@continuous-excellence/ze-great-dashboard-aws 0.30.6 → 0.31.0

package/dist/cli.js

@@ -320,14 +320,41 @@ var boardSchema = z2.object({
       params: { constraint: "Important panels require one board attention treatment." }
     });
 });
+var authorizationSchema = z2.discriminatedUnion("mode", [
+  z2.strictObject({ mode: z2.literal("authenticated") }),
+  z2.strictObject({ mode: z2.literal("subjects"), subjects: z2.array(z2.string().min(1)).min(1) }),
+  z2.strictObject({
+    mode: z2.literal("claim"),
+    /** Exact JWT payload key; namespaced provider claims are keys, never path expressions. */
+    claim: z2.string().min(1),
+    values: z2.array(z2.string().min(1)).min(1),
+    match: z2.enum(["any", "all"])
+  })
+]);
+var legacySubjectAllowSchema = z2.strictObject({ subjects: z2.array(z2.string().min(1)).min(1) });
 var authSchema = z2.strictObject({
   issuer: z2.url(),
   /** Browser SPA client id. It is public, unlike every source credential. */
   client_id: z2.string().min(1),
   /** The separately registered API resource accepted by the dashboard proxy. */
   audience: z2.string().min(1),
-  /** A deliberately portable, explicit identity boundary for the first direct-OIDC release. */
-  allow: z2.strictObject({ subjects: z2.array(z2.string().min(1)).min(1) })
+  /** Canonical authorization policy. */
+  authorization: authorizationSchema.optional(),
+  /** Legacy subject policy retained only for a configuration migration. */
+  allow: legacySubjectAllowSchema.optional()
+}).superRefine((auth, ctx) => {
+  if (!auth.authorization && !auth.allow)
+    ctx.addIssue({
+      code: "custom",
+      path: ["authorization"],
+      message: "configure authorization, or the legacy allow.subjects migration policy"
+    });
+  if (auth.authorization && auth.allow)
+    ctx.addIssue({
+      code: "custom",
+      path: ["authorization"],
+      message: "configure authorization or legacy allow.subjects, not both"
+    });
 });
 var securityPolicies = ["warn", "required", "unsecured"];
 var securityPolicySchema = z2.enum(securityPolicies);
@@ -537,43 +564,58 @@ var httpValueSchema = z4.object({
   value: z4.union([z4.string(), z4.number(), z4.boolean()])
 });
 
-// packages/server/src/adapters/azure-devops.ts
+// packages/shared/src/security-details.ts
 import { z as z5 } from "zod";
-var pipelinePanelSchema = z5.object({
-  id: z5.string().min(1),
-  type: z5.literal("pipeline-status"),
-  source: z5.string().min(1),
-  pipeline: z5.number().int().positive()
+var securityDetailsResponseSchema = z5.strictObject({
+  oidc: z5.literal(true),
+  policy: z5.discriminatedUnion("mode", [
+    z5.strictObject({ mode: z5.literal("authenticated") }),
+    z5.strictObject({ mode: z5.literal("subjects") }),
+    z5.strictObject({
+      mode: z5.literal("claim"),
+      claim: z5.string().min(1),
+      match: z5.enum(["any", "all"])
+    })
+  ])
+});
+
+// packages/server/src/adapters/azure-devops.ts
+import { z as z6 } from "zod";
+var pipelinePanelSchema = z6.object({
+  id: z6.string().min(1),
+  type: z6.literal("pipeline-status"),
+  source: z6.string().min(1),
+  pipeline: z6.number().int().positive()
 });
-var buildSchema = z5.object({
-  id: z5.number().int().positive(),
-  buildNumber: z5.string().min(1),
-  status: z5.string().nullable().optional(),
-  result: z5.string().nullable().optional(),
-  sourceBranch: z5.string().min(1).nullable().optional(),
-  startTime: z5.string().nullable().optional(),
-  finishTime: z5.string().nullable().optional(),
-  lastChangedDate: z5.string().nullable().optional()
+var buildSchema = z6.object({
+  id: z6.number().int().positive(),
+  buildNumber: z6.string().min(1),
+  status: z6.string().nullable().optional(),
+  result: z6.string().nullable().optional(),
+  sourceBranch: z6.string().min(1).nullable().optional(),
+  startTime: z6.string().nullable().optional(),
+  finishTime: z6.string().nullable().optional(),
+  lastChangedDate: z6.string().nullable().optional()
 });
-var buildsSchema = z5.object({ value: z5.array(buildSchema) });
-var timelineSchema = z5.object({
-  records: z5.array(
-    z5.object({
-      id: z5.string().min(1),
-      parentId: z5.string().min(1).nullable().optional(),
-      type: z5.string().min(1),
-      name: z5.string().min(1),
-      state: z5.string().nullable().optional()
+var buildsSchema = z6.object({ value: z6.array(buildSchema) });
+var timelineSchema = z6.object({
+  records: z6.array(
+    z6.object({
+      id: z6.string().min(1),
+      parentId: z6.string().min(1).nullable().optional(),
+      type: z6.string().min(1),
+      name: z6.string().min(1),
+      state: z6.string().nullable().optional()
     })
   )
 });
 function permittedAzureDevOpsCalls(panel, source) {
-  const { panel: parsedPanel, source: parsedSource } = z5.object({ panel: pipelinePanelSchema, source: azureDevOpsSourceSchema }).parse({ panel, source });
+  const { panel: parsedPanel, source: parsedSource } = z6.object({ panel: pipelinePanelSchema, source: azureDevOpsSourceSchema }).parse({ panel, source });
   return [buildsCall(parsedPanel.pipeline, parsedSource)];
 }
-var delegatedTokenFileSchema = z5.object({
-  accessToken: z5.string().min(1),
-  expiresAt: z5.string().min(1)
+var delegatedTokenFileSchema = z6.object({
+  accessToken: z6.string().min(1),
+  expiresAt: z6.string().min(1)
 });
 function buildsCall(definitionId, source) {
   const url = apiUrl(source, "build/builds");
@@ -595,59 +637,59 @@ function adoBranch(branch) {
 }
 
