@continuous-excellence/ze-great-dashboard-aws 0.27.9 → 0.27.11

package/dist/cli.js

@@ -2,18 +2,18 @@
 
 // packages/aws/src/cli.ts
 import { execFile as execFile2 } from "node:child_process";
-import { readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
+import { readFile as readFile7, writeFile as writeFile4 } from "node:fs/promises";
 import { promisify as promisify2 } from "node:util";
-import { parse as parse3 } from "yaml";
+import { parse as parse2 } from "yaml";
 
 // packages/aws/src/doctor.ts
 import { execFile } from "node:child_process";
-import { readFile as readFile5 } from "node:fs/promises";
+import { readFile as readFile6 } from "node:fs/promises";
 import { promisify } from "node:util";
-import { parse as parse2 } from "yaml";
+import { parse } from "yaml";
 
 // packages/aws/src/bootstrap.ts
-import { readFile as readFile2 } from "node:fs/promises";
+import { readFile as readFile3 } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 
 // packages/aws/src/compute-mode.ts
@@ -43,31 +43,21 @@ function computeMode(config) {
 
 // packages/aws/src/release.ts
 import { createHash } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 
+// packages/server/src/allowlist.ts
+import { ZodError } from "zod";
+
+// packages/server/src/adapters/azure-devops.ts
+import { readFile } from "node:fs/promises";
+
 // packages/shared/src/board-config.ts
 import { z as z2 } from "zod";
 
 // packages/shared/src/duration.ts
 import { z } from "zod";
-var DURATION_PATTERN = /^(\d+)(ms|s|m|h)$/;
-var UNIT_MILLIS = {
-  ms: 1,
-  s: 1e3,
-  m: 6e4,
-  h: 36e5
-};
-function parseDuration(value2) {
-  const match = DURATION_PATTERN.exec(value2);
-  if (!match) return null;
-  const [, rawAmount, rawUnit] = match;
-  if (rawAmount === void 0 || rawUnit === void 0) return null;
-  const amount = Number(rawAmount);
-  if (amount <= 0) return null;
-  return amount * UNIT_MILLIS[rawUnit];
-}
-var durationSchema = z.string().refine((value2) => parseDuration(value2) !== null, {
+var durationSchema = z.string().regex(/^[1-9][0-9]*(?:ms|s|m|h)$/, {
   message: 'must be a positive duration like "30s", "5m", or "1h"'
 }).brand();
 
@@ -154,7 +144,8 @@ var panelSchema = z2.looseObject({
     ctx.addIssue({
       code: "custom",
       path: ["display"],
-      message: "display was removed; use density"
+      message: "display was removed; use density",
+      params: { constraint: "display was removed; use density" }
     });
   }
   if (panel.type !== "http-value") return;
@@ -163,13 +154,15 @@ var panelSchema = z2.looseObject({
       ctx.addIssue({
         code: "custom",
         path: ["url"],
-        message: "use facts URLs for grouped panels"
+        message: "use facts URLs for grouped panels",
+        params: { constraint: "use facts URLs for grouped panels" }
       });
     if (panel.json_path !== void 0)
       ctx.addIssue({
         code: "custom",
         path: ["json_path"],
-        message: "use facts json_path values for grouped panels"
+        message: "use facts json_path values for grouped panels",
+        params: { constraint: "use facts json_path values for grouped panels" }
       });
     const seen = /* @__PURE__ */ new Map();
     panel.facts.forEach((fact, index) => {
@@ -179,7 +172,8 @@ var panelSchema = z2.looseObject({
         ctx.addIssue({
           code: "custom",
           path: ["facts", index, "id"],
-          message: `duplicate fact id "${fact.id}" (already used by fact at index ${first})`
+          message: `duplicate fact id "${fact.id}" (already used by fact at index ${first})`,
+          params: { constraint: "Use a unique fact id within this panel." }
         });
     });
   }
@@ -196,7 +190,11 @@ var sourceAuthenticationSchema = {
 };
 function exactlyOneGithubAuthenticationMode(source, ctx) {
   if (source.token_env && source.github_app)
-    ctx.addIssue({ code: "custom", message: "configure token_env or github_app, not both" });
+    ctx.addIssue({
+      code: "custom",
+      message: "configure token_env or github_app, not both",
+      params: { constraint: "configure token_env or github_app, not both" }
+    });
 }
 var githubActionsSourceSchema = z2.looseObject({
   type: z2.literal("github-actions"),
@@ -220,24 +218,44 @@ var azureDevOpsSourceSchema = z2.looseObject({
   if (source.token_env && source.entra_token_file_env) {
     ctx.addIssue({
       code: "custom",
-      message: "configure token_env or entra_token_file_env, not both"
+      message: "configure token_env or entra_token_file_env, not both",
+      params: { constraint: "configure token_env or entra_token_file_env, not both" }
     });
   }
   if (!source.token_env && !source.entra_token_file_env) {
     ctx.addIssue({
       code: "custom",
-      message: "configure token_env or entra_token_file_env"
+      message: "configure token_env or entra_token_file_env",
+      params: { constraint: "configure token_env or entra_token_file_env" }
     });
