chore(api)!: replace GraphQL observability API with gRPC, remove async-graphql dependencies (#24364)

* chore(api): grpc server (remove graphql)

* reuse event.proto

* docs(api): clarify metadata preservation in proto conversion

The comment now explicitly mentions that Log.metadata_full preserves event metadata during conversion.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* test(api): migrate vector_api tests from GraphQL to gRPC

Migrate the vector_api integration tests from the deprecated GraphQL API to the new gRPC API.

Changes:
- Updated test infrastructure to use gRPC client instead of GraphQL
- Migrated component queries from GraphQL to gRPC GetComponents RPC
- Replaced GraphQL subscriptions with gRPC streaming for tap functionality
- Added metrics population in gRPC GetComponents handler to support metrics tests
- Fixed config reload tests to work around Vector behavior where components with
  unchanged names but modified connections don't appear during the reload transition
- Increased startup timeout from 2s to 10s to handle slower test environments
- Added 500ms delay before polling after SIGHUP to let Vector process the signal

Test fixes:
- Updated all assertions to use gRPC proto types (ComponentsResponse, ComponentType, etc.)
- Changed tap tests to collect events inline instead of storing streams to avoid lifetime issues
- Simplified reload tests to completely replace components instead of keeping old names
- All 7 tests now pass: tap (4 tests), top (3 tests)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(dev): cargo fmt

* docs: add changelog for GraphQL to gRPC API migration

Add breaking change changelog documenting the removal of the GraphQL
Playground and replacement with gRPC API. Includes migration guide with
grpcurl examples for common operations.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* allow grpcurl word

* fix(api): address gRPC migration issues

P0:
- Bind TCP listener before spawning to fail fast on port conflicts

P1:
- Restore fail-fast behavior on API startup failures
- Fix tap output format regression (JSON/YAML/logfmt)
- Remove metric batching to support <10 components
- Fix double throughput normalization

P2:
- Validate parameters before casting to unsigned types
- Report Vector uptime instead of subscription lifetime

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* wip

chore(dev): cargo fmt

* support JSON/YAML/logfmt formats

* chore(dev): cargo fmt

* feat(api): add gRPC reflection support

Enables gRPC server reflection for the observability API, allowing
tools like grpcurl and grpcui to introspect the API without needing
the .proto files.

Changes:
- Add tonic-reflection dependency with server feature
- Register reflection service in gRPC server
- Expose FILE_DESCRIPTOR_SET from generated protobuf code

This allows clients to:
- List available services: grpcurl -plaintext localhost:8686 list
- Describe methods: grpcurl -plaintext localhost:8686 describe
- Call methods without proto files

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(api-client): include third-party proto path for event.proto

Fixes CI build failure where protoc couldn't find google/protobuf/timestamp.proto
when compiling event.proto in vector-api-client build script.

The first tonic_build::configure() call was missing the third-party include path,
causing the build to fail when looking for Google well-known types.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(dev): cargo fmt

* chore(dev): cargo vdev build licenses

* add note to old blog post

* refactor(grpc): apply review fixes to gRPC migration

- Fix 1: make Client::new() sync and infallible (URL validated lazily on connect);
  update all call sites, improve test for connection failure to use port 65535
- Fix 2: avoid throwaway health-check client in tap cmd; extract
  run_tap_with_client() in TapRunner and thread the pre-connected client through
  tap_internal() so cmd() reuses it instead of creating a second connection
- Fix 3: cap component poll interval at 1s minimum in poll_components to avoid
  flooding GetComponents at short metrics intervals (e.g. 100ms)
- Fix 4: populate on_type with the real plugin type name (e.g. "demo_logs",
  "kafka") sourced from TapOutput.component_type; update component_to_row to
  use ComponentType enum for kind and on_type for component_type
- Fix 5: document the intentional proto round-trip in serialize_event explaining
  the vector-api-client / vector-core type separation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* make build-licenses

* docs(grpc): clarify std::sync::Mutex usage in async streaming handlers

The lock is never held across an .await point — it only guards synchronous
HashMap updates inside IntervalStream closures — so std::sync::Mutex is
the correct, cheaper choice over tokio::sync::Mutex. Add a comment to
prevent future readers from reflexively replacing it.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(grpc): enforce limit >= 1 for StreamOutputEvents at all layers

The limit field controls both the reservoir size and the internal channel
capacity in stream_output_events, so 0 is not a valid value (unlike
GetComponents where 0 means "no limit").

