@intentius/chant-lexicon-otel 0.101.0 → 0.104.0

package/dist/rules/otel127.ts

@@ -0,0 +1,17 @@
+/**
+ * OTEL127: resourcedetection lists a detector that does not exist
+ *
+ * Each name in a started `resourcedetection` processor's `detectors` must be one the processor registers at collector-contrib v0.130.0 (`RESOURCE_DETECTORS`); any other fails the processor's build and the collector exits.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { configDiagnostics } from "./otel-helpers";
+
+export const otel127: PostSynthCheck = {
+  id: "OTEL127",
+  description: "resourcedetection lists a detector that does not exist",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return configDiagnostics(ctx, "OTEL127");
+  },
+};

package/dist/semconv.d.ts

@@ -5,7 +5,8 @@
  * A collector config has no metadata channel, so a config cannot say which
  * semconv version its attribute keys follow. What it can show is that it uses
  * a vocabulary: a `spanmetrics` dimension named `gen_ai.request.model`, an
- * OTTL statement deleting `gen_ai.input.messages`. `semconvUsage()` finds
+ * OTTL statement deleting `gen_ai.input.messages`, a `k8sattributes`
+ * processor extracting `k8s.pod.name`. `semconvUsage()` finds
  * those and pairs each vocabulary with the pin this package's keys follow, the
  * same way `collectorTopology()` pairs a component type with the pin of the
  * definition this process has. Reading a parsed YAML file and reading the

package/dist/semconv.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"semconv.d.ts","sourceRoot":"","sources":["../src/semconv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EAAc,KAAK,eAAe,EAAsB,MAAM,SAAS,CAAC;AAE/E,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,SAAS,CAAC;IACf,2EAA2E;IAC3E,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACpC;AAKD,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC,iBAAiB,CAEhE,CAAC;AAEH,mEAAmE;AACnE,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,wFAAwF;IACxF,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAWD,0GAA0G;AAC1G,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,YAAY,EAAE,CAYpE"}
+{"version":3,"file":"semconv.d.ts","sourceRoot":"","sources":["../src/semconv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAkC,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAc,KAAK,eAAe,EAAsB,MAAM,SAAS,CAAC;AAE/E,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,SAAS,CAAC;IACf,2EAA2E;IAC3E,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACpC;AAOD,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC,iBAAiB,CAGhE,CAAC;AAEH,mEAAmE;AACnE,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,wFAAwF;IACxF,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAWD,0GAA0G;AAC1G,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,YAAY,EAAE,CAYpE"}

package/dist/skill-defs.d.ts

@@ -1,3 +1,3 @@
 /** The otel lexicon's AI skills, read from src/skills/. */
-export declare const otelSkills: () => import("packages/core/src").SkillDefinition[];
+export declare const otelSkills: () => import("@intentius/chant").SkillDefinition[];
 //# sourceMappingURL=skill-defs.d.ts.map

package/dist/skill-defs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-defs.d.ts","sourceRoot":"","sources":["../src/skill-defs.ts"],"names":[],"mappings":"AAEA,2DAA2D;AAC3D,eAAO,MAAM,UAAU,qDAgCrB,CAAC"}
+{"version":3,"file":"skill-defs.d.ts","sourceRoot":"","sources":["../src/skill-defs.ts"],"names":[],"mappings":"AAEA,2DAA2D;AAC3D,eAAO,MAAM,UAAU,oDAgCrB,CAAC"}

package/dist/skills/chant-otel.md

@@ -17,7 +17,7 @@ export default { lexicons: ["otel"] };
 
 `chant init --lexicon otel` scaffolds a collector; `--template k8s-agent` scaffolds a per-node Kubernetes agent and `--template genai` a GenAI collector.
 
-For a per-node Kubernetes agent, `NodeAgent({ exporters, metricExporters?, clusterName?, kubeletStats? })` declares the whole config: OTLP, host metrics, container logs, `k8sattributes` filtered to the node, and `memory_limiter` first and `batch` last on every pipeline. Pass `Object.values(agent.members)` wherever an entity list is taken, such as the k8s lexicon's `OtelCollector` `config`.
+For a per-node Kubernetes agent, `NodeAgent({ exporters, metricExporters?, clusterName?, kubeletStats? })` declares the whole config: OTLP, host metrics, container logs, `k8sattributes` filtered to the node, and `memory_limiter` first and `batch` last on every pipeline. Pass `Object.values(agent.members)` wherever an entity list is taken, such as the k8s lexicon's `OtelCollector` `config`, which adds what the config reads from the node: `K8S_NODE_NAME` from `spec.nodeName`, the host root at `/hostfs` and `/var/log/pods` read-only, group 0 for the log files, and the RBAC.
 