   }
 });
 var gitlabInstanceUrlSchema = z2.url().superRefine((value2, ctx) => {
   const url = new URL(value2);
   if (url.protocol !== "https:")
-    ctx.addIssue({ code: "custom", message: "must be an HTTPS GitLab instance URL" });
+    ctx.addIssue({
+      code: "custom",
+      message: "must be an HTTPS GitLab instance URL",
+      params: { constraint: "must be an HTTPS GitLab instance URL" }
+    });
   if (url.username || url.password)
-    ctx.addIssue({ code: "custom", message: "must not include credentials" });
-  if (url.search) ctx.addIssue({ code: "custom", message: "must not include a query string" });
-  if (url.hash) ctx.addIssue({ code: "custom", message: "must not include a fragment" });
+    ctx.addIssue({
+      code: "custom",
+      message: "must not include credentials",
+      params: { constraint: "must not include credentials" }
+    });
+  if (url.search)
+    ctx.addIssue({
+      code: "custom",
+      message: "must not include a query string",
+      params: { constraint: "must not include a query string" }
+    });
+  if (url.hash)
+    ctx.addIssue({
+      code: "custom",
+      message: "must not include a fragment",
+      params: { constraint: "must not include a fragment" }
+    });
 });
 var gitlabCiSourceSchema = z2.looseObject({
   type: z2.literal("gitlab-ci"),
@@ -251,6 +269,17 @@ var gitlabCiSourceSchema = z2.looseObject({
   url: gitlabInstanceUrlSchema.optional().default("https://gitlab.com")
 });
 var sourceSchema = z2.looseObject({ type: z2.string().min(1), ...sourceAuthenticationSchema }).superRefine(exactlyOneGithubAuthenticationMode);
+function credentialEnvironmentNames(source) {
+  const githubApp = githubAppSchema.safeParse(source.github_app);
+  return [
+    ...source.token_env ? [source.token_env] : [],
+    ...githubApp.success ? [
+      githubApp.data.app_id_env,
+      githubApp.data.private_key_env,
+      githubApp.data.installation_id_env
+    ] : []
+  ];
+}
 var boardSchema = z2.object({
   refresh: durationSchema.optional(),
   running_refresh: durationSchema.optional(),
@@ -267,7 +296,8 @@ var boardSchema = z2.object({
       ctx.addIssue({
         code: "custom",
         path: [index, "id"],
-        message: `duplicate panel id "${panel.id}" (already used by panel at index ${firstIndex})`
+        message: `duplicate panel id "${panel.id}" (already used by panel at index ${firstIndex})`,
+        params: { constraint: "Use a unique panel id within this board." }
       });
     });
   })
@@ -287,15 +317,14 @@ var boardConfigSchema = z2.object({
   auth: authSchema.optional()
 }).superRefine((config, ctx) => {
   for (const [sourceName, source] of Object.entries(config.sources)) {
-    const sourceSchema3 = source.type === "azure-devops" ? azureDevOpsSourceSchema : source.type === "gitlab-ci" ? gitlabCiSourceSchema : void 0;
-    if (!sourceSchema3) continue;
-    const parsedSource = sourceSchema3.safeParse(source);
+    const sourceSchema2 = source.type === "azure-devops" ? azureDevOpsSourceSchema : source.type === "gitlab-ci" ? gitlabCiSourceSchema : void 0;
+    if (!sourceSchema2) continue;
+    const parsedSource = sourceSchema2.safeParse(source);
     if (!parsedSource.success) {
       for (const issue of parsedSource.error.issues) {
         ctx.addIssue({
-          code: "custom",
-          path: ["sources", sourceName, ...issue.path],
-          message: issue.message
+          ...issue,
+          path: ["sources", sourceName, ...issue.path]
         });
       }
     }
@@ -308,7 +337,10 @@ var boardConfigSchema = z2.object({
         ctx.addIssue({
           code: "custom",
           path: ["boards", boardName, "panels", panelIndex, "pipeline"],
-          message: "Azure DevOps pipeline-status panels require a positive numeric pipeline definition id"
+          message: "Azure DevOps pipeline-status panels require a positive numeric pipeline definition id",
+          params: {
+            constraint: "Provide a positive numeric Azure DevOps pipeline definition id."
+          }
         });
       }
     });
@@ -471,95 +503,376 @@ var httpValueSchema = z4.object({
   value: z4.union([z4.string(), z4.number(), z4.boolean()])
 });
 
-// packages/aws/src/release.ts
-import { parse, stringify } from "yaml";
-import { z as z6 } from "zod";
-
-// packages/aws/src/internal-board.ts
+// packages/server/src/adapters/azure-devops.ts
 import { z as z5 } from "zod";
-var durationSchema2 = z5.string().regex(/^\d+(?:ms|s|m|h)$/).refine((value2) => Number.parseInt(value2, 10) > 0).brand();
-var positionSchema2 = z5.union([
-  z5.object({
-    x: z5.number().int().min(0),
-    y: z5.number().int().min(0),
-    w: z5.number().int().min(1).max(12),
-    h: z5.number().int().min(1)
-  }),
-  z5.object({ x: z5.literal(0), y: z5.literal(0), w: z5.literal(0), h: z5.literal(0) })
-]);
-var panelSchema2 = z5.looseObject({
-  // Presentation-only; ids still address proxy calls and the generated allowlist.
