse(value);
+      const pullRequests = page.filter(
+        (pullRequest) => capabilities.permitsBuildBranch(pullRequest.head.ref)
+      );
+      return {
+        panelId: panel.id,
+        state: "ok",
+        observedAt: observedAt4,
+        link: sourceLinkForRepository(source),
+        signal: {
+          type: "pull-request-candidates",
+          pullRequests: pullRequests.map((pullRequest) => ({
+            number: pullRequest.number,
+            branch: pullRequest.head.ref,
+            link: pullRequest.html_url
+          })),
+          ...page.length === 100 ? { truncated: true } : {}
+        }
+      };
+    }
   );
-  calls.push({
-    ...pullRequestsCall(parsedSource, parsedPanel.base_branch, 1)
-  });
-  return calls;
 }
-async function fetchGithubActionsPullRequestHealth(args) {
-  const panel = pullRequestHealthPanelSchema.parse(args.panel);
+async function fetchGithubActionsUpdateWorkflow(args) {
+  const capabilities = pullRequestHealthCapabilities(args.panel);
+  const panel = capabilities.panel;
   const source = githubActionsSourceSchema.parse(args.source);
+  const configured = capabilities.configuredUpdateWorkflow(args.workflow);
+  if (!configured) throw new Error("Unconfigured update workflow");
+  return githubObservation(
+    args,
+    source,
+    githubRunsCall(source, configured.workflow, void 0, void 0, 100),
+    (value, observedAt4) => {
+      const run = runsSchema.parse(value).workflow_runs.find((candidate) => {
+        const branch = candidate.head_branch;
+        return typeof branch === "string" && configured.branch_prefixes.some((prefix) => branch.startsWith(prefix));
+      });
+      return {
+        panelId: panel.id,
+        state: "ok",
+        observedAt: observedAt4,
+        link: sourceLinkForRepository(source),
+        signal: {
+          type: "pull-request-workflow",
+          workflow: configured.workflow,
+          item: healthItem(configured.workflow, run, `Update workflow ${configured.workflow}`)
+        }
+      };
+    }
+  );
+}
+async function fetchGithubActionsPullRequestBuild(args) {
+  const capabilities = pullRequestHealthCapabilities(args.panel);
+  const panel = capabilities.panel;
+  const source = githubActionsSourceSchema.parse(args.source);
+  if (!capabilities.permitsBuildBranch(args.branch))
+    throw new Error("Unpermitted pull request branch");
+  return githubObservation(
+    args,
+    source,
+    githubRunsCall(source, panel.build_workflow, args.branch, "pull_request"),
+    (value, observedAt4) => {
+      const run = runsSchema.parse(value).workflow_runs[0];
+      return {
+        panelId: panel.id,
+        state: "ok",
+        observedAt: observedAt4,
+        link: sourceLinkForRepository(source),
+        signal: {
+          type: "pull-request-build",
+          branch: args.branch,
+          item: healthItem(args.branch, run, args.branch)
+        }
+      };
+    }
+  );
+}
+async function githubObservation(args, source, call, normalize) {
+  let upstream;
   try {
-    const workflowResults = await Promise.all(
-      panel.update_workflows.map(async ({ workflow, branch_prefixes }) => ({
-        workflow,
-        run: await latestRun({
-          source,
-          workflow,
-          branchPrefixes: branch_prefixes,
-          requestHeaders: args.requestHeaders,
-          fetcher: args.fetcher,
-          githubClient: githubClientFor(args)
-        })
-      }))
-    );
-    const pullRequests = await openPullRequests({
-      source,
-      baseBranch: panel.base_branch,
-      requestHeaders: args.requestHeaders,
-      fetcher: args.fetcher,
-      githubClient: githubClientFor(args)
-    });
-    const matching = pullRequests.filter(
-      (pullRequest) => panel.update_workflows.some(
-        ({ branch_prefixes }) => branch_prefixes.some((prefix) => pullRequest.head.ref.startsWith(prefix))
-      )
-    );
-    const pullRequestResults = await Promise.all(
