dd-trace 6.16.0 → 6.18.0

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/sql-sensitive-analyzer.js

@@ -114,11 +114,10 @@ function digitRunEnd (value, from, length) {
 }
 
 /**
- * Handles plain integer and decimal literals. Exponents and radix literals defer to `NUMERIC`.
+ * Returns the end of a plain integer or decimal literal, or `-1` to delegate exponents and radix literals to `NUMERIC`.
  * @param {string} value
  * @param {number} intEnd Index after the integer digit run measured by the caller.
  * @param {number} length
- * @returns {number} Index after the literal, or `-1` to defer to the `NUMERIC` regex.
  */
 function scanPlainNumber (value, intEnd, length) {
   // A digit run touching `x`/`b` is a radix prefix (`0x`, `0b`) — let the regex own it.
@@ -177,7 +176,6 @@ const FALL_THROUGH = -2 // not a literal start -> advance one character and reco
  * @param {string} value
  * @param {number} from
  * @param {number} length
- * @returns {number} Index of the first line terminator at or after `from`, else `length`.
  */
 function lineEnd (value, from, length) {
   for (let i = from; i < length; i++) {
@@ -196,7 +194,6 @@ function lineEnd (value, from, length) {
  * @param {number} quote Char code of the opening delimiter, `'` or `"`.
  * @param {boolean} conservativeBackslash Whether an odd backslash before a closing quote makes the
  *   remainder ambiguous and therefore unterminated.
- * @returns {number} Index after the closing quote, or `UNTERMINATED`.
  */
 function scanQuotedDoubled (value, start, length, quote, conservativeBackslash) {
   let backslashCount = 0
@@ -229,7 +226,6 @@ function scanQuotedDoubled (value, start, length, quote, conservativeBackslash)
  * @param {number} length
  * @param {number} quote Char code of the opening delimiter, `'` or `"`.
  * @param {boolean} doubled Whether two adjacent quotes escape each other.
- * @returns {number} Index after the closing quote, or `UNTERMINATED`.
  */
 function scanQuotedBackslash (value, start, length, quote, doubled) {
   for (let i = start + 1; i < length; i++) {
@@ -269,12 +265,13 @@ function isPostgresEscapeString (value, quoteIndex) {
 /**
  * Oracle `q'X…X'`: `X` is one of `< ( { [` (closed by its mirror) or any other char (closed by
  * itself). The body may span line terminators.
+ * The result is the index after the closing `X'`.
+ * It is `FALL_THROUGH` when `q'` ends the value or is followed by a line terminator.
+ * Oracle forbids whitespace as the delimiter, so this case is a plain string instead of a quote opener.
+ * It is `UNTERMINATED` when no closing delimiter exists.
  * @param {string} value
  * @param {number} start
  * @param {number} length
- * @returns {number} Index after the closing `X'`; `FALL_THROUGH` when `q'` is at the end of the value
- *   or followed by a line terminator — Oracle forbids whitespace as the delimiter, so that `'` is a
- *   plain string, not a quote opener; or `UNTERMINATED`.
  */
 function scanOracleQuote (value, start, length) {
   const delimiter = value.charCodeAt(start + 2)
@@ -294,11 +291,12 @@ function scanOracleQuote (value, start, length) {
  * Postgres `$tag$ … $tag$`, where `tag` is empty or an identifier. The body may span line
  * terminators — PL/pgSQL function bodies routinely do, and treating a newline as the end of the
  * literal would leave the rest of a multi-line body unredacted.
+ * The result is the index after the closing tag.
+ * It is `FALL_THROUGH` when no second `$` exists.
+ * It is `UNTERMINATED` when the opening tag is malformed or has no close.
  * @param {string} value
  * @param {number} start
  * @param {number} length
- * @returns {number} Index after the closing tag; `FALL_THROUGH` when no second `$` exists; or
- *   `UNTERMINATED` when the opening tag is malformed or has no close.
  */
 function scanDollarQuote (value, start, length) {
   const tagEnd = value.indexOf('$', start + 1)

