@continuous-excellence/ze-great-dashboard-aws 0.24.2 → 0.25.0

package/dist/cli.js

@@ -303,6 +303,8 @@ import { z as z3 } from "zod";
 var clientEnvSchema = z3.object({
   /** Where the immutable client assets live. The one variable that repoints the whole client. */
   assetPath: z3.string().min(1),
+  /** Opaque SHA-256 fingerprint of the canonical asset path, for diagnostic correlation only. */
+  assetPathId: z3.string().regex(/^sha256:[a-f0-9]{64}$/),
   /** Same-origin path the proxy is mounted at, so there is no CORS and no cookie problem. */
   proxyPath: z3.string().min(1),
   /** Which board this is, resolved server-side so the client parses no URLs. */
@@ -313,7 +315,7 @@ var clientEnvSchema = z3.object({
     clientId: z3.string().min(1).optional()
   }).optional()
 });
-var clientIdentitySchema = clientEnvSchema.pick({ assetPath: true });
+var clientIdentityResponseSchema = clientEnvSchema.pick({ assetPath: true, assetPathId: true }).extend({ serverVersion: z3.string().min(1) });
 
 // packages/shared/src/envelope.ts
 import { z as z4 } from "zod";

package/dist/index.js

@@ -984,6 +984,8 @@ import { z as z3 } from "zod";
 var clientEnvSchema = z3.object({
   /** Where the immutable client assets live. The one variable that repoints the whole client. */
   assetPath: z3.string().min(1),
+  /** Opaque SHA-256 fingerprint of the canonical asset path, for diagnostic correlation only. */
+  assetPathId: z3.string().regex(/^sha256:[a-f0-9]{64}$/),
   /** Same-origin path the proxy is mounted at, so there is no CORS and no cookie problem. */
   proxyPath: z3.string().min(1),
   /** Which board this is, resolved server-side so the client parses no URLs. */
@@ -994,7 +996,7 @@ var clientEnvSchema = z3.object({
     clientId: z3.string().min(1).optional()
   }).optional()
 });
-var clientIdentitySchema = clientEnvSchema.pick({ assetPath: true });
+var clientIdentityResponseSchema = clientEnvSchema.pick({ assetPath: true, assetPathId: true }).extend({ serverVersion: z3.string().min(1) });
 
 // packages/shared/src/envelope.ts
 import { z as z4 } from "zod";

package/dist/lambda.mjs

@@ -25202,7 +25202,7 @@ var require_dist_cjs11 = __commonJS({
     var { setCredentialFeature: setCredentialFeature2 } = (init_client3(), __toCommonJS(client_exports2));
     var { CredentialsProviderError: CredentialsProviderError2, parseKnownFiles: parseKnownFiles2, getProfileName: getProfileName2 } = (init_config2(), __toCommonJS(config_exports));
     var { HttpRequest: HttpRequest2 } = (init_protocols(), __toCommonJS(protocols_exports));
-    var { createHash: createHash5, createPrivateKey, createPublicKey, sign: sign2 } = __require("node:crypto");
+    var { createHash: createHash6, createPrivateKey, createPublicKey, sign: sign2 } = __require("node:crypto");
     var { promises } = __require("node:fs");
     var { homedir: homedir2 } = __require("node:os");
     var { dirname, join: join5 } = __require("node:path");
@@ -25371,7 +25371,7 @@ var require_dist_cjs11 = __commonJS({
       getTokenFilePath() {
         const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join5(homedir2(), ".aws", "login", "cache");
         const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
-        const loginSessionSha256 = createHash5("sha256").update(loginSessionBytes).digest("hex");
+        const loginSessionSha256 = createHash6("sha256").update(loginSessionBytes).digest("hex");
         return join5(directory, `${loginSessionSha256}.json`);
       }
       derToRawSignature(derSignature) {
@@ -68552,6 +68552,8 @@ function boardSchemaModeline(url2) {
 var clientEnvSchema = external_exports.object({
   /** Where the immutable client assets live. The one variable that repoints the whole client. */
   assetPath: external_exports.string().min(1),
+  /** Opaque SHA-256 fingerprint of the canonical asset path, for diagnostic correlation only. */
+  assetPathId: external_exports.string().regex(/^sha256:[a-f0-9]{64}$/),
   /** Same-origin path the proxy is mounted at, so there is no CORS and no cookie problem. */
   proxyPath: external_exports.string().min(1),
   /** Which board this is, resolved server-side so the client parses no URLs. */
@@ -68562,7 +68564,7 @@ var clientEnvSchema = external_exports.object({
     clientId: external_exports.string().min(1).optional()
   }).optional()
 });
-var clientIdentitySchema = clientEnvSchema.pick({ assetPath: true });
+var clientIdentityResponseSchema = clientEnvSchema.pick({ assetPath: true, assetPathId: true }).extend({ serverVersion: external_exports.string().min(1) });
 