 ## Declaring components
 
@@ -78,10 +78,14 @@ It deletes prompt, completion, system-instruction and tool-call content from spa
 
 - Reference components by entity where you can. A string id (`"otlp/backend"`) is allowed for a component declared elsewhere, and OTEL101 fails the build if nothing declares it.
 - Put `memory_limiter` first in `processors` (OTEL105).
-- Never write a credential literally. Use `"${env:NAME}"` and the collector reads it at start-up (OTEL002).
+- Never write a credential literally. Use `"${env:NAME}"` and the collector reads it at start-up (OTEL002 in source, OTEL120 in the config). Don't send one over `http://` or `tls.insecure: true` (OTEL121).
 - Every pipeline needs at least one receiver and one exporter (OTEL102). A declared component no pipeline uses is a warning (OTEL103).
 - Don't split metrics by a per-request id (`gen_ai.conversation.id`, `gen_ai.response.id`, `gen_ai.tool.call.id`, `session.id`, `user.id`, `enduser.id`) or a content key: each value starts new time series (OTEL116).
 - Give every listener its own port. The collector's own metrics already use localhost:8888, so a `prometheus` exporter there makes it exit with "address already in use" (OTEL117).
+- Keep `zpages` and `pprof` on localhost (OTEL122). `health_check` may listen on 0.0.0.0 for probes.
+- Put `batch` in every pipeline that sends to a remote `otlp` or `otlphttp` exporter (OTEL125), and leave the exporter's `sending_queue` and `retry_on_failure` on (OTEL124).
+- Use a `drop` policy rather than `invert_match`, and `readers` rather than `service.telemetry.metrics.address` (OTEL119).
+- In a workspace, or with `telemetry.attribution: true`, leave `service.name`, `service.version`, `deployment.environment.name`, `vcs.ref.head.revision` and `chant.*` resource attributes alone: `insert` rather than `upsert`, and `override: false` on `resourcedetection` (OTEL118).
 - Declared extensions are enabled in declaration order unless a `Service` lists `extensions` itself.
 
 ## Starting from an existing config
@@ -97,4 +101,4 @@ The importer writes `receivers.ts`, `processors.ts`, `exporters.ts`, `connectors
 
 ## Reading the result
 
-`collectorTopologyOf(entities)` returns the pipelines, each component's endpoints and schema pin, for each exporter the signals it carries, the connector `edges` between pipelines, and under `semconv` the semantic-conventions version (`GENAI_SEMCONV_PIN`) the config's `gen_ai.` keys follow, as plain data.
+`collectorTopologyOf(entities)` returns the pipelines, each component's endpoints and schema pin, for each exporter the signals it carries, the connector `edges` between pipelines, and under `semconv` the semantic-conventions version the config's `gen_ai.` keys (`GENAI_SEMCONV_PIN`) and `k8s.` keys (`SEMCONV_PIN`) follow, as plain data.

package/dist/validate-config.d.ts

@@ -10,7 +10,7 @@
 import type { Declarable } from "@intentius/chant/declarable";
 import { type CollectorConfig } from "./model.js";
 import "./components/connectors.js";
-export type CollectorIssueCode = "OTEL101" | "OTEL102" | "OTEL103" | "OTEL104" | "OTEL105" | "OTEL106" | "OTEL107" | "OTEL108" | "OTEL109" | "OTEL112" | "OTEL113" | "OTEL114" | "OTEL115" | "OTEL116" | "OTEL117";
+export type CollectorIssueCode = "OTEL101" | "OTEL102" | "OTEL103" | "OTEL104" | "OTEL105" | "OTEL106" | "OTEL107" | "OTEL108" | "OTEL109" | "OTEL112" | "OTEL113" | "OTEL114" | "OTEL115" | "OTEL116" | "OTEL117" | "OTEL118" | "OTEL119" | "OTEL120" | "OTEL121" | "OTEL122" | "OTEL123" | "OTEL124" | "OTEL125" | "OTEL126" | "OTEL127";
 export interface CollectorIssue {
     code: CollectorIssueCode;
     severity: "error" | "warning";
@@ -25,10 +25,36 @@ export interface CollectorIssue {
  * each connector's signals against its definition (OTEL112), cycles through
  * connectors (OTEL113), connector ids shared with a receiver or exporter
  * (OTEL114), `routing` connector targets (OTEL115), the attributes
- * connectors split metrics by (OTEL116), and started components that listen
- * on the same address (OTEL117).
+ * connectors split metrics by (OTEL116), started components that listen
+ * on the same address (OTEL117), and the deprecation, exposure, delivery and
+ * name-list checks in `config-hygiene.ts` (OTEL119-OTEL127).
  */
 export declare function validateCollectorConfig(config: CollectorConfig): CollectorIssue[];
+/** One address a started component listens on. */
+export interface Listener {
+    /** Who listens: `receiver "otlp" (protocols.grpc.endpoint)`. */
+    owner: string;
+    component?: string;
+    host: string;
+    port: number;
+    transport: "tcp" | "udp";
+}
+/** A config key path a component listens on, and the transport it listens with. */
+export interface ListenerPath {
+    path: string[];
+    transport: "tcp" | "udp";
+}
+/**
+ * The config key paths to the addresses a receiver or exporter of this type
+ * listens on, from the table OTEL117 checks, with the transport each listens
+ * with in `body`. Empty for a type not in the table, whose `endpoint` may be
+ * a server it connects to. `collectorEndpoints` reads the ports from here, so
+ * the ports a platform composite publishes and the listeners OTEL117 compares
+ * are the same set.
+ */
+export declare function listenerPaths(kind: "receiver" | "exporter", type: string, body: unknown): ListenerPath[];
+/** The addresses a component of this kind listens on, from the OTEL117 table and its defaults. */
+export declare function componentListeners(kind: "receiver" | "exporter" | "extension", id: string, body: unknown): Listener[];
 /**
  * Check declared entities for what only the declaration knows (OTEL107-OTEL109):
  * each component's own config rules, duplicate ids, and custom components'

