@senad-d/observme 0.1.3 → 0.1.5

package/src/config/validate.ts

@@ -1,8 +1,16 @@
 import { Compile } from "typebox/compile";
 import { defaultObservMeConfig } from "./defaults.ts";
-import { observMeConfigSchema } from "./schema.ts";
+import {
+  ACTIVE_AGENT_LEASE_EXPORT_SAFETY_MARGIN_MILLIS,
+  observMeConfigSchema,
+} from "./schema.ts";
 import type { ObservMeConfig } from "./schema.ts";
 import { validateCustomRedactionPatterns } from "../privacy/redact.ts";
+import { classifyOtlpEndpointFailure } from "../otel/otlp-endpoint.ts";
+import {
+  classifyGrafanaUrlSecurityFailure,
+  formatGrafanaUrlSecurityFailure,
+} from "../query/grafana-url.ts";
 
 export interface ValidationIssue {
   code: string;
@@ -54,14 +62,22 @@ const maximumConfigDiagnosticIssueCount = 1_000_000;
 const unknownConfigValidationIssueCode = "unknown_config_validation_issue";
 const knownConfigValidationIssueCodes = new Set([
   "invalid_config_shape",
+  "config_source_malformed",
+  "config_source_rejected",
+  "config_source_unreadable",
   "unsafe_capture_without_redaction",
   "insecure_production_transport",
+  "invalid_otlp_endpoint",
   "invalid_signal_endpoint_path",
+  "embedded_grafana_url_credentials",
   "high_cardinality_metric_label",
+  "active_agent_lease_too_short_for_export_interval",
   "custom_redaction_pattern_limit",
   "custom_redaction_pattern_too_long",
   "custom_redaction_pattern_unsupported_construct",
   "custom_redaction_pattern_nested_quantifier",
+  "custom_redaction_pattern_ambiguous_alternation",
+  "custom_redaction_pattern_ambiguous_repetition",
   "custom_redaction_pattern_empty_match",
   "invalid_custom_redaction_pattern",
   "untrusted_project_config_read",
@@ -80,8 +96,10 @@ export function validateObservMeConfig(
   const issues = [
     ...validateRedactionBoundary(config),
     ...validateTransportSecurity(config),
-    ...validateSignalEndpoints(config),
+    ...validateOtlpEndpoints(config),
+    ...validateGrafanaUrl(config),
     ...validateMetricLabels(config),
+    ...validateActiveAgentLeaseDuration(config),
     ...validateCustomRedactionPatternConfig(config),
     ...validateProjectTrust(options),
     ...validateLineageEnvironment(config, options.env ?? process.env),
@@ -248,7 +266,15 @@ function validateTransportSecurity(config: ObservMeConfig): ValidationIssue[] {
     ...validateProductionHttpEndpoint("otlp.signalEndpoints.traces", config.otlp.signalEndpoints?.traces),
     ...validateProductionHttpEndpoint("otlp.signalEndpoints.metrics", config.otlp.signalEndpoints?.metrics),
     ...validateProductionHttpEndpoint("otlp.signalEndpoints.logs", config.otlp.signalEndpoints?.logs),
+    ...validateProductionTlsVerificationBypass(
+      "otlp.tls.insecureSkipVerify",
+      config.otlp.tls.insecureSkipVerify,
+    ),
     ...validateProductionHttpEndpoint("query.grafana.url", config.query.grafana.url),
+    ...validateProductionTlsVerificationBypass(
+      "query.grafana.tls.insecureSkipVerify",
+      config.query.grafana.tls.insecureSkipVerify,
+    ),
   ];
 }
 
@@ -263,30 +289,54 @@ function validateProductionHttpEndpoint(name: string, endpoint: string | undefin
   ];
 }
 
+function validateProductionTlsVerificationBypass(name: string, insecureSkipVerify: boolean): ValidationIssue[] {
+  if (!insecureSkipVerify) return [];
+
+  return [
+    {
+      code: "insecure_production_transport",
+      message: `${name} must be false in production unless privacy.allowInsecureTransport is true.`,
+    },
+  ];
+}
+
 function isHttpEndpoint(endpoint: string): boolean {
   return endpoint.trim().toLowerCase().startsWith("http://");
 }
 
