@continuous-excellence/ze-great-dashboard-aws 0.31.55 → 0.31.57

package/dist/lambda.mjs

@@ -71654,6 +71654,12 @@ var testCountSchema = external_exports.discriminatedUnion("status", [
     type: external_exports.literal("test-count"),
     status: external_exports.literal("reported"),
     total: external_exports.number().int().nonnegative(),
+    /** Public identity for browser-local comparisons, never observation time. */
+    run: external_exports.object({
+      id: external_exports.string().min(1),
+      attempt: external_exports.number().int().positive(),
+      updatedAt: external_exports.iso.datetime()
+    }).optional(),
     passed: external_exports.number().int().nonnegative().optional(),
     failed: external_exports.number().int().nonnegative().optional(),
     skipped: external_exports.number().int().nonnegative().optional()
@@ -71819,6 +71825,27 @@ var securityDetailsResponseSchema = external_exports.strictObject({
   ])
 });
 
+// packages/shared/src/test-history.ts
+var testHistorySampleSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  attempt: external_exports.number().int().positive(),
+  updatedAt: external_exports.iso.datetime(),
+  total: external_exports.number().int().nonnegative()
+});
+var testHistorySchema = external_exports.object({
+  inspectedAt: external_exports.iso.datetime(),
+  inspectedRuns: external_exports.number().int().min(0).max(8),
+  complete: external_exports.boolean(),
+  samples: external_exports.array(testHistorySampleSchema).max(8),
+  retryAt: external_exports.iso.datetime().optional()
+});
+var testHistoryHeader = "X-Dashboard-Test-History";
+function retryAfterTime(value, now) {
+  if (!value) return void 0;
+  const at = /^\d+$/.test(value) ? now + Number(value) * 1e3 : Date.parse(value);
+  return Number.isFinite(at) && at > now ? at : void 0;
+}
+
 // packages/server/src/credentials.ts
 var import_client_secrets_manager = __toESM(require_dist_cjs16(), 1);
 var import_client_ssm = __toESM(require_dist_cjs17(), 1);
@@ -72764,6 +72791,105 @@ function concat(chunks, length) {
   return result;
 }
 
+// packages/server/src/adapters/github-test-evidence.ts
+var artifactsSchema = external_exports.object({
+  artifacts: external_exports.array(
+    external_exports.object({ id: external_exports.number().int().positive(), name: external_exports.string().min(1), expired: external_exports.boolean() })
+  )
+});
+function testArtifactHttpFailure(response) {
+  const retry = retryAfterTime(response.headers.get("retry-after"), Date.now());
+  return {
+    kind: "failed",
+    observedAt: observedAt(response.headers.get("date")),
+    errorKind: upstreamErrorKind(response.status),
+    httpStatus: response.status,
+    ...retry === void 0 ? {} : { retryAt: new Date(retry).toISOString() }
+  };
+}
+async function inspectGithubTestArtifact(args, selected, config2) {
+  const { run } = selected;
+  let at = selected.observedAt;
+  const failed = (errorKind3) => ({
+    kind: "failed",
+    observedAt: at,
+    errorKind: errorKind3
+  });
+  const get2 = (url2) => args.githubClient.get({
+    source: args.source,
+    fetcher: args.fetcher,
+    url: url2,
+    requestHeaders: new Headers()
+  });
+  const observe = (response) => {
+    const value = observedAt(response.headers.get("date"));
+    if (Date.parse(value) < Date.parse(at)) at = value;
+  };
+  try {
+    if (!run.id) return failed("upstream-error");
+    if (run.status !== "completed") return { kind: "pending", observedAt: at };
+    const url2 = new URL(
+      `https://api.github.com/repos/${args.source.repo}/actions/runs/${run.id}/artifacts`
+    );
+    url2.searchParams.set("name", config2.artifact);
+    url2.searchParams.set("per_page", "100");
+    const artifacts = await get2(url2.toString());
+    if (!artifacts.ok) return testArtifactHttpFailure(artifacts);
+    observe(artifacts);
+    const matches = artifactsSchema.parse(await artifacts.json()).artifacts.filter((item) => item.name === config2.artifact);
+    if (!matches.length) return { kind: "absent", observedAt: at };
+    const [artifact] = matches;
+    if (matches.length !== 1 || !artifact) return failed("upstream-error");
+    if (artifact.expired) return { kind: "expired", observedAt: at };