- Proto: document the >= 1 requirement and explain why 0 is not valid
- Server: improve the error message to reference the affected internals
- CLI: add value_parser range(1..) so `--limit 0` is rejected at parse
  time with a clear clap error, before the request reaches the server

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(grpc): correct reservoir sampling bias in stream_output_events

Algorithm R requires drawing a random index from 0..=i (inclusive) for
the i-th event seen. The previous code used 0..batch (exclusive), which
made the first event after the reservoir fills guaranteed to replace an
existing entry (100% probability instead of limit/(limit+1)).

The fix is a one-character change: 0..batch -> 0..=batch.

The same bug existed in the old GraphQL implementation; this is not a
regression but a pre-existing correctness issue now fixed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: improve --url help text and expand changelog for gRPC migration

- Add `(e.g. http://localhost:8686)` to --url help in tap and top
- Expand changelog to clarify GraphQL API is fully removed, add --url
  format migration guide, and note required fields in grpcurl example

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(api): remove deprecated graphql and playground config fields

The `api.graphql` and `api.playground` fields were silently ignored
after the GraphQL→gRPC migration. Remove them so configs containing
those fields are rejected with a clear error rather than accepted
and ignored. Update the changelog accordingly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: update website and internal docs for GraphQL→gRPC migration

- Rewrite website/docs/reference/api.md for gRPC (remove GraphQL/Playground sections)
- Update configuration/api.md description to reference gRPC endpoint
- Update api.cue to describe gRPC service and proto file
- Update cli.cue: --url flag descriptions now say "gRPC" not "GraphQL"
- Update internal_metrics.cue: remove "GraphQL" from api_started_total description
- Regenerate generated/configuration.cue (removes graphql/playground fields)
- Update AGENTS.md: api/ directory is now gRPC, not GraphQL

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* typo fix

* chore: apply prettier formatting to modified markdown files

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: add deprecation warning to GraphQL-related highlight posts

The GraphQL API has been replaced by gRPC. Add a warning banner to the
three highlight posts that reference the GraphQL API so users landing
on them are aware of the migration.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: set deprecation version to 0.55.0 in GraphQL warning banners

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(api-client): rename GrpcClient to Client, remove deny attributes

- Rename GrpcClient → Client; the "Grpc" prefix is redundant given the crate name
- Remove #![deny(warnings)] and #![deny(missing_debug_implementations)]

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(api): resolve component type for sinks using metric tags

TapResource.outputs only covers sources and transforms (components with
outputs). Sinks always fell back to "unknown" in GetComponents.

Extract the component_type metric tag (which all components emit) as a
fallback so sinks report their actual plugin type (e.g. "console").

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(api): propagate component type names via TapResource for all component kinds

Sinks were showing as 'unknown' in `vector top` because TapResource.outputs
only covers sources and transforms (components with fanout outputs). Sinks
have no outputs so were never included.

Fix by adding a `type_names` map to TapResource populated directly from
RunningTopology for all component types (sources, transforms, and sinks).
The gRPC GetComponents handler now reads from this map rather than
falling back to metric tags.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* perf(top): share single gRPC connection across all metric streams

Previously subscribe() called connect() 11 times sequentially, creating
a separate TCP+HTTP/2 handshake per metric stream. HTTP/2 natively
multiplexes concurrent streams over one connection, and tonic's Channel
is Arc-backed and cheap to clone, so a single connect() is sufficient.

This restores the behaviour of the old GraphQL implementation which shared
one WebSocket connection across all subscriptions via Arc<SubscriptionClient>.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(tap): break outer tap worker loop on notification send failure

The break on notification send failure was inside a `for event in events`
loop nested within the outer `loop { select! { ... } }`, so it only exited
the inner iterator loop. The tap worker would keep running with a live
TapController after the client stream had gone away, accumulating orphaned
topology taps across reconnects.

Fix with a labeled break to exit the outer loop.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(tap): extract Reservoir struct to eliminate nested loop complexity

The tap worker loop had a for-loop inside a select! arm that required a
labeled break to exit the outer loop on send failure. Extract the sampling
and flushing logic into a Reservoir struct with handle_payload() and flush()
methods returning Result<(), ()>. The select! arms become single-line checks,
and the labeled break is gone.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(api): sum metric series per component instead of overwriting

filter_and_group_metrics used insert() which overwrites earlier values for
the same component_id. Metrics like component_sent_events_total emit one
series per output label, so multi-output components (e.g. route transform)
would report only whichever series was seen last. Switch to entry/or_insert
+= to sum all series, fixing incorrect totals in GetComponents and the
streaming RPCs that feed vector top.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* make build-licenses

* fix(top): seed poll_components from init_components snapshot

poll_components started with an empty known_components set, so any
component removed between init_components() and the first poll (up to 1s
later) would never trigger a ComponentRemoved event — the stale row
persisted in vector top until reconnect.

