dd-trace 5.109.0 → 5.110.0

package/packages/dd-trace/src/opentelemetry/trace/otlp_transformer.js

@@ -74,6 +74,9 @@ const EXCLUDED_META_KEYS = new Set([
   TRACE_ID_128,
 ])
 
+// DD-only error tags that should not appear as attributes when OTel trace semantics are enabled.
+const DD_ERROR_META_KEYS = new Set(['error.message'])
+
 /**
  * OtlpTraceTransformer transforms DD-formatted spans to OTLP trace JSON format.
  *
@@ -87,13 +90,17 @@ const EXCLUDED_META_KEYS = new Set([
  * @augments OtlpTransformerBase
  */
 class OtlpTraceTransformer extends OtlpTransformerBase {
+  #otelTraceSemanticsEnabled
+
   /**
    * Creates a new OtlpTraceTransformer instance.
    *
    * @param {import('@opentelemetry/api').Attributes} resourceAttributes - Resource attributes
+   * @param {boolean} [otelTraceSemanticsEnabled] - When true, do not emit Datadog-only attributes as span attributes
    */
-  constructor (resourceAttributes) {
+  constructor (resourceAttributes, otelTraceSemanticsEnabled) {
     super(resourceAttributes, 'http/json', 'traces')
+    this.#otelTraceSemanticsEnabled = otelTraceSemanticsEnabled
   }
 
   /**
@@ -184,24 +191,30 @@ class OtlpTraceTransformer extends OtlpTransformerBase {
   #buildAttributes (span) {
     const attributes = []
 
-    // Add top-level DD span fields as OTLP attributes
-    if (span.service) {
-      attributes.push({ key: 'service.name', value: { stringValue: span.service } })
-    }
-    if (span.name) {
-      attributes.push({ key: 'operation.name', value: { stringValue: span.name } })
-    }
-    if (span.resource) {
-      attributes.push({ key: 'resource.name', value: { stringValue: span.resource } })
-    }
-    if (span.type) {
-      attributes.push({ key: 'span.type', value: { stringValue: span.type } })
+    // Add top-level DD span fields as OTLP attributes.
+    // When OTel trace semantics are enabled, these Datadog-only concepts
+    // are not added to the span attributes so the output conforms to pure
+    // OpenTelemetry semantics.
+    if (!this.#otelTraceSemanticsEnabled) {
+      if (span.service) {
+        attributes.push({ key: 'service.name', value: { stringValue: span.service } })
+      }
+      if (span.name) {
+        attributes.push({ key: 'operation.name', value: { stringValue: span.name } })
+      }
+      if (span.resource) {
+        attributes.push({ key: 'resource.name', value: { stringValue: span.resource } })
+      }
+      if (span.type) {
+        attributes.push({ key: 'span.type', value: { stringValue: span.type } })
+      }
     }
 
     // Add meta string tags, skipping keys that map to dedicated OTLP fields
     if (span.meta) {
       for (const [key, value] of Object.entries(span.meta)) {
         if (EXCLUDED_META_KEYS.has(key)) continue
+        if (this.#otelTraceSemanticsEnabled && DD_ERROR_META_KEYS.has(key)) continue
         attributes.push({ key, value: { stringValue: value } })
       }
     }

package/packages/dd-trace/src/opentracing/propagation/text_map.js

@@ -371,8 +371,8 @@ class TextMapPropagator {
 
   _hasTraceIdConflict (w3cSpanContext, firstSpanContext) {
     return w3cSpanContext !== undefined &&
-           firstSpanContext.toTraceId(true) === w3cSpanContext.toTraceId(true) &&
-           firstSpanContext.toSpanId() !== w3cSpanContext.toSpanId()
+          firstSpanContext.toTraceId(true) === w3cSpanContext.toTraceId(true) &&
+          firstSpanContext.toSpanId() !== w3cSpanContext.toSpanId()
   }
 