-      matching.map(async (pullRequest) => ({
-        pullRequest,
-        run: await latestRun({
-          source,
-          workflow: panel.build_workflow,
-          branch: pullRequest.head.ref,
-          event: "pull_request",
-          requestHeaders: args.requestHeaders,
-          fetcher: args.fetcher,
-          githubClient: githubClientFor(args)
-        })
-      }))
-    );
-    const workflows = workflowResults.map(
-      ({ workflow, run }) => healthItem(workflow, run, `Update workflow ${workflow}`)
-    );
-    const pullRequestItems = pullRequestResults.map(
-      ({ pullRequest, run }) => healthItem(`PR #${pullRequest.number}`, run, pullRequest.head.ref, pullRequest.html_url)
-    );
-    const allItems = [...workflows, ...pullRequestItems];
-    const status = aggregateStatus(allItems.map((item) => item.status));
-    const summary = summarize(status, workflows, pullRequestItems);
-    const envelope = {
-      panelId: panel.id,
-      state: "ok",
-      observedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      link: sourceLinkForRepository(source),
-      signal: {
-        type: "pull-request-health",
-        status,
-        summary,
-        workflows,
-        pullRequests: pullRequestItems
-      }
-    };
-    return { envelope, response: new Response(null, { status: 200 }) };
+    upstream = await githubFetch(call, { ...args, source, githubClient: githubClientFor(args) });
   } catch (error52) {
     return {
       response: new Response(
         JSON.stringify(
-          errorEnvelope(
-            panel.id,
-            error52 instanceof GithubAuthenticationError ? "unauthorized" : "upstream-error",
+          errorEnvelope2(
+            args.panel.id,
+            error52 instanceof GithubAuthenticationError ? "unauthorized" : "unreachable",
             error52,
             sourceLinkForRepository(source)
           )
@@ -66717,34 +67071,42 @@ async function fetchGithubActionsPullRequestHealth(args) {
       )
     };
   }
-}
-async function latestRun(args) {
-  const call = githubRunsCall(
-    args.source,
-    args.workflow,
-    args.branch,
-    args.event,
-    args.branchPrefixes ? 100 : 1
-  );
-  const response = await githubFetch(call, args);
-  if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);
-  const runs = runsSchema.parse(await response.json()).workflow_runs;
-  const branchPrefixes = args.branchPrefixes;
-  if (!branchPrefixes) return runs[0];
-  return runs.find((run) => {
-    const headBranch = run.head_branch;
-    return headBranch !== void 0 && headBranch !== null && branchPrefixes.some((prefix) => headBranch.startsWith(prefix));
-  });
-}
-async function openPullRequests(args) {
-  const result = [];
-  for (let page = 1; ; page += 1) {
-    const call = pullRequestsCall(args.source, args.baseBranch, page);
-    const response = await githubFetch(call, args);
-    if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);
-    const pageResults = pullRequestsSchema.parse(await response.json());
-    result.push(...pageResults);
-    if (pageResults.length < 100) return result;
+  if (upstream.status === 304) return { response: upstream };
+  if (!upstream.ok)
+    return {
+      response: new Response(
+        JSON.stringify(
+          errorEnvelope2(
+            args.panel.id,
+            errorKind2(upstream.status),
+            `${upstream.status} ${upstream.statusText}`,
+            sourceLinkForRepository(source),
+            observedAt3(upstream.headers.get("date"))
+          )
+        ),
+        { status: 200 }
+      )
+    };
+  try {
+    return {
+      envelope: normalize(await upstream.json(), observedAt3(upstream.headers.get("date"))),
+      response: upstream
+    };
+  } catch (error52) {
+    return {
+      response: new Response(
+        JSON.stringify(
+          errorEnvelope2(
+            args.panel.id,
+            "upstream-error",
+            error52,