Fix by passing the initial component IDs from the init_components snapshot
through subscribe() into poll_components, so both the UI and the poller
start from the same truth.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* make build-licenses

* fix(api): cap stream_output_events limit to prevent unbounded allocation

A client could send limit=i32::MAX, causing Vec::with_capacity to
attempt a multi-GB allocation in Reservoir::new and crash the process.
Add a 100_000 server-side cap with a clear error response.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(api): enforce minimum 100ms interval on all metric streams

Clients could set interval_ms=1 and hammer capture_metrics() at 1kHz
across concurrent subscriptions. Consolidate the per-endpoint interval
validation into a single validate_interval_ms helper that rejects
anything below MIN_INTERVAL_MS (100ms).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(api): extract metric stream helpers to eliminate boilerplate

- Add BoxStream<T> alias to simplify tonic associated type declarations
- Add get_controller() and metric_totals_stream()/metric_throughput_stream()
  helpers to deduplicate stream setup across handlers
- Add validate_interval_ms() to centralize interval floor enforcement
- Add output_ports_by_component() on TapResource and ports_to_proto_outputs()
  helper to expose named output ports in get_components

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(tap): stop retrying non-recoverable gRPC errors

Permanent errors (INVALID_ARGUMENT, OUT_OF_RANGE, NOT_FOUND, PERMISSION_DENIED,
UNAUTHENTICATED, UNIMPLEMENTED, invalid URL) now cause an immediate exit instead
of looping forever in the reconnect cycle.

- Add Error::is_fatal() to vector-api-client, inspecting tonic::Code before
  the status is serialised to a string
- Add TapExecutorError::Fatal variant and route fatal client errors into it
  via the From<vector_api_client::Error> impl
- In tap cmd, break on is_fatal() before checking --no-reconnect

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(top): exclude poll_components from stream-failure reconnection gate

poll_components was added to the same handles vec as the metric stream tasks,
so join_all(handles) in cmd.rs would never complete when metric streams failed
early (e.g. server-side INVALID_ARGUMENT) while get_components kept succeeding.
This left vector top stuck in a connected state with frozen metrics and no
reconnect attempt.

Split subscribe() return into SubscribeHandles { metric_handles, poll_handle }.
cmd.rs now joins only metric_handles and aborts poll_handle afterwards, so any
metric stream failure immediately unblocks the reconnect loop.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(top): populate per-output sent events and terminate idle tap workers

Two fixes addressing open review threads:

1. Per-output sent events (metrics.rs): The streaming endpoints only emit
   component-level totals; per-output data is available from GetComponents.
   poll_components now emits SentEventsTotals with per-output data from the
   snapshot, restoring per-output rows in vector top for multi-output
   components (e.g. route transforms with _unmatched/success ports).

2. Idle tap worker leak (service.rs): The interval arm of the tap worker
   loop called flush() which returns Ok(()) for empty batches, so a client
   disconnect with no matching events left the worker and its TapController
   alive indefinitely. Now checks event_tx.is_closed() on each tick.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(top): populate per-output Events Out and unify timing constants

Three changes:

1. Fix per-output Events Out showing N/A for multi-output transforms (e.g.
   route): add filter_and_group_metrics_by_output() on the server to group
   component_sent_events_total by (component_id, output), and populate
   Output.sent_events_total in GetComponents responses. poll_components
   already reads these values and emits SentEventsTotals to state.

2. Remove MIN_POLL_INTERVAL_MS: poll_components now uses the user's
   --interval directly (already validated >= 100ms server-side), making
   all metrics -- including per-output data -- update at a single
   user-controlled frequency. Previously per-output data was capped at 1s
   even when --interval was shorter.

