@telemetry-dev/bedrock 0.1.9 → 0.1.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telemetry-dev/bedrock",
-  "version": "0.1.9",
+  "version": "0.1.12",
   "description": "AWS Bedrock instrumentation for telemetry.dev: Converse, InvokeModel, and Bedrock Agents spans for AWS SDK v3 clients.",
   "keywords": [
     "aws",
@@ -44,12 +44,12 @@
     "@aws-sdk/client-bedrock-agent-runtime": "3.1135.0",
     "@aws-sdk/client-bedrock-runtime": "3.1135.0",
     "@opentelemetry/api": "^1.9.1",
-    "@opentelemetry/sdk-logs": "^0.218.0",
-    "@opentelemetry/sdk-trace-base": "^2.7.1",
+    "@opentelemetry/sdk-logs": "^0.223.0",
+    "@opentelemetry/sdk-trace-base": "^2.12.0",
     "@smithy/eventstream-codec": "^4.2.5",
     "@smithy/protocol-http": "^5.3.10",
     "@smithy/types": "^4.12.0",
-    "@telemetry-dev/sdk": "^0.1.7",
+    "@telemetry-dev/sdk": "^0.1.10",
     "@types/node": "^25.5.0",
     "@typescript/native-preview": "7.0.0-dev.20260328.1",
     "typescript": "^6.0.2",
@@ -59,7 +59,7 @@
   "peerDependencies": {
     "@aws-sdk/client-bedrock-agent-runtime": ">=3.600.0 <4",
     "@aws-sdk/client-bedrock-runtime": ">=3.600.0 <4",
-    "@telemetry-dev/sdk": "^0.1.7"
+    "@telemetry-dev/sdk": "^0.1.10"
   },
   "peerDependenciesMeta": {
     "@aws-sdk/client-bedrock-agent-runtime": {

package/src/agent-handlers.ts

@@ -5,6 +5,7 @@ import {
   awsMetadataFields,
   basenameArn,
   bytesToString,
+  captureMaskedBeforeStart,
   isRecord,
   mergeFields,
   modeledStreamError,
@@ -12,6 +13,7 @@ import {
   omitUndefined,
   PROVIDER,
   stringValue,
+  StreamRetention,
   type BedrockInstrumentationOptions,
   type JsonRecord,
   type JsonValue,
@@ -48,17 +50,30 @@ export function inlineAgentRequestFields(input: JsonRecord): SpanFields {
 }
 
 export class AgentStreamState implements StreamState {
+  readonly retention = new StreamRetention();
   private text = "";
+  // Trace and output-file metadata share the budget but do not make the text incomplete.
+  private textRejected = false;
   private usage: NonNullable<SpanFields["usage"]> = {};
   private traceEventCount = 0;
+  private failed = false;
+  private failureCode: number | undefined;
   private failureReason: string | undefined;
   private guardrailAction: string | undefined;
   private returnControl: unknown;
+  private sawReturnControl = false;
+  private returnControlRejected = false;
   private readonly traces: unknown[] = [];
   private error: Error | undefined;
   private errorFields: SpanFields | undefined;
   private citationCount = 0;
   private readonly outputFiles: unknown[] = [];
+  // Metadata bypasses the capture flags and the mask, so trace and file content is filtered here,
+  // and a mask that cannot see it withholds it.
+  private readonly contentCapture: AgentTraceCapture = {
+    input: captureEnabled("input") && !captureMaskedBeforeStart(),
+    output: captureEnabled("output") && !captureMaskedBeforeStart(),
+  };
 
   constructor(private readonly options: BedrockInstrumentationOptions) {}
 
@@ -78,7 +93,13 @@ export class AgentStreamState implements StreamState {
     const chunk = isRecord(raw.chunk) ? raw.chunk : undefined;
     const bytes = chunk?.bytes;
 
-    if (bytes !== undefined) this.text += bytesToString(bytes) ?? "";
+    const piece = bytes === undefined ? undefined : bytesToString(bytes);
+
+    if (piece) {
+      if (this.retention.accept(piece)) this.text += piece;
+      else this.textRejected = true;
+    }
+
     const attribution = isRecord(chunk?.attribution) ? chunk.attribution : undefined;
     const citations = arrayValue<unknown>(attribution?.citations);
 
