@intentius/chant-lexicon-otel 0.124.31 → 0.124.32

package/dist/index.js

@@ -0,0 +1,34 @@
+// OpenTelemetry Collector lexicon.
+// Plugin and serializer
+export { otelPlugin } from "./plugin.js";
+export { otelSerializer } from "./serializer.js";
+// Built-in components and their config types
+export * from "./components/index.js";
+// Pipelines and the service block
+export { Pipeline, Service, PIPELINE_TYPE, SERVICE_TYPE, isPipelineEntity, isServiceEntity, } from "./pipeline.js";
+// The extension point: components chant doesn't ship
+export { defineComponent, definitionFor, definitionOf, registeredDefinitions, componentEntityType, isOTelComponent, COLLECTOR_PIN, SEMCONV_PIN, GENAI_SEMCONV_PIN, } from "./define.js";
+// The plain-data model, YAML, checks and topology
+export * from "./model.js";
+export { buildCollectorConfig, collectorConfig, collectorYaml, componentConfig } from "./collector.js";
+export { emitCollectorYaml } from "./yaml.js";
+export { configMapCollectorConfigs, describeConfigMapConfig, describeOperatorCollectorConfig, operatorCollectorConfig, parseCollectorConfig, } from "./configmap.js";
+export { validateCollectorConfig, validateCollectorEntities, } from "./validate-config.js";
+export { K8S_ATTRIBUTES_METADATA, RESOURCE_DETECTORS } from "./config-hygiene.js";
+export { collectorTopology, collectorTopologyOf, } from "./topology.js";
+export { semconvUsage, SEMCONV_VOCABULARIES } from "./semconv.js";
+export { attributionIssues, isProtectedResourceAttribute, PROTECTED_RESOURCE_ATTRIBUTES } from "./attribution.js";
+// Composites
+export { NodeAgent, nodeAgentPropsProblem } from "./composites/index.js";
+export { RedMetrics, redMetricsNames, redMetricsPropsProblem, GenAiPipeline, OtlpCollector, otlpCollectorPropsProblem, TailSamplingTier, tailSamplingTierPropsProblem, tailSamplingLoadBalancer, } from "./composites/index.js";
+// What the platform collector composites (docker, k8s, fly) share
+export { otlpCollector, otlpCollectorParts, collectorEndpoints, COLLECTOR_IMAGE, COLLECTOR_CONFIG_PATH, } from "./platform.js";
+// The GenAI preset: content removal and agent RED and token metrics
+export { genAiPipeline, genAiPipelineParts, genAiComponents, genAiMetrics, GENAI_ATTRIBUTES, GENAI_CONTENT_ATTRIBUTES, GENAI_CONTENT_EVENTS, GENAI_INDEXED_CONTENT_PATTERN, GENAI_HIGH_CARDINALITY_ATTRIBUTES, genAiCardinalityRisk, GENAI_SPAN_METRIC_DIMENSIONS, GENAI_TOKEN_DIMENSIONS, GENAI_DURATION_BUCKETS, GENAI_UNKNOWN_MODEL, GENAI_PROVIDER_DIMENSIONS, GENAI_CLIENT_METRIC_NAMES, GENAI_CLIENT_METRIC_ATTRIBUTES, GENAI_CLIENT_DURATION_BUCKETS, GENAI_CLIENT_TOKEN_BUCKETS, GENAI_TOKEN_TYPES, DELTA_READY_EXPORTERS, genAiNeedsDeltaToCumulative, } from "./genai.js";
+// Metric names as Prometheus serves them, for dashboards and SLOs built from a declaration
+export { spanMetricsNames, prometheusMetricName, prometheusLabel, SPANMETRICS_DEFAULT_DIMENSIONS, SPANMETRICS_DEFAULT_NAMESPACE, SPAN_STATUS_ERROR, SERVICEGRAPH_NAMESPACE, serviceGraphNames, promSelector, promSumRate, promErrorRatio, promQuantile, promNumber, spanKindMatchers, spanMetricsRedQueries, SPAN_METRICS_KINDS, RED_DEFAULT_SPAN_KINDS, } from "./metric-names.js";
+// Op steps (#3369): the collector binary's checks, collectors as resources a
+// ConvergeOp observes, and the pin audit. The activities resolve from
+// `@intentius/chant-lexicon-otel/op/activities`.
+export { otelcolValidate, otelcolComponents, collectorHealthObserve, collectorAudit } from "./op/builders.js";
+export { CollectorAuditOp } from "./op/audit-op.js";

