dd-trace 6.11.0 → 6.13.0

package/packages/dd-trace/src/aiguard/redaction.js

@@ -0,0 +1,183 @@
+'use strict'
+
+/** @typedef {import('../../../../index').aiguard.RedactionReplacement} RedactionReplacement */
+
+const SEGMENT_PATTERN = /^([A-Za-z0-9_]+)(?:\[([0-9]+)\])?$/
+
+/**
+ * Converts the raw backend replacements into the public, typed contract.
+ *
+ * @param {unknown} replacements
+ * @returns {RedactionReplacement[]}
+ */
+function normalizeRedactionReplacements (replacements) {
+  if (!Array.isArray(replacements)) return []
+
+  const result = []
+  for (const entry of replacements) {
+    if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) continue
+
+    const { path, replacement } = entry
+    if (typeof path !== 'string' || path.length === 0 || typeof replacement !== 'string') continue
+
+    result.push({ path, replacement })
+  }
+  return result
+}
+
+/**
+ * Parses an AI Guard location path into named segments and optional indexes.
+ *
+ * @param {string} path
+ * @returns {Array<{ name: string, index: number|undefined }>|undefined}
+ */
+function parsePath (path) {
+  const segments = []
+  for (const rawSegment of path.split('.')) {
+    const match = SEGMENT_PATTERN.exec(rawSegment)
+    if (!match) return
+
+    segments.push({
+      name: match[1],
+      index: match[2] === undefined ? undefined : Number(match[2]),
+    })
+  }
+  return segments
+}
+
+/**
+ * Reports whether a parsed path targets an allowed message string.
+ *
+ * @param {Array<{ name: string, index: number|undefined }>} segments
+ * @returns {boolean}
+ */
+function isRedactablePath (segments) {
+  const first = segments[0]
+  if (first?.name !== 'messages' || first.index === undefined) return false
+
+  if (segments.length === 2) {
+    const content = segments[1]
+    return content.name === 'content' && content.index === undefined
+  }
+
+  if (segments.length === 3) {
+    const content = segments[1]
+    const text = segments[2]
+    return content.name === 'content' && content.index !== undefined &&
+      text.name === 'text' && text.index === undefined
+  }
+
+  if (segments.length === 4) {
+    const toolCalls = segments[1]
+    const functionSegment = segments[2]
+    const argumentsSegment = segments[3]
+    return toolCalls.name === 'tool_calls' && toolCalls.index !== undefined &&
+      functionSegment.name === 'function' && functionSegment.index === undefined &&
+      argumentsSegment.name === 'arguments' && argumentsSegment.index === undefined
+  }
+
+  return false
+}
+
+/**
+ * Resolves a location path to a writable string container and key.
+ *
+ * @param {{ messages: Array<object> }} root
+ * @param {string} path
+ * @returns {{ container: object|Array<unknown>, key: string|number }|undefined}
+ */
+function resolveWritableString (root, path) {
+  const segments = parsePath(path)
+  if (!segments || !isRedactablePath(segments)) return
+
+  const terminal = segments.at(-1)
+  let node = root
+  for (let i = 0; i < segments.length - 1; i++) {
+    const { name, index } = segments[i]
+    if (!node || typeof node !== 'object' || !Object.hasOwn(node, name)) return
+
+    node = node[name]
+    if (index !== undefined) {
+      if (!Array.isArray(node) || index >= node.length) return
+      node = node[index]
+    }
+  }
+
+  if (!node || typeof node !== 'object') return
+  if (!Object.hasOwn(node, terminal.name) || typeof node[terminal.name] !== 'string') return
+  return { container: node, key: terminal.name }
+}
+
+/**
+ * Applies redaction replacements to an AI Guard message list.
+ * The caller transfers ownership of a private snapshot. Successful replacements mutate that snapshot in place.
+ *
+ * @param {Array<object>} messages
+ * @param {unknown} replacements
+ * @returns {{ messages: Array<object>, redacted: boolean, failures: number }}
+ */
+function redactMessages (messages, replacements) {
+  if (!Array.isArray(messages) || replacements === undefined || replacements === null) {
+    return { messages, redacted: false, failures: 0 }
+  }
+
+  try {
+    if (!Array.isArray(replacements)) {
+      return { messages, redacted: false, failures: 1 }
+    }
+    if (replacements.length === 0) return { messages, redacted: false, failures: 0 }
+
+    const replacementsByPath = new Map()
+    const conflictingPaths = new Set()
+    let failures = 0
+    for (const entry of replacements) {
+      if (!entry || typeof entry !== 'object') {
+        failures++
+        continue
+      }
+
+      const { path, replacement } = entry
+      if (typeof path !== 'string' || path.length === 0 || typeof replacement !== 'string') {
+        failures++
+        continue
+      }
+
+      if (conflictingPaths.has(path)) continue
+      if (replacementsByPath.has(path) && replacementsByPath.get(path) !== replacement) {
+        replacementsByPath.delete(path)
+        conflictingPaths.add(path)
+        failures++
+        continue
+      }
+      replacementsByPath.set(path, replacement)
+    }
+
+    if (replacementsByPath.size === 0) return { messages, redacted: false, failures }
+
+    const root = { messages }
+    const targets = []
+
+    for (const [path, replacement] of replacementsByPath) {
+      const resolved = resolveWritableString(root, path)
+      if (!resolved) {
+        failures++
+        continue
+      }
+
+      targets.push({ ...resolved, replacement })
+    }
+
+    for (const { container, key, replacement } of targets) {
+      container[key] = replacement
+    }
+
+    return { messages, redacted: targets.length > 0, failures }
+  } catch {
+    return { messages, redacted: false, failures: 1 }
+  }
+}
+
+module.exports = {
+  normalizeRedactionReplacements,
+  redactMessages,
+}