-function validateSignalEndpoints(config: ObservMeConfig): ValidationIssue[] {
-  if (config.otlp.protocol !== "http/protobuf") return [];
-
+function validateOtlpEndpoints(config: ObservMeConfig): ValidationIssue[] {
   const endpoints = config.otlp.signalEndpoints;
-  if (!endpoints) return [];
 
   return [
-    ...validateSignalEndpoint("traces", endpoints.traces, "/v1/traces"),
-    ...validateSignalEndpoint("metrics", endpoints.metrics, "/v1/metrics"),
-    ...validateSignalEndpoint("logs", endpoints.logs, "/v1/logs"),
+    ...validateOtlpEndpoint("otlp.endpoint", config.otlp.endpoint),
+    ...validateSignalEndpoint("otlp.signalEndpoints.traces", endpoints?.traces, "/v1/traces"),
+    ...validateSignalEndpoint("otlp.signalEndpoints.metrics", endpoints?.metrics, "/v1/metrics"),
+    ...validateSignalEndpoint("otlp.signalEndpoints.logs", endpoints?.logs, "/v1/logs"),
   ];
 }
 
-function validateSignalEndpoint(signal: string, endpoint: string | undefined, requiredPath: string): ValidationIssue[] {
-  if (!endpoint || endpointPathMatches(endpoint, requiredPath)) return [];
+function validateOtlpEndpoint(name: string, endpoint: string): ValidationIssue[] {
+  const failureClass = classifyOtlpEndpointFailure(endpoint);
+  if (!failureClass) return [];
+
+  return [
+    {
+      code: "invalid_otlp_endpoint",
+      message: `${name} is invalid (${failureClass}).`,
+    },
+  ];
+}
+
+function validateSignalEndpoint(name: string, endpoint: string | undefined, requiredPath: string): ValidationIssue[] {
+  if (!endpoint) return [];
+
+  const endpointIssues = validateOtlpEndpoint(name, endpoint);
+  if (endpointIssues.length > 0 || endpointPathMatches(endpoint, requiredPath)) return endpointIssues;
 
   return [
     {
       code: "invalid_signal_endpoint_path",
-      message: `${signal} OTLP HTTP exporter URL must include ${requiredPath}.`,
+      message: `${name} must end with ${requiredPath}.`,
     },
   ];
 }
@@ -299,6 +349,18 @@ function endpointPathMatches(endpoint: string, requiredPath: string): boolean {
   }
 }
 
+function validateGrafanaUrl(config: ObservMeConfig): ValidationIssue[] {
+  const failureClass = classifyGrafanaUrlSecurityFailure(config.query.grafana.url);
+  if (!failureClass) return [];
+
+  return [
+    {
+      code: "embedded_grafana_url_credentials",
+      message: formatGrafanaUrlSecurityFailure(failureClass),
+    },
+  ];
+}
+
 function validateMetricLabels(config: ObservMeConfig): ValidationIssue[] {
   const labels = config.metrics.labels ?? [];
   return labels.filter(isForbiddenMetricLabel).map(label => ({
@@ -307,6 +369,20 @@ function validateMetricLabels(config: ObservMeConfig): ValidationIssue[] {
   }));
 }
 
+function validateActiveAgentLeaseDuration(config: ObservMeConfig): ValidationIssue[] {
+  const requiredDuration =
+    (2 * config.metrics.exportIntervalMillis) + ACTIVE_AGENT_LEASE_EXPORT_SAFETY_MARGIN_MILLIS;
+  if (config.metrics.activeAgentLeaseDurationMillis >= requiredDuration) return [];
+
+  return [
+    {
+      code: "active_agent_lease_too_short_for_export_interval",
+      message:
+        "metrics.activeAgentLeaseDurationMillis must be at least twice metrics.exportIntervalMillis plus the clock-skew safety margin.",
+    },
+  ];
+}
+
 function validateCustomRedactionPatternConfig(config: ObservMeConfig): ValidationIssue[] {
   return validateCustomRedactionPatterns(config.privacy.customRedactionPatterns).map(issue => ({
     code: issue.code,

