@continuous-excellence/ze-great-dashboard-aws 0.24.2 → 0.26.0

package/dist/cli.js

@@ -83,6 +83,26 @@ var positionSchema = z2.union([
 ]);
 var panelDensities = ["auto", "comfortable", "compact"];
 var panelDensitySchema = z2.enum(panelDensities);
+var httpValueJsonPathSchema = z2.string().regex(/^\$(?:\.[A-Za-z_][A-Za-z0-9_]*|\[\d+\])*$/, "must be a simple JSON path");
+var httpValueFactSchema = z2.object({
+  /** Stable address below the panel; labels and ordering may change without repointing it. */
+  id: z2.string().min(1),
+  label: z2.string().min(1),
+  url: z2.url(),
+  json_path: httpValueJsonPathSchema.optional()
+});
+var httpValuePanelIdentitySchema = z2.object({
+  id: z2.string().min(1),
+  type: z2.literal("http-value")
+});
+var httpValueScalarPanelSchema = httpValuePanelIdentitySchema.extend({
+  url: z2.url(),
+  json_path: httpValueJsonPathSchema.optional(),
+  link: z2.url().optional()
+});
+var httpValueGroupedPanelSchema = httpValuePanelIdentitySchema.extend({
+  facts: z2.array(httpValueFactSchema).min(1).max(4)
+});
 var visibleRunningAnimations = [
   "radial",
   "runway",
@@ -125,7 +145,9 @@ var panelSchema = z2.looseObject({
   /** Source-agnostic endpoint used by the http-value signal. */
   url: z2.url().optional(),
   /** Small, deliberate JSON path subset: $.version, $.deployment.version, or $.response.docs[0].latestVersion. */
-  json_path: z2.string().regex(/^\$(?:\.[A-Za-z_][A-Za-z0-9_]*|\[\d+\])*$/, "must be a simple JSON path").optional()
+  json_path: httpValueJsonPathSchema.optional(),
+  /** Up to four independently fetched source-agnostic readings in one visual panel. */
+  facts: httpValueGroupedPanelSchema.shape.facts.optional()
 }).superRefine((panel, ctx) => {
   if ("display" in panel) {
     ctx.addIssue({
@@ -134,6 +156,32 @@ var panelSchema = z2.looseObject({
       message: "display was removed; use density"
     });
   }
+  if (panel.type !== "http-value") return;
+  if (panel.facts) {
+    if (panel.url !== void 0)
+      ctx.addIssue({
+        code: "custom",
+        path: ["url"],
+        message: "use facts URLs for grouped panels"
+      });
+    if (panel.json_path !== void 0)
+      ctx.addIssue({
+        code: "custom",
+        path: ["json_path"],
+        message: "use facts json_path values for grouped panels"
+      });
+    const seen = /* @__PURE__ */ new Map();
+    panel.facts.forEach((fact, index) => {
+      const first = seen.get(fact.id);
+      if (first === void 0) seen.set(fact.id, index);
+      else
+        ctx.addIssue({
+          code: "custom",
+          path: ["facts", index, "id"],
+          message: `duplicate fact id "${fact.id}" (already used by fact at index ${first})`
+        });
+    });
+  }
 });
 var githubAppSchema = z2.object({
   app_id_env: z2.string().min(1),
@@ -303,6 +351,8 @@ import { z as z3 } from "zod";
 var clientEnvSchema = z3.object({
   /** Where the immutable client assets live. The one variable that repoints the whole client. */
   assetPath: z3.string().min(1),
+  /** Opaque SHA-256 fingerprint of the canonical asset path, for diagnostic correlation only. */
+  assetPathId: z3.string().regex(/^sha256:[a-f0-9]{64}$/),
   /** Same-origin path the proxy is mounted at, so there is no CORS and no cookie problem. */
   proxyPath: z3.string().min(1),
   /** Which board this is, resolved server-side so the client parses no URLs. */
@@ -313,7 +363,7 @@ var clientEnvSchema = z3.object({
     clientId: z3.string().min(1).optional()
   }).optional()
 });
-var clientIdentitySchema = clientEnvSchema.pick({ assetPath: true });