package/packages/dd-trace/src/aiguard/sdk.js

@@ -12,6 +12,7 @@ class AIGuard extends NoopAIGuard {
   #tracer
   #client
   #reporter
+  #redactionEnabled
   #meta
 
   /**
@@ -29,6 +30,7 @@ class AIGuard extends NoopAIGuard {
     this.#tracer = tracer
     this.#client = new AIGuardClient(config)
     this.#reporter = new EvaluationReporter(config)
+    this.#redactionEnabled = config.experimental.aiguard.redactionEnabled
     this.#meta = { service: config.service, env: config.env }
     this.#initialized = true
   }
@@ -45,13 +47,16 @@ class AIGuard extends NoopAIGuard {
       const report = this.#reporter.start(span, messages, { source, integration })
       let evaluation
       try {
-        evaluation = await this.#client.evaluate(messages, this.#meta)
+        evaluation = await this.#client.evaluate(report.messages, this.#meta)
       } catch (error) {
         this.#reporter.fail(report, error.telemetryType ?? TAGS.ERROR_TYPE_CLIENT)
         throw error
       }
 
-      const outcome = createEvaluationOutcome(evaluation, block)
+      const outcome = createEvaluationOutcome(report.messages, evaluation, {
+        block,
+        redactionEnabled: this.#redactionEnabled,
+      })
       this.#reporter.finish(report, outcome)
 
       if (outcome.shouldBlock) {

package/packages/dd-trace/src/aiguard/tags.js

@@ -7,6 +7,7 @@ module.exports = {
   ACTION_TAG_KEY: 'ai_guard.action',
   REASON_TAG_KEY: 'ai_guard.reason',
   BLOCKED_TAG_KEY: 'ai_guard.blocked',
+  REDACTED_TAG_KEY: 'ai_guard.redacted',
   EVENT_TAG_KEY: 'ai_guard.event',
   META_STRUCT_KEY: 'ai_guard',
 
@@ -27,4 +28,5 @@ module.exports = {
   ERROR_TYPE_CLIENT: 'client_error',
   ERROR_TYPE_STATUS: 'bad_status',
   ERROR_TYPE_RESPONSE: 'bad_response',
+  ERROR_TYPE_REDACTION: 'redaction_error',
 }