package/src/extension.ts

@@ -1,28 +1,18 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { registerObsCommand } from "./commands/obs.ts";
+import { assertObservMePiCompatibility } from "./pi/compatibility.ts";
 import { registerHandlers } from "./pi/handlers.ts";
-
-const extensionPiApiCompatibilityErrorMessage =
-  "ObservMe/Pi API compatibility error: expected Pi ExtensionAPI with on(eventName, handler) and registerCommand(name, options) before registering ObservMe.";
 const partialInitializationErrorMessage =
   "ObservMe extension initialization failed while registering /obs after Pi event handlers were already registered. Pi ExtensionAPI does not expose unregister hooks for event handlers or slash commands, so ObservMe cannot roll back partial registration; restart Pi after fixing command registration.";
 
 export default function observme(pi: ExtensionAPI): void {
-  assertRegistrationApiAvailable(pi);
+  assertObservMePiCompatibility(pi);
   // Only the Pi process environment is eligible for launcher-provided lineage.
   // Session config loading keeps trusted project .env values out of this boundary.
   registerHandlers(pi, { trustedParentContext: true });
   registerObsCommandWithPartialInitializationDiagnostic(pi);
 }
 
-function assertRegistrationApiAvailable(pi: ExtensionAPI): void {
-  const api = pi as Partial<ExtensionAPI> | null | undefined;
-
-  if (!api || typeof api.on !== "function" || typeof api.registerCommand !== "function") {
-    throw new TypeError(extensionPiApiCompatibilityErrorMessage);
-  }
-}
-
 function registerObsCommandWithPartialInitializationDiagnostic(pi: ExtensionAPI): void {
   try {
     registerObsCommand(pi);

package/src/integration.ts

@@ -7,14 +7,18 @@ export type ObservMeSpawnType = "command" | "tool" | "extension" | "unknown";
 export type ObservMeSpawnReason = "delegated_task" | "parallel_search" | "review" | "tool_wrapper" | "unknown";
 export type ObservMeAgentWaitReason = "dependency" | "rate_limit" | "child_running" | "unknown";
 export type ObservMeChildStatus = "starting" | "active" | "completed" | "failed" | "cancelled" | "orphaned";
+export type ObservMeTerminalChildStatus = Extract<ObservMeChildStatus, "completed" | "failed" | "cancelled">;
 export type ObservMeJoinStatus = "completed" | "failed" | "cancelled" | "timeout" | "unknown" | "waiting";
 export type ObservMeIntegrationFailureReason =
   | "session_unavailable"
   | "invalid_request"
   | "spawn_already_exists"
+  | "child_agent_already_exists"
   | "wait_already_exists"
   | "join_already_exists"
   | "spawn_not_found"
+  | "child_agent_mismatch"
+  | "invalid_terminal_transition"
   | "wait_not_found"
   | "join_not_found"
   | "operation_failed";
@@ -63,8 +67,8 @@ export interface ObservMeStartedSubagent {
 
 export interface ObservMeCompleteSubagentOptions {
   readonly childAgentId?: string;
-  readonly childStatus?: ObservMeChildStatus;
-  readonly outcome?: "completed" | "failed" | "cancelled";
+  readonly childStatus?: ObservMeTerminalChildStatus;
+  readonly outcome?: ObservMeTerminalChildStatus;
 }
 
 export interface ObservMeFailSubagentOptions {

package/src/otel/logs.ts

@@ -1,5 +1,5 @@
 import type { Logger } from "@opentelemetry/api-logs";
-import { createNoopLogger, logs } from "@opentelemetry/api-logs";
+import { createNoopLogger } from "@opentelemetry/api-logs";
 import type { Resource } from "@opentelemetry/resources";
 import { resourceFromAttributes } from "@opentelemetry/resources";
 import { OTLPLogExporter } from "@opentelemetry/exporter-logs-otlp-proto";
@@ -7,6 +7,7 @@ import type { LogRecordExporter, LogRecordProcessor } from "@opentelemetry/sdk-l
 import { BatchLogRecordProcessor, LoggerProvider } from "@opentelemetry/sdk-logs";
 import type { LogsBatchConfig, ObservMeConfig } from "../config/schema.ts";
 import { appendOtlpSignalPath } from "./otlp-endpoint.ts";
+import { buildOtlpHttpAgentOptions, type OtlpHttpAgentOptions } from "./otlp-http-options.ts";
 import type { StartOtelSdkFactoryOptions } from "./sdk.ts";
 
 export const OBSERVME_LOGGER_NAME = "@senad-d/observme";
@@ -24,6 +25,7 @@ export interface OtlpLogExporterOptions {
   readonly url: string;
   readonly headers: Record<string, string>;
   readonly timeoutMillis: number;
+  readonly httpAgentOptions: OtlpHttpAgentOptions;
 }
 
