@superblocksteam/telemetry 2.0.83-next.1

package/dist-esm/common/tier-hints.js

@@ -0,0 +1,199 @@
+/**
+ * Tier Policy Hints
+ *
+ * SDK-level hints that inform the OTEL Collector how to route spans.
+ * These are HINTS, not guarantees — the Collector makes final routing decisions.
+ *
+ * NOTE: This is different from tier TAGS (which indicate which pipeline processed
+ * a span). Hints are prescriptive ("please route this way"), tags are descriptive
+ * ("this was processed by Tier X"). The Collector adds tier tags; the SDK adds hints.
+ *
+ * See: engineering/projects/o11y-refactor/proposals/sdk-tier-policy-hints.md
+ */
+/**
+ * The attribute key used for tier policy hints.
+ * Collector filters on this attribute to make routing decisions.
+ */
+export const TIER_HINT_ATTRIBUTE = "superblocks.tier_hint";
+/**
+ * Tier policy hints that inform the Collector how to route spans.
+ *
+ * These are HINTS, not guarantees — the Collector makes final routing decisions
+ * based on its configuration. In cloud-prem deployments, the Collector respects
+ * these hints to control which tiers receive the span.
+ *
+ * @example
+ * ```typescript
+ * import { trace } from '@opentelemetry/api';
+ * import { TierPolicyHint, TIER_HINT_ATTRIBUTE } from '@superblocksteam/telemetry';
+ *
+ * const span = tracer.startSpan('sensitive_operation');
+ * span.setAttribute(TIER_HINT_ATTRIBUTE, TierPolicyHint.TIER1_ONLY);
+ * ```
+ */
+export var TierPolicyHint;
+(function (TierPolicyHint) {
+    /**
+     * Route to Tier 1 only. Do not export to Tier 2 or Tier 3.
+     *
+     * Use for:
+     * - Spans containing customer secrets or credentials
+     * - Highly sensitive customer data that must not leave their environment
+     * - Debug/diagnostic spans that should remain local
+     *
+     * The span will be stored in the customer's Tier 1 backend (e.g., Tempo)
+     * but will NOT be exported to Superblocks (Tier 2) or AI analytics (Tier 3).
+     */
+    TierPolicyHint["TIER1_ONLY"] = "tier1_only";
+    /**
+     * Include in Tier 3 (AI quality analysis) in addition to Tier 1 and Tier 2.
+     *
+     * Use for:
+     * - GenAI spans that should be analyzed for quality metrics
+     * - AI/LLM operations where prompts and responses are valuable for analysis
+     * - Spans with AI quality signals (latency, token usage, etc.)
+     *
+     * The span will go to all tiers: Tier 1 (full fidelity), Tier 2 (sanitized),
+     * and Tier 3 (AI analytics with identity stripped).
+     */
+    TierPolicyHint["INCLUDE_TIER3"] = "include_tier3";
+    /**
+     * Skip all external export. Tier 1 (local) only, no Tier 2/3.
+     * Alias for TIER1_ONLY, kept for semantic clarity.
+     *
+     * Use for:
+     * - High-cardinality diagnostic spans (cost control)
+     * - Temporary debug spans that shouldn't persist
+     * - Spans that are only useful for local debugging
+     *
+     * This is functionally equivalent to TIER1_ONLY but communicates
+     * a different intent: "this is for cost/noise control" rather than
+     * "this contains sensitive data."
+     */
+    TierPolicyHint["SKIP_EXPORT"] = "skip_export";
+})(TierPolicyHint || (TierPolicyHint = {}));
+/**
+ * Set a tier policy hint on a span.
+ *
+ * This is a convenience function that sets the `superblocks.tier_hint` attribute.
+ * You can also set the attribute directly if preferred.
+ *
+ * @param span - The span to set the hint on
+ * @param hint - The tier policy hint