package/dist/validate-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-config.d.ts","sourceRoot":"","sources":["../src/validate-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,EAA4D,KAAK,eAAe,EAA4B,MAAM,SAAS,CAAC;AAMnI,OAAO,yBAAyB,CAAC;AAEjC,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAkBD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,EAAE,CAkKjF;AAobD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,cAAc,EAAE,CAyDpH"}
+{"version":3,"file":"validate-config.d.ts","sourceRoot":"","sources":["../src/validate-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,EAAoF,KAAK,eAAe,EAA4B,MAAM,SAAS,CAAC;AAO3J,OAAO,yBAAyB,CAAC;AAEjC,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAkBD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,EAAE,CAmKjF;AA6OD,kDAAkD;AAClD,MAAM,WAAW,QAAQ;IACvB,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,KAAK,GAAG,KAAK,CAAC;CAC1B;AA4ED,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,KAAK,GAAG,KAAK,CAAC;CAC1B;AAYD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,YAAY,EAAE,CAExG;AAuBD,kGAAkG;AAClG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,EAAE,CAWrH;AAqHD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,cAAc,EAAE,CAyDpH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-otel",
-  "version": "0.101.0",
+  "version": "0.104.0",
   "description": "OpenTelemetry Collector lexicon for chant — typed receivers, processors, exporters, connectors, extensions and pipelines, serialized to collector YAML",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -56,7 +56,7 @@
     "validate": "tsx src/validate-cli.ts",
     "docs": "tsx src/codegen/docs-cli.ts",
     "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
-    "build": "tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
+    "build": "../../scripts/tsc7.sh -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
   },
   "dependencies": {
     "js-yaml": "^4.3.1"
@@ -68,7 +68,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.101.0",
+    "@intentius/chant": "^0.104.0",
     "typescript": "^5.9.3"
   }
 }