 export interface LogProviderOptions {
@@ -45,7 +47,6 @@ export type LogProviderFactory = (options: LogProviderOptions) => LogProviderLik
 export interface ObservMeLogSdkOptions {
   readonly config: ObservMeConfig;
   readonly loggerName?: string;
-  readonly registerGlobal?: boolean;
   readonly exporterFactory?: LogExporterFactory;
   readonly processorFactory?: LogRecordProcessorFactory;
   readonly loggerProviderFactory?: LogProviderFactory;
@@ -62,10 +63,11 @@ const noopLogger = createNoopLogger();
 export class ObservMeLogSdk {
   readonly #config: ObservMeConfig;
   readonly #loggerName: string;
-  readonly #registerGlobal: boolean;
   readonly #exporterFactory: LogExporterFactory;
   readonly #processorFactory: LogRecordProcessorFactory;
   readonly #loggerProviderFactory: LogProviderFactory;
+  #exporter?: LogRecordExporter;
+  #processor?: LogRecordProcessor;
   #provider?: LogProviderLike;
   #logger: Logger = noopLogger;
   #state: LogPipelineState = "idle";
@@ -73,7 +75,6 @@ export class ObservMeLogSdk {
   constructor(options: ObservMeLogSdkOptions) {
     this.#config = options.config;
     this.#loggerName = options.loggerName ?? OBSERVME_LOGGER_NAME;
-    this.#registerGlobal = options.registerGlobal ?? true;
     this.#exporterFactory = options.exporterFactory ?? createOtlpLogExporter;
     this.#processorFactory = options.processorFactory ?? createBatchLogRecordProcessor;
     this.#loggerProviderFactory = options.loggerProviderFactory ?? createLogProvider;
@@ -89,21 +90,20 @@ export class ObservMeLogSdk {
 
   start(): void {
     if (this.#state === "started" || this.#state === "disabled") return;
-    if (!this.#config.logs.enabled) {
+    if (!this.#config.enabled || !this.#config.logs.enabled) {
       this.#state = "disabled";
       return;
     }
 
     const wiring = buildLogExporterWiring(this.#config);
-    const exporter = this.#exporterFactory(wiring.exporter);
-    const processor = this.#processorFactory(exporter, wiring.batch);
+    this.#exporter = this.#exporterFactory(wiring.exporter);
+    this.#processor = this.#processorFactory(this.#exporter, wiring.batch);
     this.#provider = this.#loggerProviderFactory({
       resource: createLogResource(this.#config),
-      processors: [processor],
+      processors: [this.#processor],
       forceFlushTimeoutMillis: this.#config.shutdown.flushTimeoutMs,
     });
 
-    if (this.#registerGlobal) logs.setGlobalLoggerProvider(this.#provider);
     this.#logger = this.#provider.getLogger(this.#loggerName);
     this.#state = "started";
   }
@@ -113,9 +113,19 @@ export class ObservMeLogSdk {
   }
 
   async shutdown(): Promise<void> {
-    await this.#provider?.shutdown?.();
-    this.#state = "shutdown";
-    this.#logger = noopLogger;
+    if (this.#state === "shutdown") return;
+
+    try {
+      if (this.#provider?.shutdown) await this.#provider.shutdown();
+      else if (this.#processor) await this.#processor.shutdown();
+      else await this.#exporter?.shutdown();
+    } finally {
+      this.#provider = undefined;
+      this.#processor = undefined;
+      this.#exporter = undefined;
+      this.#state = "shutdown";
+      this.#logger = noopLogger;
+    }
   }
 }
 