+            sourceLinkForRepository(source),
+            observedAt3(upstream.headers.get("date"))
+          )
+        ),
+        { status: 200 }
+      )
+    };
   }
 }
 function pullRequestsCall(source, baseBranch, page) {
@@ -66767,23 +67129,11 @@ function githubRunsCall(source, workflow, branch, event, perPage = 1) {
 function healthItem(label, run, detail, link) {
   return {
     label,
-    status: run ? normalizeStatus(run.status, run.conclusion) : "unknown",
+    status: run ? normalizeStatus2(run.status, run.conclusion) : "unknown",
     detail: run ? `${detail} \xB7 ${run.conclusion ?? run.status}` : `${detail} \xB7 No run found`,
     link: link ?? run?.html_url ?? null
   };
 }
-function aggregateStatus(statuses) {
-  if (statuses.some((status) => status === "failed")) return "failed";
-  if (statuses.some((status) => status === "running")) return "running";
-  if (statuses.some((status) => status === "unknown")) return "unknown";
-  if (statuses.some((status) => status === "cancelled")) return "cancelled";
-  return "passed";
-}
-function summarize(status, workflows, pullRequests) {
-  const failed = [...workflows, ...pullRequests].find((item) => item.status === status);
-  if (status !== "passed" && failed) return `${failed.label}: ${failed.detail}`;
-  return pullRequests.length === 0 ? `${workflows.length} update workflow${workflows.length === 1 ? "" : "s"} \xB7 No open update PRs` : `${workflows.length} update workflow${workflows.length === 1 ? "" : "s"} \xB7 ${pullRequests.length} open update PR${pullRequests.length === 1 ? "" : "s"}`;
-}
 function sourceLinkForRepository(source) {
   return `https://github.com/${source.repo}`;
 }
@@ -66803,11 +67153,11 @@ async function fetchGithubActionsPipeline(args) {
     return {
       response: new Response(
         JSON.stringify(
-          errorEnvelope(
+          errorEnvelope2(
             args.panel.id,
             error52 instanceof GithubAuthenticationError ? "unauthorized" : "unreachable",
             error52,
-            sourceLink(args.panel, args.source)
+            sourceLink2(args.panel, args.source)
           )
         ),
         { status: 200 }
@@ -66819,12 +67169,12 @@ async function fetchGithubActionsPipeline(args) {
     return {
       response: new Response(
         JSON.stringify(
-          errorEnvelope(
+          errorEnvelope2(
             args.panel.id,
-            errorKind(upstream.status),
+            errorKind2(upstream.status),
             `${upstream.status} ${upstream.statusText}`,
-            sourceLink(args.panel, args.source),
-            observedAt(upstream.headers.get("date"))
+            sourceLink2(args.panel, args.source),
+            observedAt3(upstream.headers.get("date"))
           )
         ),
         { status: 200 }
@@ -66838,12 +67188,12 @@ async function fetchGithubActionsPipeline(args) {
       return {
         response: new Response(
           JSON.stringify(
-            errorEnvelope(
+            errorEnvelope2(
               args.panel.id,
               "no-runs",
               parsedSource.branch ? `No workflow runs found for branch "${parsedSource.branch}". Check the source's branch setting.` : "No workflow runs found.",
-              sourceLink(args.panel, args.source),
-              observedAt(upstream.headers.get("date"))
+              sourceLink2(args.panel, args.source),
+              observedAt3(upstream.headers.get("date"))
             )
           ),
           { status: 200 }
@@ -66852,12 +67202,12 @@ async function fetchGithubActionsPipeline(args) {
     }
     const signal = {
       type: "pipeline-status",
-      status: normalizeStatus(run.status, run.conclusion),
+      status: normalizeStatus2(run.status, run.conclusion),
       rawStatus: run.conclusion ?? run.status,
       name: run.name,
       ...run.head_branch ?? parsedSource.branch ? { branch: run.head_branch ?? parsedSource.branch } : {},
