dd-trace 5.94.0 → 5.96.0

package/LICENSE-3rdparty.csv

@@ -1,10 +1,11 @@
-"component","origin","license","copyright"
-"@datadog/flagging-core","https://github.com/DataDog/openfeature-js-client","['Apache-2.0']","['DataDog']"
-"@datadog/libdatadog","https://github.com/DataDog/libdatadog-nodejs","['Apache-2.0']","['Datadog Inc.']"
-"@datadog/native-appsec","https://github.com/DataDog/dd-native-appsec-js","['Apache-2.0']","['Datadog Inc.']"
-"@datadog/native-iast-taint-tracking","https://github.com/DataDog/dd-native-iast-taint-tracking-js","['Apache-2.0']","['Datadog Inc.']"
-"@datadog/native-metrics","https://github.com/DataDog/dd-native-metrics-js","['Apache-2.0']","['Datadog Inc.']"
-"@datadog/openfeature-node-server","https://github.com/DataDog/openfeature-js-client","['Apache-2.0']","['DataDog']"
+"component","origin","license","copyright"
+"@apm-js-collab/code-transformer","https://github.com/nodejs/orchestrion-js","['Apache-2.0']","['nodejs']"
+"@datadog/flagging-core","https://github.com/DataDog/openfeature-js-client","['Apache-2.0']","['DataDog']"
+"@datadog/libdatadog","https://github.com/DataDog/libdatadog-nodejs","['Apache-2.0']","['Datadog Inc.']"
+"@datadog/native-appsec","https://github.com/DataDog/dd-native-appsec-js","['Apache-2.0']","['Datadog Inc.']"
+"@datadog/native-iast-taint-tracking","https://github.com/DataDog/dd-native-iast-taint-tracking-js","['Apache-2.0']","['Datadog Inc.']"
+"@datadog/native-metrics","https://github.com/DataDog/dd-native-metrics-js","['Apache-2.0']","['Datadog Inc.']"
+"@datadog/openfeature-node-server","https://github.com/DataDog/openfeature-js-client","['Apache-2.0']","['DataDog']"
 "@datadog/pprof","https://github.com/DataDog/pprof-nodejs","['Apache-2.0']","['Google Inc.']"
 "@datadog/sketches-js","https://github.com/DataDog/sketches-js","['Apache-2.0']","['DataDog']"
 "@datadog/wasm-js-rewriter","https://github.com/DataDog/dd-wasm-js-rewriter","['Apache-2.0']","['Datadog Inc.']"
@@ -44,59 +45,60 @@
 "@protobufjs/aspromise","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
 "@protobufjs/base64","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
 "@protobufjs/codegen","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
-"@protobufjs/eventemitter","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
-"@protobufjs/fetch","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
-"@protobufjs/float","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
-"@protobufjs/inquire","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
+"@protobufjs/eventemitter","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
+"@protobufjs/fetch","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
+"@protobufjs/float","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
+"@protobufjs/inquire","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
 "@protobufjs/path","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
 "@protobufjs/pool","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
 "@protobufjs/utf8","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
 "@tybys/wasm-util","https://github.com/toyobayashi/wasm-util","['MIT']","['toyobayashi']"
+"@types/estree","https://github.com/DefinitelyTyped/DefinitelyTyped","['MIT']","['DefinitelyTyped']"
 "@types/node","https://github.com/DefinitelyTyped/DefinitelyTyped","['MIT']","['DefinitelyTyped']"
 "acorn","https://github.com/acornjs/acorn","['MIT']","['acornjs']"
 "acorn-import-attributes","https://github.com/xtuc/acorn-import-attributes","['MIT']","['Sven Sauleau']"
-"argparse","https://github.com/nodeca/argparse","['Python-2.0']","['nodeca']"