+var clientIdentityResponseSchema = clientEnvSchema.pick({ assetPath: true, assetPathId: true }).extend({ serverVersion: z3.string().min(1) });
 
 // packages/shared/src/envelope.ts
 import { z as z4 } from "zod";

package/dist/index.js

@@ -764,6 +764,26 @@ var positionSchema = z2.union([
 ]);
 var panelDensities = ["auto", "comfortable", "compact"];
 var panelDensitySchema = z2.enum(panelDensities);
+var httpValueJsonPathSchema = z2.string().regex(/^\$(?:\.[A-Za-z_][A-Za-z0-9_]*|\[\d+\])*$/, "must be a simple JSON path");
+var httpValueFactSchema = z2.object({
+  /** Stable address below the panel; labels and ordering may change without repointing it. */
+  id: z2.string().min(1),
+  label: z2.string().min(1),
+  url: z2.url(),
+  json_path: httpValueJsonPathSchema.optional()
+});
+var httpValuePanelIdentitySchema = z2.object({
+  id: z2.string().min(1),
+  type: z2.literal("http-value")
+});
+var httpValueScalarPanelSchema = httpValuePanelIdentitySchema.extend({
+  url: z2.url(),
+  json_path: httpValueJsonPathSchema.optional(),
+  link: z2.url().optional()
+});
+var httpValueGroupedPanelSchema = httpValuePanelIdentitySchema.extend({
+  facts: z2.array(httpValueFactSchema).min(1).max(4)
+});
 var visibleRunningAnimations = [
   "radial",
   "runway",
@@ -806,7 +826,9 @@ var panelSchema = z2.looseObject({
   /** Source-agnostic endpoint used by the http-value signal. */
   url: z2.url().optional(),
   /** Small, deliberate JSON path subset: $.version, $.deployment.version, or $.response.docs[0].latestVersion. */
-  json_path: z2.string().regex(/^\$(?:\.[A-Za-z_][A-Za-z0-9_]*|\[\d+\])*$/, "must be a simple JSON path").optional()
+  json_path: httpValueJsonPathSchema.optional(),
+  /** Up to four independently fetched source-agnostic readings in one visual panel. */
+  facts: httpValueGroupedPanelSchema.shape.facts.optional()
 }).superRefine((panel, ctx) => {
   if ("display" in panel) {
     ctx.addIssue({
@@ -815,6 +837,32 @@ var panelSchema = z2.looseObject({
       message: "display was removed; use density"
     });
   }
+  if (panel.type !== "http-value") return;
+  if (panel.facts) {
+    if (panel.url !== void 0)
+      ctx.addIssue({
+        code: "custom",
+        path: ["url"],
+        message: "use facts URLs for grouped panels"
+      });
+    if (panel.json_path !== void 0)
+      ctx.addIssue({
+        code: "custom",
+        path: ["json_path"],
+        message: "use facts json_path values for grouped panels"
+      });
+    const seen = /* @__PURE__ */ new Map();
+    panel.facts.forEach((fact, index) => {
+      const first = seen.get(fact.id);
+      if (first === void 0) seen.set(fact.id, index);
+      else
+        ctx.addIssue({
+          code: "custom",
+          path: ["facts", index, "id"],
+          message: `duplicate fact id "${fact.id}" (already used by fact at index ${first})`
+        });
+    });
+  }
 });
 var githubAppSchema = z2.object({
   app_id_env: z2.string().min(1),
@@ -984,6 +1032,8 @@ import { z as z3 } from "zod";
 var clientEnvSchema = z3.object({
   /** Where the immutable client assets live. The one variable that repoints the whole client. */
   assetPath: z3.string().min(1),
+  /** Opaque SHA-256 fingerprint of the canonical asset path, for diagnostic correlation only. */
+  assetPathId: z3.string().regex(/^sha256:[a-f0-9]{64}$/),
   /** Same-origin path the proxy is mounted at, so there is no CORS and no cookie problem. */
   proxyPath: z3.string().min(1),
   /** Which board this is, resolved server-side so the client parses no URLs. */