package/dist/init-templates.js

@@ -0,0 +1,119 @@
+// ── default ────────────────────────────────────────────────────────────
+const DEFAULT_COLLECTOR = `/**
+ * A collector: OTLP in, batched, traces out to an OTLP backend and logs to
+ * the collector's own output. \`chant build\` writes the config
+ * \`otelcol --config\` reads.
+ *
+ * Nested settings are named consts typed with the lexicon's config types, so
+ * each constructor stays flat.
+ */
+import {
+  OtlpReceiver,
+  MemoryLimiterProcessor,
+  BatchProcessor,
+  OtlpExporter,
+  DebugExporter,
+  HealthCheckExtension,
+  Pipeline,
+  type OtlpReceiverConfig,
+  type TLSClientSettings,
+  type QueueSettings,
+} from "@intentius/chant-lexicon-otel";
+
+const protocols: OtlpReceiverConfig["protocols"] = {
+  grpc: { endpoint: "0.0.0.0:4317" },
+  http: { endpoint: "0.0.0.0:4318" },
+};
+const otlp = new OtlpReceiver({ protocols });
+
+const memoryLimiter = new MemoryLimiterProcessor({ check_interval: "1s", limit_percentage: 80, spike_limit_percentage: 20 });
+const batch = new BatchProcessor({ timeout: "5s" });
+
+// Point this at your tracing backend. \`otlp/backend\`: the instance name leaves room for a second otlp exporter.
+const plaintext: TLSClientSettings = { insecure: true };
+const queue: QueueSettings = { enabled: true, queue_size: 5000 };
+const backend = new OtlpExporter({ name: "backend", endpoint: "tempo:4317", tls: plaintext, sending_queue: queue });
+
+const debug = new DebugExporter({ verbosity: "basic" });
+
+const health = new HealthCheckExtension({ endpoint: "0.0.0.0:13133" });
+
+const traces = new Pipeline({ signal: "traces", receivers: [otlp], processors: [memoryLimiter, batch], exporters: [backend] });
+const logs = new Pipeline({ signal: "logs", receivers: [otlp], processors: [memoryLimiter, batch], exporters: [debug] });
+
+export { otlp, memoryLimiter, batch, backend, debug, health, traces, logs };
+`;
+// ── k8s-agent ──────────────────────────────────────────────────────────
+const AGENT_EXPORTERS = `/**
+ * Where the agent sends what it collects: traces and logs to the gateway
+ * collectors, metrics served on each node for Prometheus to scrape.
+ */
+import { OtlpExporter, PrometheusExporter, type RetrySettings, type TLSClientSettings } from "@intentius/chant-lexicon-otel";
+
+// The gateway Service. With the k8s lexicon's OtelCollectorGateway, use its gatewayExporter() instead.
+const inCluster: TLSClientSettings = { insecure: true };
+const retry: RetrySettings = { enabled: true, max_elapsed_time: "300s" };
+const gateway = new OtlpExporter({ name: "gateway", endpoint: "otel-gateway.observability.svc:4317", tls: inCluster, retry_on_failure: retry });
+
+// Resource attributes (k8s.namespace.name, k8s.pod.name, ...) become metric labels.
+const asLabels = { enabled: true };
+const scrape = new PrometheusExporter({ endpoint: "0.0.0.0:8889", resource_to_telemetry_conversion: asLabels });
+
+export { gateway, scrape };
+`;
+const AGENT = `/**
+ * The config each node's collector runs. The pod needs the node name in
+ * K8S_NODE_NAME (from spec.nodeName), the host root mounted read-only at
+ * /hostfs, /var/log/pods mounted read-only, and a service account that can
+ * read pods, namespaces, nodes and replicasets (and nodes/stats, for kubelet
+ * stats). Pass \`Object.values(agent.members)\` as the k8s lexicon's
+ * OtelCollector \`config\` to run it as a DaemonSet: it adds all of these,
+ * worked out from the config.
+ */
+import { NodeAgent } from "@intentius/chant-lexicon-otel";
+import { gateway, scrape } from "./exporters";
+
+export const agent = NodeAgent({
+  exporters: [gateway],
+  metricExporters: [scrape],
+  clusterName: "my-cluster",
+  kubeletStats: true,
+});
+`;
+// ── genai ──────────────────────────────────────────────────────────────
+const GENAI_COLLECTOR = `/**
+ * A collector for an agent service instrumented with the OpenTelemetry GenAI
+ * conventions. Prompts, completions and tool payloads are removed before
+ * anything leaves the collector. Every GenAI span also becomes call, error,
+ * duration and token metrics, and the conventions' own client metrics
+ * (gen_ai.client.operation.duration, gen_ai.client.token.usage), served for
+ * Prometheus to scrape. Traces go to Tempo.
+ */
+import { genAiPipeline, OtlpExporter, PrometheusExporter, type TLSClientSettings } from "@intentius/chant-lexicon-otel";
+
+const plaintext: TLSClientSettings = { insecure: true };
+const tempo = new OtlpExporter({ name: "tempo", endpoint: "tempo:4317", tls: plaintext });
+
+const prometheus = new PrometheusExporter({ endpoint: "0.0.0.0:8889" });
+
+// Content stays out unless keepContent: true is set here. Card-number-like values are masked in whatever is left.
+const cardNumbers = ["\\\\b[0-9]{13,16}\\\\b"];
+
+export const collector = genAiPipeline({
+  traceExporters: [tempo],
+  metricExporters: [prometheus],
+  clientMetrics: "derive",
+  maskValues: cardNumbers,
+});
+`;
+export const DEFAULT_TEMPLATE = {
+    src: { "collector.ts": DEFAULT_COLLECTOR },
+};
+export const K8S_AGENT_TEMPLATE = {
+    src: { "exporters.ts": AGENT_EXPORTERS, "agent.ts": AGENT },
+};
+export const GENAI_TEMPLATE = {
+    src: { "collector.ts": GENAI_COLLECTOR },
+};
+/** The template names `chant init --lexicon otel --template <name>` takes, besides the default. */
+export const TEMPLATE_NAMES = ["k8s-agent", "genai"];