 // packages/server/src/adapters/github-actions.ts
-import { z as z6 } from "zod";
-var pipelinePanelSchema2 = z6.object({
-  id: z6.string().min(1),
-  type: z6.literal("pipeline-status"),
-  source: z6.string().min(1),
+import { z as z7 } from "zod";
+var pipelinePanelSchema2 = z7.object({
+  id: z7.string().min(1),
+  type: z7.literal("pipeline-status"),
+  source: z7.string().min(1),
   /** GitHub accepts a workflow filename or numeric workflow id in this URL segment. */
-  pipeline: z6.string().min(1)
+  pipeline: z7.string().min(1)
 });
-var pullRequestHealthPanelSchema = z6.object({
-  id: z6.string().min(1),
-  type: z6.literal("pull-request-health"),
-  source: z6.string().min(1),
-  base_branch: z6.string().min(1),
-  update_workflows: z6.array(
-    z6.object({
-      workflow: z6.string().min(1),
-      branch_prefixes: z6.array(z6.string().min(1)).min(1)
+var pullRequestHealthPanelSchema = z7.object({
+  id: z7.string().min(1),
+  type: z7.literal("pull-request-health"),
+  source: z7.string().min(1),
+  base_branch: z7.string().min(1),
+  update_workflows: z7.array(
+    z7.object({
+      workflow: z7.string().min(1),
+      branch_prefixes: z7.array(z7.string().min(1)).min(1)
     })
   ).min(1),
-  build_workflow: z6.string().min(1)
+  build_workflow: z7.string().min(1)
 });
-var runSchema = z6.object({
-  id: z6.number().int().positive().optional(),
-  status: z6.string(),
-  conclusion: z6.string().nullable(),
-  name: z6.string().min(1),
-  html_url: z6.url(),
+var runSchema = z7.object({
+  id: z7.number().int().positive().optional(),
+  status: z7.string(),
+  conclusion: z7.string().nullable(),
+  name: z7.string().min(1),
+  html_url: z7.url(),
   /** The branch that produced this run; absent for some event types. */
-  head_branch: z6.string().min(1).nullable().optional(),
+  head_branch: z7.string().min(1).nullable().optional(),
   // Timestamp quality should only remove timing advice, never make an otherwise useful run unreadable.
-  run_started_at: z6.string().nullable().optional(),
-  updated_at: z6.string().optional()
+  run_started_at: z7.string().nullable().optional(),
+  updated_at: z7.string().optional()
 });
-var runsSchema = z6.object({ workflow_runs: z6.array(runSchema) });
-var jobsSchema = z6.object({
-  jobs: z6.array(
-    z6.object({
-      name: z6.string().min(1),
-      status: z6.string(),
-      steps: z6.array(z6.object({ name: z6.string().min(1), status: z6.string() })).optional()
+var runsSchema = z7.object({ workflow_runs: z7.array(runSchema) });
+var jobsSchema = z7.object({
+  jobs: z7.array(
+    z7.object({
+      name: z7.string().min(1),
+      status: z7.string(),
+      steps: z7.array(z7.object({ name: z7.string().min(1), status: z7.string() })).optional()
     })
   )
 });
-var pullRequestsSchema = z6.array(
-  z6.object({
-    number: z6.number().int().positive(),
-    html_url: z6.url(),
-    head: z6.object({ ref: z6.string().min(1) }),
-    base: z6.object({ ref: z6.string().min(1) })
+var pullRequestsSchema = z7.array(
+  z7.object({
+    number: z7.number().int().positive(),
+    html_url: z7.url(),
+    head: z7.object({ ref: z7.string().min(1) }),
+    base: z7.object({ ref: z7.string().min(1) })
   })
 );
 function permittedGithubActionsCalls(panel, source, _credentials) {
-  const { panel: parsedPanel, source: parsedSource } = z6.object({ panel: pipelinePanelSchema2, source: githubActionsSourceSchema }).parse({ panel, source });
+  const { panel: parsedPanel, source: parsedSource } = z7.object({ panel: pipelinePanelSchema2, source: githubActionsSourceSchema }).parse({ panel, source });
   const url = new URL(
     `https://api.github.com/repos/${parsedSource.repo}/actions/workflows/${encodeURIComponent(parsedPanel.pipeline)}/runs`
   );
@@ -656,7 +698,7 @@ function permittedGithubActionsCalls(panel, source, _credentials) {
   return [{ url: url.toString(), headers: new Headers() }];
 }
 function pullRequestHealthCapabilities(panel) {
-  const { panel: parsed } = z6.object({ panel: pullRequestHealthPanelSchema }).parse({ panel });
+  const { panel: parsed } = z7.object({ panel: pullRequestHealthPanelSchema }).parse({ panel });
   return {
     panel: parsed,
     configuredUpdateWorkflow(workflow) {
@@ -671,23 +713,23 @@ function pullRequestHealthCapabilities(panel) {
 }
 