@@ -994,7 +1044,7 @@ var clientEnvSchema = z3.object({
     clientId: z3.string().min(1).optional()
   }).optional()
 });
-var clientIdentitySchema = clientEnvSchema.pick({ assetPath: true });
+var clientIdentityResponseSchema = clientEnvSchema.pick({ assetPath: true, assetPathId: true }).extend({ serverVersion: z3.string().min(1) });
 
 // packages/shared/src/envelope.ts
 import { z as z4 } from "zod";

package/dist/lambda.mjs

@@ -25202,7 +25202,7 @@ var require_dist_cjs11 = __commonJS({
     var { setCredentialFeature: setCredentialFeature2 } = (init_client3(), __toCommonJS(client_exports2));
     var { CredentialsProviderError: CredentialsProviderError2, parseKnownFiles: parseKnownFiles2, getProfileName: getProfileName2 } = (init_config2(), __toCommonJS(config_exports));
     var { HttpRequest: HttpRequest2 } = (init_protocols(), __toCommonJS(protocols_exports));
-    var { createHash: createHash5, createPrivateKey, createPublicKey, sign: sign2 } = __require("node:crypto");
+    var { createHash: createHash6, createPrivateKey, createPublicKey, sign: sign2 } = __require("node:crypto");
     var { promises } = __require("node:fs");
     var { homedir: homedir2 } = __require("node:os");
     var { dirname, join: join5 } = __require("node:path");
@@ -25371,7 +25371,7 @@ var require_dist_cjs11 = __commonJS({
       getTokenFilePath() {
         const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join5(homedir2(), ".aws", "login", "cache");
         const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
-        const loginSessionSha256 = createHash5("sha256").update(loginSessionBytes).digest("hex");
+        const loginSessionSha256 = createHash6("sha256").update(loginSessionBytes).digest("hex");
         return join5(directory, `${loginSessionSha256}.json`);
       }
       derToRawSignature(derSignature) {
@@ -68320,6 +68320,26 @@ var positionSchema = external_exports.union([
 ]);
 var panelDensities = ["auto", "comfortable", "compact"];
 var panelDensitySchema = external_exports.enum(panelDensities);
+var httpValueJsonPathSchema = external_exports.string().regex(/^\$(?:\.[A-Za-z_][A-Za-z0-9_]*|\[\d+\])*$/, "must be a simple JSON path");
+var httpValueFactSchema = external_exports.object({
+  /** Stable address below the panel; labels and ordering may change without repointing it. */
+  id: external_exports.string().min(1),
+  label: external_exports.string().min(1),
+  url: external_exports.url(),
+  json_path: httpValueJsonPathSchema.optional()
+});
+var httpValuePanelIdentitySchema = external_exports.object({
+  id: external_exports.string().min(1),
+  type: external_exports.literal("http-value")
+});
+var httpValueScalarPanelSchema = httpValuePanelIdentitySchema.extend({
+  url: external_exports.url(),
+  json_path: httpValueJsonPathSchema.optional(),
+  link: external_exports.url().optional()
+});
+var httpValueGroupedPanelSchema = httpValuePanelIdentitySchema.extend({
+  facts: external_exports.array(httpValueFactSchema).min(1).max(4)
+});
 var visibleRunningAnimations = [
   "radial",
   "runway",
@@ -68362,7 +68382,9 @@ var panelSchema = external_exports.looseObject({
   /** Source-agnostic endpoint used by the http-value signal. */
   url: external_exports.url().optional(),
   /** Small, deliberate JSON path subset: $.version, $.deployment.version, or $.response.docs[0].latestVersion. */
-  json_path: external_exports.string().regex(/^\$(?:\.[A-Za-z_][A-Za-z0-9_]*|\[\d+\])*$/, "must be a simple JSON path").optional()
+  json_path: httpValueJsonPathSchema.optional(),
