From e0e9c6347c177eb56cc3209206a5d5b108395195 Mon Sep 17 00:00:00 2001
From: Roch Devost <roch.devost@datadoghq.com>
Date: Fri, 26 Jun 2026 16:41:31 -0400
Subject: [PATCH 01/51] ci(release): fix publish by dropping dist-tag add
 (#9100)

The OIDC-exchanged token from the npm registry is only valid for the
publish operation; using it for npm dist-tag add produced E401. Remove
the multi-tag logic and the OIDC exchange entirely: each branch now
publishes with a single tag (latest for the current release line,
latest-nodeXX for older lines), which is all npm's trusted publishing
model supports without a stored token.

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/release.yml | 48 ++++++++++-------------------------
 1 file changed, 13 insertions(+), 35 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b826335d65..414ef18549 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,16 +16,16 @@ jobs:
   setup:
     if: github.event_name == 'push'
     runs-on: ubuntu-latest
-    # Space-separated npm dist-tags for each release line.
-    # The latest branch always gets "latest" prepended automatically.
+    # npm dist-tag for each release line.
+    # The latest branch always gets "latest" automatically.
     # Add a line here when creating a new release branch.
     env:
       DIST_TAGS: |
         v3.x latest-node14
         v4.x latest-node16
-        v5.x latest-node18 latest-node20
+        v5.x latest-node18
     outputs:
-      npm_tags: ${{ steps.compute.outputs.npm_tags }}
+      npm_tag: ${{ steps.compute.outputs.npm_tag }}
       is_latest: ${{ steps.compute.outputs.is_latest }}
     steps:
       - id: compute
@@ -47,18 +47,18 @@ jobs:
             | sort -V \
             | tail -1)
 
-          # Collect the tags defined for this branch (everything after the branch name)
-          branch_tags=$(echo "$DIST_TAGS" | awk -v b="$branch" '$1==b{$1=""; sub(/^ /,""); print}')
+          # Collect the tag defined for this branch (field after the branch name)
+          branch_tag=$(echo "$DIST_TAGS" | awk -v b="$branch" '$1==b{print $2}')
 
           if [ "$branch" = "$latest" ]; then
-            npm_tags="latest ${branch_tags:-latest-${branch%.x}}"
+            npm_tag="latest"
             is_latest="true"
           else
-            npm_tags="${branch_tags:-latest-${branch%.x}}"
+            npm_tag="${branch_tag:-latest-${branch%.x}}"
             is_latest="false"
           fi
 
-          echo "npm_tags=$npm_tags" >> "$GITHUB_OUTPUT"
+          echo "npm_tag=$npm_tag" >> "$GITHUB_OUTPUT"
           echo "is_latest=$is_latest" >> "$GITHUB_OUTPUT"
 
   publish:
@@ -88,28 +88,11 @@ jobs:
       - name: Publish
         run: |
           version="${{ fromJson(steps.pkg.outputs.json).version }}"
-          tags=(${{ needs.setup.outputs.npm_tags }})
-
-          # Exchange the GitHub OIDC token for an npm registry token so
-          # that npm publish and npm dist-tag add share the same auth.
-          # npm only runs this exchange internally for publish (oidc.js:141)
-          # and does not persist the token, so dist-tag add would fail
-          # without doing it explicitly here.
-          # Audience format and exchange endpoint from npm/lib/utils/oidc.js.
-          oidc_token=$(curl -sS -fH \
-            "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
-            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=npm:registry.npmjs.org" \
-            | jq -r '.value')
-          npm_token=$(curl -sS -fX POST \
-            -H "Authorization: Bearer $oidc_token" \
-            -H "Content-Type: application/json" \
-            "https://registry.npmjs.org/-/npm/v1/oidc/token/exchange/package/dd-trace" \
-            | jq -r '.token')
-          export NODE_AUTH_TOKEN="$npm_token"
+          tag="${{ needs.setup.outputs.npm_tag }}"
 
           # Idempotent: skip publish if this version already exists so
-          # that a rerun after a partial failure can still repair dist-tags,
-          # git tags, release notes, and docs.
+          # that a rerun after a partial failure can still repair the git
+          # tag and release notes.
           if npm view "dd-trace@$version" version 2>/dev/null | grep -qF "$version"; then
             local_integrity=$(npm pack --dry-run --json 2>/dev/null | jq -r '.[0].integrity')
             published_integrity=$(npm view "dd-trace@$version" dist.integrity 2>/dev/null)
@@ -121,13 +104,8 @@ jobs:
             fi
             echo "Version $version already published with identical content, skipping npm publish"
           else
-            npm publish --tag "${tags[0]}"
+            npm publish --tag "$tag"
           fi
-
-          # Always reconcile all expected dist-tags.
-          for tag in "${tags[@]:1}"; do
-            npm dist-tag add "dd-trace@$version" "$tag"
-          done
       - name: Tag release
         run: |
           version="${{ fromJson(steps.pkg.outputs.json).version }}"

From 9144415a6e943c2252d16a1f1be03ca9a35dd8b1 Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Fri, 26 Jun 2026 22:59:55 +0200
Subject: [PATCH 02/51] ci(coverage): merge per-integration coverage in All
 Green before upload (#9086)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Each test cell uploaded its own report to Codecov, so a commit sent ~430
uploads. Codecov silently parks uploads past its ~150-per-commit ceiling in
`started` and never merges them, so roughly 40 reports' worth of coverage was
dropped from every commit. The Datadog coverage upload was separately broken:
`upload-coverage-artifact` probed for files with `find -maxdepth 1`, but the
report lives one level deeper at `coverage/node-<version>/`, so the check found
nothing, no `coverage-*` artifact was produced, and `datadog-ci coverage
upload` reported nothing while passing green.

All Green already downloads every `coverage-*` artifact to drive the Datadog
upload, so it is the one place that sees a whole commit's coverage. It now
groups the per-cell reports by integration and uploads ~100 groups to both
backends instead of ~430 per-cell reports:

1. `upload-coverage-artifact` recurses for the report files and names each
   artifact `coverage-<flag>__<job>-<index>` so matrix cells that share a flag
   (cypress varies `spec` outside its flag) stop clobbering each other.
2. `scripts/group-coverage.mjs` sorts each cell's report into its integration's
   directory, stripping Node.js and library versions, which are noise for
   "which integration regressed". Reports are not merged locally — both
   backends merge same-flag uploads server-side — so each report passes through
   byte-for-byte and the harness needs no istanbul dependency in All Green's
   sparse checkout. ~430 cells collapse to ~100 groups.
3. Each cell emits both lcov and istanbul JSON: Codecov reads branch and
   function coverage from the JSON (its lcov parser ingests only line hits),
   Datadog reads the lcov and does not ingest the JSON. All Green uploads each
   format to the backend that reads it, one group per integration, flagged with
   the integration name.

`master-coverage` still rides every Codecov upload on PRs targeting master so
the `codecov/patch` gate fires; reruns de-duplicate to the newest run so a
stale rerun's counters are not double-counted.
---
 .github/actions/coverage/action.yml           |  26 +-
 .github/actions/coverage/upload/action.yml    |  51 ----
 .../upload-coverage-artifact/action.yml       |  36 ++-
 .github/workflows/all-green.yml               |  55 +++-
 nyc.config.js                                 |   4 +
 package.json                                  |   2 +-
 scripts/group-coverage.mjs                    | 244 ++++++++++++++++++
 scripts/group-coverage.spec.mjs               | 169 ++++++++++++
 8 files changed, 508 insertions(+), 79 deletions(-)
 delete mode 100644 .github/actions/coverage/upload/action.yml
 create mode 100644 scripts/group-coverage.mjs
 create mode 100644 scripts/group-coverage.spec.mjs

diff --git a/.github/actions/coverage/action.yml b/.github/actions/coverage/action.yml
index d01ceef7cd..3f481b05b4 100644
--- a/.github/actions/coverage/action.yml
+++ b/.github/actions/coverage/action.yml
@@ -1,9 +1,13 @@
 name: coverage
-description: Verify coverage output and upload it to Codecov and Datadog.
+description: >-
+  Verify a job's coverage output and stash it as an artifact. All Green collects every
+  `coverage-*` artifact, merges them per integration, and uploads the groups to Codecov and
+  Datadog — so a commit sends ~100 grouped reports instead of one per matrix cell, which kept
+  Codecov from silently dropping uploads past its per-commit ceiling.
 
 inputs:
   flags:
-    description: "Codecov flags value"
+    description: "Coverage flags — the grouping key All Green folds matrix cells by"
     required: false
   report-dir:
     description: "Coverage report directory (defaults to 'coverage')"
@@ -12,19 +16,13 @@ inputs:
 runs:
   using: composite
   steps:
-    # Retry once on failure to work around transient issues (e.g. flaky
-    # Codecov upload network calls).
-    - id: attempt
-      uses: ./.github/actions/coverage/upload
-      continue-on-error: true
-      with:
-        flags: ${{ inputs.flags }}
-        report-dir: ${{ inputs.report-dir }}
-    - if: steps.attempt.outcome == 'failure'
+    - name: Verify coverage output
       shell: bash
-      run: sleep 60
-    - if: steps.attempt.outcome == 'failure'
-      uses: ./.github/actions/coverage/upload
+      run: node scripts/verify-coverage.js --flags "${{ inputs.flags }}"
+
+    - name: Upload coverage artifact
+      if: always()
+      uses: ./.github/actions/upload-coverage-artifact
       with:
         flags: ${{ inputs.flags }}
         report-dir: ${{ inputs.report-dir }}
diff --git a/.github/actions/coverage/upload/action.yml b/.github/actions/coverage/upload/action.yml
deleted file mode 100644
index f74f03241d..0000000000
--- a/.github/actions/coverage/upload/action.yml
+++ /dev/null
@@ -1,51 +0,0 @@
-name: Coverage Upload
-description: Internal implementation; verify and upload coverage. Use `./.github/actions/coverage` instead.
-
-inputs:
-  flags:
-    description: "Codecov flags value"
-    required: false
-  report-dir:
-    description: "Coverage report directory (defaults to 'coverage')"
-    required: false
-    default: coverage
-
-runs:
-  using: composite
-  steps:
-    - name: Verify coverage output
-      shell: bash
-      run: node scripts/verify-coverage.js --flags "${{ inputs.flags }}"
-
-    # `master-coverage` is the flag .codecov.yml gates codecov/patch on. Attach
-    # it only on PRs targeting master so release-branch PRs auto-pass.
-    - name: Compute Codecov flags
-      id: codecov-flags
-      shell: bash
-      env:
-        JOB_FLAGS: ${{ inputs.flags }}
-        EVENT_NAME: ${{ github.event_name }}
-        BASE_REF: ${{ github.base_ref }}
-      run: |
-        flags="$JOB_FLAGS"
-        if [ "$EVENT_NAME" = "pull_request" ] && [ "$BASE_REF" = "master" ]; then
-          flags="${flags:+$flags,}master-coverage"
-        fi
-        echo "value=$flags" >> "$GITHUB_OUTPUT"
-
-    - name: Install gpg for Codecov validation
-      if: runner.os == 'Linux'
-      shell: bash
-      run: command -v gpg || sudo apt-get install -y gpg
-
-    - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
-      with:
-        flags: ${{ steps.codecov-flags.outputs.value }}
-
-    - name: Upload coverage artifact
-      if: always()
-      uses: ./.github/actions/upload-coverage-artifact
-      with:
-        flags: ${{ inputs.flags }}
-        report-dir: ${{ inputs.report-dir }}
diff --git a/.github/actions/upload-coverage-artifact/action.yml b/.github/actions/upload-coverage-artifact/action.yml
index b29903dc8e..cbb4b9ed47 100644
--- a/.github/actions/upload-coverage-artifact/action.yml
+++ b/.github/actions/upload-coverage-artifact/action.yml
@@ -1,9 +1,9 @@
 name: Upload Coverage Artifact
-description: Upload coverage report as a GitHub Actions artifact for later collection
+description: Upload a job's LCOV report as a GitHub Actions artifact for All Green to collect and group.
 