   _hasParentIdInTags (spanContext) {
@@ -875,7 +875,7 @@ class TextMapPropagator {
           (!tracestateSamplingPriority || tracestateSamplingPriority >= 0)) {
         samplingPriority = AUTO_REJECT
       } else if (traceparentSampled === 1 &&
-                 (!tracestateSamplingPriority || tracestateSamplingPriority < 0)) {
+                (!tracestateSamplingPriority || tracestateSamplingPriority < 0)) {
         samplingPriority = AUTO_KEEP
       }
     }

package/packages/dd-trace/src/opentracing/span_context.js

@@ -63,6 +63,7 @@ class DatadogSpanContext {
   }
 
   toTraceparent () {
+    this._ensureSamplingPriority()
     const flags = this._sampling.priority >= AUTO_KEEP ? '01' : '00'
     const traceId = this.toTraceId(true)
     const spanId = this.toSpanId(true)
@@ -70,6 +71,22 @@ class DatadogSpanContext {
     return `${version}-${traceId}-${spanId}-${flags}`
   }
 
+  /**
+   * Materialize the lazy priority-sampling decision for this trace, the same
+   * way {@link DatadogTracer#inject} does before propagation. The auto priority
+   * is otherwise computed at flush time, so the W3C sampled flag reads "drop"
+   * for a freshly started, not-yet-flushed span — see
+   * https://github.com/DataDog/dd-trace-js/issues/2547.
+   *
+   * The root span is only used to reach the priority sampler; `this` is passed
+   * to `sample()` so a manual sampling tag set directly on this context is
+   * honored, matching what `inject(this)` would decide.
+   */
+  _ensureSamplingPriority () {
+    if (this._sampling.priority !== undefined) return
+    this._trace.started[0]?._prioritySampler?.sample(this)
+  }
+
   /**
    * Set a tag value.
    * @param {string} key - Tag key

package/packages/dd-trace/src/plugin_manager.js

@@ -60,7 +60,11 @@ function maybeEnable (Plugin) {
 
 function getEnabled (Plugin) {
   const envName = `DD_TRACE_${Plugin.id.toUpperCase()}_ENABLED`
-  return getValueFromEnvSources(normalizePluginEnvName(envName))
+  // skipDefault: only an explicitly configured value should drive enablement here. A registered
+  // default of `false` (e.g. an experimental plugin like `nats`) must not be read as an explicit
+  // "disabled via configuration option" — that path both logs a misleading line and nulls the
+  // plugin class, bypassing the experimental opt-in handled by `loadPlugin`.
+  return getValueFromEnvSources(normalizePluginEnvName(envName), true)
 }
 
 // TODO this must always be a singleton.
@@ -164,6 +168,7 @@ module.exports = class PluginManager {
       clientIpEnabled,
       clientIpHeader,
       DD_TRACE_MEMCACHED_COMMAND_ENABLED,
+      DD_TRACE_OTEL_SEMANTICS_ENABLED,
       DD_TEST_SESSION_NAME,
       DD_AGENTLESS_LOG_SUBMISSION_ENABLED,
       isTestDynamicInstrumentationEnabled,
@@ -181,6 +186,7 @@ module.exports = class PluginManager {
       dbmPropagationMode,
       dsmEnabled,
       DD_TRACE_MEMCACHED_COMMAND_ENABLED,
+      DD_TRACE_OTEL_SEMANTICS_ENABLED,
       site,
       url,
       headers: headerTags || [],

package/packages/dd-trace/src/plugins/ci_plugin.js

@@ -31,6 +31,7 @@ const Plugin = require('./plugin')
 const { getRepositoryRoot } = require('./util/git')
 const {
   getTestEnvironmentMetadata,
+  getTestLevelsMetadataTags,
   getTestSessionName,
   getCodeOwnersFileEntries,
   getTestParentSpan,
@@ -44,6 +45,7 @@ const {
   TEST_MODULE_ID,
   TEST_SESSION_ID,
   TEST_COMMAND,
+  TEST_LEVELS_METADATA,
   TEST_MODULE,
   TEST_SESSION_NAME,
   getTestSuiteCommonTags,
@@ -219,7 +221,13 @@ module.exports = class CiPlugin extends Plugin {
         this.testEnvironmentMetadata
       )
 