 // packages/server/src/adapters/gitlab-ci.ts
-import { z as z7 } from "zod";
-var pipelinePanelSchema3 = z7.object({
-  id: z7.string().min(1),
-  type: z7.literal("pipeline-status"),
-  source: z7.string().min(1)
+import { z as z8 } from "zod";
+var pipelinePanelSchema3 = z8.object({
+  id: z8.string().min(1),
+  type: z8.literal("pipeline-status"),
+  source: z8.string().min(1)
 });
-var pipelineSchema = z7.object({
-  id: z7.number().int().positive(),
-  name: z7.string().min(1).nullable().optional(),
-  status: z7.string(),
-  ref: z7.string().min(1).nullable().optional(),
-  created_at: z7.string().nullable().optional(),
-  updated_at: z7.string().nullable().optional(),
-  web_url: z7.url()
+var pipelineSchema = z8.object({
+  id: z8.number().int().positive(),
+  name: z8.string().min(1).nullable().optional(),
+  status: z8.string(),
+  ref: z8.string().min(1).nullable().optional(),
+  created_at: z8.string().nullable().optional(),
+  updated_at: z8.string().nullable().optional(),
+  web_url: z8.url()
 });
 function permittedGitlabCiCalls(panel, source) {
-  const { source: parsedSource } = z7.object({ panel: pipelinePanelSchema3, source: gitlabCiSourceSchema }).parse({ panel, source });
+  const { source: parsedSource } = z8.object({ panel: pipelinePanelSchema3, source: gitlabCiSourceSchema }).parse({ panel, source });
   return [pipelinesCall(parsedSource)];
 }
 function pipelinesCall(source) {
@@ -699,10 +741,10 @@ function pipelinesCall(source) {
 }
 