-      ...timestamp(run.updated_at) ? { sourceUpdatedAt: timestamp(run.updated_at) } : {},
-      ...timestamp(run.run_started_at) ? { runStartedAt: timestamp(run.run_started_at) } : {},
+      ...timestamp2(run.updated_at) ? { sourceUpdatedAt: timestamp2(run.updated_at) } : {},
+      ...timestamp2(run.run_started_at) ? { runStartedAt: timestamp2(run.run_started_at) } : {},
       ...run.id !== void 0 ? { sourceRunId: String(run.id) } : {},
       ...run.status === "completed" ? completedRunDuration(run) : {}
     };
@@ -66874,7 +67224,7 @@ async function fetchGithubActionsPipeline(args) {
     const envelope = {
       panelId: args.panel.id,
       state: "ok",
-      observedAt: observedAt(upstream.headers.get("date")),
+      observedAt: observedAt3(upstream.headers.get("date")),
       link: run.html_url,
       signal
     };
@@ -66883,12 +67233,12 @@ async function fetchGithubActionsPipeline(args) {
     return {
       response: new Response(
         JSON.stringify(
-          errorEnvelope(
+          errorEnvelope2(
             args.panel.id,
             "upstream-error",
             error52,
-            sourceLink(args.panel, args.source),
-            observedAt(upstream.headers.get("date"))
+            sourceLink2(args.panel, args.source),
+            observedAt3(upstream.headers.get("date"))
           )
         ),
         { status: 200 }
@@ -66927,45 +67277,36 @@ function githubJobsCall(source, runId) {
   return { url: url2.toString(), headers: new Headers() };
 }
 function completedRunDuration(run) {
-  const startedAt = timestamp(run.run_started_at);
-  const updatedAt = timestamp(run.updated_at);
+  const startedAt = timestamp2(run.run_started_at);
+  const updatedAt = timestamp2(run.updated_at);
   if (!startedAt || !updatedAt) return {};
   const durationMs = new Date(updatedAt).valueOf() - new Date(startedAt).valueOf();
   return Number.isFinite(durationMs) && durationMs >= 0 ? { durationMs } : {};
 }
-function timestamp(value) {
+function timestamp2(value) {
   if (!value || !external_exports.iso.datetime().safeParse(value).success) return void 0;
   return Number.isFinite(new Date(value).valueOf()) ? value : void 0;
 }
-function normalizeStatus(status, conclusion) {
+function normalizeStatus2(status, conclusion) {
   if (status !== "completed") return "running";
   if (conclusion === "success") return "passed";
   if (conclusion === "failure" || conclusion === "timed_out") return "failed";
   if (conclusion === "cancelled") return "cancelled";
   return "unknown";
 }
-function errorKind(status) {
-  if (status === 401 || status === 403) return "unauthorized";
-  if (status === 404) return "not-found";
-  return "upstream-error";
+function errorKind2(status) {
+  return upstreamErrorKind(status);
 }
-function errorEnvelope(panelId, kind, error52, link, observedAt3 = (/* @__PURE__ */ new Date()).toISOString()) {
-  return {
-    panelId,
-    state: "error",
-    observedAt: observedAt3,
-    link,
-    error: { kind, message: error52 instanceof Error ? error52.message : String(error52) }
-  };
+function errorEnvelope2(panelId, kind, error52, link, observedAt4 = (/* @__PURE__ */ new Date()).toISOString()) {
+  return upstreamErrorEnvelope({ panelId, kind, error: error52, link, upstreamDate: observedAt4 });
 }
-function sourceLink(panel, source) {
-  const parsedPanel = pipelinePanelSchema.parse(panel);
+function sourceLink2(panel, source) {
+  const parsedPanel = pipelinePanelSchema2.parse(panel);
   const parsedSource = githubActionsSourceSchema.parse(source);
   return `https://github.com/${parsedSource.repo}/actions/workflows/${encodeURIComponent(parsedPanel.pipeline)}`;
 }
-function observedAt(value) {
-  const parsed = value ? new Date(value) : void 0;
-  return parsed && !Number.isNaN(parsed.valueOf()) ? parsed.toISOString() : (/* @__PURE__ */ new Date()).toISOString();
+function observedAt3(value) {
+  return observedAt(value);
 }
 
 // packages/server/src/adapters/http-value.ts
