External contributors can't build: `bun run codegen` requires GraphQL introspection on /v1/meta (disabled on customer tenants)

[beengud]

Summary

A fresh clone of observeinc/cli cannot be built or tested by anyone outside Observe, because code generation depends on GraphQL introspection against a live tenant's /v1/meta endpoint — and introspection is disabled on (at least standard) customer tenants. The generated GraphQL client is git-ignored and not committed, so there is no offline fallback.

Environment

• Clone of observeinc/cli @ main
• Bun 1.x, bun install succeeds
• A valid Observe API access key for a standard observeinc.com customer tenant (token authenticates successfully for normal queries)

Repro

bun install
cat > .env <<'EOF'
OBSERVE_OPENAPI_SPEC="https://<customer-id>.observeinc.com/v1/openapi"
OBSERVE_GQL_SPEC="https://<customer-id>.observeinc.com/v1/meta"
OBSERVE_GQL_TOKEN="<customer-id> <access-key>"
EOF
bun run codegen

Actual

codegen:gql fails while loading the schema:

✖ Load GraphQL schemas [FAILED: Failed to load schema from https://<customer-id>.observeinc.com/v1/meta:
introspection disabled]

Because src/gql/generated/ is git-ignored and absent, bun run typecheck, bun run build, and bun run test (which begins with codegen) all fail downstream.

Diagnosis (verified)

• The access key is valid: POST /v1/meta {"query":"{__typename}"} → {"data":{"__typename":"Query"}}.
• Introspection specifically is refused: POST /v1/meta {"query":"query{__schema{queryType{name}}}"} → {"errors":[{"message":"introspection disabled","path":["__schema"]}]}. This is returned regardless of headers/params/token variants, so it is a server-side policy, not a client misconfiguration.
• src/gql/gql-codegen.config.ts loads the schema only from the OBSERVE_GQL_SPEC URL via introspection; there is no committed SDL/introspection JSON fallback (src/gql/generated and src/rest/generated are git-ignored).
• The REST half is fine: GET /v1/openapi returns the OpenAPI 3.1 spec (HTTP 200), so codegen:rest works. The blocker is solely the GraphQL schema load.
• CI succeeds only because it injects OBSERVE_GQL_SPEC/OBSERVE_GQL_TOKEN secrets pointing at an endpoint where introspection is enabled (presumably an Observe-internal/dev tenant). External contributors have no such endpoint.

Impact

External contributors and fork maintainers cannot build, typecheck, run the full test suite, or add commands that touch GraphQL types — there is no path to obtain the schema the codegen requires.

Suggested resolutions (any one unblocks)

1. Commit a schema artifact — a sanitized SDL or introspection JSON snapshot in-repo, and point gql-codegen.config.ts at the file when present (falling back to the URL for maintainers). This makes the repo self-contained and buildable offline.
2. Publish the GraphQL schema at a documented, introspection-enabled (or static SDL) URL contributors can point OBSERVE_GQL_SPEC at.
3. Document how to obtain the schema in DEVELOPMENT.md (e.g., a tenant flag, a support request to enable introspection, or a downloadable SDL), since this is currently undocumented.

Happy to send a PR for option (1) if you can share an SDL/introspection snapshot.