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/utils.js

@@ -108,7 +108,7 @@ function stringifyWithRanges (obj, objRanges, loadSensitiveRanges = false) {
     value = JSON.stringify(cloneObj, null, 2)
 
     if (counter > 0) {
-      const segments = []
+      let formattedValue = ''
       let outputLength = 0
       let pos = 0
       let rangeKeyIndex = value.indexOf(STRINGIFY_RANGE_KEY)
@@ -133,13 +133,14 @@ function stringifyWithRanges (obj, objRanges, loadSensitiveRanges = false) {
               start,
               end: start + originalValue.length,
             })
-            segments.push(value.slice(pos, rangeKeyIndex), originalValue)
+            formattedValue += value.slice(pos, rangeKeyIndex)
+            formattedValue += originalValue
             outputLength += cleanLength + originalValue.length
             pos = rangeKeyIndex + matchValue.length
           } else {
             // can't happen, the only way to this to happen is
             // if the JSON has a value starting with the value of STRINGIFY_SENSITIVE_NOT_STRING_KEY
-            segments.push(value.slice(pos, rangeKeyIndex + STRINGIFY_SENSITIVE_NOT_STRING_KEY.length + 1))
+            formattedValue += value.slice(pos, rangeKeyIndex + STRINGIFY_SENSITIVE_NOT_STRING_KEY.length + 1)
             outputLength += cleanLength + STRINGIFY_SENSITIVE_NOT_STRING_KEY.length + 1
             pos = rangeKeyIndex + STRINGIFY_SENSITIVE_NOT_STRING_KEY.length + 1
           }
@@ -152,13 +153,13 @@ function stringifyWithRanges (obj, objRanges, loadSensitiveRanges = false) {
               start,
               end: start + Number.parseInt(regexRes[1], 10),
             })
-            segments.push(value.slice(pos, rangeKeyIndex))
+            formattedValue += value.slice(pos, rangeKeyIndex)
             outputLength += cleanLength
             pos = rangeKeyIndex + regexRes[0].length
           } else {
             // can't happen, the only way to this to happen is
             // if the JSON has a value starting with the value of STRINGIFY_SENSITIVE_KEY
-            segments.push(value.slice(pos, rangeKeyIndex + STRINGIFY_SENSITIVE_KEY.length))
+            formattedValue += value.slice(pos, rangeKeyIndex + STRINGIFY_SENSITIVE_KEY.length)
             outputLength += cleanLength + STRINGIFY_SENSITIVE_KEY.length
             pos = rangeKeyIndex + STRINGIFY_SENSITIVE_KEY.length
           }
@@ -175,13 +176,13 @@ function stringifyWithRanges (obj, objRanges, loadSensitiveRanges = false) {
             }))
             ranges.push(...updatedRanges)
 
-            segments.push(value.slice(pos, rangeKeyIndex))
+            formattedValue += value.slice(pos, rangeKeyIndex)
             outputLength += cleanLength
             pos = rangeKeyIndex + regexRes[0].length
           } else {
             // can't happen, the only way to this to happen is
             // if the JSON has a value starting with the value of STRINGIFY_RANGE_KEY
-            segments.push(value.slice(pos, rangeKeyIndex + STRINGIFY_RANGE_KEY.length))
+            formattedValue += value.slice(pos, rangeKeyIndex + STRINGIFY_RANGE_KEY.length)
             outputLength += cleanLength + STRINGIFY_RANGE_KEY.length
             pos = rangeKeyIndex + STRINGIFY_RANGE_KEY.length
           }
@@ -190,8 +191,8 @@ function stringifyWithRanges (obj, objRanges, loadSensitiveRanges = false) {
         rangeKeyIndex = value.indexOf(STRINGIFY_RANGE_KEY, pos)
       }
 
-      segments.push(value.slice(pos))
-      value = segments.join('')
+      formattedValue += value.slice(pos)
+      value = formattedValue
     }
   } else {
     value = JSON.stringify(obj, null, 2)

package/packages/dd-trace/src/appsec/reporter.js

@@ -15,6 +15,7 @@ const {
   incrementWafUpdatesMetric,
   incrementWafConfigErrorsMetric,
   incrementWafRequestsMetric,
+  incrementRequestDurationMetrics,
   updateWafRequestsMetricTags,
   updateRaspRequestsMetricTags,
   updateRaspRuleSkippedMetricTags,
@@ -608,6 +609,7 @@ function finishRequest (req, res, storedResponseHeaders, requestBody, rootSpan)
 
   if (!req) return
 
+  incrementRequestDurationMetrics(req)
   incrementWafRequestsMetric(req)
 