+ *
+ * @example
+ * ```typescript
+ * import { setTierHint, TierPolicyHint } from '@superblocksteam/telemetry';
+ *
+ * tracer.startActiveSpan('decrypt_secret', (span) => {
+ *   setTierHint(span, TierPolicyHint.TIER1_ONLY);
+ *   // ... perform operation
+ *   span.end();
+ * });
+ * ```
+ */
+export function setTierHint(span, hint) {
+    span.setAttribute(TIER_HINT_ATTRIBUTE, hint);
+}
+/**
+ * Mark a span as containing sensitive data that should not leave Tier 1.
+ *
+ * Use this for spans that handle customer secrets, credentials, or other
+ * highly sensitive data that must remain in the customer's environment.
+ *
+ * @param span - The span to mark as sensitive
+ *
+ * @example
+ * ```typescript
+ * import { markSensitive } from '@superblocksteam/telemetry';
+ *
+ * tracer.startActiveSpan('decrypt_customer_secret', (span) => {
+ *   markSensitive(span);
+ *   // ... decrypt operation
+ *   span.end();
+ * });
+ * ```
+ */
+export function markSensitive(span) {
+    setTierHint(span, TierPolicyHint.TIER1_ONLY);
+}
+/**
+ * Mark a span for AI quality analysis (Tier 3).
+ *
+ * Use this for GenAI spans that should be analyzed for quality metrics.
+ * The span will go to all tiers, with Tier 3 receiving the content
+ * (prompts/responses) for AI quality analysis.
+ *
+ * @param span - The span to mark for AI analysis
+ *
+ * @example
+ * ```typescript
+ * import { markForAIAnalysis } from '@superblocksteam/telemetry';
+ *
+ * tracer.startActiveSpan('gen_ai.chat', (span) => {
+ *   markForAIAnalysis(span);
+ *   span.setAttribute('gen_ai.system', 'anthropic');
+ *   // ... LLM call
+ *   span.end();
+ * });
+ * ```
+ */
+export function markForAIAnalysis(span) {
+    setTierHint(span, TierPolicyHint.INCLUDE_TIER3);
+}
+/**
+ * Mark a span as debug-only (no export to Tier 2/3).
+ *
+ * Use this for high-cardinality diagnostic spans where you want to
+ * control costs by preventing export to paid backends.
+ *
+ * @param span - The span to mark as debug-only
+ *
+ * @example
+ * ```typescript
+ * import { markDebugOnly } from '@superblocksteam/telemetry';
+ *
+ * tracer.startActiveSpan('debug.cache_lookup', (span) => {
+ *   markDebugOnly(span);
+ *   span.setAttribute('cache.key', cacheKey); // High cardinality OK
+ *   // ... lookup
+ *   span.end();
+ * });
+ * ```
+ */
+export function markDebugOnly(span) {
+    setTierHint(span, TierPolicyHint.SKIP_EXPORT);
+}
+/**
+ * Check if a span has a tier hint set.
+ *
+ * @param span - The span to check (must be a ReadableSpan with attributes)
+ * @returns The tier hint if set, undefined otherwise
+ */
+export function getTierHint(span) {
+    const hint = span.attributes?.[TIER_HINT_ATTRIBUTE];
+    if (typeof hint === "string" &&
+        Object.values(TierPolicyHint).includes(hint)) {
+        return hint;
+    }
+    return undefined;
+}
+/**
+ * Check if a tier hint indicates the span should skip Tier 2 export.
+ *
+ * @param hint - The tier hint to check
+ * @returns true if Tier 2 should be skipped
+ */
+export function shouldSkipTier2(hint) {
+    return (hint === TierPolicyHint.TIER1_ONLY || hint === TierPolicyHint.SKIP_EXPORT);
+}
+/**
+ * Check if a tier hint indicates the span should be included in Tier 3.
+ *
+ * @param hint - The tier hint to check
+ * @returns true if Tier 3 should be included
+ */
+export function shouldIncludeTier3(hint) {
+    return hint === TierPolicyHint.INCLUDE_TIER3;
+}
+//# sourceMappingURL=tier-hints.js.map