package/src/attribution.ts

@@ -0,0 +1,385 @@
+/**
+ * OTEL118: a collector processor that can remove or replace a resource
+ * attribute chant's telemetry attribution stamps (ws-060, #3375).
+ *
+ * A workload built inside a workspace carries `service.name`,
+ * `service.version`, `deployment.environment.name`, `vcs.ref.head.revision`
+ * and `chant.*` keys on its resource. hud and behold join a span to a member,
+ * a release and a graph node by them. A collector between the workload and the
+ * backend can undo that, and these are the processors that can:
+ *
+ * - `resource`: a `delete`, `update`, `upsert` or `hash` action on a protected
+ *   `key`, or a `delete` or `hash` whose `pattern` matches one. `insert` only
+ *   adds a missing key. `extract` writes the pattern's named groups, and an RE2
+ *   group name has no dot, so it can't name a protected key.
+ * - `transform`: an OTTL statement on the resource's attributes that calls
+ *   `set`, `delete_key` or `delete_matching_keys` on a protected key, or
+ *   `keep_keys` or `keep_matching_keys` that leaves one out. This is a text
+ *   match over the statement, not a parse.
+ * - `resourcedetection` with `override` on (its default at contrib v0.130.0,
+ *   `factory.go` `createDefaultConfig`) and a detector that can write a
+ *   protected key: `env` (the collector's own `OTEL_RESOURCE_ATTRIBUTES`, and
+ *   the default detector list), `dynatrace` (any key in its properties file),
+ *   `heroku` (`service.name`, `service.version`) and `elastic_beanstalk`
+ *   (`service.version`), per each detector's `metadata.yaml` at that tag.
+ * - `groupbyattrs`: a protected key in `keys`. A record attribute with that
+ *   key is copied over the resource's (`attribute_groups.go`
+ *   `buildReferenceResource`).
+ * - `redaction`: it runs over resource attributes too. With `allow_all_keys`
+ *   off, its default, every key not in `allowed_keys` or `ignored_keys` is
+ *   deleted; a `blocked_key_patterns` entry matching a protected key that isn't
+ *   ignored masks its value. `blocked_values` matches values, which a config
+ *   doesn't show, so it is not checked.
+ * - `sumologic`: `translate_attributes`, on by default, renames `service.name`
+ *   to `service` on log and metric resources; `nest_attributes` (off by
+ *   default) turns dotted keys into maps; an `aggregate_attributes` prefix
+ *   moves the keys it matches.
+ * - `schema`: a target in the `https://opentelemetry.io/schemas/` family below
+ *   1.29.0 renames `vcs.ref.head.revision` back to
+ *   `vcs.repository.ref.revision`, and below 1.27.0 renames
+ *   `deployment.environment.name` back to `deployment.environment`, for data
+ *   with a newer schema URL.
+ * - `metricstransform`: a `group` transform whose `group_resource_labels`
+ *   sets a protected key.
+ * - `logstransform`: an operator that adds, removes, moves or copies onto a
+ *   `resource["<key>"]` field for a protected key, a `retain` that lists
+ *   resource fields and leaves one out, or a parser with `parse_to: resource`.
+ *
+ * `k8sattributes` can extract `service.name` and `service.version`, but it
+ * writes pod metadata only where the key is absent or empty
+ * (`processor.go` `setResourceAttribute`), so it never replaces the
+ * workload's value. The `attributes` processor acts on span, log and metric
+ * attributes, not the resource's. Neither is checked. Only processors some
+ * pipeline lists are.
+ */
+
+import { TELEMETRY_ATTRIBUTES } from "@intentius/chant/telemetry-attribution";
+import { canonicalTypeOf, type CollectorConfig } from "./model";
+import type { CollectorIssue } from "./validate-config";
+
+/** The keys the attribution stamps. Any other `chant.*` key is protected too. */
+export const PROTECTED_RESOURCE_ATTRIBUTES: readonly string[] = TELEMETRY_ATTRIBUTES.map((a) => a.key);
+
+/** True for a key OTEL118 protects: one of `PROTECTED_RESOURCE_ATTRIBUTES`, or any `chant.*` key. */
+export function isProtectedResourceAttribute(key: string): boolean {
+  return PROTECTED_RESOURCE_ATTRIBUTES.includes(key) || key.startsWith("chant.");
+}
+
+/** The protected keys a regular expression matches. An RE2 pattern JavaScript can't compile matches none. */
+function protectedMatching(pattern: string): string[] {
+  let re: RegExp;
+  try {
+    re = new RegExp(pattern);
+  } catch {
+    return [];
+  }
+  return PROTECTED_RESOURCE_ATTRIBUTES.filter((k) => re.test(k));
+}
+
+function quoteAll(keys: string[]): string {
+  return keys.map((k) => `"${k}"`).join(", ");
+}
+
+const REPLACING_ACTIONS: Record<string, string> = {
+  delete: "removes",
+  update: "replaces",
+  upsert: "replaces",
+  hash: "replaces with its hash",
+};
+
+function resourceActionFindings(body: Record<string, unknown>): string[] {
+  const out: string[] = [];