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-handler.js

@@ -24,8 +24,8 @@ const MAX_EVIDENCE_LENGTH = 32_768
 
 class SensitiveHandler {
   constructor () {
-    this._namePattern = new RegExp(/** @type {string} */ (defaults['iast.redactionNamePattern']), 'gmi')
-    this._valuePattern = new RegExp(/** @type {string} */ (defaults['iast.redactionValuePattern']), 'gmi')
+    this._namePattern = new RegExp(/** @type {string} */ (defaults['iast.DD_IAST_REDACTION_NAME_PATTERN']), 'gmi')
+    this._valuePattern = new RegExp(/** @type {string} */ (defaults['iast.DD_IAST_REDACTION_VALUE_PATTERN']), 'gmi')
 
     this._sensitiveAnalyzers = new Map()
     this._sensitiveAnalyzers.set(vulnerabilities.CODE_INJECTION, taintedRangeBasedSensitiveAnalyzer)

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/utils.js

@@ -13,7 +13,10 @@ const REGEX_FOR_STRINGIFY_SENSITIVE_NOT_STRING = new RegExp(String.raw`"${STRING
 const REGEX_FOR_STRINGIFY_SENSITIVE = new RegExp(String.raw`${STRINGIFY_SENSITIVE_KEY}_\d+_(\d+)_`)
 const REGEX_FOR_STRINGIFY_RANGE = new RegExp(String.raw`(${STRINGIFY_RANGE_KEY}_\d+_)`)
 
-const sensitiveValueRegex = new RegExp(/** @type {string} */ (defaults['iast.redactionValuePattern']), 'gmi')
+const sensitiveValueRegex = new RegExp(
+  /** @type {string} */ (defaults['iast.DD_IAST_REDACTION_VALUE_PATTERN']),
+  'gmi'
+)
 
 function iterateObject (target, fn, levelKeys = [], depth = 10, visited = new Set()) {
   for (const key of Object.keys(target)) {

package/packages/dd-trace/src/appsec/iast/vulnerability-reporter.js

@@ -138,15 +138,15 @@ function replaceCallSiteFromSourceMap (callsite) {
 }
 
 function start (config, _tracer) {
-  deduplicationEnabled = config.iast.deduplicationEnabled
-  stackTraceEnabled = config.iast.stackTrace.enabled
-  stackTraceMaxDepth = config.appsec.stackTrace.maxDepth
-  maxStackTraces = config.appsec.stackTrace.maxStackTraces
+  deduplicationEnabled = config.iast.DD_IAST_DEDUPLICATION_ENABLED
+  stackTraceEnabled = config.iast.DD_IAST_STACK_TRACE_ENABLED
+  stackTraceMaxDepth = config.appsec.DD_APPSEC_MAX_STACK_TRACE_DEPTH
+  maxStackTraces = config.appsec.DD_APPSEC_MAX_STACK_TRACES
 
   vulnerabilitiesFormatter.setRedactVulnerabilities(
-    config.iast.redactionEnabled,
-    config.iast.redactionNamePattern,
-    config.iast.redactionValuePattern
+    config.iast.DD_IAST_REDACTION_ENABLED,
+    config.iast.DD_IAST_REDACTION_NAME_PATTERN,
+    config.iast.DD_IAST_REDACTION_VALUE_PATTERN
   )
   if (deduplicationEnabled) {
     startClearCacheTimer()

package/packages/dd-trace/src/appsec/index.js

@@ -87,7 +87,7 @@ function enable (_config) {
     appsecTelemetry.enable(_config)
     graphql.enable()
 
-    if (_config.appsec.rasp.enabled) {
+    if (_config.appsec.DD_APPSEC_RASP_ENABLED) {
       rasp.enable(_config)
     }
 
@@ -101,7 +101,7 @@ function enable (_config) {
 
     apiSecurity.configure(_config)
 