 // packages/server/src/adapters/http-value.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 function permittedHttpValueCalls(panel) {
   const grouped = httpValueGroupedPanelSchema.safeParse(panel);
-  const urls = grouped.success ? grouped.data.facts.map((fact) => fact.url) : [z8.object({ panel: httpValueScalarPanelSchema }).parse({ panel }).panel.url];
+  const urls = grouped.success ? grouped.data.facts.map((fact) => fact.url) : [z9.object({ panel: httpValueScalarPanelSchema }).parse({ panel }).panel.url];
   return urls.map(permittedCall);
 }
 function permittedCall(value2) {

package/dist/index.js

@@ -1001,14 +1001,41 @@ var boardSchema = z2.object({
       params: { constraint: "Important panels require one board attention treatment." }
     });
 });
+var authorizationSchema = z2.discriminatedUnion("mode", [
+  z2.strictObject({ mode: z2.literal("authenticated") }),
+  z2.strictObject({ mode: z2.literal("subjects"), subjects: z2.array(z2.string().min(1)).min(1) }),
+  z2.strictObject({
+    mode: z2.literal("claim"),
+    /** Exact JWT payload key; namespaced provider claims are keys, never path expressions. */
+    claim: z2.string().min(1),
+    values: z2.array(z2.string().min(1)).min(1),
+    match: z2.enum(["any", "all"])
+  })
+]);
+var legacySubjectAllowSchema = z2.strictObject({ subjects: z2.array(z2.string().min(1)).min(1) });
 var authSchema = z2.strictObject({
   issuer: z2.url(),
   /** Browser SPA client id. It is public, unlike every source credential. */
   client_id: z2.string().min(1),
   /** The separately registered API resource accepted by the dashboard proxy. */
   audience: z2.string().min(1),
-  /** A deliberately portable, explicit identity boundary for the first direct-OIDC release. */
-  allow: z2.strictObject({ subjects: z2.array(z2.string().min(1)).min(1) })
+  /** Canonical authorization policy. */
+  authorization: authorizationSchema.optional(),
+  /** Legacy subject policy retained only for a configuration migration. */
+  allow: legacySubjectAllowSchema.optional()
+}).superRefine((auth, ctx) => {
+  if (!auth.authorization && !auth.allow)
+    ctx.addIssue({
+      code: "custom",
+      path: ["authorization"],
+      message: "configure authorization, or the legacy allow.subjects migration policy"
+    });
+  if (auth.authorization && auth.allow)
+    ctx.addIssue({
+      code: "custom",
+      path: ["authorization"],
+      message: "configure authorization or legacy allow.subjects, not both"
+    });
 });
 var securityPolicies = ["warn", "required", "unsecured"];
 var securityPolicySchema = z2.enum(securityPolicies);
@@ -1218,43 +1245,58 @@ var httpValueSchema = z4.object({
   value: z4.union([z4.string(), z4.number(), z4.boolean()])
 });
 