package/dist-esm/common/tier-hints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tier-hints.js","sourceRoot":"","sources":["../../src/common/tier-hints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE3D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,cAyCX;AAzCD,WAAY,cAAc;IACxB;;;;;;;;;;OAUG;IACH,2CAAyB,CAAA;IAEzB;;;;;;;;;;OAUG;IACH,iDAA+B,CAAA;IAE/B;;;;;;;;;;;;OAYG;IACH,6CAA2B,CAAA;AAC7B,CAAC,EAzCW,cAAc,KAAd,cAAc,QAyCzB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,WAAW,CAAC,IAAU,EAAE,IAAoB;IAC1D,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa,CAAC,IAAU;IACtC,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAU;IAC1C,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,aAAa,CAAC,IAAU;IACtC,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAE3B;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,mBAAmB,CAAC,CAAC;IACpD,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAsB,CAAC,EAC9D,CAAC;QACD,OAAO,IAAsB,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAgC;IAC9D,OAAO,CACL,IAAI,KAAK,cAAc,CAAC,UAAU,IAAI,IAAI,KAAK,cAAc,CAAC,WAAW,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAgC;IACjE,OAAO,IAAI,KAAK,cAAc,CAAC,aAAa,CAAC;AAC/C,CAAC"}

package/dist-esm/index.d.ts

@@ -0,0 +1,43 @@
+/**
+ * @superblocksteam/telemetry
+ *
+ * Canonical telemetry bootstrap package for all Superblocks services.
+ * Provides policy-aware OpenTelemetry initialization with tier-based routing.
+ *
+ * This package is the ONLY approved way to initialize telemetry.
+ * Direct usage of NodeSDK or WebTracerProvider is prohibited.
+ *
+ * ## Usage
+ *
+ * ### Node.js Services
+ *
+ * ```typescript
+ * import { initNodeTelemetry } from '@superblocksteam/telemetry/node';
+ * import { getDefaultPolicy, DeploymentType } from '@superblocksteam/shared';
+ *
+ * const policy = getDefaultPolicy(DeploymentType.CLOUD_PREM);
+ * const telemetry = initNodeTelemetry({
+ *   serviceName: 'my-service',
+ *   serviceVersion: '1.0.0',
+ *   environment: 'production',
+ *   otlpUrl: 'http://localhost:4318',
+ * }, policy);
+ * ```
+ *
+ * ### Browser
+ *
+ * ```typescript
+ * import { initBrowserTelemetry } from '@superblocksteam/telemetry/browser';
+ * ```
+ *
+ * ### Testing
+ *
+ * ```typescript
+ * import { initTestTelemetry } from '@superblocksteam/telemetry/testing';
+ * ```
+ */
+export * from "./types/index.js";
+export * from "./common/index.js";
+export * from "./llmobs/index.js";
+export { initNodeTelemetry, getTelemetryInstance, isTelemetryInitialized, resetTelemetry, type NodeTelemetryInstance, MetricsClient, type Labels, type CounterHandle, type GaugeHandle, type HistogramHandle, TracedSocket, type TracedSocketConfig, type TracedSocketOptions, } from './node/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist-esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAGH,cAAc,kBAAkB,CAAC;AAGjC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,mBAAmB,CAAC;AAIlC,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,EACd,KAAK,qBAAqB,EAC1B,aAAa,EACb,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,YAAY,EACZ,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,iBAAiB,CAAC"}

package/dist-esm/index.js

@@ -0,0 +1,53 @@
+/**
+ * @superblocksteam/telemetry
+ *
+ * Canonical telemetry bootstrap package for all Superblocks services.
+ * Provides policy-aware OpenTelemetry initialization with tier-based routing.
+ *
+ * This package is the ONLY approved way to initialize telemetry.
+ * Direct usage of NodeSDK or WebTracerProvider is prohibited.
+ *
+ * ## Usage
+ *
+ * ### Node.js Services
+ *
+ * ```typescript
+ * import { initNodeTelemetry } from '@superblocksteam/telemetry/node';
+ * import { getDefaultPolicy, DeploymentType } from '@superblocksteam/shared';
+ *
+ * const policy = getDefaultPolicy(DeploymentType.CLOUD_PREM);
+ * const telemetry = initNodeTelemetry({
+ *   serviceName: 'my-service',
+ *   serviceVersion: '1.0.0',
+ *   environment: 'production',
+ *   otlpUrl: 'http://localhost:4318',
+ * }, policy);
+ * ```
+ *
+ * ### Browser
+ *
+ * ```typescript
+ * import { initBrowserTelemetry } from '@superblocksteam/telemetry/browser';
+ * ```
+ *
+ * ### Testing
+ *
+ * ```typescript
+ * import { initTestTelemetry } from '@superblocksteam/telemetry/testing';
+ * ```
+ */
+// Re-export types
+export * from "./types/index.js";
+// Re-export common utilities
+export * from "./common/index.js";
+// Re-export LLMObs tiered telemetry
+export * from "./llmobs/index.js";
+// Re-export Node.js telemetry functions for convenience
+// This allows imports like: import { initNodeTelemetry } from '@superblocksteam/telemetry'
+export { initNodeTelemetry, getTelemetryInstance, isTelemetryInitialized, resetTelemetry, MetricsClient, TracedSocket, } from './node/index.js';
+// Note: Browser and Testing modules are still exported via package.json subpath exports
+// Import them as:
+//   - @superblocksteam/telemetry/browser
+//   - @superblocksteam/telemetry/testing
+//   - @superblocksteam/telemetry/llmobs
+//# sourceMappingURL=index.js.map

