@continuous-excellence/ze-great-dashboard-aws 0.21.0 → 0.22.0

package/dist/lambda.mjs

@@ -66462,6 +66462,20 @@ var Hono2 = class extends Hono {
 var import_yaml = __toESM(require_dist(), 1);
 
 // packages/server/src/upstream.ts
+function publicErrorMessage(kind) {
+  switch (kind) {
+    case "unreachable":
+      return "The source could not be reached. Check its address and network connectivity.";
+    case "unauthorized":
+      return "The dashboard is not authorized to read this source. Check the configured access.";
+    case "not-found":
+      return "The configured source was not found. Check the board configuration.";
+    case "no-runs":
+      return "No matching workflow runs were found. Check the configured workflow and branch.";
+    case "upstream-error":
+      return "The source returned an unreadable response. Check the source service and configuration.";
+  }
+}
 function forwardValidators(requestHeaders, upstreamHeaders) {
   for (const name of ["if-none-match", "if-modified-since"]) {
     const value = requestHeaders.get(name);
@@ -66477,13 +66491,26 @@ function upstreamErrorEnvelope(args) {
     panelId: args.panelId,
     state: "error",
     observedAt: observedAt(args.upstreamDate),
-    link: args.link,
+    link: publicLink(args.link),
     error: {
       kind: args.kind,
-      message: args.error instanceof Error ? args.error.message : String(args.error)
+      // Raw failures regularly contain URLs, query values, response fragments, or credentials.
+      // The specific evidence stays server-side; the browser gets this fixed actionable vocabulary.
+      message: publicErrorMessage(args.kind)
     }
   };
 }
+function publicLink(value) {
+  if (!value) return null;
+  try {
+    const url2 = new URL(value);
+    url2.search = "";
+    url2.hash = "";
+    return url2.toString();
+  } catch {
+    return null;
+  }
+}
 function upstreamErrorResponse(envelope) {
   return new Response(JSON.stringify(envelope), { status: 200 });
 }
@@ -66494,10 +66521,15 @@ function upstreamErrorKind(status) {
 }
 async function adapterRouteResponse(result) {
   const headers = passthroughHeaders(result.response.headers);
-  if (result.response.status === 304) return new Response(null, { status: 304, headers });
+  if (result.response.status === 304)
+    return { response: new Response(null, { status: 304, headers }) };
   const envelope = result.envelope ?? JSON.parse(await result.response.text());
   headers.set("content-type", "application/json; charset=utf-8");
-  return new Response(JSON.stringify(envelope), { status: 200, headers });
+  return { response: new Response(JSON.stringify(envelope), { status: 200, headers }), envelope };
+}
+function safeNetworkCode(error52) {
+  const code = error52 && typeof error52 === "object" ? error52.code : void 0;
+  return code === "ECONNREFUSED" || code === "ENOTFOUND" || code === "ETIMEDOUT" || code === "EAI_AGAIN" ? code : void 0;
 }
 function passthroughHeaders(upstream) {
   const headers = new Headers();
@@ -66555,7 +66587,8 @@ async function fetchAzureDevOpsPipeline(args) {
           `Credential ${source.token_env} is not available.`,
           sourceLink(panel.pipeline, source)
         )
-      )
+      ),
+      failure: { kind: "unauthorized" }
     };
   }
   const call = buildsCall(panel.pipeline, source);
@@ -66568,7 +66601,11 @@ async function fetchAzureDevOpsPipeline(args) {
     return {
       response: errorResponse(
         errorEnvelope(panel.id, "unreachable", error52, sourceLink(panel.pipeline, source))
-      )
+      ),
+      failure: {
+        kind: "unreachable",
+        ...safeNetworkCode(error52) ? { networkCode: safeNetworkCode(error52) } : {}
+      }
     };
   }
   if (upstream.status === 304) return { response: upstream };
@@ -66582,7 +66619,8 @@ async function fetchAzureDevOpsPipeline(args) {
           sourceLink(panel.pipeline, source),
           observedAt2(upstream.headers.get("date"))
         )
-      )
+      ),
+      failure: { kind: errorKind(upstream.status), upstreamStatus: upstream.status }
     };
   }
   try {
@@ -66597,7 +66635,8 @@ async function fetchAzureDevOpsPipeline(args) {
             sourceLink(panel.pipeline, source),
             observedAt2(upstream.headers.get("date"))
           )