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "9b8ceae301c6c60ae68b4788234ddabe3158959f7a6caca52e087019ffb2b51a",
+    "manifest.json": "83651d5f0444ccab5144c34f0b19ac93d488b65267eb532b5c6de8ac21ab8d47",
     "meta.json": "884042882639c4dd91a8a97b9826869de90553ec4420fd1e6a0b08bb16fc5181",
     "types/index.d.ts": "a1070fd1cb3e8d8a9002fc5a75a80b3bdda02965be351e8aed2dbc2f63d36e3c",
     "rules/component-id-syntax.ts": "5d01dc32a10843e47e27c4350c841af5638b5423c653bbe8397f1e4f57271756",
@@ -37,5 +37,5 @@
     "skills/chant-otel-custom-components.md": "82e53bb482281f79b428e66fb80a1c194ead74a1a34a88bbebb11c6ad5493258",
     "skills/chant-otel-platforms.md": "c90836952dc5c88d668b890152a5063bdb656bce73fc7fa3233a3ea58ad85686"
   },
-  "composite": "2c87a4fb076d2b4e6ec079da3a955039bef4283845c355af1e9f7d65f6837afe"
+  "composite": "04842558ab398b92b3aa388bdd4d5f1ad4c90ff7988ab9f760eb030d87aa5dbd"
 }