-    UserTracking.setCollectionMode(_config.appsec.eventTracking.mode, false)
+    UserTracking.setCollectionMode(_config.appsec.DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE, false)
 
     httpRequest.setConfig(_config)
 

package/packages/dd-trace/src/appsec/lambda.js

@@ -11,6 +11,8 @@ const waf = require('./waf')
 
 const activeInvocations = new WeakMap()
 
+const MAX_RESPONSE_BODY_SIZE = 16 * 1024 * 1024
+
 /**
  * Maps pre-extracted HTTP data from the Lambda event to WAF addresses,
  * runs the WAF, and reports results on the span.
@@ -86,11 +88,12 @@ function onLambdaStartInvocation (data) {
  * WAF pass, disposes the WAF context, and finishes the request report.
  *
  * @param {{ span: object, statusCode: string | undefined,
- *           responseHeaders: Record<string, string> | undefined }} data
+ *           responseHeaders: Record<string, string> | undefined,
+ *           responseBody: unknown, isBase64Encoded: boolean | undefined }} data
  */
 function onLambdaEndInvocation (data) {
   try {
-    const { span, statusCode, responseHeaders } = data
+    const { span, statusCode, responseHeaders, responseBody, isBase64Encoded } = data
 
     if (!span) {
       log.warn('[ASM] No span provided in Lambda end invocation')
@@ -127,6 +130,11 @@ function onLambdaEndInvocation (data) {
 
       if (samplingDecision === apiSecurity.SamplingDecision.SAMPLE) {
         persistent[addresses.WAF_CONTEXT_PROCESSOR] = { 'extract-schema': true }
+
+        const parsedBody = parseResponseBody(responseBody, responseHeaders, isBase64Encoded)
+        if (parsedBody !== undefined) {
+          persistent[addresses.HTTP_INCOMING_RESPONSE_BODY] = parsedBody
+        }
       }
 
       let wafResult
@@ -147,6 +155,67 @@ function onLambdaEndInvocation (data) {
   }
 }
 
+/**
+ * Turns the raw response body published by the Lambda layer into the object the WAF expects
+ *
+ * @param {unknown} rawBody
+ * @param {Record<string, string> | undefined} headers Already lowercased by the Lambda layer
+ * @param {boolean | undefined} isBase64Encoded
+ * @returns {object | undefined} The parsed body, or `undefined` when it cannot be used
+ */
+function parseResponseBody (rawBody, headers, isBase64Encoded) {
+  if (!rawBody) return
+
+  // A handler that answered with the payload itself needs no parsing, and no content type either.
+  if (typeof rawBody === 'object') return rawBody
+
+  if (typeof rawBody !== 'string') return
+
+  if (!isJsonContentType(headers?.['content-type'])) return
+
+  if (isOverSizeCap(rawBody, isBase64Encoded)) {
+    log.debug('[ASM] Lambda response body larger than %d bytes, skipping schema extraction',
+      MAX_RESPONSE_BODY_SIZE)
+    return
+  }
+
+  const contentEncoding = headers?.['content-encoding']?.toLowerCase()
+  if (contentEncoding && contentEncoding !== 'identity') return
+
+  try {
+    const parsed = JSON.parse(isBase64Encoded ? Buffer.from(rawBody, 'base64').toString('utf8') : rawBody)
+
+    // A JSON scalar carries no schema worth extracting.
+    if (parsed === null || typeof parsed !== 'object') return
+
+    return parsed
+  } catch {
+    // The SyntaxError message embeds a fragment of the body, which is customer data.
+    log.debug('[ASM] Failed to parse Lambda response body')
+  }
+}
+
+/**
+ * @param {string | undefined} contentType
+ */
+function isJsonContentType (contentType) {
+  return typeof contentType === 'string' && contentType.toLowerCase().includes('json')
+}
+
+/**
+ * Tells whether a raw body exceeds the size cap, without decoding or measuring it when avoidable
+ *
+ * @param {string} rawBody
+ * @param {boolean | undefined} isBase64Encoded
+ */
+function isOverSizeCap (rawBody, isBase64Encoded) {
+  if (isBase64Encoded) return Math.floor(rawBody.length * 3 / 4) >= MAX_RESPONSE_BODY_SIZE
+  if (rawBody.length >= MAX_RESPONSE_BODY_SIZE) return true
+  if (rawBody.length * 3 < MAX_RESPONSE_BODY_SIZE) return false
+
+  return Buffer.byteLength(rawBody, 'utf8') >= MAX_RESPONSE_BODY_SIZE
+}
+
 module.exports = {
   onLambdaStartInvocation,
   onLambdaEndInvocation,