@@ -86,36 +107,86 @@ export class AgentStreamState implements StreamState {
 
     const files = isRecord(raw.files) ? arrayValue<JsonValue>(raw.files.files) : undefined;
 
-    if (files) this.outputFiles.push(...files.map(sanitizeOutputFile));
+    const sanitizedFiles = files?.map((file) =>
+      sanitizeOutputFile(file, this.contentCapture.output),
+    );
+
+    if (sanitizedFiles && this.retention.accept(sanitizedFiles)) {
+      this.outputFiles.push(...sanitizedFiles);
+    }
 
     const returnControl = isRecord(raw.returnControl) ? raw.returnControl : undefined;
 
-    if (returnControl) this.returnControl = returnControl;
+    if (returnControl) {
+      this.sawReturnControl = true;
+
+      // Return control replaces the text output, so it gets its own fresh bound and survives
+      // text that already spent the shared budget; one that alone does not fit is dropped and
+      // the capture is marked incomplete.
+      if (new StreamRetention().accept(returnControl)) {
+        this.returnControl = returnControl;
+      } else {
+        this.returnControl = undefined;
+        this.returnControlRejected = true;
+        this.retention.truncated = true;
+      }
+    }
 
     const traceEvent = isRecord(raw.trace) ? raw.trace : undefined;
 
     if (traceEvent) {
       this.traceEventCount += 1;
 
-      if (this.options.captureAgentTrace) this.traces.push(traceEvent);
-      collectTrace(traceEvent, (usage) => this.addUsage(usage));
-      const failure = findKey(traceEvent, "failureTrace");
+      if (this.options.captureAgentTrace) {
+        const retained = projectTrace(traceEvent, TRACE_PART, this.contentCapture);
+
+        if (this.retention.accept(retained)) this.traces.push(retained);
+      }
 
-      if (isRecord(failure))
-        this.failureReason = stringValue(failure.failureReason) ?? this.failureReason;
-      const guardrail = findKey(traceEvent, "guardrailTrace");
+      // Summaries are read only where the API puts them, so content and unknown branches can't
+      // feed them.
+      const trace = isRecord(traceEvent.trace) ? traceEvent.trace : {};
+
+      for (const step of MODEL_INVOCATION_STEPS) {
+        const member = isRecord(trace[step]) ? trace[step] : undefined;
+        const output = isRecord(member?.modelInvocationOutput) ? member.modelInvocationOutput : {};
+        this.addUsage(isRecord(output.metadata) ? output.metadata.usage : undefined);
+      }
+
+      const failure = trace.failureTrace;
+
+      if (isRecord(failure)) {
+        this.failed = true;
+        this.failureCode = numberValue(failure.failureCode) ?? this.failureCode;
+
+        // The reason is free-form text that can quote the prompt or a tool result.
+        if (this.contentCapture.input && this.contentCapture.output) {
+          this.failureReason = stringValue(failure.failureReason) ?? this.failureReason;
+        }
+      }
+
+      const guardrail = trace.guardrailTrace;
 
       if (isRecord(guardrail))
         this.guardrailAction = stringValue(guardrail.action) ?? this.guardrailAction;
     }
   }
 
+  outputTruncated(): boolean {
+    // Return control replaces the text output and is retained whole when it fits its bound.
+    if (this.returnControl !== undefined) return false;
+
+    return this.textRejected || this.returnControlRejected;
+  }
+
   finish(): SpanFields {
     const metadata = omitUndefined({
       trace_event_count: this.traceEventCount || undefined,
+      failure: this.failed ? true : undefined,
+      failure_code: this.failureCode,
       failure_reason: this.failureReason,
       guardrail_action: this.guardrailAction,
-      return_control: this.returnControl ? true : undefined,
+      return_control: this.sawReturnControl ? true : undefined,
       citation_count: this.citationCount || undefined,
       output_files: this.outputFiles.length > 0 ? this.outputFiles : undefined,
       agent_trace:
@@ -158,13 +229,13 @@ export class AgentStreamState implements StreamState {
   }
 }
 