 inputs:
   flags:
-    description: Coverage flags — used as artifact identifier and passed to Datadog on upload
+    description: Coverage flags — the grouping key All Green folds matrix cells by
     required: true
   report-dir:
     description: Coverage report directory
@@ -13,26 +13,38 @@ inputs:
 runs:
   using: composite
   steps:
+    # The reports live at `<report-dir>/node-<version>-<label>/{lcov.info,coverage-final.json}`, one
+    # level below `report-dir`, so the presence check has to recurse — a top-level-only probe finds
+    # nothing and silently skips the upload, which is what starved the Datadog coverage upload.
+    # Both formats ship: Codecov reads branch/function coverage from the istanbul JSON, Datadog from
+    # the lcov.
     - id: check
       shell: bash
       run: |
-        count=$(find "${{ inputs.report-dir }}" -maxdepth 1 -type f 2>/dev/null | wc -l | tr -d ' ')
-        echo "has_files=$([ "$count" -gt 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
-    - if: steps.check.outputs.has_files == 'true'
+        count=$(find "${{ inputs.report-dir }}" \( -name lcov.info -o -name coverage-final.json \) -type f 2>/dev/null | wc -l | tr -d ' ')
+        echo "has_coverage=$([ "$count" -gt 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+    # The artifact name carries the grouping flag plus a per-cell suffix (`__<job>-<matrix-index>`)
+    # so matrix cells that share a flag — cypress varies `spec` outside its flag — upload distinct
+    # artifacts instead of clobbering each other under one name.
+    - if: github.actor != 'dependabot[bot]' && steps.check.outputs.has_coverage == 'true'
       id: upload
       continue-on-error: true
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
-        name: coverage-${{ inputs.flags }}
-        path: ${{ inputs.report-dir }}
+        name: coverage-${{ inputs.flags }}__${{ github.job }}-${{ strategy.job-index }}
+        path: |
+          ${{ inputs.report-dir }}/**/lcov.info
+          ${{ inputs.report-dir }}/**/coverage-final.json
         retention-days: 1
-    - if: steps.check.outputs.has_files == 'true' && steps.upload.outcome == 'failure'
+    - if: github.actor != 'dependabot[bot]' && steps.check.outputs.has_coverage == 'true' && steps.upload.outcome == 'failure'
       shell: bash
       run: sleep 10
-    - if: steps.check.outputs.has_files == 'true' && steps.upload.outcome == 'failure'
+    - if: github.actor != 'dependabot[bot]' && steps.check.outputs.has_coverage == 'true' && steps.upload.outcome == 'failure'
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
-        name: coverage-${{ inputs.flags }}
-        path: ${{ inputs.report-dir }}
-        overwrite: true
+        name: coverage-${{ inputs.flags }}__${{ github.job }}-${{ strategy.job-index }}
+        path: |
+          ${{ inputs.report-dir }}/**/lcov.info
+          ${{ inputs.report-dir }}/**/coverage-final.json
         retention-days: 1
+        overwrite: true
diff --git a/.github/workflows/all-green.yml b/.github/workflows/all-green.yml
index 113a2ffe54..b49f9bd3f1 100644
--- a/.github/workflows/all-green.yml
+++ b/.github/workflows/all-green.yml
@@ -40,6 +40,12 @@ jobs:
           GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
           POLLING_INTERVAL: 1
           RETRIES: 20
+      # Sort every downloaded per-cell `coverage-*` artifact into one directory per integration under
+      # `coverage-upload/<group>/{lcov,json}/`. The reports are not merged here — both backends merge
+      # same-flag uploads server-side — so each cell's report passes through byte-for-byte. Codecov
+      # gets the istanbul JSON (carries branch/function coverage), Datadog gets the lcov.
+      - if: "!cancelled()"
+        run: node scripts/group-coverage.mjs
       - if: "!cancelled()"
         uses: ./.github/actions/dd-sts-api-key
         id: dd-sts
@@ -49,7 +55,54 @@ jobs:
         run: datadog-ci junit upload --service dd-trace-js-tests --auto-discovery junit-results
         env:
           DD_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
+      # One Datadog upload per integration, flagged with the integration name so coverage is
+      # attributable in the Datadog UI the same way the Codecov flags attribute it. Datadog reads the
+      # lcov reports; it does not ingest istanbul's JSON.
       - if: "!cancelled()"
-        run: datadog-ci coverage upload coverage-results
+        run: |
+          set -o pipefail
+          shopt -s nullglob
+          # shellcheck disable=SC2016 # the inner shell must expand "$1", not the template.
+          printf '%s\0' coverage-upload/*/lcov/ | xargs -0 -r -P 10 -I {} \
+            bash -c 'datadog-ci coverage upload "$1" --flags "$(basename "$(dirname "$1")")"' _ {}
         env:
           DD_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
+      # One Codecov upload per integration via the CLI directly — the codecov-action would re-validate
+      # and re-download the uploader once per group (~100×). Codecov reads branch/function coverage
+      # from the istanbul JSON, so the upload points at each group's `json/` subdirectory.
+      # `master-coverage` is the flag `.codecov.yml` gates `codecov/patch` on; attach it only on PRs
+      # targeting master so release-branch PRs auto-pass. The SHA/branch/PR are passed explicitly
+      # because All Green checks out the merge ref, not the head the other workflows reported coverage
+      # for. No token: the repo uploads tokenless (a Codecov token would have to be an org secret,
+      # which forks can't read).
+      - if: "!cancelled()"
+        run: |
+          commit_args=(--sha "$HEAD_SHA" --branch "$HEAD_BRANCH")
+          upload_args=(--sha "$HEAD_SHA")
+          if [ -n "$PR_NUMBER" ]; then
+            commit_args+=(--pr "$PR_NUMBER")
+            upload_args+=(--pr "$PR_NUMBER")
+          fi
+          master_flag=()
+          if [ "$GITHUB_EVENT_NAME" = "pull_request" ] && [ "$BASE_REF" = "master" ]; then
+            master_flag=(-F master-coverage)
+          fi
+          shopt -s nullglob
+          groups=(coverage-upload/*/json/)
+          [ ${#groups[@]} -gt 0 ] || exit 0
+          pip install --quiet codecov-cli
+          # create-commit and create-report set up the report once and must finish before any upload;
+          # only the do-upload fan-out is safe to parallelize.
+          codecovcli create-commit "${commit_args[@]}"
+          codecovcli create-report --sha "$HEAD_SHA"
+          set -o pipefail
+          # shellcheck disable=SC2016 # the inner shell must expand "$@"/"$dir", not the template.
+          printf '%s\0' "${groups[@]}" | xargs -0 -r -P 10 -I {} \
+            bash -c 'dir="$1"; shift; codecovcli do-upload "$@" --dir "$dir" -F "$(basename "$(dirname "$dir")")"' \
+              _ {} "${upload_args[@]}" "${master_flag[@]}"
+        env:
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.base_ref }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          HEAD_BRANCH: ${{ github.head_ref || github.ref_name }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
diff --git a/nyc.config.js b/nyc.config.js
index e3d9c8a28b..d07861ee66 100644
--- a/nyc.config.js
+++ b/nyc.config.js
@@ -16,6 +16,10 @@ module.exports = {
   reporter: [
     'text',
     'lcov',
+    // Codecov reads branch and function coverage from istanbul's native JSON via its NodeProcessor;
+    // its lcov parser only ingests line hits. Datadog accepts the lcov, so All Green uploads each
+    // format to the backend that reads it best.
+    'json',
   ],
   include: [
     '**/ext/**/*.{js,mjs}',
diff --git a/package.json b/package.json
index 19e1d475c9..d317a02211 100644
--- a/package.json
+++ b/package.json
@@ -104,7 +104,7 @@
     "test:integration:plugins:coverage": "yarn services && node ./integration-tests/coverage/run-suite.js \"packages/datadog-plugin-@(${PLUGINS})/test/integration-test/**/${SPEC:-*}*.spec.js\"",
     "test:unit:plugins": "mocha \"packages/datadog-instrumentations/test/@(${PLUGINS}).spec.js\" \"packages/datadog-plugin-@(${PLUGINS})/test/**/*.spec.js\" --exclude \"packages/datadog-plugin-@(${PLUGINS})/test/integration-test/**/*.spec.js\"",
     "test:release": "mocha \"scripts/release/**/*.spec.js\"",
-    "test:scripts": "mocha \"scripts/helpers/**/*.spec.js\"",
+    "test:scripts": "mocha \"scripts/helpers/**/*.spec.js\" \"scripts/*.spec.mjs\"",
     "test:shimmer": "mocha \"packages/datadog-shimmer/test/**/*.spec.js\"",
     "test:shimmer:ci": "nyc --silent node init && nyc -- npm run test:shimmer",
     "verify:workflow-job-names": "node scripts/verify-workflow-job-names.js",
diff --git a/scripts/group-coverage.mjs b/scripts/group-coverage.mjs
new file mode 100644
index 0000000000..b7df77c38a
--- /dev/null
+++ b/scripts/group-coverage.mjs
@@ -0,0 +1,244 @@
+import { copyFileSync, mkdirSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { argv } from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+/* eslint-disable no-console */
+
+// Sorts the per-cell `coverage-*` artifacts that `download-artifacts.mjs` placed under
+// `coverage-results/` into one directory per integration under `coverage-upload/<group>/`, so the
+// All Green upload steps send ~100 grouped reports to Codecov/Datadog instead of ~430. Codecov
+// silently parks uploads past its ~150-per-commit ceiling in `started` (never merged), so the
+// cell-per-upload model dropped coverage; one upload per integration stays under the ceiling.
+//
+// The reports are not merged here — both backends merge same-flag uploads server-side, so this only
+// routes each cell's already-patched `lcov.info` into its group's directory. That keeps the harness
+// free of any istanbul dependency in All Green's sparse checkout and passes each report through
+// byte-for-byte, so the `getLineCoverage` patch the producers baked in survives untouched.
+
+const INPUT_DIR = 'coverage-results'
+const OUTPUT_DIR = 'coverage-upload'
+const ARTIFACT_PREFIX = 'coverage-'
+// `upload-coverage-artifact` names each cell `coverage-<flag>__<job>-<job-index>`; the `__` separates
+// the grouping flag from the per-cell uniqueness suffix so two matrix cells sharing a flag (cypress
+// varies `spec` outside its flag) still upload distinct artifacts instead of clobbering each other.
+const UNIQUE_SEPARATOR = '__'
+
+// Tokens that name a Node.js major, a library version, or a runtime/OS/module-format axis — all
+// noise for "which integration regressed". Stripping every noise token folds a flag like
+// `apm-integrations-next-oldest-14.2.6` down to its integration `apm-integrations-next`.
+const NOISE_TOKENS = new Set([
+  'latest', 'oldest', 'eol', 'active', 'maintenance', 'all', // Node.js / range_clean aliases
+  'ubuntu', 'macos', 'windows', // runner OS
+  'commonjs', 'esm', // module format
+])
+// A bare version (`14.2.6`, `18`) or a `range_clean` qualifier that packs the operator and version
+// into one dash-token (`gte.5.2.0`, `gte.6.16.0.and.lt.7.0.0`).
+const VERSION_RE = /^(?:gte|gt|lte|lt|eq)?\.?\d+(?:\.\d+)*(?:\.(?:and|or|gte|gt|lte|lt|eq)\b.*)?$/
+
+// Keep a busy area's one-cell libraries from each becoming their own upload: pack them into buckets
+// of at most this many libraries, named for their members so the flag still points at a library.
+const MAX_LIBS_PER_BUCKET = 3
+// Codecov validates flags against `^[\w\.\-]{1,45}$` and silently drops any that fail. `+` is out, so
+// members join with `_`; a name longer than this falls back to a numbered bucket that stays valid.
+const MAX_FLAG_LENGTH = 45
+
+/**
+ * @param {string} token
+ * @returns {boolean}
+ */
+function isNoiseToken (token) {
+  return NOISE_TOKENS.has(token.toLowerCase()) || VERSION_RE.test(token)
+}
+
+/**
+ * The integration a per-cell flag belongs to, with every version/OS/tier/format token removed
+ * wherever it sits. Node.js tier and library version commonly land in the middle of a flag (e.g.
+ * `serverless-aws-sdk-oldest-s3`, where `oldest` is the Node.js tier and `s3` a real sub-suite of
+ * the one `aws-sdk` integration), so a tail-only strip would leave the tier stranded mid-flag.
+ *
+ * @param {string} flag
+ * @returns {string}
+ */
+function integrationOf (flag) {
+  const tokens = flag.split('-').filter(token => !isNoiseToken(token))
+  return tokens.length > 0 ? tokens.join('-') : flag
+}
+
+/**
+ * The Codecov flag carried by an artifact name, dropping the `coverage-` prefix and the
+ * `__<unique>` cell-uniqueness suffix.
+ *
+ * @param {string} artifact
+ * @returns {string}
+ */
+function flagOf (artifact) {
+  const withoutPrefix = artifact.slice(ARTIFACT_PREFIX.length)
+  const separator = withoutPrefix.indexOf(UNIQUE_SEPARATOR)
+  return separator === -1 ? withoutPrefix : withoutPrefix.slice(0, separator)
+}
+
+// Codecov reads branch/function coverage from istanbul's JSON; Datadog only ingests the lcov. Each
+// report is routed by format into its own subdirectory so the two upload steps search the one their
+// backend reads. The extension marks which.
+const REPORTS = new Map([
+  ['lcov.info', 'lcov'],
+  ['coverage-final.json', 'json'],
+])
+
+/**
+ * Recursively collect coverage report files beneath a directory, paired with the artifact instance
+ * (run-id + name) they came from and their format. `download-artifacts.mjs` lays files out as
+ * `coverage-results/<run-id>/<artifact-name>/...`; a single artifact can hold more than one report
+ * per format (a cell that ran coverage across several Node.js versions writes one set per version),
+ * so the run-id distinguishes a rerun's reupload from those siblings.
+ *
+ * @param {string} dir
+ * @param {Array<{ runId: string, name: string, format: string, reportPath: string }>} out
+ * @param {{ runId?: string, name?: string }} context
+ * @returns {Array<{ runId: string, name: string, format: string, reportPath: string }>}
+ */
+function collectCoverageFiles (dir, out = [], context = {}) {
+  let entries
+  try {
+    entries = readdirSync(dir, { withFileTypes: true })
+  } catch {
+    return out
+  }
+  for (const entry of entries) {
+    const full = join(dir, entry.name)
+    if (entry.isDirectory()) {
+      const runId = context.runId ?? entry.name
+      const name = context.runId === undefined ? undefined : (context.name ?? entry.name)
+      collectCoverageFiles(full, out, { runId, name })
+    } else if (REPORTS.has(entry.name) && context.name?.startsWith(ARTIFACT_PREFIX)) {
+      out.push({ runId: context.runId, name: context.name, format: REPORTS.get(entry.name), reportPath: full })
+    }
+  }
+  return out
+}
+
+/**
+ * Assign each integration to an upload group. Integrations exercised by more than one cell stay on
+ * their own; the one-cell tail of a busy area is packed into buckets named for their libraries, or a
+ * numbered bucket when those names would overrun Codecov's flag length limit.
+ *
+ * @param {Map<string, string[]>} cellsByIntegration  Integration → artifact names feeding it.
+ * @returns {Map<string, string[]>}  Group flag → integrations it owns.
+ */
+function planGroups (cellsByIntegration) {
+  const groups = new Map()
+  const singletonsByArea = new Map()
+
+  for (const [integration, cells] of cellsByIntegration) {
+    if (cells.length > 1) {
+      groups.set(integration, [integration])
+      continue
+    }
+    const area = integration.split('-')[0]
+    const list = singletonsByArea.get(area)
+    if (list) {
+      list.push(integration)
+    } else {
+      singletonsByArea.set(area, [integration])
+    }
+  }
+
+  for (const [area, integrations] of singletonsByArea) {
+    integrations.sort()
+    if (integrations.length <= 2) {
+      for (const integration of integrations) {
+        groups.set(integration, [integration])
+      }
+      continue
+    }
+    let bucket = 0
+    for (let i = 0; i < integrations.length; i += MAX_LIBS_PER_BUCKET) {
+      const chunk = integrations.slice(i, i + MAX_LIBS_PER_BUCKET)
+      const named = `${area}-${chunk.map(integration => integration.slice(area.length + 1)).join('_')}`
+      groups.set(named.length <= MAX_FLAG_LENGTH ? named : `${area}-bucket-${bucket}`, chunk)
+      bucket++
+    }
+  }
+
+  return groups
+}
+
+/**
+ * Reduce discovered report files to one cell per artifact name and bucket the cells by integration.
+ * All Green reruns failed workflows, so the same artifact name can arrive from more than one run;
+ * the newest run reflects the cell's final state, so older reuploads are dropped.
+ *
+ * @param {Array<{ runId: string, name: string, format: string, reportPath: string }>} files
+ * @returns {{ groups: Map<string, string[]>,
+ *   reportsByArtifact: Map<string, Array<{ format: string, reportPath: string }>>,
+ *   cellsByIntegration: Map<string, string[]> }}
+ */
+function planCoverageGroups (files) {
+  const newestRunByArtifact = new Map()
+  for (const { runId, name } of files) {
+    const previous = newestRunByArtifact.get(name)
+    if (previous === undefined || Number(runId) > Number(previous)) {
+      newestRunByArtifact.set(name, runId)
+    }
+  }
+
+  const reportsByArtifact = new Map()
+  const cellsByIntegration = new Map()
+  for (const { runId, name, format, reportPath } of files) {
+    if (runId !== newestRunByArtifact.get(name)) continue
+    const existing = reportsByArtifact.get(name)
+    if (existing) {
+      existing.push({ format, reportPath })
+      continue
+    }
+    reportsByArtifact.set(name, [{ format, reportPath }])
+    const integration = integrationOf(flagOf(name))
+    const owned = cellsByIntegration.get(integration)
+    if (owned) {
+      owned.push(name)
+    } else {
+      cellsByIntegration.set(integration, [name])
+    }
+  }
+
+  return { groups: planGroups(cellsByIntegration), reportsByArtifact, cellsByIntegration }
+}
+
+function main () {
+  rmSync(OUTPUT_DIR, { force: true, recursive: true })
+
+  const files = collectCoverageFiles(INPUT_DIR)
+  if (files.length === 0) {
+    console.log(`No coverage reports found under ${INPUT_DIR}/.`)
+    return
+  }
+
+  const { groups, reportsByArtifact, cellsByIntegration } = planCoverageGroups(files)
+
+  console.log(`Routing ${reportsByArtifact.size} cell report set(s) into ${groups.size} group(s):`)
+  for (const [flag, integrations] of [...groups].sort()) {
+    const counts = new Map()
+    for (const integration of integrations) {
+      for (const artifact of cellsByIntegration.get(integration)) {
+        for (const { format, reportPath } of reportsByArtifact.get(artifact)) {
+          const index = counts.get(format) ?? 0
+          const formatDir = join(OUTPUT_DIR, flag, format)
+          mkdirSync(formatDir, { recursive: true })
+          copyFileSync(reportPath, join(formatDir, `${artifact}-${index}.${format}`))
+          counts.set(format, index + 1)
+        }
+      }
+    }
+    const summary = [...counts].map(([format, count]) => `${count} ${format}`).join(', ')
+    console.log(`  ${flag} (${integrations.length} integration(s): ${summary})`)
+  }
+
+  writeFileSync(join(OUTPUT_DIR, 'groups.txt'), [...groups.keys()].sort().join('\n') + '\n')
+}
+
+export { flagOf, integrationOf, planCoverageGroups, planGroups }
+
+if (argv[1] === fileURLToPath(import.meta.url)) {
+  main()
+}
diff --git a/scripts/group-coverage.spec.mjs b/scripts/group-coverage.spec.mjs
new file mode 100644
index 0000000000..9d743fb516
--- /dev/null
+++ b/scripts/group-coverage.spec.mjs
@@ -0,0 +1,169 @@
+import assert from 'node:assert/strict'
+
+import { describe, it } from 'mocha'
+
+import { flagOf, integrationOf, planCoverageGroups, planGroups } from './group-coverage.mjs'
+
+/**
+ * One cell's discovered report set: a `lcov` and a `json` entry per Node.js version the cell ran.
+ *
+ * @param {string} name
+ * @param {object} [options]
+ * @param {string} [options.runId]
+ * @param {number} [options.versions]  Number of Node.js versions the cell ran (one report set each).
+ * @returns {Array<{ runId: string, name: string, format: string, reportPath: string }>}
+ */
+function files (name, { runId = '1', versions = 1 } = {}) {
+  const out = []
+  for (let version = 0; version < versions; version++) {
+    const dir = `coverage-results/${runId}/${name}/node-2${version}-x`
+    out.push(
+      { runId, name, format: 'lcov', reportPath: `${dir}/lcov.info` },
+      { runId, name, format: 'json', reportPath: `${dir}/coverage-final.json` }
+    )
+  }
+  return out
+}
+
+describe('group-coverage', () => {
+  describe('integrationOf', () => {
+    it('strips a Node.js major from the tail', () => {
+      assert.equal(integrationOf('apm-integrations-kafkajs-18'), 'apm-integrations-kafkajs')
+    })
+
+    it('strips a library version and its range qualifier', () => {
+      assert.equal(integrationOf('apm-integrations-aerospike-20-gte.5.2.0'), 'apm-integrations-aerospike')
+    })
+
+    it('strips Node.js tier, library version, and module format together', () => {
+      assert.equal(integrationOf('test-optimization-cypress-latest-14.5.4-esm'), 'test-optimization-cypress')
+      assert.equal(integrationOf('test-optimization-cypress-oldest-12.0.0-commonJS'), 'test-optimization-cypress')
+    })
+
+    it('strips a trailing OS token', () => {
+      assert.equal(integrationOf('appsec-windows'), 'appsec')
+    })
+
+    it('keeps an integration that carries no version axis', () => {
+      assert.equal(integrationOf('apm-integrations-dns'), 'apm-integrations-dns')
+    })
+
+    it('strips a Node.js tier stranded mid-flag while keeping the meaningful sub-suite', () => {
+      // `serverless-aws-sdk-${node-version}-${spec}`: the tier (oldest/latest) is noise, but the
+      // sub-suite (s3, dynamodb) names a real slice of the aws-sdk integration worth its own group.
+      assert.equal(integrationOf('serverless-aws-sdk-oldest-s3'), 'serverless-aws-sdk-s3')
+      assert.equal(integrationOf('serverless-aws-sdk-latest-dynamodb'), 'serverless-aws-sdk-dynamodb')
+    })
+
+    it('never strips the area when every token looks like noise', () => {
+      assert.equal(integrationOf('latest'), 'latest')
+    })
+  })
+
+  describe('flagOf', () => {
+    it('drops the coverage- prefix', () => {
+      assert.equal(flagOf('coverage-appsec-express'), 'appsec-express')
+    })
+
+    it('drops the per-cell uniqueness suffix after the separator', () => {
+      assert.equal(flagOf('coverage-test-optimization-cypress-latest-14.5.4-esm__integration-cypress-7'),
+        'test-optimization-cypress-latest-14.5.4-esm')
+    })
+  })
+
+  describe('planGroups', () => {
+    it('keeps a multi-cell integration as its own group', () => {
+      const groups = planGroups(new Map([['apm-integrations-next', ['a', 'b', 'c']]]))
+      assert.deepEqual([...groups], [['apm-integrations-next', ['apm-integrations-next']]])
+    })
+
+    it('leaves a small singleton tail (<=2) standalone', () => {
+      const groups = planGroups(new Map([
+        ['serverless-lambda', ['a']],
+        ['serverless-azure', ['b']],
+      ]))
+      assert.deepEqual(groups.get('serverless-lambda'), ['serverless-lambda'])
+      assert.deepEqual(groups.get('serverless-azure'), ['serverless-azure'])
+    })
+
+    it('buckets a busy singleton tail into library-named groups of at most three', () => {
+      const singletons = ['plugins-axios', 'plugins-redis', 'plugins-pino', 'plugins-fs', 'plugins-net']
+      const groups = planGroups(new Map(singletons.map(name => [name, ['cell']])))
+      assert.deepEqual([...groups.keys()].sort(), ['plugins-axios_fs_net', 'plugins-pino_redis'])
+      assert.deepEqual(groups.get('plugins-axios_fs_net'), ['plugins-axios', 'plugins-fs', 'plugins-net'])
+      for (const integrations of groups.values()) {
+        assert.ok(integrations.length <= 3, 'no bucket exceeds three integrations')
+      }
+    })
+
+    it('keeps every generated bucket flag valid for Codecov and within its length limit', () => {
+      // Codecov rejects any flag that does not match `^[\w\.\-]{1,45}$`, so a bucket name may carry
+      // only word characters, `.` and `-`, and must stay <= 45 chars. The verbose `apm-integrations`
+      // tail blows past 45 once three members join, so the overflow path must fall back to a valid
+      // bounded name rather than ship a flag Codecov drops.
+      const singletons = [
+        'apm-integrations-aerospike', 'apm-integrations-couchbase', 'apm-integrations-elasticsearch',
+        'apm-integrations-mongodb', 'apm-integrations-opensearch',
+      ]
+      const groups = planGroups(new Map(singletons.map(name => [name, ['cell']])))
+      for (const flag of groups.keys()) {
+        assert.match(flag, /^[\w.-]{1,45}$/, `flag ${flag} is a valid Codecov flag`)
+      }
+    })
+
+    it('joins short bucket members with an underscore so the flag stays valid', () => {
+      const groups = planGroups(new Map([
+        ['plugins-a', ['cell']], ['plugins-b', ['cell']], ['plugins-c', ['cell']],
+      ]))
+      assert.deepEqual([...groups.keys()], ['plugins-a_b_c'])
+    })
+  })
+
+  describe('planCoverageGroups', () => {
+    it('keeps only the newest run when a rerun reuploads the same artifact name', () => {
+      const { reportsByArtifact } = planCoverageGroups([
+        ...files('coverage-plugins-axios__a-0', { runId: '100' }),
+        ...files('coverage-plugins-axios__a-0', { runId: '205' }),
+      ])
+      const reports = reportsByArtifact.get('coverage-plugins-axios__a-0')
+      assert.ok(reports.every(report => report.reportPath.includes('/205/')), 'only the newest run survives')
+    })
+
+    it('compares run ids numerically across a digit-length boundary', () => {
+      // A lexicographic compare keeps the older run when the rerun crosses a power-of-ten boundary
+      // (`'9' > '10'` is true as strings), silently uploading the stale failed run's coverage.
+      const { reportsByArtifact } = planCoverageGroups([
+        ...files('coverage-plugins-axios__a-0', { runId: '9' }),
+        ...files('coverage-plugins-axios__a-0', { runId: '10' }),
+      ])
+      const reports = reportsByArtifact.get('coverage-plugins-axios__a-0')
+      assert.ok(reports.every(report => report.reportPath.includes('/10/')), 'the newer run wins numerically')
+    })
+
+    it('keeps both formats across every Node.js version a single artifact carries', () => {
+      const { reportsByArtifact } = planCoverageGroups(files('coverage-plugins-axios__a-0', { versions: 2 }))
+      const reports = reportsByArtifact.get('coverage-plugins-axios__a-0')
+      assert.equal(reports.filter(report => report.format === 'lcov').length, 2)
+      assert.equal(reports.filter(report => report.format === 'json').length, 2)
+    })
+
+    it('folds cells that share a flag but carry distinct uniqueness suffixes', () => {
+      // Cypress varies `spec` outside its flag: eight specs per (version, cypress-version, module)
+      // upload distinct artifacts that all belong to the one cypress integration.
+      const { groups, cellsByIntegration } = planCoverageGroups([
+        ...files('coverage-test-optimization-cypress-latest-latest-esm__integration-cypress-0'),
+        ...files('coverage-test-optimization-cypress-latest-latest-esm__integration-cypress-1'),
+      ])
+      assert.deepEqual([...groups], [['test-optimization-cypress', ['test-optimization-cypress']]])
+      assert.equal(cellsByIntegration.get('test-optimization-cypress').length, 2)
+    })
+
+    it('folds distinct version cells into one integration', () => {
+      const { groups } = planCoverageGroups([
+        ...files('coverage-apm-integrations-next-11.1.4__integration-next-0'),
+        ...files('coverage-apm-integrations-next-15.0.0__integration-next-1'),
+      ])
+      assert.deepEqual([...groups], [['apm-integrations-next', ['apm-integrations-next']]])
+    })
+  })
+})

From dc50cad8c8e03e82d822295f93bedf67771d5319 Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Fri, 26 Jun 2026 23:01:09 +0200
Subject: [PATCH 03/51] test(kafkajs): stop pinning the produce offset in the
 sendBatch test (#9074)

The "should emit one kafka.produce span per topicMessages entry" test
hard-coded kafka.messages.offsets to start_offset "0". Kafka produce is
at-least-once: a transient NOT_LEADER_FOR_PARTITION right after topic
creation makes kafkajs retry and advance the broker-assigned base offset
past 0, so the span faithfully reports a non-zero offset (CI observed
"1") and the assertion never matched before the timeout. The expected
offsets are read back from the sendBatch result instead, which still
pins the per-topic isolation the test was written for.

Each topicMessages entry is its own root span, so the two spans are
separate traces the agent may deliver in a single payload in any order;
the span lookup now scans every trace rather than only traces[0].
---
 .../datadog-plugin-kafkajs/test/index.spec.js | 77 +++++++++++++++----
 1 file changed, 63 insertions(+), 14 deletions(-)

diff --git a/packages/datadog-plugin-kafkajs/test/index.spec.js b/packages/datadog-plugin-kafkajs/test/index.spec.js
index 796882bee1..2082406c17 100644
--- a/packages/datadog-plugin-kafkajs/test/index.spec.js
+++ b/packages/datadog-plugin-kafkajs/test/index.spec.js
@@ -350,14 +350,17 @@ describe('Plugin', () => {
 
           it('should emit one kafka.produce span per topicMessages entry', async () => {
             // Per-topic offset isolation: the broker returns one aggregated
-            // response covering every topic in the batch; each span must tag
-            // only its own topic's (partition, offset) entries.
-            const topicAOffsets = JSON.stringify([{ partition: 0, start_offset: '0' }])
-            const topicBOffsets = JSON.stringify([{ partition: 0, start_offset: '0' }])
+            // response covering every topic; each span must tag only its own
+            // topic's entries. The base offset is broker state (a retried
+            // NOT_LEADER_FOR_PARTITION right after topic creation advances it
+            // past 0), so it is compared against the send result rather than
+            // hard-coded. Each entry is its own root span, so it can land in
+            // any trace of any payload.
+            let topicASpan
+            let topicBSpan
 
             const topicASpanPromise = agent.assertSomeTraces(traces => {
-              const span = traces[0].find(s =>
-                s.name === expectedSchema.send.opName && s.resource === topicA)
+              const span = findProduceSpan(traces, topicA)
               assert.ok(span, `no kafka.produce span for ${topicA}`)
               assertObjectContains(span, {
                 service: expectedSchema.send.serviceName,
@@ -367,31 +370,38 @@ describe('Plugin', () => {
                   'messaging.destination.name': topicA,
                   'messaging.kafka.bootstrap.servers': '127.0.0.1:9092',
                   'kafka.cluster_id': testKafkaClusterId,
-                  'kafka.messages.offsets': topicAOffsets,
                 },
                 metrics: { 'kafka.batch_size': 1 },
                 error: 0,
               })
+              topicASpan = span
             })
 
             const topicBSpanPromise = agent.assertSomeTraces(traces => {
-              const span = traces[0].find(s =>
-                s.name === expectedSchema.send.opName && s.resource === topicB)
+              const span = findProduceSpan(traces, topicB)
               assert.ok(span, `no kafka.produce span for ${topicB}`)
               assertObjectContains(span, {
                 resource: topicB,
-                meta: { 'kafka.messages.offsets': topicBOffsets },
                 metrics: { 'kafka.batch_size': 2 },
                 error: 0,
               })
+              topicBSpan = span
             })
 
-            await sendBatch(kafka, [
-              { topic: topicA, messages: [{ key: 'a', value: 'msg-a' }] },
-              { topic: topicB, messages: [{ key: 'b1', value: 'msg-b1' }, { key: 'b2', value: 'msg-b2' }] },
+            let result
+            await Promise.all([
+              topicASpanPromise,
+              topicBSpanPromise,
+              (async () => {
+                result = await sendBatch(kafka, [
+                  { topic: topicA, messages: [{ key: 'a', value: 'msg-a' }] },
+                  { topic: topicB, messages: [{ key: 'b1', value: 'msg-b1' }, { key: 'b2', value: 'msg-b2' }] },
+                ])
+              })(),
             ])
 
-            return Promise.all([topicASpanPromise, topicBSpanPromise])
+            assert.strictEqual(topicASpan.meta['kafka.messages.offsets'], offsetsTag(result, topicA))
+            assert.strictEqual(topicBSpan.meta['kafka.messages.offsets'], offsetsTag(result, topicB))
           })
 
           it('should emit one span for a single-topic sendBatch (mirrors send)', async () => {
@@ -875,3 +885,42 @@ async function sendBatch (kafka, topicMessages) {
   await producer.disconnect()
   return result
 }
+
+/**
+ * sendBatch emits one independent root span per topicMessages entry, so the two
+ * spans are separate traces the agent may deliver in one payload in any order.
+ * Scan every trace, not just `traces[0]`.
+ *
+ * @param {Array<Array<object>>} traces
+ * @param {string} topic
+ */
+function findProduceSpan (traces, topic) {
+  for (const trace of traces) {
+    for (const span of trace) {
+      if (span.name === expectedSchema.send.opName && span.resource === topic) {
+        return span
+      }
+    }
+  }
+}
+
+/**
+ * The `kafka.messages.offsets` tag the producer span should carry for one topic,
+ * derived from the broker's aggregated sendBatch response. Mirrors the plugin's
+ * per-topic filter so the expectation tracks the broker's real (retry-advanced)
+ * offsets instead of assuming a fresh topic starts at 0.
+ *
+ * @param {Array<{ topicName: string, partition: number, offset?: string, baseOffset?: string }>} result
+ * @param {string} topic
+ */
+function offsetsTag (result, topic) {
+  const offsets = []
+  for (const record of result) {
+    if (record.topicName !== topic) continue
+    const offset = record.offset ?? record.baseOffset
+    if (record.partition === undefined || offset === undefined) continue
+    offsets.push({ partition: record.partition, start_offset: String(offset) })
+  }
+  offsets.sort((a, b) => a.partition - b.partition)
+  return JSON.stringify(offsets)
+}

From 911c3c84dd8a330dd776612379234c661810e043 Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Fri, 26 Jun 2026 23:01:42 +0200
Subject: [PATCH 04/51] test: key plugin version folders by single-digit major
 (#9052)

Key each expanded major by its bare major (`versions/mongodb@3`) instead of a
bounded range (`versions/mongodb@>=3.0.0 <4.0.0`). The bare major reads cleanly
as a folder name and covers each major's latest, including the floor major's,
which the range form dropped. Follows the shared resolver from #9019.