 // packages/shared/src/envelope.ts
 var errorKindSchema = external_exports.enum([
@@ -72032,6 +72034,68 @@ var Hono2 = class extends Hono {
 // packages/server/src/app.ts
 var import_yaml = __toESM(require_dist(), 1);
 
+// packages/server/src/config.ts
+import { createHash as createHash5 } from "node:crypto";
+import { fileURLToPath } from "node:url";
+var DEFAULT_BOARD_CONFIG_URL = fileURLToPath(
+  new URL("../../../boards/example.yaml", import.meta.url)
+);
+var configSchema = external_exports.object({
+  /**
+   * Where the built client lives. Points at a versioned CDN path in a deployment
+   * (`https://assets.../dashboard/1.0.7`) or at the Vite dev server locally. Trailing slashes are
+   * trimmed so `${assetPath}/index.html` never doubles up.
+   */
+  assetPath: external_exports.string({
+    error: "ASSET_PATH is required \u2014 the server has no client to serve without it."
+  }).min(1, "ASSET_PATH is required \u2014 the server has no client to serve without it.").transform((value) => value.replace(/\/+$/, "")),
+  proxyPath: external_exports.string().min(1).default("/api"),
+  /** A URL or a local file path. Local development uses a path and needs no credential. */
+  boardConfigUrl: external_exports.string().min(1).default(DEFAULT_BOARD_CONFIG_URL),
+  /** Optional for single-board files; startup selects the only board automatically. */
+  board: external_exports.string().min(1).optional(),
+  /** Optional ARN of the one Secrets Manager JSON credential map for this Lambda. */
+  secretReference: external_exports.string().min(1).optional(),
+  /** Immutable server image identifier, supplied by the image build and emitted only in startup logs. */
+  serverRelease: external_exports.string().min(1).default("development"),
+  port: external_exports.coerce.number().int().min(1).max(65535).default(3e3),
+  host: external_exports.string().min(1).default("localhost"),
+  /**
+   * How long to keep retrying an unreachable template before giving up, in milliseconds.
+   *
+   * Zero — the default, and what every deployment uses — means a bad ASSET_PATH fails on the first
+   * attempt, which is the behavior a misconfiguration deserves. `npm run dev` sets a few seconds
+   * because it starts the server and the Vite dev server at the same moment, and without this the
+   * local loop is a race the developer loses about half the time.
+   */
+  templateWaitMillis: external_exports.coerce.number().int().min(0).default(0)
+});
+function loadConfig2(env2 = process.env) {
+  const result = configSchema.safeParse({
+    assetPath: env2.ASSET_PATH,
+    proxyPath: env2.PROXY_PATH,
+    boardConfigUrl: env2.BOARD_CONFIG_URL,
+    board: env2.BOARD,
+    secretReference: env2.SECRET_REFERENCE,
+    serverRelease: env2.SERVER_RELEASE,
+    port: env2.PORT,
+    host: env2.HOST,
+    templateWaitMillis: env2.TEMPLATE_WAIT_MS
+  });
+  if (!result.success) {
+    throw new Error(`Invalid server configuration:
+${external_exports.prettifyError(result.error)}`);
+  }
+  return result.data;
+}
+function assetPathId(assetPath) {
+  return `sha256:${createHash5("sha256").update(assetPath).digest("hex")}`;
+}
+var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+function isLocalHost(host) {
+  return LOCAL_HOSTS.has(host);
+}
+
 // packages/server/src/logger.ts
 var consoleLogger = {
   log(event) {
@@ -72049,6 +72113,29 @@ function destinationOrigin(value) {
     return void 0;
   }
 }
+function serverDiagnosticContext(serverVersion, configuredAssetPathId) {
+  return { serverVersion, configuredAssetPathId };
+}
+function clientDiagnosticClaims(headers, context) {
+  const version2 = headers.get("x-dashboard-client-version");
+  const origin = headers.get("x-dashboard-client-origin");
+  const assetPathId2 = headers.get("x-dashboard-client-asset-id");
+  const clientOrigin = safeOrigin(origin);
+  return {
+    ...version2 && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(version2) ? { clientVersion: version2 } : {},
+    ...clientOrigin ? { clientOrigin } : {},
+    ...assetPathId2 && /^sha256:[a-f0-9]{64}$/.test(assetPathId2) ? { clientAssetPathMatchesConfigured: assetPathId2 === context.configuredAssetPathId } : {}
+  };
+}
+function safeOrigin(value) {
+  if (!value) return void 0;
+  try {
+    const origin = new URL(value).origin;
+    return origin === "null" ? void 0 : origin;
+  } catch {
+    return void 0;
+  }
+}
 