-function sanitizeOutputFile<T>(value: T): JsonValue {
+function sanitizeOutputFile<T>(value: T, keepName: boolean): JsonValue {
   const raw: unknown = value;
 
   if (!isRecord(raw)) return undefined;
 
   return omitUndefined({
-    name: stringValue(raw.name),
+    name: keepName ? stringValue(raw.name) : undefined,
     type: stringValue(raw.type),
   });
 }
@@ -303,6 +374,7 @@ export function ragResponseFields<T>(output: T): SpanFields {
 }
 
 export class RagStreamState implements StreamState {
+  readonly retention = new StreamRetention();
   private text = "";
   private citationCount = 0;
   private guardrailAction: string | undefined;
@@ -323,7 +395,9 @@ export class RagStreamState implements StreamState {
     }
 
     const output = isRecord(raw.output) ? raw.output : undefined;
-    this.text += stringValue(output?.text) ?? "";
+    const text = stringValue(output?.text);
+
+    if (text && this.retention.accept(text)) this.text += text;
 
     if (raw.citation) this.citationCount += 1;
     const guardrail = isRecord(raw.guardrail) ? raw.guardrail : undefined;
@@ -356,6 +430,7 @@ export function flowRequestFields(input: JsonRecord): SpanFields {
 }
 
 export class FlowStreamState implements StreamState {
+  readonly retention = new StreamRetention();
   private outputs: unknown[] = [];
   private completionReason: string | undefined;
   private error: Error | undefined;
@@ -376,13 +451,16 @@ export class FlowStreamState implements StreamState {
 
     const output = isRecord(raw.flowOutputEvent) ? raw.flowOutputEvent : undefined;
 
-    if (output) this.outputs.push(output.content);
+    if (output && this.retention.accept(output.content)) this.outputs.push(output.content);
 
     const inputRequest = isRecord(raw.flowMultiTurnInputRequestEvent)
       ? raw.flowMultiTurnInputRequestEvent
       : undefined;
 
-    if (inputRequest) this.outputs.push(inputRequest.content);
+    if (inputRequest && this.retention.accept(inputRequest.content)) {
+      this.outputs.push(inputRequest.content);
+    }
+
     const completion = isRecord(raw.flowCompletionEvent) ? raw.flowCompletionEvent : undefined;
     this.completionReason = stringValue(completion?.completionReason) ?? this.completionReason;
   }
@@ -407,35 +485,135 @@ export function ragName(input: JsonRecord): string {
   return `retrieve_and_generate ${basenameArn(ragModel(input)) ?? "knowledge-base"}`;
 }
 
-function collectTrace<T>(value: T, onUsage: <TUsage>(usage: TUsage) => void): void {
-  const raw: unknown = value;
+type AgentTraceCapture = Record<"input" | "output", boolean>;
 
-  if (!isRecord(raw)) return;
-  const output = isRecord(raw.modelInvocationOutput) ? raw.modelInvocationOutput : undefined;
+/** Content kept as received when every listed capture is on; otherwise reduced to `withheld`. */
+class TraceContent {
+  constructor(
+    readonly needs: ReadonlyArray<keyof AgentTraceCapture>,
+    readonly withheld?: TraceShape,
+  ) {}
+}
 