Widening the matrix to every major's latest surfaced several latent failures:

1. A bare-major key resolves to that major's newest version, so a range ending
   inside its top major overshoots: microgateway-core `>=2.1 <=3.0.0` keyed `3`
   installed 3.3.7 and the span came back `web.request` instead of
   `microgateway.request`. The top major keeps the declared range whenever it
   stops short of the major's ceiling; fully-spanned and lower majors stay bare.
2. `versions/ai@4` and `@langchain/core@0` resolve to versions that have no VCR
   cassette and would hit the live API (401). A central `brokenVersions`
   registry drops a matching resolved version and surfaces the reason as a
   pending test, each entry a stop-gap carrying a TODO.
3. A manifest carrying a `workspace:` protocol dependency was copied verbatim
   into a generated workspace, so yarn failed with "Couldn't find any versions
   for X that matches workspace:*". Fall back to the pinned compatible version.
4. The Apollo fetch-failure test gated the error span on `version > '2.3.0'`, a
   lexicographic compare that breaks once the key is bare (`'2' > '2.3.0'` is
   false). Compare the resolved version with `semver.gt`.
5. Single-digit keying renames folders that several specs hard-code by range
   (express, langchain, bedrock runtime, aws-sdk). The bedrock require threw
   after `agent.load` with no `agent.close`, leaving the Remote Config poll
   running and hanging the job to the 45-minute timeout; the others silently
   skipped suites. Point the requires at the renamed folders.
---
 .../test/express-mongo-sanitize.spec.js       |   2 +-
 .../test/express-multi-version.spec.js        |   2 +-
 .../datadog-plugin-apollo/test/index.spec.js  |   5 +-
 .../test/bedrockruntime.spec.js               |   2 +-
 .../test/index.spec.js                        |   2 +-
 .../plugins/aws-sdk/bedrockruntime.spec.js    |   2 +-
 .../llmobs/plugins/langchain/index.spec.js    |   2 +-
 .../dd-trace/test/plugins/versions.spec.js    |  98 +++++++++-----
 .../dd-trace/test/plugins/versions/index.js   | 126 ++++++++++++++++--
 packages/dd-trace/test/setup/mocha.js         |  12 +-
 scripts/install_plugin_modules.js             |  15 ++-
 11 files changed, 206 insertions(+), 62 deletions(-)

diff --git a/packages/datadog-instrumentations/test/express-mongo-sanitize.spec.js b/packages/datadog-instrumentations/test/express-mongo-sanitize.spec.js
index 48a35656ff..bbf83023a3 100644
--- a/packages/datadog-instrumentations/test/express-mongo-sanitize.spec.js
+++ b/packages/datadog-instrumentations/test/express-mongo-sanitize.spec.js
@@ -25,7 +25,7 @@ describe('express-mongo-sanitize', () => {
         // Highest version of express that supports express-mongo-sanitize is <5 (express 5 makes req.query a
         // getter-only property). The unversioned `versions/express` folder tracks the latest express (now 5.x), so
         // pin the <5 range that externals.js installs for this plugin.
-        const express = require('../../../versions/express@>=4 <5').get()
+        const express = require('../../../versions/express@4').get()
         const expressMongoSanitize = require(`../../../versions/express-mongo-sanitize@${version}`).get()
         const app = express()
 
diff --git a/packages/datadog-instrumentations/test/express-multi-version.spec.js b/packages/datadog-instrumentations/test/express-multi-version.spec.js
index 70f1d7746a..c8eaada44c 100644
--- a/packages/datadog-instrumentations/test/express-multi-version.spec.js
+++ b/packages/datadog-instrumentations/test/express-multi-version.spec.js
@@ -11,7 +11,7 @@ const { after, afterEach, before, beforeEach, describe, it } = require('mocha')
 const agent = require('../../dd-trace/test/plugins/agent')
 
 const express4Dir = join(__dirname, '..', '..', '..', 'versions', 'express@4')
-const express5Dir = join(__dirname, '..', '..', '..', 'versions', 'express@>=5.0.0')
+const express5Dir = join(__dirname, '..', '..', '..', 'versions', 'express@5')
 
 const describeOrSkip = existsSync(express4Dir) && existsSync(express5Dir)
   ? describe
diff --git a/packages/datadog-plugin-apollo/test/index.spec.js b/packages/datadog-plugin-apollo/test/index.spec.js
index 1345c371ac..1fd48cb5e0 100644
--- a/packages/datadog-plugin-apollo/test/index.spec.js
+++ b/packages/datadog-plugin-apollo/test/index.spec.js
@@ -4,6 +4,7 @@ const assert = require('node:assert/strict')
 const { inspect } = require('node:util')
 
 const axios = require('axios')
+const semver = require('semver')
 const sinon = require('sinon')
 
 const { ERROR_MESSAGE, ERROR_TYPE, ERROR_STACK } = require('../../dd-trace/src/constants.js')
@@ -74,7 +75,7 @@ describe('Plugin', () => {
   }
 
   describe('@apollo/gateway', () => {
-    withVersions('apollo', '@apollo/gateway', version => {
+    withVersions('apollo', '@apollo/gateway', (version, moduleName, resolvedVersion) => {
       after(() => {
         return agent.close()
       })
@@ -419,7 +420,7 @@ describe('Plugin', () => {
               // the call to  the recordExceptions() method by ApolloGateway
               // in version 2.3.0, there is no recordExceptions method thus we can't ever attach an error to the
               // fetch span but instead the error will be propagated to the request span and be set there
-              if (version > '2.3.0') {
+              if (semver.gt(resolvedVersion, '2.3.0')) {
                 assertObjectContains(traces[0][3], {
                   error: 1,
                   meta: {
diff --git a/packages/datadog-plugin-aws-sdk/test/bedrockruntime.spec.js b/packages/datadog-plugin-aws-sdk/test/bedrockruntime.spec.js
index 40891e23b3..7011743938 100644
--- a/packages/datadog-plugin-aws-sdk/test/bedrockruntime.spec.js
+++ b/packages/datadog-plugin-aws-sdk/test/bedrockruntime.spec.js
@@ -25,7 +25,7 @@ describe('Plugin', () => {
 
         before(function () {
           this.timeout(10_000)
-          const requireVersion = version === '3.0.0' ? '3.422.0' : '>=3.422.0'
+          const requireVersion = version === '3.0.0' ? '3.422.0' : '3'
           AWS = require(`../../../versions/${bedrockRuntimeClientName}@${requireVersion}`).get()
           const NodeHttpHandler =
             require(`../../../versions/${bedrockRuntimeClientName}@${requireVersion}`)
diff --git a/packages/datadog-plugin-langchain/test/index.spec.js b/packages/datadog-plugin-langchain/test/index.spec.js
index 8c8d79c0b6..dcc5ee4c08 100644
--- a/packages/datadog-plugin-langchain/test/index.spec.js
+++ b/packages/datadog-plugin-langchain/test/index.spec.js
@@ -122,7 +122,7 @@ describe('Plugin', () => {
           .get('@langchain/core/tools')
 
         if (semifies(realVersion, '>=1.0')) {
-          MemoryVectorStore = require('../../../versions/@langchain/classic@>=1.0')
+          MemoryVectorStore = require('../../../versions/@langchain/classic@1')
             .get('@langchain/classic/vectorstores/memory')
             .MemoryVectorStore
         } else {
diff --git a/packages/dd-trace/test/llmobs/plugins/aws-sdk/bedrockruntime.spec.js b/packages/dd-trace/test/llmobs/plugins/aws-sdk/bedrockruntime.spec.js
index 4a70ef0383..a894dd899c 100644
--- a/packages/dd-trace/test/llmobs/plugins/aws-sdk/bedrockruntime.spec.js
+++ b/packages/dd-trace/test/llmobs/plugins/aws-sdk/bedrockruntime.spec.js
@@ -37,7 +37,7 @@ describe('Plugin', () => {
 
       describe('with configuration', () => {
         before(() => {
-          const requireVersion = version === '3.0.0' ? '3.422.0' : '>=3.422.0'
+          const requireVersion = version === '3.0.0' ? '3.422.0' : '3'
           AWS = require(`../../../../../../versions/${bedrockRuntimeClientName}@${requireVersion}`).get()
           const NodeHttpHandler =
             require(`../../../../../../versions/${bedrockRuntimeClientName}@${requireVersion}`)
diff --git a/packages/dd-trace/test/llmobs/plugins/langchain/index.spec.js b/packages/dd-trace/test/llmobs/plugins/langchain/index.spec.js
index 8427f697d0..68399dcfec 100644
--- a/packages/dd-trace/test/llmobs/plugins/langchain/index.spec.js
+++ b/packages/dd-trace/test/llmobs/plugins/langchain/index.spec.js
@@ -164,7 +164,7 @@ describe('integrations', () => {
             .tool
 
           if (semifies(realVersion, '>=1.0')) {
-            MemoryVectorStore = require('../../../../../../versions/@langchain/classic@>=1.0')
+            MemoryVectorStore = require('../../../../../../versions/@langchain/classic@1')
               .get('@langchain/classic/vectorstores/memory')
               .MemoryVectorStore
           } else {
diff --git a/packages/dd-trace/test/plugins/versions.spec.js b/packages/dd-trace/test/plugins/versions.spec.js
index e0d727872d..35344a0771 100644
--- a/packages/dd-trace/test/plugins/versions.spec.js
+++ b/packages/dd-trace/test/plugins/versions.spec.js
@@ -3,61 +3,78 @@
 const assert = require('node:assert/strict')
 
 const { describe, it } = require('mocha')
+const { coerce, major } = require('semver')
 
-const { getVersionList, resolvePluginVersions } = require('./versions')
+const { getVersionList, resolvePluginVersions, brokenVersionReason } = require('./versions')
+
+const latests = require('./versions/package.json').dependencies
 
 const keys = (name, versions, nonConsecutive) =>
   getVersionList(name, versions, nonConsecutive).map(({ versionKey }) => versionKey)
 
+const latestMajorKey = name => String(major(coerce(latests[name])))
+
 describe('getVersionList', () => {
-  it('returns the wildcard untouched', () => {
-    assert.deepEqual(keys('mongodb', ['*']), ['*'])
+  it('collapses the wildcard to the latest major', () => {
+    assert.deepEqual(keys('mongodb', ['*']), [latestMajorKey('mongodb')])
   })
 
   it('collapses equivalent exact-version notations to a single key', () => {
     assert.deepEqual(keys('mongodb', ['1.2.3', '=1.2.3', 'v1.2.3']), ['1.2.3'])
   })
 
-  it('pins the floor and keeps the range for a single-major range', () => {
-    // `<3` caps the range below any plausible pinned latest, so there is no in-between major to fill.
-    assert.deepEqual(keys('mongodb', ['>=2 <3']), ['2.0.0', '>=2 <3'])
+  it('pins the floor and the major for a single-major range', () => {
+    // `<3` caps the range to major 2, so only the pinned floor and the latest of major 2 are keys.
+    assert.deepEqual(keys('mongodb', ['>=2 <3']), ['2.0.0', '2'])
+  })
+
+  it('covers the floor major and every major up to the range top', () => {
+    // `<5` caps the top at major 4; the floor (2.0.0) is pinned and majors 2-4 each resolve to their latest.
+    assert.deepEqual(keys('mongodb', ['>=2 <5']), ['2.0.0', '2', '3', '4'])
   })
 
-  it('fills every in-between major between the floor and the range top', () => {
-    // `<5` caps the top at major 4, so only major 3 sits strictly in between major 2 and major 4.
-    assert.deepEqual(keys('mongodb', ['>=2 <5']), ['2.0.0', '>=3.0.0 <4.0.0', '>=2 <5'])
+  it('covers every major from the floor to the capped top', () => {
+    // `<6` caps the top at major 5; the floor major's latest (1) is covered too, not only the newest of the range.
+    assert.deepEqual(keys('mongodb', ['>=1 <6']), ['1.0.0', '1', '2', '3', '4', '5'])
   })
 
-  it('orders fills ascending and keeps the declared range last (the top major is covered by the range itself)', () => {
-    // `<6` caps the top at major 5, which the `>=1 <6` range resolves to; only majors 2-4 are filled in between.
-    assert.deepEqual(keys('mongodb', ['>=1 <6']), [
-      '1.0.0',
-      '>=2.0.0 <3.0.0',
-      '>=3.0.0 <4.0.0',
-      '>=4.0.0 <5.0.0',
-      '>=1 <6',
-    ])
+  it('keeps the declared range for a top major the range caps mid-way', () => {
+    // `<=3.0.0` stops inside major 3, so a bare `3` (which resolves to the major's latest) would overshoot the
+    // ceiling; the declared range is kept instead so it resolves to the newest version `<=3.0.0`.
+    assert.deepEqual(keys('mongodb', ['>=2.1 <=3.0.0']), ['2.1.0', '2', '>=2.1 <=3.0.0'])
+  })
+
+  it('keeps a sub-major range as its own key', () => {
+    // `>=4.0.0 <4.3.0` never spans major 4 in full, so there is no safe bare major; the floor and the range cover it.
+    assert.deepEqual(keys('mongodb', ['>=4.0.0 <4.3.0']), ['4.0.0', '>=4.0.0 <4.3.0'])
   })
 
   it('de-duplicates a shared floor across multiple ranges', () => {
-    assert.deepEqual(keys('mongodb', ['>=2 <3', '^2.0.0']), ['2.0.0', '>=2 <3', '^2.0.0'])
+    assert.deepEqual(keys('mongodb', ['>=2 <3', '^2.0.0']), ['2.0.0', '2'])
+  })
+
+  it('consolidates the floor with the top major when the floor is the pinned latest', () => {
+    // `>=<pinned latest>` floors at the newest version, so the bare top-major key resolves to that same version and is
+    // dropped; the pinned package.json is what proves the two keys identical.
+    assert.deepEqual(keys('mongodb', [`>=${latests.mongodb}`]), [latests.mongodb])
   })
 
-  it('does not fill in-between majors for non-consecutive packages', () => {
-    assert.deepEqual(keys('mongodb', ['>=1 <6'], new Set(['mongodb'])), ['1.0.0', '>=1 <6'])
+  it('adds the floor, the floor major and the top major for non-consecutive packages', () => {
+    // The middle majors may be unpublished, but the floor major (1) and the top major (5) both exist and are tested.
+    assert.deepEqual(keys('mongodb', ['>=1 <6'], new Set(['mongodb'])), ['1.0.0', '1', '5'])
   })
 
-  it('treats the built-in non-consecutive packages as floor + range only', () => {
-    // graphql jumps from 0.x to 14.x; auto-filling 1.x–13.x would fail the install.
-    assert.deepEqual(keys('graphql', ['>=0.10']), ['0.10.0', '>=0.10'])
+  it('treats the built-in non-consecutive packages as floor + floor major + top major', () => {
+    // graphql jumps from 0.x to 14.x; 1.x–13.x are skipped, but the latest 0.x and the newest major are still tested.
+    assert.deepEqual(keys('graphql', ['>=0.10']), ['0.10.0', '0', latestMajorKey('graphql')])
   })
 
   it('throws on an unparseable range', () => {
     assert.throws(() => getVersionList('mongodb', ['not-a-version']), /Invalid version range/)
   })
 
-  it('ignores empty entries', () => {
-    assert.deepEqual(keys('mongodb', ['', undefined, '>=2 <3']), ['2.0.0', '>=2 <3'])
+  it('throws on an empty entry', () => {
+    assert.throws(() => getVersionList('mongodb', ['', '>=2 <3']), /Empty version entry/)
   })
 })
 
@@ -67,8 +84,8 @@ describe('resolvePluginVersions', () => {
   it('expands the declared versions and points the unversioned folder at the newest in-scope key', () => {
     const result = resolvePluginVersions({ name: 'mongodb', declaredVersions: ['>=2 <5'], env: {} })
 
-    assert.deepEqual(versionKeys(result), ['2.0.0', '>=3.0.0 <4.0.0', '>=2 <5'])
-    assert.equal(result.unversioned, '>=2 <5')
+    assert.deepEqual(versionKeys(result), ['2.0.0', '2', '3', '4'])
+    assert.equal(result.unversioned, '4')
   })
 
   it('filters the installed keys by RANGE and follows the filtered tail', () => {
@@ -78,8 +95,8 @@ describe('resolvePluginVersions', () => {
       env: { RANGE: '>=2.0.0 <4.0.0' },
     })
 
-    assert.deepEqual(versionKeys(result), ['>=2.0.0 <3.0.0', '>=3.0.0 <4.0.0'])
-    assert.equal(result.unversioned, '>=3.0.0 <4.0.0')
+    assert.deepEqual(versionKeys(result), ['2', '3'])
+    assert.equal(result.unversioned, '3')
   })
 
   it('replaces the declared versions with PACKAGE_VERSION_RANGE when the module is honoured', () => {
@@ -89,7 +106,7 @@ describe('resolvePluginVersions', () => {
       env: { PACKAGE_VERSION_RANGE: '>=3 <4' },
     })
 
-    assert.deepEqual(versionKeys(result), ['3.0.0', '>=3 <4'])
+    assert.deepEqual(versionKeys(result), ['3.0.0', '3'])
     assert.equal(result.unversioned, '>=3 <4')
   })
 
@@ -101,8 +118,8 @@ describe('resolvePluginVersions', () => {
       env: { PACKAGE_VERSION_RANGE: '>=3 <4' },
     })
 
-    assert.deepEqual(versionKeys(result), ['2.0.0', '>=3.0.0 <4.0.0', '>=2 <5'])
-    assert.equal(result.unversioned, '>=2 <5')
+    assert.deepEqual(versionKeys(result), ['2.0.0', '2', '3', '4'])
+    assert.equal(result.unversioned, '4')
   })
 
   it('keeps the unversioned folder on the raw shard while RANGE narrows the installed keys', () => {
@@ -112,7 +129,7 @@ describe('resolvePluginVersions', () => {
       env: { PACKAGE_VERSION_RANGE: '>=2 <5', RANGE: '>=3.0.0 <4.0.0' },
     })
 
-    assert.deepEqual(versionKeys(result), ['>=3.0.0 <4.0.0'])
+    assert.deepEqual(versionKeys(result), ['3'])
     assert.equal(result.unversioned, '>=2 <5')
   })
 
@@ -134,3 +151,16 @@ describe('resolvePluginVersions', () => {
     assert.equal(result.unversioned, undefined)
   })
 })
+
+describe('brokenVersionReason', () => {
+  const broken = { ai: [{ range: '>=4.1.0 <5.0.0', reason: 'no cassette' }] }
+
+  it('returns the reason for a version inside a broken range', () => {
+    assert.equal(brokenVersionReason('ai', '4.3.19', broken), 'no cassette')
+  })
+
+  it('returns undefined outside every broken range and for unlisted modules', () => {
+    assert.equal(brokenVersionReason('ai', '4.0.0', broken), undefined)
+    assert.equal(brokenVersionReason('mongodb', '4.3.19', broken), undefined)
+  })
+})
diff --git a/packages/dd-trace/test/plugins/versions/index.js b/packages/dd-trace/test/plugins/versions/index.js
index 7ae0ed1a88..deb18f299e 100644
--- a/packages/dd-trace/test/plugins/versions/index.js
+++ b/packages/dd-trace/test/plugins/versions/index.js
@@ -1,6 +1,6 @@
 'use strict'
 
-const { clean, coerce, intersects, subset } = require('semver')
+const { clean, coerce, intersects, satisfies, subset } = require('semver')
 
 const latests = require('./package.json').dependencies
 
@@ -15,6 +15,22 @@ const nonConsecutiveMajorPackages = new Set([
   '@redis/client', // jumps from 2.x to 5.x (no 3.x–4.x)
 ])
 
+// Versions the matrix installs but must not run, keyed by module name. `withVersions()` skips any resolved
+// version matching a range here and surfaces the reason as a pending test. Each entry is a stop-gap: keep the reason
+// a TODO so a fixed version drops the entry instead of rotting, and scope the range as narrowly as the break warrants.
+/** @type {Record<string, Array<{ range: string, reason: string }>>} */
+const brokenVersions = {
+  // TODO: record VCR cassettes for the ai 4.x line; `versions/ai@4` resolves to the newest 4.x, which has no cassette,
+  // so the test would hit the live API. 4.0.x (cassetted) and 5.x/6.x stay covered.
+  ai: [{ range: '>=4.1.0 <5.0.0', reason: 'no VCR cassette for the ai 4.x latest (TODO: record cassettes)' }],
+  // TODO: record VCR cassettes for the @langchain/core 0.x line above 0.1. `@langchain/core@0` resolves to the newest
+  // 0.x (0.3.x), which has no cassette, so the LLMObs langchain specs hit the live API. The 0.1.0 floor and the 1.x
+  // latest stay covered.
+  '@langchain/core': [
+    { range: '>=0.2.0 <1.0.0', reason: 'no VCR cassette for the @langchain/core 0.x latest (TODO: record cassettes)' },
+  ],
+}
+
 /**
  * @param {string} name
  * @param {string} range
@@ -55,13 +71,23 @@ function capSubrange (name, subrange) {
  * maps to a `versions/<name>@<key>` workspace folder; the install script and `withVersions()` share this so the set of
  * installed folders and the set of tested folders never drift apart.
  *
- * Per range, this yields the lowest supported version (pinned exactly), the latest of every major in between, and the
- * range itself (which resolves to the newest supported version). The top major is derived from the pinned latest in
- * `package.json` rather than a registry lookup, so a major that does not exist makes the install fail loudly instead of
- * silently skipping versions — which is the signal to mark the range as non-consecutive (see `consecutiveMajors`).
+ * Per declared range this yields the lowest supported version (pinned exactly) and the newest version of every major
+ * the range spans, keyed by the bare major so the key resolves to that major's latest. Covering each major explicitly
+ * (rather than emitting the raw range, which resolves only to the newest version of the whole range) makes sure the
+ * floor major's latest is tested too. The top major is derived from the pinned latest in `package.json` rather than a
+ * registry lookup, so a major that was never published makes the install fail loudly — the signal to add the package
+ * to `nonConsecutiveMajorPackages`.
+ *
+ * A bare-major key resolves to that major's newest published version, so it can only be used where the declared range
+ * spans the major in full. When the range caps inside its top major (an upper bound below `<${major + 1}.0.0`), the
+ * top major keeps the declared range instead, which resolves to the newest version the range still allows — a bare
+ * key there would overshoot the ceiling (`>=2.1 <=3.0.0` keyed `3` installs the major's latest, a version above the
+ * declared `<=3.0.0` that the plugin never supported).
  *
- * Notations that resolve to the same exact version (`1.2.3`, `=1.2.3`, `v1.2.3`) collapse to a single key, so a version
- * is never installed twice under different spellings.
+ * Notations that resolve to the same exact version (`1.2.3`, `=1.2.3`, `v1.2.3`) collapse to a single key, and `*`
+ * collapses to the latest major (the same version an open-ended range resolves to), so a version is never installed
+ * twice under different spellings. A floor that equals the pinned latest also drops the redundant top-major key,
+ * since the pinned `package.json` proves they resolve to the same version.
  *
  * @param {string} name The module name, e.g. `mongodb`.
  * @param {string[]} versions The declared version entries, e.g. `['>=3.3 <5', '5', '>=6']`.
@@ -78,10 +104,13 @@ function getVersionList (name, versions, nonConsecutiveMajors = nonConsecutiveMa
   }
 
   for (const range of versions) {
-    if (!range) continue
+    // An empty entry is a setup mistake (a stray comma or an undefined slot); fail loudly rather than skip silently.
+    if (!range) {
+      throw new Error(`Empty version entry declared for '${name}'. Each declared version must be a non-empty range.`)
+    }
 
     if (range === '*') {
-      add('*', range)
+      add(latestMajor(name), range)
       continue
     }
 
@@ -97,19 +126,73 @@ function getVersionList (name, versions, nonConsecutiveMajors = nonConsecutiveMa
 
     add(floor.version, range)
 
-    if (!nonConsecutiveMajors.has(name)) {
-      const topMajor = highestMajor(name, range, floor.major)
-      for (let major = floor.major + 1; major < topMajor; major++) {
-        add(`>=${major}.0.0 <${major + 1}.0.0`, range)
+    const topMajor = highestMajor(name, range, floor.major)
+
+    const addMajor = (major) => {
+      if (!intersects(`>=${major}.0.0 <${major + 1}.0.0`, range)) return
+      // The top major is the only one the range can cap inside; lower majors are always spanned in full. A capped top
+      // keeps the declared range so it resolves below the ceiling instead of jumping to the major's latest.
+      if (major === topMajor && !reachesMajorCeiling(major, range)) {
+        add(range, range)
+      } else {
+        add(String(major), range)
       }
     }
 
-    add(range, range)
+    if (nonConsecutiveMajors.has(name)) {
+      // Only the in-between majors were never published. The floor major and the top major both exist, so add the
+      // latest of each (skipping the uncertain middle, which is what would make the install fail).
+      addMajor(floor.major)
+      if (topMajor > floor.major) addMajor(topMajor)
+    } else {
+      for (let major = floor.major; major <= topMajor; major++) {
+        addMajor(major)
+      }
+    }
   }
 
+  // The bare-major key for the pinned latest's major resolves to the pin itself, so when a declared floor already pins
+  // that exact version the major key would install the same thing. Drop it. This is the only such redundancy the
+  // pinned upper bound lets us prove; for lower majors the newest published version is unknown without the registry.
+  const pinned = coerce(latests[name])
+  if (pinned && entries.has(pinned.version)) entries.delete(String(pinned.major))
+
   return [...entries.values()]
 }
 
+// Higher than any real release within a major. A range that still admits it does not cap inside the major, so a
+// bare-major key is safe; a range that excludes it ends mid-major and must keep its own upper bound.
+const MAJOR_CEILING_PROBE = 999_999
+
+/**
+ * Whether `range` admits versions all the way to the top of `major` (a clean `<${major + 1}.0.0` upper bound, or none).
+ * When it does not, a bare-major key would resolve past the declared ceiling, so the caller keeps the declared range.
+ *
+ * @param {number} major
+ * @param {string} range
+ * @returns {boolean}
+ */
+function reachesMajorCeiling (major, range) {
+  return satisfies(`${major}.${MAJOR_CEILING_PROBE}.${MAJOR_CEILING_PROBE}`, range)
+}
+
+/**
+ * The latest major of `name` as a bare-major version key. `*` resolves here so it de-duplicates against an open-ended
+ * range whose top resolves to the same newest version.
+ *
+ * @param {string} name
+ * @returns {string}
+ */
+function latestMajor (name) {
+  const latest = coerce(latests[name])
+  if (!latest) {
+    throw new Error(
+      `Latest version for '${name}' needs to be defined in 'packages/dd-trace/test/plugins/versions/package.json'.`
+    )
+  }
+  return String(latest.major)
+}
+
 /**
  * Highest major still spanned by `range`, capped at the pinned latest. Iterates down from the latest so the first
  * intersecting major is the top; nothing above the pinned latest is installed.
@@ -159,7 +242,22 @@ function resolvePluginVersions ({ name, declaredVersions, honourEnvRange = true,
   return { versionList, unversioned }
 }
 