-      const metadataTags = { '*': { [TEST_COMMAND]: command, [TEST_SESSION_NAME]: testSessionName } }
+      const metadataTags = {
+        [TEST_LEVELS_METADATA]: {
+          [TEST_COMMAND]: command,
+          [TEST_SESSION_NAME]: testSessionName,
+          ...getTestLevelsMetadataTags(this.testEnvironmentMetadata),
+        },
+      }
       // tracer might not be initialized correctly
       if (this.tracer._exporter.addMetadataTags) {
         this.tracer._exporter.addMetadataTags(metadataTags)

package/packages/dd-trace/src/plugins/util/http-otel-semantics.js

@@ -0,0 +1,276 @@
+'use strict'
+
+const { extractPathFromUrl } = require('./url')
+
+// OpenTelemetry HTTP semantic-convention attribute names, emitted in place of
+// the Datadog ones when `DD_TRACE_OTEL_SEMANTICS_ENABLED` is set.
+// See https://opentelemetry.io/docs/specs/semconv/http/http-spans/
+const HTTP_REQUEST_METHOD = 'http.request.method'
+const HTTP_RESPONSE_STATUS_CODE = 'http.response.status_code'
+const URL_FULL = 'url.full'
+const URL_PATH = 'url.path'
+const URL_SCHEME = 'url.scheme'
+const URL_QUERY = 'url.query'
+const SERVER_ADDRESS = 'server.address'
+const SERVER_PORT = 'server.port'
+const USER_AGENT_ORIGINAL = 'user_agent.original'
+const CLIENT_ADDRESS = 'client.address'
+const NETWORK_PEER_ADDRESS = 'network.peer.address'
+const HTTP_REQUEST_METHOD_ORIGINAL = 'http.request.method_original'
+
+// Known HTTP methods (RFC 9110 + PATCH RFC 5789 + QUERY httpbis draft). A verb
+// outside this set is reported as `_OTHER` with the raw value preserved on
+// `http.request.method_original`, per the OTel HTTP semantic conventions.
+const KNOWN_METHODS = new Set([
+  'CONNECT', 'DELETE', 'GET', 'HEAD', 'OPTIONS', 'PATCH', 'POST', 'PUT', 'QUERY', 'TRACE',
+])
+
+// Datadog HTTP meta keys replaced by OTel names — omitted when rebuilding meta.
+const DD_HTTP_META_KEYS = new Set([
+  'http.method', 'http.status_code', 'http.useragent', 'http.client_ip', 'http.endpoint', 'http.url', 'out.host',
+])
+const NETWORK_DESTINATION_PORT = 'network.destination.port'
+
+// IPv6 literals arrive bracketed (URL.hostname / out.host = `[::1]`); OTel
+// `server.address` is the bare address.
+function stripIpv6Brackets (host) {
+  return host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host
+}
+
+/**
+ * @typedef {object} ServerUrlParts
+ * @property {string} [scheme] value for `url.scheme`
+ * @property {string} [address] value for `server.address`
+ * @property {number} [port] value for `server.port`
+ * @property {string} path value for `url.path`
+ * @property {string} [query] value for `url.query` (omitted when empty)
+ */
+
+/**
+ * Decompose a server request URL into the OpenTelemetry `url.*` / `server.*`
+ * parts. Structural fields (scheme, address, port, path) are read from the raw
+ * URL; the query is taken from the already-obfuscated URL so the configured
+ * query-string obfuscation is preserved.
+ *
+ * @param {string} rawUrl full request URL (`scheme://host[:port]/path?query`)
+ * @param {string} obfuscatedUrl same URL with its query string obfuscated
+ * @returns {ServerUrlParts}
+ */
+function decomposeServerUrl (rawUrl, obfuscatedUrl) {
+  let scheme
+  let address
+  let port
+  let path
+
+  try {
+    const parsed = new URL(rawUrl)
+    scheme = parsed.protocol.length > 1 ? parsed.protocol.slice(0, -1) : undefined
+    // `extractURL` builds `http://undefined/...` when the Host header is absent; skip that.
+    const hostname = parsed.hostname
+    if (hostname && hostname !== 'undefined') {
+      address = stripIpv6Brackets(hostname)
+    }
+    if (parsed.port) {
+      const parsedPort = Number.parseInt(parsed.port)
+      if (parsedPort > 0) port = parsedPort
+    }
+    path = parsed.pathname || '/'
+  } catch {