   const tags = rootSpan.context().getTags()

package/packages/dd-trace/src/appsec/rule_manager.js

@@ -82,6 +82,8 @@ function updateWafFromRC (transaction) {
         const asmFile = /** @type {AsmConfigFile} */ (item.file)
         if (asmFile?.actions?.length) {
           newActions.set(item.id, asmFile.actions)
+        } else {
+          newActions.delete(item.id)
         }
       }
     } catch (e) {

package/packages/dd-trace/src/appsec/telemetry/index.js

@@ -12,6 +12,7 @@ const {
   trackRaspMetrics,
   trackRaspRuleMatch,
   trackRaspRuleSkipped,
+  incrementRaspDurationMetrics,
 } = require('./rasp')
 const {
   addWafRequestMetrics,
@@ -20,6 +21,7 @@ const {
   incrementWafUpdates,
   incrementWafConfigErrors,
   incrementWafRequests,
+  incrementWafDurationMetrics,
 } = require('./waf')
 
 const metricsStoreMap = new WeakMap()
@@ -142,6 +144,16 @@ function incrementWafRequestsMetric (req) {
   metricsStoreMap.delete(req)
 }
 
+function incrementRequestDurationMetrics (req) {
+  if (!req || !enabled) return
+
+  const store = getStore(req)
+  const requestMetrics = store[DD_TELEMETRY_REQUEST_METRICS]
+
+  incrementWafDurationMetrics(requestMetrics)
+  incrementRaspDurationMetrics(requestMetrics)
+}
+
 function incrementMissingUserLoginMetric (framework, eventType) {
   if (!enabled) return
 
@@ -199,6 +211,7 @@ module.exports = {
   incrementWafUpdatesMetric,
   incrementWafConfigErrorsMetric,
   incrementWafRequestsMetric,
+  incrementRequestDurationMetrics,
   incrementMissingUserLoginMetric,
   incrementMissingUserIdMetric,
   incrementSdkEventMetric,

package/packages/dd-trace/src/appsec/telemetry/rasp.js

@@ -77,6 +77,21 @@ function trackRaspRuleMatch (store, raspRule, blockTriggered, blocked) {
   appsecMetrics.count('rasp.rule.match', tags).inc(1)
 }
 
+function incrementRaspDurationMetrics (requestMetrics) {
+  const { raspDuration, raspDurationExt, wafVersion, rulesVersion } = requestMetrics
+  if (!raspDuration && !raspDurationExt) return
+
+  const versionsTags = getVersionsTags(wafVersion, rulesVersion)
+
+  if (raspDuration) {
+    appsecMetrics.distribution('rasp.duration', versionsTags).track(raspDuration)
+  }
+
+  if (raspDurationExt) {
+    appsecMetrics.distribution('rasp.duration_ext', versionsTags).track(raspDurationExt)
+  }
+}
+
 function trackRaspRuleSkipped (raspRule, reason) {
   const tags = { reason, rule_type: raspRule.type }
 
@@ -100,4 +115,5 @@ module.exports = {
   trackRaspMetrics,
   trackRaspRuleMatch,
   trackRaspRuleSkipped,
+  incrementRaspDurationMetrics,
 }

package/packages/dd-trace/src/appsec/telemetry/waf.js

@@ -34,6 +34,14 @@ function addWafRequestMetrics (store, { duration, durationExt, wafTimeout, error
 function trackWafMetrics (store, metrics) {
   const versionsTags = getVersionsTags(metrics.wafVersion, metrics.rulesVersion)
 
+  const requestMetrics = store[DD_TELEMETRY_REQUEST_METRICS]
+  if (metrics.wafVersion) {
+    requestMetrics.wafVersion = metrics.wafVersion
+  }
+  if (metrics.rulesVersion) {
+    requestMetrics.rulesVersion = metrics.rulesVersion
+  }
+
   const metricTags = getOrCreateMetricTags(store, versionsTags)
 
   if (metrics.blockFailed) {
@@ -118,6 +126,21 @@ function incrementWafRequests (store) {
   }
 }
 