+/**
+ * The reason `version` of `name` is marked broken (and must be skipped), or `undefined` when it is testable.
+ *
+ * @param {string} name
+ * @param {string} version A concrete, resolved version.
+ * @param {Record<string, Array<{ range: string, reason: string }>>} [broken] Injectable for testing.
+ * @returns {string|undefined}
+ */
+function brokenVersionReason (name, version, broken = brokenVersions) {
+  for (const { range, reason } of broken[name] ?? []) {
+    if (satisfies(version, range)) return reason
+  }
+}
+
 module.exports = {
+  brokenVersionReason,
   getCappedRange,
   getVersionList,
   resolvePluginVersions,
diff --git a/packages/dd-trace/test/setup/mocha.js b/packages/dd-trace/test/setup/mocha.js
index 44c23ac3ae..f4b9d984b2 100644
--- a/packages/dd-trace/test/setup/mocha.js
+++ b/packages/dd-trace/test/setup/mocha.js
@@ -16,7 +16,7 @@ require('./core')
 const { engines, nodeMaxMajor } = require('../../../../package.json')
 
 const externals = require('../plugins/externals')
-const { resolvePluginVersions } = require('../plugins/versions')
+const { resolvePluginVersions, brokenVersionReason } = require('../plugins/versions')
 const runtimeMetrics = require('../../src/runtime_metrics')
 const Nomenclature = require('../../src/service-naming')
 const { SVC_SRC_KEY } = require('../../src/constants')
@@ -316,6 +316,16 @@ function withVersions (plugin, modules, range, cb) {
       .sort(({ resolvedVersion }) => resolvedVersion.localeCompare(resolvedVersion))
 
     for (const testCase of testCases) {
+      const brokenReason = brokenVersionReason(moduleName, testCase.resolvedVersion)
+      if (brokenReason) {
+        // The version is installed but deliberately not exercised; surface it as a pending test so the skip is visible
+        // in CI rather than silently absent.
+        describe(`with ${moduleName} ${testCase.versionRange} (${testCase.resolvedVersion})`, () => {
+          it.skip(`skipped — known broken: ${brokenReason}`, () => {})
+        })
+        continue
+      }
+
       const absBasePath = path.resolve(__dirname, getModulePath(moduleName, testCase.versionKey))
       const absNodeModulesPath = `${absBasePath}/node_modules`
 
diff --git a/scripts/install_plugin_modules.js b/scripts/install_plugin_modules.js
index c4b28e7ac2..404ef576fd 100644
--- a/scripts/install_plugin_modules.js
+++ b/scripts/install_plugin_modules.js
@@ -245,11 +245,16 @@ async function patchPeerDependencies ({ folder, externalName }) {
         if (dep === externalName) {
           versionPkgJson.dependencies[name] = pkgJson.version
         } else {
-          versionPkgJson.dependencies[name] = pkgJson[section][name].includes('||')
-            // Use the first version in the list (as npm does by default)
-            ? pkgJson[section][name].split('||')[0].trim()
-            // Only one version available so use that.
-            : pkgJson[section][name]
+          const declared = pkgJson[section][name]
+          versionPkgJson.dependencies[name] = declared.startsWith('workspace:')
+            // A `workspace:` protocol leaked into the published manifest (some monorepo packages publish it raw); it
+            // cannot resolve outside the source repo, so fall back to the pinned compatible version.
+            ? (latests[name] ?? '*')
+            : declared.includes('||')
+              // Use the first version in the list (as npm does by default)
+              ? declared.split('||')[0].trim()
+              // Only one version available so use that.
+              : declared
         }
         break
       }

From bf2bbfd4d9cd03415757ed2b69fb23ee9ab9b995 Mon Sep 17 00:00:00 2001
From: Roch Devost <roch.devost@datadoghq.com>
Date: Fri, 26 Jun 2026 17:09:52 -0400
Subject: [PATCH 05/51] ci(release): fix branch-diff Infinity crash on
 scientific notation SHAs (#9101)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 scripts/release/proposal.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/scripts/release/proposal.js b/scripts/release/proposal.js
index f36e8c167b..fa359b1d2d 100644
--- a/scripts/release/proposal.js
+++ b/scripts/release/proposal.js
@@ -101,10 +101,14 @@ try {
     process.exit(0)
   }
 
+  // Expand to full SHA to avoid minimist scientific notation coercion in branch-diff.
+  // Abbreviated SHAs like "980e663509" match JS float syntax and become Infinity.
+  const upperBoundRef = capture(`git rev-parse ${upperBoundSha}`)
+
   // notesShas is scoped to upperBoundSha so isMinor and release notes only reflect
   // the capped commits actually included in the proposal, not deferred ones.
   // Excludes semver-major (gated behind a flag, not user-visible).
-  const notesShas = capture(`${notesDiffCmd} --format=sha --reverse v${releaseLine}.x ${upperBoundSha}`)
+  const notesShas = capture(`${notesDiffCmd} --format=sha --reverse v${releaseLine}.x ${upperBoundRef}`)
     .split('\n').filter(Boolean)
   const contributorBySha = getContributorsBySha(`v${releaseLine}.x`, upperBoundSha)
   const notesEntries = []
@@ -155,7 +159,7 @@ try {
 
   if (shasToApply.length > 0) {
     // Show only commits being applied; upperBoundSha is the last main SHA that fits.
-    const newChanges = capture(`${cherryPickDiffCmd} v${newVersion}-proposal ${upperBoundSha}`)
+    const newChanges = capture(`${cherryPickDiffCmd} v${newVersion}-proposal ${upperBoundRef}`)
     const truncationNote = truncated
       ? `\n\n⚠️  Applying ${shasToApply.length} of ${proposalShas.length} available commits` +
         ` (GitHub limit: ${MAX_CHERRY_PICKS}). Remaining commits require a separate release.`

From 857bd76db2860f9505d4ff46067e608b9c687436 Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Fri, 26 Jun 2026 23:10:53 +0200
Subject: [PATCH 06/51] refactor(config): introduce namespace field and start
 pruning internalPropertyName (#8943)

`internalPropertyName` carried a hand-maintained full property path
(`telemetry.debug`, `remoteConfig.enabled`) that diverged from the canonical
env name, so the same configuration was named twice and the two could drift.

A new `namespace` field nests the canonical env name under a property path
(`telemetry.DD_TELEMETRY_DEBUG`), so the runtime path is derived from the
canonical name plus a namespace with no separate alias to maintain. It takes
precedence over `configurationNames` and `internalPropertyName` when resolving
the path, in the eslint sync rule, and in the type generator. Every group of
entries (remoteConfig, telemetry, appsec api-security and sca, profiling,
stats, llmobs, iast security-controls, the per-integration llm span limits)
moves onto it, and their runtime consumers are updated to the renamed keys.

The canonical name telemetry reports is unchanged: the rename only affects how
the property path is derived, not which env name is sent. The namespace object
is always built from the defaults, so the optional chaining and `?? 0`
fallbacks on the api-security accesses guarded a state that cannot occur and
are dropped.

Drive-by fix:

* Exempt integration-test fixture apps from `n/no-extraneous-require`: they
  `require('dd-trace')` as a customer does, so the rule fired once dd-trace
  became locally resolvable (yarn link) but stayed silent on a clean install.
---
 benchmark/sirun/exporting-pipeline/index.js   |  10 +-
 .../sirun/llmobs-span-processor/index.js      |   5 +-
 eslint-rules/eslint-config-names-sync.mjs     |   4 +-
 .../supported-configurations.json             |   2 +-
 eslint.config.mjs                             |   6 +
 integration-tests/code-origin/express-app.js  |   2 +-
 integration-tests/code-origin/fastify-app.js  |   2 +-
 .../datadog-plugin-express/src/code_origin.js |   2 +-
 .../datadog-plugin-fastify/src/code_origin.js |   2 +-
 .../src/appsec/api_security/sampler.js        |   6 +-
 .../src/appsec/downstream_requests.js         |   8 +-
 .../appsec/iast/security-controls/index.js    |   4 +-
 .../src/appsec/iast/telemetry/index.js        |   3 +-
 .../dd-trace/src/appsec/telemetry/index.js    |   2 +-
 packages/dd-trace/src/config/defaults.js      |   5 +-
 .../src/config/generated-config-types.d.ts    |  54 +++---
 packages/dd-trace/src/config/helper.js        |   1 +
 packages/dd-trace/src/config/index.js         |  34 ++--
 .../dd-trace/src/config/major-overrides.js    |   6 +-
 .../src/config/supported-configurations.json  |  47 +++---
 .../dd-trace/src/exporters/agent/index.js     |   2 +-
 packages/dd-trace/src/llmobs/plugins/base.js  |   8 +-
 .../src/llmobs/plugins/langgraph/index.js     |   2 +-
 packages/dd-trace/src/llmobs/sdk.js           |   6 +-
 .../dd-trace/src/llmobs/span_processor.js     |   2 +-
 packages/dd-trace/src/llmobs/tagger.js        |   6 +-
 packages/dd-trace/src/plugins/util/llm.js     |   7 +-
 .../dd-trace/src/profiling/exporter_cli.js    |   4 +-
 .../profiling/exporters/event_serializer.js   |   6 +-
 .../dd-trace/src/profiling/profilers/wall.js  |   2 +-
 packages/dd-trace/src/proxy.js                |   8 +-
 packages/dd-trace/src/span_processor.js       |   2 +-
 packages/dd-trace/src/span_stats.js           |   2 +-
 packages/dd-trace/src/startup-log.js          |   3 +-
 .../dd-trace/src/telemetry/dependencies.js    |   2 +-
 packages/dd-trace/src/telemetry/endpoints.js  |  10 +-
 packages/dd-trace/src/telemetry/index.js      |   4 +-
 packages/dd-trace/src/telemetry/logs/index.js |   2 +-
 packages/dd-trace/src/telemetry/send-data.js  |   2 +-
 .../src/telemetry/session-propagation.js      |   2 +-
 packages/dd-trace/src/telemetry/telemetry.js  |  18 +-
 .../test/appsec/api_security/sampler.spec.js  |  14 +-
 .../test/appsec/downstream_requests.spec.js   |  38 ++---
 .../iast/security-controls/index.spec.js      |  40 ++---
 .../taint-tracking-operations.spec.js         |   2 +-
 .../test/appsec/iast/telemetry/index.spec.js  |  14 +-
 .../test/appsec/iast/telemetry/logs.spec.js   |  10 +-
 .../test/appsec/index.express.plugin.spec.js  |   6 +-
 .../test/appsec/index.fastify.plugin.spec.js  |   1 -
 .../appsec/index.sequelize.plugin.spec.js     |   1 -
 packages/dd-trace/test/appsec/index.spec.js   |  40 ++---
 .../appsec/telemetry/api_security.spec.js     |   8 +-
 .../test/appsec/telemetry/rasp.spec.js        |  39 ++---
 .../test/appsec/telemetry/user.spec.js        |   4 +-
 .../test/appsec/telemetry/waf.spec.js         |  32 ++--
 packages/dd-trace/test/config/index.spec.js   | 158 ++++++++----------
 .../test/exporters/agent/exporter.spec.js     |   6 +-
 .../bedrockruntime.token-cache.spec.js        |   2 +-
 .../dd-trace/test/llmobs/sdk/index.spec.js    |  26 +--
 .../test/llmobs/span_processor.spec.js        |   4 +-
 packages/dd-trace/test/llmobs/tagger.spec.js  |  14 +-
 .../dd-trace/test/plugins/util/llm.spec.js    |   4 +-
 .../dd-trace/test/profiling/config.spec.js    |   4 +-
 .../test/profiling/exporters/agent.spec.js    |   2 +-
 .../test/profiling/profilers/wall.spec.js     |   2 +-
 packages/dd-trace/test/proxy.spec.js          |  10 +-
 packages/dd-trace/test/span_processor.spec.js |  23 ++-
 packages/dd-trace/test/span_stats.spec.js     |   6 +-
 packages/dd-trace/test/startup-log.spec.js    |   1 +
 .../test/telemetry/dependencies.spec.js       |   2 +-
 .../dd-trace/test/telemetry/endpoints.spec.js |  10 +-
 .../dd-trace/test/telemetry/index.spec.js     | 136 +++++++--------
 .../test/telemetry/logs/index.spec.js         |  10 +-
 .../dd-trace/test/telemetry/send-data.spec.js |   2 +-
 .../telemetry/session-propagation.spec.js     |   6 +-
 scripts/generate-config-types.js              |   6 +-
 76 files changed, 503 insertions(+), 485 deletions(-)

diff --git a/benchmark/sirun/exporting-pipeline/index.js b/benchmark/sirun/exporting-pipeline/index.js
index 876dee63b0..176365f44b 100644
--- a/benchmark/sirun/exporting-pipeline/index.js
+++ b/benchmark/sirun/exporting-pipeline/index.js
@@ -41,7 +41,11 @@ const exporter = { export (formatted) { exported += formatted.length; lastFormat
 const prioritySampler = new PrioritySampler()
 const config = {
   flushMinSpans: 100,
-  stats: { enabled: WITH_STATS },
+  stats: {
+    enabled: WITH_STATS,
+    DD_TRACE_STATS_COMPUTATION_ENABLED: WITH_STATS,
+  },
+  appsec: {},
 }
 const sp = new SpanProcessor(exporter, prioritySampler, config)
 
@@ -94,6 +98,10 @@ trace.started = finished
 trace.finished = finished
 sp.process(finished[0])
 assert.equal(exported, 30, 'span processor did not format and export the chunk')
+// The stats variant must actually build the stats processor: a renamed config
+// key would otherwise leave it off and the variant would silently measure the
+// no-stats path, showing up as a spurious A/B improvement.
+assert.equal(Boolean(sp._stats), WITH_STATS, 'stats computation did not match the WITH_STATS variant')
 if (WITH_LINKS) {
   assert.ok(lastFormatted[0].meta['_dd.span_links'], 'span links were not formatted')
   assert.ok(lastFormatted[0].span_events?.length, 'span events were not formatted')
diff --git a/benchmark/sirun/llmobs-span-processor/index.js b/benchmark/sirun/llmobs-span-processor/index.js
index 2f62bc39fb..bdaa70b4a0 100644
--- a/benchmark/sirun/llmobs-span-processor/index.js
+++ b/benchmark/sirun/llmobs-span-processor/index.js
@@ -33,7 +33,10 @@ const OPERATIONS = Number(process.env.OPERATIONS)
 // event (meta/input/output by span kind, metrics, tags, error). This is the
 // per-span LLMObs hot path, uncovered by the existing llmobs writer bench.
 const processor = new LLMObsSpanProcessor({
-  llmobs: { enabled: true },
+  llmobs: {
+    enabled: true,
+    DD_LLMOBS_ENABLED: true,
+  },
   version: '1.0.0',
   env: 'bench',
   service: 'llmobs-bench',
diff --git a/eslint-rules/eslint-config-names-sync.mjs b/eslint-rules/eslint-config-names-sync.mjs
index cafc034fc1..5f4a93e96d 100644
--- a/eslint-rules/eslint-config-names-sync.mjs
+++ b/eslint-rules/eslint-config-names-sync.mjs
@@ -132,7 +132,9 @@ function getSupportedConfigurationInfo (filePath) {
     const targets = new Set()
 
     for (const entry of entries) {
-      if (typeof entry.internalPropertyName === 'string') {
+      if (typeof entry.namespace === 'string') {
+        targets.add(`${entry.namespace}.${envName}`)
+      } else if (typeof entry.internalPropertyName === 'string') {
         targets.add(entry.internalPropertyName)
       }
 
diff --git a/eslint-rules/fixtures/config-names-sync/internal-env-and-ignored-names/supported-configurations.json b/eslint-rules/fixtures/config-names-sync/internal-env-and-ignored-names/supported-configurations.json
index 5e989725d9..dfaec3cd26 100644
--- a/eslint-rules/fixtures/config-names-sync/internal-env-and-ignored-names/supported-configurations.json
+++ b/eslint-rules/fixtures/config-names-sync/internal-env-and-ignored-names/supported-configurations.json
@@ -2,7 +2,7 @@
   "supportedConfigurations": {
     "DD_LLMOBS_ENABLED": [
       {
-        "internalPropertyName": "llmobs.enabled"
+        "namespace": "llmobs"
       }
     ],
     "DD_LLMOBS_ML_APP": [
diff --git a/eslint.config.mjs b/eslint.config.mjs
index de8e5f5fb6..9d79a8d1f1 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -873,6 +873,11 @@ export default [
     },
   },
   {
+    // These fixture apps import dd-trace the way a customer does
+    // (`require('dd-trace')`), so dd-trace never appears in their own manifest.
+    // Both extraneous-require rules must be off; otherwise the rule fires
+    // whenever dd-trace happens to be resolvable locally (e.g. `yarn link`),
+    // even though CI's clean install keeps it unresolvable.
     name: 'dd-trace/tests/integration-and-resources',
     plugins: {
       import: eslintPluginImport,
@@ -890,6 +895,7 @@ export default [
     ],
     rules: {
       'import/no-extraneous-dependencies': 'off',
+      'n/no-extraneous-require': 'off',
     },
   },
   {
diff --git a/integration-tests/code-origin/express-app.js b/integration-tests/code-origin/express-app.js
index 73166ea978..ce59fed22f 100644
--- a/integration-tests/code-origin/express-app.js
+++ b/integration-tests/code-origin/express-app.js
@@ -16,7 +16,7 @@ app.get('/config', (req, res) => {
   const config = tracer._tracer._config
   res.json({
     codeOriginEnabled: config.codeOriginForSpans.enabled,
-    remoteConfigEnabled: config.remoteConfig.enabled,
+    remoteConfigEnabled: config.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED,
   })
 })
 
diff --git a/integration-tests/code-origin/fastify-app.js b/integration-tests/code-origin/fastify-app.js
index 1b37424137..1ce60074ec 100644
--- a/integration-tests/code-origin/fastify-app.js
+++ b/integration-tests/code-origin/fastify-app.js
@@ -17,7 +17,7 @@ app.get('/config', (req, res) => {
   const config = tracer._tracer._config
   res.send({
     codeOriginEnabled: config.codeOriginForSpans.enabled,
-    remoteConfigEnabled: config.remoteConfig.enabled,
+    remoteConfigEnabled: config.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED,
   })
 })
 
diff --git a/packages/datadog-plugin-express/src/code_origin.js b/packages/datadog-plugin-express/src/code_origin.js
index 633231ff13..1c802f4c55 100644
--- a/packages/datadog-plugin-express/src/code_origin.js
+++ b/packages/datadog-plugin-express/src/code_origin.js
@@ -31,7 +31,7 @@ class ExpressCodeOriginForSpansPlugin extends Plugin {
       layerTags.set(layer, entryTags(topOfStackFunc))
     }
 
-    if (this._tracerConfig.remoteConfig?.enabled) {
+    if (this._tracerConfig.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED) {
       // When RC is enabled, use manual subscriptions (always pre-compute)
       // This allows tags to be computed even when CO is disabled, so runtime enabling works
       dc.channel('apm:express:route:added').subscribe(handleRouteAdded)
diff --git a/packages/datadog-plugin-fastify/src/code_origin.js b/packages/datadog-plugin-fastify/src/code_origin.js
index ddda552ff6..0a937324dc 100644
--- a/packages/datadog-plugin-fastify/src/code_origin.js
+++ b/packages/datadog-plugin-fastify/src/code_origin.js
@@ -20,7 +20,7 @@ class FastifyCodeOriginForSpansPlugin extends Plugin {
       web.getContext(req)?.span?.addTags(tags)
     })
 
-    if (this._tracerConfig.remoteConfig?.enabled) {
+    if (this._tracerConfig.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED) {
       // When RC is enabled, use manual subscription (always pre-computes)
       // This allows tags to be computed even when CO is disabled, so runtime enabling works
       dc.channel('apm:fastify:route:added').subscribe(handleRouteAdded)
diff --git a/packages/dd-trace/src/appsec/api_security/sampler.js b/packages/dd-trace/src/appsec/api_security/sampler.js
index dc083616b1..aeb19c6ea6 100644
--- a/packages/dd-trace/src/appsec/api_security/sampler.js
+++ b/packages/dd-trace/src/appsec/api_security/sampler.js
@@ -31,11 +31,11 @@ class NoopTTLCache {
 }
 
 function configure ({ appsec, apmTracingEnabled }) {
-  enabled = appsec.apiSecurity.enabled
+  enabled = appsec.DD_API_SECURITY_ENABLED
   asmStandaloneEnabled = apmTracingEnabled === false
-  sampledRequests = appsec.apiSecurity.sampleDelay === 0
+  sampledRequests = appsec.DD_API_SECURITY_SAMPLE_DELAY === 0
     ? new NoopTTLCache()
-    : new TTLCache({ max: MAX_SIZE, ttl: appsec.apiSecurity.sampleDelay * 1000 })
+    : new TTLCache({ max: MAX_SIZE, ttl: appsec.DD_API_SECURITY_SAMPLE_DELAY * 1000 })
 }
 
 function disable () {
diff --git a/packages/dd-trace/src/appsec/downstream_requests.js b/packages/dd-trace/src/appsec/downstream_requests.js
index b7b004abe0..893bb55a9f 100644
--- a/packages/dd-trace/src/appsec/downstream_requests.js
+++ b/packages/dd-trace/src/appsec/downstream_requests.js
@@ -41,7 +41,7 @@ function enable (_config) {
   downstreamAnalysisCount = new WeakMap()
   responseBodyIgnoredCount = new WeakMap()
 
-  const bodyAnalysisSampleRate = config.appsec.apiSecurity?.downstreamBodyAnalysisSampleRate
+  const bodyAnalysisSampleRate = config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE
   samplingRate = Math.min(Math.max(bodyAnalysisSampleRate, 0), 1)
 
   if (samplingRate !== bodyAnalysisSampleRate) {
@@ -105,7 +105,7 @@ function recordResponseBodyIgnored (req, tag) {
  * @returns {boolean} whether downstream response body should be collected for AppSec.
  */
 function evaluateResponseBodyCollection (originatingReq, res) {
-  const maxBytes = config.appsec.apiSecurity.maxDownstreamBodyBytes
+  const maxBytes = config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES
 
   const mime = extractMimeType(res.headers?.['content-type'])
   if (!mime || !SUPPORTED_RESPONSE_BODY_MIME_TYPES.has(mime)) {
@@ -137,7 +137,7 @@ function shouldSampleBody (req) {
   globalRequestCounter = (globalRequestCounter + 1n) & UINT64_MAX
 
   const currentCount = bodyAnalysisCount.get(req) || 0
-  if (currentCount >= config.appsec.apiSecurity?.maxDownstreamRequestBodyAnalysis) {
+  if (currentCount >= config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS) {
     return false
   }
 
