@cosmicdrift/kumiko-framework 0.299.0 → 0.304.0

package/src/observability/metrics-wiring.ts

@@ -0,0 +1,32 @@
+import { z } from "zod";
+import { createNoopProvider } from "./noop-provider";
+import { createPrometheusMeter, type PrometheusMeter } from "./prometheus-meter";
+import type { ObservabilityProvider } from "./types";
+
+export const prometheusMetricsEnvSchema = z.object({
+  PROMETHEUS_METRICS_TOKEN: z
+    .string()
+    .min(32)
+    .optional()
+    .describe("Bearer token for /metrics; unset keeps the endpoint off.")
+    .meta({ kumiko: { pulumi: { secret: true, generator: "openssl rand -base64 32" } } }),
+});
+
+type PrometheusObservabilityProvider = ObservabilityProvider & { readonly meter: PrometheusMeter };
+
+export type ObservabilityWiring =
+  | {
+      readonly observability: PrometheusObservabilityProvider;
+      readonly metrics: { readonly path: string; readonly token: string };
+    }
+  | Record<string, never>;
+
+// Fail-closed: public tenant hosts share the /metrics port, so no token means no endpoint.
+export function resolveObservabilityWiring(metricsToken: string | undefined): ObservabilityWiring {
+  if (!metricsToken) return {};
+  return {
+    // Overrides the spread's name "noop", which would otherwise show up in diagnostics/logs.
+    observability: { ...createNoopProvider(), name: "prometheus", meter: createPrometheusMeter() },
+    metrics: { path: "/metrics", token: metricsToken },
+  };
+}

package/src/testing/handler-context.ts

@@ -5,6 +5,8 @@
 // production services (delivery-service uses it to run cross-feature notify
 // calls without a real dispatcher). Hence the runtime classification despite
 // living under `testing/` — no vitest imports, no test side-effects.
+
+import { ANONYMOUS_ROLE } from "../engine/system-user";
 import type {
   AppendEventArgs,
   FetchForWritingArgs,
@@ -76,7 +78,7 @@ export function bridgeStub(opts?: {
   const stubUser: SessionUser = opts?.user ?? {
     id: "00000000-0000-0000-0000-000000000000",
     tenantId: "00000000-0000-0000-0000-000000000000" as SessionUser["tenantId"], // @cast-boundary engine-bridge
-    roles: ["all"],
+    roles: [ANONYMOUS_ROLE],
   };
   return {
     user: stubUser,

package/src/ui-types/index.ts

@@ -61,6 +61,8 @@ export type {
   OpenToAllAccessRule,
   OpenToAllDeclaration,
   OpenToAllPersonalData,
+  RoleAccessPersonalData,
+  RoleAccessRule,
 } from "../engine/types/handlers";
 export { isOpenToAllGranted } from "../engine/types/handlers";
 export type { IconKey, NavDefinition, NavIconKey } from "../engine/types/nav";