+    // Malformed or relative URL: fall back to a best-effort path only.
+    path = extractPathFromUrl(rawUrl)
+  }
+
+  let query
+  const queryIndex = obfuscatedUrl.indexOf('?')
+  if (queryIndex !== -1) {
+    const rawQuery = obfuscatedUrl.slice(queryIndex + 1)
+    if (rawQuery) query = rawQuery
+  }
+
+  return { scheme, address, port, path, query }
+}
+
+const ERROR_TYPE = 'error.type'
+
+function toHttpScheme (scheme) {
+  if (scheme === 'ws') return 'http'
+  if (scheme === 'wss') return 'https'
+  return scheme
+}
+
+/**
+ * Redact any userinfo embedded in a URL's authority, since `url.full` must not
+ * leak credentials: `user:pass@host` -> `REDACTED:REDACTED@host`, `user@host` ->
+ * `REDACTED@host`. Returns the URL unchanged when no userinfo is present.
+ *
+ * @param {string} url
+ * @returns {string}
+ */
+function redactUrlCredentials (url) {
+  const schemeEnd = url.indexOf('://')
+  if (schemeEnd === -1) return url
+  const authorityStart = schemeEnd + 3
+
+  let authorityEnd = url.length
+  for (let i = authorityStart; i < url.length; i++) {
+    const char = url[i]
+    if (char === '/' || char === '?' || char === '#') {
+      authorityEnd = i
+      break
+    }
+  }
+
+  // userinfo runs to the LAST '@' in the authority (WHATWG); using the first
+  // '@' would leak the remainder, e.g. `user:p@ss@host`.
+  const at = url.lastIndexOf('@', authorityEnd - 1)
+  if (at < authorityStart) return url
+
+  const redacted = url.slice(authorityStart, at).includes(':') ? 'REDACTED:REDACTED' : 'REDACTED'
+  return url.slice(0, authorityStart) + redacted + url.slice(at)
+}
+
+/**
+ * The scheme's default port, used as the `server.port` fallback for client spans
+ * (the attribute is required for clients but the explicit port is absent for
+ * default-port requests).
+ *
+ * @param {string} [url]
+ * @returns {number | undefined}
+ */
+function defaultPortForUrl (url) {
+  if (url === undefined) return
+  if (url.startsWith('https:') || url.startsWith('wss:')) return 443
+  if (url.startsWith('http:') || url.startsWith('ws:')) return 80
+}
+
+/**
+ * @typedef {object} FormattedHttpSpan
+ * @property {Record<string, string>} meta
+ * @property {Record<string, number>} metrics
+ * @property {number} error
+ */
+
+/**
+ * Rewrite a formatted span's Datadog HTTP tags to OpenTelemetry HTTP
+ * semantic-convention names, in place. Called at serialization time (from
+ * `span_format`) when `DD_TRACE_OTEL_SEMANTICS_ENABLED` is set, so every HTTP
+ * integration is covered from one place. No-op for non-HTTP spans. The span
+ * keeps the Datadog tag names throughout its lifetime — only the serialized
+ * output is renamed — so runtime consumers (peer.service, AppSec, trace stats)
+ * are unaffected.
+ *
+ * @param {FormattedHttpSpan} formattedSpan
+ */
+function applyHttpOtelSemantics (formattedSpan) {
+  const meta = formattedSpan.meta
+  const metrics = formattedSpan.metrics
+  const method = meta['http.method']
+  const url = meta['http.url']
+  if (method === undefined && url === undefined) return
+
+  // Rebuild meta/metrics as fresh objects that omit the renamed Datadog HTTP
+  // keys. Deleting them in place demotes the formatted span to V8 dictionary
+  // mode (~40% slower than this rebuild, measured); a fresh object keeps fast
+  // properties and can't leak a renamed key as `undefined` on the OTLP path.
+  const newMeta = {}
+  for (const key of Object.keys(meta)) {
+    if (!DD_HTTP_META_KEYS.has(key)) newMeta[key] = meta[key]
+  }
+  const newMetrics = {}
+  for (const key of Object.keys(metrics)) {
+    if (key !== NETWORK_DESTINATION_PORT) newMetrics[key] = metrics[key]
+  }
+
+  const kind = meta['span.kind']
+
+  if (method !== undefined) {
+    if (KNOWN_METHODS.has(method)) {
+      newMeta[HTTP_REQUEST_METHOD] = method
+    } else {