-        )
+        ),
+        failure: { kind: "no-runs", upstreamStatus: upstream.status }
       };
     }
     const signal = {
@@ -66640,7 +66679,8 @@ async function fetchAzureDevOpsPipeline(args) {
           sourceLink(panel.pipeline, source),
           observedAt2(upstream.headers.get("date"))
         )
-      )
+      ),
+      failure: { kind: "upstream-error", upstreamStatus: upstream.status }
     };
   }
 }
@@ -67068,7 +67108,11 @@ async function githubObservation(args, source, call, normalize) {
           )
         ),
         { status: 200 }
-      )
+      ),
+      failure: {
+        kind: error52 instanceof GithubAuthenticationError ? "unauthorized" : "unreachable",
+        ...safeNetworkCode(error52) ? { networkCode: safeNetworkCode(error52) } : {}
+      }
     };
   }
   if (upstream.status === 304) return { response: upstream };
@@ -67085,7 +67129,8 @@ async function githubObservation(args, source, call, normalize) {
           )
         ),
         { status: 200 }
-      )
+      ),
+      failure: { kind: errorKind2(upstream.status), upstreamStatus: upstream.status }
     };
   try {
     return {
@@ -67105,7 +67150,8 @@ async function githubObservation(args, source, call, normalize) {
           )
         ),
         { status: 200 }
-      )
+      ),
+      failure: { kind: "upstream-error", upstreamStatus: upstream.status }
     };
   }
 }
@@ -67161,7 +67207,11 @@ async function fetchGithubActionsPipeline(args) {
           )
         ),
         { status: 200 }
-      )
+      ),
+      failure: {
+        kind: error52 instanceof GithubAuthenticationError ? "unauthorized" : "unreachable",
+        ...safeNetworkCode(error52) ? { networkCode: safeNetworkCode(error52) } : {}
+      }
     };
   }
   if (upstream.status === 304) return { response: upstream };
@@ -67178,7 +67228,8 @@ async function fetchGithubActionsPipeline(args) {
           )
         ),
         { status: 200 }
-      )
+      ),
+      failure: { kind: errorKind2(upstream.status), upstreamStatus: upstream.status }
     };
   }
   try {
@@ -67197,7 +67248,8 @@ async function fetchGithubActionsPipeline(args) {
             )
           ),
           { status: 200 }
-        )
+        ),
+        failure: { kind: "no-runs", upstreamStatus: upstream.status }
       };
     }
     const signal = {
@@ -67242,7 +67294,8 @@ async function fetchGithubActionsPipeline(args) {
           )
         ),
         { status: 200 }
-      )
+      ),
+      failure: { kind: "upstream-error", upstreamStatus: upstream.status }
     };
   }
 }
@@ -67334,7 +67387,13 @@ async function fetchHttpValue(args) {
   try {
     upstream = await args.fetcher(call.url, { headers: call.headers });
   } catch (error52) {
-    return { response: errorResponse2("unreachable", error52, panel) };
+    return {
+      response: errorResponse2("unreachable", error52, panel),
+      failure: {
+        kind: "unreachable",
+        ...safeNetworkCode(error52) ? { networkCode: safeNetworkCode(error52) } : {}
+      }
+    };
   }
   if (upstream.status === 304) return { response: upstream };
   if (!upstream.ok) {
@@ -67344,7 +67403,8 @@ async function fetchHttpValue(args) {
         `${upstream.status} ${upstream.statusText}`,
         panel,
         upstream
-      )
+      ),
+      failure: { kind: upstreamErrorKind(upstream.status), upstreamStatus: upstream.status }
     };
   }
   try {
@@ -67356,14 +67416,15 @@ async function fetchHttpValue(args) {
         panelId: panel.id,
         state: "ok",
         observedAt: observedAt(upstream.headers.get("date")),
-        link: panel.link ?? panel.url,
+        link: publicLink(panel.link ?? panel.url),
         signal
       },
       response: upstream
     };
   } catch (error52) {
     return {
-      response: errorResponse2("upstream-error", error52, panel, upstream)
+      response: errorResponse2("upstream-error", error52, panel, upstream),
+      failure: { kind: "upstream-error", upstreamStatus: upstream.status }
     };
   }
 }
@@ -67434,6 +67495,24 @@ function callsFor(panel, source) {
   return void 0;
 }
 
+// packages/server/src/logger.ts
+var consoleLogger = {
+  log(event) {
+    console.log(JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), ...event }));
+  }
+};