package/dist-esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,kBAAkB;AAClB,cAAc,kBAAkB,CAAC;AAEjC,6BAA6B;AAC7B,cAAc,mBAAmB,CAAC;AAElC,oCAAoC;AACpC,cAAc,mBAAmB,CAAC;AAElC,wDAAwD;AACxD,2FAA2F;AAC3F,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,EAEd,aAAa,EAKb,YAAY,GAGb,MAAM,iBAAiB,CAAC;AAEzB,wFAAwF;AACxF,kBAAkB;AAClB,yCAAyC;AACzC,yCAAyC;AACzC,wCAAwC"}

package/dist-esm/lint/forbidden-attributes.d.ts

@@ -0,0 +1,149 @@
+/**
+ * ESLint Rule: No Forbidden Telemetry Attributes
+ *
+ * This rule detects usage of forbidden attributes in span/metric instrumentation.
+ * It catches common leak paths before code is merged.
+ *
+ * Usage in eslint.config.js:
+ * ```
+ * import { noForbiddenTelemetryAttributes } from '@superblocksteam/telemetry/lint';
+ *
+ * export default [
+ *   {
+ *     plugins: {
+ *       telemetry: { rules: { 'no-forbidden-attributes': noForbiddenTelemetryAttributes } }
+ *     },
+ *     rules: {
+ *       'telemetry/no-forbidden-attributes': 'error'
+ *     }
+ *   }
+ * ];
+ * ```
+ */
+/**
+ * Forbidden attribute patterns for static analysis.
+ */
+export declare const FORBIDDEN_ATTRIBUTE_PATTERNS: string[];
+/**
+ * ESLint rule metadata.
+ */
+export declare const noForbiddenTelemetryAttributesMeta: {
+    type: string;
+    docs: {
+        description: string;
+        category: string;
+        recommended: boolean;
+    };
+    messages: {
+        forbiddenAttribute: string;
+        resourceOnlyAttribute: string;
+    };
+    schema: never[];
+};
+/**
+ * ESLint rule implementation.
+ *
+ * Detects patterns like:
+ * - span.setAttribute('prompt', value)
+ * - span.setAttributes({ prompt: value })
+ * - { 'prompt': value }
+ */
+export declare function noForbiddenTelemetryAttributesCreate(context: any): {
+    CallExpression(node: any): void;
+    Property(node: any): void;
+};
+/**
+ * Complete ESLint rule export.
+ */
+export declare const noForbiddenTelemetryAttributes: {
+    meta: {
+        type: string;
+        docs: {
+            description: string;
+            category: string;
+            recommended: boolean;
+        };
+        messages: {
+            forbiddenAttribute: string;
+            resourceOnlyAttribute: string;
+        };
+        schema: never[];
+    };
+    create: typeof noForbiddenTelemetryAttributesCreate;
+};
+/**
+ * ESLint rule: No Direct OTEL SDK Usage
+ *
+ * Detects direct usage of NodeSDK or WebTracerProvider outside the telemetry package.
+ */
+export declare const noDirectOtelSdkMeta: {
+    type: string;
+    docs: {
+        description: string;
+        category: string;
+        recommended: boolean;
+    };
+    messages: {
+        directSdkUsage: string;
+    };
+    schema: never[];
+};
+export declare function noDirectOtelSdkCreate(context: any): {
+    ImportSpecifier?: undefined;
+    CallExpression?: undefined;
+} | {
+    ImportSpecifier(node: any): void;
+    CallExpression(node: any): void;
+};
+export declare const noDirectOtelSdk: {
+    meta: {
+        type: string;
+        docs: {
+            description: string;
+            category: string;
+            recommended: boolean;
+        };
+        messages: {
+            directSdkUsage: string;
+        };
+        schema: never[];
+    };
+    create: typeof noDirectOtelSdkCreate;
+};
+/**
+ * All telemetry ESLint rules.
+ */
+export declare const telemetryRules: {
+    'no-forbidden-attributes': {
+        meta: {
+            type: string;
+            docs: {
+                description: string;
+                category: string;
+                recommended: boolean;
+            };
+            messages: {
+                forbiddenAttribute: string;
+                resourceOnlyAttribute: string;
+            };
+            schema: never[];
+        };
+        create: typeof noForbiddenTelemetryAttributesCreate;
+    };
+    'no-direct-otel-sdk': {
+        meta: {
+            type: string;
+            docs: {
+                description: string;
+                category: string;
+                recommended: boolean;
+            };
+            messages: {
+                directSdkUsage: string;
+            };
+            schema: never[];
+        };
+        create: typeof noDirectOtelSdkCreate;
+    };
+};
+//# sourceMappingURL=forbidden-attributes.d.ts.map