@@ -125,7 +135,7 @@ export function createLogSessionScopedOtelSdk(options: StartOtelSdkFactoryOption
 
 export function buildLogExporterWiring(config: ObservMeConfig): LogExporterWiring {
   return {
-    enabled: config.logs.enabled,
+    enabled: config.enabled && config.logs.enabled,
     exporter: buildOtlpLogExporterOptions(config),
     batch: { ...config.logs.batch },
   };
@@ -136,6 +146,7 @@ export function buildOtlpLogExporterOptions(config: ObservMeConfig): OtlpLogExpo
     url: resolveLogEndpoint(config),
     headers: { ...config.otlp.headers },
     timeoutMillis: config.otlp.timeoutMs,
+    httpAgentOptions: buildOtlpHttpAgentOptions(config),
   };
 }
 

package/src/otel/metrics.ts

@@ -1,5 +1,5 @@
 import type { Meter } from "@opentelemetry/api";
-import { createNoopMeter, metrics } from "@opentelemetry/api";
+import { createNoopMeter } from "@opentelemetry/api";
 import type { Resource } from "@opentelemetry/resources";
 import { resourceFromAttributes } from "@opentelemetry/resources";
 import { OTLPMetricExporter } from "@opentelemetry/exporter-metrics-otlp-proto";
@@ -7,6 +7,7 @@ import type { IMetricReader, PushMetricExporter } from "@opentelemetry/sdk-metri
 import { MeterProvider, PeriodicExportingMetricReader } from "@opentelemetry/sdk-metrics";
 import type { MetricsConfig, ObservMeConfig } from "../config/schema.ts";
 import { appendOtlpSignalPath } from "./otlp-endpoint.ts";
+import { buildOtlpHttpAgentOptions, type OtlpHttpAgentOptions } from "./otlp-http-options.ts";
 import type { StartOtelSdkFactoryOptions } from "./sdk.ts";
 
 export const OBSERVME_METER_NAME = "@senad-d/observme";
@@ -23,6 +24,7 @@ export interface OtlpMetricExporterOptions {
   readonly url: string;
   readonly headers: Record<string, string>;
   readonly timeoutMillis: number;
+  readonly httpAgentOptions: OtlpHttpAgentOptions;
 }
 
 export interface MetricReaderOptions {
@@ -48,7 +50,6 @@ export type MetricProviderFactory = (options: MetricProviderOptions) => MetricPr
 export interface ObservMeMetricSdkOptions {
   readonly config: ObservMeConfig;
   readonly meterName?: string;
-  readonly registerGlobal?: boolean;
   readonly exporterFactory?: MetricExporterFactory;
   readonly readerFactory?: MetricReaderFactory;
   readonly meterProviderFactory?: MetricProviderFactory;
@@ -65,10 +66,11 @@ const noopMeter = createNoopMeter();
 export class ObservMeMetricSdk {
   readonly #config: ObservMeConfig;
   readonly #meterName: string;
-  readonly #registerGlobal: boolean;
   readonly #exporterFactory: MetricExporterFactory;
   readonly #readerFactory: MetricReaderFactory;
   readonly #meterProviderFactory: MetricProviderFactory;
+  #exporter?: PushMetricExporter;
+  #reader?: IMetricReader;
   #provider?: MetricProviderLike;
   #meter: Meter = noopMeter;
   #state: MetricPipelineState = "idle";
@@ -76,7 +78,6 @@ export class ObservMeMetricSdk {
   constructor(options: ObservMeMetricSdkOptions) {
     this.#config = options.config;
     this.#meterName = options.meterName ?? OBSERVME_METER_NAME;
-    this.#registerGlobal = options.registerGlobal ?? true;
     this.#exporterFactory = options.exporterFactory ?? createOtlpMetricExporter;
     this.#readerFactory = options.readerFactory ?? createPeriodicMetricReader;
     this.#meterProviderFactory = options.meterProviderFactory ?? createMetricProvider;
@@ -92,20 +93,19 @@ export class ObservMeMetricSdk {
 
   start(): void {
     if (this.#state === "started" || this.#state === "disabled") return;
-    if (!this.#config.metrics.enabled) {
+    if (!this.#config.enabled || !this.#config.metrics.enabled) {
       this.#state = "disabled";
       return;
     }
 
     const wiring = buildMetricExporterWiring(this.#config);
-    const exporter = this.#exporterFactory(wiring.exporter);
-    const reader = this.#readerFactory(exporter, wiring.reader);
+    this.#exporter = this.#exporterFactory(wiring.exporter);
+    this.#reader = this.#readerFactory(this.#exporter, wiring.reader);
     this.#provider = this.#meterProviderFactory({
       resource: createMetricResource(this.#config),
-      readers: [reader],
+      readers: [this.#reader],
     });
 