+function requestId() {
+  return crypto.randomUUID();
+}
+function destinationOrigin(value) {
+  if (!value) return void 0;
+  try {
+    return new URL(value).origin;
+  } catch {
+    return void 0;
+  }
+}
+
 // packages/server/src/template.ts
 var ASSET_PATH_SENTINEL = "/__ASSET_PATH__";
 var TemplateFetchError = class extends Error {
@@ -67517,9 +67596,28 @@ function createApp(deps) {
   const allowlist = deps.boardConfig ? deriveAllowlist(deps.boardConfig) : /* @__PURE__ */ new Map();
   const credentials = deps.credentials ?? environmentCredentials();
   const githubClient = createGithubClient(credentials);
+  const logger2 = deps.logger ?? consoleLogger;
   const app = new Hono2();
+  app.use("/api/*", async (c5, next) => {
+    const id = requestId();
+    c5.set("dashboardRequestId", id);
+    await next();
+    c5.header("x-dashboard-request-id", id);
+  });
+  app.onError((_error, c5) => {
+    const id = c5.get("dashboardRequestId");
+    logger2.log({
+      event: "server.unhandled_exception",
+      ...id ? { requestId: id } : {},
+      operation: "route-handler"
+    });
+    return c5.json(
+      { error: "The dashboard could not complete this request." },
+      500,
+      id ? { "x-dashboard-request-id": id } : void 0
+    );
+  });
   app.get("/health", (c5) => c5.json({ status: "ok" }));
-  app.use("/api/*", async (_c5, next) => next());
   app.get(`${config2.proxyPath}/client`, (c5) => {
     const identity = { assetPath: config2.assetPath };
     return c5.json(identity, 200, { "cache-control": "no-store" });
@@ -67580,48 +67678,82 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
     const panel = board?.panels.find((candidate) => candidate.id === panelId);
     const source = panel?.source ? deps.boardConfig?.sources[panel.source] : void 0;
     if (!panel || panel.type !== "http-value" && !source || !permitsPanelOperation(allowlist, boardName, panelId, "read"))
-      return c5.notFound();
+      return rejected(c5, { boardId: boardName, panelId, operation: "read" });
     if (panel.type === "pipeline-status" && source?.type === "github-actions" && source) {
-      const result = await fetchGithubActionsPipeline({
+      const result = fetchGithubActionsPipeline({
         panel,
         source,
         requestHeaders: c5.req.raw.headers,
         fetcher: deps.fetcher ?? globalThis.fetch,
         githubClient
       });
-      return adapterRouteResponse(result);
+      return observation(c5, result, {
+        boardId: boardName,
+        panelId,
+        operation: "read",
+        sourceName: panel.source,
+        sourceType: source.type,
+        destination: "https://api.github.com"
+      });
     }
     if (panel.type === "pipeline-status" && source?.type === "azure-devops" && source) {
-      const result = await fetchAzureDevOpsPipeline({
+      const result = fetchAzureDevOpsPipeline({
         panel,
         source,
         requestHeaders: c5.req.raw.headers,
         fetcher: deps.fetcher ?? globalThis.fetch,
         credentials
       });
-      return adapterRouteResponse(result);
+      return observation(c5, result, {
+        boardId: boardName,
+        panelId,
+        operation: "read",
+        sourceName: panel.source,
+        sourceType: source.type,
+        destination: "https://dev.azure.com"
+      });
     }
-    if (panel.type === "pull-request-health") return c5.notFound();
+    if (panel.type === "pull-request-health")
+      return rejected(c5, { boardId: boardName, panelId, operation: "read" });
     if (panel.type === "http-value") {
-      const result = await fetchHttpValue({
+      const result = fetchHttpValue({
         panel,
         requestHeaders: c5.req.raw.headers,
         fetcher: deps.fetcher ?? globalThis.fetch
       });
-      return adapterRouteResponse(result);
+      return observation(c5, result, {
+        boardId: boardName,
+        panelId,
+        operation: "read",
+        destination: panel.url
+      });
     }
     return c5.notFound();
   });
   app.get("/api/panel/:board/:panelId/pull-requests", async (c5) => {
     const resolved = pullRequestPanel(c5.req.param("board"), c5.req.param("panelId"), "pull-requests");
-    if (!resolved) return c5.notFound();
-    return adapterRouteResponse(