+      // Unknown verb: bucket to `_OTHER`, preserve the raw value, and use the
+      // literal "HTTP" in the span name (the spec forbids the URL path there).
+      // Known-method names are already `{method} {route}`.
+      newMeta[HTTP_REQUEST_METHOD] = '_OTHER'
+      newMeta[HTTP_REQUEST_METHOD_ORIGINAL] = method
+      const resource = formattedSpan.resource
+      if (typeof resource === 'string') {
+        if (resource === method) {
+          formattedSpan.resource = 'HTTP'
+        } else if (resource.startsWith(`${method} `)) {
+          formattedSpan.resource = `HTTP${resource.slice(method.length)}`
+        }
+      }
+    }
+  }
+
+  const status = meta['http.status_code']
+  let statusCode
+  if (status !== undefined) {
+    // OTel types http.response.status_code as an int, so emit it as a numeric
+    // metric (the OTLP exporter serializes meta as stringValue but metrics as
+    // intValue) — mirroring how server.port is handled below. Guard against a
+    // non-numeric status, which would otherwise write a NaN metric.
+    statusCode = Number.parseInt(status)
+    if (Number.isFinite(statusCode)) newMetrics[HTTP_RESPONSE_STATUS_CODE] = statusCode
+  }
+
+  const userAgent = meta['http.useragent']
+  if (userAgent !== undefined) newMeta[USER_AGENT_ORIGINAL] = userAgent
+
+  const clientIp = meta['http.client_ip']
+  if (clientIp !== undefined) newMeta[CLIENT_ADDRESS] = clientIp
+
+  // http.endpoint is Datadog-only (omitted above); it has no OTel equivalent.
+
+  if (kind === 'server') {
+    // FIXME: some server frameworks (e.g. Next.js — `packages/datadog-plugin-next`)
+    // never populate `http.url`, so the OTel `url.*` / `server.*` attributes below
+    // can't be derived and are omitted for those spans. This needs a fix; the
+    // short-term option is to set `http.url` in those integrations so they emit
+    // the full server attribute set.
+    if (url !== undefined) {
+      // The query in `http.url` is already obfuscated per config, so it is preserved.
+      const { scheme, address, port, path, query } = decomposeServerUrl(url, url)
+      if (path !== undefined) newMeta[URL_PATH] = path
+      if (scheme !== undefined) newMeta[URL_SCHEME] = toHttpScheme(scheme)
+      if (query !== undefined) newMeta[URL_QUERY] = query
+      if (address !== undefined) newMeta[SERVER_ADDRESS] = address
+      if (port !== undefined) newMetrics[SERVER_PORT] = port
+    }
+  } else {
+    if (url !== undefined) {
+      // url.full must not carry embedded credentials.
+      newMeta[URL_FULL] = redactUrlCredentials(url)
+    }
+    const outHost = meta['out.host']
+    if (outHost !== undefined) newMeta[SERVER_ADDRESS] = stripIpv6Brackets(outHost)
+    const clientPort = metrics[NETWORK_DESTINATION_PORT]
+    if (clientPort === undefined) {
+      // server.port is required for client spans; fall back to the scheme default.
+      const defaultPort = defaultPortForUrl(url)
+      if (defaultPort !== undefined) newMetrics[SERVER_PORT] = defaultPort
+    } else {
+      newMetrics[SERVER_PORT] = clientPort
+    }
+  }
+
+  // OTel error semantics for an error response (no-clobber on an exception-derived
+  // type): server spans are errors on 5xx only (4xx MUST be left unset per the
+  // spec); client spans on any status >= 400.
+  if (status !== undefined && newMeta[ERROR_TYPE] === undefined) {
+    const isError = kind === 'server' ? statusCode >= 500 : statusCode >= 400
+    if (isError) {
+      newMeta[ERROR_TYPE] = status
+      formattedSpan.error = 1
+    }
+  }
+
+  formattedSpan.meta = newMeta
+  formattedSpan.metrics = newMetrics
+}
+
+module.exports = {
+  NETWORK_PEER_ADDRESS, // imported by web.js (set from req.socket, not at serialization)
+  decomposeServerUrl, // exercised directly by the helper spec
+  applyHttpOtelSemantics,
+}