-"astring","https://github.com/davidbonnet/astring","['MIT']","['David Bonnet']"
-"cjs-module-lexer","https://github.com/nodejs/cjs-module-lexer","['MIT']","['Guy Bedford']"
-"crypto-randomuuid","npm:crypto-randomuuid","['MIT']","['Stephen Belanger']"
-"dc-polyfill","https://github.com/DataDog/dc-polyfill","['MIT']","['Thomas Hunter II']"
-"dd-trace","https://github.com/DataDog/dd-trace-js","['(Apache-2.0 OR BSD-3-Clause)']","['Datadog Inc. <info@datadoghq.com>']"
-"detect-newline","https://github.com/sindresorhus/detect-newline","['MIT']","['Sindre Sorhus']"
-"escape-string-regexp","https://github.com/sindresorhus/escape-string-regexp","['MIT']","['Sindre Sorhus']"
-"esquery","https://github.com/estools/esquery","['BSD-3-Clause']","['Joel Feenstra']"
-"estraverse","https://github.com/estools/estraverse","['BSD-2-Clause']","['estools']"
-"fast-fifo","https://github.com/mafintosh/fast-fifo","['MIT']","['Mathias Buus']"
-"ignore","https://github.com/kaelzhang/node-ignore","['MIT']","['kael']"
-"import-in-the-middle","https://github.com/nodejs/import-in-the-middle","['Apache-2.0']","['Bryan English']"
-"istanbul-lib-coverage","https://github.com/istanbuljs/istanbuljs","['BSD-3-Clause']","['Krishnan Anantheswaran']"
-"jest-docblock","https://github.com/jestjs/jest","['MIT']","['jestjs']"
-"js-yaml","https://github.com/nodeca/js-yaml","['MIT']","['Vladimir Zapparov']"
-"jsep","https://github.com/EricSmekens/jsep","['MIT']","['Stephen Oney']"
-"jsonpath-plus","https://github.com/JSONPath-Plus/JSONPath","['MIT']","['Stefan Goessner']"
-"limiter","https://github.com/jhurliman/node-rate-limiter","['MIT']","['John Hurliman']"
-"lodash.sortby","https://github.com/lodash/lodash","['MIT']","['John-David Dalton']"
-"long","https://github.com/dcodeIO/long.js","['Apache-2.0']","['Daniel Wirtz']"
-"lru-cache","https://github.com/isaacs/node-lru-cache","['ISC']","['Isaac Z. Schlueter']"
-"meriyah","https://github.com/meriyah/meriyah","['ISC']","['Kenny F.']"
-"module-details-from-path","https://github.com/watson/module-details-from-path","['MIT']","['Thomas Watson']"
-"mutexify","https://github.com/mafintosh/mutexify","['MIT']","['Mathias Buus']"
+"argparse","https://github.com/nodeca/argparse","['Python-2.0']","['nodeca']"
+"astring","https://github.com/davidbonnet/astring","['MIT']","['David Bonnet']"
+"cjs-module-lexer","https://github.com/nodejs/cjs-module-lexer","['MIT']","['Guy Bedford']"
+"crypto-randomuuid","npm:crypto-randomuuid","['MIT']","['Stephen Belanger']"
+"dc-polyfill","https://github.com/DataDog/dc-polyfill","['MIT']","['Thomas Hunter II']"
+"dd-trace","https://github.com/DataDog/dd-trace-js","['(Apache-2.0 OR BSD-3-Clause)']","['Datadog Inc. <info@datadoghq.com>']"
+"detect-newline","https://github.com/sindresorhus/detect-newline","['MIT']","['Sindre Sorhus']"
+"escape-string-regexp","https://github.com/sindresorhus/escape-string-regexp","['MIT']","['Sindre Sorhus']"
+"esquery","https://github.com/estools/esquery","['BSD-3-Clause']","['Joel Feenstra']"
+"estraverse","https://github.com/estools/estraverse","['BSD-2-Clause']","['estools']"
+"fast-fifo","https://github.com/mafintosh/fast-fifo","['MIT']","['Mathias Buus']"
+"ignore","https://github.com/kaelzhang/node-ignore","['MIT']","['kael']"
+"import-in-the-middle","https://github.com/nodejs/import-in-the-middle","['Apache-2.0']","['Bryan English']"
+"istanbul-lib-coverage","https://github.com/istanbuljs/istanbuljs","['BSD-3-Clause']","['Krishnan Anantheswaran']"
+"jest-docblock","https://github.com/jestjs/jest","['MIT']","['jestjs']"
+"js-yaml","https://github.com/nodeca/js-yaml","['MIT']","['Vladimir Zapparov']"