package/dist/lint/audit-catalog.js

@@ -0,0 +1,49 @@
+/**
+ * The otel lexicon's chant audit catalog, contributed via
+ * `otelPlugin.auditCatalog()` (#687, #1346).
+ *
+ * OTEL101-OTEL106, OTEL112-OTEL117 and OTEL119-OTEL127 read the emitted collector YAML, so they are
+ * `yamlBased`. OTEL118 reads it too, but only in a build that stamps
+ * telemetry attribution, so it is not.
+ * OTEL107-OTEL109 read the declared entities (a component's definition, its
+ * schema pin), which a standalone YAML file does not carry, so they are
+ * constructed with `yamlBased: false`. The two source-level lint rules are
+ * listed too, for a reader who meets them in a lint report.
+ */
+import { auditRule } from "@intentius/chant/audit/catalog";
+function entityRule(id, category, title, remediation) {
+    return { id, tier: "merge-worthy", fixKind: "guidance", category, title, remediation, yamlBased: false };
+}
+export const otelAuditCatalog = {
+    OTEL001: entityRule("OTEL001", "correctness", "Collector component id or instance name is not valid syntax", 'Write component ids as `type` or `type/name` (e.g. "otlp/backend") and give instances a non-empty name with no whitespace.'),
+    OTEL002: entityRule("OTEL002", "security", "Collector credential declared as a literal", 'Replace the value with `${env:NAME}` or `${file:/path}` so the collector reads it at start-up.'),
+    OTEL101: auditRule("OTEL101", "merge-worthy", "guidance", "Pipeline uses an undeclared component", "Declare the receiver, processor or exporter under its section, or reference the declared entity instead of an id string. List a connector as an exporter in one pipeline and a receiver in another.", { category: "correctness" }),
+    OTEL102: auditRule("OTEL102", "merge-worthy", "guidance", "Pipeline has no receivers or no exporters", "Give every pipeline at least one receiver and at least one exporter, or remove it.", { category: "correctness" }),
+    OTEL103: auditRule("OTEL103", "report-only", "guidance", "Declared collector component is never used", "List the component in a pipeline (or the extension in service.extensions), or remove its declaration.", { category: "best-practice" }),
+    OTEL104: auditRule("OTEL104", "merge-worthy", "guidance", "service.extensions enables an undeclared extension", "Declare the extension under extensions, or drop it from service.extensions.", { category: "correctness" }),
+    OTEL105: auditRule("OTEL105", "report-only", "guidance", "memory_limiter is not the first processor", "Move memory_limiter to the front of the pipeline's processors list.", { category: "best-practice" }),
+    OTEL106: auditRule("OTEL106", "merge-worthy", "guidance", "Pipeline id or component reference is not valid collector syntax", "Name pipelines traces, metrics or logs (optionally /name) and reference components as type or type/name.", { category: "correctness" }),
+    OTEL107: entityRule("OTEL107", "correctness", "Collector component config breaks its definition's rules", "Fix the config the message names; for a custom component the rule comes from its defineComponent validate."),
+    OTEL108: entityRule("OTEL108", "correctness", "Two collector components or pipelines declare the same id", "Give each instance its own name so their ids (type/name) differ."),
+    OTEL109: entityRule("OTEL109", "correctness", "Custom collector component has no schema pin", "Pass defineComponent a pin with the source and version the component's config type follows."),
+    OTEL112: auditRule("OTEL112", "merge-worthy", "guidance", "Connector joins pipelines whose signals it does not convert", "Feed the connector from, and receive from it into, pipelines of the signals it supports (spanmetrics: traces in, metrics out).", { category: "correctness" }),
+    OTEL113: auditRule("OTEL113", "merge-worthy", "guidance", "Pipelines form a cycle through connectors", "Break the cycle the message names: drop one connector hop, or send that pipeline's data to an exporter instead of back upstream.", { category: "correctness" }),
+    OTEL114: auditRule("OTEL114", "merge-worthy", "guidance", "Connector id also declared as a receiver or exporter", 'Give the connector, or the receiver or exporter, its own name (e.g. "datadog/connector") and update the pipelines that list it.', { category: "correctness" }),
+    OTEL115: auditRule("OTEL115", "merge-worthy", "guidance", "Routing connector routes to a pipeline that does not receive from it", "List the routing connector in the receivers of every pipeline its table and default_pipelines name, or remove the pipeline from the route.", { category: "correctness" }),
+    OTEL116: auditRule("OTEL116", "merge-worthy", "guidance", "Connector splits metrics by a high-cardinality GenAI attribute", "Remove the conversation, response, tool call, session or user id, or the content key, from the connector's dimensions or attributes. Keep it on spans and logs, where a per-request value costs nothing extra.", { category: "efficiency" }),
+    OTEL117: auditRule("OTEL117", "merge-worthy", "guidance", "Two started components listen on the same address", "Give one of them another port, or a specific host that doesn't overlap the other's. The collector's own metrics listen on localhost:8888 unless service.telemetry.metrics sets a reader or level none.", { category: "correctness" }),
+    // Runs only in a build that stamps telemetry attribution, which a standalone YAML file never is.
+    OTEL118: {
+        ...auditRule("OTEL118", "report-only", "guidance", "Pipeline processor can remove or replace a telemetry attribution key", "Leave service.name, service.version, deployment.environment.name, vcs.ref.head.revision and chant.* keys alone: use insert rather than upsert or update, keep them in keep_keys and in redaction's allowed_keys, and set override: false on resourcedetection.", { category: "correctness" }),
+        yamlBased: false,
+    },
+    OTEL119: auditRule("OTEL119", "report-only", "guidance", "Collector config sets a field deprecated before the pinned release", "Replace invert_match with a drop policy, service.telemetry.metrics.address with readers, and spanmetrics dimensions_cache_size with aggregation_cardinality_limit.", { category: "best-practice" }),
+    OTEL120: auditRule("OTEL120", "merge-worthy", "guidance", "Collector credential written as a literal in the config", 'Replace the value with `${env:NAME}` or `${file:/path}` so the collector reads it at start-up.', { category: "security" }),
+    OTEL121: auditRule("OTEL121", "merge-worthy", "guidance", "Exporter sends a credential over plaintext", "Use an https:// endpoint, or drop tls.insecure, for an exporter that sends an authorization header or API key.", { category: "security" }),
+    OTEL122: auditRule("OTEL122", "merge-worthy", "guidance", "zpages or pprof listens on a non-loopback address", "Bind zpages and pprof to localhost and reach them with a port-forward.", { category: "security" }),
+    OTEL123: auditRule("OTEL123", "report-only", "guidance", "debug exporter at verbosity detailed beside a real exporter", "Set the debug exporter to verbosity basic, or keep detailed output to a pipeline that exports nowhere else.", { category: "security" }),
+    OTEL124: auditRule("OTEL124", "report-only", "guidance", "Remote exporter has its sending queue or retries turned off", "Remove sending_queue.enabled: false and retry_on_failure.enabled: false from exporters that send over the network.", { category: "best-practice" }),
+    OTEL125: auditRule("OTEL125", "report-only", "guidance", "Pipeline sends to a remote otlp or otlphttp exporter without batching", "Add a batch processor to the pipeline, or set sending_queue.batch on the exporter.", { category: "best-practice" }),
+    OTEL126: auditRule("OTEL126", "merge-worthy", "guidance", "k8sattributes extracts an unsupported metadata field", "Use a field from the k8sattributes list at the pinned release, or extract it as a label or annotation.", { category: "correctness" }),
+    OTEL127: auditRule("OTEL127", "merge-worthy", "guidance", "resourcedetection lists an unknown detector", "Name detectors as the processor registers them (elastic_beanstalk, not elasticbeanstalk), or remove the entry.", { category: "correctness" }),
+};