@@ -166,7 +166,7 @@ function isRedirectResponse (res) {
  * @param {object} ctx http client instrumentation context (mutated).
  */
 function planResponseBodyCollection (originatingReq, res, ctx) {
-  if (!config?.appsec.apiSecurity) {
+  if (!config) {
     return
   }
 
diff --git a/packages/dd-trace/src/appsec/iast/security-controls/index.js b/packages/dd-trace/src/appsec/iast/security-controls/index.js
index 0302b85e56..7f7e1ce171 100644
--- a/packages/dd-trace/src/appsec/iast/security-controls/index.js
+++ b/packages/dd-trace/src/appsec/iast/security-controls/index.js
@@ -21,10 +21,10 @@ let controlsKeys
 let hooks
 
 function configure (iastConfig) {
-  if (!iastConfig?.securityControlsConfiguration) return
+  if (!iastConfig.DD_IAST_SECURITY_CONTROLS_CONFIGURATION) return
 
   try {
-    controls = parse(iastConfig.securityControlsConfiguration)
+    controls = parse(iastConfig.DD_IAST_SECURITY_CONTROLS_CONFIGURATION)
     if (controls?.size > 0) {
       hooks = new WeakSet()
       controlsKeys = [...controls.keys()]
diff --git a/packages/dd-trace/src/appsec/iast/telemetry/index.js b/packages/dd-trace/src/appsec/iast/telemetry/index.js
index 2b28ddf96f..61e08339f0 100644
--- a/packages/dd-trace/src/appsec/iast/telemetry/index.js
+++ b/packages/dd-trace/src/appsec/iast/telemetry/index.js
@@ -6,7 +6,8 @@ const { initRequestNamespace, finalizeRequestNamespace, globalNamespace } = requ
 
 class Telemetry {
   configure (config, verbosity) {
-    const telemetryAndMetricsEnabled = config?.telemetry?.enabled && config.telemetry.metrics
+    const telemetryAndMetricsEnabled = config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED &&
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED
 
     this.verbosity = telemetryAndMetricsEnabled ? getVerbosity(verbosity) : Verbosity.OFF
     this.enabled = this.verbosity !== Verbosity.OFF
diff --git a/packages/dd-trace/src/appsec/telemetry/index.js b/packages/dd-trace/src/appsec/telemetry/index.js
index d7676b04ba..5b8541475b 100644
--- a/packages/dd-trace/src/appsec/telemetry/index.js
+++ b/packages/dd-trace/src/appsec/telemetry/index.js
@@ -27,7 +27,7 @@ const metricsStoreMap = new WeakMap()
 let enabled = false
 
 function enable (config) {
-  enabled = config.telemetry?.enabled && config.telemetry?.metrics
+  enabled = config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED && config.telemetry.DD_TELEMETRY_METRICS_ENABLED
 }
 
 function disable () {
diff --git a/packages/dd-trace/src/config/defaults.js b/packages/dd-trace/src/config/defaults.js
index 8feaf5d7a9..595672d60f 100644
--- a/packages/dd-trace/src/config/defaults.js
+++ b/packages/dd-trace/src/config/defaults.js
@@ -227,8 +227,9 @@ for (const [canonicalName, entries] of Object.entries(supportedConfigurations))
     if (entry.sensitive) {
       sensitiveConfigurations.add(canonicalName)
     }
-    const configurationNames = entry.internalPropertyName ? [entry.internalPropertyName] : entry.configurationNames
-    const fullPropertyName = configurationNames?.[0] ?? canonicalName
+    const fullPropertyName = entry.namespace
+      ? `${entry.namespace}.${canonicalName}`
+      : (entry.internalPropertyName ?? entry.configurationNames?.[0] ?? canonicalName)
     const type = entry.type.toUpperCase()
 
     let transformer = transformers[entry.transform]
diff --git a/packages/dd-trace/src/config/generated-config-types.d.ts b/packages/dd-trace/src/config/generated-config-types.d.ts
index ee41bc1c12..7f8747b5bb 100644
--- a/packages/dd-trace/src/config/generated-config-types.d.ts
+++ b/packages/dd-trace/src/config/generated-config-types.d.ts
@@ -6,18 +6,17 @@ export interface GeneratedConfig {
   apiKey: string | undefined;
   apmTracingEnabled: boolean;
   appsec: {
-    apiSecurity: {
-      downstreamBodyAnalysisSampleRate: number;
-      enabled: boolean;
-      endpointCollectionEnabled: boolean;
-      endpointCollectionMessageLimit: number;
-      maxDownstreamBodyBytes: number;
-      maxDownstreamRequestBodyAnalysis: number;
-      sampleDelay: number;
-    };
     blockedTemplateGraphql: string | undefined;
     blockedTemplateHtml: string | undefined;
     blockedTemplateJson: string | undefined;
+    DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE: number;
+    DD_API_SECURITY_ENABLED: boolean;
+    DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: boolean;
+    DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT: number;
+    DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES: number;
+    DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS: number;
+    DD_API_SECURITY_SAMPLE_DELAY: number;
+    DD_APPSEC_SCA_ENABLED: boolean | undefined;
     enabled: boolean | undefined;
     eventTracking: {
       mode: string;
@@ -35,9 +34,6 @@ export interface GeneratedConfig {
     };
     rateLimit: number;
     rules: string | undefined;
-    sca: {
-      enabled: boolean | undefined;
-    };
     stackTrace: {
       enabled: boolean;
       maxDepth: number;
@@ -446,6 +442,7 @@ export interface GeneratedConfig {
   hostname: string;
   iast: {
     dbRowsToTaint: number;
+    DD_IAST_SECURITY_CONTROLS_CONFIGURATION: string | undefined;
     deduplicationEnabled: boolean;
     enabled: boolean;
     maxConcurrentRequests: number;
@@ -454,7 +451,6 @@ export interface GeneratedConfig {
     redactionNamePattern: string;
     redactionValuePattern: string;
     requestSampling: number;
-    securityControlsConfiguration: string | undefined;
     stackTrace: {
       enabled: boolean;
     };
@@ -469,13 +465,13 @@ export interface GeneratedConfig {
   isTestDynamicInstrumentationEnabled: boolean;
   isTestManagementEnabled: boolean;
   langchain: {
-    spanCharLimit: number;
-    spanPromptCompletionSampleRate: number;
+    DD_LANGCHAIN_SPAN_CHAR_LIMIT: number;
+    DD_LANGCHAIN_SPAN_PROMPT_COMPLETION_SAMPLE_RATE: number;
   };
   legacyBaggageEnabled: boolean;
   llmobs: {
     agentlessEnabled: boolean | undefined;
-    enabled: boolean;
+    DD_LLMOBS_ENABLED: boolean;
     mlApp: string | undefined;
     sampleRate: number;
   };
@@ -483,7 +479,7 @@ export interface GeneratedConfig {
   logLevel: "debug" | "info" | "warn" | "error";
   middlewareTracingEnabled: boolean;
   openai: {
-    spanCharLimit: number;
+    DD_OPENAI_SPAN_CHAR_LIMIT: number;
   };
   openAiLogsEnabled: boolean;
   OTEL_BSP_MAX_EXPORT_BATCH_SIZE: number;
@@ -518,13 +514,13 @@ export interface GeneratedConfig {
   peerServiceMapping: Record<string, string>;
   port: string | number;
   profiling: {
-    enabled: 'true' | 'false' | 'auto';
+    DD_PROFILING_ENABLED: 'true' | 'false' | 'auto';
   };
   protocolVersion: string;
   queryStringObfuscation: string;
   rateLimit: number;
   remoteConfig: {
-    enabled: boolean;
+    DD_REMOTE_CONFIGURATION_ENABLED: boolean;
     pollInterval: number;
   };
   reportHostname: boolean;
@@ -548,17 +544,17 @@ export interface GeneratedConfig {
   spanSamplingRules: import('../../../../index').SpanSamplingRule[] | undefined;
   startupLogs: boolean;
   stats: {
-    enabled: boolean;
+    DD_TRACE_STATS_COMPUTATION_ENABLED: boolean;
   };
   tags: Record<string, string>;
   telemetry: {
-    debug: boolean;
-    dependencyCollection: boolean;
-    enabled: boolean;
-    extendedHeartbeatInterval: number;
-    heartbeatInterval: number;
-    logCollection: boolean;
-    metrics: boolean;
+    DD_INSTRUMENTATION_TELEMETRY_ENABLED: boolean;
+    DD_TELEMETRY_DEBUG: boolean;
+    DD_TELEMETRY_DEPENDENCY_COLLECTION_ENABLED: boolean;
+    DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: number;
+    DD_TELEMETRY_HEARTBEAT_INTERVAL: number;
+    DD_TELEMETRY_LOG_COLLECTION_ENABLED: boolean;
+    DD_TELEMETRY_METRICS_ENABLED: boolean;
   };
   testManagementAttemptToFixRetries: number;
   traceId128BitGenerationEnabled: boolean;
@@ -574,8 +570,8 @@ export interface GeneratedConfig {
   url: string | URL;
   version: string | undefined;
   vertexai: {
-    spanCharLimit: number;
-    spanPromptCompletionSampleRate: number;
+    DD_VERTEXAI_SPAN_CHAR_LIMIT: number;
+    DD_VERTEXAI_SPAN_PROMPT_COMPLETION_SAMPLE_RATE: number;
   };
 }
 
diff --git a/packages/dd-trace/src/config/helper.js b/packages/dd-trace/src/config/helper.js
index b3b615ff04..1f01bf7100 100644
--- a/packages/dd-trace/src/config/helper.js
+++ b/packages/dd-trace/src/config/helper.js
@@ -10,6 +10,7 @@
  * @property {string[]} [aliases]
  * @property {string[]} [configurationNames]
  * @property {string} [internalPropertyName]
+ * @property {string} [namespace] Nests the canonical env name under this property path (e.g. `telemetry`).
  * @property {string} [transform]
  * @property {string} [allowed]
  * @property {string|boolean} [deprecated]
diff --git a/packages/dd-trace/src/config/index.js b/packages/dd-trace/src/config/index.js
index 8faf6dc597..495da5ea06 100644
--- a/packages/dd-trace/src/config/index.js
+++ b/packages/dd-trace/src/config/index.js
@@ -358,15 +358,16 @@ class Config extends ConfigBase {
       setAndTrack(this, 'OTEL_TRACES_EXPORTER', 'none')
     }
 
-    if (this.telemetry.heartbeatInterval) {
-      setAndTrack(this, 'telemetry.heartbeatInterval', Math.floor(this.telemetry.heartbeatInterval * 1000))
+    if (this.telemetry.DD_TELEMETRY_HEARTBEAT_INTERVAL) {
+      setAndTrack(this, 'telemetry.DD_TELEMETRY_HEARTBEAT_INTERVAL',
+        Math.floor(this.telemetry.DD_TELEMETRY_HEARTBEAT_INTERVAL * 1000))
     }
 
     // Allocation profiling needs a sampling hook only available on Node.js 26+.
     setAndTrack(this, 'DD_PROFILING_ALLOCATION_ENABLED', NODE_MAJOR >= 26 && this.DD_PROFILING_ALLOCATION_ENABLED)
-    if (this.telemetry.extendedHeartbeatInterval) {
-      setAndTrack(this, 'telemetry.extendedHeartbeatInterval',
-        Math.floor(this.telemetry.extendedHeartbeatInterval * 1000))
+    if (this.telemetry.DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL) {
+      setAndTrack(this, 'telemetry.DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL',
+        Math.floor(this.telemetry.DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL * 1000))
     }
 
     // Enable resourceRenamingEnabled when appsec is enabled and only
@@ -380,9 +381,9 @@ class Config extends ConfigBase {
     }
 
     if (!this.apmTracingEnabled) {
-      setAndTrack(this, 'stats.enabled', false)
-    } else if (!trackedConfigOrigins.has('stats.enabled')) {
-      setAndTrack(this, 'stats.enabled', getIsGCPFunction() || getIsAzureFunction())
+      setAndTrack(this, 'stats.DD_TRACE_STATS_COMPUTATION_ENABLED', false)
+    } else if (!trackedConfigOrigins.has('stats.DD_TRACE_STATS_COMPUTATION_ENABLED')) {
+      setAndTrack(this, 'stats.DD_TRACE_STATS_COMPUTATION_ENABLED', getIsGCPFunction() || getIsAzureFunction())
     }
 
     // TODO: Remove the experimental env vars as a major or deprecate the option?
@@ -454,11 +455,11 @@ class Config extends ConfigBase {
     }
 
     // For LLMObs, we want to auto enable it when other llmobs options are defined.
-    if (!this.llmobs.enabled &&
-        !trackedConfigOrigins.has('llmobs.enabled') &&
+    if (!this.llmobs.DD_LLMOBS_ENABLED &&
+        !trackedConfigOrigins.has('llmobs.DD_LLMOBS_ENABLED') &&
         (trackedConfigOrigins.has('llmobs.agentlessEnabled') ||
         trackedConfigOrigins.has('llmobs.mlApp'))) {
-      setAndTrack(this, 'llmobs.enabled', true)
+      setAndTrack(this, 'llmobs.DD_LLMOBS_ENABLED', true)
     }
 
     if (this.OTEL_RESOURCE_ATTRIBUTES) {
@@ -551,14 +552,15 @@ class Config extends ConfigBase {
     this.tags['runtime-id'] = RUNTIME_ID
 
     if (IS_SERVERLESS) {
-      setAndTrack(this, 'telemetry.enabled', false)
+      setAndTrack(this, 'telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED', false)
       setAndTrack(this, 'DD_CRASHTRACKING_ENABLED', false)
-      setAndTrack(this, 'remoteConfig.enabled', false)
+      setAndTrack(this, 'remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED', false)
     }
 
     // TODO: Should this unconditionally be disabled?
-    if (getEnvironmentVariable('JEST_WORKER_ID') && !trackedConfigOrigins.has('telemetry.enabled')) {
-      setAndTrack(this, 'telemetry.enabled', false)
+    if (getEnvironmentVariable('JEST_WORKER_ID') &&
+        !trackedConfigOrigins.has('telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED')) {
+      setAndTrack(this, 'telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED', false)
     }
 
     // Experimental agentless APM span intake
@@ -568,7 +570,7 @@ class Config extends ConfigBase {
     if (agentlessEnabled) {
       setAndTrack(this, 'experimental.exporter', 'agentless')
       // Disable client-side stats computation
-      setAndTrack(this, 'stats.enabled', false)
+      setAndTrack(this, 'stats.DD_TRACE_STATS_COMPUTATION_ENABLED', false)
       // Enable hostname reporting
       setAndTrack(this, 'reportHostname', true)
       // Disable rate limiting - server-side sampling will be used
diff --git a/packages/dd-trace/src/config/major-overrides.js b/packages/dd-trace/src/config/major-overrides.js
index 2d8c355c42..033b507bb3 100644
--- a/packages/dd-trace/src/config/major-overrides.js
+++ b/packages/dd-trace/src/config/major-overrides.js
@@ -72,11 +72,13 @@ function applyV5Overrides (supportedConfigurations) {
   const iastEntry = supportedConfigurations.DD_IAST_SECURITY_CONTROLS_CONFIGURATION?.[0]
   if (!iastEntry) return
 
+  // v5 kept this configurable through the (experimental) iast.* programmatic API. The entry
+  // still carries `namespace: "iast"`, so these names route to iast.DD_IAST_SECURITY_CONTROLS_CONFIGURATION
+  // and the property path stays canonical across majors.
   iastEntry.configurationNames = [
-    iastEntry.internalPropertyName || iastEntry.configurationNames?.[0],
+    'iast.securityControlsConfiguration',
     `${EXPERIMENTAL_IAST_PREFIX}.securityControlsConfiguration`,
   ]
-  delete iastEntry.internalPropertyName
 }
 
 /**
diff --git a/packages/dd-trace/src/config/supported-configurations.json b/packages/dd-trace/src/config/supported-configurations.json
index b915d6957d..96104ea3b0 100644
--- a/packages/dd-trace/src/config/supported-configurations.json
+++ b/packages/dd-trace/src/config/supported-configurations.json
@@ -119,6 +119,7 @@
       {
         "implementation": "A",
         "type": "boolean",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.apiSecurity.enabled",
           "experimental.appsec.apiSecurity.enabled"
@@ -133,6 +134,7 @@
       {
         "implementation": "A",
         "type": "boolean",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.apiSecurity.endpointCollectionEnabled",
           "experimental.appsec.apiSecurity.endpointCollectionEnabled"
@@ -144,6 +146,7 @@
       {
         "implementation": "A",
         "type": "int",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.apiSecurity.endpointCollectionMessageLimit",
           "experimental.appsec.apiSecurity.endpointCollectionMessageLimit"
@@ -155,7 +158,7 @@
       {
         "implementation": "A",
         "type": "decimal",
-        "internalPropertyName": "appsec.apiSecurity.downstreamBodyAnalysisSampleRate",
+        "namespace": "appsec",
         "default": "0.5"
       }
     ],
@@ -163,7 +166,7 @@
       {
         "implementation": "A",
         "type": "int",
-        "internalPropertyName": "appsec.apiSecurity.maxDownstreamRequestBodyAnalysis",
+        "namespace": "appsec",
         "default": "1"
       }
     ],
@@ -171,7 +174,7 @@
       {
         "implementation": "A",
         "type": "int",
-        "internalPropertyName": "appsec.apiSecurity.maxDownstreamBodyBytes",
+        "namespace": "appsec",
         "default": "10485760"
       }
     ],
@@ -180,7 +183,7 @@
         "implementation": "A",
         "type": "decimal",
         "default": "30",
-        "internalPropertyName": "appsec.apiSecurity.sampleDelay"
+        "namespace": "appsec"
       }
     ],
     "DD_APM_FLUSH_DEADLINE_MILLISECONDS": [
@@ -392,7 +395,7 @@
         "implementation": "B",
         "type": "boolean",
         "default": null,
-        "internalPropertyName": "appsec.sca.enabled"
+        "namespace": "appsec"
       }
     ],
     "DD_APPSEC_STACK_TRACE_ENABLED": [
@@ -1094,7 +1097,7 @@
       {
         "implementation": "B",
         "type": "string",
-        "internalPropertyName": "iast.securityControlsConfiguration",
+        "namespace": "iast",
         "default": null
       }
     ],
@@ -1170,7 +1173,7 @@
         "aliases": [
           "DD_TRACE_TELEMETRY_ENABLED"
         ],
-        "internalPropertyName": "telemetry.enabled"
+        "namespace": "telemetry"
       }
     ],
     "DD_INTERNAL_PROFILING_LONG_LIVED_THRESHOLD": [
@@ -1199,7 +1202,7 @@
         "implementation": "A",
         "type": "int",
         "default": "128",
-        "internalPropertyName": "langchain.spanCharLimit"
+        "namespace": "langchain"
       }
     ],
     "DD_LANGCHAIN_SPAN_PROMPT_COMPLETION_SAMPLE_RATE": [
@@ -1207,7 +1210,7 @@
         "implementation": "A",
         "type": "decimal",
         "default": "1",
-        "internalPropertyName": "langchain.spanPromptCompletionSampleRate"
+        "namespace": "langchain"
       }
     ],
     "DD_LLMOBS_AGENTLESS_ENABLED": [
@@ -1225,7 +1228,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "false",
-        "internalPropertyName": "llmobs.enabled"
+        "namespace": "llmobs"
       }
     ],
     "DD_LLMOBS_ML_APP": [
@@ -1323,7 +1326,7 @@
         "implementation": "A",
         "type": "int",
         "default": "128",
-        "internalPropertyName": "openai.spanCharLimit"
+        "namespace": "openai"
       }
     ],
     "DD_PIPELINE_EXECUTION_ID": [
@@ -1416,7 +1419,7 @@
       {
         "implementation": "B",
         "type": "string",
-        "internalPropertyName": "profiling.enabled",
+        "namespace": "profiling",
         "configurationNames": [
           "profiling"
         ],
@@ -1578,7 +1581,7 @@
         "aliases": [
           "DD_REMOTE_CONFIG_ENABLED"
         ],
-        "internalPropertyName": "remoteConfig.enabled"
+        "namespace": "remoteConfig"
       }
     ],
     "DD_REMOTE_CONFIG_POLL_INTERVAL_SECONDS": [
@@ -1740,7 +1743,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "false",
-        "internalPropertyName": "telemetry.debug"
+        "namespace": "telemetry"
       }
     ],
     "DD_TELEMETRY_DEPENDENCY_COLLECTION_ENABLED": [
@@ -1748,7 +1751,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "telemetry.dependencyCollection"
+        "namespace": "telemetry"
       }
     ],
     "DD_TELEMETRY_FORWARDER_PATH": [
@@ -1763,7 +1766,7 @@
         "implementation": "A",
         "type": "int",
         "default": "86400",
-        "internalPropertyName": "telemetry.extendedHeartbeatInterval"
+        "namespace": "telemetry"
       }
     ],
     "DD_TELEMETRY_HEARTBEAT_INTERVAL": [
@@ -1771,7 +1774,7 @@
         "implementation": "B",
         "type": "decimal",
         "default": "60.0",
-        "internalPropertyName": "telemetry.heartbeatInterval"
+        "namespace": "telemetry"
       }
     ],
     "DD_TELEMETRY_LOG_COLLECTION_ENABLED": [
@@ -1779,7 +1782,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "telemetry.logCollection"
+        "namespace": "telemetry"
       }
     ],
     "DD_TELEMETRY_METRICS_ENABLED": [
@@ -1787,7 +1790,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "telemetry.metrics"
+        "namespace": "telemetry"
       }
     ],
     "DD_TEST_FAILED_TEST_REPLAY_ENABLED": [
@@ -3764,7 +3767,7 @@
       {
         "implementation": "A",
         "type": "boolean",
-        "internalPropertyName": "stats.enabled",
+        "namespace": "stats",
         "configurationNames": [
           "stats"
         ],
@@ -3910,7 +3913,7 @@
         "implementation": "A",
         "type": "int",
         "default": "128",
-        "internalPropertyName": "vertexai.spanCharLimit"
+        "namespace": "vertexai"
       }
     ],
     "DD_VERTEXAI_SPAN_PROMPT_COMPLETION_SAMPLE_RATE": [
@@ -3918,7 +3921,7 @@
         "implementation": "A",
         "type": "decimal",
         "default": "1",
-        "internalPropertyName": "vertexai.spanPromptCompletionSampleRate"
+        "namespace": "vertexai"
       }
     ],
     "DD_VITEST_WORKER": [
diff --git a/packages/dd-trace/src/exporters/agent/index.js b/packages/dd-trace/src/exporters/agent/index.js
index 3bb0a7e681..e951048ab5 100644
--- a/packages/dd-trace/src/exporters/agent/index.js
+++ b/packages/dd-trace/src/exporters/agent/index.js
@@ -13,7 +13,7 @@ class AgentExporter {
     this._url = config.url
 
     const headers = {}
-    if (stats.enabled || apmTracingEnabled === false) {
+    if (stats.DD_TRACE_STATS_COMPUTATION_ENABLED || apmTracingEnabled === false) {
       headers['Datadog-Client-Computed-Stats'] = 'yes'
     }
 
diff --git a/packages/dd-trace/src/llmobs/plugins/base.js b/packages/dd-trace/src/llmobs/plugins/base.js
index 6f58a7e5c7..278db9a5a3 100644
--- a/packages/dd-trace/src/llmobs/plugins/base.js
+++ b/packages/dd-trace/src/llmobs/plugins/base.js
@@ -25,7 +25,7 @@ class LLMObsPlugin extends TracingPlugin {
   start (ctx) {
     // even though llmobs span events won't be enqueued if llmobs is disabled
     // we should avoid doing any computations here (these listeners aren't disabled)
-    const enabled = this._tracerConfig.llmobs.enabled
+    const enabled = this._tracerConfig.llmobs.DD_LLMOBS_ENABLED
     if (!enabled) return
 
     const parentStore = llmobsStorage.getStore()
@@ -52,7 +52,7 @@ class LLMObsPlugin extends TracingPlugin {
   }
 
   end (ctx) {
-    const enabled = this._tracerConfig.llmobs.enabled
+    const enabled = this._tracerConfig.llmobs.DD_LLMOBS_ENABLED
     if (!enabled) return
 
     // only attempt to restore the context if the current span was an LLMObs span
@@ -67,7 +67,7 @@ class LLMObsPlugin extends TracingPlugin {
   asyncEnd (ctx) {
     // even though llmobs span events won't be enqueued if llmobs is disabled
     // we should avoid doing any computations here (these listeners aren't disabled)
-    const enabled = this._tracerConfig.llmobs.enabled
+    const enabled = this._tracerConfig.llmobs.DD_LLMOBS_ENABLED
     if (!enabled) return
 
     const apmStore = ctx.currentStore
@@ -85,7 +85,7 @@ class LLMObsPlugin extends TracingPlugin {
 
   configure (config) {
     // we do not want to enable any LLMObs plugins if it is disabled on the tracer
-    const llmobsEnabled = this._tracerConfig.llmobs.enabled
+    const llmobsEnabled = this._tracerConfig.llmobs.DD_LLMOBS_ENABLED
     if (llmobsEnabled === false) {
       config = typeof config === 'boolean' ? false : { ...config, enabled: false } // override to false
     }
diff --git a/packages/dd-trace/src/llmobs/plugins/langgraph/index.js b/packages/dd-trace/src/llmobs/plugins/langgraph/index.js
index 4cc08be8e2..b5b121dd57 100644
--- a/packages/dd-trace/src/llmobs/plugins/langgraph/index.js
+++ b/packages/dd-trace/src/llmobs/plugins/langgraph/index.js
@@ -14,7 +14,7 @@ class PregelStreamLLMObsPlugin extends LLMObsPlugin {
   getLLMObsSpanRegisterOptions (ctx) {
     const name = ctx.self.name || 'LangGraph'
 
-    const enabled = this._tracerConfig.llmobs.enabled
+    const enabled = this._tracerConfig.llmobs.DD_LLMOBS_ENABLED
     if (!enabled) return
 
     const span = ctx.currentStore?.span
diff --git a/packages/dd-trace/src/llmobs/sdk.js b/packages/dd-trace/src/llmobs/sdk.js
index 6a50c5b2cc..3feb414f7e 100644
--- a/packages/dd-trace/src/llmobs/sdk.js
+++ b/packages/dd-trace/src/llmobs/sdk.js
@@ -49,7 +49,7 @@ class LLMObs extends NoopLLMObs {
   }
 
   get enabled () {
-    return this._config.llmobs.enabled ?? false
+    return this._config.llmobs.DD_LLMOBS_ENABLED ?? false
   }
 
   enable (options = {}) {
@@ -75,7 +75,7 @@ class LLMObs extends NoopLLMObs {
     }
 
     // TODO: These configs should be passed through directly at construction time instead.
-    this._config.llmobs.enabled = true
+    this._config.llmobs.DD_LLMOBS_ENABLED = true
     this._config.llmobs.mlApp = options.mlApp
     this._config.llmobs.agentlessEnabled = options.agentlessEnabled
 
@@ -96,7 +96,7 @@ class LLMObs extends NoopLLMObs {
 
     logger.debug('Disabling LLMObs')
 
-    this._config.llmobs.enabled = false
+    this._config.llmobs.DD_LLMOBS_ENABLED = false
 
