@continuous-excellence/ze-great-dashboard-aws 0.31.46 → 0.31.48

package/dist/index.js

@@ -7,10 +7,10 @@ import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { createRequire } from "module";
 var require2 = createRequire("/");
 var _a;
-var Worker;
+var Worker2;
 var isMarkedAsUntransferable;
 try {
-  _a = require2("worker_threads"), Worker = _a.Worker, isMarkedAsUntransferable = _a.isMarkedAsUntransferable;
+  _a = require2("worker_threads"), Worker2 = _a.Worker, isMarkedAsUntransferable = _a.isMarkedAsUntransferable;
 } catch (e) {
 }
 var u8 = Uint8Array;
@@ -90,13 +90,13 @@ var fdeb = new u8([
 var clim = new u8([16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15]);
 var freb = function(eb, start) {
   var b = new u16(31);
-  for (var i2 = 0; i2 < 31; ++i2) {
-    b[i2] = start += 1 << eb[i2 - 1];
+  for (var i3 = 0; i3 < 31; ++i3) {
+    b[i3] = start += 1 << eb[i3 - 1];
   }
   var r = new i32(b[30]);
-  for (var i2 = 1; i2 < 30; ++i2) {
-    for (var j = b[i2]; j < b[i2 + 1]; ++j) {
-      r[j] = j - b[i2] << 5 | i2;
+  for (var i3 = 1; i3 < 30; ++i3) {
+    for (var j = b[i3]; j < b[i3 + 1]; ++j) {
+      r[j] = j - b[i3] << 5 | i3;
     }
   }
   return { b, r };
@@ -119,25 +119,25 @@ var x;
 var i;
 var hMap = (function(cd, mb, r) {
   var s = cd.length;
-  var i2 = 0;
+  var i3 = 0;
   var l = new u16(mb);
-  for (; i2 < s; ++i2) {
-    if (cd[i2])
-      ++l[cd[i2] - 1];
+  for (; i3 < s; ++i3) {
+    if (cd[i3])
+      ++l[cd[i3] - 1];
   }
   var le = new u16(mb);
-  for (i2 = 1; i2 < mb; ++i2) {
-    le[i2] = le[i2 - 1] + l[i2 - 1] << 1;
+  for (i3 = 1; i3 < mb; ++i3) {
+    le[i3] = le[i3 - 1] + l[i3 - 1] << 1;
   }
   var co;
   if (r) {
     co = new u16(1 << mb);
     var rvb = 15 - mb;
-    for (i2 = 0; i2 < s; ++i2) {
-      if (cd[i2]) {
-        var sv = i2 << 4 | cd[i2];
-        var r_1 = mb - cd[i2];
-        var v = le[cd[i2] - 1]++ << r_1;
+    for (i3 = 0; i3 < s; ++i3) {
+      if (cd[i3]) {
+        var sv = i3 << 4 | cd[i3];
+        var r_1 = mb - cd[i3];
+        var v = le[cd[i3] - 1]++ << r_1;
         for (var m = v | (1 << r_1) - 1; v <= m; ++v) {
           co[rev[v] >> rvb] = sv;
         }
@@ -145,9 +145,9 @@ var hMap = (function(cd, mb, r) {
     }
   } else {
     co = new u16(s);
-    for (i2 = 0; i2 < s; ++i2) {
-      if (cd[i2]) {
-        co[i2] = rev[le[cd[i2] - 1]++] >> 15 - cd[i2];
+    for (i3 = 0; i3 < s; ++i3) {
+      if (cd[i3]) {
+        co[i3] = rev[le[cd[i3] - 1]++] >> 15 - cd[i3];
       }
     }
   }
@@ -224,9 +224,9 @@ var wbits16 = function(d, p, v) {
 };
 var hTree = function(d, mb) {
   var t = [];
-  for (var i2 = 0; i2 < d.length; ++i2) {
-    if (d[i2])
-      t.push({ s: i2, f: d[i2] });
+  for (var i3 = 0; i3 < d.length; ++i3) {
+    if (d[i3])
+      t.push({ s: i3, f: d[i3] });
   }
   var s = t.length;
   var t2 = t.slice();
@@ -249,20 +249,20 @@ var hTree = function(d, mb) {
     t[i1++] = { s: -1, f: l.f + r.f, l, r };
   }
   var maxSym = t2[0].s;
-  for (var i2 = 1; i2 < s; ++i2) {
-    if (t2[i2].s > maxSym)
-      maxSym = t2[i2].s;
+  for (var i3 = 1; i3 < s; ++i3) {
+    if (t2[i3].s > maxSym)
+      maxSym = t2[i3].s;
   }
   var tr = new u16(maxSym + 1);
   var mbt = ln(t[i1 - 1], tr, 0);
   if (mbt > mb) {
-    var i2 = 0, dt = 0;
+    var i3 = 0, dt = 0;
     var lft = mbt - mb, cst = 1 << lft;
     t2.sort(function(a, b) {
       return tr[b.s] - tr[a.s] || a.f - b.f;
     });
-    for (; i2 < s; ++i2) {
-      var i2_1 = t2[i2].s;
+    for (; i3 < s; ++i3) {
+      var i2_1 = t2[i3].s;
       if (tr[i2_1] > mb) {
         dt += cst - (1 << mbt - tr[i2_1]);
         tr[i2_1] = mb;
@@ -271,14 +271,14 @@ var hTree = function(d, mb) {
     }
     dt >>= lft;
     while (dt > 0) {
-      var i2_2 = t2[i2].s;
+      var i2_2 = t2[i3].s;
       if (tr[i2_2] < mb)
         dt -= 1 << mb - tr[i2_2]++ - 1;
       else
-        ++i2;
+        ++i3;
     }
-    for (; i2 >= 0 && dt; --i2) {
-      var i2_3 = t2[i2].s;
+    for (; i3 >= 0 && dt; --i3) {
+      var i2_3 = t2[i3].s;
       if (tr[i2_3] == mb) {
         --tr[i2_3];
         ++dt;
@@ -300,8 +300,8 @@ var lc = function(c) {
   var w = function(v) {
     cl[cli++] = v;
   };
-  for (var i2 = 1; i2 <= s; ++i2) {
-    if (c[i2] == cln && i2 != s)
+  for (var i3 = 1; i3 <= s; ++i3) {
+    if (c[i3] == cln && i3 != s)
       ++cls;
     else {
       if (!cln && cls > 2) {
@@ -321,15 +321,15 @@ var lc = function(c) {
       while (cls--)
         w(cln);
       cls = 1;
-      cln = c[i2];
+      cln = c[i3];
     }
   }
   return { c: cl.subarray(0, cli), n: s };
 };
 var clen = function(cf, cl) {
   var l = 0;
-  for (var i2 = 0; i2 < cl.length; ++i2)
-    l += cf[i2] * cl[i2];
+  for (var i3 = 0; i3 < cl.length; ++i3)
+    l += cf[i3] * cl[i3];
   return l;
 };
 var wfblk = function(out, pos, dat) {
@@ -339,22 +339,22 @@ var wfblk = function(out, pos, dat) {
   out[o + 1] = s >> 8;
   out[o + 2] = out[o] ^ 255;
   out[o + 3] = out[o + 1] ^ 255;
-  for (var i2 = 0; i2 < s; ++i2)
-    out[o + i2 + 4] = dat[i2];
+  for (var i3 = 0; i3 < s; ++i3)
+    out[o + i3 + 4] = dat[i3];
   return (o + 4 + s) * 8;
 };
 var wblk = function(dat, out, final, syms, lf, df, eb, li, bs, bl, p) {
   wbits(out, p++, final);
   ++lf[256];
-  var _a2 = hTree(lf, 15), dlt = _a2.t, mlb = _a2.l;
-  var _b2 = hTree(df, 15), ddt = _b2.t, mdb = _b2.l;
+  var _a3 = hTree(lf, 15), dlt = _a3.t, mlb = _a3.l;
+  var _b3 = hTree(df, 15), ddt = _b3.t, mdb = _b3.l;
   var _c = lc(dlt), lclt = _c.c, nlc = _c.n;
   var _d = lc(ddt), lcdt = _d.c, ndc = _d.n;
   var lcfreq = new u16(19);
-  for (var i2 = 0; i2 < lclt.length; ++i2)
-    ++lcfreq[lclt[i2] & 31];
-  for (var i2 = 0; i2 < lcdt.length; ++i2)
-    ++lcfreq[lcdt[i2] & 31];
+  for (var i3 = 0; i3 < lclt.length; ++i3)
+    ++lcfreq[lclt[i3] & 31];
+  for (var i3 = 0; i3 < lcdt.length; ++i3)
+    ++lcfreq[lcdt[i3] & 31];
   var _e = hTree(lcfreq, 7), lct = _e.t, mlcb = _e.l;
   var nlcc = 19;
   for (; nlcc > 4 && !lct[clim[nlcc - 1]]; --nlcc)
@@ -373,24 +373,24 @@ var wblk = function(dat, out, final, syms, lf, df, eb, li, bs, bl, p) {
     wbits(out, p + 5, ndc - 1);
     wbits(out, p + 10, nlcc - 4);
     p += 14;
-    for (var i2 = 0; i2 < nlcc; ++i2)
-      wbits(out, p + 3 * i2, lct[clim[i2]]);
+    for (var i3 = 0; i3 < nlcc; ++i3)
+      wbits(out, p + 3 * i3, lct[clim[i3]]);
     p += 3 * nlcc;
     var lcts = [lclt, lcdt];
     for (var it = 0; it < 2; ++it) {
       var clct = lcts[it];
-      for (var i2 = 0; i2 < clct.length; ++i2) {
-        var len = clct[i2] & 31;
+      for (var i3 = 0; i3 < clct.length; ++i3) {
+        var len = clct[i3] & 31;
         wbits(out, p, llm[len]), p += lct[len];
         if (len > 15)
-          wbits(out, p, clct[i2] >> 5 & 127), p += clct[i2] >> 12;
+          wbits(out, p, clct[i3] >> 5 & 127), p += clct[i3] >> 12;
       }
     }
   } else {
     lm = flm, ll = flt, dm = fdm, dl = fdt;
   }
-  for (var i2 = 0; i2 < li; ++i2) {
-    var sym = syms[i2];
+  for (var i3 = 0; i3 < li; ++i3) {
+    var sym = syms[i3];
     if (sym > 255) {
       var len = sym >> 18 & 31;
       wbits16(out, p, lm[len + 257]), p += ll[len + 257];
@@ -423,36 +423,36 @@ var dflt = function(dat, lvl, plvl, pre, post, st) {
     var msk_1 = (1 << plvl) - 1;
     var prev = st.p || new u16(32768), head = st.h || new u16(msk_1 + 1);
     var bs1_1 = Math.ceil(plvl / 3), bs2_1 = 2 * bs1_1;
-    var hsh = function(i3) {
-      return (dat[i3] ^ dat[i3 + 1] << bs1_1 ^ dat[i3 + 2] << bs2_1) & msk_1;
+    var hsh = function(i4) {
+      return (dat[i4] ^ dat[i4 + 1] << bs1_1 ^ dat[i4 + 2] << bs2_1) & msk_1;
     };
     var syms = new i32(25e3);
     var lf = new u16(288), df = new u16(32);
-    var lc_1 = 0, eb = 0, i2 = st.i || 0, li = 0, wi = st.w || 0, bs = 0;
-    for (; i2 + 2 < s; ++i2) {
-      var hv = hsh(i2);
-      var imod = i2 & 32767, pimod = head[hv];
+    var lc_1 = 0, eb = 0, i3 = st.i || 0, li = 0, wi = st.w || 0, bs = 0;
+    for (; i3 + 2 < s; ++i3) {
+      var hv = hsh(i3);
+      var imod = i3 & 32767, pimod = head[hv];
       prev[imod] = pimod;
       head[hv] = imod;
-      if (wi <= i2) {
-        var rem = s - i2;
+      if (wi <= i3) {
+        var rem = s - i3;
         if ((lc_1 > 7e3 || li > 24576) && (rem > 423 || !lst)) {
-          pos = wblk(dat, w, 0, syms, lf, df, eb, li, bs, i2 - bs, pos);
-          li = lc_1 = eb = 0, bs = i2;
+          pos = wblk(dat, w, 0, syms, lf, df, eb, li, bs, i3 - bs, pos);
+          li = lc_1 = eb = 0, bs = i3;
           for (var j = 0; j < 286; ++j)
             lf[j] = 0;
           for (var j = 0; j < 30; ++j)
             df[j] = 0;
         }
         var l = 2, d = 0, ch_1 = c, dif = imod - pimod & 32767;
-        if (rem > 2 && hv == hsh(i2 - dif)) {
+        if (rem > 2 && hv == hsh(i3 - dif)) {
           var maxn = Math.min(n, rem) - 1;
-          var maxd = Math.min(32767, i2);
+          var maxd = Math.min(32767, i3);
           var ml = Math.min(258, rem);
           while (dif <= maxd && --ch_1 && imod != pimod) {
-            if (dat[i2 + l] == dat[i2 + l - dif]) {
+            if (dat[i3 + l] == dat[i3 + l - dif]) {
               var nl = 0;
-              for (; nl < ml && dat[i2 + nl] == dat[i2 + nl - dif]; ++nl)
+              for (; nl < ml && dat[i3 + nl] == dat[i3 + nl - dif]; ++nl)
                 ;
               if (nl > l) {
                 l = nl, d = dif;
@@ -461,7 +461,7 @@ var dflt = function(dat, lvl, plvl, pre, post, st) {
                 var mmd = Math.min(dif, nl - 2);
                 var md = 0;
                 for (var j = 0; j < mmd; ++j) {
-                  var ti = i2 - dif + j & 32767;
+                  var ti = i3 - dif + j & 32767;
                   var pti = prev[ti];
                   var cd = ti - pti & 32767;
                   if (cd > md)
@@ -479,32 +479,32 @@ var dflt = function(dat, lvl, plvl, pre, post, st) {
           eb += fleb[lin] + fdeb[din];
           ++lf[257 + lin];
           ++df[din];
-          wi = i2 + l;
+          wi = i3 + l;
           ++lc_1;
         } else {
-          syms[li++] = dat[i2];
-          ++lf[dat[i2]];
+          syms[li++] = dat[i3];
+          ++lf[dat[i3]];
         }
       }
     }
-    for (i2 = Math.max(i2, wi); i2 < s; ++i2) {
-      syms[li++] = dat[i2];
-      ++lf[dat[i2]];
+    for (i3 = Math.max(i3, wi); i3 < s; ++i3) {
+      syms[li++] = dat[i3];
+      ++lf[dat[i3]];
     }
-    pos = wblk(dat, w, lst, syms, lf, df, eb, li, bs, i2 - bs, pos);
+    pos = wblk(dat, w, lst, syms, lf, df, eb, li, bs, i3 - bs, pos);
     if (!lst) {
       st.r = pos & 7 | w[pos / 8 | 0] << 3;
       pos -= 7;
-      st.h = head, st.p = prev, st.i = i2, st.w = wi;
+      st.h = head, st.p = prev, st.i = i3, st.w = wi;
     }
   } else {
-    for (var i2 = st.w || 0; i2 < s + lst; i2 += 65535) {
-      var e = i2 + 65535;
+    for (var i3 = st.w || 0; i3 < s + lst; i3 += 65535) {
+      var e = i3 + 65535;
       if (e >= s) {
         w[pos / 8 | 0] = lst;
         e = s;
       }
-      pos = wfblk(w, pos + 1, dat.subarray(i2, e));
+      pos = wfblk(w, pos + 1, dat.subarray(i3, e));
     }
     st.i = s;
   }
@@ -512,11 +512,11 @@ var dflt = function(dat, lvl, plvl, pre, post, st) {
 };
 var crct = /* @__PURE__ */ (function() {
   var t = new Int32Array(256);
-  for (var i2 = 0; i2 < 256; ++i2) {
-    var c = i2, k = 9;
+  for (var i3 = 0; i3 < 256; ++i3) {
+    var c = i3, k = 9;
     while (--k)
       c = (c & 1 && -306674912) ^ c >>> 1;
-    t[i2] = c;
+    t[i3] = c;
   }
   return t;
 })();
@@ -525,8 +525,8 @@ var crc = function() {
   return {
     p: function(d) {
       var cr = c;
-      for (var i2 = 0; i2 < d.length; ++i2)
