Add isolated Vercel Speed Insights drain receiver

[ausdisau]

What changed

Adds a separate apps/observability-drain Node.js service for receiving Vercel Speed Insights Drain events outside the MapAble user-facing web request path.

Receiver

• GET /health
• POST /v1/vercel/speed-insights
• verifies x-vercel-signature using HMAC-SHA1 over the raw request body
• accepts JSON or NDJSON batches
• accepts only vercel.speed_insights.v1 and known Core Web Vital metric types
• limits request size and batch cardinality

Privacy defaults

• never logs the incoming payload
• removes deviceId, city, and attribution
• excludes raw path by default
• keeps route patterns such as /participant/[id]
• strips path/query components from origin
• optional raw path retention requires MAPABLE_DRAIN_INCLUDE_PATH=true

Optional forwarding

DRAIN_FORWARD_URL can send sanitized batches to an independent observability sink. Without it, accepted batches produce only structured aggregate runtime log entries.

Why

A drain receiver improves MapAble's observability pipeline without putting telemetry ingestion on the production application's own API surface. This keeps monitoring failure domains separate and reduces the risk of participant-specific URL or device metadata being exported unnecessarily.

Vercel deployment contract

Create a dedicated Vercel project using:

• repository: ausdisau/MapAble
• root directory: apps/observability-drain
• framework: Other / Node.js
• required production secret: VERCEL_DRAIN_SECRET

Then configure a Speed Insights Drain to send production events to:

https://<observability-project>.vercel.app/v1/vercel/speed-insights

Do not add Logs, Web Analytics, AI Gateway or Trace schemas until dedicated handlers and a privacy review are added.

Validation

Local Node test suite: 5/5 passing

• raw-body HMAC verification
• JSON and NDJSON parsing
• privacy stripping
• opt-in path handling
• invalid schema/value rejection

Scope

This PR does not create or expose any participant-facing capability, modify the main web deployment, create a Vercel secret, enable a drain, or change production traffic.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 84523820-4b61-4ae8-abff-0cc227dad260

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}