@@ -66988,22 +67329,21 @@ async function fetchHttpValue(args) {
   const panel = httpValuePanelSchema.parse(args.panel);
   const [call] = permittedHttpValueCalls(args.panel);
   if (!call) throw new Error("http-value adapter declared no permitted call");
-  for (const name of ["if-none-match", "if-modified-since"]) {
-    const value = args.requestHeaders.get(name);
-    if (value) call.headers.set(name, value);
-  }
+  forwardValidators(args.requestHeaders, call.headers);
   let upstream;
   try {
     upstream = await args.fetcher(call.url, { headers: call.headers });
   } catch (error52) {
-    return { response: errorResponse(errorEnvelope2(panel.id, "unreachable", error52, panel)) };
+    return { response: errorResponse2("unreachable", error52, panel) };
   }
   if (upstream.status === 304) return { response: upstream };
   if (!upstream.ok) {
-    const kind = upstream.status === 401 || upstream.status === 403 ? "unauthorized" : upstream.status === 404 ? "not-found" : "upstream-error";
     return {
-      response: errorResponse(
-        errorEnvelope2(panel.id, kind, `${upstream.status} ${upstream.statusText}`, panel, upstream)
+      response: errorResponse2(
+        upstreamErrorKind(upstream.status),
+        `${upstream.status} ${upstream.statusText}`,
+        panel,
+        upstream
       )
     };
   }
@@ -67015,7 +67355,7 @@ async function fetchHttpValue(args) {
       envelope: {
         panelId: panel.id,
         state: "ok",
-        observedAt: observedAt2(upstream.headers.get("date")),
+        observedAt: observedAt(upstream.headers.get("date")),
         link: panel.link ?? panel.url,
         signal
       },
@@ -67023,7 +67363,7 @@ async function fetchHttpValue(args) {
     };
   } catch (error52) {
     return {
-      response: errorResponse(errorEnvelope2(panel.id, "upstream-error", error52, panel, upstream))
+      response: errorResponse2("upstream-error", error52, panel, upstream)
     };
   }
 }
@@ -67050,21 +67390,16 @@ function extractJsonPath(value, path) {
   }
   return current;
 }
-function errorResponse(envelope) {
-  return new Response(JSON.stringify(envelope), { status: 200 });
-}
-function errorEnvelope2(panelId, kind, error52, panel, response) {
-  return {
-    panelId,
-    state: "error",
-    observedAt: observedAt2(response?.headers.get("date") ?? null),
-    link: panel.link ?? panel.url,
-    error: { kind, message: error52 instanceof Error ? error52.message : String(error52) }
-  };
-}
-function observedAt2(value) {
-  const parsed = value ? new Date(value) : void 0;
-  return parsed && !Number.isNaN(parsed.valueOf()) ? parsed.toISOString() : (/* @__PURE__ */ new Date()).toISOString();
+function errorResponse2(kind, error52, panel, response) {
+  return upstreamErrorResponse(
+    upstreamErrorEnvelope({
+      panelId: panel.id,
+      kind,
+      error: error52,
+      link: panel.link ?? panel.url,
+      upstreamDate: response?.headers.get("date")
+    })
+  );
 }
 
 // packages/server/src/allowlist.ts
@@ -67074,17 +67409,26 @@ function deriveAllowlist(config2) {
     for (const panel of board.panels) {
       const source = panel.source ? config2.sources[panel.source] : void 0;
       const calls = callsFor(panel, source);
-      if (calls) allowed.set(`${boardName}/${panel.id}`, calls);
+      if (calls) allowed.set(`${boardName}/${panel.id}`, /* @__PURE__ */ new Set(["read"]));
+      if (panel.type === "pull-request-health" && source?.type === "github-actions") {
+        allowed.set(
+          `${boardName}/${panel.id}`,
+          /* @__PURE__ */ new Set(["pull-requests", "update-workflow", "pull-request-build"])
+        );
+      }
     }
   }
   return allowed;
 }
+function permitsPanelOperation(allowlist, board, panel, operation2) {
+  return allowlist.get(`${board}/${panel}`)?.has(operation2) ?? false;
+}
 function callsFor(panel, source) {
   if (panel.type === "pipeline-status" && source?.type === "github-actions") {