-    if (this.#registerGlobal) metrics.setGlobalMeterProvider(this.#provider);
     this.#meter = this.#provider.getMeter(this.#meterName);
     this.#state = "started";
   }
@@ -115,9 +115,19 @@ export class ObservMeMetricSdk {
   }
 
   async shutdown(): Promise<void> {
-    await this.#provider?.shutdown?.();
-    this.#state = "shutdown";
-    this.#meter = noopMeter;
+    if (this.#state === "shutdown") return;
+
+    try {
+      if (this.#provider?.shutdown) await this.#provider.shutdown();
+      else if (this.#reader) await this.#reader.shutdown();
+      else await this.#exporter?.shutdown();
+    } finally {
+      this.#provider = undefined;
+      this.#reader = undefined;
+      this.#exporter = undefined;
+      this.#state = "shutdown";
+      this.#meter = noopMeter;
+    }
   }
 }
 
@@ -127,7 +137,7 @@ export function createMetricSessionScopedOtelSdk(options: StartOtelSdkFactoryOpt
 
 export function buildMetricExporterWiring(config: ObservMeConfig): MetricExporterWiring {
   return {
-    enabled: config.metrics.enabled,
+    enabled: config.enabled && config.metrics.enabled,
     exporter: buildOtlpMetricExporterOptions(config),
     reader: {
       exportIntervalMillis: config.metrics.exportIntervalMillis,
@@ -141,6 +151,7 @@ export function buildOtlpMetricExporterOptions(config: ObservMeConfig): OtlpMetr
     url: resolveMetricEndpoint(config),
     headers: { ...config.otlp.headers },
     timeoutMillis: config.otlp.timeoutMs,
+    httpAgentOptions: buildOtlpHttpAgentOptions(config),
   };
 }
 

package/src/otel/otlp-endpoint.ts

@@ -1,6 +1,45 @@
+export type OtlpEndpointFailureClass =
+  | "unresolved_placeholder"
+  | "malformed_url"
+  | "unsupported_protocol"
+  | "embedded_credentials"
+  | "query_not_supported"
+  | "fragment_not_supported";
+
+export function classifyOtlpEndpointFailure(endpoint: string): OtlpEndpointFailureClass | undefined {
+  if (endpoint.includes("${")) return "unresolved_placeholder";
+  if (/\s/u.test(endpoint)) return "malformed_url";
+
+  const parsedEndpoint = parseEndpoint(endpoint);
+  if (!parsedEndpoint) return "malformed_url";
+  if (parsedEndpoint.protocol !== "http:" && parsedEndpoint.protocol !== "https:") return "unsupported_protocol";
+  if (parsedEndpoint.username || parsedEndpoint.password) return "embedded_credentials";
+  if (endpoint.includes("?")) return "query_not_supported";
+  if (endpoint.includes("#")) return "fragment_not_supported";
+  return undefined;
+}
+
 export function appendOtlpSignalPath(baseEndpoint: string, signalPath: string): string {
-  const trimmedBaseEndpoint = removeTrailingSlashes(baseEndpoint);
-  return `${trimmedBaseEndpoint}${signalPath}`;
+  const failureClass = classifyOtlpEndpointFailure(baseEndpoint);
+  if (failureClass) throw new TypeError(`OTLP endpoint is invalid (${failureClass}).`);
+
+  const endpoint = new URL(baseEndpoint);
+  endpoint.pathname = `${removeTrailingSlashes(endpoint.pathname)}${normalizeSignalPath(signalPath)}`;
+  return endpoint.href;
+}
+
+function parseEndpoint(endpoint: string): URL | undefined {
+  try {
+    return new URL(endpoint);
+  } catch {
+    return undefined;
+  }
+}
+
+function normalizeSignalPath(signalPath: string): string {
+  let start = 0;
+  while (start < signalPath.length && signalPath[start] === "/") start += 1;
+  return `/${signalPath.slice(start)}`;
 }
 
 function removeTrailingSlashes(value: string): string {

package/src/otel/otlp-http-options.ts

@@ -0,0 +1,11 @@
+import type { ObservMeConfig } from "../config/schema.ts";
+
+export interface OtlpHttpAgentOptions {
+  readonly rejectUnauthorized: boolean;
+}
+
+export function buildOtlpHttpAgentOptions(config: ObservMeConfig): OtlpHttpAgentOptions {
+  return {
+    rejectUnauthorized: !config.otlp.tls.insecureSkipVerify,
+  };
+}