-// packages/server/src/adapters/azure-devops.ts
+// packages/shared/src/security-details.ts
 import { z as z5 } from "zod";
-var pipelinePanelSchema = z5.object({
-  id: z5.string().min(1),
-  type: z5.literal("pipeline-status"),
-  source: z5.string().min(1),
-  pipeline: z5.number().int().positive()
+var securityDetailsResponseSchema = z5.strictObject({
+  oidc: z5.literal(true),
+  policy: z5.discriminatedUnion("mode", [
+    z5.strictObject({ mode: z5.literal("authenticated") }),
+    z5.strictObject({ mode: z5.literal("subjects") }),
+    z5.strictObject({
+      mode: z5.literal("claim"),
+      claim: z5.string().min(1),
+      match: z5.enum(["any", "all"])
+    })
+  ])
 });
-var buildSchema = z5.object({
-  id: z5.number().int().positive(),
-  buildNumber: z5.string().min(1),
-  status: z5.string().nullable().optional(),
-  result: z5.string().nullable().optional(),
-  sourceBranch: z5.string().min(1).nullable().optional(),
-  startTime: z5.string().nullable().optional(),
-  finishTime: z5.string().nullable().optional(),
-  lastChangedDate: z5.string().nullable().optional()
+
+// packages/server/src/adapters/azure-devops.ts
+import { z as z6 } from "zod";
+var pipelinePanelSchema = z6.object({
+  id: z6.string().min(1),
+  type: z6.literal("pipeline-status"),
+  source: z6.string().min(1),
+  pipeline: z6.number().int().positive()
+});
+var buildSchema = z6.object({
+  id: z6.number().int().positive(),
+  buildNumber: z6.string().min(1),
+  status: z6.string().nullable().optional(),
+  result: z6.string().nullable().optional(),
+  sourceBranch: z6.string().min(1).nullable().optional(),
+  startTime: z6.string().nullable().optional(),
+  finishTime: z6.string().nullable().optional(),
+  lastChangedDate: z6.string().nullable().optional()
 });
-var buildsSchema = z5.object({ value: z5.array(buildSchema) });
-var timelineSchema = z5.object({
-  records: z5.array(
-    z5.object({
-      id: z5.string().min(1),
-      parentId: z5.string().min(1).nullable().optional(),
-      type: z5.string().min(1),
-      name: z5.string().min(1),
-      state: z5.string().nullable().optional()
+var buildsSchema = z6.object({ value: z6.array(buildSchema) });
+var timelineSchema = z6.object({
+  records: z6.array(
+    z6.object({
+      id: z6.string().min(1),
+      parentId: z6.string().min(1).nullable().optional(),
+      type: z6.string().min(1),
+      name: z6.string().min(1),
+      state: z6.string().nullable().optional()
     })
   )
 });
 function permittedAzureDevOpsCalls(panel, source) {
-  const { panel: parsedPanel, source: parsedSource } = z5.object({ panel: pipelinePanelSchema, source: azureDevOpsSourceSchema }).parse({ panel, source });
+  const { panel: parsedPanel, source: parsedSource } = z6.object({ panel: pipelinePanelSchema, source: azureDevOpsSourceSchema }).parse({ panel, source });
   return [buildsCall(parsedPanel.pipeline, parsedSource)];
 }
-var delegatedTokenFileSchema = z5.object({
-  accessToken: z5.string().min(1),
-  expiresAt: z5.string().min(1)
+var delegatedTokenFileSchema = z6.object({
+  accessToken: z6.string().min(1),
+  expiresAt: z6.string().min(1)
 });
 function buildsCall(definitionId, source) {
   const url = apiUrl(source, "build/builds");
@@ -1276,59 +1318,59 @@ function adoBranch(branch) {
 }
 