     // disable writers and channel subscribers
     this._llmobsModule.disable()
diff --git a/packages/dd-trace/src/llmobs/span_processor.js b/packages/dd-trace/src/llmobs/span_processor.js
index 615d4626b4..a41a629928 100644
--- a/packages/dd-trace/src/llmobs/span_processor.js
+++ b/packages/dd-trace/src/llmobs/span_processor.js
@@ -83,7 +83,7 @@ class LLMObsSpanProcessor {
 
   // TODO: instead of relying on the tagger's weakmap registry, can we use some namespaced storage correlation?
   process (span) {
-    if (!this.#config.llmobs.enabled) return
+    if (!this.#config.llmobs.DD_LLMOBS_ENABLED) return
     // if the span is not in our private tagger map, it is not an llmobs span
     if (!LLMObsTagger.tagMap.has(span)) return
 
diff --git a/packages/dd-trace/src/llmobs/tagger.js b/packages/dd-trace/src/llmobs/tagger.js
index c60337b6b8..dea398c111 100644
--- a/packages/dd-trace/src/llmobs/tagger.js
+++ b/packages/dd-trace/src/llmobs/tagger.js
@@ -105,7 +105,7 @@ class LLMObsTagger {
     integration,
     _decorator,
   } = {}) {
-    if (!this.#config.llmobs.enabled) return
+    if (!this.#config.llmobs.DD_LLMOBS_ENABLED) return
     if (!kind) return // do not register it in the map if it doesn't have an llmobs span kind
 
     const spanMlApp =
@@ -734,7 +734,7 @@ class LLMObsTagger {
   }
 
   _register (span) {
-    if (!this.#config.llmobs.enabled) return
+    if (!this.#config.llmobs.DD_LLMOBS_ENABLED) return
     if (registry.has(span)) {
       this.#handleFailure(`LLMObs Span "${span._name}" already registered.`)
       return
@@ -744,7 +744,7 @@ class LLMObsTagger {
   }
 
   _setTag (span, key, value) {
-    if (!this.#config.llmobs.enabled) return
+    if (!this.#config.llmobs.DD_LLMOBS_ENABLED) return
     if (!registry.has(span)) {
       this.#handleFailure(`Span "${span._name}" must be an LLMObs generated span.`)
       return
diff --git a/packages/dd-trace/src/plugins/util/llm.js b/packages/dd-trace/src/plugins/util/llm.js
index b22cd96c09..548ddc78cd 100644
--- a/packages/dd-trace/src/plugins/util/llm.js
+++ b/packages/dd-trace/src/plugins/util/llm.js
@@ -37,7 +37,12 @@ function isPromptCompletionSampled (sampler, span) {
 
 module.exports = function makeUtilities (integrationName, tracerConfig) {
   const integrationConfig = tracerConfig[integrationName] || {}
-  const { spanCharLimit, spanPromptCompletionSampleRate } = integrationConfig
+  // The per-integration config is keyed by the canonical environment variable
+  // names (e.g. `DD_LANGCHAIN_SPAN_CHAR_LIMIT`), nested under the integration's
+  // namespace. Derive those leaf names from the integration name.
+  const prefix = `DD_${integrationName.toUpperCase()}_`
+  const spanCharLimit = integrationConfig[`${prefix}SPAN_CHAR_LIMIT`]
+  const spanPromptCompletionSampleRate = integrationConfig[`${prefix}SPAN_PROMPT_COMPLETION_SAMPLE_RATE`]
 
   const sampler = new Sampler(spanPromptCompletionSampleRate ?? 1)
 
diff --git a/packages/dd-trace/src/profiling/exporter_cli.js b/packages/dd-trace/src/profiling/exporter_cli.js
index 24c4c56c88..5369b0507b 100644
--- a/packages/dd-trace/src/profiling/exporter_cli.js
+++ b/packages/dd-trace/src/profiling/exporter_cli.js
@@ -18,7 +18,7 @@ function exporterFromURL (url) {
     return new FileExporter({}, fileURLToPath(url))
   }
   // The subprocess has no tracer config, so mirror the canonical config property
-  // names the exporters read. Normalize the raw env to the parsed profiling.enabled
+  // names the exporters read. Normalize the raw env to the parsed profiling.DD_PROFILING_ENABLED
   // values ('true' | 'false' | 'auto') the main process would have produced.
   const profilingEnabled = (getValueFromEnvSources('DD_PROFILING_ENABLED') ?? '').toLowerCase()
   const enabled = profilingEnabled === 'auto'
@@ -28,7 +28,7 @@ function exporterFromURL (url) {
     url,
     DD_PROFILING_UPLOAD_TIMEOUT: timeoutMs,
     DD_INJECTION_ENABLED: getValueFromEnvSources('DD_INJECTION_ENABLED'),
-    profiling: { enabled },
+    profiling: { DD_PROFILING_ENABLED: enabled },
   })
 }
 
diff --git a/packages/dd-trace/src/profiling/exporters/event_serializer.js b/packages/dd-trace/src/profiling/exporters/event_serializer.js
index b3cb6c9c17..aff7aa1985 100644
--- a/packages/dd-trace/src/profiling/exporters/event_serializer.js
+++ b/packages/dd-trace/src/profiling/exporters/event_serializer.js
@@ -11,10 +11,10 @@ const processTags = require('../../process-tags')
 /** @typedef {import('../../config/config-base')} TracerConfig */
 
 /**
- * Maps the canonical profiling.enabled value to the activation reported in the
+ * Maps the canonical profiling.DD_PROFILING_ENABLED value to the activation reported in the
  * profile event.
  *
- * @param {string} [enabled] - config.profiling.enabled ('true' | 'false' | 'auto')
+ * @param {string} [enabled] - config.profiling.DD_PROFILING_ENABLED ('true' | 'false' | 'auto')
  * @returns {string}
  */
 function getActivation (enabled) {
@@ -38,7 +38,7 @@ class EventSerializer {
     this.#service = config.service
     this.#appVersion = config.version
     this.#libraryInjected = !!config.DD_INJECTION_ENABLED
-    this.#activation = getActivation(config.profiling?.enabled)
+    this.#activation = getActivation(config.profiling?.DD_PROFILING_ENABLED)
   }
 
   /**
diff --git a/packages/dd-trace/src/profiling/profilers/wall.js b/packages/dd-trace/src/profiling/profilers/wall.js
index bdce213c6d..798a68f327 100644
--- a/packages/dd-trace/src/profiling/profilers/wall.js
+++ b/packages/dd-trace/src/profiling/profilers/wall.js
@@ -148,7 +148,7 @@ class NativeWallProfiler {
     this.#endpointCollectionEnabled = config.DD_PROFILING_ENDPOINT_COLLECTION_ENABLED
     this.#flushIntervalMillis = flushInterval
     this.#samplingIntervalMicros = SAMPLING_INTERVAL * 1000
-    this.#telemetryHeartbeatIntervalMillis = config.telemetry.heartbeatInterval
+    this.#telemetryHeartbeatIntervalMillis = config.telemetry.DD_TELEMETRY_HEARTBEAT_INTERVAL
     this.#timelineEnabled = config.DD_PROFILING_TIMELINE_ENABLED
     this.#v8ProfilerBugWorkaroundEnabled = config.DD_PROFILING_V8_PROFILER_BUG_WORKAROUND
 
diff --git a/packages/dd-trace/src/proxy.js b/packages/dd-trace/src/proxy.js
index 821f7aac3b..bcc6ec9c8b 100644
--- a/packages/dd-trace/src/proxy.js
+++ b/packages/dd-trace/src/proxy.js
@@ -138,7 +138,7 @@ class Tracer extends NoopProxy {
         spanleak.startScrubber()
       }
 
-      if (config.remoteConfig.enabled && !config.isCiVisibility) {
+      if (config.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED && !config.isCiVisibility) {
         const RemoteConfig = require('./remote_config')
         const rc = new RemoteConfig(config)
 
@@ -180,11 +180,11 @@ class Tracer extends NoopProxy {
         openfeatureRemoteConfig.enable(rc, config, () => this.openfeature)
       }
 
-      if (config.profiling.enabled === 'true') {
+      if (config.profiling.DD_PROFILING_ENABLED === 'true') {
         this._profilerStarted = this._startProfiler(config)
       } else {
         this._profilerStarted = false
-        if (config.profiling.enabled === 'auto') {
+        if (config.profiling.DD_PROFILING_ENABLED === 'auto') {
           const { SSIHeuristics } = require('./profiling/ssi-heuristics')
           const ssiHeuristics = new SSIHeuristics(config)
           ssiHeuristics.start()
@@ -274,7 +274,7 @@ class Tracer extends NoopProxy {
       if (config.appsec.enabled) {
         this._modules.appsec.enable(config)
       }
-      if (config.llmobs.enabled) {
+      if (config.llmobs.DD_LLMOBS_ENABLED) {
         this._modules.llmobs.enable(config)
       }
       if (!this._tracingInitialized) {
diff --git a/packages/dd-trace/src/span_processor.js b/packages/dd-trace/src/span_processor.js
index ac7f471d05..9165735feb 100644
--- a/packages/dd-trace/src/span_processor.js
+++ b/packages/dd-trace/src/span_processor.js
@@ -18,7 +18,7 @@ class SpanProcessor {
     this._killAll = false
 
     // TODO: This should already have been calculated in `config.js`.
-    if (config.stats?.enabled && !config.appsec?.standalone?.enabled) {
+    if (config.stats.DD_TRACE_STATS_COMPUTATION_ENABLED && !config.appsec.standalone?.enabled) {
       const { SpanStatsProcessor } = require('./span_stats')
       this._stats = new SpanStatsProcessor(config)
     }
diff --git a/packages/dd-trace/src/span_stats.js b/packages/dd-trace/src/span_stats.js
index 39039191bb..fdcd98bf39 100644
--- a/packages/dd-trace/src/span_stats.js
+++ b/packages/dd-trace/src/span_stats.js
@@ -137,7 +137,7 @@ class TimeBuckets extends Map {
 class SpanStatsProcessor {
   constructor ({
     stats: {
-      enabled = false,
+      DD_TRACE_STATS_COMPUTATION_ENABLED: enabled = false,
       interval = 10,
     },
     hostname,
diff --git a/packages/dd-trace/src/startup-log.js b/packages/dd-trace/src/startup-log.js
index 37071f9efc..7e74e3d508 100644
--- a/packages/dd-trace/src/startup-log.js
+++ b/packages/dd-trace/src/startup-log.js
@@ -76,6 +76,7 @@ function logGenericError (message) {
  */
 function configInfo () {
   const url = config.url
+  const profilingEnabled = config.profiling.DD_PROFILING_ENABLED
 
   return {
     [inspect.custom] () {
@@ -104,7 +105,7 @@ function configInfo () {
     ...(config.tags && config.tags.version && { dd_version: config.tags.version }),
     log_injection_enabled: !!config.logInjection,
     runtime_metrics_enabled: !!config.runtimeMetrics,
-    profiling_enabled: config.profiling?.enabled === 'true' || config.profiling?.enabled === 'auto',
+    profiling_enabled: profilingEnabled === 'true' || profilingEnabled === 'auto',
     appsec_enabled: config.appsec.enabled,
     data_streams_enabled: !!config.dsmEnabled,
   }
diff --git a/packages/dd-trace/src/telemetry/dependencies.js b/packages/dd-trace/src/telemetry/dependencies.js
index dbdac58232..017b6d113a 100644
--- a/packages/dd-trace/src/telemetry/dependencies.js
+++ b/packages/dd-trace/src/telemetry/dependencies.js
@@ -32,7 +32,7 @@ function waitAndSend (config, application, host) {
       const [name, version, initialLoadModule] = dependency.split(' ')
       // If a dependency is from the initial load, *always* send the event
       // Otherwise, only send if dependencyCollection is enabled
-      const sendModule = isTrue(initialLoadModule) || config.telemetry?.dependencyCollection
+      const sendModule = isTrue(initialLoadModule) || config.telemetry.DD_TELEMETRY_DEPENDENCY_COLLECTION_ENABLED
 
       savedDependenciesToSend.delete(dependency)
 
diff --git a/packages/dd-trace/src/telemetry/endpoints.js b/packages/dd-trace/src/telemetry/endpoints.js
index cc3c838178..e1ad3a3454 100644
--- a/packages/dd-trace/src/telemetry/endpoints.js
+++ b/packages/dd-trace/src/telemetry/endpoints.js
@@ -11,7 +11,10 @@ const { sendData } = require('./send-data')
  */
 /**
  * @typedef {import('./send-data').TelemetryConfig & {
- *   appsec?: { apiSecurity?: { endpointCollectionEnabled?: boolean, endpointCollectionMessageLimit?: number } }
+ *   appsec: {
+ *     DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: boolean,
+ *     DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT: number
+ *   }
  * }} TelemetryConfig
  */
 
@@ -142,8 +145,7 @@ function flushAndSend () {
   for (const [key, endpoint] of pendingEndpoints) {
     batchEndpoints.push(endpoint)
     pendingEndpoints.delete(key)
-    // Config is set when endpoint collection is enabled; message limit is optional
-    if (batchEndpoints.length >= (config.appsec?.apiSecurity?.endpointCollectionMessageLimit ?? 0)) break
+    if (batchEndpoints.length >= config.appsec.DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT) break
   }
 
   const payloadObj = {
@@ -184,7 +186,7 @@ function flushAndSend () {
  * @param {import('./send-data').SendDataCallback} updateRetryDataFunction
  */
 function start (_config, _application, _host, getRetryDataFunction, updateRetryDataFunction) {
-  if (!_config.appsec?.apiSecurity?.endpointCollectionEnabled) return
+  if (!_config.appsec.DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED) return
 
   config = _config
   application = _application
diff --git a/packages/dd-trace/src/telemetry/index.js b/packages/dd-trace/src/telemetry/index.js
index 43e884b026..bc277ddafb 100644
--- a/packages/dd-trace/src/telemetry/index.js
+++ b/packages/dd-trace/src/telemetry/index.js
@@ -5,14 +5,14 @@ let telemetry
 // Lazy load the telemetry module to avoid the performance impact of loading it unconditionally
 module.exports = {
   start (config, ...args) {
-    if (!config.telemetry.enabled) return
+    if (!config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED) return
     telemetry ??= require('./telemetry')
     telemetry.start(config, ...args)
   },
   // This might be called before `start` so we have to trigger loading the
   // underlying module here as well.
   updateConfig (changes, config, ...args) {
-    if (!config.telemetry.enabled) return
+    if (!config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED) return
     telemetry ??= require('./telemetry')
     telemetry.updateConfig(changes, config, ...args)
   },
diff --git a/packages/dd-trace/src/telemetry/logs/index.js b/packages/dd-trace/src/telemetry/logs/index.js
index 8b37070108..1266289008 100644
--- a/packages/dd-trace/src/telemetry/logs/index.js
+++ b/packages/dd-trace/src/telemetry/logs/index.js
@@ -55,7 +55,7 @@ function onErrorLog (msg) {
 }
 
 function start (config) {
-  if (!config.telemetry.logCollection || enabled) return
+  if (!config.telemetry.DD_TELEMETRY_LOG_COLLECTION_ENABLED || enabled) return
 
   enabled = true
 
diff --git a/packages/dd-trace/src/telemetry/send-data.js b/packages/dd-trace/src/telemetry/send-data.js
index f1ab6d61e9..8d833e319a 100644
--- a/packages/dd-trace/src/telemetry/send-data.js
+++ b/packages/dd-trace/src/telemetry/send-data.js
@@ -87,7 +87,7 @@ function getHeaders (config, application, reqType) {
   if (config.DD_ROOT_JS_SESSION_ID) {
     headers['dd-root-session-id'] = config.DD_ROOT_JS_SESSION_ID
   }
-  const debug = config.telemetry && config.telemetry.debug
+  const debug = config.telemetry && config.telemetry.DD_TELEMETRY_DEBUG
   if (debug) {
     headers['dd-telemetry-debug-enabled'] = 'true'
   }
diff --git a/packages/dd-trace/src/telemetry/session-propagation.js b/packages/dd-trace/src/telemetry/session-propagation.js
index 7f191f02d7..528f36dec4 100644
--- a/packages/dd-trace/src/telemetry/session-propagation.js
+++ b/packages/dd-trace/src/telemetry/session-propagation.js
@@ -40,7 +40,7 @@ function onChildProcessStart (context) {
 }
 
 function start (config) {
-  if (!config.telemetry?.enabled || subscribed) return
+  if (!config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED || subscribed) return
   subscribed = true
 
   runtimeId = config.DD_ROOT_JS_SESSION_ID || config.tags['runtime-id']
diff --git a/packages/dd-trace/src/telemetry/telemetry.js b/packages/dd-trace/src/telemetry/telemetry.js
index 06aa8500de..af6f5d37b7 100644
--- a/packages/dd-trace/src/telemetry/telemetry.js
+++ b/packages/dd-trace/src/telemetry/telemetry.js
@@ -154,7 +154,7 @@ function getProducts (config) {
     },
     profiler: {
       version: tracerVersion,
-      enabled: profilingEnabledToBoolean(config.profiling.enabled),
+      enabled: profilingEnabledToBoolean(config.profiling.DD_PROFILING_ENABLED),
     },
   }
 }
@@ -193,7 +193,7 @@ function appStarted (config) {
 }
 
 function appClosing () {
-  if (!config?.telemetry?.enabled) {
+  if (!config?.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED) {
     return
   }
   // Give chance to listeners to update metrics before shutting down.
@@ -244,7 +244,7 @@ function createHostObject () {
 }
 
 function getTelemetryData () {
-  return { config, application, host, heartbeatInterval: config?.telemetry.heartbeatInterval }
+  return { config, application, host, heartbeatInterval: config?.telemetry.DD_TELEMETRY_HEARTBEAT_INTERVAL }
 }
 
 /**
@@ -291,7 +291,7 @@ function heartbeat (config, application) {
 
     const { reqType, payload } = createPayload('app-heartbeat')
     sendData(config, application, host, reqType, payload, updateRetryData)
-  }, config.telemetry.heartbeatInterval).unref?.()
+  }, config.telemetry.DD_TELEMETRY_HEARTBEAT_INTERVAL).unref?.()
 }
 
 /** @param {import('../config/config-base')} config */
@@ -307,7 +307,7 @@ function extendedHeartbeat (config) {
       heartbeatFailedDependencies = []
     }
     sendData(config, application, host, 'app-extended-heartbeat', appPayload)
-  }, config.telemetry.extendedHeartbeatInterval).unref?.()
+  }, config.telemetry.DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL).unref?.()
 }
 
 /**
@@ -315,8 +315,8 @@ function extendedHeartbeat (config) {
  * @param {PluginManager} thePluginManager
  */
 function start (aConfig, thePluginManager) {
-  if (!aConfig.telemetry.enabled) {
-    if (aConfig.appsec.sca.enabled) {
+  if (!aConfig.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED) {
+    if (aConfig.appsec.DD_APPSEC_SCA_ENABLED) {
       logger.warn('DD_APPSEC_SCA_ENABLED requires enabling telemetry to work.')
     }
 
@@ -347,7 +347,7 @@ function start (aConfig, thePluginManager) {
 }
 
 function updateIntegrations () {
-  if (!config?.telemetry.enabled) {
+  if (!config?.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED) {
     return
   }
   const integrations = getIntegrations()
@@ -367,7 +367,7 @@ let latestConfiguration = []
  * @param {import('../config/config-base')} config
  */
 function updateConfig (configuration, config) {
-  if (!config.telemetry.enabled) return
+  if (!config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED) return
 
   logger.trace(configuration)
 
diff --git a/packages/dd-trace/test/appsec/api_security/sampler.spec.js b/packages/dd-trace/test/appsec/api_security/sampler.spec.js
index 79272f998b..6392cbd790 100644
--- a/packages/dd-trace/test/appsec/api_security/sampler.spec.js
+++ b/packages/dd-trace/test/appsec/api_security/sampler.spec.js
@@ -81,7 +81,7 @@ describe('API Security Sampler', () => {
 
   describe('with TTLCache', () => {
     beforeEach(() => {
-      apiSecuritySampler.configure({ appsec: { apiSecurity: { enabled: true, sampleDelay: 30 } } })
+      apiSecuritySampler.configure({ appsec: { DD_API_SECURITY_ENABLED: true, DD_API_SECURITY_SAMPLE_DELAY: 30 } })
     })
 
     it('should not sample before 30 seconds', () => {
@@ -157,7 +157,7 @@ describe('API Security Sampler', () => {
 
   describe('with NoopTTLCache', () => {
     beforeEach(() => {
-      apiSecuritySampler.configure({ appsec: { apiSecurity: { enabled: true, sampleDelay: 0 } } })
+      apiSecuritySampler.configure({ appsec: { DD_API_SECURITY_ENABLED: true, DD_API_SECURITY_SAMPLE_DELAY: 0 } })
     })
 
     it('should always return SAMPLE for sampleRequest', () => {
@@ -203,7 +203,7 @@ describe('API Security Sampler', () => {
 
   describe('MISSING_ROUTE decision', () => {
     beforeEach(() => {
-      apiSecuritySampler.configure({ appsec: { apiSecurity: { enabled: true, sampleDelay: 30 } } })
+      apiSecuritySampler.configure({ appsec: { DD_API_SECURITY_ENABLED: true, DD_API_SECURITY_SAMPLE_DELAY: 30 } })
     })
 
     it('returns MISSING_ROUTE when there is no route and status is not 404 and response is not blocked', () => {
@@ -258,10 +258,8 @@ describe('API Security Sampler', () => {
       SamplingDecision = apiSecuritySampler.SamplingDecision
       apiSecuritySampler.configure({
         appsec: {
-          apiSecurity: {
-            enabled: true,
-            sampleDelay: 30,
-          },
+          DD_API_SECURITY_ENABLED: true,
+          DD_API_SECURITY_SAMPLE_DELAY: 30,
         },
         apmTracingEnabled: false,
       })
@@ -283,7 +281,7 @@ describe('API Security Sampler', () => {
 
   describe('http.endpoint fallback', () => {
     beforeEach(() => {
-      apiSecuritySampler.configure({ appsec: { apiSecurity: { enabled: true, sampleDelay: 30 } } })
+      apiSecuritySampler.configure({ appsec: { DD_API_SECURITY_ENABLED: true, DD_API_SECURITY_SAMPLE_DELAY: 30 } })
     })
 
     function makeSpan (tags) {
diff --git a/packages/dd-trace/test/appsec/downstream_requests.spec.js b/packages/dd-trace/test/appsec/downstream_requests.spec.js
index 1bc8446d30..26f3707426 100644
--- a/packages/dd-trace/test/appsec/downstream_requests.spec.js
+++ b/packages/dd-trace/test/appsec/downstream_requests.spec.js
@@ -16,12 +16,10 @@ describe('appsec downstream_requests', () => {
   beforeEach(() => {
     config = {
       appsec: {
-        apiSecurity: {
-          enabled: true,
-          downstreamBodyAnalysisSampleRate: 1,
-          maxDownstreamRequestBodyAnalysis: 1,
-          maxDownstreamBodyBytes: 1024,
-        },
+        DD_API_SECURITY_ENABLED: true,
+        DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE: 1,
+        DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS: 1,
+        DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES: 1024,
       },
     }
 
