dd-trace 5.104.0 → 5.106.0

package/packages/datadog-instrumentations/src/router.js

@@ -8,7 +8,6 @@ const { getCompileToRegexp } = require('./path-to-regexp')
 const {
   getRouterMountPaths,
   joinPath,
-  getLayerMatchers,
   setLayerMatchers,
   isAppMounted,
   setRouterMountPath,
@@ -42,34 +41,47 @@ function createWrapRouterMethod (name, compile) {
   const nextChannel = channel(`apm:${name}:middleware:next`)
   const routeAddedChannel = channel(`apm:${name}:route:added`)
 
-  function wrapLayerHandle (layer, original) {
-    original._name = original._name || layer.name
+  function wrapLayerHandle (layer, original, matchers) {
+    // Resolve `name` once at wrap time: cached on the original for any code
+    // that reads `_name`, captured in the closure so the per-call body avoids
+    // the property-lookup / `||` fallback.
+    const name = original._name || layer.name || original.name
+    original._name = name
+
+    // Wrap-time matcher analysis. The single-pattern case yields a constant
+    // route; only multi-pattern stacks need a per-request layer.path match.
+    let captureRoute
+    let needMultiMatch = false
+    if (matchers.length !== 0 && !isFastStar(layer, matchers) && !isFastSlash(layer, matchers)) {
+      if (matchers.length === 1) {
+        captureRoute = matchers[0].path
+      } else {
+        needMultiMatch = true
+      }
+    }
 
-    return shimmer.wrapFunction(original, original => function (...args) {
-      if (!enterChannel.hasSubscribers) return original.apply(this, args)
+    // Split by arity: router only ever dispatches 3-arg request handlers
+    // through `Layer.handleRequest` and 4-arg error handlers through
+    // `Layer.handleError`. Specialising lets the per-call body use named
+    // parameters and `.call`, avoiding the rest-spread Array allocation that
+    // the unified shape forced on every middleware invocation.
+    return original.length === 4
+      ? shimmer.wrapFunction(original, errorHandlerLayerWrap(layer, name, captureRoute, needMultiMatch, matchers))
+      : shimmer.wrapFunction(original, requestHandlerLayerWrap(layer, name, captureRoute, needMultiMatch, matchers))
+  }
 
-      const matchers = getLayerMatchers(layer)
-      const lastIndex = args.length - 1
-      const name = original._name || original.name
-      const req = args[args.length > 3 ? 1 : 0]
-      const next = args[lastIndex]
+  function requestHandlerLayerWrap (layer, name, captureRoute, needMultiMatch, matchers) {
+    return original => function (req, res, next) {
+      if (!enterChannel.hasSubscribers) return original.call(this, req, res, next)
 
-      if (typeof next === 'function') {
-        args[lastIndex] = wrapNext(req, next)
-      }
+      const wrappedNext = typeof next === 'function' ? wrapNext(req, next) : next
 
-      let route
-
-      if (matchers?.length && !isFastStar(layer, matchers) && !isFastSlash(layer, matchers)) {
-        if (matchers.length === 1) {
-          // The host already matched this layer; the lone pattern is the route.
-          route = matchers[0].path
-        } else {
-          for (const matcher of matchers) {
-            if (matcher.regex?.test(layer.path)) {
-              route = matcher.path
-              break
-            }
+      let route = captureRoute
+      if (needMultiMatch) {
+        for (const matcher of matchers) {
+          if (matcher.regex?.test(layer.path)) {
+            route = matcher.path
+            break
           }
         }
       }
@@ -77,7 +89,7 @@ function createWrapRouterMethod (name, compile) {
       enterChannel.publish({ name, req, route, layer })
 
       try {
-        return original.apply(this, args)
+        return original.call(this, req, res, wrappedNext)
       } catch (error) {
         errorChannel.publish({ req, error })
         nextChannel.publish({ req })
@@ -87,15 +99,47 @@ function createWrapRouterMethod (name, compile) {
       } finally {
         exitChannel.publish({ req })
       }
-    })
+    }
+  }
+
+  function errorHandlerLayerWrap (layer, name, captureRoute, needMultiMatch, matchers) {
+    return original => function (error, req, res, next) {
+      if (!enterChannel.hasSubscribers) return original.call(this, error, req, res, next)
+
+      const wrappedNext = typeof next === 'function' ? wrapNext(req, next) : next
+
+      let route = captureRoute
+      if (needMultiMatch) {
+        for (const matcher of matchers) {
+          if (matcher.regex?.test(layer.path)) {
+            route = matcher.path
+            break
+          }
+        }
+      }
+
+      enterChannel.publish({ name, req, route, layer })
+
+      try {
+        return original.call(this, error, req, res, wrappedNext)
+      } catch (caught) {
+        errorChannel.publish({ req, error: caught })
+        nextChannel.publish({ req })
+        finishChannel.publish({ req })
+
+        throw caught
+      } finally {
+        exitChannel.publish({ req })
+      }
+    }
   }
 