-        cr = crct[cr & 255 ^ d[i2]] ^ cr >>> 8;
+      for (var i3 = 0; i3 < d.length; ++i3)
+        cr = crct[cr & 255 ^ d[i3]] ^ cr >>> 8;
       c = cr;
     },
     d: function() {
@@ -587,8 +587,8 @@ try {
 function strToU8(str, latin1) {
   if (latin1) {
     var ar_1 = new u8(str.length);
-    for (var i2 = 0; i2 < str.length; ++i2)
-      ar_1[i2] = str.charCodeAt(i2);
+    for (var i3 = 0; i3 < str.length; ++i3)
+      ar_1[i3] = str.charCodeAt(i3);
     return ar_1;
   }
   if (te)
@@ -599,19 +599,19 @@ function strToU8(str, latin1) {
   var w = function(v) {
     ar[ai++] = v;
   };
-  for (var i2 = 0; i2 < l; ++i2) {
+  for (var i3 = 0; i3 < l; ++i3) {
     if (ai + 5 > ar.length) {
-      var n = new u8(ai + 8 + (l - i2 << 1));
+      var n = new u8(ai + 8 + (l - i3 << 1));
       n.set(ar);
       ar = n;
     }
-    var c = str.charCodeAt(i2);
+    var c = str.charCodeAt(i3);
     if (c < 128 || latin1)
       w(c);
     else if (c < 2048)
       w(192 | c >> 6), w(128 | c & 63);
     else if (c > 55295 && c < 57344)
-      c = 65536 + (c & 1023 << 10) | str.charCodeAt(++i2) & 1023, w(240 | c >> 18), w(128 | c >> 12 & 63), w(128 | c >> 6 & 63), w(128 | c & 63);
+      c = 65536 + (c & 1023 << 10) | str.charCodeAt(++i3) & 1023, w(240 | c >> 18), w(128 | c >> 12 & 63), w(128 | c >> 6 & 63), w(128 | c & 63);
     else
       w(224 | c >> 12), w(128 | c >> 6 & 63), w(128 | c & 63);
   }
@@ -630,7 +630,7 @@ var exfl = function(ex) {
   return le;
 };
 var wzh = function(d, b, f, fn, u, c, ce, co) {
-  var fl2 = fn.length, ex = f.extra, col = co && co.length;
+  var fl3 = fn.length, ex = f.extra, col = co && co.length;
   var exl = exfl(ex);
   wbytes(d, b, ce != null ? 33639248 : 67324752), b += 4;
   if (ce != null)
@@ -647,7 +647,7 @@ var wzh = function(d, b, f, fn, u, c, ce, co) {
     wbytes(d, b + 4, c < 0 ? -c - 2 : c);
     wbytes(d, b + 8, f.size);
   }
-  wbytes(d, b + 12, fl2);
+  wbytes(d, b + 12, fl3);
   wbytes(d, b + 14, exl), b += 16;
   if (ce != null) {
     wbytes(d, b, col);
@@ -655,7 +655,7 @@ var wzh = function(d, b, f, fn, u, c, ce, co) {
     wbytes(d, b + 10, ce), b += 14;
   }
   d.set(fn, b);
-  b += fl2;
+  b += fl3;
   if (exl) {
     for (var k in ex) {
       var exf = ex[k], l = exf.length;
@@ -684,7 +684,7 @@ function zipSync(data, opts) {
   var o = 0;
   var tot = 0;
   for (var fn in r) {
-    var _a2 = r[fn], file = _a2[0], p = _a2[1];
+    var _a3 = r[fn], file = _a3[0], p = _a3[1];
     var compression = p.level == 0 ? 0 : 8;
     var f = strToU8(fn), s = f.length;
     var com = p.comment, m = com && strToU8(com), ms = m && m.length;
@@ -708,8 +708,8 @@ function zipSync(data, opts) {
     tot += 76 + 2 * (s + exl) + (ms || 0) + l;
   }
   var out = new u8(tot + 22), oe = o, cdl = tot - o;
-  for (var i2 = 0; i2 < files.length; ++i2) {
-    var f = files[i2];
+  for (var i3 = 0; i3 < files.length; ++i3) {
+    var f = files[i3];
     wzh(out, f.o, f, f.f, f.u, f.c.length);
     var badd = 30 + f.f.length + exfl(f.extra);
     out.set(f.c, f.o + badd);
@@ -730,9 +730,6 @@ import { join, resolve } from "node:path";
 // packages/server/src/allowlist.ts
 import { ZodError } from "zod";
 
-// packages/server/src/adapters/azure-devops.ts
-import { readFile } from "node:fs/promises";
-
 // packages/shared/src/board-config.ts
 import { z as z2 } from "zod";
 
@@ -793,6 +790,17 @@ var githubActionsBuildEventsSchema = z2.array(githubActionsBuildEventSchema).min
 var attentionTreatments = ["beacon", "alarm", "steady"];
 var attentionTreatmentSchema = z2.enum(attentionTreatments);
 var httpValueJsonPathSchema = z2.string().regex(/^\$(?:\.[A-Za-z_][A-Za-z0-9_]*|\[\d+\])*$/, "must be a simple JSON path");
+var testResultsArtifactSchema = z2.object({
+  artifact: z2.string().min(1).max(128),
+  entry: z2.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]*\.json$/, "must be a root-level JSON file")
+});
+var testCountPanelSchema = z2.object({
+  id: z2.string().min(1),
+  type: z2.literal("test-count"),
+  source: z2.string().min(1),
+  pipeline: z2.string().min(1),
+  test_results: testResultsArtifactSchema
+});
 var httpValueFactSchema = z2.object({
   /** Stable address below the panel; labels and ordering may change without repointing it. */
   id: z2.string().min(1),
@@ -852,7 +860,9 @@ var panelSchema = z2.looseObject({
   /** Up to four independently fetched source-agnostic readings in one visual panel. */
   facts: httpValueGroupedPanelSchema.shape.facts.optional(),
   /** Optional GitHub Actions-only restriction on which workflow triggers count as build evidence. */
-  build_events: githubActionsBuildEventsSchema.optional()
+  build_events: githubActionsBuildEventsSchema.optional(),
+  /** Workflow-run artifact carrying a test-count panel's summary. */
+  test_results: testResultsArtifactSchema.optional()
 }).superRefine((panel, ctx) => {
   if ("display" in panel) {
     ctx.addIssue({
@@ -862,6 +872,28 @@ var panelSchema = z2.looseObject({
       params: { constraint: "display was removed; use density" }
     });
   }
+  if (panel.type === "test-count") {
+    if (!panel.source)
+      ctx.addIssue({ code: "custom", path: ["source"], message: "test-count requires a source" });
+    if (typeof panel.pipeline !== "string" || !panel.pipeline)
+      ctx.addIssue({
+        code: "custom",
+        path: ["pipeline"],
+        message: "test-count requires a workflow filename"
+      });
+    if (!panel.test_results)
+      ctx.addIssue({
+        code: "custom",
+        path: ["test_results"],
+        message: "test-count requires test_results artifact configuration"
+      });
+  } else if (panel.test_results) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["test_results"],
+      message: "test_results is only supported by test-count panels"
+    });
+  }
   if (panel.type !== "http-value") return;
   if (panel.facts) {
     if (panel.url !== void 0)
@@ -1237,6 +1269,18 @@ var pipelineStatusSchema = z4.object({
   /** When this workflow run was last updated by its source, distinct from our observation time. */
   sourceUpdatedAt: z4.iso.datetime().optional()
 });
+var testCountSchema = z4.discriminatedUnion("status", [
+  z4.object({
+    type: z4.literal("test-count"),
+    status: z4.literal("reported"),
+    total: z4.number().int().nonnegative(),
+    passed: z4.number().int().nonnegative().optional(),
+    failed: z4.number().int().nonnegative().optional(),
+    skipped: z4.number().int().nonnegative().optional()
+  }),
+  z4.object({ type: z4.literal("test-count"), status: z4.literal("pending") }),
+  z4.object({ type: z4.literal("test-count"), status: z4.literal("not-reported") })
+]);
 var pullRequestHealthItemSchema = z4.object({
   label: z4.string().min(1),
   status: pipelineStatusSchema.shape.status,
@@ -1295,301 +1339,2000 @@ var securityDetailsResponseSchema = z5.strictObject({
   ])
 });
 
-// packages/server/src/adapters/azure-devops.ts
-import { z as z6 } from "zod";
-var pipelinePanelSchema = z6.object({
-  id: z6.string().min(1),
-  type: z6.literal("pipeline-status"),
-  source: z6.string().min(1),
-  pipeline: z6.number().int().positive()
-});
-var buildSchema = z6.object({
-  id: z6.number().int().positive(),
-  buildNumber: z6.string().min(1),
-  status: z6.string().nullable().optional(),
-  result: z6.string().nullable().optional(),
-  sourceBranch: z6.string().min(1).nullable().optional(),
-  startTime: z6.string().nullable().optional(),
-  finishTime: z6.string().nullable().optional(),
-  lastChangedDate: z6.string().nullable().optional()
-});
-var buildsSchema = z6.object({ value: z6.array(buildSchema) });
-var timelineSchema = z6.object({
-  records: z6.array(
-    z6.object({
-      id: z6.string().min(1),
-      parentId: z6.string().min(1).nullable().optional(),
-      type: z6.string().min(1),
-      name: z6.string().min(1),
-      state: z6.string().nullable().optional()
-    })
-  )
-});
-function permittedAzureDevOpsCalls(panel, source) {
-  const { panel: parsedPanel, source: parsedSource } = z6.object({ panel: pipelinePanelSchema, source: azureDevOpsSourceSchema }).parse({ panel, source });
-  return [buildsCall(parsedPanel.pipeline, parsedSource)];
-}
-var delegatedTokenFileSchema = z6.object({
-  accessToken: z6.string().min(1),
-  expiresAt: z6.string().min(1)
-});
-function buildsCall(definitionId, source) {
-  const url = apiUrl(source, "build/builds");
-  url.searchParams.set("definitions", String(definitionId));
-  if (source.branch) url.searchParams.set("branchName", adoBranch(source.branch));
-  url.searchParams.set("queryOrder", "queueTimeDescending");
-  url.searchParams.set("$top", "1");
-  return { url: url.toString(), headers: new Headers({ accept: "application/json" }) };
+// packages/server/src/adapters/github-actions.ts
+import { z as z7 } from "zod";
+
+// packages/server/src/credentials.ts
+function environmentCredentials(env = process.env) {
+  return { get: (name) => env[name] };
 }
-function apiUrl(source, suffix) {
-  const url = new URL(
-    `https://dev.azure.com/${encodeURIComponent(source.organization)}/${encodeURIComponent(source.project)}/_apis/${suffix}`
-  );
-  url.searchParams.set("api-version", "7.1");
-  return url;
+
+// packages/server/src/github-auth.ts
+import { createSign } from "node:crypto";
+
+// packages/server/src/upstream.ts
+function publicErrorMessage(kind) {
+  switch (kind) {
+    case "unreachable":
+      return "The source could not be reached. Check its address and network connectivity.";
+    case "unauthorized":
+      return "The dashboard is not authorized to read this source. Check the configured access.";
+    case "not-found":
+      return "The configured source was not found. Check the board configuration.";
+    case "no-runs":
+      return "No matching workflow runs were found. Check the configured workflow and branch.";
+    case "upstream-error":
+      return "The source returned an unreadable response. Check the source service and configuration.";
+  }
 }
-function adoBranch(branch) {
-  return branch.startsWith("refs/") ? branch : `refs/heads/${branch}`;
+function forwardValidators(requestHeaders, upstreamHeaders) {
+  for (const name of ["if-none-match", "if-modified-since"]) {
+    const value2 = requestHeaders.get(name);
+    if (value2) upstreamHeaders.set(name, value2);
+  }
 }
-
-// packages/server/src/adapters/github-actions.ts
-import { z as z7 } from "zod";
-var pipelinePanelSchema2 = z7.object({
-  id: z7.string().min(1),
-  type: z7.literal("pipeline-status"),
-  source: z7.string().min(1),
-  /** GitHub accepts a workflow filename or numeric workflow id in this URL segment. */
-  pipeline: z7.string().min(1)
-});
-var pullRequestHealthPanelSchema = z7.object({
-  id: z7.string().min(1),
-  type: z7.literal("pull-request-health"),
-  source: z7.string().min(1),
-  base_branch: z7.string().min(1),
-  update_workflows: z7.array(
-    z7.object({
-      workflow: z7.string().min(1),
-      branch_prefixes: z7.array(z7.string().min(1)).min(1)
-    })
-  ).min(1),
-  build_workflow: z7.string().min(1),
-  build_events: githubActionsBuildEventsSchema.optional()
-});
-var runSchema = z7.object({
-  id: z7.number().int().positive().optional(),
-  status: z7.string(),
-  conclusion: z7.string().nullable(),
-  name: z7.string().min(1),
-  html_url: z7.url(),
-  /** The GitHub Actions trigger that started this run. */
-  event: z7.string().min(1).optional(),
-  /** The branch that produced this run; absent for some event types. */
-  head_branch: z7.string().min(1).nullable().optional(),
-  // Timestamp quality should only remove timing advice, never make an otherwise useful run unreadable.