+"jsep","https://github.com/EricSmekens/jsep","['MIT']","['Stephen Oney']"
+"jsonpath-plus","https://github.com/JSONPath-Plus/JSONPath","['MIT']","['Stefan Goessner']"
+"limiter","https://github.com/jhurliman/node-rate-limiter","['MIT']","['John Hurliman']"
+"lodash.sortby","https://github.com/lodash/lodash","['MIT']","['John-David Dalton']"
+"long","https://github.com/dcodeIO/long.js","['Apache-2.0']","['Daniel Wirtz']"
+"lru-cache","https://github.com/isaacs/node-lru-cache","['ISC']","['Isaac Z. Schlueter']"
+"meriyah","https://github.com/meriyah/meriyah","['ISC']","['Kenny F.']"
+"module-details-from-path","https://github.com/watson/module-details-from-path","['MIT']","['Thomas Watson']"
+"mutexify","https://github.com/mafintosh/mutexify","['MIT']","['Mathias Buus']"
 "node-addon-api","https://github.com/nodejs/node-addon-api","['MIT']","['nodejs']"
 "node-gyp-build","https://github.com/prebuild/node-gyp-build","['MIT']","['Mathias Buus']"
 "opentracing","https://github.com/opentracing/opentracing-javascript","['Apache-2.0']","['opentracing']"
 "oxc-parser","https://github.com/oxc-project/oxc","['MIT']","['Boshen and oxc contributors']"
 "path-to-regexp","https://github.com/pillarjs/path-to-regexp","['MIT']","['pillarjs']"
 "pprof-format","https://github.com/DataDog/pprof-format","['MIT']","['Datadog Inc.']"
-"protobufjs","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
-"queue-tick","https://github.com/mafintosh/queue-tick","['MIT']","['Mathias Buus']"
-"retry","https://github.com/tim-kos/node-retry","['MIT']","['Tim Koschützki']"
-"rfdc","https://github.com/davidmarkclements/rfdc","['MIT']","['David Mark Clements']"
-"semifies","https://github.com/holepunchto/semifies","['Apache-2.0']","['Holepunch Inc']"
-"shell-quote","https://github.com/ljharb/shell-quote","['MIT']","['James Halliday']"
+"protobufjs","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
+"queue-tick","https://github.com/mafintosh/queue-tick","['MIT']","['Mathias Buus']"
+"retry","https://github.com/tim-kos/node-retry","['MIT']","['Tim Koschützki']"
+"rfdc","https://github.com/davidmarkclements/rfdc","['MIT']","['David Mark Clements']"
+"semifies","https://github.com/holepunchto/semifies","['Apache-2.0']","['Holepunch Inc']"
+"shell-quote","https://github.com/ljharb/shell-quote","['MIT']","['James Halliday']"
 "source-map","https://github.com/mozilla/source-map","['BSD-3-Clause']","['Nick Fitzgerald']"
 "spark-md5","https://github.com/satazor/js-spark-md5","['(WTFPL OR MIT)']","['André Cruz']"
 "tlhunter-sorted-set","https://github.com/tlhunter/node-sorted-set","['MIT']","['Thomas Hunter II']"
 "tslib","https://github.com/microsoft/tslib","['0BSD']","['Microsoft Corp.']"
 "ttl-set","https://github.com/watson/ttl-set","['MIT']","['Thomas Watson']"
 "undici-types","https://github.com/nodejs/undici","['MIT']","['nodejs']"
-"aws-lambda-nodejs-runtime-interface-client","https://github.com/aws/aws-lambda-nodejs-runtime-interface-client/blob/v2.1.0/src/utils/UserFunction.ts","['Apache-2.0']","['Amazon.com Inc. or its affiliates']"
-"is-git-url","https://github.com/jonschlinkert/is-git-url/blob/396965ffabf2f46656c8af4c47bef1d69f09292e/index.js#L9C15-L9C87","['MIT']","['Jon Schlinkert']"
+"aws-lambda-nodejs-runtime-interface-client","https://github.com/aws/aws-lambda-nodejs-runtime-interface-client/blob/v2.1.0/src/utils/UserFunction.ts","['Apache-2.0']","['Amazon.com Inc. or its affiliates']"
+"is-git-url","https://github.com/jonschlinkert/is-git-url/blob/396965ffabf2f46656c8af4c47bef1d69f09292e/index.js#L9C15-L9C87","['MIT']","['Jon Schlinkert']"