+  /** Up to four independently fetched source-agnostic readings in one visual panel. */
+  facts: httpValueGroupedPanelSchema.shape.facts.optional()
 }).superRefine((panel, ctx) => {
   if ("display" in panel) {
     ctx.addIssue({
@@ -68371,6 +68393,32 @@ var panelSchema = external_exports.looseObject({
       message: "display was removed; use density"
     });
   }
+  if (panel.type !== "http-value") return;
+  if (panel.facts) {
+    if (panel.url !== void 0)
+      ctx.addIssue({
+        code: "custom",
+        path: ["url"],
+        message: "use facts URLs for grouped panels"
+      });
+    if (panel.json_path !== void 0)
+      ctx.addIssue({
+        code: "custom",
+        path: ["json_path"],
+        message: "use facts json_path values for grouped panels"
+      });
+    const seen = /* @__PURE__ */ new Map();
+    panel.facts.forEach((fact, index) => {
+      const first = seen.get(fact.id);
+      if (first === void 0) seen.set(fact.id, index);
+      else
+        ctx.addIssue({
+          code: "custom",
+          path: ["facts", index, "id"],
+          message: `duplicate fact id "${fact.id}" (already used by fact at index ${first})`
+        });
+    });
+  }
 });
 var githubAppSchema = external_exports.object({
   app_id_env: external_exports.string().min(1),
@@ -68552,6 +68600,8 @@ function boardSchemaModeline(url2) {
 var clientEnvSchema = external_exports.object({
   /** Where the immutable client assets live. The one variable that repoints the whole client. */
   assetPath: external_exports.string().min(1),
+  /** Opaque SHA-256 fingerprint of the canonical asset path, for diagnostic correlation only. */
+  assetPathId: external_exports.string().regex(/^sha256:[a-f0-9]{64}$/),
   /** Same-origin path the proxy is mounted at, so there is no CORS and no cookie problem. */
   proxyPath: external_exports.string().min(1),
   /** Which board this is, resolved server-side so the client parses no URLs. */
@@ -68562,7 +68612,7 @@ var clientEnvSchema = external_exports.object({
     clientId: external_exports.string().min(1).optional()
   }).optional()
 });
-var clientIdentitySchema = clientEnvSchema.pick({ assetPath: true });
+var clientIdentityResponseSchema = clientEnvSchema.pick({ assetPath: true, assetPathId: true }).extend({ serverVersion: external_exports.string().min(1) });
 
 // packages/shared/src/envelope.ts
 var errorKindSchema = external_exports.enum([
@@ -69803,23 +69853,17 @@ function failure(panelId, kind, error62, link, date6, failure2) {
 }
 
 // packages/server/src/adapters/http-value.ts
-var httpValuePanelSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  type: external_exports.literal("http-value"),
-  url: external_exports.url(),
-  json_path: external_exports.string().regex(/^\$(?:\.[A-Za-z_][A-Za-z0-9_]*|\[\d+\])*$/).optional(),
-  link: external_exports.url().optional()
-});
 function permittedHttpValueCalls(panel) {
-  const parsed = httpValuePanelSchema.parse(panel);
-  const url2 = new URL(parsed.url);
-  if (url2.protocol !== "http:" && url2.protocol !== "https:") {
-    throw new Error("http-value URLs must use http or https");
-  }
-  return [{ url: url2.toString(), headers: new Headers({ accept: "application/json, text/plain" }) }];
+  const grouped = httpValueGroupedPanelSchema.safeParse(panel);
+  const urls = grouped.success ? grouped.data.facts.map((fact) => fact.url) : [httpValueScalarPanelSchema.parse(panel).url];
+  return urls.map(permittedCall);
+}
+function httpValueFact(panel, factId) {
+  const grouped = httpValueGroupedPanelSchema.parse(panel);