+function incrementWafDurationMetrics (requestMetrics) {
+  const { duration, durationExt, wafVersion, rulesVersion } = requestMetrics
+  if (!duration && !durationExt) return
+
+  const versionsTags = getVersionsTags(wafVersion, rulesVersion)
+
+  if (duration) {
+    appsecMetrics.distribution('waf.duration', versionsTags).track(duration)
+  }
+
+  if (durationExt) {
+    appsecMetrics.distribution('waf.duration_ext', versionsTags).track(durationExt)
+  }
+}
+
 function incrementTruncatedMetrics (metrics, truncationReason) {
   const truncationTags = { truncation_reason: truncationReason }
   appsecMetrics.count('waf.input_truncated', truncationTags).inc(1)
@@ -140,4 +163,5 @@ module.exports = {
   incrementWafUpdates,
   incrementWafConfigErrors,
   incrementWafRequests,
+  incrementWafDurationMetrics,
 }

package/packages/dd-trace/src/carrier.js

@@ -9,6 +9,23 @@ const FIELD_HAS = 4
 const FIELD_DELETE = 8
 const FIELD_NAME_LENGTH = 16
 
+const b3FlagsHeader = 'x-b3-flags'
+const b3Header = 'b3'
+const b3SampledHeader = 'x-b3-sampled'
+const b3SpanIdHeader = 'x-b3-spanid'
+const b3TraceIdHeader = 'x-b3-traceid'
+const baggageHeader = 'baggage'
+const datadogOriginHeader = 'x-datadog-origin'
+const datadogParentIdHeader = 'x-datadog-parent-id'
+const datadogSamplingPriorityHeader = 'x-datadog-sampling-priority'
+const datadogTagsHeader = 'x-datadog-tags'
+const datadogTraceIdHeader = 'x-datadog-trace-id'
+const dsmBase64Header = 'dd-pathway-ctx-base64'
+const dsmBinaryHeader = 'dd-pathway-ctx'
+const sqsdHeader = 'x-aws-sqsd-attr-_datadog'
+const traceparentHeader = 'traceparent'
+const tracestateHeader = 'tracestate'
+
 /** @type {Record<string, unknown>} */
 const carrierOperations = {}
 
@@ -24,7 +41,7 @@ const carrierOperations = {}
 /**
  * @template Value
  * @typedef {object} CarrierField
- * @property {(carrier: Carrier) => Value | undefined} read
+ * @property {((carrier: Carrier) => Value | undefined) | undefined} read
  * @property {(carrier: Carrier, value: Value) => void} write
  * @property {(carrier: Carrier) => boolean} has
  * @property {(carrier: Carrier) => void} delete
@@ -53,19 +70,13 @@ function defineCapability (name, operations, capability) {
  * @template Value
  * @param {string} fieldName
  * @param {string} headerName
- * @param {(value: unknown) => Value | undefined} resolve
+ * @param {((carrier: Carrier) => Value | undefined) | undefined} read
  * @param {number} operations
  * @returns {CarrierField<Value>}
  */
-function defineField (fieldName, headerName, resolve, operations) {
+function defineField (fieldName, headerName, read, operations) {
   return defineCapability(fieldName, operations, {
-    /**
-     * @param {Carrier} carrier
-     * @returns {Value | undefined}
-     */
-    read (carrier) {
-      return resolve(carrier[headerName])
-    },
+    read,
 
     /**
      * @param {Carrier} carrier
@@ -183,48 +194,96 @@ function readLastPathway (value) {
   return result
 }
 