-  run_started_at: z7.string().nullable().optional(),
-  updated_at: z7.string().optional(),
-  created_at: z7.string().optional()
-});
-var runsSchema = z7.object({ workflow_runs: z7.array(runSchema) });
-var jobsSchema = z7.object({
-  jobs: z7.array(
-    z7.object({
-      name: z7.string().min(1),
-      status: z7.string(),
-      steps: z7.array(z7.object({ name: z7.string().min(1), status: z7.string() })).optional()
-    })
-  )
-});
-var pullRequestsSchema = z7.array(
-  z7.object({
-    number: z7.number().int().positive(),
-    html_url: z7.url(),
-    head: z7.object({ ref: z7.string().min(1) }),
-    base: z7.object({ ref: z7.string().min(1) })
-  })
-);
-function permittedGithubActionsCalls(panel, source, _credentials) {
-  const { panel: parsedPanel, source: parsedSource } = z7.object({ panel: pipelinePanelSchema2, source: githubActionsSourceSchema }).parse({ panel, source });
-  const url = new URL(
-    `https://api.github.com/repos/${parsedSource.repo}/actions/workflows/${encodeURIComponent(parsedPanel.pipeline)}/runs`
-  );
-  if (parsedSource.branch) url.searchParams.set("branch", parsedSource.branch);
-  url.searchParams.set("per_page", "1");
-  return [{ url: url.toString(), headers: new Headers() }];
+function observedAt(upstreamDate) {
+  const parsed = upstreamDate ? new Date(upstreamDate) : void 0;
+  return parsed && !Number.isNaN(parsed.valueOf()) ? parsed.toISOString() : (/* @__PURE__ */ new Date()).toISOString();
 }
-function pullRequestHealthCapabilities(panel) {
-  const { panel: parsed } = z7.object({ panel: pullRequestHealthPanelSchema }).parse({ panel });
+function upstreamErrorEnvelope(args) {
   return {
-    panel: parsed,
-    configuredUpdateWorkflow(workflow) {
-      return parsed.update_workflows.find((candidate) => candidate.workflow === workflow);
-    },
-    permitsBuildBranch(branch) {
-      return parsed.update_workflows.some(
-        ({ branch_prefixes }) => branch_prefixes.some((prefix) => branch.startsWith(prefix))
-      );
+    panelId: args.panelId,
+    state: "error",
+    observedAt: observedAt(args.upstreamDate),
+    link: publicLink(args.link),
+    error: {
+      kind: args.kind,
+      // Raw failures regularly contain URLs, query values, response fragments, or credentials.
+      // The specific evidence stays server-side; the browser gets this fixed actionable vocabulary.
+      message: publicErrorMessage(args.kind)
     }
   };
 }
-
-// packages/server/src/adapters/gitlab-ci.ts
-import { z as z8 } from "zod";
-var pipelinePanelSchema3 = z8.object({
-  id: z8.string().min(1),
-  type: z8.literal("pipeline-status"),
-  source: z8.string().min(1)
-});
-var pipelineSchema = z8.object({
-  id: z8.number().int().positive(),
-  name: z8.string().min(1).nullable().optional(),
-  status: z8.string(),
-  ref: z8.string().min(1).nullable().optional(),
-  created_at: z8.string().nullable().optional(),
-  updated_at: z8.string().nullable().optional(),
-  web_url: z8.url()
-});
-function permittedGitlabCiCalls(panel, source) {
-  const { source: parsedSource } = z8.object({ panel: pipelinePanelSchema3, source: gitlabCiSourceSchema }).parse({ panel, source });
-  return [pipelinesCall(parsedSource)];
+function publicLink(value2) {
+  if (!value2) return null;
+  try {
+    const url = new URL(value2);
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return null;
+  }
 }
-function pipelinesCall(source) {
-  const url = new URL(source.url);
-  url.pathname = `${url.pathname.replace(/\/$/, "")}/api/v4/projects/${encodeURIComponent(source.project)}/pipelines`;
-  url.searchParams.set("per_page", "1");
-  if (source.branch) url.searchParams.set("ref", source.branch);
-  return { url: url.toString(), headers: new Headers({ accept: "application/json" }) };
+function upstreamErrorResponse(envelope) {
+  return new Response(JSON.stringify(envelope), { status: 200 });
 }
-
-// packages/server/src/adapters/http-value.ts
-import { z as z9 } from "zod";
-function permittedHttpValueCalls(panel) {
-  const grouped = httpValueGroupedPanelSchema.safeParse(panel);
-  const urls = grouped.success ? grouped.data.facts.map((fact) => fact.url) : [z9.object({ panel: httpValueScalarPanelSchema }).parse({ panel }).panel.url];
-  return urls.map(permittedCall);
+function upstreamErrorKind(status) {
+  if (status === 401 || status === 403) return "unauthorized";
+  if (status === 404) return "not-found";
+  return "upstream-error";
 }
-function permittedCall(value2) {
-  const url = new URL(value2);
-  if (url.protocol !== "http:" && url.protocol !== "https:")
-    throw new Error("http-value URLs must use http or https");
-  return { url: url.toString(), headers: new Headers({ accept: "application/json, text/plain" }) };
+function safeNetworkCode(error) {
+  const code = error && typeof error === "object" ? error.code : void 0;
+  return code === "ECONNREFUSED" || code === "ENOTFOUND" || code === "ETIMEDOUT" || code === "EAI_AGAIN" ? code : void 0;
 }
 
-// packages/server/src/configuration-error.ts
-var ConfigurationError = class extends Error {
-  constructor(message2, diagnostics) {
-    super(message2);
-    this.diagnostics = diagnostics;
+// packages/server/src/github-auth.ts
+var GithubAuthenticationError = class extends Error {
+  constructor() {
+    super("GitHub authentication could not be completed.");
+    this.name = "GithubAuthenticationError";
   }
-  diagnostics;
 };
-function configurationLocation(path) {
-  return path.reduce(
-    (location, part) => typeof part === "number" ? `${location}[${part}]` : `${location}${location ? "." : ""}${String(part)}`,
-    ""
-  ) || "configuration";
-}
-function boardConfigurationLocation(config, path) {
-  const [record, key, ...rest] = path;
-  if ((record === "boards" || record === "sources") && key !== void 0) {
-    const entries = config && typeof config === "object" ? Reflect.get(config, record) : void 0;
-    const index = entries && typeof entries === "object" ? Object.keys(entries).indexOf(String(key)) : -1;
-    return configurationLocation([record, index, ...rest]);
+function createGithubClient(credentials, now = Date.now) {
+  const tokens = /* @__PURE__ */ new Map();
+  const pending = /* @__PURE__ */ new Map();
+  async function installationToken(source, fetcher, refresh = false) {
+    const app = source.github_app;
+    if (!app) return void 0;
+    const appId = requiredCredential(credentials, app.app_id_env);
+    const privateKey = requiredCredential(credentials, app.private_key_env);
+    const installationId = requiredCredential(credentials, app.installation_id_env);
+    const cacheKey = `${appId}:${installationId}:${app.private_key_env}`;
+    const cached = tokens.get(cacheKey);
+    if (!refresh && cached && cached.expiresAt > now() + 6e4)
+      return { token: cached.token, cacheKey };
+    const existing = pending.get(cacheKey);
+    if (existing) return { token: await existing, cacheKey };
+    const exchange = exchangeInstallationToken({ appId, privateKey, installationId, fetcher, now }).then(({ token, expiresAt }) => {
+      tokens.set(cacheKey, { token, expiresAt });
+      return token;
+    }).catch((error) => {
+      if (error instanceof GithubAuthenticationError) throw error;
+      throw new GithubAuthenticationError();
+    });
+    pending.set(cacheKey, exchange);
+    try {
+      return { token: await exchange, cacheKey };
+    } finally {
+      pending.delete(cacheKey);
+    }
   }
-  return configurationLocation(path);
+  return {
+    async get({ source, url, requestHeaders, fetcher }) {
+      const headers = githubHeaders(requestHeaders);
+      if (source.token_env)
+        headers.set("authorization", `Bearer ${requiredCredential(credentials, source.token_env)}`);
+      const appToken = await installationToken(source, fetcher);
+      if (appToken) headers.set("authorization", `Bearer ${appToken.token}`);
+      const response = await fetcher(url, { headers });
+      if (!appToken || response.status !== 401) return response;
+      tokens.delete(appToken.cacheKey);
+      const refreshed = await installationToken(source, fetcher, true);
+      if (!refreshed) return response;
+      const replayHeaders = githubHeaders(requestHeaders);
+      replayHeaders.set("authorization", `Bearer ${refreshed.token}`);
+      return fetcher(url, { headers: replayHeaders });
+    }
+  };
 }
-function schemaDiagnostics(error, locate, kind = "schema") {
-  return error.issues.map((issue) => ({
-    kind,
-    location: locate(issue.path),
-    constraint: correctiveConstraint(issue)
-  }));
+function githubHeaders(requestHeaders) {
+  const headers = new Headers({ accept: "application/vnd.github+json" });
+  forwardValidators(requestHeaders, headers);
+  return headers;
 }
-function correctiveConstraint(issue) {
-  switch (issue.code) {
-    case "invalid_type":
-      return `Provide a value of type ${issue.expected}.`;
-    case "too_big":
-      return `Use ${issue.inclusive ? "at most" : "fewer than"} ${issue.maximum} ${issue.origin === "array" ? "entries" : issue.origin === "string" ? "characters" : "as the value"}.`;
-    case "too_small":
-      return `Use ${issue.inclusive ? "at least" : "more than"} ${issue.minimum} ${issue.origin === "array" ? "entries" : issue.origin === "string" ? "characters" : "as the value"}.`;
-    // Format messages are fixed by our schemas (or Zod); unlike custom issues they contain no authored values.
-    case "invalid_format":
-      return issue.message;
-    case "invalid_value":
-      return "Use one of the values allowed by the board schema.";
-    case "custom":
-      return typeof issue.params?.constraint === "string" ? issue.params.constraint : "Correct this field according to the board schema.";
-    default:
-      return "Provide a value matching the board schema for this field.";
+async function exchangeInstallationToken(args) {
+  let jwt;
+  try {
+    jwt = createAppJwt(args.appId, args.privateKey, args.now());
+  } catch {
+    throw new GithubAuthenticationError();
+  }
+  let response;
+  try {
+    response = await args.fetcher(
+      `https://api.github.com/app/installations/${encodeURIComponent(args.installationId)}/access_tokens`,
+      {
+        method: "POST",
+        headers: new Headers({
+          accept: "application/vnd.github+json",
+          authorization: `Bearer ${jwt}`,
+          "content-type": "application/json"
+        })
+      }
+    );
+  } catch {
+    throw new GithubAuthenticationError();
   }
+  if (!response.ok) throw new GithubAuthenticationError();
+  const body = await response.json();
+  if (!body.token || !body.expires_at) throw new GithubAuthenticationError();
+  const expiresAt = new Date(body.expires_at).valueOf();
+  if (!Number.isFinite(expiresAt)) throw new GithubAuthenticationError();
+  return { token: body.token, expiresAt };
 }
-
-// packages/server/src/allowlist.ts
-function deriveValidatedAllowlist(config) {
-  return derive(config, true);
+function createAppJwt(appId, privateKey, now = Date.now()) {
+  const issuedAt = Math.floor(now / 1e3) - 60;
+  const header = base64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+  const payload = base64url(JSON.stringify({ iat: issuedAt, exp: issuedAt + 540, iss: appId }));
+  const signingInput = `${header}.${payload}`;
+  const signer = createSign("RSA-SHA256");
+  signer.update(signingInput);
+  signer.end();
+  return `${signingInput}.${base64url(signer.sign(privateKey))}`;
 }
-function derive(config, rejectUnsupported) {
-  const allowed = /* @__PURE__ */ new Map();
-  for (const [boardName, board] of Object.entries(config.boards)) {
-    for (const panel of board.panels) {
-      const source = panel.source ? config.sources[panel.source] : void 0;
-      try {
-        const capability = panelCapability(panel, source);
-        if (capability.kind === "unsupported") {
-          if (rejectUnsupported) throw new Error("no bounded operations");
-          continue;
-        }
-        if (capability.kind === "server")
-          allowed.set(`${boardName}/${panel.id}`, new Set(capability.operations));
-      } catch (error) {
-        if (rejectUnsupported) {
-          const location = `boards[${Object.keys(config.boards).indexOf(boardName)}].panels[${board.panels.indexOf(panel)}]`;
-          throw new ConfigurationError(
-            unsupportedPanelOperation(boardName, panel, source, error).message,
-            error instanceof ZodError ? schemaDiagnostics(
-              error,
-              ([subject, ...path]) => {
-                const root = subject === "source" ? ["sources", Object.keys(config.sources).indexOf(panel.source ?? "")] : [
-                  "boards",
-                  Object.keys(config.boards).indexOf(boardName),
-                  "panels",
-                  board.panels.indexOf(panel)
-                ];
-                return configurationLocation([...root, ...path]);
-              },
-              "panel-admission"
-            ) : [
-              {
-                kind: "panel-admission",
-                location,
-                constraint: "Use a supported panel/source combination with bounded HTTP(S) operations."