package/packages/dd-trace/src/appsec/rasp/utils.js

@@ -45,7 +45,11 @@ class DatadogRaspAbortError extends Error {
 function handleResult (result, req, res, abortController, config, raspRule) {
   const generateStackTraceAction = result?.actions?.generate_stack
 
-  const { enabled, maxDepth, maxStackTraces } = config.appsec.stackTrace
+  const {
+    DD_APPSEC_STACK_TRACE_ENABLED: enabled,
+    DD_APPSEC_MAX_STACK_TRACE_DEPTH: maxDepth,
+    DD_APPSEC_MAX_STACK_TRACES: maxStackTraces,
+  } = config.appsec
 
   const rootSpan = web.root(req)
 

package/packages/dd-trace/src/appsec/remote_config.js

@@ -43,7 +43,7 @@ function enable (rcInstance, config, appsec) {
           setCollectionMode(rcConfig.auto_user_instrum.mode)
           autoUserInstrumModeId = configId
         } else if (configId === autoUserInstrumModeId) {
-          setCollectionMode(config.appsec.eventTracking.mode)
+          setCollectionMode(config.appsec.DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE)
           autoUserInstrumModeId = null
         }
       }
@@ -68,7 +68,7 @@ function enableOrDisableAppsec (action, rcConfig, config, appsec) {
     const isRemoteConfigControlling = action === 'apply' || action === 'modify'
     const shouldEnable = isRemoteConfigControlling
       ? rcConfig.asm.enabled // take control
-      : config.appsec.enabled // give back control to local config
+      : config.appsec.DD_APPSEC_ENABLED // give back control to local config
 
     if (shouldEnable) {
       appsec.enable(config)
@@ -79,8 +79,10 @@ function enableOrDisableAppsec (action, rcConfig, config, appsec) {
     // TODO: Use configWithOrigin /generateTelemetry instead of manually constructing the change.
     updateConfig([
       {
-        name: 'appsec.enabled',
-        origin: isRemoteConfigControlling ? 'remote_config' : config.getOrigin('appsec.enabled'),
+        name: 'DD_APPSEC_ENABLED',
+        origin: isRemoteConfigControlling
+          ? 'remote_config'
+          : config.getOrigin('appsec.DD_APPSEC_ENABLED'),
         value: shouldEnable,
       },
     ], config)
@@ -93,7 +95,7 @@ function enableOrDisableAppsec (action, rcConfig, config, appsec) {
  * @param {object} appsecConfig - Appsec config
  */
 function enableWafUpdate (appsecConfig) {
-  if (rc && appsecConfig && !appsecConfig.rules) {
+  if (rc && appsecConfig && !appsecConfig.DD_APPSEC_RULES) {
     // dirty require to make startup faster for serverless
     const { ASM_WAF_PRODUCTS } = require('./rc-products')
     const RuleManager = require('./rule_manager')
@@ -119,7 +121,7 @@ function enableWafUpdate (appsecConfig) {
     rc.updateCapabilities(RemoteConfigCapabilities.ASM_TRACE_TAGGING_RULES, true)
     rc.updateCapabilities(RemoteConfigCapabilities.ASM_EXTENDED_DATA_COLLECTION, true)
 