package/dist/lint/post-synth/index.js

@@ -0,0 +1,52 @@
+import { otel101 } from "./otel101.js";
+import { otel102 } from "./otel102.js";
+import { otel103 } from "./otel103.js";
+import { otel104 } from "./otel104.js";
+import { otel105 } from "./otel105.js";
+import { otel106 } from "./otel106.js";
+import { otel107 } from "./otel107.js";
+import { otel108 } from "./otel108.js";
+import { otel109 } from "./otel109.js";
+import { otel112 } from "./otel112.js";
+import { otel113 } from "./otel113.js";
+import { otel114 } from "./otel114.js";
+import { otel115 } from "./otel115.js";
+import { otel116 } from "./otel116.js";
+import { otel117 } from "./otel117.js";
+import { otel118 } from "./otel118.js";
+import { otel119 } from "./otel119.js";
+import { otel120 } from "./otel120.js";
+import { otel121 } from "./otel121.js";
+import { otel122 } from "./otel122.js";
+import { otel123 } from "./otel123.js";
+import { otel124 } from "./otel124.js";
+import { otel125 } from "./otel125.js";
+import { otel126 } from "./otel126.js";
+import { otel127 } from "./otel127.js";
+export const postSynthChecks = [
+    otel101,
+    otel102,
+    otel103,
+    otel104,
+    otel105,
+    otel106,
+    otel107,
+    otel108,
+    otel109,
+    otel112,
+    otel113,
+    otel114,
+    otel115,
+    otel116,
+    otel117,
+    otel118,
+    otel119,
+    otel120,
+    otel121,
+    otel122,
+    otel123,
+    otel124,
+    otel125,
+    otel126,
+    otel127,
+];

package/dist/lint/post-synth/otel-helpers.js

@@ -0,0 +1,103 @@
+/**
+ * Shared plumbing for the otel post-synth checks: find the collector configs
+ * in a build's output, and run the plain-function checks over them.
+ */
+import { loadAll } from "js-yaml";
+import { looksLikeCollectorConfig } from "../../model.js";
+import { configMapCollectorConfigs, describeConfigMapConfig, describeOperatorCollectorConfig, operatorCollectorConfig } from "../../configmap.js";
+import { validateCollectorConfig, validateCollectorEntities } from "../../validate-config.js";
+import { attributionIssues } from "../../attribution.js";
+/**
+ * Every collector config in the output: the otel lexicon's own, any YAML
+ * document shaped like one, and any ConfigMap data value that parses as one
+ * (how `OtelCollector`, `OtelCollectorGateway` and `GkeOtelCollector` carry
+ * theirs), and the `spec.config` of an OpenTelemetry Operator
+ * `OpenTelemetryCollector` (chant #3367). Parsed with js-yaml rather than `ctx.docs`, because collector
+ * configs are written with flow lists (`[otlp, batch]`) that core's small
+ * YAML reader keeps as strings.
+ *
+ * `chant build` hands each lexicon's checks only that lexicon's output, so
+ * the otel checks see ConfigMaps only in a context that includes k8s output.
+ * The k8s lexicon's WK8604 runs the same config checks over its own output.
+ */
+export function collectorConfigs(ctx) {
+    const out = [];
+    for (const [lexicon, output] of ctx.outputs) {
+        const texts = typeof output === "string"
+            ? [[lexicon, output]]
+            : [[lexicon, output.primary], ...Object.entries(output.files ?? {})];
+        for (const [source, text] of texts) {
+            if (!text)
+                continue;
+            let docs;
+            try {
+                docs = loadAll(text);
+            }
+            catch {
+                continue; // not YAML, or not ours
+            }
+            for (const doc of docs) {
+                if (typeof doc !== "object" || doc === null || Array.isArray(doc))
+                    continue;
+                if ((lexicon === "otel" && source === lexicon) || looksLikeCollectorConfig(doc)) {
+                    out.push({ source, config: doc });
+                    continue;
+                }
+                for (const { config, ...configMap } of configMapCollectorConfigs(doc)) {
+                    out.push({ source, config, configMap });
+                }
+                const cr = operatorCollectorConfig(doc);
+                if (cr)
+                    out.push({ source, config: cr.config, operator: { namespace: cr.namespace, name: cr.name } });
+            }
+        }
+    }
+    return out;
+}
+function toDiagnostic(issue, found) {
+    const where = found?.configMap
+        ? describeConfigMapConfig(found.configMap)
+        : found?.operator
+            ? describeOperatorCollectorConfig(found.operator)
+            : found && found.source !== "otel" ? found.source : undefined;
+    return {
+        checkId: issue.code,
+        severity: issue.severity,
+        message: where ? `${where}: ${issue.message}` : issue.message,
+        ...(issue.component ? { entity: issue.component } : issue.pipeline ? { entity: issue.pipeline } : {}),
+        lexicon: "otel",
+    };
+}
+/**
+ * The config-level issues for one config. OTEL118 joins them only when the
+ * build stamps the telemetry attribution (`ctx.telemetry`), so a level-0
+ * project never sees it.
+ */
+function configIssues(ctx, config) {
+    const issues = validateCollectorConfig(config);
+    return ctx.telemetry ? [...issues, ...attributionIssues(config)] : issues;
+}
+/**
+ * Every config-level diagnostic (OTEL101-OTEL106, OTEL112-OTEL127 and any later
+ * config check) over the collector configs in the output. `configMapsOnly`
+ * keeps the configs held in ConfigMaps. `hostedOnly` keeps those and the `spec.config` of an operator `OpenTelemetryCollector`, which is what WK8604 reads.
+ */
+export function collectorConfigDiagnostics(ctx, opts = {}) {
+    return collectorConfigs(ctx)
+        .filter((found) => !opts.configMapsOnly || found.configMap)
+        .filter((found) => !opts.hostedOnly || found.configMap || found.operator)
+        .flatMap(({ config, ...found }) => configIssues(ctx, config).map((i) => toDiagnostic(i, found)));
+}
+/** Diagnostics for one config-level code (OTEL101-OTEL106, OTEL112-OTEL127) across every collector config in the output. */
+export function configDiagnostics(ctx, code) {
+    return collectorConfigs(ctx).flatMap(({ config, ...found }) => configIssues(ctx, config)
+        .filter((i) => i.code === code)
+        .map((i) => toDiagnostic(i, found)));
+}
+/** Diagnostics for one entity-level code (OTEL107-OTEL109) over the build's otel entities. */
+export function entityDiagnostics(ctx, code) {
+    const otel = [...(ctx.entities?.values() ?? [])].filter((e) => e?.lexicon === "otel");
+    return validateCollectorEntities(otel)
+        .filter((i) => i.code === code)
+        .map((i) => toDiagnostic(i));
+}