+/** @param {Carrier} carrier */
+function readB3Flags (carrier) { return readLastText(carrier[b3FlagsHeader]) }
+
+/** @param {Carrier} carrier */
+function readB3 (carrier) { return readLastText(carrier[b3Header]) }
+
+/** @param {Carrier} carrier */
+function readB3Sampled (carrier) { return readLastText(carrier[b3SampledHeader]) }
+
+/** @param {Carrier} carrier */
+function readB3SpanId (carrier) { return readLastText(carrier[b3SpanIdHeader]) }
+
+/** @param {Carrier} carrier */
+function readB3TraceId (carrier) { return readLastText(carrier[b3TraceIdHeader]) }
+
+/** @param {Carrier} carrier */
+function readBaggage (carrier) { return readListText(carrier[baggageHeader]) }
+
+/** @param {Carrier} carrier */
+function readDatadogOrigin (carrier) { return readLastText(carrier[datadogOriginHeader]) }
+
+/** @param {Carrier} carrier */
+function readDatadogParentId (carrier) { return readLastText(carrier[datadogParentIdHeader]) }
+
+/** @param {Carrier} carrier */
+function readDatadogSamplingPriority (carrier) { return readLastText(carrier[datadogSamplingPriorityHeader]) }
+
+/** @param {Carrier} carrier */
+function readDatadogTags (carrier) { return readListText(carrier[datadogTagsHeader]) }
+
+/** @param {Carrier} carrier */
+function readDatadogTraceId (carrier) { return readLastText(carrier[datadogTraceIdHeader]) }
+
+/** @param {Carrier} carrier */
+function readDsmBase64 (carrier) { return readLastPathway(carrier[dsmBase64Header]) }
+
+/** @param {Carrier} carrier */
+function readDsmBinary (carrier) { return readLastPathway(carrier[dsmBinaryHeader]) }
+
+/** @param {Carrier} carrier */
+function readSqsd (carrier) { return readLastText(carrier[sqsdHeader]) }
+
+/** @param {Carrier} carrier */
+function readTraceparent (carrier) { return readUniqueText(carrier[traceparentHeader]) }
+
+/** @param {Carrier} carrier */
+function readTracestate (carrier) { return readListText(carrier[tracestateHeader]) }
+
 const datadogTraceId = defineField(
   'datadogTraceId',
-  'x-datadog-trace-id',
-  readLastText,
+  datadogTraceIdHeader,
+  readDatadogTraceId,
   FIELD_READ | FIELD_WRITE
 )
 const datadogParentId = defineField(
   'datadogParentId',
-  'x-datadog-parent-id',
-  readLastText,
+  datadogParentIdHeader,
+  readDatadogParentId,
   FIELD_READ | FIELD_WRITE | FIELD_DELETE
 )
 const datadogOrigin = defineField(
   'datadogOrigin',
-  'x-datadog-origin',
-  readLastText,
+  datadogOriginHeader,
+  readDatadogOrigin,
   FIELD_READ | FIELD_WRITE
 )
 const datadogSamplingPriority = defineField(
   'datadogSamplingPriority',
-  'x-datadog-sampling-priority',
-  readLastText,
+  datadogSamplingPriorityHeader,
+  readDatadogSamplingPriority,
   FIELD_READ | FIELD_WRITE
 )
-defineField('datadogTags', 'x-datadog-tags', readListText, FIELD_READ | FIELD_WRITE)
-defineField('baggage', 'baggage', readListText, FIELD_READ | FIELD_WRITE)
-const b3TraceId = defineField('b3TraceId', 'x-b3-traceid', readLastText, FIELD_READ | FIELD_WRITE)
-const b3SpanId = defineField('b3SpanId', 'x-b3-spanid', readLastText, FIELD_READ | FIELD_WRITE)
-const b3ParentId = defineField('b3ParentId', 'x-b3-parentspanid', readLastText, FIELD_WRITE)
-const b3Sampled = defineField('b3Sampled', 'x-b3-sampled', readLastText, FIELD_READ | FIELD_WRITE)
-const b3Flags = defineField('b3Flags', 'x-b3-flags', readLastText, FIELD_READ | FIELD_WRITE)
-const b3 = defineField('b3', 'b3', readLastText, FIELD_READ | FIELD_WRITE)
-defineField('sqsd', 'x-aws-sqsd-attr-_datadog', readLastText, FIELD_READ)
-const traceparent = defineField('traceparent', 'traceparent', readUniqueText, FIELD_READ | FIELD_WRITE)
-const tracestate = defineField('tracestate', 'tracestate', readListText, FIELD_READ | FIELD_WRITE)
+defineField('datadogTags', datadogTagsHeader, readDatadogTags, FIELD_READ | FIELD_WRITE)
+defineField('baggage', baggageHeader, readBaggage, FIELD_READ | FIELD_WRITE)
+const b3TraceId = defineField('b3TraceId', b3TraceIdHeader, readB3TraceId, FIELD_READ | FIELD_WRITE)
+const b3SpanId = defineField('b3SpanId', b3SpanIdHeader, readB3SpanId, FIELD_READ | FIELD_WRITE)
+const b3ParentId = defineField('b3ParentId', 'x-b3-parentspanid', undefined, FIELD_WRITE)
+const b3Sampled = defineField('b3Sampled', b3SampledHeader, readB3Sampled, FIELD_READ | FIELD_WRITE)
+const b3Flags = defineField('b3Flags', b3FlagsHeader, readB3Flags, FIELD_READ | FIELD_WRITE)
+const b3 = defineField('b3', b3Header, readB3, FIELD_READ | FIELD_WRITE)
+defineField('sqsd', sqsdHeader, readSqsd, FIELD_READ)
+const traceparent = defineField('traceparent', traceparentHeader, readTraceparent, FIELD_READ | FIELD_WRITE)
+const tracestate = defineField('tracestate', tracestateHeader, readTracestate, FIELD_READ | FIELD_WRITE)
 const dsmBase64 = defineField(
   'dsmBase64',
-  'dd-pathway-ctx-base64',
-  readLastPathway,
+  dsmBase64Header,
+  readDsmBase64,
   FIELD_READ | FIELD_WRITE | FIELD_HAS | FIELD_NAME_LENGTH
 )
-const dsmBinary = defineField('dsmBinary', 'dd-pathway-ctx', readLastPathway, FIELD_READ | FIELD_HAS)
+const dsmBinary = defineField('dsmBinary', dsmBinaryHeader, readDsmBinary, FIELD_READ | FIELD_HAS)
 