package/dist-esm/lint/forbidden-attributes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forbidden-attributes.d.ts","sourceRoot":"","sources":["../../src/lint/forbidden-attributes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAOH;;GAEG;AACH,eAAO,MAAM,4BAA4B,UAKxC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;CAgB9C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,GAAG;yBAsBxC,GAAG;mBA6BT,GAAG;EAuBrB;AAED;;GAEG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;CAG1C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;CAa/B,CAAC;AAYF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,GAAG;;;;0BASxB,GAAG;yBAYJ,GAAG;EAsB3B;AAED,eAAO,MAAM,eAAe;;;;;;;;;;;;;;CAG3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAG1B,CAAC"}

package/dist-esm/lint/forbidden-attributes.js

@@ -0,0 +1,209 @@
+/**
+ * ESLint Rule: No Forbidden Telemetry Attributes
+ *
+ * This rule detects usage of forbidden attributes in span/metric instrumentation.
+ * It catches common leak paths before code is merged.
+ *
+ * Usage in eslint.config.js:
+ * ```
+ * import { noForbiddenTelemetryAttributes } from '@superblocksteam/telemetry/lint';
+ *
+ * export default [
+ *   {
+ *     plugins: {
+ *       telemetry: { rules: { 'no-forbidden-attributes': noForbiddenTelemetryAttributes } }
+ *     },
+ *     rules: {
+ *       'telemetry/no-forbidden-attributes': 'error'
+ *     }
+ *   }
+ * ];
+ * ```
+ */
+/* eslint-disable @typescript-eslint/no-explicit-any -- ESLint rule APIs use untyped AST nodes */
+import { TIER2_FORBIDDEN_ATTRIBUTES } from '../common/contracts/tier2-traces.js';
+import { RESOURCE_ONLY_ATTRIBUTES } from '../common/resource.js';
+/**
+ * Forbidden attribute patterns for static analysis.
+ */
+export const FORBIDDEN_ATTRIBUTE_PATTERNS = [
+    // Direct string literals
+    ...Array.from(TIER2_FORBIDDEN_ATTRIBUTES),
+    // Resource-only attributes
+    ...Array.from(RESOURCE_ONLY_ATTRIBUTES),
+];
+/**
+ * ESLint rule metadata.
+ */
+export const noForbiddenTelemetryAttributesMeta = {
+    type: 'problem',
+    docs: {
+        description: 'Disallow forbidden telemetry attributes in Tier 2 paths',
+        category: 'Security',
+        recommended: true,
+    },
+    messages: {
+        forbiddenAttribute: "Attribute '{{name}}' is forbidden in Tier 2 telemetry. " +
+            'This data should only be in Tier 1 (local retention).',
+        resourceOnlyAttribute: "Attribute '{{name}}' should be a RESOURCE attribute, not a span attribute. " +
+            'Set it in initNodeTelemetry() config, not per-span.',
+    },
+    schema: [],
+};
+/**
+ * ESLint rule implementation.
+ *
+ * Detects patterns like:
+ * - span.setAttribute('prompt', value)
+ * - span.setAttributes({ prompt: value })
+ * - { 'prompt': value }
+ */
+export function noForbiddenTelemetryAttributesCreate(context) {
+    const forbiddenSet = new Set(FORBIDDEN_ATTRIBUTE_PATTERNS);
+    const resourceOnlySet = RESOURCE_ONLY_ATTRIBUTES;
+    function checkAttributeName(node, name) {
+        if (TIER2_FORBIDDEN_ATTRIBUTES.has(name)) {
+            context.report({
+                node,
+                messageId: 'forbiddenAttribute',
+                data: { name },
+            });
+        }
+        else if (resourceOnlySet.has(name)) {
+            context.report({
+                node,
+                messageId: 'resourceOnlyAttribute',
+                data: { name },
+            });
+        }
+    }
+    return {
+        // Check span.setAttribute('forbidden', value)
+        CallExpression(node) {
+            if (node.callee.type === 'MemberExpression' &&
+                node.callee.property.name === 'setAttribute' &&
+                node.arguments.length >= 1 &&
+                node.arguments[0].type === 'Literal' &&
+                typeof node.arguments[0].value === 'string') {
+                checkAttributeName(node.arguments[0], node.arguments[0].value);
+            }
+            // Check span.setAttributes({ forbidden: value })
+            if (node.callee.type === 'MemberExpression' &&
+                node.callee.property.name === 'setAttributes' &&