-              }
-            ]
-          );
-        }
-        throw error;
+function requiredCredential(credentials, name) {
+  const value2 = credentials.get(name);
+  if (value2) return value2;
+  throw new GithubAuthenticationError();
+}
+function base64url(value2) {
+  return Buffer.from(value2).toString("base64url");
+}
+
+// node_modules/fflate/esm/browser.js
+var u82 = Uint8Array;
+var u162 = Uint16Array;
+var i322 = Int32Array;
+var fleb2 = new u82([
+  0,
+  0,
+  0,
+  0,
+  0,
+  0,
+  0,
+  0,
+  1,
+  1,
+  1,
+  1,
+  2,
+  2,
+  2,
+  2,
+  3,
+  3,
+  3,
+  3,
+  4,
+  4,
+  4,
+  4,
+  5,
+  5,
+  5,
+  5,
+  0,
+  /* unused */
+  0,
+  0,
+  /* impossible */
+  0
+]);
+var fdeb2 = new u82([
+  0,
+  0,
+  0,
+  0,
+  1,
+  1,
+  2,
+  2,
+  3,
+  3,
+  4,
+  4,
+  5,
+  5,
+  6,
+  6,
+  7,
+  7,
+  8,
+  8,
+  9,
+  9,
+  10,
+  10,
+  11,
+  11,
+  12,
+  12,
+  13,
+  13,
+  /* unused */
+  0,
+  0
+]);
+var clim2 = new u82([16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15]);
+var freb2 = function(eb, start) {
+  var b = new u162(31);
+  for (var i3 = 0; i3 < 31; ++i3) {
+    b[i3] = start += 1 << eb[i3 - 1];
+  }
+  var r = new i322(b[30]);
+  for (var i3 = 1; i3 < 30; ++i3) {
+    for (var j = b[i3]; j < b[i3 + 1]; ++j) {
+      r[j] = j - b[i3] << 5 | i3;
+    }
+  }
+  return { b, r };
+};
+var _a2 = freb2(fleb2, 2);
+var fl2 = _a2.b;
+var revfl2 = _a2.r;
+fl2[28] = 258, revfl2[258] = 28;
+var _b2 = freb2(fdeb2, 0);
+var fd2 = _b2.b;
+var revfd2 = _b2.r;
+var rev2 = new u162(32768);
+for (i2 = 0; i2 < 32768; ++i2) {
+  x2 = (i2 & 43690) >> 1 | (i2 & 21845) << 1;
+  x2 = (x2 & 52428) >> 2 | (x2 & 13107) << 2;
+  x2 = (x2 & 61680) >> 4 | (x2 & 3855) << 4;
+  rev2[i2] = ((x2 & 65280) >> 8 | (x2 & 255) << 8) >> 1;
+}
+var x2;
+var i2;
+var hMap2 = (function(cd, mb, r) {
+  var s = cd.length;
+  var i3 = 0;
+  var l = new u162(mb);
+  for (; i3 < s; ++i3) {
+    if (cd[i3])
+      ++l[cd[i3] - 1];
+  }
+  var le = new u162(mb);
+  for (i3 = 1; i3 < mb; ++i3) {
+    le[i3] = le[i3 - 1] + l[i3 - 1] << 1;
+  }
+  var co;
+  if (r) {
+    co = new u162(1 << mb);
+    var rvb = 15 - mb;
+    for (i3 = 0; i3 < s; ++i3) {
+      if (cd[i3]) {
+        var sv = i3 << 4 | cd[i3];
+        var r_1 = mb - cd[i3];
+        var v = le[cd[i3] - 1]++ << r_1;
+        for (var m = v | (1 << r_1) - 1; v <= m; ++v) {
+          co[rev2[v] >> rvb] = sv;
+        }
+      }
+    }
+  } else {
+    co = new u162(s);
+    for (i3 = 0; i3 < s; ++i3) {
+      if (cd[i3]) {
+        co[i3] = rev2[le[cd[i3] - 1]++] >> 15 - cd[i3];
+      }
+    }
+  }
+  return co;
+});
+var flt2 = new u82(288);
+for (i2 = 0; i2 < 144; ++i2)
+  flt2[i2] = 8;
+var i2;
+for (i2 = 144; i2 < 256; ++i2)
+  flt2[i2] = 9;
+var i2;
+for (i2 = 256; i2 < 280; ++i2)
+  flt2[i2] = 7;
+var i2;
+for (i2 = 280; i2 < 288; ++i2)
+  flt2[i2] = 8;
+var i2;
+var fdt2 = new u82(32);
+for (i2 = 0; i2 < 32; ++i2)
+  fdt2[i2] = 5;
+var i2;
+var flrm = /* @__PURE__ */ hMap2(flt2, 9, 1);
+var fdrm = /* @__PURE__ */ hMap2(fdt2, 5, 1);
+var max = function(a) {
+  var m = a[0];
+  for (var i3 = 1; i3 < a.length; ++i3) {
+    if (a[i3] > m)
+      m = a[i3];
+  }
+  return m;
+};
+var bits = function(d, p, m) {
+  var o = p / 8 | 0;
+  return (d[o] | d[o + 1] << 8) >> (p & 7) & m;
+};
+var bits16 = function(d, p) {
+  var o = p / 8 | 0;
+  return (d[o] | d[o + 1] << 8 | d[o + 2] << 16) >> (p & 7);
+};
+var shft2 = function(p) {
+  return (p + 7) / 8 | 0;
+};
+var slc2 = function(v, s, e) {
+  if (s == null || s < 0)
+    s = 0;
+  if (e == null || e > v.length)
+    e = v.length;
+  return new u82(v.subarray(s, e));
+};
+var ec2 = [
+  "unexpected EOF",
+  "invalid block type",
+  "invalid length/literal",
+  "invalid distance",
+  "stream finished",
+  "no stream handler",
+  ,
+  // determined by compression function
+  "no callback",
+  "invalid UTF-8 data",
+  "extra field too long",
+  "date not in range 1980-2099",
+  "filename too long",
+  "stream finishing",
+  "invalid zip data"
+  // determined by unknown compression method
+];
+var err2 = function(ind, msg, nt) {
+  var e = new Error(msg || ec2[ind]);
+  e.code = ind;
+  if (Error.captureStackTrace)
+    Error.captureStackTrace(e, err2);
+  if (!nt)
+    throw e;
+  return e;
+};
+var inflt = function(dat, st, buf, dict) {
+  var sl = dat.length, dl = dict ? dict.length : 0;
+  if (!sl || st.f && !st.l)
+    return buf || new u82(0);
+  var noBuf = !buf;
+  var resize = noBuf || st.i != 2;
+  var noSt = st.i;
+  if (noBuf)
+    buf = new u82(sl * 3);
+  var cbuf = function(l2) {
+    var bl = buf.length;
+    if (l2 > bl) {
+      var nbuf = new u82(Math.max(bl * 2, l2));
+      nbuf.set(buf);
+      buf = nbuf;
+    }
+  };
+  var final = st.f || 0, pos = st.p || 0, bt = st.b || 0, lm = st.l, dm = st.d, lbt = st.m, dbt = st.n;
+  var tbts = sl * 8;
+  do {
+    if (!lm) {
+      final = bits(dat, pos, 1);
+      var type = bits(dat, pos + 1, 3);
+      pos += 3;
+      if (!type) {
+        var s = shft2(pos) + 4, l = dat[s - 4] | dat[s - 3] << 8, t = s + l;
+        if (t > sl) {
+          if (noSt)
+            err2(0);
+          break;
+        }
+        if (resize)
+          cbuf(bt + l);
+        buf.set(dat.subarray(s, t), bt);
+        st.b = bt += l, st.p = pos = t * 8, st.f = final;
+        continue;
+      } else if (type == 1)
+        lm = flrm, dm = fdrm, lbt = 9, dbt = 5;
+      else if (type == 2) {
+        var hLit = bits(dat, pos, 31) + 257, hcLen = bits(dat, pos + 10, 15) + 4;
+        var tl = hLit + bits(dat, pos + 5, 31) + 1;
+        pos += 14;
+        var ldt = new u82(tl);
+        var clt = new u82(19);
+        for (var i3 = 0; i3 < hcLen; ++i3) {
+          clt[clim2[i3]] = bits(dat, pos + i3 * 3, 7);
+        }
+        pos += hcLen * 3;
+        var clb = max(clt), clbmsk = (1 << clb) - 1;
+        var clm = hMap2(clt, clb, 1);
+        for (var i3 = 0; i3 < tl; ) {
+          var r = clm[bits(dat, pos, clbmsk)];
+          pos += r & 15;
+          var s = r >> 4;
+          if (s < 16) {
+            ldt[i3++] = s;
+          } else {
+            var c = 0, n = 0;
+            if (s == 16)
+              n = 3 + bits(dat, pos, 3), pos += 2, c = ldt[i3 - 1];
+            else if (s == 17)
+              n = 3 + bits(dat, pos, 7), pos += 3;
+            else if (s == 18)
+              n = 11 + bits(dat, pos, 127), pos += 7;
+            while (n--)
+              ldt[i3++] = c;
+          }
+        }
+        var lt = ldt.subarray(0, hLit), dt = ldt.subarray(hLit);
+        lbt = max(lt);
+        dbt = max(dt);
+        lm = hMap2(lt, lbt, 1);
+        dm = hMap2(dt, dbt, 1);
+      } else
+        err2(1);
+      if (pos > tbts) {
+        if (noSt)
+          err2(0);
+        break;
+      }
+    }
+    if (resize)
+      cbuf(bt + 131072);
+    var lms = (1 << lbt) - 1, dms = (1 << dbt) - 1;
+    var lpos = pos;
+    for (; ; lpos = pos) {
+      var c = lm[bits16(dat, pos) & lms], sym = c >> 4;
+      pos += c & 15;
+      if (pos > tbts) {
+        if (noSt)
+          err2(0);
+        break;
+      }
+      if (!c)
+        err2(2);
+      if (sym < 256)
+        buf[bt++] = sym;
+      else if (sym == 256) {
+        lpos = pos, lm = null;
+        break;
+      } else {
+        var add = sym - 254;
+        if (sym > 264) {
+          var i3 = sym - 257, b = fleb2[i3];
+          add = bits(dat, pos, (1 << b) - 1) + fl2[i3];
+          pos += b;
+        }
+        var d = dm[bits16(dat, pos) & dms], dsym = d >> 4;
+        if (!d)
+          err2(3);
+        pos += d & 15;
+        var dt = fd2[dsym];
+        if (dsym > 3) {
+          var b = fdeb2[dsym];
+          dt += bits16(dat, pos) & (1 << b) - 1, pos += b;
+        }
+        if (pos > tbts) {
+          if (noSt)
+            err2(0);
+          break;
+        }
+        if (resize)
+          cbuf(bt + 131072);
+        var end = bt + add;
+        if (bt < dt) {
+          var shift = dl - dt, dend = Math.min(dt, end);
+          if (shift + bt < 0)
+            err2(3);
+          for (; bt < dend; ++bt)
+            buf[bt] = dict[shift + bt];
+        }
+        for (; bt < end; ++bt)
+          buf[bt] = buf[bt - dt];
+      }
+    }
+    st.l = lm, st.p = lpos, st.b = bt, st.f = final;
+    if (lm)
+      final = 1, st.m = lbt, st.d = dm, st.n = dbt;
+  } while (!final);
+  return bt != buf.length && noBuf ? slc2(buf, 0, bt) : buf.subarray(0, bt);
+};
+var et2 = /* @__PURE__ */ new u82(0);
+var b2 = function(d, b) {
+  return d[b] | d[b + 1] << 8;
+};
+var b4 = function(d, b) {
+  return (d[b] | d[b + 1] << 8 | d[b + 2] << 16 | d[b + 3] << 24) >>> 0;
+};
+var b8 = function(d, b) {
+  return b4(d, b) + b4(d, b + 4) * 4294967296;
+};
+var Inflate = /* @__PURE__ */ (function() {
+  function Inflate2(opts, cb) {
+    if (typeof opts == "function")
+      cb = opts, opts = {};
+    this.ondata = cb;
+    var dict = opts && opts.dictionary && opts.dictionary.subarray(-32768);
+    this.s = { i: 0, b: dict ? dict.length : 0 };
+    this.o = new u82(32768);
+    this.p = new u82(0);
+    if (dict)
+      this.o.set(dict);
+  }
+  Inflate2.prototype.e = function(c) {
+    if (!this.ondata)
+      err2(5);
+    if (this.d)
+      err2(4);
+    if (!this.p.length)
+      this.p = c;
+    else if (c.length) {
+      var n = new u82(this.p.length + c.length);
+      n.set(this.p), n.set(c, this.p.length), this.p = n;
+    }
+  };
+  Inflate2.prototype.c = function(final) {
+    this.s.i = +(this.d = final || false);
+    var bts = this.s.b;
+    var dt = inflt(this.p, this.s, this.o);
+    this.ondata(slc2(dt, bts, this.s.b), this.d);
+    this.o = slc2(dt, this.s.b - 32768), this.s.b = this.o.length;
+    this.p = slc2(this.p, this.s.p / 8 | 0), this.s.p &= 7;
+  };
+  Inflate2.prototype.push = function(chunk, final) {
+    this.e(chunk), this.c(final);
+  };
+  return Inflate2;
+})();
+var td2 = typeof TextDecoder != "undefined" && /* @__PURE__ */ new TextDecoder();
+var tds2 = 0;
+try {
+  td2.decode(et2, { stream: true });
+  tds2 = 1;
+} catch (e) {
+}
+var dutf8 = function(d) {
+  for (var r = "", i3 = 0; ; ) {
+    var c = d[i3++];
+    var eb = (c > 127) + (c > 223) + (c > 239);
+    if (i3 + eb > d.length)
+      return { s: r, r: slc2(d, i3 - 1) };
+    if (!eb)
+      r += String.fromCharCode(c);
+    else if (eb == 3) {
+      c = ((c & 15) << 18 | (d[i3++] & 63) << 12 | (d[i3++] & 63) << 6 | d[i3++] & 63) - 65536, r += String.fromCharCode(55296 | c >> 10, 56320 | c & 1023);
+    } else if (eb & 1)
+      r += String.fromCharCode((c & 31) << 6 | d[i3++] & 63);
+    else