@@ -38,7 +36,7 @@ describe('appsec downstream_requests', () => {
   describe('apiSecurity downstream body analysis sample rate', () => {
     it('logs warning and clamps value when sample rate is above 1', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = 1.5
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = 1.5
       downstream.enable(config)
 
       sinon.assert.calledOnce(logWarnStub)
@@ -51,7 +49,7 @@ describe('appsec downstream_requests', () => {
 
     it('logs warning and clamps value when sample rate is below 0', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = -0.5
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = -0.5
       downstream.enable(config)
 
       sinon.assert.calledOnce(logWarnStub)
@@ -64,7 +62,7 @@ describe('appsec downstream_requests', () => {
 
     it('does not log warning when sample rate is within valid range', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = 0.5
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = 0.5
       downstream.enable(config)
 
       const validRes = {
@@ -180,7 +178,7 @@ describe('appsec downstream_requests', () => {
 
     it('does not plan body collection when sample rate is zero', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = 0
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = 0
       downstream.enable(config)
 
       const inboundReq = {}
@@ -494,8 +492,8 @@ describe('appsec downstream_requests', () => {
 
     it('collects body on every hop at sample rate 1.0 (100%)', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = 1.0
-      config.appsec.apiSecurity.maxDownstreamRequestBodyAnalysis = 100
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = 1.0
+      config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS = 100
       downstream.enable(config)
 
       for (let i = 0; i < 10; i++) {
@@ -508,8 +506,8 @@ describe('appsec downstream_requests', () => {
 
     it('never collects at sample rate 0.0 (0%)', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = 0.0
-      config.appsec.apiSecurity.maxDownstreamRequestBodyAnalysis = 100
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = 0.0
+      config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS = 100
       downstream.enable(config)
 
       for (let i = 0; i < 10; i++) {
@@ -522,8 +520,8 @@ describe('appsec downstream_requests', () => {
 
     it('produces some collects and some skips with rate 0.5', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = 0.5
-      config.appsec.apiSecurity.maxDownstreamRequestBodyAnalysis = 1000
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = 0.5
+      config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS = 1000
       downstream.enable(config)
 
       const results = []
@@ -543,8 +541,8 @@ describe('appsec downstream_requests', () => {
 
     it('tracks per-request body analysis count independently', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = 1.0
-      config.appsec.apiSecurity.maxDownstreamRequestBodyAnalysis = 2
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = 1.0
+      config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS = 2
       downstream.enable(config)
 
       const req1 = {}
@@ -573,8 +571,8 @@ describe('appsec downstream_requests', () => {
 
     it('increments counter only after successful header-based collection plan', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = 1.0
-      config.appsec.apiSecurity.maxDownstreamRequestBodyAnalysis = 3
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = 1.0
+      config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS = 3
       downstream.enable(config)
 
       const testReq = {}
diff --git a/packages/dd-trace/test/appsec/iast/security-controls/index.spec.js b/packages/dd-trace/test/appsec/iast/security-controls/index.spec.js
index 8fa1161cc3..6752e0aba3 100644
--- a/packages/dd-trace/test/appsec/iast/security-controls/index.spec.js
+++ b/packages/dd-trace/test/appsec/iast/security-controls/index.spec.js
@@ -53,7 +53,7 @@ describe('IAST Security Controls', () => {
       controls.set('sanitizer.js', {})
 
       const securityControlsConfiguration = 'SANITIZER:CODE_INJECTION:sanitizer.js:sanitize'
-      securityControls.configure({ securityControlsConfiguration })
+      securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: securityControlsConfiguration })
 
       sinon.assert.calledWithExactly(parse, securityControlsConfiguration)
 
@@ -63,7 +63,7 @@ describe('IAST Security Controls', () => {
 
     it('should call parse and not subscribe to moduleLoad channels', () => {
       const securityControlsConfiguration = 'invalid_config'
-      securityControls.configure({ securityControlsConfiguration })
+      securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: securityControlsConfiguration })
 
       sinon.assert.calledWithExactly(parse, securityControlsConfiguration)
 
@@ -114,7 +114,7 @@ describe('IAST Security Controls', () => {
       // eslint-disable-next-line no-multi-str
       const conf = 'INPUT_VALIDATOR:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/custom_input_validator.js:validate'
-      securityControls.configure({ securityControlsConfiguration: conf })
+      securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
       requireAndPublish('./resources/custom_input_validator')
 
@@ -129,7 +129,7 @@ describe('IAST Security Controls', () => {
         // eslint-disable-next-line no-multi-str
         const conf = 'INPUT_VALIDATOR:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/custom_input_validator.js:validate'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { validate } = requireAndPublish('./resources/custom_input_validator')
         validate('input')
@@ -141,7 +141,7 @@ describe('IAST Security Controls', () => {
         // eslint-disable-next-line no-multi-str
         const conf = 'SANITIZER:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/sanitizer_default.js'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const sanitize = requireAndPublish('./resources/sanitizer_default')
         const result = sanitize('input')
@@ -156,7 +156,7 @@ describe('IAST Security Controls', () => {
 /security-controls/resources/custom_input_validator.js:validate;INPUT_VALIDATOR:\
 COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources\
 /custom_input_validator.js:validateObject'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { validate, validateObject } = requireAndPublish('./resources/custom_input_validator')
         let result = validate('input')
@@ -174,7 +174,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'INPUT_VALIDATOR:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/custom_input_validator.js:validate'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { validate } = requireAndPublish('./resources/custom_input_validator')
         validate('input1', 'input2')
@@ -188,7 +188,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'INPUT_VALIDATOR:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/custom_input_validator.js:validate:1'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { validate } = requireAndPublish('./resources/custom_input_validator')
         validate('input1', 'input2')
@@ -200,7 +200,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'INPUT_VALIDATOR:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/custom_input_validator.js:validate:1,3'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { validate } = requireAndPublish('./resources/custom_input_validator')
         validate('input1', 'input2', 'input3', 'input4')
@@ -214,7 +214,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'INPUT_VALIDATOR:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/custom_input_validator.js:validate:42'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { validate } = requireAndPublish('./resources/custom_input_validator')
         validate('input1')
@@ -226,7 +226,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'SANITIZER:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/sanitizer.js:sanitize'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { sanitize } = requireAndPublish('./resources/sanitizer')
         const result = sanitize('input')
@@ -240,7 +240,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'INPUT_VALIDATOR:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/custom_input_validator.js:validateObject'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { validateObject } = requireAndPublish('./resources/custom_input_validator')
         const result = validateObject({ input1: 'input1', nested: { input: 'input2' } })
@@ -256,7 +256,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'INPUT_VALIDATOR:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/custom_input_validator.js:validateObject'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { validateObject } = requireAndPublish('./resources/custom_input_validator')
         const result = validateObject({ input1: 'input1' }, 'input3')
@@ -272,7 +272,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'SANITIZER:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/sanitizer.js:sanitizeObject'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { sanitizeObject } = requireAndPublish('./resources/sanitizer')
         const result = sanitizeObject({ output: 'output1', nested: { output: 'nested output' } })
@@ -290,7 +290,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'SANITIZER:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/sanitizer.js:nested.sanitize'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { nested } = requireAndPublish('./resources/sanitizer')
         const result = nested.sanitize('input')
@@ -303,7 +303,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'SANITIZER:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/sanitizer.js:incorrect.sanitize'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { nested } = requireAndPublish('./resources/sanitizer')
         const result = nested.sanitize('input')
@@ -316,7 +316,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'SANITIZER:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/sanitizer.js:nested.incorrect.sanitize'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { nested } = requireAndPublish('./resources/sanitizer')
         const result = nested.sanitize('input')
@@ -329,7 +329,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
     describe('in node_modules', () => {
       it('should hook node_module dependency', () => {
         const conf = 'SANITIZER:COMMAND_INJECTION:node_modules/sanitizer/index.js:sanitize'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { sanitize } = requireAndPublish('./resources/node_modules/sanitizer')
         const result = sanitize('input')
@@ -340,7 +340,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
 
       it('should hook transitive node_module dependency', () => {
         const conf = 'SANITIZER:COMMAND_INJECTION:node_modules/sanitizer/index.js:sanitize'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { sanitize } = requireAndPublish('./resources/node_modules/anotherlib/node_modules/sanitizer')
         const result = sanitize('input')
@@ -351,7 +351,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
 
       it('should not fail with not found node_module dep', () => {
         const conf = 'SANITIZER:COMMAND_INJECTION:node_modules/not_loaded_sanitizer/index.js:sanitize'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { sanitize } = requireAndPublish('./resources/node_modules/sanitizer')
         const result = sanitize('input')
diff --git a/packages/dd-trace/test/appsec/iast/taint-tracking/taint-tracking-operations.spec.js b/packages/dd-trace/test/appsec/iast/taint-tracking/taint-tracking-operations.spec.js
index e9abbc5720..5d00b4f3cf 100644
--- a/packages/dd-trace/test/appsec/iast/taint-tracking/taint-tracking-operations.spec.js
+++ b/packages/dd-trace/test/appsec/iast/taint-tracking/taint-tracking-operations.spec.js
@@ -255,7 +255,7 @@ describe('IAST TaintTracking Operations', () => {
         [taintTrackingOperations.IAST_TRANSACTION_ID]: 'id',
       }
       iastTelemetry.configure({
-        telemetry: { enabled: true, metrics: true },
+        telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true, DD_TELEMETRY_METRICS_ENABLED: true },
       }, 'INFORMATION')
 
       const requestTaintedInc = sinon.stub(REQUEST_TAINTED, 'inc')
diff --git a/packages/dd-trace/test/appsec/iast/telemetry/index.spec.js b/packages/dd-trace/test/appsec/iast/telemetry/index.spec.js
index b6429c179d..f8ae447ad6 100644
--- a/packages/dd-trace/test/appsec/iast/telemetry/index.spec.js
+++ b/packages/dd-trace/test/appsec/iast/telemetry/index.spec.js
@@ -25,8 +25,8 @@ describe('Telemetry', () => {
     beforeEach(() => {
       defaultConfig = {
         telemetry: {
-          enabled: true,
-          metrics: true,
+          DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+          DD_TELEMETRY_METRICS_ENABLED: true,
         },
       }
 
@@ -66,7 +66,7 @@ describe('Telemetry', () => {
           '../../../telemetry/metrics': telemetryMetrics,
         })
 
-        const telemetryConfig = { enabled: true, metrics: true }
+        const telemetryConfig = { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true, DD_TELEMETRY_METRICS_ENABLED: true }
         iastTelemetry.configure({
           telemetry: telemetryConfig,
         }, 'OFF')
@@ -77,7 +77,7 @@ describe('Telemetry', () => {
       })
 
       it('should enable telemetry if telemetry.metrics is true', () => {
-        const telemetryConfig = { enabled: true, metrics: true }
+        const telemetryConfig = { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true, DD_TELEMETRY_METRICS_ENABLED: true }
         iastTelemetry.configure({
           telemetry: telemetryConfig,
         })
@@ -88,7 +88,7 @@ describe('Telemetry', () => {
       })
 
       it('should not enable telemetry if telemetry.metrics is false', () => {
-        const telemetryConfig = { enabled: true, metrics: false }
+        const telemetryConfig = { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true, DD_TELEMETRY_METRICS_ENABLED: false }
         iastTelemetry.configure({
           telemetry: telemetryConfig,
         })
@@ -127,7 +127,7 @@ describe('Telemetry', () => {
           },
         })
         iastTelemetry.configure({
-          telemetry: { enabled: true },
+          telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true },
         })
 
         const iastContext = {}
@@ -155,7 +155,7 @@ describe('Telemetry', () => {
           },
         })
         iastTelemetry.configure({
-          telemetry: { enabled: true },
+          telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true },
         })
 
         const iastContext = {}
diff --git a/packages/dd-trace/test/appsec/iast/telemetry/logs.spec.js b/packages/dd-trace/test/appsec/iast/telemetry/logs.spec.js
index b8db6aa6da..1794a2c7a2 100644
--- a/packages/dd-trace/test/appsec/iast/telemetry/logs.spec.js
+++ b/packages/dd-trace/test/appsec/iast/telemetry/logs.spec.js
@@ -35,10 +35,14 @@ describe('Telemetry logs', () => {
     })
 
     const config = {
-      telemetry: { enabled: true, heartbeatInterval: 3000, logCollection: true },
+      telemetry: {
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: 3000,
+        DD_TELEMETRY_LOG_COLLECTION_ENABLED: true,
+      },
       version: '1.2.3-beta4',
-      appsec: { enabled: false },
-      profiling: { enabled: false },
+      appsec: { enabled: false, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: false },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
diff --git a/packages/dd-trace/test/appsec/index.express.plugin.spec.js b/packages/dd-trace/test/appsec/index.express.plugin.spec.js
index 0eb14ec10d..17752435db 100644
--- a/packages/dd-trace/test/appsec/index.express.plugin.spec.js
+++ b/packages/dd-trace/test/appsec/index.express.plugin.spec.js
@@ -319,7 +319,7 @@ withVersions('express', 'express', version => {
 
     describe('with sample delay 10', () => {
       beforeEach(() => {
-        config.appsec.apiSecurity.sampleDelay = 10
+        config.appsec.DD_API_SECURITY_SAMPLE_DELAY = 10
         appsec.enable(config)
       })
 
@@ -387,8 +387,8 @@ withVersions('express', 'express', version => {
     })
 
     it('should not get the schema', async () => {
-      config.appsec.apiSecurity.enabled = false
-      config.appsec.apiSecurity.sampleDelay = 10
+      config.appsec.DD_API_SECURITY_ENABLED = false
+      config.appsec.DD_API_SECURITY_SAMPLE_DELAY = 10
       appsec.enable(config)
 
       const res = await axios.post('/', { key: 'value' })
diff --git a/packages/dd-trace/test/appsec/index.fastify.plugin.spec.js b/packages/dd-trace/test/appsec/index.fastify.plugin.spec.js
index 8d6e46002b..f79f24427d 100644
--- a/packages/dd-trace/test/appsec/index.fastify.plugin.spec.js
+++ b/packages/dd-trace/test/appsec/index.fastify.plugin.spec.js
@@ -717,7 +717,6 @@ describe('Api Security - Fastify', () => {
           rules: path.join(__dirname, 'api_security_rules.json'),
           apiSecurity: {
             enabled: true,
-            sampleDelay: 10,
           },
         },
       })
diff --git a/packages/dd-trace/test/appsec/index.sequelize.plugin.spec.js b/packages/dd-trace/test/appsec/index.sequelize.plugin.spec.js
index 88eea125ed..a8fa93a150 100644
--- a/packages/dd-trace/test/appsec/index.sequelize.plugin.spec.js
+++ b/packages/dd-trace/test/appsec/index.sequelize.plugin.spec.js
@@ -51,7 +51,6 @@ describe('sequelize', () => {
               rules: path.join(__dirname, 'rules-example.json'),
               apiSecurity: {
                 enabled: true,
-                sampleDelay: 10,
               },
             },
           }))
diff --git a/packages/dd-trace/test/appsec/index.spec.js b/packages/dd-trace/test/appsec/index.spec.js
index 66c1668e84..c24c318a05 100644
--- a/packages/dd-trace/test/appsec/index.spec.js
+++ b/packages/dd-trace/test/appsec/index.spec.js
@@ -85,10 +85,8 @@ describe('AppSec Index', function () {
         eventTracking: {
           mode: 'anon',
         },
-        apiSecurity: {
-          enabled: false,
-          sampleDelay: 10,
-        },
+        DD_API_SECURITY_ENABLED: false,
+        DD_API_SECURITY_SAMPLE_DELAY: 10,
         rasp: {
           enabled: true,
           bodyCollection: true,
@@ -249,8 +247,8 @@ describe('AppSec Index', function () {
 
     it('should call appsec telemetry enable', () => {
       config.telemetry = {
-        enabled: true,
-        metrics: true,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_METRICS_ENABLED: true,
       }
       AppSec.enable(config)
 
@@ -791,10 +789,8 @@ describe('AppSec Index', function () {
     })
 
     it('should not trigger schema extraction with feature disabled', () => {
-      config.appsec.apiSecurity = {
-        enabled: false,
-        sampleDelay: 1,
-      }
+      config.appsec.DD_API_SECURITY_ENABLED = false
+      config.appsec.DD_API_SECURITY_SAMPLE_DELAY = 1
 
       AppSec.enable(config)
 
@@ -842,10 +838,8 @@ describe('AppSec Index', function () {
     })
 
     it('should trigger schema extraction with sampling enabled', () => {
-      config.appsec.apiSecurity = {
-        enabled: true,
-        sampleDelay: 1,
-      }
+      config.appsec.DD_API_SECURITY_ENABLED = true
+      config.appsec.DD_API_SECURITY_SAMPLE_DELAY = 1
 
       AppSec.enable(config)
 
@@ -897,10 +891,8 @@ describe('AppSec Index', function () {
 
     describe('onResponseBody', () => {
       beforeEach(() => {
-        config.appsec.apiSecurity = {
-          enabled: true,
-          sampleDelay: 1,
-        }
+        config.appsec.DD_API_SECURITY_ENABLED = true
+        config.appsec.DD_API_SECURITY_SAMPLE_DELAY = 1
 
         AppSec.enable(config)
       })
@@ -1536,8 +1528,8 @@ describe('AppSec Index', function () {
     })
 
     it('should increment waf.init metric', () => {
-      config.telemetry.enabled = true
-      config.telemetry.metrics = true
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = true
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = true
 
       appsec.enable(config)
 
@@ -1548,8 +1540,8 @@ describe('AppSec Index', function () {
     })
 
     it('should not increment waf.init metric if metrics are not enabled', () => {
-      config.telemetry.enabled = true
-      config.telemetry.metrics = false
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = true
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = false
 
       appsec.enable(config)
 
@@ -1559,8 +1551,8 @@ describe('AppSec Index', function () {
     })
 
     it('should not increment waf.init metric if telemetry is not enabled', () => {
-      config.telemetry.enabled = false
-      config.telemetry.metrics = true
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = false
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = true
 
       appsec.enable(config)
 
diff --git a/packages/dd-trace/test/appsec/telemetry/api_security.spec.js b/packages/dd-trace/test/appsec/telemetry/api_security.spec.js
index 6fb55e86b7..9bc5b60f0b 100644
--- a/packages/dd-trace/test/appsec/telemetry/api_security.spec.js
+++ b/packages/dd-trace/test/appsec/telemetry/api_security.spec.js
@@ -27,8 +27,8 @@ describe('Appsec API Security Telemetry metrics', () => {
   describe('if enabled', () => {
     beforeEach(() => {
       const config = getConfig()
-      config.telemetry.enabled = true
-      config.telemetry.metrics = true
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = true
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = true
 
       appsecTelemetry.enable(config)
     })
@@ -78,8 +78,8 @@ describe('Appsec API Security Telemetry metrics', () => {
   describe('if telemetry is disabled', () => {
     beforeEach(() => {
       const config = getConfig()
-      config.telemetry.enabled = false
-      config.telemetry.metrics = false
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = false
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = false
 
       appsecTelemetry.enable(config)
     })
diff --git a/packages/dd-trace/test/appsec/telemetry/rasp.spec.js b/packages/dd-trace/test/appsec/telemetry/rasp.spec.js
index a183c77b2c..800f31589e 100644
--- a/packages/dd-trace/test/appsec/telemetry/rasp.spec.js
+++ b/packages/dd-trace/test/appsec/telemetry/rasp.spec.js
@@ -33,8 +33,8 @@ describe('Appsec Rasp Telemetry metrics', () => {
   describe('if enabled', () => {
     beforeEach(() => {
       const config = getConfig()
-      config.telemetry.enabled = true
-      config.telemetry.metrics = true
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = true
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = true
 
       appsecTelemetry.enable(config)
     })
@@ -270,10 +270,9 @@ describe('Appsec Rasp Telemetry metrics', () => {
 
   describe('if disabled', () => {
     it('should not increment any metric if telemetry is disabled', () => {
-      appsecTelemetry.enable({
-        enabled: false,
-        metrics: true,
-      })
+      const config = getConfig()
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = false
+      appsecTelemetry.enable(config)
 
       appsecTelemetry.incrementWafInitMetric(wafVersion, rulesVersion)
 
@@ -282,10 +281,9 @@ describe('Appsec Rasp Telemetry metrics', () => {
     })
 
     it('should not increment any metric if telemetry metrics are disabled', () => {
-      appsecTelemetry.enable({
-        enabled: true,
-        metrics: false,
-      })
+      const config = getConfig()
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = false
+      appsecTelemetry.enable(config)
 
       appsecTelemetry.incrementWafInitMetric(wafVersion, rulesVersion)
 
@@ -295,10 +293,9 @@ describe('Appsec Rasp Telemetry metrics', () => {
 
     describe('updateRaspRequestsMetricTags', () => {
       it('should sum rasp.duration and rasp.durationExt request metrics', () => {
-        appsecTelemetry.enable({
-          enabled: false,
-          metrics: true,
-        })
+        const config = getConfig()
+        config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = false
+        appsecTelemetry.enable(config)
 
         appsecTelemetry.updateRaspRequestsMetricTags({
           duration: 42,
@@ -318,10 +315,9 @@ describe('Appsec Rasp Telemetry metrics', () => {
       })
 
       it('should sum rasp.duration and rasp.durationExt with telemetry enabled and metrics disabled', () => {
-        appsecTelemetry.enable({
-          enabled: true,
-          metrics: false,
-        })
+        const config = getConfig()
+        config.telemetry.DD_TELEMETRY_METRICS_ENABLED = false
+        appsecTelemetry.enable(config)
 
         appsecTelemetry.updateRaspRequestsMetricTags({
           duration: 42,
@@ -341,10 +337,9 @@ describe('Appsec Rasp Telemetry metrics', () => {
       })
 
       it('should not increment any metric if telemetry metrics are disabled', () => {
-        appsecTelemetry.enable({
-          enabled: true,
-          metrics: false,
-        })
+        const config = getConfig()
+        config.telemetry.DD_TELEMETRY_METRICS_ENABLED = false
+        appsecTelemetry.enable(config)
 
         appsecTelemetry.updateRaspRequestsMetricTags({
           duration: 24,
diff --git a/packages/dd-trace/test/appsec/telemetry/user.spec.js b/packages/dd-trace/test/appsec/telemetry/user.spec.js
index 783438dded..f83f40e7ec 100644
--- a/packages/dd-trace/test/appsec/telemetry/user.spec.js
+++ b/packages/dd-trace/test/appsec/telemetry/user.spec.js
@@ -27,8 +27,8 @@ describe('Appsec User Telemetry metrics', () => {
   describe('if enabled', () => {
     beforeEach(() => {
       const config = getConfig()
-      config.telemetry.enabled = true
-      config.telemetry.metrics = true
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = true
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = true
 
       appsecTelemetry.enable(config)
     })
diff --git a/packages/dd-trace/test/appsec/telemetry/waf.spec.js b/packages/dd-trace/test/appsec/telemetry/waf.spec.js
index 1d9efccfbf..551dc6a9d3 100644
--- a/packages/dd-trace/test/appsec/telemetry/waf.spec.js
+++ b/packages/dd-trace/test/appsec/telemetry/waf.spec.js
@@ -45,8 +45,8 @@ describe('Appsec Waf Telemetry metrics', () => {
 
     beforeEach(() => {
       const config = getConfig()
-      config.telemetry.enabled = true
-      config.telemetry.metrics = true
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = true
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = true
 
       appsecTelemetry.enable(config)
     })
@@ -420,10 +420,9 @@ describe('Appsec Waf Telemetry metrics', () => {
 
   describe('if disabled', () => {
     it('should not increment any metric if telemetry is disabled', () => {
-      appsecTelemetry.enable({
-        enabled: false,
-        metrics: true,
-      })
+      const config = getConfig()
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = false
+      appsecTelemetry.enable(config)
 
       appsecTelemetry.incrementWafInitMetric(wafVersion, rulesVersion, true)
 
@@ -432,10 +431,9 @@ describe('Appsec Waf Telemetry metrics', () => {
     })
 
     it('should not increment any metric if telemetry metrics are disabled', () => {
-      appsecTelemetry.enable({
-        enabled: true,
-        metrics: false,
-      })
+      const config = getConfig()
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = false
+      appsecTelemetry.enable(config)
 
       appsecTelemetry.incrementWafInitMetric(wafVersion, rulesVersion, true)
 
@@ -457,10 +455,9 @@ describe('Appsec Waf Telemetry metrics', () => {
 
     describe('updateWafRequestMetricTags', () => {
       it('should sum waf.duration and waf.durationExt request metrics', () => {
-        appsecTelemetry.enable({
-          enabled: false,
-          metrics: true,
-        })
+        const config = getConfig()
+        config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = false
+        appsecTelemetry.enable(config)
 
         appsecTelemetry.updateWafRequestsMetricTags({
           duration: 42,
@@ -479,10 +476,9 @@ describe('Appsec Waf Telemetry metrics', () => {
       })
 
       it('should sum waf.duration and waf.durationExt with telemetry enabled and metrics disabled', () => {
-        appsecTelemetry.enable({
-          enabled: true,
-          metrics: false,
-        })
+        const config = getConfig()
+        config.telemetry.DD_TELEMETRY_METRICS_ENABLED = false
+        appsecTelemetry.enable(config)
 
         appsecTelemetry.updateWafRequestsMetricTags({
           duration: 42,
diff --git a/packages/dd-trace/test/config/index.spec.js b/packages/dd-trace/test/config/index.spec.js
index e823ed4211..dfa982a4d9 100644
--- a/packages/dd-trace/test/config/index.spec.js
+++ b/packages/dd-trace/test/config/index.spec.js
@@ -250,8 +250,8 @@ describe('Config', () => {
       const firstConfig = getConfig(undefined, { ddMajor: 5 })
       const secondConfig = getConfig(undefined, { ddMajor: 5 })
 