+  const actions = Array.isArray(body.attributes) ? body.attributes : [];
+  for (const raw of actions) {
+    if (typeof raw !== "object" || raw === null) continue;
+    const { key, action, pattern } = raw as { key?: unknown; action?: unknown; pattern?: unknown };
+    const verb = typeof action === "string" ? REPLACING_ACTIONS[action] : undefined;
+    if (!verb) continue;
+    if (typeof key === "string" && isProtectedResourceAttribute(key)) {
+      out.push(`its ${action} action ${verb} "${key}"`);
+    } else if (typeof pattern === "string" && (action === "delete" || action === "hash")) {
+      const hit = protectedMatching(pattern);
+      if (hit.length > 0) out.push(`its ${action} action's pattern "${pattern}" matches ${quoteAll(hit)}`);
+    }
+  }
+  return out;
+}
+
+// ── transform: a text match over OTTL ────────────────────────────────
+
+const OTTL_CALL = /\b(set|delete_key|delete_matching_keys|keep_keys|keep_matching_keys)\s*\(/g;
+
+/** The top-level arguments of the call whose `(` is at `open`, as written. */
+function callArguments(text: string, open: number): string[] {
+  const args: string[] = [];
+  let depth = 0;
+  let start = open + 1;
+  let quoted = false;
+  for (let i = open; i < text.length; i++) {
+    const c = text[i];
+    if (quoted) {
+      if (c === "\\") i++;
+      else if (c === '"') quoted = false;
+      continue;
+    }
+    if (c === '"') quoted = true;
+    else if (c === "(" || c === "[" || c === "{") depth++;
+    else if (c === ")" || c === "]" || c === "}") {
+      depth--;
+      if (depth === 0) {
+        args.push(text.slice(start, i).trim());
+        return args;
+      }
+    } else if (c === "," && depth === 1) {
+      args.push(text.slice(start, i).trim());
+      start = i + 1;
+    }
+  }
+  return args;
+}
+
+/** The OTTL string literals in `text`, unescaped. */
+function stringLiterals(text: string): string[] {
+  return [...text.matchAll(/"((?:[^"\\]|\\.)*)"/g)].map((m) => m[1].replace(/\\(["\\])/g, "$1"));
+}
+
+/**
+ * Whether `path` is the resource's attribute map, and the key it indexes.
+ * `resource.attributes` always is; a bare `attributes` is only in a statement
+ * group whose context is `resource`.
+ */
+function resourcePath(path: string, resourceContext: boolean): { key?: string } | undefined {
+  const m = /^(resource\.)?attributes\s*(?:\[\s*"((?:[^"\\]|\\.)*)"\s*\])?$/.exec(path);
+  if (!m || (!m[1] && !resourceContext)) return undefined;
+  return m[2] === undefined ? {} : { key: m[2].replace(/\\(["\\])/g, "$1") };
+}
+
+function statementFindings(statement: string, resourceContext: boolean): string[] {
+  const out: string[] = [];
+  for (const call of statement.matchAll(OTTL_CALL)) {
+    const fn = call[1];
+    const args = callArguments(statement, call.index! + call[0].length - 1);
+    const target = resourcePath(args[0] ?? "", resourceContext);
+    if (!target) continue;
+    const [literal] = stringLiterals(args[1] ?? "");
+    if (fn === "set") {
+      if (target.key === undefined) out.push(`set replaces the whole resource attribute map`);
+      else if (isProtectedResourceAttribute(target.key)) out.push(`set replaces "${target.key}"`);
+    } else if (target.key !== undefined) {
+      continue;
+    } else if (fn === "delete_key" && literal !== undefined && isProtectedResourceAttribute(literal)) {
+      out.push(`delete_key removes "${literal}"`);
+    } else if (fn === "delete_matching_keys" && literal !== undefined) {
+      const hit = protectedMatching(literal);
+      if (hit.length > 0) out.push(`delete_matching_keys "${literal}" removes ${quoteAll(hit)}`);
+    } else if (fn === "keep_keys") {
+      const kept = new Set(stringLiterals(args[1] ?? ""));
+      const dropped = PROTECTED_RESOURCE_ATTRIBUTES.filter((k) => !kept.has(k));
+      if (dropped.length > 0) out.push(`keep_keys drops ${quoteAll(dropped)}`);
+    } else if (fn === "keep_matching_keys" && literal !== undefined) {
+      const hit = new Set(protectedMatching(literal));
+      const dropped = PROTECTED_RESOURCE_ATTRIBUTES.filter((k) => !hit.has(k));
+      if (dropped.length > 0) out.push(`keep_matching_keys "${literal}" drops ${quoteAll(dropped)}`);
+    }
+  }
+  return out;
+}
+
+function transformFindings(body: Record<string, unknown>): string[] {
+  const out: string[] = [];
+  for (const [field, groups] of Object.entries(body)) {
+    if (!field.endsWith("_statements") || !Array.isArray(groups)) continue;
+    for (const group of groups) {
+      // A plain string infers its context from its paths, so only `resource.` paths reach the resource.
+      const [statements, resourceContext] =
+        typeof group === "string"
+          ? [[group], false]
+          : typeof group === "object" && group !== null