 // packages/server/src/adapters/github-actions.ts
-import { z as z6 } from "zod";
-var pipelinePanelSchema2 = z6.object({
-  id: z6.string().min(1),
-  type: z6.literal("pipeline-status"),
-  source: z6.string().min(1),
+import { z as z7 } from "zod";
+var pipelinePanelSchema2 = z7.object({
+  id: z7.string().min(1),
+  type: z7.literal("pipeline-status"),
+  source: z7.string().min(1),
   /** GitHub accepts a workflow filename or numeric workflow id in this URL segment. */
-  pipeline: z6.string().min(1)
+  pipeline: z7.string().min(1)
 });
-var pullRequestHealthPanelSchema = z6.object({
-  id: z6.string().min(1),
-  type: z6.literal("pull-request-health"),
-  source: z6.string().min(1),
-  base_branch: z6.string().min(1),
-  update_workflows: z6.array(
-    z6.object({
-      workflow: z6.string().min(1),
-      branch_prefixes: z6.array(z6.string().min(1)).min(1)
+var pullRequestHealthPanelSchema = z7.object({
+  id: z7.string().min(1),
+  type: z7.literal("pull-request-health"),
+  source: z7.string().min(1),
+  base_branch: z7.string().min(1),
+  update_workflows: z7.array(
+    z7.object({
+      workflow: z7.string().min(1),
+      branch_prefixes: z7.array(z7.string().min(1)).min(1)
     })
   ).min(1),
-  build_workflow: z6.string().min(1)
+  build_workflow: z7.string().min(1)
 });
-var runSchema = z6.object({
-  id: z6.number().int().positive().optional(),
-  status: z6.string(),
-  conclusion: z6.string().nullable(),
-  name: z6.string().min(1),
-  html_url: z6.url(),
+var runSchema = z7.object({
+  id: z7.number().int().positive().optional(),
+  status: z7.string(),
+  conclusion: z7.string().nullable(),
+  name: z7.string().min(1),
+  html_url: z7.url(),
   /** The branch that produced this run; absent for some event types. */
-  head_branch: z6.string().min(1).nullable().optional(),
+  head_branch: z7.string().min(1).nullable().optional(),
   // Timestamp quality should only remove timing advice, never make an otherwise useful run unreadable.
-  run_started_at: z6.string().nullable().optional(),
-  updated_at: z6.string().optional()
+  run_started_at: z7.string().nullable().optional(),
+  updated_at: z7.string().optional()
 });
-var runsSchema = z6.object({ workflow_runs: z6.array(runSchema) });
-var jobsSchema = z6.object({
-  jobs: z6.array(
-    z6.object({
-      name: z6.string().min(1),
-      status: z6.string(),
-      steps: z6.array(z6.object({ name: z6.string().min(1), status: z6.string() })).optional()
+var runsSchema = z7.object({ workflow_runs: z7.array(runSchema) });
+var jobsSchema = z7.object({
+  jobs: z7.array(
+    z7.object({
+      name: z7.string().min(1),
+      status: z7.string(),
+      steps: z7.array(z7.object({ name: z7.string().min(1), status: z7.string() })).optional()
     })
   )
 });
-var pullRequestsSchema = z6.array(
-  z6.object({
-    number: z6.number().int().positive(),
-    html_url: z6.url(),
-    head: z6.object({ ref: z6.string().min(1) }),
-    base: z6.object({ ref: z6.string().min(1) })
+var pullRequestsSchema = z7.array(
+  z7.object({
+    number: z7.number().int().positive(),
+    html_url: z7.url(),
+    head: z7.object({ ref: z7.string().min(1) }),
+    base: z7.object({ ref: z7.string().min(1) })
   })
 );
 function permittedGithubActionsCalls(panel, source, _credentials) {
-  const { panel: parsedPanel, source: parsedSource } = z6.object({ panel: pipelinePanelSchema2, source: githubActionsSourceSchema }).parse({ panel, source });
+  const { panel: parsedPanel, source: parsedSource } = z7.object({ panel: pipelinePanelSchema2, source: githubActionsSourceSchema }).parse({ panel, source });
   const url = new URL(
     `https://api.github.com/repos/${parsedSource.repo}/actions/workflows/${encodeURIComponent(parsedPanel.pipeline)}/runs`
   );
@@ -1337,7 +1379,7 @@ function permittedGithubActionsCalls(panel, source, _credentials) {
   return [{ url: url.toString(), headers: new Headers() }];
 }
 function pullRequestHealthCapabilities(panel) {
-  const { panel: parsed } = z6.object({ panel: pullRequestHealthPanelSchema }).parse({ panel });
+  const { panel: parsed } = z7.object({ panel: pullRequestHealthPanelSchema }).parse({ panel });
   return {
     panel: parsed,
     configuredUpdateWorkflow(workflow) {
@@ -1352,23 +1394,23 @@ function pullRequestHealthCapabilities(panel) {
 }
 
 // packages/server/src/adapters/gitlab-ci.ts
-import { z as z7 } from "zod";
-var pipelinePanelSchema3 = z7.object({
-  id: z7.string().min(1),
-  type: z7.literal("pipeline-status"),
-  source: z7.string().min(1)
+import { z as z8 } from "zod";
+var pipelinePanelSchema3 = z8.object({
+  id: z8.string().min(1),
+  type: z8.literal("pipeline-status"),
+  source: z8.string().min(1)
 });
-var pipelineSchema = z7.object({
-  id: z7.number().int().positive(),
-  name: z7.string().min(1).nullable().optional(),
-  status: z7.string(),
-  ref: z7.string().min(1).nullable().optional(),
-  created_at: z7.string().nullable().optional(),
-  updated_at: z7.string().nullable().optional(),
-  web_url: z7.url()
+var pipelineSchema = z8.object({
+  id: z8.number().int().positive(),
+  name: z8.string().min(1).nullable().optional(),
+  status: z8.string(),
+  ref: z8.string().min(1).nullable().optional(),
+  created_at: z8.string().nullable().optional(),
+  updated_at: z8.string().nullable().optional(),
+  web_url: z8.url()
 });
 function permittedGitlabCiCalls(panel, source) {
-  const { source: parsedSource } = z7.object({ panel: pipelinePanelSchema3, source: gitlabCiSourceSchema }).parse({ panel, source });
+  const { source: parsedSource } = z8.object({ panel: pipelinePanelSchema3, source: gitlabCiSourceSchema }).parse({ panel, source });
   return [pipelinesCall(parsedSource)];
 }
 function pipelinesCall(source) {
@@ -1380,10 +1422,10 @@ function pipelinesCall(source) {
 }
 