package/index.d.ts

@@ -456,11 +456,15 @@ declare namespace tracer {
   export interface PropagationStyle {
     /**
      * Selection of context propagation injection mechanisms.
+     * @env DD_TRACE_PROPAGATION_STYLE, DD_TRACE_PROPAGATION_STYLE_INJECT
+     * Programmatic configuration takes precedence over the environment variables listed above.
      */
     inject: string[],
 
     /**
      * Selection and priority order of context propagation extraction mechanisms.
+     * @env DD_TRACE_PROPAGATION_STYLE, DD_TRACE_PROPAGATION_STYLE_EXTRACT
+     * Programmatic configuration takes precedence over the environment variables listed above.
      */
     extract: string[]
   }
@@ -477,6 +481,14 @@ declare namespace tracer {
      */
     apmTracingEnabled?: boolean
 
+    /**
+     * List of baggage tag keys to be included in the baggage.
+     * @default ['user.id', 'session.id', 'account.id']
+     * @env DD_TRACE_BAGGAGE_TAG_KEYS
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    baggageTagKeys?: string[];
+
     /**
      * Whether to enable trace ID injection in log records to be able to correlate
      * traces with logs.
@@ -577,7 +589,7 @@ declare namespace tracer {
 
     /**
      * Controls the ingestion sample rate (between 0 and 1) between the agent and the backend.
-     * @env DD_TRACE_SAMPLE_RATE, OTEL_TRACES_SAMPLER, OTEL_TRACES_SAMPLER_ARG
+     * @env DD_TRACE_SAMPLE_RATE
      * Programmatic configuration takes precedence over the environment variables listed above.
      */
     sampleRate?: number;
@@ -682,7 +694,7 @@ declare namespace tracer {
     ingestion?: {
       /**
        * Controls the ingestion sample rate (between 0 and 1) between the agent and the backend.
-       * @env DD_TRACE_SAMPLE_RATE, OTEL_TRACES_SAMPLER, OTEL_TRACES_SAMPLER_ARG
+       * @env DD_TRACE_SAMPLE_RATE
        * Programmatic configuration takes precedence over the environment variables listed above.
        */
       sampleRate?: number
@@ -695,6 +707,22 @@ declare namespace tracer {
       rateLimit?: number
     };
 
+    /**
+     * Whether to enable inferred proxy services.
+     * @default false
+     * @env DD_TRACE_INFERRED_PROXY_SERVICES_ENABLED
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    inferredProxyServicesEnabled?: boolean
+
+    /**
+     * The site to use for the trace.
+     * @default 'datadoghq.com'
+     * @env DD_SITE
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    site?: string;
+
     /**
      * Experimental features can be enabled individually using key / value pairs.
      * @default {}
@@ -725,24 +753,31 @@ declare namespace tracer {
 
       /**
        * Configuration of the IAST. Can be a boolean as an alias to `iast.enabled`.
+       * @deprecated Please use the non-experimental `iast` option instead.
        */
       iast?: boolean | IastOptions
 