package/packages/dd-trace/src/plugins/util/test.js

@@ -22,17 +22,40 @@ const { SAMPLING_RULE_DECISION } = require('../../constants')
 const { AUTO_KEEP } = require('../../../../../ext/priority')
 const { version: ddTraceVersion } = require('../../../../../package.json')
 const {
+  CI_JOB_ID,
   GIT_BRANCH,
   GIT_COMMIT_SHA,
   GIT_REPOSITORY_URL,
   GIT_TAG,
+  GIT_COMMIT_AUTHOR_DATE,
   GIT_COMMIT_AUTHOR_EMAIL,
   GIT_COMMIT_AUTHOR_NAME,
+  GIT_COMMIT_COMMITTER_DATE,
+  GIT_COMMIT_COMMITTER_EMAIL,
+  GIT_COMMIT_COMMITTER_NAME,
   GIT_COMMIT_MESSAGE,
+  GIT_COMMIT_HEAD_AUTHOR_DATE,
+  GIT_COMMIT_HEAD_AUTHOR_EMAIL,
+  GIT_COMMIT_HEAD_AUTHOR_NAME,
+  GIT_COMMIT_HEAD_COMMITTER_DATE,
+  GIT_COMMIT_HEAD_COMMITTER_EMAIL,
+  GIT_COMMIT_HEAD_COMMITTER_NAME,
+  GIT_COMMIT_HEAD_MESSAGE,
   CI_WORKSPACE_PATH,
+  CI_PIPELINE_ID,
+  CI_PIPELINE_NAME,
+  CI_PIPELINE_NUMBER,
   CI_PIPELINE_URL,
   CI_JOB_NAME,
+  CI_JOB_URL,
+  CI_NODE_LABELS,
+  CI_NODE_NAME,
+  CI_PROVIDER_NAME,
+  CI_STAGE_NAME,
   GIT_COMMIT_HEAD_SHA,
+  GIT_PULL_REQUEST_BASE_BRANCH,
+  GIT_PULL_REQUEST_BASE_BRANCH_HEAD_SHA,
+  GIT_PULL_REQUEST_BASE_BRANCH_SHA,
 } = require('./tags')
 const { getRuntimeAndOSMetadata } = require('./env')
 const { getCIMetadata } = require('./ci')
@@ -198,6 +221,43 @@ const TEST_LEVEL_EVENT_TYPES = [
   'test_module_end',
   'test_session_end',
 ]
+const TEST_LEVELS_METADATA = 'test_levels'
+const TEST_LEVELS_METADATA_TAGS = [
+  CI_JOB_ID,
+  CI_JOB_NAME,
+  CI_JOB_URL,
+  CI_NODE_LABELS,
+  CI_NODE_NAME,
+  CI_PIPELINE_ID,
+  CI_PIPELINE_NAME,
+  CI_PIPELINE_NUMBER,
+  CI_PIPELINE_URL,
+  CI_PROVIDER_NAME,
+  CI_STAGE_NAME,
+  CI_WORKSPACE_PATH,
+  GIT_BRANCH,
+  GIT_COMMIT_AUTHOR_DATE,
+  GIT_COMMIT_AUTHOR_EMAIL,
+  GIT_COMMIT_AUTHOR_NAME,
+  GIT_COMMIT_COMMITTER_DATE,
+  GIT_COMMIT_COMMITTER_EMAIL,
+  GIT_COMMIT_COMMITTER_NAME,
+  GIT_COMMIT_HEAD_AUTHOR_DATE,
+  GIT_COMMIT_HEAD_AUTHOR_EMAIL,