+    const archive = await get2(
+      `https://api.github.com/repos/${args.source.repo}/actions/artifacts/${artifact.id}/zip`
+    );
+    if (!archive.ok) return testArtifactHttpFailure(archive);
+    observe(archive);
+    const summary = testResultsSummarySchema.parse(
+      JSON.parse(await readTestResultsArtifact(archive, config2.entry))
+    );
+    if (summary.runId !== run.id || summary.runAttempt !== run.run_attempt || summary.headSha !== run.head_sha)
+      return failed("upstream-error");
+    const updatedAt = external_exports.iso.datetime().safeParse(run.updated_at);
+    const tests = {
+      type: "test-count",
+      status: "reported",
+      total: summary.total,
+      ...updatedAt.success ? { run: { id: String(run.id), attempt: summary.runAttempt, updatedAt: updatedAt.data } } : {},
+      ...summary.passed === void 0 ? {} : { passed: summary.passed },
+      ...summary.failed === void 0 ? {} : { failed: summary.failed },
+      ...summary.skipped === void 0 ? {} : { skipped: summary.skipped }
+    };
+    return { kind: "reported", observedAt: at, tests };
+  } catch (error63) {
+    return failed(error63 instanceof GithubAuthenticationError ? "unauthorized" : "upstream-error");
+  }
+}
+function currentTestEvidence(inspection) {
+  const { observedAt: at } = inspection;
+  switch (inspection.kind) {
+    case "reported":
+      return { state: "ok", observedAt: at, signal: inspection.tests };
+    case "pending":
+      return { state: "ok", observedAt: at, signal: { type: "test-count", status: "pending" } };
+    case "absent":
+      return { state: "ok", observedAt: at, signal: { type: "test-count", status: "not-reported" } };
+    case "expired":
+      return {
+        state: "error",
+        observedAt: at,
+        error: { kind: "upstream-error", message: publicErrorMessage("upstream-error") }
+      };
+    case "failed":
+      return {
+        state: "error",
+        observedAt: at,
+        error: { kind: inspection.errorKind, message: publicErrorMessage(inspection.errorKind) }
+      };
+  }
+}
+
 // packages/server/src/adapters/github-actions.ts
 var pipelinePanelSchema = external_exports.object({
   test_results: testResultsArtifactSchema.optional(),
@@ -72804,11 +72930,6 @@ var runSchema = external_exports.object({
   updated_at: external_exports.string().optional(),
   created_at: external_exports.string().optional()
 });
-var artifactsSchema = external_exports.object({
-  artifacts: external_exports.array(
-    external_exports.object({ id: external_exports.number().int().positive(), name: external_exports.string().min(1), expired: external_exports.boolean() })
-  )
-});
 var runsSchema = external_exports.object({ workflow_runs: external_exports.array(runSchema) });
 var jobsSchema = external_exports.object({
   jobs: external_exports.array(
@@ -72855,13 +72976,15 @@ async function fetchGithubActionsTestCount(args) {
       return testCountEnvelope(
         noRunEnvelope(panel.id, source, panel.pipeline, selected.response.headers.get("date"))
       );
-    const evidence = await readGithubRunTestEvidence(
-      { ...args, source, githubClient },
-      {
-        run: selected.run,
-        observedAt: selected.observedAt
-      },
-      panel.test_results
+    const evidence = currentTestEvidence(
+      await inspectGithubTestArtifact(
+        { ...args, source, githubClient },
+        {
+          run: selected.run,
+          observedAt: selected.observedAt
+        },
+        panel.test_results
+      )
     );
     return testCountEnvelope({ ...evidence, panelId: panel.id, link: selected.run.html_url });
   } catch (error63) {
@@ -72875,80 +72998,6 @@ async function fetchGithubActionsTestCount(args) {
     );
   }
 }
-async function readGithubRunTestEvidence(args, selected, artifactConfig) {
-  const { run, observedAt: runObservedAt } = selected;
-  const { source, githubClient } = args;
-  const noValidators = new Headers();
-  let failureObservedAt = runObservedAt;
-  const evidenceError = (kind, at = failureObservedAt) => ({
-    state: "error",
-    observedAt: at,
-    error: { kind, message: publicErrorMessage(kind) }
-  });
-  const failedResponse = (response) => evidenceError(errorKind(response.status), observedAt2(response.headers.get("date")));