-  if (output) {
-    const metadata = isRecord(output.metadata) ? output.metadata : undefined;
-    onUsage(metadata?.usage);
-  }
+const SCALAR = "scalar";
+
+// A record shape lists the only fields kept; a one-item array shape is a list of that shape.
+type TraceShape =
+  | typeof SCALAR
+  | TraceContent
+  | readonly [TraceShape]
+  | { readonly [field: string]: TraceShape };
+
+const TRACE_METADATA: TraceShape = {
+  usage: { inputTokens: SCALAR, outputTokens: SCALAR },
+  startTime: SCALAR,
+  endTime: SCALAR,
+  totalTimeMs: SCALAR,
+  operationTotalTimeMs: SCALAR,
+  clientRequestId: SCALAR,
+};
+
+// What the agent sends to a model, tool, or guardrail is input content; what comes back is output.
+const MODEL_INVOCATION_INPUT = new TraceContent(["input"], {
+  traceId: SCALAR,
+  type: SCALAR,
+  foundationModel: SCALAR,
+});
+
+const INVOCATION_INPUT = new TraceContent(["input"], { traceId: SCALAR, invocationType: SCALAR });
+
+const MODEL_INVOCATION_OUTPUT = new TraceContent(["output"], {
+  traceId: SCALAR,
+  metadata: TRACE_METADATA,
+});
+
+const OBSERVATION = new TraceContent(["output"], { traceId: SCALAR, type: SCALAR });
+
+const MODEL_INVOCATION_STEPS = [
+  "preProcessingTrace",
+  "orchestrationTrace",
+  "postProcessingTrace",
+  "routingClassifierTrace",
+];
+
+const PROCESSING_TRACE: TraceShape = {
+  modelInvocationInput: MODEL_INVOCATION_INPUT,
+  modelInvocationOutput: MODEL_INVOCATION_OUTPUT,
+};
+
+// Mirrors TracePart and the Trace union in the Bedrock Agent Runtime API; anything else, including
+// the AWS SDK's `$unknown` union member, is dropped because nothing says what it holds.
+const TRACE_PART: TraceShape = {
+  agentId: SCALAR,
+  agentAliasId: SCALAR,
+  agentVersion: SCALAR,
+  sessionId: SCALAR,
+  collaboratorName: SCALAR,
+  eventTime: SCALAR,
+  callerChain: [{ agentAliasArn: SCALAR }],
+  trace: {
+    preProcessingTrace: PROCESSING_TRACE,
+    postProcessingTrace: PROCESSING_TRACE,
+    orchestrationTrace: {
+      modelInvocationInput: MODEL_INVOCATION_INPUT,
+      invocationInput: INVOCATION_INPUT,
+      modelInvocationOutput: MODEL_INVOCATION_OUTPUT,
+      rationale: new TraceContent(["output"], { traceId: SCALAR }),
+      observation: OBSERVATION,
+    },
+    routingClassifierTrace: {
+      modelInvocationInput: MODEL_INVOCATION_INPUT,
+      invocationInput: INVOCATION_INPUT,
+      modelInvocationOutput: MODEL_INVOCATION_OUTPUT,
+      observation: OBSERVATION,
+    },
+    customOrchestrationTrace: { traceId: SCALAR, event: new TraceContent(["output"]) },
+    guardrailTrace: {
+      traceId: SCALAR,
+      action: SCALAR,
+      metadata: TRACE_METADATA,
+      inputAssessments: new TraceContent(["input"]),
+      outputAssessments: new TraceContent(["output"]),
+    },
+    failureTrace: {
+      traceId: SCALAR,
+      failureCode: SCALAR,
+      metadata: TRACE_METADATA,
+      // Free-form text that can quote either the prompt or a tool result.
+      failureReason: new TraceContent(["input", "output"]),
+    },
+  },
+};
 
-  for (const child of Object.values(raw)) {
-    if (isRecord(child)) collectTrace(child, onUsage);
-    else if (Array.isArray(child)) child.forEach((item) => collectTrace(item, onUsage));
-  }
-}
+function projectTrace(value: JsonValue, shape: TraceShape, capture: AgentTraceCapture): JsonValue {
+  if (shape instanceof TraceContent) {
+    if (shape.needs.every((kind) => capture[kind])) return value ?? undefined;
 
-function findKey<T>(value: T, key: string): JsonValue {
-  const raw: unknown = value;
+    return shape.withheld === undefined ? undefined : projectTrace(value, shape.withheld, capture);
+  }
 
-  if (!isRecord(raw)) return undefined;
+  if (shape === SCALAR) {
+    const scalar = ["string", "number", "boolean"].includes(typeof value) || value instanceof Date;
 
-  if (raw[key] !== undefined) return raw[key];
+    return scalar ? value : undefined;
+  }
 
-  for (const child of Object.values(raw)) {
-    const found = findKey(child, key);
+  if (Array.isArray(shape)) {
+    if (!Array.isArray(value)) return undefined;
 
-    if (found !== undefined) return found;
+    return value
+      .map((item) => projectTrace(item, shape[0], capture))
+      .filter((item) => item !== undefined);
   }
 
-  return undefined;
+  if (!isRecord(value)) return undefined;
+
+  return omitUndefined(
+    Object.fromEntries(
+      Object.entries(shape).map(([field, child]) => [
+        field,
+        projectTrace(value[field], child, capture),
+      ]),
+    ),
+  );
 }

package/src/converse.ts

@@ -11,6 +11,7 @@ import {
   parseJson,
   PROVIDER,
   stringValue,
+  StreamRetention,
   type JsonRecord,
   type JsonValue,
   type StreamState,
@@ -256,6 +257,7 @@ interface StreamBlock {
 }
 
 export class ConverseStreamState implements StreamState {
+  readonly retention = new StreamRetention();
   private role = "assistant";
   private readonly blocks = new Map<number, StreamBlock>();
   private stopReason: string | undefined;
@@ -282,7 +284,7 @@ export class ConverseStreamState implements StreamState {
 
     const blockStart = isRecord(event.contentBlockStart) ? event.contentBlockStart : undefined;
 