3. Unify RECONNECT_DELAY: the constant was duplicated in src/top/cmd.rs
   and src/tap/cmd.rs. Now defined once as RECONNECT_DELAY_MS in
   vector-api-client and imported by both.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(api,top): address code review issues in gRPC observability API

- Add per-output breakdown to streaming sent_events proto messages
  (output_totals/output_throughputs map fields on ComponentTotalsResponse
  and ComponentThroughputResponse); introduce dedicated server-side stream
  builders that populate these fields and wire them to the sent_events RPCs
- Remove redundant per-output poll_components emission now that the stream
  carries the data directly
- Validate --interval >= 100 at the CLI boundary in `vector top`, matching
  the server-side minimum and the pattern already used by `vector tap`
- Sort components alphabetically before applying limit in GetComponents for
  stable, deterministic results across repeated calls
- Fix tap_survives_config_reload test to hold the stream open across the
  reload rather than opening a fresh one; add use<> bound to
  stream_output_events to prevent lifetime overcapture in Rust 2024

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(api): restore shutdown health semantics in gRPC service

The GraphQL health handler returned HTTP 503 during shutdown by checking
the topology running AtomicBool. The gRPC migration dropped that flag,
making the health RPC always return healthy:true — including while Vector
was shutting down.

Pass Arc<AtomicBool> (topology.running) through GrpcServer::start and
into ObservabilityService. The health handler now returns Status::UNAVAILABLE
when the flag is false, matching the old GraphQL behaviour and honouring
the existing shutdown logic in RunningTopology::stop().

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(tap,api): reject logfmt for non-log events, validate tap interval, add multi-output test

- Return an error when --format logfmt is used with metric or trace events
  instead of silently falling back to JSON
- Add value_parser range(100..) to vector tap --interval, matching top's validation
- Add multi_output_transform_reports_per_output_sent_events integration test
  asserting GetComponents.outputs and StreamComponentSentEventsTotal.output_totals
  for a route transform with named outputs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* cargo fmt

* fix(api): restore api_started_total metric and startup log for gRPC server

The ApiStarted internal event was deleted along with GraphQL. Re-add it
to grpc.rs and emit it from setup_api once the gRPC server successfully
binds, restoring the api_started_total counter and "API server running"
log line.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(api): remove remaining GraphQL references

- Delete .graphqlconfig (referenced old GraphQL endpoint)
- Remove async-graphql dependabot group
- Remove async-graphql dep and api feature from vector-tap Cargo.toml
- Strip async-graphql imports and derive attributes from notification.rs
- Remove vector-tap/api feature activation from vector-lib
- Update stale comments in vector-core config and config/vector.yaml

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: cargo fmt and remove async-graphql from Cargo.lock and license inventory

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(api): remove stale GraphQL migration comments

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: add deprecation warnings to GraphQL docs and fix AGENTS.md API reference

- Add warning banner to blog post and highlight pages noting migration
  to gRPC in 0.55.0
- Update AGENTS.md api/ directory description from GraphQL to gRPC

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: address urseberry review feedback

- Fix changelog wording: "will now reject" -> "now rejects"
- Update warning banners: "we migrated" -> "Datadog migrated"

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: fix warning banner wording - remove Datadog reference

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: standardize warning banners to multi-line Hugo shortcode form

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: extract grpc migration warning into reusable Hugo shortcode

Create grpc-migration-warning.html shortcode and replace all four
inline warning blocks with a single {{< grpc-migration-warning >}} call.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(api): remove unused tokio-tungstenite and reqwest deps from vector-api-client

Leftovers from the GraphQL era (WebSocket subscriptions and HTTP requests).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: address thomasqueirozb review feedback

- Add compatibility note to changelog: 0.55+ clients require 0.55+ server
- Add grpc.io link to api.md
- Link proto file directly in api.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(api): gate ApiStarted and its imports behind the api feature flag

Fixes unused import/dead_code warnings when building without the api
feature (e.g. component-validation-tests).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(api): replace 9 streaming RPCs with unified StreamComponentMetrics

Consolidates StreamComponentReceivedEventsTotal,
StreamComponentSentEventsTotal, StreamComponentReceivedBytesTotal,
StreamComponentSentBytesTotal, StreamComponentErrorsTotal,
StreamComponentReceivedEventsThroughput,
StreamComponentSentEventsThroughput,
StreamComponentReceivedBytesThroughput, and
StreamComponentSentBytesThroughput into a single
StreamComponentMetrics(ComponentMetricStreamRequest) RPC.

The unified response type ComponentMetricResponse uses
oneof value { TotalMetric total; ThroughputMetric throughput; }
to carry per-output breakdowns alongside the aggregated value,
keeping the schema honest about which fields are populated.

StreamComponentAllocatedBytes remains a separate RPC since it is
semantically distinct and has no per-output breakdown.