+            ? [(group as { statements?: unknown }).statements, (group as { context?: unknown }).context === "resource"]
+            : [[], false];
+      if (!Array.isArray(statements)) continue;
+      for (const statement of statements) {
+        if (typeof statement !== "string") continue;
+        for (const finding of statementFindings(statement, resourceContext)) {
+          out.push(`the OTTL text \`${statement}\` matches a call where ${finding}`);
+        }
+      }
+    }
+  }
+  return out;
+}
+
+// ── resourcedetection ────────────────────────────────────────────────
+
+/** Detectors that can write a protected key, and which. */
+const OVERRIDING_DETECTORS: Record<string, string> = {
+  env: "any key in the collector's own OTEL_RESOURCE_ATTRIBUTES",
+  dynatrace: "any key in the Dynatrace properties file",
+  heroku: '"service.name" and "service.version"',
+  elastic_beanstalk: '"service.version"',
+};
+
+function detectionFindings(body: Record<string, unknown>): string[] {
+  // `override` defaults to true, and `detectors` to [env], at contrib v0.130.0.
+  if (body.override === false) return [];
+  const detectors = Array.isArray(body.detectors) ? body.detectors : ["env"];
+  const how = body.override === true ? "override: true" : "override on by default";
+  return detectors
+    .filter((d): d is string => typeof d === "string" && d in OVERRIDING_DETECTORS)
+    .map((d) => `with ${how}, the ${d} detector writes ${OVERRIDING_DETECTORS[d]} over the service's own value; set override: false`);
+}
+
+// ── processors that rewrite the resource as a side effect ─────────────
+
+function strings(value: unknown): string[] {
+  return Array.isArray(value) ? value.filter((v): v is string => typeof v === "string") : [];
+}
+
+function groupByAttrsFindings(body: Record<string, unknown>): string[] {
+  const keys = strings(body.keys).filter(isProtectedResourceAttribute);
+  return keys.length > 0 ? [`it groups by ${quoteAll(keys)}, so a record attribute with that key is copied over the resource's value`] : [];
+}
+
+function redactionFindings(body: Record<string, unknown>): string[] {
+  const out: string[] = [];
+  const ignored = new Set(strings(body.ignored_keys));
+  const allowed = new Set(strings(body.allowed_keys));
+  const exposed = PROTECTED_RESOURCE_ATTRIBUTES.filter((k) => !ignored.has(k));
+  if (body.allow_all_keys !== true) {
+    const deleted = exposed.filter((k) => !allowed.has(k));
+    if (deleted.length > 0) {
+      const how = body.allow_all_keys === false ? "allow_all_keys: false" : "allow_all_keys off by default";
+      out.push(`with ${how}, it deletes resource keys missing from allowed_keys and ignored_keys: ${quoteAll(deleted)}`);
+    }
+  }
+  for (const pattern of strings(body.blocked_key_patterns)) {
+    const masked = exposed.filter((k) => protectedMatching(pattern).includes(k));
+    if (masked.length > 0) out.push(`its blocked_key_patterns entry "${pattern}" masks the value of ${quoteAll(masked)}`);
+  }
+  return out;
+}
+
+function sumologicFindings(body: Record<string, unknown>): string[] {
+  const out: string[] = [];
+  // `translate_attributes` defaults to true at contrib v0.130.0.
+  if (body.translate_attributes !== false) {
+    out.push(`translate_attributes${body.translate_attributes === true ? "" : " (on by default)"} renames "service.name" to "service" on log and metric resources`);
+  }
+  const nest = body.nest_attributes;
+  if (typeof nest === "object" && nest !== null && (nest as { enabled?: unknown }).enabled === true) {
+    const include = strings((nest as { include?: unknown }).include);
+    const exclude = strings((nest as { exclude?: unknown }).exclude);
+    const nested = PROTECTED_RESOURCE_ATTRIBUTES.filter(
+      (k) => (include.length === 0 || include.some((p) => k.startsWith(p))) && !exclude.some((p) => k.startsWith(p)),
+    );
+    if (nested.length > 0) out.push(`nest_attributes turns ${quoteAll(nested)} into nested maps`);
+  }
+  for (const pair of Array.isArray(body.aggregate_attributes) ? body.aggregate_attributes : []) {
+    const prefixes = strings((pair as { prefixes?: unknown } | null)?.prefixes);
+    const moved = PROTECTED_RESOURCE_ATTRIBUTES.filter((k) => prefixes.some((p) => k.startsWith(p)));
+    if (moved.length > 0) out.push(`aggregate_attributes prefixes ${quoteAll(prefixes)} move ${quoteAll(moved)} into one attribute`);
+  }
+  return out;
+}
+
+// Schema versions whose `all` changes rename a protected key, in semantic-conventions' schemas/1.37.0.
+const SCHEMA_RENAMES: ReadonlyArray<{ version: [number, number, number]; from: string; to: string }> = [
+  { version: [1, 29, 0], from: "vcs.repository.ref.revision", to: "vcs.ref.head.revision" },
+  { version: [1, 27, 0], from: "deployment.environment", to: "deployment.environment.name" },
+];
+