+      r += String.fromCharCode((c & 15) << 12 | (d[i3++] & 63) << 6 | d[i3++] & 63);
+  }
+};
+function strFromU8(dat, latin1) {
+  if (latin1) {
+    var r = "";
+    for (var i3 = 0; i3 < dat.length; i3 += 16384)
+      r += String.fromCharCode.apply(null, dat.subarray(i3, i3 + 16384));
+    return r;
+  } else if (td2) {
+    return td2.decode(dat);
+  } else {
+    var _a3 = dutf8(dat), s = _a3.s, r = _a3.r;
+    if (r.length)
+      err2(8);
+    return s;
+  }
+}
+var z64hs = function(d, b, l, z11, sc, su, off) {
+  var nsc = sc == 4294967295, nsu = su == 4294967295, noff = off == 4294967295, e = b + l;
+  var nf = nsc + nsu + noff;
+  if (z11 && nf) {
+    for (; b + 4 < e; b += 4 + b2(d, b + 2)) {
+      if (b2(d, b) == 1) {
+        return [
+          nsc ? b8(d, b + 4 + 8 * nsu) : sc,
+          nsu ? b8(d, b + 4) : su,
+          noff ? b8(d, b + 4 + 8 * (nsu + nsc)) : off,
+          1
+        ];
+      }
+    }
+    if (z11 < 2)
+      err2(13);
+  }
+  return [sc, su, off, 0];
+};
+var UnzipPassThrough = /* @__PURE__ */ (function() {
+  function UnzipPassThrough2() {
+  }
+  UnzipPassThrough2.prototype.push = function(chunk, final) {
+    this.ondata(null, chunk, final);
+  };
+  UnzipPassThrough2.compression = 0;
+  return UnzipPassThrough2;
+})();
+var UnzipInflate = /* @__PURE__ */ (function() {
+  function UnzipInflate2() {
+    var _this = this;
+    this.i = new Inflate(function(dat, final) {
+      _this.ondata(null, dat, final);
+    });
+  }
+  UnzipInflate2.prototype.push = function(chunk, final) {
+    try {
+      this.i.push(chunk, final);
+    } catch (e) {
+      this.ondata(e, null, final);
+    }
+  };
+  UnzipInflate2.compression = 8;
+  return UnzipInflate2;
+})();
+var Unzip = /* @__PURE__ */ (function() {
+  function Unzip2(cb) {
+    this.onfile = cb;
+    this.k = [];
+    this.o = {
+      0: UnzipPassThrough
+    };
+    this.p = et2;
+  }
+  Unzip2.prototype.push = function(chunk, final) {
+    var _this = this;
+    if (!this.onfile)
+      err2(5);
+    if (!this.p)
+      err2(4);
+    if (this.c > 0) {
+      var len = Math.min(this.c, chunk.length);
+      var toAdd = chunk.subarray(0, len);
+      this.c -= len;
+      if (this.d)
+        this.d.push(toAdd, !this.c);
+      else
+        this.k[0].push(toAdd);
+      chunk = chunk.subarray(len);
+      if (chunk.length)
+        return this.push(chunk, final);
+    } else {
+      var f = 0, i3 = 0, is = void 0, buf = void 0;
+      if (!this.p.length)
+        buf = chunk;
+      else if (!chunk.length)
+        buf = this.p;
+      else {
+        buf = new u82(this.p.length + chunk.length);
+        buf.set(this.p), buf.set(chunk, this.p.length);
+      }
+      var l = buf.length, oc = this.c, add = oc && this.d;
+      var _loop_2 = function() {
+        var sig = b4(buf, i3);
+        if (sig == 67324752) {
+          f = 1, is = i3;
+          this_1.d = null;
+          this_1.c = 0;
+          var bf = b2(buf, i3 + 6), cmp_1 = b2(buf, i3 + 8), u = bf & 2048, dd = bf & 8, fnl = b2(buf, i3 + 26), es = b2(buf, i3 + 28);
+          if (l > i3 + 30 + fnl + es) {
+            var chks_3 = [];
+            this_1.k.unshift(chks_3);
+            f = 2;
+            var lsc = b4(buf, i3 + 18), lsu = b4(buf, i3 + 22);
+            var fn_1 = strFromU8(buf.subarray(i3 + 30, i3 += 30 + fnl), !u);
+            var _a3 = z64hs(buf, i3, es, 2, lsc, lsu, 0), sc_1 = _a3[0], su_1 = _a3[1], z64 = _a3[3];
+            if (dd)
+              sc_1 = -1 - z64;
+            i3 += es;
+            this_1.c = sc_1;
+            var d_1;
+            var file_1 = {
+              name: fn_1,
+              compression: cmp_1,
+              start: function() {
+                if (!file_1.ondata)
+                  err2(5);
+                if (!sc_1)
+                  file_1.ondata(null, et2, true);
+                else {
+                  var ctr = _this.o[cmp_1];
+                  if (!ctr)
+                    file_1.ondata(err2(14, "unknown compression type " + cmp_1, 1), null, false);
+                  d_1 = sc_1 < 0 ? new ctr(fn_1) : new ctr(fn_1, sc_1, su_1);
+                  d_1.ondata = function(err3, dat3, final2) {
+                    file_1.ondata(err3, dat3, final2);
+                  };
+                  for (var _i = 0, chks_4 = chks_3; _i < chks_4.length; _i++) {
+                    var dat2 = chks_4[_i];
+                    d_1.push(dat2, false);
+                  }
+                  if (_this.k[0] == chks_3 && _this.c)
+                    _this.d = d_1;
+                  else
+                    d_1.push(et2, true);
+                }
+              },
+              terminate: function() {
+                if (d_1 && d_1.terminate)
+                  d_1.terminate();
+              }
+            };
+            if (sc_1 >= 0)
+              file_1.size = sc_1, file_1.originalSize = su_1;
+            this_1.onfile(file_1);
+          }
+          return "break";
+        } else if (oc) {
+          if (sig == 134695760) {
+            is = i3 += 12 + (oc == -2 && 8), f = 3, this_1.c = 0;
+            return "break";
+          } else if (sig == 33639248) {
+            is = i3 -= 4, f = 3, this_1.c = 0;
+            return "break";
+          }
+        }
+      };
+      var this_1 = this;
+      for (; i3 < l - 4; ++i3) {
+        var state_1 = _loop_2();
+        if (state_1 === "break")
+          break;
+      }
+      this.p = et2;
+      if (oc < 0) {
+        var dat = f ? buf.subarray(0, is - 12 - (oc == -2 && 8) - (b4(buf, is - 16) == 134695760 && 4)) : buf.subarray(0, i3);
+        if (add)
+          add.push(dat, !!f);
+        else
+          this.k[+(f == 2)].push(dat);
+      }
+      if (f & 2)
+        return this.push(buf.subarray(i3), final);
+      this.p = buf.subarray(i3);
+    }
+    if (final) {
+      if (this.c)
+        err2(13);
+      this.p = null;
+    }
+  };
+  Unzip2.prototype.register = function(decoder) {
+    this.o[decoder.compression] = decoder;
+  };
+  return Unzip2;
+})();
+
+// packages/server/src/workflow-artifact-summary.ts
+import { z as z6 } from "zod";
+var maxArtifactBytes = 64 * 1024;
+var testResultsSummarySchema = z6.object({
+  schemaVersion: z6.literal(1),
+  runId: z6.number().int().positive(),
+  runAttempt: z6.number().int().positive(),
+  headSha: z6.string().min(1),
+  total: z6.number().int().nonnegative(),
+  passed: z6.number().int().nonnegative().optional(),
+  failed: z6.number().int().nonnegative().optional(),
+  skipped: z6.number().int().nonnegative().optional(),
+  metadata: z6.record(z6.string(), z6.unknown()).optional()
+}).superRefine((summary, ctx) => {
+  const outcomeTotal = (summary.passed ?? 0) + (summary.failed ?? 0) + (summary.skipped ?? 0);
+  for (const key of ["passed", "failed", "skipped"]) {
+    if (summary[key] !== void 0 && summary[key] > summary.total)
+      ctx.addIssue({ code: "custom", path: [key], message: "must not exceed total" });
+  }
+  if (outcomeTotal > summary.total)
+    ctx.addIssue({ code: "custom", path: ["total"], message: "must cover the declared outcomes" });
+});
+async function readTestResultsArtifact(response, entry) {
+  const reader = response.body?.getReader();
+  if (!reader) throw new Error("Artifact archive has no readable body.");
+  let compressedBytes = 0;
+  let entryCount = 0;
+  let outputBytes = 0;
+  let complete = false;
+  let failure2;
+  const chunks = [];
+  const archive = new Unzip((file) => {
+    entryCount += 1;
+    if (file.name !== entry || entryCount > 1) {
+      failure2 = new Error("Artifact archive has an unexpected entry.");
+      return;
+    }
+    if ((file.originalSize ?? 0) > maxArtifactBytes) {
+      failure2 = new Error("Artifact entry exceeds the configured size limit.");
+      return;
+    }
+    file.ondata = (error, data, final) => {
+      if (error) {
+        failure2 = error;
+        return;
+      }
+      outputBytes += data.length;
+      if (outputBytes > maxArtifactBytes) {
+        failure2 = new Error("Artifact entry exceeds the configured size limit.");
+        file.terminate();
+        return;
+      }
+      chunks.push(data);
+      if (final) complete = true;
+    };
+    file.start();
+  });
+  archive.register(UnzipInflate);
+  try {
+    for (; ; ) {
+      const { done, value: value2 } = await reader.read();
+      if (value2) {
+        compressedBytes += value2.length;
+        if (compressedBytes > maxArtifactBytes)
+          throw new Error("Artifact archive exceeds the configured size limit.");
+        archive.push(value2, done);
+      } else if (done) archive.push(new Uint8Array(), true);
+      if (done) break;
+      if (failure2) throw failure2;
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  if (failure2) throw failure2;
+  if (entryCount !== 1 || !complete)
+    throw new Error("Artifact archive did not contain the configured summary.");
+  return new TextDecoder("utf-8", { fatal: true }).decode(concat(chunks, outputBytes));
+}
+function concat(chunks, length) {
+  const result = new Uint8Array(length);
+  let offset = 0;
+  for (const chunk of chunks) {
+    result.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return result;
+}
+
+// packages/server/src/adapters/github-actions.ts
+var pipelinePanelSchema = z7.object({
+  id: z7.string().min(1),
+  type: z7.literal("pipeline-status"),
+  source: z7.string().min(1),
+  /** GitHub accepts a workflow filename or numeric workflow id in this URL segment. */
+  pipeline: z7.string().min(1)
+});
+var pullRequestHealthPanelSchema = z7.object({
+  id: z7.string().min(1),
+  type: z7.literal("pull-request-health"),
+  source: z7.string().min(1),
+  base_branch: z7.string().min(1),
+  update_workflows: z7.array(
+    z7.object({
+      workflow: z7.string().min(1),
+      branch_prefixes: z7.array(z7.string().min(1)).min(1)
+    })
+  ).min(1),
+  build_workflow: z7.string().min(1),
+  build_events: githubActionsBuildEventsSchema.optional()
+});
+var runSchema = z7.object({
+  id: z7.number().int().positive().optional(),
+  run_attempt: z7.number().int().positive().optional(),
+  head_sha: z7.string().min(1).optional(),
+  status: z7.string(),
+  conclusion: z7.string().nullable(),
+  name: z7.string().min(1),
+  html_url: z7.url(),
+  /** The GitHub Actions trigger that started this run. */
+  event: z7.string().min(1).optional(),
+  /** The branch that produced this run; absent for some event types. */
+  head_branch: z7.string().min(1).nullable().optional(),
+  // Timestamp quality should only remove timing advice, never make an otherwise useful run unreadable.