-      await fetchGithubActionsPullRequestCandidates({
+    if (!resolved)
+      return rejected(c5, {
+        boardId: c5.req.param("board"),
+        panelId: c5.req.param("panelId"),
+        operation: "pull-requests"
+      });
+    return observation(
+      c5,
+      fetchGithubActionsPullRequestCandidates({
         ...resolved,
         requestHeaders: c5.req.raw.headers,
         fetcher: deps.fetcher ?? globalThis.fetch,
         githubClient
-      })
+      }),
+      {
+        boardId: c5.req.param("board"),
+        panelId: c5.req.param("panelId"),
+        operation: "pull-requests",
+        sourceName: resolved.panel.source,
+        sourceType: resolved.source.type,
+        destination: "https://api.github.com"
+      }
     );
   });
   app.get("/api/panel/:board/:panelId/update-workflow/:workflow", async (c5) => {
@@ -67631,15 +67763,29 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
       "update-workflow"
     );
     const workflow = c5.req.param("workflow");
-    if (!resolved?.capabilities.configuredUpdateWorkflow(workflow)) return c5.notFound();
-    return adapterRouteResponse(
-      await fetchGithubActionsUpdateWorkflow({
+    if (!resolved?.capabilities.configuredUpdateWorkflow(workflow))
+      return rejected(c5, {
+        boardId: c5.req.param("board"),
+        panelId: c5.req.param("panelId"),
+        operation: "update-workflow"
+      });
+    return observation(
+      c5,
+      fetchGithubActionsUpdateWorkflow({
         ...resolved,
         workflow,
         requestHeaders: c5.req.raw.headers,
         fetcher: deps.fetcher ?? globalThis.fetch,
         githubClient
-      })
+      }),
+      {
+        boardId: c5.req.param("board"),
+        panelId: c5.req.param("panelId"),
+        operation: "update-workflow",
+        sourceName: resolved.panel.source,
+        sourceType: resolved.source.type,
+        destination: "https://api.github.com"
+      }
     );
   });
   app.get("/api/panel/:board/:panelId/pull-request-build", async (c5) => {
@@ -67650,15 +67796,28 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
     );
     const branch = c5.req.query("branch");
     if (!resolved || !branch || !resolved.capabilities.permitsBuildBranch(branch))
-      return c5.notFound();
-    return adapterRouteResponse(
-      await fetchGithubActionsPullRequestBuild({
+      return rejected(c5, {
+        boardId: c5.req.param("board"),
+        panelId: c5.req.param("panelId"),
+        operation: "pull-request-build"
+      });
+    return observation(
+      c5,
+      fetchGithubActionsPullRequestBuild({
         ...resolved,
         branch,
         requestHeaders: c5.req.raw.headers,
         fetcher: deps.fetcher ?? globalThis.fetch,
         githubClient
-      })
+      }),
+      {
+        boardId: c5.req.param("board"),
+        panelId: c5.req.param("panelId"),
+        operation: "pull-request-build",
+        sourceName: resolved.panel.source,
+        sourceType: resolved.source.type,
+        destination: "https://api.github.com"
+      }
     );
   });
   function pullRequestPanel(boardName, panelId, operation2) {
@@ -67670,6 +67829,38 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
     if (!capabilities) return void 0;
     return panel?.type === "pull-request-health" && source?.type === "github-actions" && permitsPanelOperation(allowlist, boardName, panelId, operation2) ? { panel, source, capabilities } : void 0;
   }
+  function rejected(c5, context) {
+    logger2.log({
+      event: "api.operation_rejected",
+      requestId: c5.get("dashboardRequestId"),
+      boardId: context.boardId,
+      panelId: context.panelId,
+      operation: context.operation
+    });
+    return c5.notFound();
+  }
+  async function observation(c5, result, context) {
+    const started = performance.now();
+    const resolved = await result;
+    const adapted = await adapterRouteResponse(resolved);
+    if (adapted.envelope?.state === "error") {
+      logger2.log({
+        event: "panel.observation_failed",
+        requestId: c5.get("dashboardRequestId"),
+        boardId: context.boardId,
+        panelId: context.panelId,
+        operation: context.operation,
+        errorKind: adapted.envelope.error.kind,
+        elapsedMs: Math.round(performance.now() - started),