 const legacyBaggagePrefix = 'ot-baggage-'
 // RFC 7230 `token`, compatible with Node.js header-name validation.
@@ -314,23 +373,23 @@ function pickDsm (carrier) {
  * @property {typeof dsmBinary.has} hasDsmBinary
  * @property {typeof pickDsm} pickDsm
  * @property {typeof pickTextMap} pickTextMap
- * @property {(carrier: Carrier) => string | undefined} readBaggage
- * @property {typeof b3.read} readB3
- * @property {typeof b3Flags.read} readB3Flags
- * @property {typeof b3Sampled.read} readB3Sampled
- * @property {typeof b3SpanId.read} readB3SpanId
- * @property {typeof b3TraceId.read} readB3TraceId
- * @property {typeof datadogOrigin.read} readDatadogOrigin
- * @property {typeof datadogParentId.read} readDatadogParentId
- * @property {typeof datadogSamplingPriority.read} readDatadogSamplingPriority
- * @property {(carrier: Carrier) => string | undefined} readDatadogTags
- * @property {typeof datadogTraceId.read} readDatadogTraceId
- * @property {typeof dsmBase64.read} readDsmBase64
- * @property {typeof dsmBinary.read} readDsmBinary
+ * @property {typeof readBaggage} readBaggage
+ * @property {typeof readB3} readB3
+ * @property {typeof readB3Flags} readB3Flags
+ * @property {typeof readB3Sampled} readB3Sampled
+ * @property {typeof readB3SpanId} readB3SpanId
+ * @property {typeof readB3TraceId} readB3TraceId
+ * @property {typeof readDatadogOrigin} readDatadogOrigin
+ * @property {typeof readDatadogParentId} readDatadogParentId
+ * @property {typeof readDatadogSamplingPriority} readDatadogSamplingPriority
+ * @property {typeof readDatadogTags} readDatadogTags
+ * @property {typeof readDatadogTraceId} readDatadogTraceId
+ * @property {typeof readDsmBase64} readDsmBase64
+ * @property {typeof readDsmBinary} readDsmBinary
  * @property {(carrier: Carrier, target: Record<string, string>) => void} readLegacyBaggage
- * @property {(carrier: Carrier) => string | undefined} readSqsd
- * @property {typeof traceparent.read} readTraceparent
- * @property {typeof tracestate.read} readTracestate
+ * @property {typeof readSqsd} readSqsd
+ * @property {typeof readTraceparent} readTraceparent
+ * @property {typeof readTracestate} readTracestate
  * @property {(carrier: Carrier, value: string) => void} writeBaggage
  * @property {typeof b3.write} writeB3
  * @property {typeof b3Flags.write} writeB3Flags