-  label: z5.string().min(1).optional(),
+var pipelinePanelSchema = z5.object({
   id: z5.string().min(1),
-  type: z5.string().min(1),
-  source: z5.string().min(1).optional(),
-  density: z5.enum(["auto", "comfortable", "compact"]).optional(),
-  position: positionSchema2.optional(),
-  refresh: durationSchema2.optional(),
-  link: z5.url().optional(),
-  url: z5.url().optional(),
-  json_path: z5.string().regex(/^\$(?:\.[A-Za-z_][A-Za-z0-9_]*|\[\d+\])*$/).optional()
-}).superRefine((panel, ctx) => {
-  if ("display" in panel) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["display"],
-      message: "display was removed; use density"
-    });
-  }
+  type: z5.literal("pipeline-status"),
+  source: z5.string().min(1),
+  pipeline: z5.number().int().positive()
 });
-var sourceSchema2 = z5.looseObject({
-  type: z5.string().min(1),
-  token_env: z5.string().min(1).optional(),
-  github_app: z5.object({
-    app_id_env: z5.string().min(1),
-    private_key_env: z5.string().min(1),
-    installation_id_env: z5.string().min(1)
-  }).optional()
-}).superRefine((source, ctx) => {
-  if (source.token_env && source.github_app)
-    ctx.addIssue({ code: "custom", message: "configure token_env or github_app, not both" });
+var buildSchema = z5.object({
+  id: z5.number().int().positive(),
+  buildNumber: z5.string().min(1),
+  status: z5.string().nullable().optional(),
+  result: z5.string().nullable().optional(),
+  sourceBranch: z5.string().min(1).nullable().optional(),
+  startTime: z5.string().nullable().optional(),
+  finishTime: z5.string().nullable().optional(),
+  lastChangedDate: z5.string().nullable().optional()
 });
-var boardSchema2 = z5.object({
-  refresh: durationSchema2.optional(),
-  panels: z5.array(panelSchema2).min(1).superRefine((panels, ctx) => {
-    const seen = /* @__PURE__ */ new Map();
-    panels.forEach((panel, index) => {
-      const firstIndex = seen.get(panel.id);
-      if (firstIndex === void 0) seen.set(panel.id, index);
-      else
-        ctx.addIssue({
-          code: "custom",
-          path: [index, "id"],
-          message: `duplicate panel id "${panel.id}" (already used by panel at index ${firstIndex})`
-        });
-    });
+var buildsSchema = z5.object({ value: z5.array(buildSchema) });
+var timelineSchema = z5.object({
+  records: z5.array(
+    z5.object({
+      id: z5.string().min(1),
+      parentId: z5.string().min(1).nullable().optional(),
+      type: z5.string().min(1),
+      name: z5.string().min(1),
+      state: z5.string().nullable().optional()
+    })
+  )
+});
+function permittedAzureDevOpsCalls(panel, source) {
+  const { panel: parsedPanel, source: parsedSource } = z5.object({ panel: pipelinePanelSchema, source: azureDevOpsSourceSchema }).parse({ panel, source });
+  return [buildsCall(parsedPanel.pipeline, parsedSource)];
+}
+var delegatedTokenFileSchema = z5.object({
+  accessToken: z5.string().min(1),
+  expiresAt: z5.string().min(1)
+});
+function buildsCall(definitionId, source) {
+  const url = apiUrl(source, "build/builds");
+  url.searchParams.set("definitions", String(definitionId));
+  if (source.branch) url.searchParams.set("branchName", adoBranch(source.branch));
+  url.searchParams.set("queryOrder", "queueTimeDescending");
+  url.searchParams.set("$top", "1");
+  return { url: url.toString(), headers: new Headers({ accept: "application/json" }) };
+}
+function apiUrl(source, suffix) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(source.organization)}/${encodeURIComponent(source.project)}/_apis/${suffix}`
+  );
+  url.searchParams.set("api-version", "7.1");
+  return url;
+}
+function adoBranch(branch) {
+  return branch.startsWith("refs/") ? branch : `refs/heads/${branch}`;
+}
+
+// packages/server/src/adapters/github-actions.ts
+import { z as z6 } from "zod";
+var pipelinePanelSchema2 = z6.object({
+  id: z6.string().min(1),
+  type: z6.literal("pipeline-status"),
+  source: z6.string().min(1),
+  /** GitHub accepts a workflow filename or numeric workflow id in this URL segment. */
+  pipeline: z6.string().min(1)
+});
+var pullRequestHealthPanelSchema = z6.object({
+  id: z6.string().min(1),
+  type: z6.literal("pull-request-health"),
+  source: z6.string().min(1),
+  base_branch: z6.string().min(1),
+  update_workflows: z6.array(
+    z6.object({
+      workflow: z6.string().min(1),
+      branch_prefixes: z6.array(z6.string().min(1)).min(1)
+    })
+  ).min(1),
+  build_workflow: z6.string().min(1)
+});
+var runSchema = z6.object({
+  id: z6.number().int().positive().optional(),
+  status: z6.string(),
+  conclusion: z6.string().nullable(),
+  name: z6.string().min(1),
+  html_url: z6.url(),
+  /** The branch that produced this run; absent for some event types. */
+  head_branch: z6.string().min(1).nullable().optional(),
+  // Timestamp quality should only remove timing advice, never make an otherwise useful run unreadable.