-    if (appsecConfig.rasp?.enabled) {
+    if (appsecConfig.DD_APPSEC_RASP_ENABLED) {
       rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_SQLI, true)
       rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_SSRF, true)
       rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_LFI, true)

package/packages/dd-trace/src/appsec/reporter.js

@@ -8,7 +8,7 @@ const web = require('../plugins/util/web')
 const { ipHeaderList } = require('../plugins/util/ip_extractor')
 const { keepTrace } = require('../priority_sampler')
 const { ASM } = require('../standalone/product')
-const { isEmpty } = require('../util')
+const { isEmpty, truncateString } = require('../util')
 const { getActiveRequest } = require('./store')
 const {
   incrementWafInitMetric,
@@ -114,11 +114,15 @@ const NON_EXTENDED_REQUEST_HEADERS = new Set([...requestHeadersList, ...eventHea
 const NON_EXTENDED_RESPONSE_HEADERS = new Set(responseHeaderList)
 const REDACTED_HEADERS = new Set(redactedHeadersList)
 
+/**
+ * @param {import('../config/config-types').ConfigProperties['appsec']} _config
+ * @param {boolean} [inferredProxyServicesEnabled]
+ */
 function init (_config, inferredProxyServicesEnabled) {
-  config.headersExtendedCollectionEnabled = _config.extendedHeadersCollection.enabled
-  config.maxHeadersCollected = _config.extendedHeadersCollection.maxHeaders
-  config.headersRedaction = _config.extendedHeadersCollection.redaction
-  config.raspBodyCollection = _config.rasp.bodyCollection
+  config.headersExtendedCollectionEnabled = _config.DD_APPSEC_COLLECT_ALL_HEADERS
+  config.maxHeadersCollected = _config.DD_APPSEC_MAX_COLLECTED_HEADERS
+  config.headersRedaction = _config.DD_APPSEC_HEADER_COLLECTION_REDACTION_ENABLED
+  config.raspBodyCollection = _config.DD_APPSEC_RASP_COLLECT_REQUEST_BODY
   config.inferredProxyServicesEnabled = inferredProxyServicesEnabled
 }
 
@@ -431,7 +435,7 @@ function truncateRequestBody (target, depth = 0) {
   switch (typeof target) {
     case 'string':
       if (target.length > COLLECTED_REQUEST_BODY_MAX_STRING_LENGTH) {
-        return { value: target.slice(0, COLLECTED_REQUEST_BODY_MAX_STRING_LENGTH), truncated: true }
+        return { value: truncateString(target, COLLECTED_REQUEST_BODY_MAX_STRING_LENGTH), truncated: true }
       }
       return { value: target, truncated: false }
     case 'object': {

package/packages/dd-trace/src/appsec/rule_manager.js

@@ -20,15 +20,15 @@ let appliedActions = new Map()
  */
 
 /**
- * @typedef {import('./waf').WAFConfig & { rules?: string }} AppSecConfig
+ * @typedef {import('./waf').WAFConfig & { DD_APPSEC_RULES?: string }} AppSecConfig
  */
 
 /**
  * @param {AppSecConfig} config
  */
 function loadRules (config) {
-  const defaultRules = config.rules
-    ? JSON.parse(readFileSync(config.rules, 'utf8'))
+  const defaultRules = config.DD_APPSEC_RULES
+    ? JSON.parse(readFileSync(config.DD_APPSEC_RULES, 'utf8'))
     : require('./recommended.json')
 
   waf.init(defaultRules, config)

package/packages/dd-trace/src/appsec/sdk/track_event.js

@@ -14,7 +14,6 @@ const { getRootSpan } = require('./utils')
  * @param {import('../../tracer')} tracer
  * @param {import('../../../../../index').User} user
  * @param {Record<string, string>} [metadata]
- * @returns {void}
  */
 function trackUserLoginSuccessEvent (tracer, user, metadata) {
   // TODO: better user check here and in _setUser() ?
@@ -48,7 +47,6 @@ function trackUserLoginSuccessEvent (tracer, user, metadata) {
  * @param {string} userId
  * @param {boolean} exists
  * @param {Record<string, string>} [metadata]
- * @returns {void}
  */
 function trackUserLoginFailureEvent (tracer, userId, exists, metadata) {
   if (!userId || typeof userId !== 'string') {