-      appsec?: {
+      /**
+       * Configuration of the AppSec. Can be a boolean as an alias to `appsec.enabled`.
+       * @deprecated Please use the non-experimental `appsec` option instead.
+       */
+      appsec?: boolean | {
         /**
          * Configuration of Standalone ASM mode
          * Deprecated in favor of `apmTracingEnabled`.
          *
-         * @deprecated
+         * @deprecated Please use `apmTracingEnabled` instead.
          */
         standalone?: {
           /**
            * Whether to enable Standalone ASM.
            * @default false
+           * @env DD_EXPERIMENTAL_APPSEC_STANDALONE_ENABLED
+           * Programmatic configuration takes precedence over the environment variables listed above.
            */
           enabled?: boolean
         }
-      },
+      } | TracerOptions['appsec'],
 
       aiguard?: {
         /**
@@ -751,6 +786,15 @@ declare namespace tracer {
          * Programmatic configuration takes precedence over the environment variables listed above.
          */
         enabled?: boolean,
+        /**
+         * Whether to request blocking mode when evaluating prompts via auto-instrumentation.
+         * When `true`, AI Guard will block requests that violate security policies.
+         * When `false`, AI Guard evaluates but never blocks (monitor-only mode).
+         * @default false
+         * @env DD_AI_GUARD_BLOCK
+         * Programmatic configuration takes precedence over the environment variables listed above.
+         */
+        block?: boolean,
         /**
          * URL of the AI Guard REST API.
          * @env DD_AI_GUARD_ENDPOINT
@@ -808,6 +852,7 @@ declare namespace tracer {
 
     /**
      * Whether to load all built-in plugins.
+     * @deprecated To deactivate plugins, use the specific DD_TRACE_<INTEGRATION>_ENABLED environment variables.
      * @default true
      */
     plugins?: boolean;
@@ -1092,6 +1137,18 @@ declare namespace tracer {
        * Programmatic configuration takes precedence over the environment variables listed above.
        */
       enabled?: boolean
+
+      experimental?: {
+        exit_spans?: {
+          /**
+           * Whether to attach code origin data to exit spans.
+           * @default false
+           * @env DD_CODE_ORIGIN_FOR_SPANS_EXPERIMENTAL_EXIT_SPANS_ENABLED
+           * Programmatic configuration takes precedence over the environment variables listed above.
+           */
+          enabled?: boolean
+        }
+      }
     }
 
     /**
@@ -1226,6 +1283,134 @@ declare namespace tracer {
        */
       redactionExcludedIdentifiers?: string[]
     }
+
+    /**
+     * Maximum size in bytes for serialized baggage items.
+     * @default 8192
+     * @env DD_TRACE_BAGGAGE_MAX_BYTES
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    baggageMaxBytes?: number
+
+    /**
+     * Maximum number of baggage items allowed on a context.
+     * @default 64
+     * @env DD_TRACE_BAGGAGE_MAX_ITEMS
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    baggageMaxItems?: number
+
+    /**
+     * Header tags (key-value pairs comma separated) to extract and attach to spans.
+     * TODO: In the next major version, this will become an object.
+     * @env DD_TRACE_HEADER_TAGS
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    headerTags?: string[]
+
+    /**
+     * Whether to use Datadog legacy baggage extraction and injection behavior.
+     * @default false
+     * @env DD_TRACE_LEGACY_BAGGAGE_ENABLED
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    legacyBaggageEnabled?: boolean
+
+    /**
+     * Whether middleware spans should be created.
+     * @default true
+     * @env DD_TRACE_MIDDLEWARE_TRACING_ENABLED
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    middlewareTracingEnabled?: boolean
+
+    /**
+     * Whether to enable OpenAI log collection.
+     * @default false
+     * @env DD_OPENAI_LOGS_ENABLED
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    openAiLogsEnabled?: boolean
+
+    /**
+     * Peer service name remapping rules.
+     * @env DD_TRACE_PEER_SERVICE_MAPPING
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    peerServiceMapping?: { [key: string]: string }
+
+    /**
+     * Controls the naming schema version used for spans.
+     * @default 'v0'
+     * @env DD_TRACE_SPAN_ATTRIBUTE_SCHEMA
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    spanAttributeSchema?: 'v0' | 'v1'
+
+    /**
+     * Whether to compute peer.service tags automatically.
+     * @default false
+     * @env DD_TRACE_PEER_SERVICE_DEFAULTS_ENABLED
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    spanComputePeerService?: boolean
+
+    /**
+     * Whether to remove integration names from service names under the active schema.
+     * @default false
+     * @env DD_TRACE_REMOVE_INTEGRATION_SERVICE_NAMES_ENABLED
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    spanRemoveIntegrationFromService?: boolean
+
+    /**
+     * Whether to enable client-side stats computation.
+     * @default false
+     * @env DD_TRACE_STATS_COMPUTATION_ENABLED
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    stats?: boolean
+
+    /**
+     * Whether to generate 128-bit trace IDs.
+     * @default true
+     * @env DD_TRACE_128_BIT_TRACEID_GENERATION_ENABLED
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    traceId128BitGenerationEnabled?: boolean
+
+    /**
+     * Whether to include the high 64 bits of 128-bit trace IDs in logs.
+     * @default true
+     * @env DD_TRACE_128_BIT_TRACEID_LOGGING_ENABLED
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    traceId128BitLoggingEnabled?: boolean
+
+    /**
+     * Whether websocket message spans should be created.
+     * @default true
+     * @env DD_TRACE_WEBSOCKET_MESSAGES_ENABLED
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    traceWebsocketMessagesEnabled?: boolean
+
+    /**
+     * Whether websocket message spans should inherit sampling decisions.
+     * @default true
+     * @env DD_TRACE_WEBSOCKET_MESSAGES_INHERIT_SAMPLING
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    traceWebsocketMessagesInheritSampling?: boolean
+
+    /**
+     * Whether websocket message spans should start separate traces.
+     * @default true
+     * @env DD_TRACE_WEBSOCKET_MESSAGES_SEPARATE_TRACES
+     * Programmatic configuration takes precedence over the environment variables listed above.
+     */
+    traceWebsocketMessagesSeparateTraces?: boolean
+
   }
 