+  run_started_at: z6.string().nullable().optional(),
+  updated_at: z6.string().optional()
+});
+var runsSchema = z6.object({ workflow_runs: z6.array(runSchema) });
+var jobsSchema = z6.object({
+  jobs: z6.array(
+    z6.object({
+      name: z6.string().min(1),
+      status: z6.string(),
+      steps: z6.array(z6.object({ name: z6.string().min(1), status: z6.string() })).optional()
+    })
+  )
+});
+var pullRequestsSchema = z6.array(
+  z6.object({
+    number: z6.number().int().positive(),
+    html_url: z6.url(),
+    head: z6.object({ ref: z6.string().min(1) }),
+    base: z6.object({ ref: z6.string().min(1) })
   })
+);
+function permittedGithubActionsCalls(panel, source, _credentials) {
+  const { panel: parsedPanel, source: parsedSource } = z6.object({ panel: pipelinePanelSchema2, source: githubActionsSourceSchema }).parse({ panel, source });
+  const url = new URL(
+    `https://api.github.com/repos/${parsedSource.repo}/actions/workflows/${encodeURIComponent(parsedPanel.pipeline)}/runs`
+  );
+  if (parsedSource.branch) url.searchParams.set("branch", parsedSource.branch);
+  url.searchParams.set("per_page", "1");
+  return [{ url: url.toString(), headers: new Headers() }];
+}
+function pullRequestHealthCapabilities(panel) {
+  const { panel: parsed } = z6.object({ panel: pullRequestHealthPanelSchema }).parse({ panel });
+  return {
+    panel: parsed,
+    configuredUpdateWorkflow(workflow) {
+      return parsed.update_workflows.find((candidate) => candidate.workflow === workflow);
+    },
+    permitsBuildBranch(branch) {
+      return parsed.update_workflows.some(
+        ({ branch_prefixes }) => branch_prefixes.some((prefix) => branch.startsWith(prefix))
+      );
+    }
+  };
+}
+
+// packages/server/src/adapters/gitlab-ci.ts
+import { z as z7 } from "zod";
+var pipelinePanelSchema3 = z7.object({
+  id: z7.string().min(1),
+  type: z7.literal("pipeline-status"),
+  source: z7.string().min(1)
 });
-var boardConfigSchema2 = z5.object({
-  sources: z5.record(z5.string().min(1), sourceSchema2).default({}),
-  boards: z5.record(z5.string().min(1), boardSchema2),
-  auth: z5.object({
-    issuer: z5.url(),
-    client_id: z5.string().min(1).optional(),
-    allow: z5.object({
-      groups: z5.array(z5.string().min(1)).optional(),
-      subjects: z5.array(z5.string().min(1)).optional()
-    }).optional()
-  }).optional()
+var pipelineSchema = z7.object({
+  id: z7.number().int().positive(),
+  name: z7.string().min(1).nullable().optional(),
+  status: z7.string(),
+  ref: z7.string().min(1).nullable().optional(),
+  created_at: z7.string().nullable().optional(),
+  updated_at: z7.string().nullable().optional(),
+  web_url: z7.url()
 });
-function credentialEnvironmentNames2(source) {
-  return [
-    ...source.token_env ? [source.token_env] : [],
-    ...source.github_app ? [
-      source.github_app.app_id_env,
-      source.github_app.private_key_env,
-      source.github_app.installation_id_env
-    ] : []
-  ];
+function permittedGitlabCiCalls(panel, source) {
+  const { source: parsedSource } = z7.object({ panel: pipelinePanelSchema3, source: gitlabCiSourceSchema }).parse({ panel, source });
+  return [pipelinesCall(parsedSource)];
+}
+function pipelinesCall(source) {
+  const url = new URL(source.url);
+  url.pathname = `${url.pathname.replace(/\/$/, "")}/api/v4/projects/${encodeURIComponent(source.project)}/pipelines`;
+  url.searchParams.set("per_page", "1");
+  if (source.branch) url.searchParams.set("ref", source.branch);
+  return { url: url.toString(), headers: new Headers({ accept: "application/json" }) };
+}
+
+// packages/server/src/adapters/http-value.ts
+import { z as z8 } from "zod";
+function permittedHttpValueCalls(panel) {
+  const grouped = httpValueGroupedPanelSchema.safeParse(panel);
+  const urls = grouped.success ? grouped.data.facts.map((fact) => fact.url) : [z8.object({ panel: httpValueScalarPanelSchema }).parse({ panel }).panel.url];
+  return urls.map(permittedCall);
+}
+function permittedCall(value2) {
+  const url = new URL(value2);
+  if (url.protocol !== "http:" && url.protocol !== "https:")
+    throw new Error("http-value URLs must use http or https");
+  return { url: url.toString(), headers: new Headers({ accept: "application/json, text/plain" }) };
+}
+
+// packages/server/src/configuration-error.ts
+var ConfigurationError = class extends Error {
+  constructor(message2, diagnostics) {
+    super(message2);
+    this.diagnostics = diagnostics;
+  }
+  diagnostics;
+};
+function configurationLocation(path) {
+  return path.reduce(
+    (location, part) => typeof part === "number" ? `${location}[${part}]` : `${location}${location ? "." : ""}${String(part)}`,
+    ""
+  ) || "configuration";
+}
+function boardConfigurationLocation(config, path) {
+  const [record, key, ...rest] = path;
+  if ((record === "boards" || record === "sources") && key !== void 0) {
+    const entries = config && typeof config === "object" ? Reflect.get(config, record) : void 0;
+    const index = entries && typeof entries === "object" ? Object.keys(entries).indexOf(String(key)) : -1;
+    return configurationLocation([record, index, ...rest]);
+  }
+  return configurationLocation(path);
+}
+function schemaDiagnostics(error, locate, kind = "schema") {
+  return error.issues.map((issue) => ({
+    kind,
+    location: locate(issue.path),
+    constraint: correctiveConstraint(issue)
+  }));
+}
+function correctiveConstraint(issue) {
+  switch (issue.code) {
+    case "invalid_type":
+      return `Provide a value of type ${issue.expected}.`;
+    case "too_big":
+      return `Use ${issue.inclusive ? "at most" : "fewer than"} ${issue.maximum} ${issue.origin === "array" ? "entries" : issue.origin === "string" ? "characters" : "as the value"}.`;
+    case "too_small":
+      return `Use ${issue.inclusive ? "at least" : "more than"} ${issue.minimum} ${issue.origin === "array" ? "entries" : issue.origin === "string" ? "characters" : "as the value"}.`;
+    // Format messages are fixed by our schemas (or Zod); unlike custom issues they contain no authored values.