-    if (blockStart) {
+    if (blockStart && this.retention.accept(blockStart.start ?? {})) {
       const index = numberValue(blockStart.contentBlockIndex) ?? this.blocks.size;
       const start = isRecord(blockStart.start) ? blockStart.start : undefined;
       const toolUse = isRecord(start?.toolUse) ? start?.toolUse : undefined;
@@ -316,9 +318,10 @@ export class ConverseStreamState implements StreamState {
 
     const deltaEvent = isRecord(event.contentBlockDelta) ? event.contentBlockDelta : undefined;
 
-    if (deltaEvent) {
+    const delta = isRecord(deltaEvent?.delta) ? deltaEvent.delta : {};
+
+    if (deltaEvent && this.retention.accept(delta)) {
       const index = numberValue(deltaEvent.contentBlockIndex) ?? 0;
-      const delta = isRecord(deltaEvent.delta) ? deltaEvent.delta : {};
       const block = this.blocks.get(index) ?? { kind: "text", text: "" };
       const text = stringValue(delta.text);
 

package/src/internal-handlers.ts

@@ -32,6 +32,7 @@ import {
   stringValue,
   wrapAsyncIterable,
   endSpan,
+  endSpanWithBoundedOutput,
   type BedrockInstrumentationOptions,
 } from "./internal.ts";
 
@@ -154,7 +155,7 @@ export const AGENT_HANDLERS = {
     spanType: () => "span",
     requestFields: rerankRequestFields,
     onResult(result, span) {
-      endSpan(span, rerankResponseFields(result));
+      endSpanWithBoundedOutput(span, rerankResponseFields(result));
 
       return result;
     },

package/src/internal.ts

@@ -1,4 +1,12 @@
-import { startSpan, type SpanFields, type SpanHandle, type SpanType } from "@telemetry-dev/sdk";
+import {
+  boundedCaptureDetails,
+  startSpan,
+  type SpanFields,
+  type SpanHandle,
+  type SpanType,
+  type StartSpanOptions,
+} from "@telemetry-dev/sdk";
+import * as telemetrySdk from "@telemetry-dev/sdk";
 
 export const PROVIDER = "amazon-bedrock";
 
@@ -64,7 +72,7 @@ export function createInstrumentedSend(
     const spanType = safe(() => handler.spanType(input)) ?? "span";
     const spanName = safe(() => handler.spanName(input)) ?? name ?? "bedrock";
     const fields = safe(() => handler.requestFields(input, options)) ?? {};
-    const span = startSpan(spanName, { type: spanType, ...fields });
+    const span = startRequestSpan(spanName, { type: spanType, ...fields });
     const callbackIndex = rawRest.findIndex((arg) => arg instanceof Function);
 
     if (callbackIndex !== -1) {
@@ -162,6 +170,42 @@ function withCacheInclusiveInput(fields: SpanFields | undefined): SpanFields | u
   return { ...fields, usage: { ...usage, inputTokens, totalTokens } };
 }
 
+// A capture cut to the retention bound keeps its truncated flag, but a mask cannot be trusted to
+// redact a value it only sees part of. Cores without a capture policy are treated as masked.
+function capturesWithMask(span: SpanHandle): boolean {
+  return span.capturePolicy?.mask ?? true;
+}
+
+function isCut(fields: SpanFields | undefined): boolean {
+  return fields?.attributes?.["telemetry.dev.capture.truncated"] === true;
+}
+
+// Cores older than captureMasked expose no mask policy before a span starts; treat them as
+// masked, like LEGACY_CAPTURE_POLICY. A namespace read keeps them loadable without the export.
+export function captureMaskedBeforeStart(): boolean {
+  const read = (telemetrySdk as { captureMasked?: () => boolean }).captureMasked;
+
+  try {
+    return typeof read === "function" ? read() : true;
+  } catch {
+    return true;
+  }
+}
+
+// The decision is made before the span starts so samplers see the same attributes as before.
+function startRequestSpan(name: string, options: StartSpanOptions): SpanHandle {
+  const withheld = options.input !== undefined && isCut(options) && captureMaskedBeforeStart();
+
+  return startSpan(name, withheld ? { ...options, input: undefined } : options);
+}
+
+/** Ends a non-streamed span, withholding output cut to the retention bound from a mask. */
+export function endSpanWithBoundedOutput(span: SpanHandle, fields: SpanFields): void {
+  const withheld = fields.output !== undefined && isCut(fields) && capturesWithMask(span);
+
+  endSpan(span, withheld ? { ...fields, output: undefined } : fields);
+}
+
 export function endSpan(span: SpanHandle, fields?: SpanFields): void {
   try {
     span.end(withCacheInclusiveInput(fields));
@@ -306,9 +350,69 @@ export function parseJson<T>(value: T): JsonValue {
   }
 }
 