   /**
@@ -3256,13 +3441,6 @@ declare namespace tracer {
      */
     maxContextOperations?: number,
 
-    /**
-     * Defines the pattern to ignore cookie names in the vulnerability hash calculation
-     * @default ".{32,}"
-     * @deprecated This property has no effect because hash calculation algorithm has been updated for cookie vulnerabilities
-     */
-    cookieFilterPattern?: string,
-
     /**
      * Defines the number of rows to taint in data coming from databases
      * @default 1
@@ -3304,7 +3482,7 @@ declare namespace tracer {
      * Allows to enable security controls. This option is not supported when
      * using ESM.
      * @deprecated Please use the DD_IAST_SECURITY_CONTROLS_CONFIGURATION
-     * environment variable instead.
+     * environment variable instead. This option will be removed in the next major version.
      * @env DD_IAST_SECURITY_CONTROLS_CONFIGURATION
      * Programmatic configuration takes precedence over the environment variables listed above.
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dd-trace",
-  "version": "5.94.0",
+  "version": "5.96.0",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",
@@ -139,7 +139,7 @@
   ],
   "dependencies": {
     "dc-polyfill": "^0.1.10",
-    "import-in-the-middle": "^3.0.0"
+    "import-in-the-middle": "^3.0.1"
   },
   "optionalDependencies": {
     "@datadog/libdatadog": "0.9.2",

package/packages/datadog-instrumentations/src/ai.js

@@ -3,11 +3,113 @@
 const { channel, tracingChannel } = require('dc-polyfill')
 const shimmer = require('../../datadog-shimmer')
 const { addHook, getHooks } = require('./helpers/instrument')
+const { convertVercelPromptToMessages, buildOutputMessages } = require('./helpers/ai-messages')
 
 const vercelAiTracingChannel = tracingChannel('dd-trace:vercel-ai')
 const vercelAiSpanSetAttributesChannel = channel('dd-trace:vercel-ai:span:setAttributes')
+const aiguardChannel = channel('dd-trace:ai:aiguard')
 