+  return grouped.facts.find((fact) => fact.id === factId);
 }
 async function fetchHttpValue(args) {
-  const panel = httpValuePanelSchema.parse(args.panel);
+  const panel = httpValueScalarPanelSchema.parse(args.panel);
   const [call] = permittedHttpValueCalls(args.panel);
   if (!call) throw new Error("http-value adapter declared no permitted call");
   forwardValidators(args.requestHeaders, call.headers);
@@ -69868,6 +69912,21 @@ async function fetchHttpValue(args) {
     };
   }
 }
+async function fetchHttpValueFact(args) {
+  const fact = httpValueFact(args.panel, args.factId);
+  if (!fact) throw new Error(`http-value fact "${args.factId}" is not configured`);
+  return fetchHttpValue({
+    panel: { id: args.panel.id, type: "http-value", url: fact.url, json_path: fact.json_path },
+    requestHeaders: args.requestHeaders,
+    fetcher: args.fetcher
+  });
+}
+function permittedCall(value) {
+  const url2 = new URL(value);
+  if (url2.protocol !== "http:" && url2.protocol !== "https:")
+    throw new Error("http-value URLs must use http or https");
+  return { url: url2.toString(), headers: new Headers({ accept: "application/json, text/plain" }) };
+}
 function parseValue(text) {
   const trimmed = text.trim();
   try {
@@ -72032,6 +72091,68 @@ var Hono2 = class extends Hono {
 // packages/server/src/app.ts
 var import_yaml = __toESM(require_dist(), 1);
 
+// packages/server/src/config.ts
+import { createHash as createHash5 } from "node:crypto";
+import { fileURLToPath } from "node:url";
+var DEFAULT_BOARD_CONFIG_URL = fileURLToPath(
+  new URL("../../../boards/example.yaml", import.meta.url)
+);
+var configSchema = external_exports.object({
+  /**
+   * Where the built client lives. Points at a versioned CDN path in a deployment
+   * (`https://assets.../dashboard/1.0.7`) or at the Vite dev server locally. Trailing slashes are
+   * trimmed so `${assetPath}/index.html` never doubles up.
+   */
+  assetPath: external_exports.string({
+    error: "ASSET_PATH is required \u2014 the server has no client to serve without it."
+  }).min(1, "ASSET_PATH is required \u2014 the server has no client to serve without it.").transform((value) => value.replace(/\/+$/, "")),
+  proxyPath: external_exports.string().min(1).default("/api"),
+  /** A URL or a local file path. Local development uses a path and needs no credential. */
+  boardConfigUrl: external_exports.string().min(1).default(DEFAULT_BOARD_CONFIG_URL),
+  /** Optional for single-board files; startup selects the only board automatically. */
+  board: external_exports.string().min(1).optional(),
+  /** Optional ARN of the one Secrets Manager JSON credential map for this Lambda. */
+  secretReference: external_exports.string().min(1).optional(),
+  /** Immutable server image identifier, supplied by the image build and emitted only in startup logs. */
+  serverRelease: external_exports.string().min(1).default("development"),
+  port: external_exports.coerce.number().int().min(1).max(65535).default(3e3),
+  host: external_exports.string().min(1).default("localhost"),
+  /**
+   * How long to keep retrying an unreachable template before giving up, in milliseconds.
+   *
+   * Zero — the default, and what every deployment uses — means a bad ASSET_PATH fails on the first
+   * attempt, which is the behavior a misconfiguration deserves. `npm run dev` sets a few seconds
+   * because it starts the server and the Vite dev server at the same moment, and without this the
+   * local loop is a race the developer loses about half the time.