+    case "invalid_format":
+      return issue.message;
+    case "invalid_value":
+      return "Use one of the values allowed by the board schema.";
+    case "custom":
+      return typeof issue.params?.constraint === "string" ? issue.params.constraint : "Correct this field according to the board schema.";
+    default:
+      return "Provide a value matching the board schema for this field.";
+  }
+}
+
+// packages/server/src/allowlist.ts
+function deriveValidatedAllowlist(config) {
+  return derive(config, true);
+}
+function derive(config, rejectUnsupported) {
+  const allowed = /* @__PURE__ */ new Map();
+  for (const [boardName, board] of Object.entries(config.boards)) {
+    for (const panel of board.panels) {
+      const source = panel.source ? config.sources[panel.source] : void 0;
+      try {
+        const capability = panelCapability(panel, source);
+        if (capability.kind === "unsupported") {
+          if (rejectUnsupported) throw new Error("no bounded operations");
+          continue;
+        }
+        if (capability.kind === "server")
+          allowed.set(`${boardName}/${panel.id}`, new Set(capability.operations));
+      } catch (error) {
+        if (rejectUnsupported) {
+          const location = `boards[${Object.keys(config.boards).indexOf(boardName)}].panels[${board.panels.indexOf(panel)}]`;
+          throw new ConfigurationError(
+            unsupportedPanelOperation(boardName, panel, source, error).message,
+            error instanceof ZodError ? schemaDiagnostics(
+              error,
+              ([subject, ...path]) => {
+                const root = subject === "source" ? ["sources", Object.keys(config.sources).indexOf(panel.source ?? "")] : [
+                  "boards",
+                  Object.keys(config.boards).indexOf(boardName),
+                  "panels",
+                  board.panels.indexOf(panel)
+                ];
+                return configurationLocation([...root, ...path]);
+              },
+              "panel-admission"
+            ) : [
+              {
+                kind: "panel-admission",
+                location,
+                constraint: "Use a supported panel/source combination with bounded HTTP(S) operations."
+              }
+            ]
+          );
+        }
+        throw error;
+      }
+    }
+  }
+  return allowed;
+}
+function panelCapability(panel, source) {
+  if (panel.type === "pipeline-status" && source?.type === "github-actions") {
+    permittedGithubActionsCalls(panel, source);
+    return { kind: "server", operations: ["read"] };
+  }
+  if (panel.type === "pipeline-status" && source?.type === "azure-devops") {
+    permittedAzureDevOpsCalls(panel, source);
+    return { kind: "server", operations: ["read"] };
+  }
+  if (panel.type === "pipeline-status" && source?.type === "gitlab-ci") {
+    permittedGitlabCiCalls(panel, source);
+    return { kind: "server", operations: ["read"] };
+  }
+  if (panel.type === "http-value") {
+    permittedHttpValueCalls(panel);
+    return { kind: "server", operations: ["read"] };
+  }
+  if (panel.type === "pull-request-health" && source?.type === "github-actions") {
+    pullRequestHealthCapabilities(panel);
+    return {
+      kind: "server",
+      operations: ["pull-requests", "update-workflow", "pull-request-build"]
+    };
+  }
+  if (panel.type === "pipeline-animation-demo") return { kind: "client-only" };
+  return { kind: "unsupported" };
+}
+function unsupportedPanelOperation(boardName, panel, source, error) {
+  const sourceName = panel.source ?? "(none)";
+  const sourceType = source?.type ?? "(none)";
+  const detail = error instanceof Error && error.message !== "no bounded operations" ? ` ${error.message}` : "";
+  return new Error(
+    `Unsupported configured panel operation: board "${boardName}", panel "${panel.id}", source "${sourceName}" (${sourceType}), signal "${panel.type}".${detail} Configure a supported panel/source combination and all adapter-required fields.`
+  );
+}
+
+// packages/server/src/board-config.ts
+import { readFile as readFile2 } from "node:fs/promises";
+import { parse as parseYaml, YAMLParseError } from "yaml";
+async function loadBoardConfig(location, fetcher = globalThis.fetch, expectedSchemaUrl) {
+  const text = isUrl(location) ? await fetchBoardConfig(location, fetcher) : await readFile2(location, "utf-8");
+  let authoredSchemaUrl;
+  try {
+    authoredSchemaUrl = readBoardSchemaModeline(text, expectedSchemaUrl);
+  } catch (error) {
+    throw new ConfigurationError(error instanceof Error ? error.message : "Invalid modeline", [
+      {
+        kind: "modeline",
+        location: "line 1",
+        constraint: "Add a first-line yaml-language-server schema modeline ending in /board-config.schema.json."
+      }
+    ]);
+  }
+  let parsed;
+  try {
+    parsed = parseYaml(text);
+  } catch (error) {
+    const position = error instanceof YAMLParseError ? error.linePos?.[0] : void 0;
+    const location2 = position ? `line ${position.line}, column ${position.col}` : "configuration";
+    throw new ConfigurationError(
+      `Invalid board configuration YAML at ${location2}: correct YAML syntax.`,
+      [
+        {
+          kind: "yaml",
+          location: location2,
+          constraint: "Correct YAML syntax and indentation."