 // packages/server/src/template.ts
 var ASSET_PATH_SENTINEL = "/__ASSET_PATH__";
@@ -72134,6 +72221,10 @@ function createApp(deps) {
   const credentials = deps.credentials ?? environmentCredentials();
   const githubClient = createGithubClient(credentials);
   const logger2 = deps.logger ?? consoleLogger;
+  const diagnosticContext = serverDiagnosticContext(
+    config2.serverRelease,
+    assetPathId(config2.assetPath)
+  );
   const app = new Hono2();
   app.use("/api/*", async (c5, next) => {
     const id = requestId();
@@ -72145,8 +72236,10 @@ function createApp(deps) {
     const id = c5.get("dashboardRequestId");
     logger2.log({
       event: "server.unhandled_exception",
+      serverVersion: diagnosticContext.serverVersion,
       ...id ? { requestId: id } : {},
-      operation: "route-handler"
+      operation: "route-handler",
+      ...clientDiagnosticClaims(c5.req.raw.headers, diagnosticContext)
     });
     return c5.json(
       { error: "The dashboard could not complete this request." },
@@ -72156,7 +72249,11 @@ function createApp(deps) {
   });
   app.get("/health", (c5) => c5.json({ status: "ok" }));
   app.get(`${config2.proxyPath}/client`, (c5) => {
-    const identity = { assetPath: config2.assetPath };
+    const identity = {
+      assetPath: config2.assetPath,
+      assetPathId: diagnosticContext.configuredAssetPathId,
+      serverVersion: diagnosticContext.serverVersion
+    };
     return c5.json(identity, 200, { "cache-control": "no-store" });
   });
   app.get("/", (c5) => renderEntrypoint(c5.req.raw, selectedBoard));
@@ -72386,10 +72483,12 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
   function rejected(c5, context) {
     logger2.log({
       event: "api.operation_rejected",
+      serverVersion: diagnosticContext.serverVersion,
       requestId: c5.get("dashboardRequestId"),
       boardId: context.boardId,
       panelId: context.panelId,
-      operation: context.operation
+      operation: context.operation,
+      ...clientDiagnosticClaims(c5.req.raw.headers, diagnosticContext)
     });
     return c5.notFound();
   }
@@ -72400,10 +72499,12 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
     if (adapted.envelope?.state === "error") {
       logger2.log({
         event: "panel.observation_failed",
+        serverVersion: diagnosticContext.serverVersion,
         requestId: c5.get("dashboardRequestId"),
         boardId: context.boardId,
         panelId: context.panelId,
         operation: context.operation,
+        ...clientDiagnosticClaims(c5.req.raw.headers, diagnosticContext),
         errorKind: adapted.envelope.error.kind,
         elapsedMs: Math.round(performance.now() - started),
         ...context.sourceName ? { sourceName: context.sourceName } : {},
@@ -72419,6 +72520,7 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
     const template = await templates.get(config2.assetPath);
     const env2 = {
       assetPath: config2.assetPath,
+      assetPathId: diagnosticContext.configuredAssetPathId,
       proxyPath: config2.proxyPath,
       board
     };
@@ -72465,68 +72567,13 @@ async function fetchBoardConfig(url2, fetcher) {
   return response.text();
 }
 