-  try {
-    if (!run.id) return evidenceError("upstream-error");
-    if (run.status !== "completed")
-      return {
-        state: "ok",
-        observedAt: runObservedAt,
-        signal: { type: "test-count", status: "pending" }
-      };
-    const artifactsResponse = await githubFetch(
-      githubArtifactsCall(source, run.id, artifactConfig),
-      {
-        ...args,
-        source,
-        requestHeaders: noValidators,
-        githubClient
-      }
-    );
-    if (!artifactsResponse.ok) return failedResponse(artifactsResponse);
-    const artifactObservedAt = observedAt2(artifactsResponse.headers.get("date"));
-    failureObservedAt = oldestObservation(runObservedAt, artifactObservedAt);
-    const artifacts = artifactsSchema.parse(await artifactsResponse.json()).artifacts;
-    const matches = artifacts.filter((artifact2) => artifact2.name === artifactConfig.artifact);
-    if (matches.length === 0)
-      return {
-        state: "ok",
-        observedAt: oldestObservation(runObservedAt, artifactObservedAt),
-        signal: { type: "test-count", status: "not-reported" }
-      };
-    const [artifact] = matches;
-    if (matches.length !== 1 || !artifact || artifact.expired)
-      return evidenceError("upstream-error");
-    const archiveResponse = await githubFetch(githubArtifactDownloadCall(source, artifact.id), {
-      ...args,
-      source,
-      requestHeaders: noValidators,
-      githubClient
-    });
-    if (!archiveResponse.ok) return failedResponse(archiveResponse);
-    const archiveObservedAt = observedAt2(archiveResponse.headers.get("date"));
-    failureObservedAt = oldestObservation(runObservedAt, artifactObservedAt, archiveObservedAt);
-    const summary = testResultsSummarySchema.parse(
-      JSON.parse(await readTestResultsArtifact(archiveResponse, artifactConfig.entry))
-    );
-    if (summary.runId !== run.id || summary.runAttempt !== run.run_attempt || summary.headSha !== run.head_sha)
-      throw new Error("Test-results manifest does not belong to the selected workflow run.");
-    return {
-      state: "ok",
-      observedAt: oldestObservation(runObservedAt, artifactObservedAt, archiveObservedAt),
-      signal: {
-        type: "test-count",
-        status: "reported",
-        total: summary.total,
-        ...summary.passed === void 0 ? {} : { passed: summary.passed },
-        ...summary.failed === void 0 ? {} : { failed: summary.failed },
-        ...summary.skipped === void 0 ? {} : { skipped: summary.skipped }
-      }
-    };
-  } catch (error63) {
-    return evidenceError(
-      error63 instanceof GithubAuthenticationError ? "unauthorized" : "upstream-error"
-    );
-  }
-}
 function pullRequestHealthCapabilities(panel) {
   const { panel: parsed } = external_exports.object({ panel: pullRequestHealthPanelSchema }).parse({ panel });
   return {
@@ -73227,10 +73276,12 @@ async function fetchGithubActionsPipeline(args) {
       if (activity) signal.activity = activity;
     }
     if (parsedPanel.test_results) {
-      signal.testResults = await readGithubRunTestEvidence(
-        { ...args, source: parsedSource, githubClient },
-        { run, observedAt: selected.observedAt },
-        parsedPanel.test_results
+      signal.testResults = currentTestEvidence(
+        await inspectGithubTestArtifact(
+          { ...args, source: parsedSource, githubClient },
+          { run, observedAt: selected.observedAt },
+          parsedPanel.test_results
+        )
       );
     }
     const envelope = {
@@ -73349,18 +73400,6 @@ function githubJobsCall(source, runId) {
   url2.searchParams.set("per_page", "100");
   return { url: url2.toString(), headers: new Headers() };
 }
-function githubArtifactsCall(source, runId, testResults) {
-  const url2 = new URL(`https://api.github.com/repos/${source.repo}/actions/runs/${runId}/artifacts`);
-  url2.searchParams.set("name", testResults.artifact);
-  url2.searchParams.set("per_page", "100");
-  return { url: url2.toString(), headers: new Headers() };
-}
-function githubArtifactDownloadCall(source, artifactId) {
-  return {
-    url: `https://api.github.com/repos/${source.repo}/actions/artifacts/${artifactId}/zip`,
-    headers: new Headers()