   function wrapStack (layers, matchers) {
     for (const layer of layers) {
       if (layer.__handle) { // express-async-errors
-        layer.__handle = wrapLayerHandle(layer, layer.__handle)
+        layer.__handle = wrapLayerHandle(layer, layer.__handle, matchers)
       } else {
-        layer.handle = wrapLayerHandle(layer, layer.handle)
+        layer.handle = wrapLayerHandle(layer, layer.handle, matchers)
       }
 
       setLayerMatchers(layer, matchers)
@@ -258,15 +302,15 @@ addHook({ name: 'router', versions: ['>=2'] }, Router => {
 
       shimmer.wrap(router, 'handle', function wrapHandle (originalHandle) {
         return function wrappedHandle (req, res, next) {
-          const abortController = new AbortController()
-
           if (queryParserReadCh.hasSubscribers && req) {
+            const abortController = new AbortController()
+
             queryParserReadCh.publish({ req, res, query: req.query, abortController })
 
             if (abortController.signal.aborted) return
           }
 
-          return originalHandle.apply(this, arguments)
+          return originalHandle.call(this, req, res, next)
         }
       })
 

package/packages/datadog-instrumentations/src/stripe.js

@@ -97,7 +97,7 @@ function wrapStripe (Stripe) {
 
 addHook({
   name: 'stripe',
-  versions: ['9', '10', '11', '12', '13', '14', '15', '16', '17', '18', '19', '>=20.0.0 <22'],
+  versions: ['>=9 <22'],
 }, Stripe => shimmer.wrapFunction(Stripe, wrapLegacyStripe))
 
 addHook({

package/packages/datadog-plugin-avsc/src/schema_iterator.js

@@ -140,7 +140,7 @@ class SchemaExtractor {
       return
     }
 
-    if (span.context()._tags[SCHEMA_TYPE] && operation === 'serialization') {
+    if (span.context().getTag(SCHEMA_TYPE) && operation === 'serialization') {
       // we have already added a schema to this span, this call is an encode of nested schema types
       return
     }

package/packages/datadog-plugin-aws-sdk/src/services/bedrockruntime/tracing.js

@@ -3,7 +3,7 @@
 const BaseAwsSdkPlugin = require('../../base')
 const { parseModelId } = require('./utils')
 
-const enabledOperations = new Set(['invokeModel', 'invokeModelWithResponseStream'])
+const enabledOperations = new Set(['invokeModel', 'invokeModelWithResponseStream', 'converse', 'converseStream'])
 
 class BedrockRuntime extends BaseAwsSdkPlugin {
   static id = 'bedrockruntime'

package/packages/datadog-plugin-aws-sdk/src/services/bedrockruntime/utils.js

@@ -131,6 +131,7 @@ class Generation {
     outputTokens,
     cacheReadTokens,
     cacheWriteTokens,
+    messages,
   } = {}) {
     // stringify message as it could be a single generated message as well as a list of embeddings
     this.message = typeof message === 'string' ? message : JSON.stringify(message) || ''
@@ -143,6 +144,7 @@ class Generation {
       cacheReadTokens,
       cacheWriteTokens,
     }
+    this.messages = messages ?? [{ content: this.message, role: this.role }]
   }
 }
 
@@ -401,10 +403,7 @@ function extractTextAndResponseReason (response, provider, modelName) {
             message: output.message?.content[0]?.text ?? 'Unsupported content type',
             finishReason: body.stopReason,
             role: output.message?.role,
-            inputTokens: body.usage?.inputTokens,
-            outputTokens: body.usage?.outputTokens,
-            cacheReadInputTokenCount: body.usage?.cacheReadInputTokenCount,
-            cacheWriteInputTokenCount: body.usage?.cacheWriteInputTokenCount,
+            ...buildUsage(body.usage),
           })
         }
         break
@@ -476,6 +475,216 @@ function extractTextAndResponseReason (response, provider, modelName) {
   return new Generation()
 }
 