 // packages/server/src/adapters/http-value.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 function permittedHttpValueCalls(panel) {
   const grouped = httpValueGroupedPanelSchema.safeParse(panel);
-  const urls = grouped.success ? grouped.data.facts.map((fact) => fact.url) : [z8.object({ panel: httpValueScalarPanelSchema }).parse({ panel }).panel.url];
+  const urls = grouped.success ? grouped.data.facts.map((fact) => fact.url) : [z9.object({ panel: httpValueScalarPanelSchema }).parse({ panel }).panel.url];
   return urls.map(permittedCall);
 }
 function permittedCall(value2) {

package/dist/lambda.mjs

@@ -69356,15 +69356,47 @@ var boardSchema = external_exports.object({
       params: { constraint: "Important panels require one board attention treatment." }
     });
 });
+var authorizationSchema = external_exports.discriminatedUnion("mode", [
+  external_exports.strictObject({ mode: external_exports.literal("authenticated") }),
+  external_exports.strictObject({ mode: external_exports.literal("subjects"), subjects: external_exports.array(external_exports.string().min(1)).min(1) }),
+  external_exports.strictObject({
+    mode: external_exports.literal("claim"),
+    /** Exact JWT payload key; namespaced provider claims are keys, never path expressions. */
+    claim: external_exports.string().min(1),
+    values: external_exports.array(external_exports.string().min(1)).min(1),
+    match: external_exports.enum(["any", "all"])
+  })
+]);
+var legacySubjectAllowSchema = external_exports.strictObject({ subjects: external_exports.array(external_exports.string().min(1)).min(1) });
 var authSchema = external_exports.strictObject({
   issuer: external_exports.url(),
   /** Browser SPA client id. It is public, unlike every source credential. */
   client_id: external_exports.string().min(1),
   /** The separately registered API resource accepted by the dashboard proxy. */
   audience: external_exports.string().min(1),
-  /** A deliberately portable, explicit identity boundary for the first direct-OIDC release. */
-  allow: external_exports.strictObject({ subjects: external_exports.array(external_exports.string().min(1)).min(1) })
+  /** Canonical authorization policy. */
+  authorization: authorizationSchema.optional(),
+  /** Legacy subject policy retained only for a configuration migration. */
+  allow: legacySubjectAllowSchema.optional()
+}).superRefine((auth, ctx) => {
+  if (!auth.authorization && !auth.allow)
+    ctx.addIssue({
+      code: "custom",
+      path: ["authorization"],
+      message: "configure authorization, or the legacy allow.subjects migration policy"
+    });
+  if (auth.authorization && auth.allow)
+    ctx.addIssue({
+      code: "custom",
+      path: ["authorization"],
+      message: "configure authorization or legacy allow.subjects, not both"
+    });
 });
+function authorizationForAuth(auth) {
+  if (auth.authorization) return auth.authorization;
+  if (auth.allow) return { mode: "subjects", subjects: auth.allow.subjects };
+  throw new Error("OIDC authorization policy is missing.");
+}
 var securityPolicies = ["warn", "required", "unsecured"];
 var securityPolicySchema = external_exports.enum(securityPolicies);
 var boardConfigSchema = external_exports.object({
@@ -69647,6 +69679,20 @@ function nearestLegalRectangle(desired, accepted) {
   return { x: candidate.x, y: candidate.y, w: candidate.w, h: candidate.h };
 }
 
+// packages/shared/src/security-details.ts
+var securityDetailsResponseSchema = external_exports.strictObject({
+  oidc: external_exports.literal(true),
+  policy: external_exports.discriminatedUnion("mode", [
+    external_exports.strictObject({ mode: external_exports.literal("authenticated") }),
+    external_exports.strictObject({ mode: external_exports.literal("subjects") }),
+    external_exports.strictObject({
+      mode: external_exports.literal("claim"),
+      claim: external_exports.string().min(1),
+      match: external_exports.enum(["any", "all"])
+    })
+  ])
+});
+
 // packages/server/src/adapters/azure-devops.ts
 import { readFile } from "node:fs/promises";
 