-  };
-}
 function noRunEnvelope(panelId, source, pipeline, date6) {
   return {
     panelId,
@@ -73426,6 +73465,81 @@ function sourceLinkForWorkflow(source, pipeline) {
 function observedAt2(value) {
   return observedAt(value);
 }
+async function fetchGithubTestHistory(args) {
+  const source = githubActionsSourceSchema.parse(args.source);
+  const fetcher = (input2, init) => args.fetcher(input2, { ...init, ...args.signal ? { signal: args.signal } : {} });
+  const artifact = testResultsArtifactSchema.parse(args.panel.test_results);
+  const workflow = external_exports.string().min(1).parse(args.panel.pipeline);
+  const now = Date.now();
+  const cutoff = now - 14 * 864e5;
+  const history = {
+    inspectedAt: new Date(now).toISOString(),
+    inspectedRuns: 0,
+    complete: true,
+    samples: []
+  };
+  let stop = false;
+  const recordFailure = (failure3) => {
+    history.complete = false;
+    if (failure3.errorKind === "unauthorized" || failure3.httpStatus === 429) stop = true;
+    if (failure3.retryAt && (!history.retryAt || Date.parse(failure3.retryAt) > Date.parse(history.retryAt)))
+      history.retryAt = failure3.retryAt;
+  };
+  try {
+    const call = githubRunsCall(
+      source,
+      workflow,
+      source.branch,
+      void 0,
+      8,
+      new Date(cutoff).toISOString()
+    );
+    const url2 = new URL(call.url);
+    url2.searchParams.set("status", "completed");
+    const response = await githubFetch(
+      { ...call, url: url2.toString() },
+      { ...args, fetcher, source, requestHeaders: new Headers() }
+    );
+    if (!response.ok) recordFailure(testArtifactHttpFailure(response));
+    else {
+      const runs = runsSchema.parse(await response.json()).workflow_runs.slice(0, 8);
+      for (const run of runs) {
+        if (stop || args.signal?.aborted) {
+          history.complete = false;
+          break;
+        }
+        if (run.status !== "completed") continue;
+        if (run.updated_at && Date.parse(run.updated_at) < cutoff) continue;
+        history.inspectedRuns++;
+        const inspection = await inspectGithubTestArtifact(
+          { ...args, fetcher, source },
+          { run, observedAt: observedAt2(response.headers.get("date")) },
+          artifact
+        );
+        switch (inspection.kind) {
+          case "failed":
+            recordFailure(inspection);
+            break;
+          case "reported": {
+            const { run: identity, total } = inspection.tests;
+            if (identity) history.samples.push({ ...identity, total });
+            else history.complete = false;
+            break;
+          }
+          case "absent":
+          case "expired":
+            break;
+          case "pending":
+            history.complete = false;
+            break;
+        }
+      }
+    }
+  } catch {
+    history.complete = false;
+  }
+  return Response.json(history, { headers: { "cache-control": "no-store" } });
+}
 
 // packages/server/src/configuration-error.ts
 var ConfigurationError = class extends Error {
@@ -73983,6 +74097,9 @@ function readPanelAdapter(panel, source) {
   if (panel.type === "pipeline-status" && source?.type === "github-actions") {
     permittedGithubActionsCalls(panel, source);
     return {
+      ...panel.test_results ? {
+        testHistory: ({ source: _source, ...args }) => fetchGithubTestHistory({ ...args, source })
+      } : {},
       destination: () => "https://api.github.com",
       fetch: ({ source: _configuredSource, ...args }) => fetchGithubActionsPipeline({ ...args, source })
     };
@@ -73990,6 +74107,9 @@ function readPanelAdapter(panel, source) {
   if (panel.type === "test-count" && source?.type === "github-actions") {
     testCountCapabilities(panel, source);
     return {
+      ...panel.test_results ? {
+        testHistory: ({ source: _source, ...args }) => fetchGithubTestHistory({ ...args, source })
+      } : {},
       destination: () => "https://api.github.com",
       fetch: ({ source: _configuredSource, ...args }) => fetchGithubActionsTestCount({ ...args, source })
     };
@@ -74074,7 +74194,9 @@ function permitsPanelOperation(allowlist, board, panel, operation2) {
   return allowlist.get(`${board}/${panel}`)?.has(operation2) ?? false;