+/**
+ * Convert a Converse content-block array to an LLMObs message array.
+ *
+ * @param {string} role
+ * @param {Array<object>} contentBlocks
+ * @returns {{ content?: string, role: string, toolCalls?: Array, toolResults?: Array } | undefined}
+ */
+function extractMessagesFromConverseContent (role, contentBlocks) {
+  let content = ''
+  const toolCalls = []
+  const toolResults = []
+
+  for (const block of contentBlocks || []) {
+    if (block == null || typeof block !== 'object') continue
+    if (typeof block.text === 'string') {
+      content += block.text
+    } else if (block.toolUse) {
+      toolCalls.push(buildToolCall(block.toolUse))
+    } else if (block.toolResult) {
+      toolResults.push(buildToolResult(block.toolResult))
+    } else {
+      content += `[Unsupported content type: ${getContentBlockType(block)}]`
+    }
+  }
+
+  if (!content && toolCalls.length === 0 && toolResults.length === 0) return
+
+  const message = { role }
+  if (content) message.content = content
+  if (toolCalls.length > 0) message.toolCalls = toolCalls
+  if (toolResults.length > 0) message.toolResults = toolResults
+  return message
+}
+
+/**
+ * Resolve a Converse `ContentBlock`'s member type. The block is a key-presence
+ * tagged union (no `type` discriminator), so the active member is its sole own
+ * key. For forward-compat `$unknown` members the real type is the first element
+ * of the `[name, value]` tuple.
+ *
+ * @param {object} block
+ * @returns {string}
+ */
+function getContentBlockType (block) {
+  const key = Object.keys(block)[0]
+  if (key === '$unknown') return block.$unknown?.[0] ?? 'unknown'
+  return key ?? 'unknown'
+}
+
+// Always emit at least one output message so downstream tagging has a role to attach to.
+function toOutputMessages (role, contentBlocks) {
+  const message = extractMessagesFromConverseContent(role, contentBlocks)
+  return message ? [message] : [{ role, content: '' }]
+}
+
+function buildToolCall ({ name, input, toolUseId }) {
+  return { name: name ?? '', arguments: input ?? {}, toolId: toolUseId ?? '', type: 'toolUse' }
+}
+
+function parseToolInput (inputStr) {
+  try {
+    return JSON.parse(inputStr)
+  } catch {
+    log.warn('Failed to parse Converse stream toolUse.input JSON; emitting empty arguments')
+    return {}
+  }
+}
+
+function buildToolResult ({ toolUseId, content }) {
+  const result = (content || []).map(resolveToolResultItem).join('')
+  return { name: '', result, toolId: toolUseId ?? '', type: 'tool_result' }
+}
+
+function resolveToolResultItem (item) {
+  if (typeof item.text === 'string') return item.text
+  if (item.json != null) return JSON.stringify(item.json)
+  return `[Unsupported content type(s): ${getContentBlockType(item)}]`
+}
+
+function buildUsage (usage = {}) {
+  return {
+    inputTokens: usage.inputTokens,
+    outputTokens: usage.outputTokens,
+    cacheReadTokens: usage.cacheReadInputTokens ?? usage.cacheReadInputTokenCount,
+    cacheWriteTokens: usage.cacheWriteInputTokens ?? usage.cacheWriteInputTokenCount,
+  }
+}
+
+/**
+ * Extract tool definitions from a Converse request's `toolConfig.tools`,
+ * mapping Bedrock's `toolSpec` shape to LLMObs `ToolDefinition` shape.
+ *
+ * @param {object} params - Converse request params with optional `toolConfig.tools[].toolSpec`.
+ * @returns {Array<{ name: string, description: string, schema: object }>}
+ */
+function extractConverseToolDefinitions (params) {
+  const toolDefinitions = []
+  for (const tool of params.toolConfig?.tools || []) {
+    const toolSpec = tool?.toolSpec
+    if (!toolSpec?.name) continue
+    toolDefinitions.push({
+      name: toolSpec.name,
+      description: toolSpec.description ?? '',
+      schema: toolSpec.inputSchema ?? {},
+    })
+  }
+  return toolDefinitions
+}
+
+/**
+ * Extract request metadata + rendered input messages from a Converse /
+ * ConverseStream request.
+ *
+ * @param {{ modelId?: string, messages?: Array, system?: Array, inferenceConfig?: object, toolConfig?: object }} params