-// packages/server/src/config.ts
-import { fileURLToPath } from "node:url";
-var DEFAULT_BOARD_CONFIG_URL = fileURLToPath(
-  new URL("../../../boards/example.yaml", import.meta.url)
-);
-var configSchema = external_exports.object({
-  /**
-   * Where the built client lives. Points at a versioned CDN path in a deployment
-   * (`https://assets.../dashboard/1.0.7`) or at the Vite dev server locally. Trailing slashes are
-   * trimmed so `${assetPath}/index.html` never doubles up.
-   */
-  assetPath: external_exports.string({
-    error: "ASSET_PATH is required \u2014 the server has no client to serve without it."
-  }).min(1, "ASSET_PATH is required \u2014 the server has no client to serve without it.").transform((value) => value.replace(/\/+$/, "")),
-  proxyPath: external_exports.string().min(1).default("/api"),
-  /** A URL or a local file path. Local development uses a path and needs no credential. */
-  boardConfigUrl: external_exports.string().min(1).default(DEFAULT_BOARD_CONFIG_URL),
-  /** Optional for single-board files; startup selects the only board automatically. */
-  board: external_exports.string().min(1).optional(),
-  /** Optional ARN of the one Secrets Manager JSON credential map for this Lambda. */
-  secretReference: external_exports.string().min(1).optional(),
-  /** Immutable server image identifier, supplied by the image build and emitted only in startup logs. */
-  serverRelease: external_exports.string().min(1).default("development"),
-  port: external_exports.coerce.number().int().min(1).max(65535).default(3e3),
-  host: external_exports.string().min(1).default("localhost"),
-  /**
-   * How long to keep retrying an unreachable template before giving up, in milliseconds.
-   *
-   * Zero — the default, and what every deployment uses — means a bad ASSET_PATH fails on the first
-   * attempt, which is the behavior a misconfiguration deserves. `npm run dev` sets a few seconds
-   * because it starts the server and the Vite dev server at the same moment, and without this the
-   * local loop is a race the developer loses about half the time.
-   */
-  templateWaitMillis: external_exports.coerce.number().int().min(0).default(0)
-});
-function loadConfig2(env2 = process.env) {
-  const result = configSchema.safeParse({
-    assetPath: env2.ASSET_PATH,
-    proxyPath: env2.PROXY_PATH,
-    boardConfigUrl: env2.BOARD_CONFIG_URL,
-    board: env2.BOARD,
-    secretReference: env2.SECRET_REFERENCE,
-    serverRelease: env2.SERVER_RELEASE,
-    port: env2.PORT,
-    host: env2.HOST,
-    templateWaitMillis: env2.TEMPLATE_WAIT_MS
-  });
-  if (!result.success) {
-    throw new Error(`Invalid server configuration:
-${external_exports.prettifyError(result.error)}`);
-  }
-  return result.data;
-}
-var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
-function isLocalHost(host) {
-  return LOCAL_HOSTS.has(host);
-}
-
 // packages/server/src/startup.ts
 async function startup(options = {}) {
   const logger2 = options.logger ?? consoleLogger;
-  logger2.log({ event: "server.starting" });
+  logger2.log({
+    event: "server.starting",
+    serverVersion: process.env.SERVER_RELEASE ?? "development"
+  });
   try {
     const config2 = loadConfig2();
     const fetcher = options.fetcher ?? globalThis.fetch;
@@ -72559,7 +72606,11 @@ async function startup(options = {}) {
       config: resolvedConfig
     };
   } catch (error62) {
-    logger2.log({ event: "server.startup_failed", category: startupFailureCategory(error62) });
+    logger2.log({
+      event: "server.startup_failed",
+      serverVersion: process.env.SERVER_RELEASE ?? "development",
+      category: startupFailureCategory(error62)
+    });
     throw error62;
   }
 }
@@ -72598,7 +72649,12 @@ async function waitForTemplate(config2, fetcher) {
 var RETRY_INTERVAL_MILLIS = 250;
 function warnAboutMissingAuth(config2, logger2) {
   if (isLocalHost(config2.host)) return;
-  logger2.log({ event: "server.no_auth_warning", host: config2.host, port: config2.port });
+  logger2.log({
+    event: "server.no_auth_warning",
+    serverVersion: config2.serverRelease,
+    host: config2.host,
+    port: config2.port
+  });
 }
 function startupFailureCategory(error62) {
   const message = error62 instanceof Error ? error62.message : "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@continuous-excellence/ze-great-dashboard-aws",
-  "version": "0.24.2",
+  "version": "0.25.0",
   "type": "module",
   "description": "AWS server runtime and CloudFormation deployment tooling for Ze Great Dashboard.",
   "keywords": [