+  GIT_COMMIT_HEAD_AUTHOR_NAME,
+  GIT_COMMIT_HEAD_COMMITTER_DATE,
+  GIT_COMMIT_HEAD_COMMITTER_EMAIL,
+  GIT_COMMIT_HEAD_COMMITTER_NAME,
+  GIT_COMMIT_HEAD_MESSAGE,
+  GIT_COMMIT_HEAD_SHA,
+  GIT_COMMIT_MESSAGE,
+  GIT_COMMIT_SHA,
+  GIT_PULL_REQUEST_BASE_BRANCH,
+  GIT_PULL_REQUEST_BASE_BRANCH_HEAD_SHA,
+  GIT_PULL_REQUEST_BASE_BRANCH_SHA,
+  GIT_REPOSITORY_URL,
+  GIT_TAG,
+]
 const TEST_RETRY_REASON_TYPES = {
   efd: 'early_flake_detection',
   atr: 'auto_test_retry',
@@ -398,6 +458,7 @@ module.exports = {
   getCodeOwnersFileEntries,
   getCodeOwnersForFilename,
   getTestCommonTags,
+  getTestLevelsMetadataTags,
   getTestSessionCommonTags,
   getTestModuleCommonTags,
   getTestSuiteCommonTags,
@@ -448,6 +509,7 @@ module.exports = {
   DD_CAPABILITIES_TEST_MANAGEMENT_ATTEMPT_TO_FIX,
   DD_CAPABILITIES_FAILED_TEST_REPLAY,
   TEST_LEVEL_EVENT_TYPES,
+  TEST_LEVELS_METADATA,
   TEST_RETRY_REASON_TYPES,
   getNumFromKnownTests,
   getFileAndLineNumberFromError,
@@ -700,6 +762,24 @@ function getTestParametersString (parametersByTestName, testName) {
   }
 }
 
+/**
+ * Extracts CI and Git tags that apply to every test level.
+ *
+ * @param {TestEnvironmentMetadata} testEnvironmentMetadata
+ * @returns {Record<string, string|number>}
+ */
+function getTestLevelsMetadataTags (testEnvironmentMetadata) {
+  const testLevelsMetadataTags = {}
+  for (let i = 0; i < TEST_LEVELS_METADATA_TAGS.length; i++) {
+    const key = TEST_LEVELS_METADATA_TAGS[i]
+    const value = testEnvironmentMetadata[key]
+    if (value !== undefined) {
+      testLevelsMetadataTags[key] = value
+    }
+  }
+  return testLevelsMetadataTags
+}
+
 function getTestTypeFromFramework (testFramework) {
   if (testFramework === 'playwright' || testFramework === 'cypress') {
     return 'browser'

package/packages/dd-trace/src/plugins/util/url.js

@@ -2,6 +2,8 @@
 
 const { URL } = require('url')
 