Also moves ApiStarted internal event from grpc.rs (gated behind
sources-vector/opentelemetry) into a new api.rs module gated
behind the api feature flag.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(api): apply buf lint fixes to observability proto and cascade Rust updates

- Add METRIC_NAME_ prefix to MetricName enum values (ENUM_VALUE_PREFIX)
- Rename proto package to vector.observability.v1 (PACKAGE_VERSION_SUFFIX)
- Rename service Observability -> ObservabilityService (SERVICE_SUFFIX)
- Rename all request/response messages to match their RPC names per
  RPC_REQUEST_RESPONSE_UNIQUE convention (e.g. MetaRequest ->
  GetMetaRequest, HeartbeatRequest -> StreamHeartbeatRequest, etc.)
- Add COMPONENT_TYPE_UNSPECIFIED zero value to ComponentType enum
  (ENUM_ZERO_VALUE_SUFFIX)
- Cascade all renames through Rust: service.rs, client.rs, metrics.rs,
  vector-tap, and integration tests
- Update grpcurl examples in changelog

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(api): use Uri in Client::new, drop url dep, clean up tests, fix api.md title

- Client::new now takes http::Uri instead of String; Endpoint is built
  eagerly so connect() can no longer fail with InvalidUrl
- Remove unused `url` dep from vector-api-client, add `http`
- Remove test_invalid_url and test_connection_failure (assert nothing useful)
- Update all callers to parse their string URL into Uri
- Fix api.md title to "The Vector Observability API" and update stale
  grpcurl examples to use vector.observability.v1.ObservabilityService

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(tap): gate gRPC client code behind `api` feature

Move `TapRunner`, `EventFormatter`, `OutputChannel`, and `TapExecutorError`
into a new `runner` module gated by the `api` feature, and make the
associated heavy deps (`vector-api-client`, `prost`, `bytes`, `serde_*`, etc.)
optional. Also removes the unused `tokio-tungstenite` dep. Restores
`vector-lib/api = ["vector-tap/api"]` so the feature activation chain is
preserved.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(api): move fn-level allow attributes and apply rustfmt

Move `#[allow(clippy::print_stderr)]` to the `fn cmd` level in both
`src/top/cmd.rs` and `src/tap/cmd.rs` instead of per-statement blocks,
and inline `{url}` format captures where applicable. Also applies
rustfmt line-wrapping to service.rs and top.rs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(top): remove interval from EventType throughput variants

The gRPC server already normalizes throughput values to per-second by
dividing by `interval_secs` before streaming them. The `interval` field
in the four `*Throughputs` EventType variants was therefore unused
(`_interval`) and carried over from the old GraphQL client, which had to
do the `v * (1000.0 / interval_ms)` normalization itself.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* style: collapse pub use statement in vector-tap lib.rs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(api): address thomasqueirozb review feedback

- Use OS entropy (thread RNG) instead of epoch-based seed for reservoir
  sampler RNG in service.rs; removes SystemTime/UNIX_EPOCH boilerplate
- Return exitcode::USAGE (bad input) instead of exitcode::UNAVAILABLE
  when URL fails to parse in tap/top cmd
- Rename tap_internal parameter initial_client -> mut client_opt,
  eliminating the intermediate local binding
- Thread http::Uri through top::cmd -> subscription -> metrics::subscribe
  and metrics::init_components, removing the String -> Uri round-trip;
  re-export http::Uri from vector-api-client for callers

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: use http::Uri directly instead of re-exporting through vector-api-client

Add http as a direct dep to vector-top and import http::Uri directly in
metrics.rs and top/cmd.rs, rather than leaking it through a re-export
in vector-api-client.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: add link to proto file in changelog entry

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* cargo fmt

* fix(tests): add transforms-route to vector-api-tests feature set

The multi_output_transform_reports_per_output_sent_events test uses a
route transform, but the feature was not included in vector-api-tests,
causing Vector to exit with CONFIG error (78) when starting.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: pront

.github/actions/spelling/allow.txt

@@ -567,5 +567,6 @@ LDFLAGS
 libsasl
 pkgconfig
 CLAUDE
+grpcurl
 linting
 lexers

.github/dependabot.yml

@@ -45,9 +45,6 @@ updates:
         patterns:
         - "futures"
         - "futures-util"
-      graphql:
-        patterns:
-        - "async-graphql*"
       metrics:
         patterns:
         - "metrics"

.graphqlconfig

@@ -21,7 +21,7 @@ reduction and improved data quality for observability infrastructure.
   - `sinks/` - Data output destinations
   - `config/` - Configuration system and validation
   - `topology/` - Component graph management
-  - `api/` - GraphQL API for management and monitoring
+  - `api/` - gRPC API for management and monitoring
   - `cli.rs` - Command-line interface
 
 - `/lib/` - Modular library crates