+ * @returns {RequestParams}
+ */
+function extractRequestParamsConverse (params) {
+  const prompt = []
+  for (const block of params.system || []) {
+    if (typeof block?.text === 'string') prompt.push({ content: block.text, role: 'system' })
+  }
+  for (const msg of params.messages || []) {
+    if (msg == null || typeof msg !== 'object') continue
+    const message = extractMessagesFromConverseContent(msg.role || 'user', msg.content)
+    if (message) prompt.push(message)
+  }
+
+  const { temperature, topP, maxTokens, stopSequences } = params.inferenceConfig || {}
+  return new RequestParams({ prompt, temperature, topP, maxTokens, stopSequences })
+}
+
+/**
+ * Extract output messages + usage from a non-stream Converse response.
+ *
+ * @param {{ output?: { message?: { role?: string, content?: Array } }, stopReason?: string, usage?: object }} response
+ * @returns {Generation}
+ */
+function extractTextAndResponseReasonConverse (response) {
+  const outputMessage = response?.output?.message
+  const role = outputMessage?.role || 'assistant'
+
+  return new Generation({
+    role,
+    finishReason: response?.stopReason || '',
+    ...buildUsage(response?.usage),
+    messages: toOutputMessages(role, outputMessage?.content),
+  })
+}
+
+/**
+ * Aggregate Converse stream events into a single output message + usage.
+ * One messageStart / messageStop pair per response, so one message out.
+ *
+ * Stream events describe the same content-block structure as the non-stream
+ * response, spread across start/delta chunks. We reassemble those chunks
+ * into a normalized content-block array and reuse the non-stream extractor.
+ *
+ * @param {Array<object>} chunks - Ordered ConverseStreamOutput events.
+ * @returns {Generation}
+ */
+function extractTextAndResponseReasonConverseFromStream (chunks) {
+  let role = 'assistant'
+  let stopReason = ''
+  let usage = {}
+  const blocksByIdx = new Map()
+
+  for (const chunk of chunks || []) {
+    if (chunk.messageStart?.role) {
+      role = chunk.messageStart.role
+    } else if (chunk.messageStop?.stopReason) {
+      stopReason = chunk.messageStop.stopReason
+    } else if (chunk.metadata?.usage) {
+      usage = chunk.metadata.usage
+    } else if (chunk.contentBlockStart?.start?.toolUse) {
+      const { contentBlockIndex, start: { toolUse } } = chunk.contentBlockStart
+      blocksByIdx.set(contentBlockIndex, {
+        toolUse: { toolUseId: toolUse.toolUseId, name: toolUse.name, inputStr: '' },
+      })
+    } else if (chunk.contentBlockDelta) {
+      const { contentBlockIndex, delta } = chunk.contentBlockDelta
+      if (typeof delta?.text === 'string') {
+        const block = blocksByIdx.get(contentBlockIndex) ?? {}
+        block.text = (block.text ?? '') + delta.text
+        blocksByIdx.set(contentBlockIndex, block)
+      } else if (typeof delta?.toolUse?.input === 'string') {
+        const block = blocksByIdx.get(contentBlockIndex) ?? { toolUse: { inputStr: '' } }
+        block.toolUse ??= { inputStr: '' }
+        block.toolUse.inputStr += delta.toolUse.input
+        blocksByIdx.set(contentBlockIndex, block)
+      }
+    }
+  }
+
+  const contentBlocks = [...blocksByIdx.keys()].sort((a, b) => a - b).map(i => {
+    const block = blocksByIdx.get(i)
+    if (block.toolUse) {
+      const { toolUseId, name, inputStr } = block.toolUse
+      block.toolUse = { toolUseId, name, input: parseToolInput(inputStr) }
+    }
+    return block
+  })
+
+  return new Generation({
+    role,
+    finishReason: stopReason,
+    ...buildUsage(usage),
+    messages: toOutputMessages(role, contentBlocks),
+  })
+}
+
 module.exports = {
   Generation,
   RequestParams,
@@ -483,5 +692,10 @@ module.exports = {
   parseModelId,
   extractRequestParams,
   extractTextAndResponseReason,
+  extractMessagesFromConverseContent,
+  extractConverseToolDefinitions,
+  extractRequestParamsConverse,
+  extractTextAndResponseReasonConverse,
+  extractTextAndResponseReasonConverseFromStream,
   PROVIDER,
 }