+  run_started_at: z7.string().nullable().optional(),
+  updated_at: z7.string().optional(),
+  created_at: z7.string().optional()
+});
+var artifactsSchema = z7.object({
+  artifacts: z7.array(
+    z7.object({ id: z7.number().int().positive(), name: z7.string().min(1), expired: z7.boolean() })
+  )
+});
+var runsSchema = z7.object({ workflow_runs: z7.array(runSchema) });
+var jobsSchema = z7.object({
+  jobs: z7.array(
+    z7.object({
+      name: z7.string().min(1),
+      status: z7.string(),
+      steps: z7.array(z7.object({ name: z7.string().min(1), status: z7.string() })).optional()
+    })
+  )
+});
+var pullRequestsSchema = z7.array(
+  z7.object({
+    number: z7.number().int().positive(),
+    html_url: z7.url(),
+    head: z7.object({ ref: z7.string().min(1) }),
+    base: z7.object({ ref: z7.string().min(1) })
+  })
+);
+function permittedGithubActionsCalls(panel, source, _credentials) {
+  const { panel: parsedPanel, source: parsedSource } = z7.object({ panel: pipelinePanelSchema, source: githubActionsSourceSchema }).parse({ panel, source });
+  const url = new URL(
+    `https://api.github.com/repos/${parsedSource.repo}/actions/workflows/${encodeURIComponent(parsedPanel.pipeline)}/runs`
+  );
+  if (parsedSource.branch) url.searchParams.set("branch", parsedSource.branch);
+  url.searchParams.set("per_page", "1");
+  return [{ url: url.toString(), headers: new Headers() }];
+}
+function testCountCapabilities(panel, source) {
+  return z7.object({ panel: testCountPanelSchema, source: githubActionsSourceSchema }).parse({ panel, source });
+}
+async function fetchGithubActionsTestCount(args) {
+  const { panel, source } = testCountCapabilities(args.panel, args.source);
+  const githubClient = githubClientFor(args);
+  const noValidators = new Headers();
+  let failureLink = sourceLinkForWorkflow(source, panel.pipeline);
+  let failureObservedAt;
+  try {
+    const selected = await selectGithubWorkflowRun({
+      ...args,
+      source,
+      workflow: panel.pipeline,
+      requestHeaders: noValidators,
+      githubClient
+    });
+    if (!selected.response.ok) return testCountFailure(panel.id, source, selected.response);
+    const { run } = selected;
+    if (!run?.id)
+      return testCountEnvelope(
+        noRunEnvelope(panel.id, source, panel.pipeline, selected.response.headers.get("date"))
+      );
+    const link = run.html_url;
+    const runObservedAt = selected.observedAt;
+    failureLink = link;
+    failureObservedAt = runObservedAt;
+    if (run.status !== "completed")
+      return testCountEnvelope({
+        panelId: panel.id,
+        state: "ok",
+        observedAt: runObservedAt,
+        link,
+        signal: { type: "test-count", status: "pending" }
+      });
+    const artifactsResponse = await githubFetch(
+      githubArtifactsCall(source, run.id, panel.test_results),
+      {
+        ...args,
+        source,
+        requestHeaders: noValidators,
+        githubClient
+      }
+    );
+    if (!artifactsResponse.ok) return testCountFailure(panel.id, source, artifactsResponse, link);
+    const artifactObservedAt = observedAt2(artifactsResponse.headers.get("date"));
+    failureObservedAt = oldestObservation(runObservedAt, artifactObservedAt);
+    const artifacts = artifactsSchema.parse(await artifactsResponse.json()).artifacts;
+    const matches = artifacts.filter((artifact2) => artifact2.name === panel.test_results.artifact);
+    if (matches.length === 0)
+      return testCountEnvelope({
+        panelId: panel.id,
+        state: "ok",
+        observedAt: oldestObservation(runObservedAt, artifactObservedAt),
+        link,
+        signal: { type: "test-count", status: "not-reported" }
+      });
+    if (matches.length !== 1 || matches[0]?.expired)
+      return testCountEnvelope(
+        errorEnvelope(
+          panel.id,
+          "upstream-error",
+          "The test-results artifact is unavailable.",
+          link
+        )
+      );
+    const [artifact] = matches;
+    if (!artifact)
+      return testCountEnvelope(
+        errorEnvelope(
+          panel.id,
+          "upstream-error",
+          "The test-results artifact is unavailable.",
+          link
+        )
+      );
+    const archiveResponse = await githubFetch(githubArtifactDownloadCall(source, artifact.id), {
+      ...args,
+      source,
+      requestHeaders: noValidators,
+      githubClient
+    });
+    if (!archiveResponse.ok) return testCountFailure(panel.id, source, archiveResponse, link);
+    const archiveObservedAt = observedAt2(archiveResponse.headers.get("date"));
+    failureObservedAt = oldestObservation(runObservedAt, artifactObservedAt, archiveObservedAt);
+    const summary = testResultsSummarySchema.parse(
+      JSON.parse(await readTestResultsArtifact(archiveResponse, panel.test_results.entry))
+    );
+    if (summary.runId !== run.id || summary.runAttempt !== run.run_attempt || summary.headSha !== run.head_sha)
+      throw new Error("Test-results manifest does not belong to the selected workflow run.");
+    return testCountEnvelope({
+      panelId: panel.id,
+      state: "ok",
+      observedAt: oldestObservation(runObservedAt, artifactObservedAt, archiveObservedAt),
+      link,
+      signal: {
+        type: "test-count",
+        status: "reported",
+        total: summary.total,
+        ...summary.passed === void 0 ? {} : { passed: summary.passed },
+        ...summary.failed === void 0 ? {} : { failed: summary.failed },
+        ...summary.skipped === void 0 ? {} : { skipped: summary.skipped }
+      }
+    });
+  } catch (error) {
+    return testCountEnvelope(
+      errorEnvelope(
+        panel.id,
+        error instanceof GithubAuthenticationError ? "unauthorized" : "upstream-error",
+        error,
+        failureLink,
+        failureObservedAt
+      )
+    );
+  }
+}
+function pullRequestHealthCapabilities(panel) {
+  const { panel: parsed } = z7.object({ panel: pullRequestHealthPanelSchema }).parse({ panel });
+  return {
+    panel: parsed,
+    configuredUpdateWorkflow(workflow) {
+      return parsed.update_workflows.find((candidate) => candidate.workflow === workflow);
+    },
+    permitsBuildBranch(branch) {
+      return parsed.update_workflows.some(
+        ({ branch_prefixes }) => branch_prefixes.some((prefix) => branch.startsWith(prefix))
+      );
+    }
+  };
+}
+function githubRunsCall(source, workflow, branch, event, perPage = 1, created) {
+  const url = new URL(
+    `https://api.github.com/repos/${source.repo}/actions/workflows/${encodeURIComponent(workflow)}/runs`
+  );
+  if (branch) url.searchParams.set("branch", branch);
+  if (event) url.searchParams.set("event", event);
+  if (created) url.searchParams.set("created", `>=${created}`);
+  url.searchParams.set("per_page", String(perPage));
+  return { url: url.toString(), headers: new Headers() };
+}
+function sourceLinkForRepository(source) {
+  return `https://github.com/${source.repo}`;
+}
+async function fetchGithubActionsPipeline(args) {
+  const parsedSource = githubActionsSourceSchema.parse(args.source);
+  const parsedPanel = pipelinePanelSchema.parse(args.panel);
+  const githubClient = githubClientFor(args);
+  let selected;
+  try {
+    selected = await selectGithubWorkflowRun({
+      ...args,
+      source: parsedSource,
+      workflow: parsedPanel.pipeline,
+      githubClient
+    });
+  } catch (error) {
+    return {
+      response: new Response(
+        JSON.stringify(
+          errorEnvelope(
+            args.panel.id,
+            error instanceof GithubAuthenticationError ? "unauthorized" : "unreachable",
+            error,
+            sourceLink(args.panel, args.source)
+          )
+        ),
+        { status: 200 }
+      ),
+      failure: {
+        kind: error instanceof GithubAuthenticationError ? "unauthorized" : "unreachable",
+        ...safeNetworkCode(error) ? { networkCode: safeNetworkCode(error) } : {}
+      }
+    };
+  }
+  const upstream = selected.response;
+  if (upstream.status === 304) return { response: upstream };
+  if (!upstream.ok) return githubPipelineFailure(args, upstream);
+  try {
+    const run = selected.run;
+    if (!run) {
+      return {
+        response: new Response(
+          JSON.stringify(
+            errorEnvelope(
+              args.panel.id,
+              "no-runs",
+              parsedSource.branch ? `No workflow runs found for branch "${parsedSource.branch}". Check the source's branch setting.` : "No workflow runs found.",
+              sourceLink(args.panel, args.source),
+              observedAt2(upstream.headers.get("date"))
+            )
+          ),
+          { status: 200 }
+        ),
+        failure: { kind: "no-runs", upstreamStatus: upstream.status }
+      };
+    }
+    const signal = {
+      type: "pipeline-status",
+      status: normalizeStatus(run.status, run.conclusion),
+      rawStatus: run.conclusion ?? run.status,
+      name: run.name,
+      ...run.head_branch ?? parsedSource.branch ? { branch: run.head_branch ?? parsedSource.branch } : {},
+      ...timestamp(run.updated_at) ? { sourceUpdatedAt: timestamp(run.updated_at) } : {},
+      ...timestamp(run.run_started_at) ? { runStartedAt: timestamp(run.run_started_at) } : {},
+      ...run.id !== void 0 ? { sourceRunId: String(run.id) } : {},
+      ...run.status === "completed" ? completedRunDuration(run) : {}
+    };
+    if (signal.status === "running" && run.id !== void 0) {
+      const activity = await activeGithubActivity({
+        source: parsedSource,
+        runId: run.id,
+        requestHeaders: args.requestHeaders,
+        fetcher: args.fetcher,
+        githubClient: githubClientFor(args)
+      });
+      if (activity) signal.activity = activity;
+    }
+    const envelope = {
+      panelId: args.panel.id,
+      state: "ok",
+      observedAt: observedAt2(upstream.headers.get("date")),
+      link: run.html_url,
+      signal
+    };
+    return { envelope, response: upstream };
+  } catch (error) {
+    return {
+      response: new Response(
+        JSON.stringify(
+          errorEnvelope(
+            args.panel.id,
+            "upstream-error",
+            error,
+            sourceLink(args.panel, args.source),
+            observedAt2(upstream.headers.get("date"))
+          )
+        ),
+        { status: 200 }
+      ),
+      failure: { kind: "upstream-error", upstreamStatus: upstream.status }
+    };
+  }
+}
+function githubPipelineFailure(args, upstream) {
+  return {
+    response: new Response(
+      JSON.stringify(
+        errorEnvelope(
+          args.panel.id,
+          errorKind(upstream.status),
+          `${upstream.status} ${upstream.statusText}`,
+          sourceLink(args.panel, args.source),
+          observedAt2(upstream.headers.get("date"))
+        )
+      ),
+      { status: 200 }
+    ),
+    failure: { kind: errorKind(upstream.status), upstreamStatus: upstream.status }
+  };
+}
+function recentRunsCreatedAt(now = /* @__PURE__ */ new Date()) {
+  return new Date(now.valueOf() - 30 * 24 * 60 * 60 * 1e3).toISOString();
+}
+function newestGithubRun(runs) {
+  return runs.reduce((newest, candidate) => {
+    if (!newest) return candidate;
+    const candidateCreatedAt = Date.parse(candidate.created_at ?? "");
+    const newestCreatedAt = Date.parse(newest.created_at ?? "");
+    if (candidateCreatedAt > newestCreatedAt) return candidate;
+    if (candidateCreatedAt < newestCreatedAt) return newest;
+    return (candidate.id ?? 0) > (newest.id ?? 0) ? candidate : newest;
+  }, void 0);
+}
+async function selectGithubWorkflowRun(args) {
+  let response = await githubFetch(
+    githubRunsCall(
+      args.source,
+      args.workflow,
+      args.source.branch,
+      void 0,
+      100,
+      recentRunsCreatedAt()
+    ),
+    args
+  );
+  if (response.status === 304 || !response.ok)
+    return { response, observedAt: observedAt2(response.headers.get("date")), run: void 0 };
+  let runs = runsSchema.parse(await response.json()).workflow_runs;
+  if (runs.length === 0) {
+    response = await githubFetch(
+      githubRunsCall(args.source, args.workflow, args.source.branch),
+      args
+    );
+    if (response.status === 304 || !response.ok)
+      return { response, observedAt: observedAt2(response.headers.get("date")), run: void 0 };
+    runs = runsSchema.parse(await response.json()).workflow_runs;
+  }
+  return {
+    response,
+    observedAt: observedAt2(response.headers.get("date")),
+    run: newestGithubRun(runs)
+  };
+}
+async function activeGithubActivity(args) {
+  const call = githubJobsCall(args.source, args.runId);
+  try {
+    const response = await githubFetch(call, args);
+    if (!response.ok) return void 0;
+    const jobs = jobsSchema.parse(await response.json()).jobs;
+    const job = jobs.find((candidate) => candidate.status === "in_progress") ?? jobs.find((candidate) => candidate.status === "queued");
+    if (!job) return void 0;
+    const step = job.steps?.find((candidate) => candidate.status === "in_progress");
+    return step ? { kind: "step", name: step.name, parent: job.name } : { kind: "job", name: job.name };
+  } catch {
+    return void 0;
+  }
+}
+async function githubFetch(call, args) {
+  return args.githubClient.get({
+    source: args.source,
+    url: call.url,
+    requestHeaders: args.requestHeaders,
+    fetcher: args.fetcher
+  });
+}
+function githubClientFor(args) {
+  return args.githubClient ?? createGithubClient(args.credentials ?? environmentCredentials());
+}
+function githubJobsCall(source, runId) {
+  const url = new URL(`https://api.github.com/repos/${source.repo}/actions/runs/${runId}/jobs`);
+  url.searchParams.set("per_page", "100");
+  return { url: url.toString(), headers: new Headers() };
+}
+function githubArtifactsCall(source, runId, testResults) {
+  const url = new URL(`https://api.github.com/repos/${source.repo}/actions/runs/${runId}/artifacts`);
+  url.searchParams.set("name", testResults.artifact);
+  url.searchParams.set("per_page", "100");
+  return { url: url.toString(), headers: new Headers() };
+}
+function githubArtifactDownloadCall(source, artifactId) {
+  return {
+    url: `https://api.github.com/repos/${source.repo}/actions/artifacts/${artifactId}/zip`,
+    headers: new Headers()
+  };
+}
+function noRunEnvelope(panelId, source, pipeline, date) {
+  return {
+    panelId,
+    state: "error",
+    observedAt: observedAt2(date),
+    link: sourceLinkForWorkflow(source, pipeline),
+    error: {
+      kind: "no-runs",
+      message: "No matching workflow runs were found. Check the configured workflow and branch."