 }
 function panelCapability(panel, source) {
-  if (readPanelAdapter(panel, source)) return { kind: "server", operations: ["read"] };
+  const adapter = readPanelAdapter(panel, source);
+  if (adapter)
+    return { kind: "server", operations: adapter.testHistory ? ["read", "test-history"] : ["read"] };
   if (panel.type === "pull-request-health" && source?.type === "github-actions") {
     pullRequestHealthCapabilities(panel);
     return {
@@ -76559,7 +76681,8 @@ function validateClaimsSet(protectedHeader, claimsSetBytes, options = {}) {
       throw new TypeError("Invalid clockTolerance option type");
     tolerance = clockTolerance;
   }
-  validateInput("clockTolerance option", tolerance);
+  if (validateInput("clockTolerance option", tolerance), tolerance < 0)
+    throw new TypeError("Invalid clockTolerance option input");
   const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(claimsSet, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(claimsSet, "nbf");
   if (nbf !== void 0 && nbf > now + tolerance)
     throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', claimsSet, "nbf", checkFailed);
@@ -76645,7 +76768,7 @@ function isCloudflareWorkers() {
   return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
 }
 var USER_AGENT2;
-(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT2 = "jose/v6.2.14");
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT2 = "jose/v6.2.15");
 var customFetch = /* @__PURE__ */ Symbol();
 async function fetchJwks(url2, headers, signal, fetchImpl = fetch) {
   const response = await fetchImpl(url2, {
@@ -76671,6 +76794,8 @@ function isFreshFor(timestamp4, duration3) {
 function validateDuration(value, fallback2, option) {
   if (Number.isNaN(value))
     throw new TypeError(`"${option}" option must not be NaN`);
+  if (typeof value == "number" && value < 0)
+    throw new TypeError(`"${option}" option must not be negative`);
   return typeof value == "number" ? value : fallback2;
 }
 function createRemoteJWKSet(url2, options) {
@@ -77000,6 +77125,28 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
       { boardId: boardName, panelId, operation: "read", destination: fact.url }
     );
   });
+  app.get("/api/panel/:board/:panelId/test-history", async (c5) => {
+    const boardName = c5.req.param("board");
+    const panelId = c5.req.param("panelId");
+    const panel = deps.boardConfig?.boards[boardName]?.panels.find(
+      (candidate) => candidate.id === panelId
+    );
+    const source = panel?.source ? deps.boardConfig?.sources[panel.source] : void 0;
+    if (!panel || !source || !permitsPanelOperation(allowlist, boardName, panelId, "test-history"))
+      return rejected(c5, { boardId: boardName, panelId, operation: "test-history" });
+    const adapter = readPanelAdapter(panel, source);
+    if (!adapter?.testHistory)
+      return rejected(c5, { boardId: boardName, panelId, operation: "test-history" });
+    return adapter.testHistory({
+      panel,
+      source,
+      signal: c5.req.raw.signal,
+      requestHeaders: new Headers(),
+      fetcher: deps.fetcher ?? globalThis.fetch,
+      credentials,
+      githubClient
+    });
+  });
   app.get("/api/panel/:board/:panelId", async (c5) => {
     const boardName = c5.req.param("board");
     const panelId = c5.req.param("panelId");
@@ -77022,7 +77169,7 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
         credentials,
         githubClient
       });
-      return observation(c5, result, {
+      const response = await observation(c5, result, {
         boardId: boardName,
         panelId,
         operation: "read",
@@ -77030,6 +77177,8 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
         ...source ? { sourceType: source.type } : {},
         destination: adapter.destination(panel, source)
       });
+      if (adapter.testHistory) response.headers.set(testHistoryHeader, "supported");
+      return response;
     }
     return c5.notFound();
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@continuous-excellence/ze-great-dashboard-aws",
-  "version": "0.31.55",
+  "version": "0.31.57",
   "type": "module",
   "description": "AWS server runtime and CloudFormation deployment tooling for Ze Great Dashboard.",
   "keywords": [