package/packages/dd-trace/src/appsec/waf/index.js

@@ -25,7 +25,7 @@ let limiter = new Limiter(100)
 let WAFManager = null
 
 /**
- * @typedef {import('./waf_manager').WAFManagerConfig & { rateLimit: number }} WAFConfig
+ * @typedef {import('./waf_manager').WAFManagerConfig & { DD_APPSEC_TRACE_RATE_LIMIT: number }} WAFConfig
  */
 
 const waf = {
@@ -48,7 +48,7 @@ const waf = {
 function init (rules, config) {
   destroy()
 
-  limiter = new Limiter(config.rateLimit)
+  limiter = new Limiter(config.DD_APPSEC_TRACE_RATE_LIMIT)
 
   // Lazy loading improves the startup time
   WAFManager = require('./waf_manager')

package/packages/dd-trace/src/appsec/waf/waf_manager.js

@@ -8,9 +8,9 @@ const contexts = new WeakMap()
 
 /**
  * @typedef {object} WAFManagerConfig
- * @property {number} wafTimeout - Maximum time in microseconds for WAF execution
- * @property {string} obfuscatorKeyRegex - Regex to redact sensitive data by key
- * @property {string} obfuscatorValueRegex - Regex to redact sensitive data by value
+ * @property {number} DD_APPSEC_WAF_TIMEOUT - Maximum time in microseconds for WAF execution
+ * @property {string} DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP - Regex to redact sensitive data by key
+ * @property {string} DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP - Regex to redact sensitive data by value
  */
 
 class WAFManager {
@@ -22,7 +22,7 @@ class WAFManager {
    */
   constructor (rules, config) {
     this.config = config
-    this.wafTimeout = config.wafTimeout
+    this.wafTimeout = config.DD_APPSEC_WAF_TIMEOUT
     this.ddwaf = this._loadDDWAF(rules)
     this.rulesVersion = this.ddwaf.diagnostics.ruleset_version
     this.defaultRules = rules
@@ -36,7 +36,10 @@ class WAFManager {
       const { DDWAF } = require('@datadog/native-appsec')
       this.ddwafVersion = DDWAF.version()
 
-      const { obfuscatorKeyRegex, obfuscatorValueRegex } = this.config
+      const {
+        DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP: obfuscatorKeyRegex,
+        DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP: obfuscatorValueRegex,
+      } = this.config
       return new DDWAF(rules, WAFManager.defaultWafConfigPath, { obfuscatorKeyRegex, obfuscatorValueRegex })
     } catch (err) {
       this.ddwafVersion ||= 'unknown'

package/packages/dd-trace/src/carrier.js

@@ -81,7 +81,6 @@ function defineField (fieldName, headerName, read, operations) {
     /**
      * @param {Carrier} carrier
      * @param {Value} value
-     * @returns {void}
      */
     write (carrier, value) {
       carrier[headerName] = value
@@ -89,7 +88,6 @@ function defineField (fieldName, headerName, read, operations) {
 
     /**
      * @param {Carrier} carrier
-     * @returns {boolean}
      */
     has (carrier) {
       return headerName in carrier
@@ -97,7 +95,6 @@ function defineField (fieldName, headerName, read, operations) {
 
     /**
      * @param {Carrier} carrier
-     * @returns {void}
      */
     delete (carrier) {
       delete carrier[headerName]
@@ -106,7 +103,6 @@ function defineField (fieldName, headerName, read, operations) {
     /**
      * @param {Carrier} carrier
      * @param {Carrier} target
-     * @returns {void}
      */
     copy (carrier, target) {
       if (Object.hasOwn(carrier, headerName)) target[headerName] = carrier[headerName]
@@ -308,7 +304,6 @@ defineCapability('legacyBaggage', FIELD_READ | FIELD_WRITE, {
   /**
    * @param {Carrier} carrier
    * @param {Record<string, string>} target
-   * @returns {void}
    */
   read (carrier, target) {
     for (const name of Object.keys(carrier)) {