+    }
+  };
+}
+function testCountFailure(panelId, source, response, link = sourceLinkForRepository(source)) {
+  return testCountEnvelope(
+    errorEnvelope(
+      panelId,
+      errorKind(response.status),
+      `${response.status} ${response.statusText}`,
+      link,
+      observedAt2(response.headers.get("date"))
+    ),
+    { kind: errorKind(response.status), upstreamStatus: response.status }
+  );
+}
+function testCountEnvelope(envelope, failure2) {
+  return { envelope, response: new Response(null), ...failure2 ? { failure: failure2 } : {} };
+}
+function oldestObservation(...values) {
+  return values.reduce((oldest, value2) => Date.parse(value2) < Date.parse(oldest) ? value2 : oldest);
+}
+function completedRunDuration(run) {
+  const startedAt = timestamp(run.run_started_at);
+  const updatedAt = timestamp(run.updated_at);
+  if (!startedAt || !updatedAt) return {};
+  const durationMs = new Date(updatedAt).valueOf() - new Date(startedAt).valueOf();
+  return Number.isFinite(durationMs) && durationMs >= 0 ? { durationMs } : {};
+}
+function timestamp(value2) {
+  if (!value2 || !z7.iso.datetime().safeParse(value2).success) return void 0;
+  return Number.isFinite(new Date(value2).valueOf()) ? value2 : void 0;
+}
+function normalizeStatus(status, conclusion) {
+  if (status !== "completed") return "running";
+  if (conclusion === "success") return "passed";
+  if (conclusion === "failure" || conclusion === "timed_out") return "failed";
+  if (conclusion === "cancelled") return "cancelled";
+  return "unknown";
+}
+function errorKind(status) {
+  return upstreamErrorKind(status);
+}
+function errorEnvelope(panelId, kind, error, link, observedAt4 = (/* @__PURE__ */ new Date()).toISOString()) {
+  return upstreamErrorEnvelope({ panelId, kind, error, link, upstreamDate: observedAt4 });
+}
+function sourceLink(panel, source) {
+  const parsedPanel = z7.object({ pipeline: z7.string().min(1) }).parse(panel);
+  const parsedSource = githubActionsSourceSchema.parse(source);
+  return sourceLinkForWorkflow(parsedSource, parsedPanel.pipeline);
+}
+function sourceLinkForWorkflow(source, pipeline) {
+  return `https://github.com/${source.repo}/actions/workflows/${encodeURIComponent(pipeline)}`;
+}
+function observedAt2(value2) {
+  return observedAt(value2);
+}
+
+// packages/server/src/configuration-error.ts
+var ConfigurationError = class extends Error {
+  constructor(message2, diagnostics) {
+    super(message2);
+    this.diagnostics = diagnostics;
+  }
+  diagnostics;
+};
+function configurationLocation(path) {
+  return path.reduce(
+    (location, part) => typeof part === "number" ? `${location}[${part}]` : `${location}${location ? "." : ""}${String(part)}`,
+    ""
+  ) || "configuration";
+}
+function boardConfigurationLocation(config, path) {
+  const [record, key, ...rest] = path;
+  if ((record === "boards" || record === "sources") && key !== void 0) {
+    const entries = config && typeof config === "object" ? Reflect.get(config, record) : void 0;
+    const index = entries && typeof entries === "object" ? Object.keys(entries).indexOf(String(key)) : -1;
+    return configurationLocation([record, index, ...rest]);
+  }
+  return configurationLocation(path);
+}
+function schemaDiagnostics(error, locate, kind = "schema") {
+  return error.issues.map((issue) => ({
+    kind,
+    location: locate(issue.path),
+    constraint: correctiveConstraint(issue)
+  }));
+}
+function correctiveConstraint(issue) {
+  switch (issue.code) {
+    case "invalid_type":
+      return `Provide a value of type ${issue.expected}.`;
+    case "too_big":
+      return `Use ${issue.inclusive ? "at most" : "fewer than"} ${issue.maximum} ${issue.origin === "array" ? "entries" : issue.origin === "string" ? "characters" : "as the value"}.`;
+    case "too_small":
+      return `Use ${issue.inclusive ? "at least" : "more than"} ${issue.minimum} ${issue.origin === "array" ? "entries" : issue.origin === "string" ? "characters" : "as the value"}.`;
+    // Format messages are fixed by our schemas (or Zod); unlike custom issues they contain no authored values.
+    case "invalid_format":
+      return issue.message;
+    case "invalid_value":
+      return "Use one of the values allowed by the board schema.";
+    case "custom":
+      return typeof issue.params?.constraint === "string" ? issue.params.constraint : "Correct this field according to the board schema.";
+    default:
+      return "Provide a value matching the board schema for this field.";
+  }
+}
+
+// packages/server/src/adapters/azure-devops.ts
+import { readFile } from "node:fs/promises";
+import { z as z8 } from "zod";
+var pipelinePanelSchema2 = z8.object({
+  id: z8.string().min(1),
+  type: z8.literal("pipeline-status"),
+  source: z8.string().min(1),
+  pipeline: z8.number().int().positive()
+});
+var buildSchema = z8.object({
+  id: z8.number().int().positive(),
+  buildNumber: z8.string().min(1),
+  status: z8.string().nullable().optional(),
+  result: z8.string().nullable().optional(),
+  sourceBranch: z8.string().min(1).nullable().optional(),
+  startTime: z8.string().nullable().optional(),
+  finishTime: z8.string().nullable().optional(),
+  lastChangedDate: z8.string().nullable().optional()
+});
+var buildsSchema = z8.object({ value: z8.array(buildSchema) });
+var timelineSchema = z8.object({
+  records: z8.array(
+    z8.object({
+      id: z8.string().min(1),
+      parentId: z8.string().min(1).nullable().optional(),
+      type: z8.string().min(1),
+      name: z8.string().min(1),
+      state: z8.string().nullable().optional()
+    })
+  )
+});
+function permittedAzureDevOpsCalls(panel, source) {
+  const { panel: parsedPanel, source: parsedSource } = z8.object({ panel: pipelinePanelSchema2, source: azureDevOpsSourceSchema }).parse({ panel, source });
+  return [buildsCall(parsedPanel.pipeline, parsedSource)];
+}
+async function fetchAzureDevOpsPipeline(args) {
+  const panel = pipelinePanelSchema2.parse(args.panel);
+  const source = azureDevOpsSourceSchema.parse(args.source);
+  const authorization = await azureDevOpsAuthorization(source, args.credentials);
+  if (!authorization) {
+    return {
+      response: errorResponse(
+        errorEnvelope2(
+          panel.id,
+          "unauthorized",
+          "Azure DevOps credentials are not available.",
+          sourceLink2(panel.pipeline, source)
+        )
+      ),
+      failure: { kind: "unauthorized" }
+    };
+  }
+  const call = buildsCall(panel.pipeline, source);
+  copyValidators(args.requestHeaders, call.headers);
+  call.headers.set("authorization", authorization);
+  let upstream;
+  try {
+    upstream = await args.fetcher(call.url, { headers: call.headers });
+  } catch (error) {
+    return {
+      response: errorResponse(
+        errorEnvelope2(panel.id, "unreachable", error, sourceLink2(panel.pipeline, source))
+      ),
+      failure: {
+        kind: "unreachable",
+        ...safeNetworkCode(error) ? { networkCode: safeNetworkCode(error) } : {}
       }
+    };
+  }
+  if (upstream.status === 304) return { response: upstream };
+  if (!upstream.ok) {
+    return {
+      response: errorResponse(
+        errorEnvelope2(
+          panel.id,
+          errorKind2(upstream.status),
+          `${upstream.status} ${upstream.statusText}`,
+          sourceLink2(panel.pipeline, source),
+          observedAt3(upstream.headers.get("date"))
+        )
+      ),
+      failure: { kind: errorKind2(upstream.status), upstreamStatus: upstream.status }
+    };
+  }
+  try {
+    const build = buildsSchema.parse(await upstream.json()).value[0];
+    if (!build) {
+      return {
+        response: errorResponse(
+          errorEnvelope2(
+            panel.id,
+            "no-runs",
+            source.branch ? `No builds found for branch "${source.branch}". Check the source's branch setting.` : "No builds found.",
+            sourceLink2(panel.pipeline, source),
+            observedAt3(upstream.headers.get("date"))
+          )
+        ),
+        failure: { kind: "no-runs", upstreamStatus: upstream.status }
+      };
+    }
+    const signal = {
+      type: "pipeline-status",
+      status: normalizeStatus2(build.status, build.result),
+      rawStatus: build.result ?? build.status ?? "unknown",
+      name: build.buildNumber,
+      ...build.sourceBranch ?? source.branch ? { branch: build.sourceBranch ?? source.branch } : {},
+      ...timestamp2(build.startTime) ? { runStartedAt: timestamp2(build.startTime) } : {},
+      ...timestamp2(build.lastChangedDate) ? { sourceUpdatedAt: timestamp2(build.lastChangedDate) } : {},
+      sourceRunId: String(build.id),
+      ...completedBuildDuration(build)
+    };
+    if (signal.status === "running") {
+      const activity = await activeAzureDevOpsActivity({
+        buildId: build.id,
+        source,
+        fetcher: args.fetcher,
+        authorization: call.headers.get("authorization") ?? ""
+      });
+      if (activity) signal.activity = activity;
     }
+    return {
+      envelope: {
+        panelId: panel.id,
+        state: "ok",
+        observedAt: observedAt3(upstream.headers.get("date")),
+        link: buildLink(build.id, source),
+        signal
+      },
+      response: upstream
+    };
+  } catch (error) {
+    return {
+      response: errorResponse(
+        errorEnvelope2(
+          panel.id,
+          "upstream-error",
+          error,
+          sourceLink2(panel.pipeline, source),
+          observedAt3(upstream.headers.get("date"))
+        )
+      ),
+      failure: { kind: "upstream-error", upstreamStatus: upstream.status }
+    };
   }
-  return allowed;
 }
-function panelCapability(panel, source) {
+var delegatedTokenFileSchema = z8.object({
+  accessToken: z8.string().min(1),
+  expiresAt: z8.string().min(1)
+});
+async function azureDevOpsAuthorization(source, credentials) {
+  if (source.token_env) {
+    const token = credentials.get(source.token_env);
+    return token ? `Basic ${btoa(`:${token}`)}` : void 0;
+  }
+  if (!source.entra_token_file_env) return void 0;
+  const tokenFile = credentials.get(source.entra_token_file_env);
+  if (!tokenFile) return void 0;
+  try {
+    const token = delegatedTokenFileSchema.parse(JSON.parse(await readFile(tokenFile, "utf8")));
+    const expiresAt = Date.parse(token.expiresAt);
+    if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) return void 0;
+    return `Bearer ${token.accessToken}`;
+  } catch {
+    return void 0;
+  }
+}
+function buildsCall(definitionId, source) {
+  const url = apiUrl(source, "build/builds");
+  url.searchParams.set("definitions", String(definitionId));
+  if (source.branch) url.searchParams.set("branchName", adoBranch(source.branch));
+  url.searchParams.set("queryOrder", "queueTimeDescending");
+  url.searchParams.set("$top", "1");
+  return { url: url.toString(), headers: new Headers({ accept: "application/json" }) };
+}
+function timelineCall(buildId, source) {
+  return {
+    url: apiUrl(source, `build/builds/${buildId}/timeline`).toString(),
+    headers: new Headers({ accept: "application/json" })
+  };
+}
+function apiUrl(source, suffix) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(source.organization)}/${encodeURIComponent(source.project)}/_apis/${suffix}`
+  );
+  url.searchParams.set("api-version", "7.1");
+  return url;
+}
+function adoBranch(branch) {
+  return branch.startsWith("refs/") ? branch : `refs/heads/${branch}`;
+}
+async function activeAzureDevOpsActivity(args) {
+  const call = timelineCall(args.buildId, args.source);
+  call.headers.set("authorization", args.authorization);
+  try {
+    const response = await args.fetcher(call.url, { headers: call.headers });
+    if (!response.ok) return void 0;
+    const records = timelineSchema.parse(await response.json()).records;
+    const active = records.find((record) => record.state === "inProgress");
+    if (!active) return void 0;
+    const parent = active.parentId ? records.find((record) => record.id === active.parentId) : void 0;
+    const kind = active.type.toLowerCase();
+    return {
+      kind: kind === "stage" ? "stage" : kind === "job" ? "job" : "step",
+      name: active.name,
+      ...parent ? { parent: parent.name } : {}
+    };
+  } catch {
+    return void 0;
+  }
+}
+function normalizeStatus2(status, result) {
+  if (status === "notStarted" || status === "postponed" || status === "inProgress" || status === "cancelling")
+    return "running";
+  if (status !== "completed") return "unknown";
+  if (result === "succeeded") return "passed";
+  if (result === "failed") return "failed";
+  if (result === "partiallySucceeded") return "warning";
+  if (result === "canceled") return "cancelled";
+  return "unknown";
+}
+function completedBuildDuration(build) {
+  const startedAt = timestamp2(build.startTime);
+  const finishedAt = timestamp2(build.finishTime);
+  if (!startedAt || !finishedAt) return {};
+  const durationMs = new Date(finishedAt).valueOf() - new Date(startedAt).valueOf();
+  return Number.isFinite(durationMs) && durationMs >= 0 ? { durationMs } : {};
+}
+function timestamp2(value2) {
+  if (!value2 || !z8.iso.datetime().safeParse(value2).success) return void 0;
+  return Number.isFinite(new Date(value2).valueOf()) ? value2 : void 0;
+}
+function copyValidators(requestHeaders, upstreamHeaders) {
+  forwardValidators(requestHeaders, upstreamHeaders);