     return permittedGithubActionsCalls(panel, source);
   }
-  if (panel.type === "pull-request-health" && source?.type === "github-actions") {
-    return permittedGithubActionsPullRequestHealthCalls(panel, source);
+  if (panel.type === "pipeline-status" && source?.type === "azure-devops") {
+    return permittedAzureDevOpsCalls(panel, source);
   }
   if (panel.type === "http-value") return permittedHttpValueCalls(panel);
   return void 0;
@@ -67169,7 +67513,6 @@ function serializeForScriptTag(value) {
 function createApp(deps) {
   const { config: config2 } = deps;
   const templates = new TemplateCache(deps.fetcher ?? globalThis.fetch);
-  const clientVersion = deps.clientVersion ?? deriveVersionLabel(config2.assetPath);
   const selectedBoard = config2.board ?? Object.keys(deps.boardConfig?.boards ?? {})[0] ?? "ze-great-team";
   const allowlist = deps.boardConfig ? deriveAllowlist(deps.boardConfig) : /* @__PURE__ */ new Map();
   const credentials = deps.credentials ?? environmentCredentials();
@@ -67178,7 +67521,7 @@ function createApp(deps) {
   app.get("/health", (c5) => c5.json({ status: "ok" }));
   app.use("/api/*", async (_c5, next) => next());
   app.get(`${config2.proxyPath}/client`, (c5) => {
-    const identity = { assetPath: config2.assetPath, clientVersion };
+    const identity = { assetPath: config2.assetPath };
     return c5.json(identity, 200, { "cache-control": "no-store" });
   });
   app.get("/", (c5) => renderEntrypoint(c5.req.raw, selectedBoard));
@@ -67236,7 +67579,7 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
     const board = deps.boardConfig?.boards[boardName];
     const panel = board?.panels.find((candidate) => candidate.id === panelId);
     const source = panel?.source ? deps.boardConfig?.sources[panel.source] : void 0;
-    if (!panel || panel.type !== "http-value" && !source || !allowlist.has(`${boardName}/${panelId}`))
+    if (!panel || panel.type !== "http-value" && !source || !permitsPanelOperation(allowlist, boardName, panelId, "read"))
       return c5.notFound();
     if (panel.type === "pipeline-status" && source?.type === "github-actions" && source) {
       const result = await fetchGithubActionsPipeline({
@@ -67246,46 +67589,93 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
         fetcher: deps.fetcher ?? globalThis.fetch,
         githubClient
       });
-      const headers = passthroughHeaders(result.response.headers);
-      if (result.response.status === 304) return new Response(null, { status: 304, headers });
-      const envelope = result.envelope ?? JSON.parse(await result.response.text());
-      headers.set("content-type", "application/json; charset=utf-8");
-      return new Response(JSON.stringify(envelope), { status: 200, headers });
-    }
-    if (panel.type === "pull-request-health" && source?.type === "github-actions" && source) {
-      const result = await fetchGithubActionsPullRequestHealth({
+      return adapterRouteResponse(result);
+    }
+    if (panel.type === "pipeline-status" && source?.type === "azure-devops" && source) {
+      const result = await fetchAzureDevOpsPipeline({
         panel,
         source,
         requestHeaders: c5.req.raw.headers,
         fetcher: deps.fetcher ?? globalThis.fetch,
-        githubClient
+        credentials
       });
-      const headers = passthroughHeaders(result.response.headers);
-      const envelope = result.envelope ?? JSON.parse(await result.response.text());
-      headers.set("content-type", "application/json; charset=utf-8");
-      return new Response(JSON.stringify(envelope), { status: 200, headers });
+      return adapterRouteResponse(result);
     }
+    if (panel.type === "pull-request-health") return c5.notFound();
     if (panel.type === "http-value") {
       const result = await fetchHttpValue({
         panel,
         requestHeaders: c5.req.raw.headers,
         fetcher: deps.fetcher ?? globalThis.fetch
       });