+        }
+      ]
+    );
+  }
+  const result = boardConfigSchema.safeParse(parsed);
+  if (!result.success) {
+    const stale = expectedSchemaUrl && authoredSchemaUrl !== expectedSchemaUrl ? `
+Stale schema modeline: expected ${expectedSchemaUrl}` : "";
+    throw new ConfigurationError(
+      `Invalid board configuration:
+${result.error.message}${stale}`,
+      schemaDiagnostics(result.error, (path) => boardConfigurationLocation(parsed, path))
+    );
+  }
+  return result.data;
+}
+function isUrl(value2) {
+  return /^https?:\/\//i.test(value2);
+}
+async function fetchBoardConfig(url, fetcher) {
+  const response = await fetcher(url);
+  if (!response.ok)
+    throw new Error(
+      `Unable to fetch board configuration from ${url}: ${response.status} ${response.statusText}`
+    );
+  return response.text();
 }
 
 // packages/aws/src/release.ts
+import { stringify } from "yaml";
 var CORE_RUNTIME_VERSION = "1.0.0";
 var CANONICAL_ASSET_DOMAIN = "https://public-assets.zegreatrob.com";
 function legacyAssetPath(version, domain = CANONICAL_ASSET_DOMAIN) {
@@ -582,22 +895,27 @@ function normalizeAssetPath(value2) {
   return assetPath;
 }
 async function validateBoardConfig(path, expectedSchemaUrl) {
-  const source = await readFile(resolve(path), "utf8");
-  const authoredSchemaUrl = readBoardSchemaModeline(source, expectedSchemaUrl);
-  const result = boardConfigSchema2.safeParse(parse(source));
-  if (!result.success) {
-    const stale = authoredSchemaUrl !== expectedSchemaUrl ? `
-Stale schema modeline: expected ${expectedSchemaUrl}` : "";
-    throw new Error(`Invalid board configuration:
-${z6.prettifyError(result.error)}${stale}`);
+  const config = await loadBoardConfig(resolve(path), void 0, expectedSchemaUrl).catch(
+    (error) => {
+      throw new Error(
+        `${path}: ${error instanceof Error ? error.message : "Invalid board configuration"}`
+      );
+    }
+  );
+  try {
+    deriveValidatedAllowlist(config);
+  } catch (error) {
+    throw new Error(
+      `${path}: ${error instanceof Error ? error.message : "Invalid panel configuration"}`
+    );
   }
   const yaml = `${boardSchemaModeline(expectedSchemaUrl)}
-${stringify(result.data, { sortMapEntries: true })}`;
+${stringify(config, { sortMapEntries: true })}`;
   return {
     yaml,
     sha256: sha256(yaml),
-    usesCredentials: Object.values(result.data.sources).some(
-      (source2) => credentialEnvironmentNames2(source2).length > 0
+    usesCredentials: Object.values(config.sources).some(
+      (source) => credentialEnvironmentNames(source).length > 0
     )
   };
 }
@@ -750,11 +1068,11 @@ async function bootstrapTemplatePath(kind, mode = "lambda") {
   return fileURLToPath(new URL(templates[kind][mode], import.meta.url));
 }
 async function bootstrapTemplate(kind, mode = "lambda") {
-  return readFile2(await bootstrapTemplatePath(kind, mode), "utf8");
+  return readFile3(await bootstrapTemplatePath(kind, mode), "utf8");
 }
 async function installedBootstrapDesiredState(config = {}) {
   const packageManifest = JSON.parse(
-    await readFile2(new URL("../package.json", import.meta.url), "utf8")
+    await readFile3(new URL("../package.json", import.meta.url), "utf8")
   );
   return desiredStateFromTemplates(
     packageVersion(packageManifest),
@@ -824,7 +1142,7 @@ function inspectTemplate(kind, path, template) {
 }
 async function bootstrapPlan(config) {
   const packageManifest = JSON.parse(
-    await readFile2(new URL("../package.json", import.meta.url), "utf8")
+    await readFile3(new URL("../package.json", import.meta.url), "utf8")
   );
   const packageTemplates = await installedTemplateInspections(computeMode(config));
   const installedDesiredState = desiredStateFromTemplates(
@@ -997,7 +1315,7 @@ function requiredBootstrapParameters(kind, values) {
 }
 
 // packages/aws/src/index.ts
-import { cp, mkdir as mkdir2, readFile as readFile4, rm, writeFile as writeFile3 } from "node:fs/promises";
+import { cp, readFile as readFile5, rm, writeFile as writeFile3 } from "node:fs/promises";
 import { join as join2, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
@@ -2039,7 +2357,7 @@ async function checkBootstrap(config, options, dependencies) {
 }
 
 // packages/aws/src/guided.ts
-import { readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
+import { readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";
 
 // packages/aws/src/handoff.ts
 var githubSubjectKeys = [
@@ -2555,7 +2873,7 @@ async function scaffoldBootstrapManifest(input) {
 async function upgradeBootstrapManifest(path) {
   let parsed;
   try {
-    parsed = JSON.parse(await readFile3(path, "utf8"));
+    parsed = JSON.parse(await readFile4(path, "utf8"));
   } catch (error) {
     throw new Error(
       `Unable to read bootstrap manifest ${path}: ${error instanceof Error ? error.message : String(error)}`
@@ -2851,11 +3169,8 @@ function deploymentTemplate(template, values) {
 }
 async function packageLambda(options) {
   const outputDir = resolve2(options.outputDir);
-  await mkdir2(outputDir, { recursive: true });
   const runtimeDir = join2(outputDir, "lambda");
