fix: defensive timestamp parsing in transformFault

Accept unix-seconds numbers, ISO 8601 strings, and fall back to the
current time for zero, negative, missing, or otherwise invalid values
instead of letting `new Date()` produce "Invalid Date" in the UI.
Widen `RawFaultItem.first_occurred` to `number | string | null |
undefined` so the type reflects the shapes the transform actually
handles and the fallback branches are not unreachable at the type
level.

Author: bburda

src/lib/transforms.test.ts

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import {
     unwrapItems,
     transformFault,
@@ -89,6 +89,58 @@ describe('transformFault', () => {
         expect(result.timestamp).toBe(new Date(1700000000 * 1000).toISOString());
     });
 
+    describe('timestamp defensive parsing', () => {
+        // All fallback branches must return an ISO string close to "now".
+        // Asserting recency (not just "doesn't throw") actually verifies the
+        // fallback fired and produced a sane value.
+        const expectRecent = (iso: string) => {
+            const ts = new Date(iso).getTime();
+            const now = Date.now();
+            expect(ts).toBeGreaterThan(now - 5000);
+            expect(ts).toBeLessThanOrEqual(now);
+        };
+
+        // Suppress the dev-tools breadcrumb console.warn in fallback cases.
+        let warnSpy: ReturnType<typeof vi.spyOn>;
+        beforeEach(() => {
+            warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+        });
+        afterEach(() => {
+            warnSpy.mockRestore();
+        });
+
+        it('falls back to current time when first_occurred is 0', () => {
+            const result = transformFault(makeFaultInput({ first_occurred: 0 }));
+            expectRecent(result.timestamp);
+            expect(warnSpy).toHaveBeenCalledTimes(1);
+        });
+
+        it('falls back to current time when first_occurred is negative', () => {
+            const result = transformFault(makeFaultInput({ first_occurred: -1 }));
+            expectRecent(result.timestamp);
+            expect(warnSpy).toHaveBeenCalledTimes(1);
+        });
+
+        it('parses ISO 8601 string first_occurred', () => {
+            const iso = '2026-04-13T10:00:00.000Z';
+            const result = transformFault(makeFaultInput({ first_occurred: iso }));
+            expect(result.timestamp).toBe(iso);
+            expect(warnSpy).not.toHaveBeenCalled();
+        });
+
+        it('falls back to current time when first_occurred is an invalid string', () => {
+            const result = transformFault(makeFaultInput({ first_occurred: 'not-a-date' }));
+            expectRecent(result.timestamp);
+            expect(warnSpy).toHaveBeenCalledTimes(1);
+        });
+
+        it('falls back to current time when first_occurred is missing', () => {
+            const result = transformFault(makeFaultInput({ first_occurred: undefined }));
+            expectRecent(result.timestamp);
+            expect(warnSpy).toHaveBeenCalledTimes(1);
+        });
+    });
+
     it('defaults entity_type to "app" when not in raw data', () => {
         const result = transformFault(makeFaultInput());
         expect(result.entity_type).toBe('app');

src/lib/transforms.ts

@@ -64,8 +64,10 @@ export interface RawFaultItem {
     severity: number;
     severity_label: string;
     status: string;
-    first_occurred: number;
-    last_occurred?: number;
+    /** Accepted as unix seconds (number), ISO 8601 string, or missing/invalid;
+     *  `transformFault` normalises all of these to an ISO timestamp. */
+    first_occurred: number | string | null | undefined;
+    last_occurred?: number | string | null;
     occurrence_count?: number;
     reporting_sources?: string[];
     /** Entity type if provided by the gateway (not currently included in
@@ -127,7 +129,26 @@ export function transformFault(apiFault: RawFaultItem): Fault {
         message: apiFault.description,
         severity,
         status,
-        timestamp: new Date(apiFault.first_occurred * 1000).toISOString(),
+        timestamp: (() => {
+            try {
+                if (typeof apiFault.first_occurred === 'number' && apiFault.first_occurred > 0) {
+                    return new Date(apiFault.first_occurred * 1000).toISOString();
+                }
+                if (typeof apiFault.first_occurred === 'string') {
+                    const parsed = new Date(apiFault.first_occurred);
+                    if (!Number.isNaN(parsed.getTime())) {
+                        return parsed.toISOString();
+                    }
+                }
+            } catch {
+                // fall through to the warn + fallback below
+            }
+            // Log a breadcrumb so operators correlating with syslog can tell
+            // the timestamp was fabricated by the UI and not reported by the
+            // gateway. Dev tools only; fallback keeps rendering alive.
+            console.warn('[transformFault] invalid first_occurred, falling back to now:', apiFault.first_occurred);
+            return new Date().toISOString();
+        })(),
         entity_id,
         entity_type,
         parameters: {