+   */
+  templateWaitMillis: external_exports.coerce.number().int().min(0).default(0)
+});
+function loadConfig2(env2 = process.env) {
+  const result = configSchema.safeParse({
+    assetPath: env2.ASSET_PATH,
+    proxyPath: env2.PROXY_PATH,
+    boardConfigUrl: env2.BOARD_CONFIG_URL,
+    board: env2.BOARD,
+    secretReference: env2.SECRET_REFERENCE,
+    serverRelease: env2.SERVER_RELEASE,
+    port: env2.PORT,
+    host: env2.HOST,
+    templateWaitMillis: env2.TEMPLATE_WAIT_MS
+  });
+  if (!result.success) {
+    throw new Error(`Invalid server configuration:
+${external_exports.prettifyError(result.error)}`);
+  }
+  return result.data;
+}
+function assetPathId(assetPath) {
+  return `sha256:${createHash5("sha256").update(assetPath).digest("hex")}`;
+}
+var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+function isLocalHost(host) {
+  return LOCAL_HOSTS.has(host);
+}
+
 // packages/server/src/logger.ts
 var consoleLogger = {
   log(event) {
@@ -72049,6 +72170,29 @@ function destinationOrigin(value) {
     return void 0;
   }
 }
+function serverDiagnosticContext(serverVersion, configuredAssetPathId) {
+  return { serverVersion, configuredAssetPathId };
+}
+function clientDiagnosticClaims(headers, context) {
+  const version2 = headers.get("x-dashboard-client-version");
+  const origin = headers.get("x-dashboard-client-origin");
+  const assetPathId2 = headers.get("x-dashboard-client-asset-id");
+  const clientOrigin = safeOrigin(origin);
+  return {
+    ...version2 && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(version2) ? { clientVersion: version2 } : {},
+    ...clientOrigin ? { clientOrigin } : {},
+    ...assetPathId2 && /^sha256:[a-f0-9]{64}$/.test(assetPathId2) ? { clientAssetPathMatchesConfigured: assetPathId2 === context.configuredAssetPathId } : {}
+  };
+}
+function safeOrigin(value) {
+  if (!value) return void 0;
+  try {
+    const origin = new URL(value).origin;
+    return origin === "null" ? void 0 : origin;
+  } catch {
+    return void 0;
+  }
+}
 
 // packages/server/src/template.ts
 var ASSET_PATH_SENTINEL = "/__ASSET_PATH__";
@@ -72134,6 +72278,10 @@ function createApp(deps) {
   const credentials = deps.credentials ?? environmentCredentials();
   const githubClient = createGithubClient(credentials);
   const logger2 = deps.logger ?? consoleLogger;
+  const diagnosticContext = serverDiagnosticContext(
+    config2.serverRelease,
+    assetPathId(config2.assetPath)
+  );
   const app = new Hono2();
   app.use("/api/*", async (c5, next) => {
     const id = requestId();
@@ -72145,8 +72293,10 @@ function createApp(deps) {
     const id = c5.get("dashboardRequestId");
     logger2.log({
       event: "server.unhandled_exception",
+      serverVersion: diagnosticContext.serverVersion,
       ...id ? { requestId: id } : {},
-      operation: "route-handler"
+      operation: "route-handler",
+      ...clientDiagnosticClaims(c5.req.raw.headers, diagnosticContext)
     });
     return c5.json(
       { error: "The dashboard could not complete this request." },
@@ -72156,7 +72306,11 @@ function createApp(deps) {
   });
   app.get("/health", (c5) => c5.json({ status: "ok" }));
   app.get(`${config2.proxyPath}/client`, (c5) => {
-    const identity = { assetPath: config2.assetPath };
+    const identity = {
+      assetPath: config2.assetPath,
+      assetPathId: diagnosticContext.configuredAssetPathId,
+      serverVersion: diagnosticContext.serverVersion
+    };
     return c5.json(identity, 200, { "cache-control": "no-store" });
   });
   app.get("/", (c5) => renderEntrypoint(c5.req.raw, selectedBoard));
@@ -72208,6 +72362,27 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
   };
   app.get("/api/boards/:board/rendered", (c5) => layoutDownload(c5, "rendered"));