-  await mkdir2(runtimeDir, { recursive: true });
   const lambdaSource = fileURLToPath2(new URL("../dist/lambda.mjs", import.meta.url));
-  await cp(lambdaSource, join2(runtimeDir, "index.mjs"));
   const release = await assembleRelease({
     boardConfigPath: options.boardConfigPath,
     outputDir: runtimeDir,
@@ -2865,12 +3180,13 @@ async function packageLambda(options) {
     assetDomain: options.assetDomain,
     secretReference: options.secretReference
   });
+  await cp(lambdaSource, join2(runtimeDir, "index.mjs"));
   const runtimeMetadata = {
     ...release.metadata,
     computeMode: "lambda",
     artifactChecksums: {
       ...release.metadata.artifactChecksums,
-      "index.mjs": sha256(await readFile4(join2(runtimeDir, "index.mjs")))
+      "index.mjs": sha256(await readFile5(join2(runtimeDir, "index.mjs")))
     }
   };
   await writeFile3(join2(runtimeDir, "release.json"), `${JSON.stringify(runtimeMetadata, null, 2)}
@@ -2885,7 +3201,7 @@ async function packageLambda(options) {
       archiveFiles.map(async (name) => [
         name,
         [
-          strToU8(await readFile4(join2(runtimeDir, name), "utf8")),
+          strToU8(await readFile5(join2(runtimeDir, name), "utf8")),
           { mtime: new Date(1980, 0, 1, 0, 0, 0), level: 9 }
         ]
       ])
@@ -2893,7 +3209,7 @@ async function packageLambda(options) {
   );
   await writeFile3(lambdaPath, zipSync(archive));
   await rm(runtimeDir, { recursive: true, force: true });
-  const lambdaChecksum = sha256(await readFile4(lambdaPath));
+  const lambdaChecksum = sha256(await readFile5(lambdaPath));
   const deploymentChecksum = sha256(JSON.stringify(runtimeMetadata));
   const packagedRelease = {
     ...runtimeMetadata,
@@ -2914,7 +3230,6 @@ async function packageLambda(options) {
 }
 async function packageEcs(options) {
   const outputDir = resolve2(options.outputDir);
-  await mkdir2(outputDir, { recursive: true });
   const imageReference = requireImageDigest(options.imageReference ?? "");
   const release = await assembleRelease({
     boardConfigPath: options.boardConfigPath,
@@ -2943,13 +3258,13 @@ async function packageEcs(options) {
   );
   await writeFile3(
     join2(outputDir, "SHA256SUMS"),
-    `${sha256(await readFile4(join2(outputDir, "release.json")))}  release.json
+    `${sha256(await readFile5(join2(outputDir, "release.json")))}  release.json
 `
   );
   return packagedRelease;
 }
 async function cloudFormationTemplate(mode = "lambda") {
-  return readFile4(
+  return readFile5(
     fileURLToPath2(
       new URL(mode === "ecs" ? "../template-ecs.yml" : "../template.yml", import.meta.url)
     ),
@@ -2991,8 +3306,8 @@ async function templateContract(parameters) {
   )?.[0];
   const metadataBlock = template.match(/^Metadata:\n[\s\S]*?(?=^Parameters:\s*$)/m)?.[0];
   if (!parametersBlock) throw new Error("template has no Parameters block");
-  const parsedParameters = parse2(parametersBlock);
-  const parsedMetadata = metadataBlock ? parse2(metadataBlock) : {};
+  const parsedParameters = parse(parametersBlock);
+  const parsedMetadata = metadataBlock ? parse(metadataBlock) : {};
   const definitions = parsedParameters.Parameters ?? {};
   const managedValue = parsedMetadata.Metadata?.PackageManagedParameters ?? [];
   if (!Array.isArray(managedValue) || !managedValue.every((key) => typeof key === "string"))
@@ -3054,7 +3369,7 @@ async function runDoctor(options, dependencies = actualDependencies) {
   let parameterData;
   await check("Parameters/template", async () => {
     const parameters = readParameterValues(
-      JSON.parse(await readFile5(options.parametersPath, "utf8"))
+      JSON.parse(await readFile6(options.parametersPath, "utf8"))
     );
     parameterData = await templateContract(parameters);
     return `${options.parametersPath} is compatible (${computeMode({ mode: parameterData.values.ComputeMode })})`;
@@ -3094,7 +3409,7 @@ async function runDoctor(options, dependencies = actualDependencies) {
     const template = await bootstrapTemplate("github-oidc");
     const expectedRevision = bootstrapTemplateRevision(template);
     await check("Bootstrap template", async () => {
-      const raw = JSON.parse(await readFile5(stackPath, "utf8"));
+      const raw = JSON.parse(await readFile6(stackPath, "utf8"));
       const stack = raw && typeof raw === "object" && "Stacks" in raw ? raw.Stacks?.[0] : raw;
       if (!stack || typeof stack !== "object")
         throw new Error("captured stack JSON contains no stack");
@@ -3132,7 +3447,7 @@ var option = (name, fallback) => {
 };
 async function installedPackageVersion() {
   const packageManifest = JSON.parse(
-    await readFile6(new URL("../package.json", import.meta.url), "utf8")
+    await readFile7(new URL("../package.json", import.meta.url), "utf8")
   );
   return typeof packageManifest.version === "string" ? packageManifest.version : "";
 }
@@ -3146,7 +3461,7 @@ function parameter(key, value2) {
 }
 async function existingParameters(path, allowMissing = false) {
   try {
-    const parsed = JSON.parse(await readFile6(path, "utf8"));