+const log = require('../../log')
+
 const HTTP2_HEADER_AUTHORITY = ':authority'
 const HTTP2_HEADER_SCHEME = ':scheme'
 const HTTP2_HEADER_PATH = ':path'
@@ -60,6 +62,69 @@ function obfuscateQs (config, url) {
   return `${path}?${qs}`
 }
 
+const qsObfuscatorCache = new Map()
+
+/**
+ * Compile the configured query-string obfuscator (a regex string, or a boolean)
+ * into the boolean / RegExp form that `obfuscateQs` consumes. The compiled regex
+ * is cached, since the configuration is stable for the process lifetime.
+ *
+ * @param {{ queryStringObfuscation?: boolean | string }} config
+ * @returns {boolean | RegExp}
+ */
+function getQsObfuscator (config) {
+  const obfuscator = config.queryStringObfuscation
+
+  if (typeof obfuscator === 'boolean') return obfuscator
+
+  if (typeof obfuscator === 'string') {
+    const cached = qsObfuscatorCache.get(obfuscator)
+    if (cached !== undefined) return cached
+
+    let compiled = true
+    if (obfuscator === '') {
+      compiled = false // disable obfuscator
+    } else if (obfuscator !== '.*') { // '.*' optimizes to a full redact (true)
+      try {
+        compiled = new RegExp(obfuscator, 'gi')
+      } catch (err) {
+        log.error('Error getting qs obfuscator', err)
+      }
+    }
+
+    qsObfuscatorCache.set(obfuscator, compiled)
+    return compiled
+  }
+
+  if (Object.hasOwn(config, 'queryStringObfuscation')) {
+    log.error('Expected `queryStringObfuscation` to be a regex string or boolean.')
+  }
+
+  return true
+}
+
+/**
+ * Build a client span's `http.url` with its query retained but obfuscated per
+ * `config.queryStringObfuscation` (OTel `url.full` is the absolute URL including
+ * the redacted query). Falls back to `strippedUrl` when there is no query.
+ * Callers gate this behind `DD_TRACE_OTEL_SEMANTICS_ENABLED`, so the default
+ * (flag off) hot path stays a plain tag assignment.
+ *
+ * @param {{ queryStringObfuscation?: boolean | string }} config
+ * @param {string} base `scheme://host[:port]`
+ * @param {string} [pathname] raw request path, may include `?query`
+ * @param {string} strippedUrl `base` + query-stripped path (used when there is no query)
+ * @returns {string}
+ */
+function buildClientHttpUrl (config, base, pathname, strippedUrl) {
+  if (pathname?.includes('?')) {
+    // `config.queryStringObfuscation` is the raw config value here (client plugins
+    // don't normalize it the way the server does), so compile it first.
+    return obfuscateQs({ queryStringObfuscation: getQsObfuscator(config) }, `${base}${pathname}`)
+  }
+  return strippedUrl
+}
+
 /**
  * Extract URL path from URL using regex pattern instead of Node.js URL API because:
  *
@@ -139,7 +204,9 @@ function filterSensitiveInfoFromRepository (repositoryUrl) {
 module.exports = {
   extractURL,
   obfuscateQs,
+  getQsObfuscator,
+  buildClientHttpUrl,
   calculateHttpEndpoint,
   filterSensitiveInfoFromRepository,
-  extractPathFromUrl, // test only
+  extractPathFromUrl, // used by http-otel-semantics decomposeServerUrl fallback (and tests)
 }