   app.get("/api/boards/:board/authored", (c5) => layoutDownload(c5, "authored"));
+  app.get("/api/panel/:board/:panelId/facts/:factId", async (c5) => {
+    const boardName = c5.req.param("board");
+    const panelId = c5.req.param("panelId");
+    const factId = c5.req.param("factId");
+    const panel = deps.boardConfig?.boards[boardName]?.panels.find(
+      (candidate) => candidate.id === panelId
+    );
+    const fact = panel?.type === "http-value" && panel.facts ? httpValueFact(panel, factId) : void 0;
+    if (!panel || !fact || !permitsPanelOperation(allowlist, boardName, panelId, "read"))
+      return rejected(c5, { boardId: boardName, panelId, operation: "read" });
+    return observation(
+      c5,
+      fetchHttpValueFact({
+        panel,
+        factId,
+        requestHeaders: c5.req.raw.headers,
+        fetcher: deps.fetcher ?? globalThis.fetch
+      }),
+      { boardId: boardName, panelId, operation: "read", destination: fact.url }
+    );
+  });
   app.get("/api/panel/:board/:panelId", async (c5) => {
     const boardName = c5.req.param("board");
     const panelId = c5.req.param("panelId");
@@ -72270,6 +72445,7 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
     if (panel.type === "pull-request-health")
       return rejected(c5, { boardId: boardName, panelId, operation: "read" });
     if (panel.type === "http-value") {
+      if (panel.facts) return rejected(c5, { boardId: boardName, panelId, operation: "read" });
       const result = fetchHttpValue({
         panel,
         requestHeaders: c5.req.raw.headers,
@@ -72386,10 +72562,12 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
   function rejected(c5, context) {
     logger2.log({
       event: "api.operation_rejected",
+      serverVersion: diagnosticContext.serverVersion,
       requestId: c5.get("dashboardRequestId"),
       boardId: context.boardId,
       panelId: context.panelId,
-      operation: context.operation
+      operation: context.operation,
+      ...clientDiagnosticClaims(c5.req.raw.headers, diagnosticContext)
     });
     return c5.notFound();
   }
@@ -72400,10 +72578,12 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
     if (adapted.envelope?.state === "error") {
       logger2.log({
         event: "panel.observation_failed",
+        serverVersion: diagnosticContext.serverVersion,
         requestId: c5.get("dashboardRequestId"),
         boardId: context.boardId,
         panelId: context.panelId,
         operation: context.operation,
+        ...clientDiagnosticClaims(c5.req.raw.headers, diagnosticContext),
         errorKind: adapted.envelope.error.kind,
         elapsedMs: Math.round(performance.now() - started),
         ...context.sourceName ? { sourceName: context.sourceName } : {},
@@ -72419,6 +72599,7 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
     const template = await templates.get(config2.assetPath);
     const env2 = {
       assetPath: config2.assetPath,
+      assetPathId: diagnosticContext.configuredAssetPathId,
       proxyPath: config2.proxyPath,
       board
     };
@@ -72465,68 +72646,13 @@ async function fetchBoardConfig(url2, fetcher) {
   return response.text();
 }
 
-// packages/server/src/config.ts
-import { fileURLToPath } from "node:url";
-var DEFAULT_BOARD_CONFIG_URL = fileURLToPath(
-  new URL("../../../boards/example.yaml", import.meta.url)
-);
-var configSchema = external_exports.object({
-  /**
-   * Where the built client lives. Points at a versioned CDN path in a deployment
-   * (`https://assets.../dashboard/1.0.7`) or at the Vite dev server locally. Trailing slashes are
-   * trimmed so `${assetPath}/index.html` never doubles up.
-   */
-  assetPath: external_exports.string({
-    error: "ASSET_PATH is required \u2014 the server has no client to serve without it."