+    const parsed = JSON.parse(await readFile7(path, "utf8"));
     if (!Array.isArray(parsed)) throw new Error(`${path} must contain a JSON parameter array`);
     const values = parsed.map((value2) => {
       if (!value2 || typeof value2 !== "object" || typeof value2.ParameterKey !== "string" || typeof value2.ParameterValue !== "string")
@@ -3170,7 +3485,7 @@ function bootstrapKind() {
   throw new Error("--kind must be core or github-oidc");
 }
 async function readBootstrapConfig(path) {
-  const parsed = JSON.parse(await readFile6(path, "utf8"));
+  const parsed = JSON.parse(await readFile7(path, "utf8"));
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
     throw new Error("--config must contain a JSON object");
   return parsed;
@@ -3251,10 +3566,10 @@ async function templateParameters(mode = "lambda") {
   const template = await cloudFormationTemplate(mode);
   const block = template.match(/^Parameters:\n[\s\S]*?(?=^[A-Za-z][A-Za-z0-9]*:\s*$)/m)?.[0];
   if (!block) throw new Error("Unable to read Parameters from the CloudFormation template");
-  const parsed = parse3(block);
+  const parsed = parse2(block);
   if (!parsed.Parameters) throw new Error("CloudFormation template has no Parameters");
   const metadataBlock = template.match(/^Metadata:\n[\s\S]*?(?=^Parameters:\s*$)/m)?.[0];
-  const metadata = metadataBlock ? parse3(metadataBlock).Metadata ?? {} : {};
+  const metadata = metadataBlock ? parse2(metadataBlock).Metadata ?? {} : {};
   if (metadata.PackageManagedParameters !== void 0 && (!Array.isArray(metadata.PackageManagedParameters) || !metadata.PackageManagedParameters.every((key) => typeof key === "string")))
     throw new Error("CloudFormation template has invalid PackageManagedParameters metadata");
   const packageManaged = new Set(metadata.PackageManagedParameters ?? []);
@@ -3428,7 +3743,7 @@ try {
     if (action === "init") {
       const output = requiredOption("--output");
       try {
-        await readFile6(output, "utf8");
+        await readFile7(output, "utf8");
         throw new Error(`Refusing to overwrite existing manifest: ${output}`);
       } catch (error) {
         if (!(error && typeof error === "object" && "code" in error && error.code === "ENOENT"))
@@ -3486,9 +3801,9 @@ Review and commit this manifest before deployment.`
           config,
           configPath,
           workDir: option("--work-dir"),
-          coreStack: coreStackPath ? JSON.parse(await readFile6(coreStackPath, "utf8")) : void 0,
+          coreStack: coreStackPath ? JSON.parse(await readFile7(coreStackPath, "utf8")) : void 0,
           coreStackPath,
-          githubOidcStack: githubStackPath ? JSON.parse(await readFile6(githubStackPath, "utf8")) : void 0,
+          githubOidcStack: githubStackPath ? JSON.parse(await readFile7(githubStackPath, "utf8")) : void 0,
           githubOidcStackPath: githubStackPath,
           runner
         });
@@ -3510,9 +3825,9 @@ Review and commit this manifest before deployment.`
           config,
           configPath,
           workDir: option("--work-dir"),
-          coreStack: coreStackPath ? JSON.parse(await readFile6(coreStackPath, "utf8")) : void 0,
+          coreStack: coreStackPath ? JSON.parse(await readFile7(coreStackPath, "utf8")) : void 0,
           coreStackPath,
-          githubOidcStack: githubStackPath ? JSON.parse(await readFile6(githubStackPath, "utf8")) : void 0,
+          githubOidcStack: githubStackPath ? JSON.parse(await readFile7(githubStackPath, "utf8")) : void 0,
           githubOidcStackPath: githubStackPath,
           runner
         });
@@ -3527,8 +3842,8 @@ ${formatBootstrapRemediationText(handoff.remediation).join("\n")}`
         const githubStackPath = requiredOption("--github-oidc-stack-json");
         const verified = await verifyBootstrap({
           config,
-          coreStack: JSON.parse(await readFile6(coreStackPath, "utf8")),
-          githubOidcStack: JSON.parse(await readFile6(githubStackPath, "utf8"))
+          coreStack: JSON.parse(await readFile7(coreStackPath, "utf8")),
+          githubOidcStack: JSON.parse(await readFile7(githubStackPath, "utf8"))
         });
         printBootstrap(
           verified,
@@ -3612,7 +3927,7 @@ ${plan.notes.join("\n")}`);
         if (kind === "github-oidc" && coreStackPath) {
           coreOutputs = coreBootstrapOutputs(
             deployedBootstrapStack(
-              JSON.parse(await readFile6(coreStackPath, "utf8")),
+              JSON.parse(await readFile7(coreStackPath, "utf8")),
               bootstrapContractVersion(await bootstrapTemplate("core", mode))
             )
           );
@@ -3625,7 +3940,7 @@ ${plan.notes.join("\n")}`);
         const deployedStackPath = option("--deployed-stack-json");
         if (deployedStackPath) {
           const stack = deployedBootstrapStack(
-            JSON.parse(await readFile6(deployedStackPath, "utf8")),
+            JSON.parse(await readFile7(deployedStackPath, "utf8")),
             bootstrapContractVersion(await bootstrapTemplate(kind, mode))
           );
           if (kind === "github-oidc" && !(stack.Parameters ?? []).some(