package/dist/lint/post-synth/otel101.js

@@ -0,0 +1,13 @@
+/**
+ * OTEL101: A pipeline uses a receiver, processor or exporter that is not declared
+ *
+ * The collector refuses to start on this. Typed entity references cannot go wrong this way, so it mostly catches id strings (`"otlp/backend"`) and hand-edited or parsed configs. A connector id is accepted in receivers and exporters, but a connector counts as used only when one pipeline lists it as an exporter and another lists it as a receiver; listed on one side only, it fails this check.
+ */
+import { configDiagnostics } from "./otel-helpers.js";
+export const otel101 = {
+    id: "OTEL101",
+    description: "A pipeline uses a receiver, processor or exporter that is not declared",
+    check(ctx) {
+        return configDiagnostics(ctx, "OTEL101");
+    },
+};

package/dist/lint/post-synth/otel102.js

@@ -0,0 +1,13 @@
+/**
+ * OTEL102: A pipeline has no receivers or no exporters
+ *
+ * A pipeline with no receivers takes in nothing, and one with no exporters sends what it takes in nowhere. The collector rejects both at start.
+ */
+import { configDiagnostics } from "./otel-helpers.js";
+export const otel102 = {
+    id: "OTEL102",
+    description: "A pipeline has no receivers or no exporters",
+    check(ctx) {
+        return configDiagnostics(ctx, "OTEL102");
+    },
+};

package/dist/lint/post-synth/otel103.js

@@ -0,0 +1,13 @@
+/**
+ * OTEL103: A declared component is never used
+ *
+ * A receiver, processor, exporter or connector no pipeline lists, or an extension missing from service.extensions, is ignored by the collector. Usually it means a pipeline was meant to list it. A warning, since the config still runs.
+ */
+import { configDiagnostics } from "./otel-helpers.js";
+export const otel103 = {
+    id: "OTEL103",
+    description: "A declared component is never used",
+    check(ctx) {
+        return configDiagnostics(ctx, "OTEL103");
+    },
+};

package/dist/lint/post-synth/otel104.js

@@ -0,0 +1,13 @@
+/**
+ * OTEL104: service.extensions enables an extension that is not declared
+ *
+ * The collector refuses to start when service.extensions names an id with no entry under extensions.
+ */
+import { configDiagnostics } from "./otel-helpers.js";
+export const otel104 = {
+    id: "OTEL104",
+    description: "service.extensions enables an extension that is not declared",
+    check(ctx) {
+        return configDiagnostics(ctx, "OTEL104");
+    },
+};

package/dist/lint/post-synth/otel105.js

@@ -0,0 +1,13 @@
+/**
+ * OTEL105: memory_limiter is not the first processor in a pipeline
+ *
+ * The collector's own guidance puts memory_limiter first, so it can refuse data before any other processor buffers it. Later in the chain it limits too late to protect the process.
+ */
+import { configDiagnostics } from "./otel-helpers.js";
+export const otel105 = {
+    id: "OTEL105",
+    description: "memory_limiter is not the first processor in a pipeline",
+    check(ctx) {
+        return configDiagnostics(ctx, "OTEL105");
+    },
+};