-  }).min(1, "ASSET_PATH is required \u2014 the server has no client to serve without it.").transform((value) => value.replace(/\/+$/, "")),
-  proxyPath: external_exports.string().min(1).default("/api"),
-  /** A URL or a local file path. Local development uses a path and needs no credential. */
-  boardConfigUrl: external_exports.string().min(1).default(DEFAULT_BOARD_CONFIG_URL),
-  /** Optional for single-board files; startup selects the only board automatically. */
-  board: external_exports.string().min(1).optional(),
-  /** Optional ARN of the one Secrets Manager JSON credential map for this Lambda. */
-  secretReference: external_exports.string().min(1).optional(),
-  /** Immutable server image identifier, supplied by the image build and emitted only in startup logs. */
-  serverRelease: external_exports.string().min(1).default("development"),
-  port: external_exports.coerce.number().int().min(1).max(65535).default(3e3),
-  host: external_exports.string().min(1).default("localhost"),
-  /**
-   * How long to keep retrying an unreachable template before giving up, in milliseconds.
-   *
-   * Zero — the default, and what every deployment uses — means a bad ASSET_PATH fails on the first
-   * attempt, which is the behavior a misconfiguration deserves. `npm run dev` sets a few seconds
-   * because it starts the server and the Vite dev server at the same moment, and without this the
-   * local loop is a race the developer loses about half the time.
-   */
-  templateWaitMillis: external_exports.coerce.number().int().min(0).default(0)
-});
-function loadConfig2(env2 = process.env) {
-  const result = configSchema.safeParse({
-    assetPath: env2.ASSET_PATH,
-    proxyPath: env2.PROXY_PATH,
-    boardConfigUrl: env2.BOARD_CONFIG_URL,
-    board: env2.BOARD,
-    secretReference: env2.SECRET_REFERENCE,
-    serverRelease: env2.SERVER_RELEASE,
-    port: env2.PORT,
-    host: env2.HOST,
-    templateWaitMillis: env2.TEMPLATE_WAIT_MS
-  });
-  if (!result.success) {
-    throw new Error(`Invalid server configuration:
-${external_exports.prettifyError(result.error)}`);
-  }
-  return result.data;
-}
-var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
-function isLocalHost(host) {
-  return LOCAL_HOSTS.has(host);
-}
-
 // packages/server/src/startup.ts
 async function startup(options = {}) {
   const logger2 = options.logger ?? consoleLogger;
-  logger2.log({ event: "server.starting" });
+  logger2.log({
+    event: "server.starting",
+    serverVersion: process.env.SERVER_RELEASE ?? "development"
+  });
   try {
     const config2 = loadConfig2();
     const fetcher = options.fetcher ?? globalThis.fetch;
@@ -72559,7 +72685,11 @@ async function startup(options = {}) {
       config: resolvedConfig
     };
   } catch (error62) {
-    logger2.log({ event: "server.startup_failed", category: startupFailureCategory(error62) });
+    logger2.log({
+      event: "server.startup_failed",
+      serverVersion: process.env.SERVER_RELEASE ?? "development",
+      category: startupFailureCategory(error62)
+    });
     throw error62;
   }
 }
@@ -72598,7 +72728,12 @@ async function waitForTemplate(config2, fetcher) {
 var RETRY_INTERVAL_MILLIS = 250;
 function warnAboutMissingAuth(config2, logger2) {
   if (isLocalHost(config2.host)) return;
-  logger2.log({ event: "server.no_auth_warning", host: config2.host, port: config2.port });
+  logger2.log({
+    event: "server.no_auth_warning",
+    serverVersion: config2.serverRelease,
+    host: config2.host,
+    port: config2.port
+  });
 }
 function startupFailureCategory(error62) {
   const message = error62 instanceof Error ? error62.message : "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@continuous-excellence/ze-great-dashboard-aws",
-  "version": "0.24.2",
+  "version": "0.26.0",
   "type": "module",
   "description": "AWS server runtime and CloudFormation deployment tooling for Ze Great Dashboard.",
   "keywords": [