+}
+function buildLink(buildId, source) {
+  return `https://dev.azure.com/${encodeURIComponent(source.organization)}/${encodeURIComponent(source.project)}/_build/results?buildId=${buildId}`;
+}
+function sourceLink2(definitionId, source) {
+  return `https://dev.azure.com/${encodeURIComponent(source.organization)}/${encodeURIComponent(source.project)}/_build?definitionId=${definitionId}`;
+}
+function errorResponse(envelope) {
+  return upstreamErrorResponse(envelope);
+}
+function errorEnvelope2(panelId, kind, error, link, date) {
+  return upstreamErrorEnvelope({ panelId, kind, error, link, upstreamDate: date });
+}
+function errorKind2(status) {
+  return upstreamErrorKind(status);
+}
+function observedAt3(value2) {
+  return observedAt(value2);
+}
+
+// packages/server/src/adapters/gitlab-ci.ts
+import { z as z9 } from "zod";
+var pipelinePanelSchema3 = z9.object({
+  id: z9.string().min(1),
+  type: z9.literal("pipeline-status"),
+  source: z9.string().min(1)
+});
+var pipelineSchema = z9.object({
+  id: z9.number().int().positive(),
+  name: z9.string().min(1).nullable().optional(),
+  status: z9.string(),
+  ref: z9.string().min(1).nullable().optional(),
+  created_at: z9.string().nullable().optional(),
+  updated_at: z9.string().nullable().optional(),
+  web_url: z9.url()
+});
+function permittedGitlabCiCalls(panel, source) {
+  const { source: parsedSource } = z9.object({ panel: pipelinePanelSchema3, source: gitlabCiSourceSchema }).parse({ panel, source });
+  return [pipelinesCall(parsedSource)];
+}
+async function fetchGitlabCiPipeline(args) {
+  const panel = pipelinePanelSchema3.parse(args.panel);
+  const source = gitlabCiSourceSchema.parse(args.source);
+  const token = args.credentials.get(source.token_env);
+  if (!token)
+    return failure(
+      panel.id,
+      "unauthorized",
+      "GitLab credentials are not available.",
+      sourceLink3(source)
+    );
+  const call = pipelinesCall(source);
+  forwardValidators(args.requestHeaders, call.headers);
+  call.headers.set("private-token", token);
+  let upstream;
+  try {
+    upstream = await args.fetcher(call.url, { headers: call.headers });
+  } catch (error) {
+    return failure(panel.id, "unreachable", error, sourceLink3(source), void 0, {
+      kind: "unreachable",
+      ...safeNetworkCode(error) ? { networkCode: safeNetworkCode(error) } : {}
+    });
+  }
+  if (upstream.status === 304) return { response: upstream };
+  if (!upstream.ok) {
+    const kind = upstreamErrorKind(upstream.status);
+    return failure(
+      panel.id,
+      kind,
+      `${upstream.status} ${upstream.statusText}`,
+      sourceLink3(source),
+      upstream.headers.get("date"),
+      { kind, upstreamStatus: upstream.status }
+    );
+  }
+  try {
+    const pipeline = z9.array(pipelineSchema).parse(await upstream.json())[0];
+    if (!pipeline) {
+      const detail = source.branch ? `No pipelines found for ref "${source.branch}". Check the source's branch setting.` : "No pipelines found.";
+      return failure(
+        panel.id,
+        "no-runs",
+        detail,
+        sourceLink3(source),
+        upstream.headers.get("date"),
+        {
+          kind: "no-runs",
+          upstreamStatus: upstream.status
+        }
+      );
+    }
+    const signal = {
+      type: "pipeline-status",
+      status: normalizeStatus3(pipeline.status),
+      rawStatus: pipeline.status,
+      name: pipeline.name ?? `Pipeline #${pipeline.id}`,
+      ...pipeline.ref ?? source.branch ? { branch: pipeline.ref ?? source.branch } : {},
+      ...timestamp3(pipeline.created_at) ? { runStartedAt: timestamp3(pipeline.created_at) } : {},
+      ...timestamp3(pipeline.updated_at) ? { sourceUpdatedAt: timestamp3(pipeline.updated_at) } : {},
+      sourceRunId: String(pipeline.id)
+    };
+    const envelope = {
+      panelId: panel.id,
+      state: "ok",
+      observedAt: observedAt(upstream.headers.get("date")),
+      link: publicLink(pipeline.web_url),
+      signal
+    };
+    return { envelope, response: upstream };
+  } catch (error) {
+    return failure(
+      panel.id,
+      "upstream-error",
+      error,
+      sourceLink3(source),
+      upstream.headers.get("date"),
+      { kind: "upstream-error", upstreamStatus: upstream.status }
+    );
+  }
+}
+function pipelinesCall(source) {
+  const url = new URL(source.url);
+  url.pathname = `${url.pathname.replace(/\/$/, "")}/api/v4/projects/${encodeURIComponent(source.project)}/pipelines`;
+  url.searchParams.set("per_page", "1");
+  if (source.branch) url.searchParams.set("ref", source.branch);
+  return { url: url.toString(), headers: new Headers({ accept: "application/json" }) };
+}
+function sourceLink3(source) {
+  const url = new URL(source.url);
+  url.pathname = `${url.pathname.replace(/\/$/, "")}/${source.project.split("/").map(encodeURIComponent).join("/")}/-/pipelines`;
+  return url.toString();
+}
+function normalizeStatus3(status) {
+  if (["created", "waiting_for_resource", "preparing", "pending", "running"].includes(status))
+    return "running";
+  if (status === "success") return "passed";
+  if (status === "failed") return "failed";
+  if (status === "canceled") return "cancelled";
+  if (["manual", "skipped", "scheduled"].includes(status)) return "warning";
+  return "unknown";
+}
+function timestamp3(value2) {
+  if (!value2 || !z9.iso.datetime().safeParse(value2).success) return void 0;
+  return Number.isFinite(new Date(value2).valueOf()) ? value2 : void 0;
+}
+function failure(panelId, kind, error, link, date, failure2) {
+  return {
+    response: upstreamErrorResponse(
+      upstreamErrorEnvelope({ panelId, kind, error, link, upstreamDate: date })
+    ),
+    ...failure2 ? { failure: failure2 } : { failure: { kind } }
+  };
+}
+
+// packages/server/src/adapters/http-value.ts
+import { z as z10 } from "zod";
+function permittedHttpValueCalls(panel) {
+  const grouped = httpValueGroupedPanelSchema.safeParse(panel);
+  const urls = grouped.success ? grouped.data.facts.map((fact) => fact.url) : [z10.object({ panel: httpValueScalarPanelSchema }).parse({ panel }).panel.url];
+  return urls.map(permittedCall);
+}
+async function fetchHttpValue(args) {
+  const panel = httpValueScalarPanelSchema.parse(args.panel);
+  const [call] = permittedHttpValueCalls(args.panel);
+  if (!call) throw new Error("http-value adapter declared no permitted call");
+  forwardValidators(args.requestHeaders, call.headers);
+  let upstream;
+  try {
+    upstream = await args.fetcher(call.url, { headers: call.headers });
+  } catch (error) {
+    return {
+      response: errorResponse2("unreachable", error, panel),
+      failure: {
+        kind: "unreachable",
+        ...safeNetworkCode(error) ? { networkCode: safeNetworkCode(error) } : {}
+      }
+    };
+  }
+  if (upstream.status === 304) return { response: upstream };
+  if (!upstream.ok) {
+    return {
+      response: errorResponse2(
+        upstreamErrorKind(upstream.status),
+        `${upstream.status} ${upstream.statusText}`,
+        panel,
+        upstream
+      ),
+      failure: { kind: upstreamErrorKind(upstream.status), upstreamStatus: upstream.status }
+    };
+  }
+  try {
+    const text = await upstream.text();
+    const value2 = panel.json_path ? extractJsonPath(JSON.parse(text), panel.json_path) : parseValue(text);
+    const signal = { type: "http-value", value: value2 };
+    return {
+      envelope: {
+        panelId: panel.id,
+        state: "ok",
+        observedAt: observedAt(upstream.headers.get("date")),
+        link: publicLink(panel.link ?? panel.url),
+        signal
+      },
+      response: upstream
+    };
+  } catch (error) {
+    return {
+      response: errorResponse2("upstream-error", error, panel, upstream),
+      failure: { kind: "upstream-error", upstreamStatus: upstream.status }
+    };
+  }
+}
+function permittedCall(value2) {
+  const url = new URL(value2);
+  if (url.protocol !== "http:" && url.protocol !== "https:")
+    throw new Error("http-value URLs must use http or https");
+  return { url: url.toString(), headers: new Headers({ accept: "application/json, text/plain" }) };
+}
+function parseValue(text) {
+  const trimmed = text.trim();
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (typeof parsed === "string" || typeof parsed === "number" || typeof parsed === "boolean")
+      return parsed;
+  } catch {
+  }
+  return trimmed;
+}
+function extractJsonPath(value2, path) {
+  let current = value2;
+  const segments = path === "$" ? [] : path.slice(1).split(/\.|\[|\]/).filter(Boolean);
+  for (const segment of segments) {
+    if (typeof current !== "object" || current === null || !(segment in current))
+      throw new Error(`JSON path ${path} was not found`);
+    current = current[segment];
+  }
+  if (typeof current !== "string" && typeof current !== "number" && typeof current !== "boolean") {
+    throw new Error(`JSON path ${path} did not select a scalar value`);
+  }
+  return current;
+}
+function errorResponse2(kind, error, panel, response) {
+  return upstreamErrorResponse(
+    upstreamErrorEnvelope({
+      panelId: panel.id,
+      kind,
+      error,
+      link: panel.link ?? panel.url,
+      upstreamDate: response?.headers.get("date")
+    })
+  );
+}
+
+// packages/server/src/panel-adapters.ts
+function readPanelAdapter(panel, source) {
   if (panel.type === "pipeline-status" && source?.type === "github-actions") {
     permittedGithubActionsCalls(panel, source);
-    return { kind: "server", operations: ["read"] };
+    return {
+      destination: () => "https://api.github.com",
+      fetch: ({ source: _configuredSource, ...args }) => fetchGithubActionsPipeline({ ...args, source })
+    };
+  }
+  if (panel.type === "test-count" && source?.type === "github-actions") {
+    testCountCapabilities(panel, source);
+    return {
+      destination: () => "https://api.github.com",
+      fetch: ({ source: _configuredSource, ...args }) => fetchGithubActionsTestCount({ ...args, source })
+    };
   }
   if (panel.type === "pipeline-status" && source?.type === "azure-devops") {
     permittedAzureDevOpsCalls(panel, source);
-    return { kind: "server", operations: ["read"] };
+    return {
+      destination: () => "https://dev.azure.com",
+      fetch: ({ source: _configuredSource, ...args }) => fetchAzureDevOpsPipeline({ ...args, source })
+    };
   }
   if (panel.type === "pipeline-status" && source?.type === "gitlab-ci") {
     permittedGitlabCiCalls(panel, source);
-    return { kind: "server", operations: ["read"] };
+    return {
+      destination: (_panel, resolvedSource) => resolvedSource && "url" in resolvedSource && typeof resolvedSource.url === "string" ? resolvedSource.url : "https://gitlab.com",
+      fetch: ({ source: _configuredSource, ...args }) => fetchGitlabCiPipeline({ ...args, source })
+    };
   }
   if (panel.type === "http-value") {
     permittedHttpValueCalls(panel);
-    return { kind: "server", operations: ["read"] };
+    return {
+      destination: (configuredPanel) => configuredPanel.url ?? "",
+      ...panel.facts ? {} : { fetch: (args) => fetchHttpValue(args) }
+    };
+  }
+  return void 0;
+}
+
+// packages/server/src/allowlist.ts
+function deriveValidatedAllowlist(config) {
+  return derive(config, true);
+}
+function derive(config, rejectUnsupported) {
+  const allowed = /* @__PURE__ */ new Map();
+  for (const [boardName, board] of Object.entries(config.boards)) {
+    for (const panel of board.panels) {
+      const source = panel.source ? config.sources[panel.source] : void 0;
+      try {
+        const capability = panelCapability(panel, source);
+        if (capability.kind === "unsupported") {
+          if (rejectUnsupported) throw new Error("no bounded operations");
+          continue;
+        }
+        if (capability.kind === "server")
+          allowed.set(`${boardName}/${panel.id}`, new Set(capability.operations));
+      } catch (error) {
+        if (rejectUnsupported) {
+          const location = `boards[${Object.keys(config.boards).indexOf(boardName)}].panels[${board.panels.indexOf(panel)}]`;
+          throw new ConfigurationError(
+            unsupportedPanelOperation(boardName, panel, source, error).message,
+            error instanceof ZodError ? schemaDiagnostics(
+              error,
+              ([subject, ...path]) => {
+                const root = subject === "source" ? ["sources", Object.keys(config.sources).indexOf(panel.source ?? "")] : [
+                  "boards",
+                  Object.keys(config.boards).indexOf(boardName),
+                  "panels",
+                  board.panels.indexOf(panel)
+                ];
+                return configurationLocation([...root, ...path]);
+              },
+              "panel-admission"
+            ) : [
+              {
+                kind: "panel-admission",
+                location,
+                constraint: "Use a supported panel/source combination with bounded HTTP(S) operations."
+              }
+            ]
+          );
+        }
+        throw error;
+      }
+    }
   }
+  return allowed;
+}
+function panelCapability(panel, source) {
+  if (readPanelAdapter(panel, source)) return { kind: "server", operations: ["read"] };
   if (panel.type === "pull-request-health" && source?.type === "github-actions") {
     pullRequestHealthCapabilities(panel);
     return {