v0.7.0 — Modular observability

v0.7.0 — Modular observability

Makes every observability tool opt-in via blokctl, and ships the surface that
merged after v0.6.21 (PRs #277-287):

• blokctl observability add/remove/list/status command group + 7 modules
  (obs-stack, tracing, trace-store, metrics, logging, alerting, error-sink)
• Metrics opt-out gate (BLOK_METRICS_DISABLED) — default ON, no import-time
  side-effect; /metrics registered only when enabled
• obs-stack tiering (none|lite|full) — blokctl create no longer copies the
  full Prom/Grafana/Loki/Tempo stack unconditionally (default: none)
• Tracing/error-sink inert by default (endpoint/SENTRY_DSN gated)
• Studio: terminal + transient run-event states (crashed/timedOut/throttled/
  cancelled/expired/queued/delayed) with badges + toasts

Lockstep bump of the 17 publishable packages 0.6.21 -> 0.7.0.

v0.6.21 — framework fixes from the Paga.eu validation pass

Lockstep patch release. 8 framework fixes surfaced while validating a real product (a Pix + WhatsApp billing platform) against Blok, plus 3 deferred SPECs. All 17 @blokjs/* packages + blokctl are published at 0.6.21.

⚠️ Breaking defaults (new projects & the HTTP trigger)

These live in the HTTP-trigger source that blokctl create project vendors into new projects (@blokjs/trigger-http is not on npm). Existing projects keep their current HttpTrigger.ts until they re-scaffold or update it manually.

• CORS is no longer wildcard by default. The HTTP trigger emits no Access-Control-Allow-Origin unless BLOK_CORS_ORIGIN is set. Use BLOK_CORS_ORIGIN=* for a public API, or a comma-separated allow-list for a credentialed app. (Previously every route was origin: * with no override.)
• /__blok/rpc/:name denies by default in production. The typed-client RPC mount now requires an authorize hook (trigger.setTraceAuth(...)) in production — mirroring the trace API. Set BLOK_RPC_AUTH_DISABLED=1 to opt out (e.g. when /__blok/* is firewalled). Non-production behavior is unchanged.

Fixes

Reliability & correctness

• @blokjs/api-call no longer discards the upstream Retry-After header or the response body on a ≥400. It throws a GlobalError carrying the upstream status (a 429/503 now surfaces as itself, not a generic 500) plus { status, statusText, url, retryAfter, retryAfterSeconds, body } — so steps can honor backoff and tell retryable from permanent failures.
• @blokjs/trigger-webhook — buildCustomVerifier now extracts a real eventId via new eventIdHeader / eventIdPath signature options. Webhook replay/idempotency dedup previously never fired for custom-HMAC providers (e.g. Pix PSPs) because the event id was hardcoded empty — a duplicate-processing risk.

Honesty & DX

• @blokjs/helpers — @blokjs/audit-log now clearly states it's an in-memory, non-durable ring buffer (with a one-time production warning) and drops a reference to a /__blok/audit endpoint that never existed.
• blokctl gen app-types now lists JSON-authored workflows it excludes from the typed client instead of silently dropping them.
• Reference deploy — dockerfiles/Dockerfile.deploy.http no longer fails a clean docker build on a missing supervisord.conf; infra/docker-compose.production.yml wires Redis-backed concurrency/debounce so replicas: 3 actually coordinates shared state.

Deferred SPECs

Three larger follow-ups are specced (not yet implemented) in specs/blok-framework-fixes/06-paga-validation-fixes.md: a per-step rateLimit DSL knob, an SSE cross-process backplane (Redis Streams / NATS JetStream), and a pluggable durable @blokjs/audit-log backend.

Upgrade

Bump your @blokjs/* dependencies to ^0.6.21 (or npm update). New projects pick everything up via npx blokctl@latest create project.

Full diff & details: #139