+                node.arguments.length >= 1 &&
+                node.arguments[0].type === 'ObjectExpression') {
+                for (const prop of node.arguments[0].properties) {
+                    if (prop.key.type === 'Literal' && typeof prop.key.value === 'string') {
+                        checkAttributeName(prop.key, prop.key.value);
+                    }
+                    else if (prop.key.type === 'Identifier') {
+                        checkAttributeName(prop.key, prop.key.name);
+                    }
+                }
+            }
+        },
+        // Check object literals with forbidden keys in telemetry-related files
+        Property(node) {
+            // Only check if we're likely in a telemetry context
+            const filename = context.getFilename();
+            if (!filename.includes('telemetry') &&
+                !filename.includes('tracing') &&
+                !filename.includes('observability')) {
+                return;
+            }
+            let name = null;
+            if (node.key.type === 'Literal' && typeof node.key.value === 'string') {
+                name = node.key.value;
+            }
+            else if (node.key.type === 'Identifier') {
+                name = node.key.name;
+            }
+            if (name && forbiddenSet.has(name)) {
+                checkAttributeName(node.key, name);
+            }
+        },
+    };
+}
+/**
+ * Complete ESLint rule export.
+ */
+export const noForbiddenTelemetryAttributes = {
+    meta: noForbiddenTelemetryAttributesMeta,
+    create: noForbiddenTelemetryAttributesCreate,
+};
+/**
+ * ESLint rule: No Direct OTEL SDK Usage
+ *
+ * Detects direct usage of NodeSDK or WebTracerProvider outside the telemetry package.
+ */
+export const noDirectOtelSdkMeta = {
+    type: 'problem',
+    docs: {
+        description: 'Disallow direct OpenTelemetry SDK usage outside telemetry package',
+        category: 'Best Practices',
+        recommended: true,
+    },
+    messages: {
+        directSdkUsage: "Direct usage of '{{name}}' is not allowed. " +
+            'Use @superblocksteam/telemetry bootstrap functions instead.',
+    },
+    schema: [],
+};
+/**
+ * Forbidden OTEL SDK imports.
+ */
+const FORBIDDEN_SDK_IMPORTS = [
+    'NodeSDK',
+    'WebTracerProvider',
+    'NodeTracerProvider',
+    'BasicTracerProvider',
+];
+export function noDirectOtelSdkCreate(context) {
+    const filename = context.getFilename();
+    // Allow in telemetry package itself
+    if (filename.includes('packages/telemetry')) {
+        return {};
+    }
+    return {
+        ImportSpecifier(node) {
+            const importedName = node.imported.name;
+            if (FORBIDDEN_SDK_IMPORTS.includes(importedName)) {
+                context.report({
+                    node,
+                    messageId: 'directSdkUsage',
+                    data: { name: importedName },
+                });
+            }
+        },
+        // Also check require() calls
+        CallExpression(node) {
+            if (node.callee.name === 'require' &&
+                node.arguments.length === 1 &&
+                node.arguments[0].type === 'Literal') {
+                const requirePath = node.arguments[0].value;
+                if (typeof requirePath === 'string' &&
+                    (requirePath.includes('@opentelemetry/sdk-node') ||
+                        requirePath.includes('@opentelemetry/sdk-trace-node') ||
+                        requirePath.includes('@opentelemetry/sdk-trace-web'))) {
+                    context.report({
+                        node,
+                        messageId: 'directSdkUsage',
+                        data: { name: requirePath },
+                    });
+                }
+            }
+        },
+    };
+}
+export const noDirectOtelSdk = {
+    meta: noDirectOtelSdkMeta,
+    create: noDirectOtelSdkCreate,
+};
+/**
+ * All telemetry ESLint rules.
+ */
+export const telemetryRules = {
+    'no-forbidden-attributes': noForbiddenTelemetryAttributes,
+    'no-direct-otel-sdk': noDirectOtelSdk,
+};
+//# sourceMappingURL=forbidden-attributes.js.map