 const tracers = new WeakSet()
+const wrappedModels = new WeakSet()
+
+/**
+ * Publishes already-converted AI guard style messages to the AIGuard channel.
+ *
+ * @param {Array<object>} messages - AI guard style messages to evaluate
+ * @returns {Promise<void>}
+ */
+function publishToAIGuard (messages) {
+  return new Promise((resolve, reject) => {
+    aiguardChannel.publish({ messages, resolve, reject })
+  })
+}
+
+/**
+ * Wraps a Vercel AI language model's doGenerate and doStream methods to evaluate
+ * messages with AIGuard.
+ *
+ * @param {object} model - A Vercel AI language model instance
+ */
+function wrapModelWithAIGuard (model) {
+  if (!model || wrappedModels.has(model)) return
+  wrappedModels.add(model)
+
+  if (typeof model.doGenerate === 'function') {
+    shimmer.wrap(model, 'doGenerate', function (original) {
+      return function (options) {
+        const originalResult = original.call(this, options)
+
+        if (!aiguardChannel.hasSubscribers) return originalResult
+        if (!options.prompt?.length) return originalResult
+
+        const inputMessages = convertVercelPromptToMessages(options.prompt)
+        if (!inputMessages.length) return originalResult
+
+        // Run AI Guard input evaluation and LLM call in parallel.
+        // The LLM has no side effects so it is safe to discard its result if AI Guard blocks.
+        return Promise.all([publishToAIGuard(inputMessages), originalResult])
+          .then(([, result]) => {
+            if (!result.content?.length) return result
+            return publishToAIGuard(buildOutputMessages(inputMessages, result.content))
+              .then(() => result)
+          })
+      }
+    })
+  }
+
+  if (typeof model.doStream === 'function') {
+    shimmer.wrap(model, 'doStream', function (original) {
+      return function (options) {
+        const originalResult = original.call(this, options)
+
+        if (!aiguardChannel.hasSubscribers) return originalResult
+        if (!options.prompt?.length) return originalResult
+
+        const inputMessages = convertVercelPromptToMessages(options.prompt)
+        if (!inputMessages.length) return originalResult
+
+        // Run AI Guard input evaluation and LLM call in parallel.
+        // The LLM has no side effects so it is safe to discard its result if AI Guard blocks.
+        return Promise.all([publishToAIGuard(inputMessages), originalResult])
+          .then(([, result]) => {
+            const chunks = []
+            const reader = result.stream.getReader()
+
+            function readAll () {
+              return reader.read().then(({ done, value }) => {
+                if (done) return
+                chunks.push(value)
+                return readAll()
+              })
+            }
+
+            return readAll().then(() => {
+              const toolCalls = chunks.filter(c => c?.type === 'tool-call')
+              const text = chunks.filter(c => c?.type === 'text-delta').map(c => c.textDelta).join('')
+              const content = toolCalls.length ? toolCalls : text ? [{ type: 'text', text }] : []
+
+              const evaluate = content.length
+                ? publishToAIGuard(buildOutputMessages(inputMessages, content))
+                : Promise.resolve()
+
+              return evaluate.then(() => {
+                // eslint-disable-next-line n/no-unsupported-features/node-builtins
+                const stream = new ReadableStream({
+                  start (controller) {
+                    for (const chunk of chunks) {
+                      controller.enqueue(chunk)
+                    }
+                    controller.close()
+                  },
+                })
+                return { ...result, stream }
+              })
+            })
+          })
+      }
+    })
+  }
+}
 
 function wrapTracer (tracer) {
   if (tracers.has(tracer)) {
@@ -114,6 +216,16 @@ for (const hook of getHooks('ai')) {
       },
     })
 
+    // resolveLanguageModel is called by all LLM entry points (generateText, streamText,
+    // generateObject, streamObject)
+    tracingChannel('orchestrion:ai:resolveLanguageModel').subscribe({
+      end (ctx) {
+        wrapModelWithAIGuard(ctx.result)
+      },
+    })
+
     return exports
   })
 }
+
+module.exports = { wrapModelWithAIGuard }

package/packages/datadog-instrumentations/src/anthropic.js

@@ -41,7 +41,7 @@ function wrapCreate (create) {
     const options = arguments[0]
     const stream = options.stream
 
-    const ctx = { options, resource: 'create' }
+    const ctx = { options, resource: 'create', baseUrl: this._client?.baseURL }
 
     return anthropicTracingChannel.start.runStores(ctx, () => {
       let apiPromise