package/packages/datadog-plugin-azure-cosmos/src/index.js

@@ -0,0 +1,144 @@
+'use strict'
+
+const { storage } = require('../../datadog-core')
+
+const DatabasePlugin = require('../../dd-trace/src/plugins/database')
+
+class AzureCosmosPlugin extends DatabasePlugin {
+  static id = 'azure-cosmos'
+  // Channel prefix determines how the plugin subscribes to instrumentation events.
+  // Three patterns exist — set `static prefix` explicitly based on instrumentation type:
+  //
+  // Orchestrion:              static prefix = 'tracing:orchestrion:<npm-package>:<channelName>'
+  // Shimmer + tracingChannel: static prefix = 'tracing:apm:<name>:<operation>'
+  // Shimmer + manual channels: omit prefix — defaults to `apm:${id}:${operation}`
+  static prefix = 'tracing:orchestrion:@azure/cosmos:executePlugins'
+  static peerServicePrecursors = ['db.name']
+
+  operationName () {
+    return 'cosmosdb.query'
+  }
+
+  asyncEnd (ctx) {
+    if (!ctx.span) return
+    const span = ctx.currentStore?.span
+    if (span) {
+      const result = ctx.result
+      if (result?.code) span.setTag('db.response.status_code', (result.code).toString())
+      if (result?.substatus) span.setTag('cosmosdb.response.sub_status_code', result.substatus)
+      span.finish()
+    }
+  }
+
+  error (ctx) {
+    if (!ctx.span) return
+    const span = ctx.currentStore?.span
+    if (span) {
+      const error = ctx.error
+      this.addError(error, span)
+      if (error?.code) span.setTag('db.response.status_code', (error.code).toString())
+      if (error?.substatus) span.setTag('cosmosdb.response.sub_status_code', error.substatus)
+    }
+  }
+
+  bindStart (ctx) {
+    const requestContext = ctx.arguments[1]
+    const resource = this.getResource(requestContext)
+    const { dbName, containerName } = this.getDbInfo(requestContext)
+    const connectionMode = this.getConnectionMode(requestContext)
+    const { outHost, userAgent } = this.getHttpInfo(requestContext)
+    const pluginOn = ctx.arguments[3]
+
+    if (pluginOn != null && requestContext.operationType != null && requestContext.resourceType != null) {
+      const operationType = requestContext.operationType
+      const resourceType = requestContext.resourceType
+      // only trace operations not requests (pluginOn)
+      // trace requests only if they are read or query operations not on docs
+      // prevents doubled read spans for createIfNotExists calls
+      if (pluginOn === 'request' && ((operationType !== 'read' && operationType !== 'query') ||
+        (operationType === 'read' && resourceType !== 'docs'))) {
+        return storage('legacy').getStore()
+      }
+
+      // separately, skip tracing read requests without a path, these don't
+      // represent CRUD operations on a resource we care about
+      // not returning current store because we don't want the child http.request spans
+      // to be created
+      if (operationType === 'read' && requestContext.path === '') {
+        return { noop: true }
+      }
+    }
+
+    const span = this.startSpan(this.operationName(), {
+      resource,
+      type: 'cosmosdb',
+      kind: 'client',
+      meta: {
+        component: 'azure_cosmos',
+        'db.system': 'cosmosdb',
+        'db.name': dbName,
+        'cosmosdb.container': containerName,
+        'cosmosdb.connection.mode': connectionMode,
+        'http.useragent': userAgent,
+        'out.host': outHost,
+      },
+    }, ctx)
+
+    ctx.span = span
+    return ctx.currentStore
+  }
+
+  getResource (requestContext) {
+    const path = requestContext.path
+    const parts = path.split('/')
+    let modified = false
+    for (let i = 2; i < parts.length; i += 2) {
+      if (parts[i].length > 0 && parts[i - 1] !== 'dbs' && parts[i - 1] !== 'colls') {
+        parts[i] = '?'
+        modified = true
+      }
+    }
+
+    return `${requestContext.operationType} ${modified ? parts.join('/') : path}`
+  }
+
+  getDbInfo (requestContext) {
+    let dbName = null
+    let containerName = null
+
+    if (requestContext.operationType === 'create' && requestContext.resourceType === 'dbs' &&
+      requestContext.body != null && requestContext.body.id != null) {
+      dbName = requestContext.body.id
+    }
+
+    let resourceLink = requestContext.path
+    if (resourceLink?.length > 1 && resourceLink.startsWith('/')) {
+      resourceLink = resourceLink.slice(1)
+      const parts = resourceLink.split('/')
+      if (parts.length > 0 && parts[0].toLowerCase() === 'dbs' && parts.length >= 2) {
+        dbName = parts[1]
+        if (parts.length >= 4 && parts[2].toLowerCase() === 'colls' && parts[3] !== '') {
+          containerName = parts[3]
+        }
+      }
+    }
+
+    return { dbName, containerName }
+  }
+
+  getConnectionMode (requestContext) {
+    const mode = requestContext.client?.connectionPolicy?.connectionMode
+    if (mode === 0) {
+      return 'gateway'
+    }
+    return 'direct'
+  }
+
+  getHttpInfo (requestContext) {
+    const outHost = requestContext.client?.cosmosClientOptions?.endpoint
+    const userAgent = requestContext.headers?.['User-Agent']
+    return { outHost, userAgent }
+  }
+}
+
+module.exports = AzureCosmosPlugin