+function schemaFindings(body: Record<string, unknown>): string[] {
+  const out: string[] = [];
+  for (const target of strings(body.targets)) {
+    const m = /^https?:\/\/opentelemetry\.io\/schemas\/(\d+)\.(\d+)\.(\d+)$/.exec(target);
+    if (!m) continue;
+    const v = [Number(m[1]), Number(m[2]), Number(m[3])];
+    const older = (r: [number, number, number]) => v[0] < r[0] || (v[0] === r[0] && (v[1] < r[1] || (v[1] === r[1] && v[2] < r[2])));
+    for (const rename of SCHEMA_RENAMES) {
+      if (older(rename.version)) out.push(`its target ${target} renames "${rename.to}" back to "${rename.from}" on data with a newer schema URL`);
+    }
+  }
+  return out;
+}
+
+function metricsTransformFindings(body: Record<string, unknown>): string[] {
+  const out: string[] = [];
+  for (const t of Array.isArray(body.transforms) ? body.transforms : []) {
+    if (typeof t !== "object" || t === null || (t as { action?: unknown }).action !== "group") continue;
+    const labels = (t as { group_resource_labels?: unknown }).group_resource_labels;
+    const keys = typeof labels === "object" && labels !== null ? Object.keys(labels).filter(isProtectedResourceAttribute) : [];
+    if (keys.length > 0) out.push(`a group transform's group_resource_labels sets ${quoteAll(keys)} on the new resource`);
+  }
+  return out;
+}
+
+/** The key of a stanza `resource["<key>"]` field, or undefined. */
+function resourceField(field: unknown): string | undefined {
+  if (typeof field !== "string") return undefined;
+  const m = /^resource\[\s*["']([^"']*)["']\s*\]$/.exec(field.trim());
+  return m?.[1];
+}
+
+function logsTransformFindings(body: Record<string, unknown>): string[] {
+  const out: string[] = [];
+  for (const raw of Array.isArray(body.operators) ? body.operators : []) {
+    if (typeof raw !== "object" || raw === null) continue;
+    const op = raw as Record<string, unknown>;
+    const type = String(op.type ?? "");
+    const touched = [
+      ...(type === "add" || type === "remove" ? [resourceField(op.field)] : []),
+      ...(type === "move" ? [resourceField(op.from), resourceField(op.to)] : []),
+      ...(type === "copy" ? [resourceField(op.to)] : []),
+    ].filter((k): k is string => k !== undefined && isProtectedResourceAttribute(k));
+    if (touched.length > 0) out.push(`its ${type} operator writes or removes ${quoteAll(touched)}`);
+    if (type === "retain") {
+      const kept = strings(op.fields).map(resourceField).filter((k): k is string => k !== undefined);
+      const dropped = PROTECTED_RESOURCE_ATTRIBUTES.filter((k) => !kept.includes(k));
+      if (kept.length > 0 && dropped.length > 0) out.push(`its retain operator keeps only the resource fields it lists, dropping ${quoteAll(dropped)}`);
+    }
+    if (op.parse_to === "resource") out.push(`its ${type} operator parses into the resource, so a parsed key can replace any protected key`);
+  }
+  return out;
+}
+
+const FINDINGS: Record<string, (body: Record<string, unknown>) => string[]> = {
+  resource: resourceActionFindings,
+  transform: transformFindings,
+  resourcedetection: detectionFindings,
+  groupbyattrs: groupByAttrsFindings,
+  redaction: redactionFindings,
+  sumologic: sumologicFindings,
+  schema: schemaFindings,
+  metricstransform: metricsTransformFindings,
+  logstransform: logsTransformFindings,
+};
+
+/**
+ * OTEL118 over one collector config: each processor a pipeline lists that can
+ * remove or replace a protected resource attribute. Not part of
+ * `validateCollectorConfig`, because it applies only to a build that stamps
+ * the attribution: the post-synth check runs it when the context carries
+ * `telemetry`.
+ */
+export function attributionIssues(config: CollectorConfig): CollectorIssue[] {
+  const pipelinesOf = new Map<string, string[]>();
+  for (const [pipeline, body] of Object.entries(config.service?.pipelines ?? {})) {
+    for (const id of body?.processors ?? []) pipelinesOf.set(String(id), [...(pipelinesOf.get(String(id)) ?? []), pipeline]);
+  }
+  const issues: CollectorIssue[] = [];
+  for (const [id, pipelines] of pipelinesOf) {
+    const raw = config.processors?.[id];
+    const body = typeof raw === "object" && raw !== null ? (raw as Record<string, unknown>) : {};
+    const type = canonicalTypeOf("processor", id);
+    const findings = Object.prototype.hasOwnProperty.call(FINDINGS, type) ? FINDINGS[type](body) : [];
+    for (const finding of findings) {
+      issues.push({
+        code: "OTEL118",
+        severity: "warning",
+        component: id,
+        message: `processor "${id}" (pipelines ${pipelines.join(", ")}): ${finding}. Chant's telemetry attribution stamps those resource attributes, and a span that loses them can't be joined to its member, release or declaration`,
+      });
+    }
+  }
+  return issues;
+}