package/dist-esm/lint/forbidden-attributes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forbidden-attributes.js","sourceRoot":"","sources":["../../src/lint/forbidden-attributes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,iGAAiG;AAEjG,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEjE;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,yBAAyB;IACzB,GAAG,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC;IACzC,2BAA2B;IAC3B,GAAG,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC;CACxC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACJ,WAAW,EAAE,yDAAyD;QACtE,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,IAAI;KAClB;IACD,QAAQ,EAAE;QACR,kBAAkB,EAChB,yDAAyD;YACzD,uDAAuD;QACzD,qBAAqB,EACnB,6EAA6E;YAC7E,qDAAqD;KACxD;IACD,MAAM,EAAE,EAAE;CACX,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,oCAAoC,CAAC,OAAY;IAC/D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC3D,MAAM,eAAe,GAAG,wBAAwB,CAAC;IAEjD,SAAS,kBAAkB,CAAC,IAAS,EAAE,IAAY;QACjD,IAAI,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,oBAAoB;gBAC/B,IAAI,EAAE,EAAE,IAAI,EAAE;aACf,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,uBAAuB;gBAClC,IAAI,EAAE,EAAE,IAAI,EAAE;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,8CAA8C;QAC9C,cAAc,CAAC,IAAS;YACtB,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;gBACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,cAAc;gBAC5C,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC;gBAC1B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS;gBACpC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,EAC3C,CAAC;gBACD,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACjE,CAAC;YAED,iDAAiD;YACjD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;gBACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,eAAe;gBAC7C,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC;gBAC1B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,EAC7C,CAAC;gBACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;oBAChD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;wBACtE,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;oBAC/C,CAAC;yBAAM,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBAC1C,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC9C,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,QAAQ,CAAC,IAAS;YAChB,oDAAoD;YACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACvC,IACE,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC/B,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC7B,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EACnC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,IAAI,GAAkB,IAAI,CAAC;YAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACtE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YACxB,CAAC;iBAAM,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1C,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YACvB,CAAC;YAED,IAAI,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,IAAI,EAAE,kCAAkC;IACxC,MAAM,EAAE,oCAAoC;CAC7C,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACJ,WAAW,EAAE,mEAAmE;QAChF,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,IAAI;KAClB;IACD,QAAQ,EAAE;QACR,cAAc,EACZ,6CAA6C;YAC7C,6DAA6D;KAChE;IACD,MAAM,EAAE,EAAE;CACX,CAAC;AAEF;;GAEG;AACH,MAAM,qBAAqB,GAAG;IAC5B,SAAS;IACT,mBAAmB;IACnB,oBAAoB;IACpB,qBAAqB;CACtB,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,OAAY;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAEvC,oCAAoC;IACpC,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL,eAAe,CAAC,IAAS;YACvB,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACxC,IAAI,qBAAqB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACjD,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,gBAAgB;oBAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,cAAc,CAAC,IAAS;YACtB,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;gBAC9B,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;gBAC3B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,EACpC,CAAC;gBACD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC5C,IACE,OAAO,WAAW,KAAK,QAAQ;oBAC/B,CAAC,WAAW,CAAC,QAAQ,CAAC,yBAAyB,CAAC;wBAC9C,WAAW,CAAC,QAAQ,CAAC,+BAA+B,CAAC;wBACrD,WAAW,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC,EACvD,CAAC;oBACD,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI;wBACJ,SAAS,EAAE,gBAAgB;wBAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;qBAC5B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,mBAAmB;IACzB,MAAM,EAAE,qBAAqB;CAC9B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,yBAAyB,EAAE,8BAA8B;IACzD,oBAAoB,EAAE,eAAe;CACtC,CAAC"}