package/packages/dd-trace/src/ci-visibility/dynamic-atr-retries.js

@@ -0,0 +1,104 @@
+'use strict'
+
+const log = require('../log')
+
+const {
+  retriesForDuration,
+  retryBucketIndexForDuration,
+} = require('./efd-retry-policy')
+
+const DYNAMIC_ATR_ENABLED_ENV = 'DD_CIVISIBILITY_DYNAMIC_ATR_ENABLED'
+const DYNAMIC_ATR_BUCKETS_ENV = 'DD_CIVISIBILITY_DYNAMIC_ATR_BUCKETS'
+
+const RETRY_BUCKET_COUNT = 5
+const MAX_RETRIES_PER_BUCKET = 20
+
+/**
+ * Returns whether duration-based ATR retry budgets are enabled.
+ *
+ * @param {unknown} value A parsed test-optimization configuration value.
+ */
+function isDynamicAtrEnabled (value) {
+  return value === true
+}
+
+/**
+ * Parses and validates custom ATR retry buckets from the parsed
+ * test-optimization configuration.
+ *
+ * Returns a frozen array of 5 positive integers in [1, 20], or `null`
+ * when the value is unset/empty or invalid (in which case the EFD retry
+ * settings from the backend are used).
+ *
+ * @param {unknown} value A parsed test-optimization configuration value.
+ * @returns {number[] | null}
+ */
+function getDynamicAtrBuckets (value) {
+  if (!Array.isArray(value) || value.length === 0) {
+    return null
+  }
+
+  const parts = value
+  const raw = parts.join(',')
+  if (parts.length !== RETRY_BUCKET_COUNT) {
+    log.warn(
+      'Invalid %s value %o; expected five comma-separated integers in [1, %d]',
+      DYNAMIC_ATR_BUCKETS_ENV, raw, MAX_RETRIES_PER_BUCKET
+    )
+    return null
+  }
+
+  const buckets = []
+  for (const part of parts) {
+    const trimmedPart = typeof part === 'string' ? part.trim() : ''
+    if (!/^\d+$/.test(trimmedPart)) {
+      log.warn(
+        'Invalid %s value %o; expected five comma-separated integers in [1, %d]',
+        DYNAMIC_ATR_BUCKETS_ENV, raw, MAX_RETRIES_PER_BUCKET
+      )
+      return null
+    }
+    const value = Number(trimmedPart)
+    if (!Number.isSafeInteger(value) || value < 1 || value > MAX_RETRIES_PER_BUCKET) {
+      log.warn(
+        'Invalid %s value %o; expected five comma-separated integers in [1, %d]',
+        DYNAMIC_ATR_BUCKETS_ENV, raw, MAX_RETRIES_PER_BUCKET
+      )
+      return null
+    }
+    buckets.push(value)
+  }
+
+  return Object.freeze(buckets)
+}
+
+/**
+ * Computes the dynamic ATR retry count for a test based on its initial-attempt
+ * duration.
+ *
+ * When `customBuckets` is provided, the bucket at the duration index is used.
+ * Otherwise, the EFD retry policy's `retriesForDuration` is used.
+ *
+ * The result is clamped to a minimum of 1.
+ *
+ * @param {number} durationMs - Initial-attempt duration in milliseconds.
+ * @param {import('./efd-retry-policy').EfdRetryPolicy} efdRetryPolicy
+ * @param {number[] | null} customBuckets
+ */
+function getDynamicAtrRetryCount (durationMs, efdRetryPolicy, customBuckets) {
+  let retryCount
+  if (customBuckets) {
+    retryCount = customBuckets[retryBucketIndexForDuration(durationMs)]
+  } else {
+    retryCount = retriesForDuration(durationMs, efdRetryPolicy)
+  }
+  return Math.max(1, retryCount)
+}
+
+module.exports = {
+  DYNAMIC_ATR_BUCKETS_ENV,
+  DYNAMIC_ATR_ENABLED_ENV,
+  getDynamicAtrBuckets,
+  getDynamicAtrRetryCount,
+  isDynamicAtrEnabled,
+}

package/packages/dd-trace/src/ci-visibility/dynamic-instrumentation/worker/index.js