package/src/codegen/docs.ts

@@ -55,7 +55,14 @@ connector id shared with a receiver or exporter (OTEL114), a \`routing\` route
 to a pipeline that doesn't receive from it (OTEL115), a connector
 splitting metrics by a per-request GenAI attribute such as
 \`gen_ai.conversation.id\` (OTEL116), two started components listening
-on the same address (OTEL117), and a literal credential in source (OTEL002).
+on the same address (OTEL117), and a literal credential in source (OTEL002)
+or in the config (OTEL120). Others report deprecated fields (OTEL119),
+credentials sent in plaintext (OTEL121), zpages or pprof off loopback
+(OTEL122), detailed debug output beside a backend (OTEL123), delivery and
+batching settings (OTEL124, OTEL125), and k8sattributes fields or
+resourcedetection detectors the collector doesn't know (OTEL126, OTEL127). In
+a build that stamps telemetry attribution, OTEL118 reports a processor that can
+drop or overwrite one of the attribution's resource attributes.
 `;
 
 const outputFormat = `The otel lexicon serializes every otel entity in a build into **one

package/src/components/k8s-receivers.test.ts

@@ -5,7 +5,7 @@ import { otelSerializer } from "../serializer";
 import { collectorYaml } from "../collector";
 import { collectorTopology } from "../topology";
 import { validateCollectorEntities } from "../validate-config";
-import { COLLECTOR_PIN } from "../define";
+import { COLLECTOR_PIN, SEMCONV_PIN } from "../define";
 import { DebugExporter } from "./exporters";
 import { K8sClusterReceiver, KubeletStatsReceiver } from "./k8s-receivers";
 import { Pipeline } from "../pipeline";
@@ -43,7 +43,10 @@ describe("k8s_cluster receiver", () => {
       metrics: { "k8s.pod.status_reason": { enabled: true } },
     });
     const out = primary(otelSerializer.serialize(new Map([["cluster", cluster as unknown as Declarable]])));
-    expect(out).toBe(`receivers:
+    // The `k8s.pod.status_reason` metric name is a k8s key, so the header names the pin.
+    expect(out).toBe(`# chant: semconv k8s ${SEMCONV_PIN.source}@${SEMCONV_PIN.version} (k8s_cluster)
+
+receivers:
   k8s_cluster:
     auth_type: serviceAccount
     collection_interval: 30s

package/src/components/processors.ts

@@ -175,7 +175,7 @@ export type ResourceDetector =
   | "ec2"
   | "ecs"
   | "eks"
-  | "elasticbeanstalk"
+  | "elastic_beanstalk"
   | "lambda"
   | "azure"
   | "aks"

package/src/components/sampling.ts

@@ -24,6 +24,7 @@ export interface NumericAttributePolicyConfig {
   key: string;
   min_value?: number;
   max_value?: number;
+  /** @deprecated Inverted decisions are deprecated since collector-contrib v0.126.0; use a `drop` policy (OTEL119). */
   invert_match?: boolean;
 }
 
@@ -46,6 +47,7 @@ export interface StringAttributePolicyConfig {
   values: string[];
   enabled_regex_matching?: boolean;
   cache_max_size?: number;
+  /** @deprecated Inverted decisions are deprecated since collector-contrib v0.126.0; use a `drop` policy (OTEL119). */
   invert_match?: boolean;
 }
 
@@ -70,6 +72,7 @@ export interface TraceStatePolicyConfig {
 export interface BooleanAttributePolicyConfig {
   key: string;
   value: boolean;
+  /** @deprecated Inverted decisions are deprecated since collector-contrib v0.126.0; use a `drop` policy (OTEL119). */
   invert_match?: boolean;
 }
 

package/src/composites/composites.test.ts

@@ -10,6 +10,8 @@ import { OtlpExporter, PrometheusExporter } from "../components/exporters";
 import { collectorYaml } from "../collector";
 import { validateCollectorConfig } from "../validate-config";
 import type { CollectorConfig } from "../model";
+import { SEMCONV_PIN } from "../define";
+import { semconvUsage } from "../semconv";
 
 const gateway = new OtlpExporter({ name: "gateway", endpoint: "otel-gateway.observability.svc:4317", tls: { insecure: true } });
 const base: NodeAgentProps = { exporters: [gateway] };
@@ -136,3 +138,17 @@ describe("NodeAgent options", () => {
     expect((config.receivers?.filelog as Loose).exclude).toEqual(["/var/log/pods/*/agent/*.log"]);
   });
 });
+
+describe("NodeAgent semconv", () => {
+  test("the YAML names the k8s semantic conventions its keys follow", () => {
+    const yaml = collectorYaml(Object.values(NodeAgent({ ...base, clusterName: "prod-eu-1" }).members) as Declarable[]);
+    expect(yaml.split("\n")[0]).toBe(`# chant: semconv k8s ${SEMCONV_PIN.source}@${SEMCONV_PIN.version} (k8sattributes, resource)`);
+  });
+
+  test("k8s_cluster and k8sattributes as names are not k8s keys", () => {
+    expect(semconvUsage({ receivers: { k8s_cluster: {} }, processors: { k8sattributes: {}, "resource/k8s": {} } })).toEqual([]);
+    expect(semconvUsage({ processors: { "transform/x": { statements: ['delete_matching_keys(resource.attributes, "^k8s\\\\.pod\\\\..*")'] } } })).toEqual([
+      { namespace: "k8s", ...SEMCONV_PIN, components: ["transform/x"] },
+    ]);
+  });
+});