-      const headers = passthroughHeaders(result.response.headers);
-      if (result.response.status === 304) return new Response(null, { status: 304, headers });
-      const envelope = result.envelope ?? JSON.parse(await result.response.text());
-      headers.set("content-type", "application/json; charset=utf-8");
-      return new Response(JSON.stringify(envelope), { status: 200, headers });
+      return adapterRouteResponse(result);
     }
     return c5.notFound();
   });
+  app.get("/api/panel/:board/:panelId/pull-requests", async (c5) => {
+    const resolved = pullRequestPanel(c5.req.param("board"), c5.req.param("panelId"), "pull-requests");
+    if (!resolved) return c5.notFound();
+    return adapterRouteResponse(
+      await fetchGithubActionsPullRequestCandidates({
+        ...resolved,
+        requestHeaders: c5.req.raw.headers,
+        fetcher: deps.fetcher ?? globalThis.fetch,
+        githubClient
+      })
+    );
+  });
+  app.get("/api/panel/:board/:panelId/update-workflow/:workflow", async (c5) => {
+    const resolved = pullRequestPanel(
+      c5.req.param("board"),
+      c5.req.param("panelId"),
+      "update-workflow"
+    );
+    const workflow = c5.req.param("workflow");
+    if (!resolved?.capabilities.configuredUpdateWorkflow(workflow)) return c5.notFound();
+    return adapterRouteResponse(
+      await fetchGithubActionsUpdateWorkflow({
+        ...resolved,
+        workflow,
+        requestHeaders: c5.req.raw.headers,
+        fetcher: deps.fetcher ?? globalThis.fetch,
+        githubClient
+      })
+    );
+  });
+  app.get("/api/panel/:board/:panelId/pull-request-build", async (c5) => {
+    const resolved = pullRequestPanel(
+      c5.req.param("board"),
+      c5.req.param("panelId"),
+      "pull-request-build"
+    );
+    const branch = c5.req.query("branch");
+    if (!resolved || !branch || !resolved.capabilities.permitsBuildBranch(branch))
+      return c5.notFound();
+    return adapterRouteResponse(
+      await fetchGithubActionsPullRequestBuild({
+        ...resolved,
+        branch,
+        requestHeaders: c5.req.raw.headers,
+        fetcher: deps.fetcher ?? globalThis.fetch,
+        githubClient
+      })
+    );
+  });
+  function pullRequestPanel(boardName, panelId, operation2) {
+    const panel = deps.boardConfig?.boards[boardName]?.panels.find(
+      (candidate) => candidate.id === panelId
+    );
+    const source = panel?.source ? deps.boardConfig?.sources[panel.source] : void 0;
+    const capabilities = panel?.type === "pull-request-health" ? pullRequestHealthCapabilities(panel) : void 0;
+    if (!capabilities) return void 0;
+    return panel?.type === "pull-request-health" && source?.type === "github-actions" && permitsPanelOperation(allowlist, boardName, panelId, operation2) ? { panel, source, capabilities } : void 0;
+  }
   async function renderEntrypoint(_request, board) {
     const template = await templates.get(config2.assetPath);
     const env2 = {
       assetPath: config2.assetPath,
       proxyPath: config2.proxyPath,
-      board,
-      clientVersion
+      board
     };
     return new Response(renderIndexHtml(template, env2), {
       headers: {
@@ -67302,20 +67692,6 @@ function safeDownloadFilename(value) {
   const sanitized = value.replace(/[\\/\r\n"%*:|<>?]/g, "_").trim();
   return sanitized || "board";
 }
-function passthroughHeaders(upstream) {
-  const headers = new Headers();
-  for (const name of ["cache-control", "etag", "last-modified", "date", "vary"]) {
-    const value = upstream.get(name);
-    if (value) headers.set(name, value);
-  }
-  return headers;
-}
-function deriveVersionLabel(assetPath) {
-  const segments = assetPath.split("/").filter((segment) => segment !== "");
-  const last = segments.at(-1);
-  if (last === void 0) return "unknown";
-  return last === ASSET_PATH_SENTINEL.replace("/", "") ? "dev" : last;
-}
 
 // packages/server/src/board-config.ts
 import { readFile as readFile3 } from "node:fs/promises";