+// Retention uses fixed bounds; the core applies maxAttributeLength after the mask.
+const STREAM_CAPTURE_MAX_BYTES = 48 * 1024;
+export const STREAM_CAPTURE_MAX_ITEMS = 1_000;
+const CAPTURE_TRUNCATED_ATTRIBUTE = "telemetry.dev.capture.truncated";
+
+// Older cores enforce captureOutput and masking when the span ends but expose no policy, so
+// withhold incomplete output from their mask. Retention uses the fixed stream bounds either way;
+// maxAttributeLength is only here to satisfy the policy type.
+const LEGACY_CAPTURE_POLICY: NonNullable<SpanHandle["capturePolicy"]> = {
+  output: true,
+  mask: true,
+  maxAttributeLength: 65_536,
+};
+
+/** Tracks the fixed byte and item bound before a stream state retains a value. */
+export class StreamRetention {
+  private bytes = 0;
+  private items = 0;
+  truncated = false;
+
+  accept<T>(value: T): boolean {
+    if (this.truncated) return false;
+
+    const measured = boundedCaptureDetails(value, {
+      maxBytes: STREAM_CAPTURE_MAX_BYTES - this.bytes,
+      maxItems: STREAM_CAPTURE_MAX_ITEMS - this.items,
+    });
+
+    if (measured.truncated) {
+      this.truncated = true;
+
+      return false;
+    }
+
+    this.bytes += measured.bytes;
+    this.items += measured.items;
+
+    return true;
+  }
+}
+
 export interface StreamState {
   feed<T>(event: T): boolean | void;
   finish(partial: boolean): SpanFields;
+  readonly retention: StreamRetention;
+  /** Whether the exported output itself was cut; defaults to the retention flag. */
+  outputTruncated?(): boolean;
+}
+
+function finishStream(state: StreamState, span: SpanHandle, partial: boolean): SpanFields {
+  const fields = state.finish(partial);
+  const interrupted = partial || fields.error !== undefined;
+
+  if (!interrupted && !state.retention.truncated) return fields;
+
+  fields.attributes = { ...fields.attributes, [CAPTURE_TRUNCATED_ATTRIBUTE]: true };
+  const outputTruncated = state.outputTruncated?.() ?? state.retention.truncated;
+
+  if ((span.capturePolicy ?? LEGACY_CAPTURE_POLICY).mask && (interrupted || outputTruncated)) {
+    delete fields.output;
+  }
+
+  return fields;
 }
 
 export function wrapAsyncIterable<T>(
@@ -360,13 +464,13 @@ export function wrapAsyncIterable<T>(
       completed = true;
     } catch (error) {
       endOnce(
-        mergeFields(state.finish(true), awsMetadataFields(metadataOf(error)), {
+        mergeFields(finishStream(state, span, true), awsMetadataFields(metadataOf(error)), {
           error: asError(error),
         }),
       );
       throw error;
     } finally {
-      if (!ended) endOnce(state.finish(!completed));
+      if (!ended) endOnce(finishStream(state, span, !completed));
     }
   };
 
@@ -378,7 +482,7 @@ export function wrapAsyncIterable<T>(
     }
   }
 
-  const finishAbandoned = () => endOnce(safe(() => state.finish(true)));
+  const finishAbandoned = () => endOnce(safe(() => finishStream(state, span, true)));
   wrapped[Symbol.asyncIterator] = () => {
     const iterator = generator();
     STREAM_FINALIZER?.register(iterator, finishAbandoned, unregisterToken);