@@ -52,7 +52,6 @@ const limits = {
 
 /**
  * @param {object} value - Snapshot object or sub-object.
- * @returns {boolean}
  */
 function isCapturedValue (value) {
   return typeof value.type === 'string'
@@ -62,7 +61,6 @@ function isCapturedValue (value) {
  * Remove empty capture containers before sending snapshots through the Test Optimization logs path.
  *
  * @param {object} value - Snapshot object or sub-object.
- * @returns {void}
  */
 function removeEmptyCaptureProperties (value) {
   const stack = [value]

package/packages/dd-trace/src/ci-visibility/efd-retry-policy.js

@@ -23,12 +23,43 @@ const EARLY_FLAKE_DETECTION_RETRY_BUCKETS =
  * @property {number} schedulingRetryCount
  */
 
+/**
+ * Returns the zero-based dynamic ATR retry-bucket index for a test duration.
+ *
+ * Bucket boundaries (ms): 5 000, 10 000, 30 000, 300 000.
+ * Durations at a boundary remain in that bucket.
+ *
+ * @param {number} durationMs
+ */
+function retryBucketIndexForDuration (durationMs) {
+  for (let index = 0; index < EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS.length; index++) {
+    if (durationMs <= EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS[index].limitMs) {
+      return index
+    }
+  }
+  return EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS.length // > 5 m bucket
+}
+
+/**
+ * Returns the backend retry budget using dynamic ATR's inclusive duration cutoffs.
+ *
+ * @param {number} durationMs
+ * @param {EfdRetryPolicy} retryPolicy
+ */
+function retriesForDuration (durationMs, retryPolicy) {
+  const index = retryBucketIndexForDuration(durationMs)
+  if (index < retryPolicy.durationRetryCounts.length) {
+    return retryPolicy.durationRetryCounts[index].retryCount
+  }
+  return 0
+}
+
 /**
  * @param {number} durationMs
  * @param {EfdRetryPolicy} retryPolicy
- * @returns {number}
  */
 function getEfdRetryCountForDuration (durationMs, retryPolicy) {
+  // EFD retains exclusive cutoffs, including no retries at exactly five minutes.
   for (const { durationLimitMs, retryCount } of retryPolicy.durationRetryCounts) {
     if (durationMs < durationLimitMs) {
       return retryCount
@@ -62,7 +93,6 @@ function createEfdRetryPolicy (retriesByDuration = {}) {
 
 /**
  * @param {EfdRetryPolicy | undefined} retryPolicy
- * @returns {boolean}
  */
 function hasEfdRetries (retryPolicy) {
   return (retryPolicy?.schedulingRetryCount ?? 0) > 0
@@ -71,7 +101,6 @@ function hasEfdRetries (retryPolicy) {
 /**
  * @param {number} retryIndex
  * @param {number | undefined} retryCount
- * @returns {boolean}
  */
 function shouldSkipEfdRetry (retryIndex, retryCount) {
   return retryCount !== undefined && retryIndex > retryCount
@@ -85,5 +114,7 @@ module.exports = {
   createEfdRetryPolicy,
   getEfdRetryCountForDuration,
   hasEfdRetries,
+  retriesForDuration,
+  retryBucketIndexForDuration,
   shouldSkipEfdRetry,
 }

package/packages/dd-trace/src/ci-visibility/exporters/agentless/coverage-writer.js

@@ -36,7 +36,6 @@ class Writer extends BaseWriter {
    *
    * @param {(error?: Error) => void} [done]
    * @param {{ deadline?: number }} [options]
-   * @returns {void}
    */
   flush (done, options) {
     this.#requestTracker.flush(done, options)