package/packages/datadog-plugin-azure-event-hubs/src/producer.js

@@ -62,7 +62,7 @@ class AzureEventHubsProducerPlugin extends ProducerPlugin {
         const contexts = spanContexts.get(eventData)
         if (contexts) {
           for (const spanContext of contexts) {
-            span.addLink(spanContext)
+            span.addLink({ context: spanContext })
           }
         }
       }

package/packages/datadog-plugin-azure-functions/src/index.js

@@ -13,6 +13,7 @@ const triggerMap = {
   serviceBusQueue: 'ServiceBus',
   serviceBusTopic: 'ServiceBus',
   eventHub: 'EventHubs',
+  cosmosDB: 'CosmosDB',
 }
 
 class AzureFunctionsPlugin extends TracingPlugin {
@@ -53,7 +54,7 @@ class AzureFunctionsPlugin extends TracingPlugin {
       )
 
       span._integrationName = 'azure-functions'
-      span.context()._tags.component = 'azure-functions'
+      span.context().setTag('component', 'azure-functions')
       span.addTags(meta)
       webContext.span = span
       webContext.azureFunctionCtx = ctx
@@ -127,6 +128,8 @@ function getMetaForTrigger ({ functionName, methodName, invocationContext }) {
       'resource.name': `EventHubs ${functionName}`,
       'span.kind': 'consumer',
     }
+  } else if (triggerMap[methodName] === 'CosmosDB') {
+    meta['resource.name'] = `CosmosDB ${functionName}`
   }
 
   return meta
@@ -155,7 +158,7 @@ function setSpanLinks (triggerType, tracer, span, ctx) {
     if (!props || Object.keys(props).length === 0) return
     const spanContext = tracer.extract('text_map', props)
     if (spanContext) {
-      span.addLink(spanContext)
+      span.addLink({ context: spanContext })
     }
   }
 

package/packages/datadog-plugin-azure-service-bus/src/producer.js

@@ -56,7 +56,7 @@ class AzureServiceBusProducerPlugin extends ProducerPlugin {
           const contexts = spanContexts.get(messages)
           if (contexts) {
             for (const spanContext of contexts) {
-              span.addLink(spanContext)
+              span.addLink({ context: spanContext })
             }
           }
         }

package/packages/datadog-plugin-bunyan/src/index.js

@@ -1,8 +1,36 @@
 'use strict'
 
+const { buildLogHolder } = require('../../dd-trace/src/plugins/log_injection')
 const LogPlugin = require('../../dd-trace/src/plugins/log_plugin')
 
 class BunyanPlugin extends LogPlugin {
   static id = 'bunyan'
+
+  constructor (...args) {
+    super(...args)
+    this.addSub('apm:bunyan:log', (arg) => this.handleLog(arg))
+  }
+
+  /**
+   * Inject `dd` directly on the record bunyan hands us. bunyan builds the
+   * record inside `mkRecord` via `objCopy(log.fields)` and then copies the
+   * caller's fields onto the result, so the `rec` object that flows
+   * through `_emit` is always bunyan-owned, has `Object.prototype` for its
+   * prototype, and is never the caller's input directly. Mutating it adds
+   * `dd` for every consumer (JSON streams via `JSON.stringify(rec)`, raw
+   * streams via the record reference) without paying for a Proxy view.
+   *
+   * @param {{ message: object }} arg
+   */
+  handleLog (arg) {
+    const rec = arg.message
+    if (rec === null || typeof rec !== 'object' || Object.hasOwn(rec, 'dd')) return
+
+    const logHolder = buildLogHolder(this.tracer)
+    if (!logHolder) return
+
+    rec.dd = logHolder.dd
+  }
 }
+
 module.exports = BunyanPlugin