+        ...context.sourceName ? { sourceName: context.sourceName } : {},
+        ...context.sourceType ? { sourceType: context.sourceType } : {},
+        ...destinationOrigin(context.destination) ? { destinationOrigin: destinationOrigin(context.destination) } : {},
+        ...resolved.failure?.upstreamStatus ? { upstreamStatus: resolved.failure.upstreamStatus } : {},
+        ...resolved.failure?.networkCode ? { networkCode: resolved.failure.networkCode } : {}
+      });
+    }
+    return adapted.response;
+  }
   async function renderEntrypoint(_request, board) {
     const template = await templates.get(config2.assetPath);
     const env2 = {
@@ -67777,28 +67968,35 @@ function isLocalHost(host) {
 
 // packages/server/src/startup.ts
 async function startup(options = {}) {
-  const config2 = loadConfig2();
-  const fetcher = options.fetcher ?? globalThis.fetch;
-  const [, boardConfig] = await Promise.all([
-    waitForTemplate(config2, fetcher),
-    loadBoardConfig(
-      config2.boardConfigUrl,
-      fetcher,
-      config2.assetPath.includes("__ASSET_PATH__") ? void 0 : schemaUrlForAssetPath(config2.assetPath)
-    )
-  ]);
-  const board = selectBoard(config2.board, boardConfig);
-  const resolvedConfig = { ...config2, board };
-  const credentialNames = Object.values(boardConfig.sources).flatMap(credentialEnvironmentNames);
-  const credentials = await createCredentialResolver({
-    secretReference: config2.secretReference,
-    credentialNames
-  });
-  warnAboutMissingAuth(resolvedConfig);
-  return {
-    app: createApp({ config: resolvedConfig, fetcher, boardConfig, credentials }),
-    config: resolvedConfig
-  };
+  const logger2 = options.logger ?? consoleLogger;
+  logger2.log({ event: "server.starting" });
+  try {
+    const config2 = loadConfig2();
+    const fetcher = options.fetcher ?? globalThis.fetch;
+    const [, boardConfig] = await Promise.all([
+      waitForTemplate(config2, fetcher),
+      loadBoardConfig(
+        config2.boardConfigUrl,
+        fetcher,
+        config2.assetPath.includes("__ASSET_PATH__") ? void 0 : schemaUrlForAssetPath(config2.assetPath)
+      )
+    ]);
+    const board = selectBoard(config2.board, boardConfig);
+    const resolvedConfig = { ...config2, board };
+    const credentialNames = Object.values(boardConfig.sources).flatMap(credentialEnvironmentNames);
+    const credentials = await createCredentialResolver({
+      secretReference: config2.secretReference,
+      credentialNames
+    });
+    warnAboutMissingAuth(resolvedConfig, logger2);
+    return {
+      app: createApp({ config: resolvedConfig, fetcher, boardConfig, credentials, logger: logger2 }),
+      config: resolvedConfig
+    };
+  } catch (error52) {
+    logger2.log({ event: "server.startup_failed", category: startupFailureCategory(error52) });
+    throw error52;
+  }
 }
 function selectBoard(requested, config2) {
   if (requested) {
@@ -67833,14 +68031,17 @@ async function waitForTemplate(config2, fetcher) {
   }
 }
 var RETRY_INTERVAL_MILLIS = 250;
-function warnAboutMissingAuth(config2) {
+function warnAboutMissingAuth(config2, logger2) {
   if (isLocalHost(config2.host)) return;
-  console.warn(
-    `
-  \u26A0\uFE0F  No auth configured. This instance is accessible to anyone who can reach it.
-     Bound to ${config2.host}:${config2.port}, which is not localhost.
-`
-  );
+  logger2.log({ event: "server.no_auth_warning", host: config2.host, port: config2.port });
+}
+function startupFailureCategory(error52) {
+  const message = error52 instanceof Error ? error52.message : "";
+  if (message.includes("server configuration")) return "configuration";
+  if (message.includes("ASSET_PATH") || message.includes("<head>")) return "template";
+  if (message.includes("board") || message.includes("Board")) return "board-config";
+  if (message.includes("credential") || message.includes("secret")) return "credentials";
+  return "unknown";
 }
 
 // packages/server/src/lambda.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@continuous-excellence/ze-great-dashboard-aws",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "type": "module",
   "description": "AWS server runtime and CloudFormation deployment tooling for Ze Great Dashboard.",
   "keywords": [