@@ -73865,14 +73911,22 @@ async function createAccessTokenVerifier(auth, fetcher = globalThis.fetch) {
     const { payload: payload2 } = await jwtVerify(token, keys, { issuer, audience: auth.audience });
     if (typeof payload2.sub !== "string" || !payload2.sub)
       throw new Error("Access token has no subject.");
-    if (!auth.allow.subjects.includes(payload2.sub)) {
+    if (!permitsIdentity(authorizationForAuth(auth), payload2.sub, payload2)) {
       const error63 = new Error("Authenticated subject is not allowed to view this dashboard.");
-      error63.name = "UnauthorizedSubjectError";
+      error63.name = "AccessDeniedError";
       throw error63;
     }
     return { subject: payload2.sub };
   };
 }
+function permitsIdentity(policy, subject, claims) {
+  if (policy.mode === "authenticated") return true;
+  if (policy.mode === "subjects") return policy.subjects.includes(subject);
+  const value = claims[policy.claim];
+  const actual = typeof value === "string" && value.length > 0 ? [value] : Array.isArray(value) && value.every((item) => typeof item === "string" && item.length > 0) ? value : void 0;
+  if (!actual) return false;
+  return policy.match === "any" ? policy.values.some((expected) => actual.includes(expected)) : policy.values.every((expected) => actual.includes(expected));
+}
 async function fetchJson(url2, fetcher) {
   const response = await fetcher(url2);
   if (!response.ok) throw new Error(`OIDC discovery request failed: ${response.status}`);
@@ -73882,8 +73936,8 @@ async function fetchJson(url2, fetcher) {
     throw new Error("OIDC discovery did not return JSON.");
   }
 }
-function unauthorizedSubject(error63) {
-  return error63 instanceof Error && error63.name === "UnauthorizedSubjectError";
+function accessDenied(error63) {
+  return error63 instanceof Error && error63.name === "AccessDeniedError";
 }
 
 // packages/server/src/template.ts
@@ -73992,8 +74046,8 @@ function createApp(deps) {
       await deps.accessTokenVerifier(authorization.slice("Bearer ".length));
     } catch (error63) {
       return c5.json(
-        { error: unauthorizedSubject(error63) ? "Access denied." : "Invalid access token." },
-        unauthorizedSubject(error63) ? 403 : 401
+        { error: accessDenied(error63) ? "Access denied." : "Invalid access token." },
+        accessDenied(error63) ? 403 : 401
       );
     }
     return next();
@@ -74035,6 +74089,17 @@ function createApp(deps) {
       })
     });
   });
+  app.get("/api/boards/:board/security", (c5) => {
+    if (!deps.boardConfig?.boards[c5.req.param("board")] || !deps.boardConfig.auth)
+      return c5.notFound();
+    const policy = authorizationForAuth(deps.boardConfig.auth);
+    return c5.json(
+      securityDetailsResponseSchema.parse({
+        oidc: true,
+        policy: policy.mode === "claim" ? { mode: policy.mode, claim: policy.claim, match: policy.match } : { mode: policy.mode }
+      })
+    );
+  });
   const layoutDownload = (c5, mode) => {
     const boardName = c5.req.param("board");
     const board = deps.boardConfig?.boards[boardName];
@@ -74055,8 +74120,7 @@ function createApp(deps) {
     const outputConfig = {
       sources,
       boards: { [boardName]: outputBoard },
-      ...deps.boardConfig.security ? { security: deps.boardConfig.security } : {},
-      ...deps.boardConfig.auth ? { auth: deps.boardConfig.auth } : {}
+      ...deps.boardConfig.security ? { security: deps.boardConfig.security } : {}
     };
     const filenameBoard = safeDownloadFilename(boardName);
     return new Response(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@continuous-excellence/ze-great-dashboard-aws",
-  "version": "0.30.6",
+  "version": "0.31.0",
   "type": "module",
   "description": "AWS server runtime and CloudFormation deployment tooling for Ze Great Dashboard.",
   "keywords": [