package/dist/lint/post-synth/otel106.js

@@ -0,0 +1,13 @@
+/**
+ * OTEL106: A pipeline id or component reference is not valid collector syntax
+ *
+ * A pipeline id is a signal (traces, metrics, logs) optionally followed by /name, and every reference is type or type/name. Anything else is a config error at collector start.
+ */
+import { configDiagnostics } from "./otel-helpers.js";
+export const otel106 = {
+    id: "OTEL106",
+    description: "A pipeline id or component reference is not valid collector syntax",
+    check(ctx) {
+        return configDiagnostics(ctx, "OTEL106");
+    },
+};

package/dist/lint/post-synth/otel107.js

@@ -0,0 +1,13 @@
+/**
+ * OTEL107: A component's config breaks its definition's rules
+ *
+ * Each component definition, built-in or custom, can check its own config beyond what the TypeScript type says: memory_limiter needs a limit, filelog needs an include, and so on. A custom component supplies its checks through defineComponent's validate.
+ */
+import { entityDiagnostics } from "./otel-helpers.js";
+export const otel107 = {
+    id: "OTEL107",
+    description: "A component's config breaks its definition's rules",
+    check(ctx) {
+        return entityDiagnostics(ctx, "OTEL107");
+    },
+};

package/dist/lint/post-synth/otel108.js

@@ -0,0 +1,13 @@
+/**
+ * OTEL108: Two components or two pipelines declare the same id
+ *
+ * The collector config is keyed by id, so the second declaration would silently replace the first. The serializer keeps the first and this check fails the build.
+ */
+import { entityDiagnostics } from "./otel-helpers.js";
+export const otel108 = {
+    id: "OTEL108",
+    description: "Two components or two pipelines declare the same id",
+    check(ctx) {
+        return entityDiagnostics(ctx, "OTEL108");
+    },
+};

package/dist/lint/post-synth/otel109.js

@@ -0,0 +1,13 @@
+/**
+ * OTEL109: A custom component has no schema pin
+ *
+ * defineComponent requires a pin naming the source and version its config type follows, so a reader can tell which schema the component was checked against. This check fails a build whose custom component lost its pin, for instance through an untyped call.
+ */
+import { entityDiagnostics } from "./otel-helpers.js";
+export const otel109 = {
+    id: "OTEL109",
+    description: "A custom component has no schema pin",
+    check(ctx) {
+        return entityDiagnostics(ctx, "OTEL109");
+    },
+};

package/dist/lint/post-synth/otel112.js

@@ -0,0 +1,13 @@
+/**
+ * OTEL112: A connector joins pipelines whose signals it does not convert
+ *
+ * Each connector supports fixed signal pairs: `spanmetrics` and `servicegraph` read traces and write metrics, `count` writes metrics from any signal, `routing` and `forward` keep the signal. Every pipeline that feeds a connector must pair with a pipeline it feeds through one of those pairs, and the other way round, or the collector refuses to start. A traces pipeline that receives from `spanmetrics` fails this check. Custom connectors are checked when their `defineComponent` call lists `connects`.
+ */
+import { configDiagnostics } from "./otel-helpers.js";
+export const otel112 = {
+    id: "OTEL112",
+    description: "A connector joins pipelines whose signals it does not convert",
+    check(ctx) {
+        return configDiagnostics(ctx, "OTEL112");
+    },
+};

package/dist/lint/post-synth/otel113.js

@@ -0,0 +1,13 @@
+/**
+ * OTEL113: Pipelines form a cycle through connectors
+ *
+ * A connector carries data from the pipeline that lists it as an exporter to the pipeline that lists it as a receiver. When those hops lead back to a pipeline already on the path (traces/a feeds traces/b through one connector and traces/b feeds traces/a through another, or one pipeline lists the same `forward` connector on both sides), the collector refuses to start. The check walks the `edges` `collectorTopology()` returns and names one cycle per group of pipelines caught in it.
+ */
+import { configDiagnostics } from "./otel-helpers.js";
+export const otel113 = {
+    id: "OTEL113",
+    description: "Pipelines form a cycle through connectors",
+    check(ctx) {
+        return configDiagnostics(ctx, "OTEL113");
+    },
+};

package/dist/lint/post-synth/otel114.js

@@ -0,0 +1,13 @@
+/**
+ * OTEL114: A connector id is also declared as a receiver or exporter
+ *
+ * A pipeline names a connector the same way it names a receiver or an exporter, so the collector refuses a config where a connector id is also declared under `receivers` or `exporters`, whether or not any pipeline uses it.
+ */
+import { configDiagnostics } from "./otel-helpers.js";
+export const otel114 = {
+    id: "OTEL114",
+    description: "A connector id is also declared as a receiver or exporter",
+    check(ctx) {
+        return configDiagnostics(ctx, "OTEL114");
+    },
+};

package/dist/lint/post-synth/otel115.js

@@ -0,0 +1,13 @@
+/**
+ * OTEL115: A routing connector routes to a pipeline that does not receive from it
+ *
+ * Every pipeline a `routing` connector names in `table[].pipelines` or `default_pipelines` must list that connector in its receivers. The connector can only hand data to the pipelines it feeds, and the collector refuses to start when a route names any other pipeline or one that does not exist.
+ */
+import { configDiagnostics } from "./otel-helpers.js";
+export const otel115 = {
+    id: "OTEL115",
+    description: "A routing connector routes to a pipeline that does not receive from it",
+    check(ctx) {
+        return configDiagnostics(ctx, "OTEL115");
+    },
+};

package/dist/lint/post-synth/otel116.js

@@ -0,0 +1,13 @@
+/**
+ * OTEL116: A connector splits metrics by a high-cardinality GenAI attribute
+ *
+ * `gen_ai.conversation.id`, `gen_ai.response.id`, `gen_ai.tool.call.id`, `session.id`, `user.id`, `enduser.id` and the other keys in `GENAI_HIGH_CARDINALITY_ATTRIBUTES` take a new value per response, conversation or user, and the content keys (`gen_ai.input.messages` and the rest of `GENAI_CONTENT_ATTRIBUTES`) are unbounded. Used as a metric attribute in `spanmetrics` or `servicegraph` dimensions, `sum` or `count` attributes, or `signaltometrics` attributes or `include_resource_attributes`, each value starts new time series. The collector accepts such a config without a warning.
+ */
+import { configDiagnostics } from "./otel-helpers.js";
+export const otel116 = {
+    id: "OTEL116",
+    description: "A connector splits metrics by a high-cardinality GenAI attribute",
+    check(ctx) {
+        return configDiagnostics(ctx, "OTEL116");
+    },
+};

package/dist/lint/post-synth/otel117.js

@@ -0,0 +1,13 @@
+/**
+ * OTEL117: Two components the collector starts listen on the same address
+ *
+ * A receiver or exporter a pipeline lists, an extension in `service.extensions`, and the collector's own metrics endpoint (`localhost:8888` unless `service.telemetry.metrics` says otherwise) each bind an address when the collector starts. Two on the same port, on the same host or with either on a wildcard host (`0.0.0.0`, `::`), make the second bind fail with "address already in use", and the collector exits. `otelcol validate` does not bind, so it accepts such a config. The listeners checked are the otlp, zipkin and jaeger receivers, the prometheus exporter, and the health_check, zpages and pprof extensions, with their defaults at the pinned collector release.
+ */
+import { configDiagnostics } from "./otel-helpers.js";
+export const otel117 = {
+    id: "OTEL117",
+    description: "Two components the collector starts listen on the same address",
+    check(ctx) {
+        return configDiagnostics(ctx, "OTEL117");
+    },
+};

package/dist/lint/post-synth/otel118.js

@@ -0,0 +1,13 @@
+/**
+ * OTEL118: A pipeline processor can remove or replace a resource attribute chant's telemetry attribution stamps
+ *
+ * A workload built in a workspace, or with `telemetry.attribution: true`, carries `service.name`, `service.version`, `deployment.environment.name`, `vcs.ref.head.revision` and `chant.*` resource attributes. A `resource` processor that deletes, updates, upserts or hashes one, a `transform` statement that sets, deletes or fails to keep one, or a `resourcedetection` processor with `override` on and a detector that writes one undoes that. The `transform` case matches OTTL text. The check runs only when the build stamps the attribution, so a level-0 project sees nothing.
+ */
+import { configDiagnostics } from "./otel-helpers.js";
+export const otel118 = {
+    id: "OTEL118",
+    description: "A pipeline processor can remove or replace a resource attribute chant's telemetry attribution stamps",
+    check(ctx) {
+        return configDiagnostics(ctx, "OTEL118");
+    },
+};

package/dist/lint/post-synth/otel119.js

@@ -0,0 +1,13 @@
+/**
+ * OTEL119: A collector config sets a field deprecated at or before the pinned release
+ *
+ * `invert_match: true` in a `tail_sampling` policy (inverted decisions are deprecated in collector-contrib v0.126.0 for a `drop` policy), `service.telemetry.metrics.address` (deprecated in collector v0.111.0 for `readers`), and `dimensions_cache_size` on `spanmetrics` (deprecated in collector-contrib v0.125.0 for `aggregation_cardinality_limit`). The collector still reads each at v0.130.0, and a later release drops it.
+ */
+import { configDiagnostics } from "./otel-helpers.js";
+export const otel119 = {
+    id: "OTEL119",
+    description: "A collector config sets a field deprecated at or before the pinned release",
+    check(ctx) {
+        return configDiagnostics(ctx, "OTEL119");
+    },
+};