-      assert.strictEqual(firstConfig.iast.securityControlsConfiguration, undefined)
-      assert.strictEqual(secondConfig.iast.securityControlsConfiguration, undefined)
+      assert.strictEqual(firstConfig.iast.DD_IAST_SECURITY_CONTROLS_CONFIGURATION, undefined)
+      assert.strictEqual(secondConfig.iast.DD_IAST_SECURITY_CONTROLS_CONFIGURATION, undefined)
     })
 
     it('should pass through random envs', async () => {
@@ -776,15 +776,13 @@ describe('Config', () => {
       apmTracingEnabled: true,
       DD_APP_KEY: undefined,
       appsec: {
-        apiSecurity: {
-          enabled: true,
-          sampleDelay: 30,
-          endpointCollectionEnabled: true,
-          endpointCollectionMessageLimit: 300,
-          downstreamBodyAnalysisSampleRate: 0.5,
-          maxDownstreamRequestBodyAnalysis: 1,
-          maxDownstreamBodyBytes: 10485760,
-        },
+        DD_API_SECURITY_ENABLED: true,
+        DD_API_SECURITY_SAMPLE_DELAY: 30,
+        DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: true,
+        DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT: 300,
+        DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE: 0.5,
+        DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS: 1,
+        DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES: 10485760,
         blockedTemplateHtml: undefined,
         blockedTemplateJson: undefined,
         blockedTemplateGraphql: undefined,
@@ -803,9 +801,7 @@ describe('Config', () => {
           enabled: true,
         },
         rateLimit: 100,
-        sca: {
-          enabled: undefined,
-        },
+        DD_APPSEC_SCA_ENABLED: undefined,
         stackTrace: {
           enabled: true,
           maxDepth: 32,
@@ -870,7 +866,7 @@ describe('Config', () => {
       DD_INSTRUMENTATION_CONFIG_ID: undefined,
       llmobs: {
         agentlessEnabled: undefined,
-        enabled: false,
+        DD_LLMOBS_ENABLED: false,
         mlApp: undefined,
       },
       logLevel: 'debug',
@@ -882,7 +878,7 @@ describe('Config', () => {
         service: 'node',
       },
       remoteConfig: {
-        enabled: true,
+        DD_REMOTE_CONFIGURATION_ENABLED: true,
         pollInterval: 5,
       },
       reportHostname: false,
@@ -1254,15 +1250,13 @@ describe('Config', () => {
       apmTracingEnabled: false,
       DD_APP_KEY: 'myAppKey',
       appsec: {
-        apiSecurity: {
-          enabled: true,
-          sampleDelay: 25,
-          endpointCollectionEnabled: false,
-          endpointCollectionMessageLimit: 500,
-          downstreamBodyAnalysisSampleRate: 0.75,
-          maxDownstreamRequestBodyAnalysis: 2,
-          maxDownstreamBodyBytes: 2048,
-        },
+        DD_API_SECURITY_ENABLED: true,
+        DD_API_SECURITY_SAMPLE_DELAY: 25,
+        DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false,
+        DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT: 500,
+        DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE: 0.75,
+        DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS: 2,
+        DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES: 2048,
         blockedTemplateGraphql: BLOCKED_TEMPLATE_GRAPHQL,
         blockedTemplateHtml: BLOCKED_TEMPLATE_HTML,
         blockedTemplateJson: BLOCKED_TEMPLATE_JSON,
@@ -1283,9 +1277,7 @@ describe('Config', () => {
         },
         rateLimit: 42,
         rules: RULES_JSON_PATH,
-        sca: {
-          enabled: true,
-        },
+        DD_APPSEC_SCA_ENABLED: true,
         stackTrace: {
           enabled: false,
           maxDepth: 42,
@@ -1343,7 +1335,7 @@ describe('Config', () => {
         redactionNamePattern: 'REDACTION_NAME_PATTERN',
         redactionValuePattern: 'REDACTION_VALUE_PATTERN',
         requestSampling: 40,
-        securityControlsConfiguration: 'SANITIZER:CODE_INJECTION:sanitizer.js:method',
+        DD_IAST_SECURITY_CONTROLS_CONFIGURATION: 'SANITIZER:CODE_INJECTION:sanitizer.js:method',
         stackTrace: {
           enabled: false,
         },
@@ -1358,7 +1350,7 @@ describe('Config', () => {
       protocolVersion: '0.5',
       queryStringObfuscation: '.*',
       remoteConfig: {
-        enabled: false,
+        DD_REMOTE_CONFIGURATION_ENABLED: false,
         pollInterval: 42,
       },
       reportHostname: true,
@@ -1892,7 +1884,10 @@ describe('Config', () => {
     assert.deepStrictEqual(config.dynamicInstrumentation.redactedIdentifiers, ['foo', 'bar'])
     assert.deepStrictEqual(config.dynamicInstrumentation.redactionExcludedIdentifiers, ['a', 'b', 'c'])
     if (DD_MAJOR < 6) {
-      assert.strictEqual(config.iast.securityControlsConfiguration, 'SANITIZER:CODE_INJECTION:sanitizer.js:method')
+      assert.strictEqual(
+        config.iast.DD_IAST_SECURITY_CONTROLS_CONFIGURATION,
+        'SANITIZER:CODE_INJECTION:sanitizer.js:method'
+      )
     } else {
       assert.ok(!('iast.securityControlsConfiguration' in config))
     }
@@ -2386,11 +2381,9 @@ describe('Config', () => {
     assertObjectContains(config, {
       apmTracingEnabled: true,
       appsec: {
-        apiSecurity: {
-          enabled: true,
-          endpointCollectionEnabled: true,
-          endpointCollectionMessageLimit: 150,
-        },
+        DD_API_SECURITY_ENABLED: true,
+        DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: true,
+        DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT: 150,
         blockedTemplateGraphql: BLOCKED_TEMPLATE_GRAPHQL,
         blockedTemplateHtml: BLOCKED_TEMPLATE_HTML,
         blockedTemplateJson: BLOCKED_TEMPLATE_JSON,
@@ -2464,7 +2457,8 @@ describe('Config', () => {
         redactionNamePattern: 'REDACTION_NAME_PATTERN',
         redactionValuePattern: 'REDACTION_VALUE_PATTERN',
         requestSampling: 30,
-        securityControlsConfiguration: 'SANITIZER:CODE_INJECTION:sanitizer.js:method' + (DD_MAJOR < 6 ? '2' : '1'),
+        DD_IAST_SECURITY_CONTROLS_CONFIGURATION:
+          'SANITIZER:CODE_INJECTION:sanitizer.js:method' + (DD_MAJOR < 6 ? '2' : '1'),
         stackTrace: {
           enabled: false,
         },
@@ -2600,15 +2594,13 @@ describe('Config', () => {
     })
 
     assert.deepStrictEqual(config.appsec, {
-      apiSecurity: {
-        enabled: true,
-        sampleDelay: 30,
-        endpointCollectionEnabled: true,
-        endpointCollectionMessageLimit: 500,
-        downstreamBodyAnalysisSampleRate: 0.5,
-        maxDownstreamRequestBodyAnalysis: 1,
-        maxDownstreamBodyBytes: 10485760,
-      },
+      DD_API_SECURITY_ENABLED: true,
+      DD_API_SECURITY_SAMPLE_DELAY: 30,
+      DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: true,
+      DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT: 500,
+      DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE: 0.5,
+      DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS: 1,
+      DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES: 10485760,
       blockedTemplateGraphql: BLOCKED_TEMPLATE_GRAPHQL,
       blockedTemplateHtml: BLOCKED_TEMPLATE_HTML,
       blockedTemplateJson: BLOCKED_TEMPLATE_JSON,
@@ -2629,9 +2621,7 @@ describe('Config', () => {
       },
       rateLimit: 42,
       rules: RULES_JSON_PATH,
-      sca: {
-        enabled: undefined,
-      },
+      DD_APPSEC_SCA_ENABLED: undefined,
       stackTrace: {
         enabled: true,
         maxStackTraces: 2,
@@ -2650,7 +2640,7 @@ describe('Config', () => {
       redactionNamePattern: 'REDACTION_NAME_PATTERN',
       redactionValuePattern: 'REDACTION_VALUE_PATTERN',
       requestSampling: 15,
-      securityControlsConfiguration: undefined,
+      DD_IAST_SECURITY_CONTROLS_CONFIGURATION: undefined,
       stackTrace: {
         enabled: false,
       },
@@ -2804,7 +2794,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.enabled, false)
+    assert.strictEqual(config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED, false)
   })
 
   it('should not set DD_INSTRUMENTATION_TELEMETRY_ENABLED if FUNCTION_NAME and GCP_PROJECT are present', () => {
@@ -2814,7 +2804,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.enabled, false)
+    assert.strictEqual(config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED, false)
   })
 
   it('should not set DD_INSTRUMENTATION_TELEMETRY_ENABLED if K_SERVICE and FUNCTION_TARGET are present', () => {
@@ -2824,7 +2814,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.enabled, false)
+    assert.strictEqual(config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED, false)
   })
 
   it('should not set DD_INSTRUMENTATION_TELEMETRY_ENABLED if Azure Consumption Plan Function', () => {
@@ -2835,7 +2825,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.enabled, false)
+    assert.strictEqual(config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED, false)
   })
 
   it('should set telemetry default values', () => {
@@ -2843,11 +2833,11 @@ describe('Config', () => {
 
     assertObjectContains(config, {
       telemetry: {
-        enabled: true,
-        heartbeatInterval: 60000,
-        logCollection: true,
-        debug: false,
-        metrics: true,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: 60000,
+        DD_TELEMETRY_LOG_COLLECTION_ENABLED: true,
+        DD_TELEMETRY_DEBUG: false,
+        DD_TELEMETRY_METRICS_ENABLED: true,
       },
     })
   })
@@ -2858,7 +2848,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.heartbeatInterval, 42000)
+    assert.strictEqual(config.telemetry.DD_TELEMETRY_HEARTBEAT_INTERVAL, 42000)
 
     process.env.DD_TELEMETRY_HEARTBEAT_INTERVAL = origTelemetryHeartbeatIntervalValue
   })
@@ -2869,7 +2859,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.enabled, false)
+    assert.strictEqual(config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED, false)
 
     process.env.DD_INSTRUMENTATION_TELEMETRY_ENABLED = origTraceTelemetryValue
   })
@@ -2880,7 +2870,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.metrics, false)
+    assert.strictEqual(config.telemetry.DD_TELEMETRY_METRICS_ENABLED, false)
 
     process.env.DD_TELEMETRY_METRICS_ENABLED = origTelemetryMetricsEnabledValue
   })
@@ -2891,7 +2881,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.logCollection, false)
+    assert.strictEqual(config.telemetry.DD_TELEMETRY_LOG_COLLECTION_ENABLED, false)
 
     process.env.DD_TELEMETRY_LOG_COLLECTION_ENABLED = origLogsValue
   })
@@ -2902,7 +2892,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.debug, true)
+    assert.strictEqual(config.telemetry.DD_TELEMETRY_DEBUG, true)
 
     process.env.DD_TELEMETRY_DEBUG = origTelemetryDebugValue
   })
@@ -2912,7 +2902,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.remoteConfig.enabled, false)
+    assert.strictEqual(config.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED, false)
   })
 
   describe('flushInterval in Lambda', () => {
@@ -2944,7 +2934,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.remoteConfig.enabled, false)
+    assert.strictEqual(config.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED, false)
   })
 
   it('should not set DD_REMOTE_CONFIGURATION_ENABLED if K_SERVICE and FUNCTION_TARGET are present', () => {
@@ -2953,7 +2943,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.remoteConfig.enabled, false)
+    assert.strictEqual(config.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED, false)
   })
 
   it('should not set DD_REMOTE_CONFIGURATION_ENABLED if Azure Functions env vars are present', () => {
@@ -2963,7 +2953,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.remoteConfig.enabled, false)
+    assert.strictEqual(config.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED, false)
   })
 
   it('should send empty array when remote config is called on empty options', () => {
@@ -3180,7 +3170,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.appsec.apiSecurity.enabled, true)
+    assert.strictEqual(config.appsec.DD_API_SECURITY_ENABLED, true)
   })
 
   it('should disable api security with DD_EXPERIMENTAL_API_SECURITY_ENABLED', () => {
@@ -3188,7 +3178,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.appsec.apiSecurity.enabled, false)
+    assert.strictEqual(config.appsec.DD_API_SECURITY_ENABLED, false)
   })
 
   it('should ignore DD_EXPERIMENTAL_API_SECURITY_ENABLED with DD_API_SECURITY_ENABLED=true', () => {
@@ -3197,7 +3187,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.appsec.apiSecurity.enabled, true)
+    assert.strictEqual(config.appsec.DD_API_SECURITY_ENABLED, true)
   })
 
   it('should prioritize DD_DOGSTATSD_HOST over DD_DOGSTATSD_HOSTNAME', () => {
@@ -3391,7 +3381,7 @@ describe('Config', () => {
       })
       it('should enable telemetry', () => {
         const config = getConfig(options)
-        assert.strictEqual(config.telemetry.enabled, true)
+        assert.strictEqual(config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED, true)
       })
       it('should enable early flake detection by default', () => {
         const config = getConfig(options)
@@ -3478,14 +3468,14 @@ describe('Config', () => {
     it('disables telemetry if inside a jest worker', () => {
       process.env.JEST_WORKER_ID = '1'
       const config = getConfig(options)
-      assert.strictEqual(config.telemetry.enabled, false)
+      assert.strictEqual(config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED, false)
     })
   })
 
   context('llmobs config', () => {
     it('should disable llmobs by default', () => {
       const config = getConfig()
-      assert.strictEqual(config.llmobs.enabled, false)
+      assert.strictEqual(config.llmobs.DD_LLMOBS_ENABLED, false)
 
       // check origin computation
       assertConfigUpdateContains(updateConfig.getCall(0).args[0], [{
@@ -3496,7 +3486,7 @@ describe('Config', () => {
     it('should enable llmobs if DD_LLMOBS_ENABLED is set to true', () => {
       process.env.DD_LLMOBS_ENABLED = 'true'
       const config = getConfig()
-      assert.strictEqual(config.llmobs.enabled, true)
+      assert.strictEqual(config.llmobs.DD_LLMOBS_ENABLED, true)
 
       // check origin computation
       assertConfigUpdateContains(updateConfig.getCall(0).args[0], [{
@@ -3507,7 +3497,7 @@ describe('Config', () => {
     it('should disable llmobs if DD_LLMOBS_ENABLED is set to false', () => {
       process.env.DD_LLMOBS_ENABLED = 'false'
       const config = getConfig()
-      assert.strictEqual(config.llmobs.enabled, false)
+      assert.strictEqual(config.llmobs.DD_LLMOBS_ENABLED, false)
 
       // check origin computation
       assertConfigUpdateContains(updateConfig.getCall(0).args[0], [{
@@ -3517,7 +3507,7 @@ describe('Config', () => {
 
     it('should enable llmobs with options and DD_LLMOBS_ENABLED is not set', () => {
       const config = getConfig({ llmobs: { agentlessEnabled: true } })
-      assert.strictEqual(config.llmobs.enabled, true)
+      assert.strictEqual(config.llmobs.DD_LLMOBS_ENABLED, true)
 
       // check origin computation
       assertConfigUpdateContains(updateConfig.getCall(0).args[0], [{
@@ -3528,7 +3518,7 @@ describe('Config', () => {
     it('should have DD_LLMOBS_ENABLED take priority over options', () => {
       process.env.DD_LLMOBS_ENABLED = 'false'
       const config = getConfig({ llmobs: { agentlessEnabled: true } })
-      assert.strictEqual(config.llmobs.enabled, false)
+      assert.strictEqual(config.llmobs.DD_LLMOBS_ENABLED, false)
 
       // check origin computation
       assertConfigUpdateContains(updateConfig.getCall(0).args[0], [{
@@ -3724,7 +3714,7 @@ describe('Config', () => {
       assertObjectContains(config, {
         apmTracingEnabled: true,
         stats: {
-          enabled: true,
+          DD_TRACE_STATS_COMPUTATION_ENABLED: true,
         },
       })
 
@@ -3742,7 +3732,7 @@ describe('Config', () => {
       assertObjectContains(config, {
         apmTracingEnabled: false,
         stats: {
-          enabled: false,
+          DD_TRACE_STATS_COMPUTATION_ENABLED: false,
         },
       })
 
@@ -3760,7 +3750,7 @@ describe('Config', () => {
       assertObjectContains(config, {
         apmTracingEnabled: false,
         stats: {
-          enabled: false,
+          DD_TRACE_STATS_COMPUTATION_ENABLED: false,
         },
       })
     })
@@ -3966,8 +3956,8 @@ apm_configuration_default:
           maxConcurrentRequests: 10,
         },
         telemetry: {
-          heartbeatInterval: 42000,
-          metrics: false,
+          DD_TELEMETRY_HEARTBEAT_INTERVAL: 42000,
+          DD_TELEMETRY_METRICS_ENABLED: false,
         },
         llmobs: {
           mlApp: 'my-llm-app',
@@ -4667,7 +4657,7 @@ rules:
     it('should disable stats computation when agentless is enabled', () => {
       process.env._DD_APM_TRACING_AGENTLESS_ENABLED = 'true'
       const config = getConfig()
-      assert.strictEqual(config.stats.enabled, false)
+      assert.strictEqual(config.stats.DD_TRACE_STATS_COMPUTATION_ENABLED, false)
     })
 
     it('should enable hostname reporting when agentless is enabled', () => {
diff --git a/packages/dd-trace/test/exporters/agent/exporter.spec.js b/packages/dd-trace/test/exporters/agent/exporter.spec.js
index 7f35a21d95..e9b38fa44b 100644
--- a/packages/dd-trace/test/exporters/agent/exporter.spec.js
+++ b/packages/dd-trace/test/exporters/agent/exporter.spec.js
@@ -37,7 +37,7 @@ describe('Exporter', () => {
   })
 
   it('should pass computed stats header through to writer', () => {
-    const stats = { enabled: true }
+    const stats = { DD_TRACE_STATS_COMPUTATION_ENABLED: true }
     exporter = new Exporter({ url, flushInterval, stats }, prioritySampler)
     sinon.assert.calledWithMatch(Writer, {
       headers: {
@@ -47,7 +47,7 @@ describe('Exporter', () => {
   })
 
   it('should pass computed stats header through to writer if APM Tracing is disabled', () => {
-    const stats = { enabled: false }
+    const stats = { DD_TRACE_STATS_COMPUTATION_ENABLED: false }
     const apmTracingEnabled = false
     exporter = new Exporter({ url, flushInterval, stats, apmTracingEnabled }, prioritySampler)
 
@@ -59,7 +59,7 @@ describe('Exporter', () => {
   })
 
   it('should forward an IPv6 agent URL to the writer', () => {
-    const stats = { enabled: true }
+    const stats = { DD_TRACE_STATS_COMPUTATION_ENABLED: true }
     const url = new URL('http://[::1]:8126/')
     exporter = new Exporter({ url, flushInterval, stats }, prioritySampler)
     sinon.assert.calledWithMatch(Writer, { url })
diff --git a/packages/dd-trace/test/llmobs/plugins/aws-sdk/bedrockruntime.token-cache.spec.js b/packages/dd-trace/test/llmobs/plugins/aws-sdk/bedrockruntime.token-cache.spec.js
index deb8731c6f..64303f1233 100644
--- a/packages/dd-trace/test/llmobs/plugins/aws-sdk/bedrockruntime.token-cache.spec.js
+++ b/packages/dd-trace/test/llmobs/plugins/aws-sdk/bedrockruntime.token-cache.spec.js
@@ -39,7 +39,7 @@ describe('BedrockRuntime LLMObs plugin pending token headers', () => {
     })
 
     plugin = new BedrockRuntimePlugin({}, {
-      llmobs: { enabled: true, mlApp: 'test' },
+      llmobs: { DD_LLMOBS_ENABLED: true, mlApp: 'test' },
       service: 'test',
     })
     plugin._tagger = {
diff --git a/packages/dd-trace/test/llmobs/sdk/index.spec.js b/packages/dd-trace/test/llmobs/sdk/index.spec.js
index aa5d4bea10..4ea62a887c 100644
--- a/packages/dd-trace/test/llmobs/sdk/index.spec.js
+++ b/packages/dd-trace/test/llmobs/sdk/index.spec.js
@@ -81,7 +81,7 @@ describe('sdk', () => {
       [false, 'disabled'],
     ]) {
       it(`returns ${value} when llmobs is ${label}`, () => {
-        const enabledOrDisabledLLMObs = new LLMObsSDK(null, { disable () {} }, { llmobs: { enabled: value } })
+        const enabledOrDisabledLLMObs = new LLMObsSDK(null, { disable () {} }, { llmobs: { DD_LLMOBS_ENABLED: value } })
 
         assert.strictEqual(enabledOrDisabledLLMObs.enabled, value)
         enabledOrDisabledLLMObs.disable() // unsubscribe
@@ -163,7 +163,7 @@ describe('sdk', () => {
 
     it('does not disable llmobs if it is already disabled', () => {
       // do not fully enable a disabled llmobs
-      const disabledLLMObs = new LLMObsSDK(null, { disable () {} }, { llmobs: { enabled: false } })
+      const disabledLLMObs = new LLMObsSDK(null, { disable () {} }, { llmobs: { DD_LLMOBS_ENABLED: false } })
       sinon.spy(disabledLLMObs._llmobsModule, 'disable')
 
       disabledLLMObs.disable()
@@ -177,7 +177,7 @@ describe('sdk', () => {
     describe('trace', () => {
       describe('tracing behavior', () => {
         it('starts a span if llmobs is disabled but does not process it in the LLMObs span processor', () => {
-          tracer._tracer._config.llmobs.enabled = false
+          tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = false
 
           llmobs.trace({ kind: 'workflow', name: 'myWorkflow' }, (span, cb) => {
             const tag = LLMObsTagger.tagMap.get(span)
@@ -189,7 +189,7 @@ describe('sdk', () => {
           sinon.assert.called(llmobs._tracer._processor.process)
           sinon.assert.notCalled(LLMObsSpanProcessor.prototype.format)
 
-          tracer._tracer._config.llmobs.enabled = true
+          tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = true
         })
 
         it('throws if the kind is invalid', () => {
@@ -426,7 +426,7 @@ describe('sdk', () => {
     describe('wrap', () => {
       describe('tracing behavior', () => {
         it('starts a span if llmobs is disabled but does not process it in the LLMObs span processor', () => {
-          tracer._tracer._config.llmobs.enabled = false
+          tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = false
 
           const fn = llmobs.wrap({ kind: 'workflow' }, (a) => {
             assert.strictEqual(a, 1)
@@ -439,7 +439,7 @@ describe('sdk', () => {
           sinon.assert.called(llmobs._tracer._processor.process)
           sinon.assert.notCalled(LLMObsSpanProcessor.prototype.format)
 
-          tracer._tracer._config.llmobs.enabled = true
+          tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = true
         })
 
         it('throws if the kind is invalid', () => {
@@ -903,14 +903,14 @@ describe('sdk', () => {
 
   describe('annotate', () => {
     it('returns if llmobs is disabled', () => {
-      tracer._tracer._config.llmobs.enabled = false
+      tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = false
       sinon.spy(llmobs, '_active')
       llmobs.annotate()
 
       sinon.assert.notCalled(llmobs._active)
       llmobs._active.restore()
 
-      tracer._tracer._config.llmobs.enabled = true
+      tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = true
     })
 
     it('throws if no arguments are provided', () => {
@@ -1427,12 +1427,12 @@ describe('sdk', () => {
     })
 
     it('does not submit an evaluation if llmobs is disabled', () => {
-      tracer._tracer._config.llmobs.enabled = false
+      tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = false
       llmobs.submitEvaluation()
 
       sinon.assert.notCalled(LLMObsEvalMetricsWriter.prototype.append)
 
-      tracer._tracer._config.llmobs.enabled = true
+      tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = true
     })
 
     it('throws for an invalid span context', () => {
@@ -1722,7 +1722,7 @@ describe('sdk', () => {
         process.env.DD_TRACE_OTEL_ENABLED = 'true'
         const config = getConfigFresh({ llmobs: { mlApp: 'mlApp', agentlessEnabled: false } })
         delete process.env.DD_TRACE_OTEL_ENABLED
-        config.llmobs.enabled = true
+        config.llmobs.DD_LLMOBS_ENABLED = true
         otelLLMObs = new LLMObsSDK(tracer._tracer, llmobsModule, config)
       })
 
@@ -1743,12 +1743,12 @@ describe('sdk', () => {
 
   describe('flush', () => {
     it('does not flush if llmobs is disabled', () => {
-      tracer._tracer._config.llmobs.enabled = false
+      tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = false
       llmobs.flush()
 
       sinon.assert.notCalled(LLMObsEvalMetricsWriter.prototype.flush)
       sinon.assert.notCalled(LLMObsSpanWriter.prototype.flush)
-      tracer._tracer._config.llmobs.enabled = true
+      tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = true
     })
 
     it('flushes the evaluation writer and span writer', () => {
diff --git a/packages/dd-trace/test/llmobs/span_processor.spec.js b/packages/dd-trace/test/llmobs/span_processor.spec.js
index 21347b9d94..b6892f5f20 100644
--- a/packages/dd-trace/test/llmobs/span_processor.spec.js
+++ b/packages/dd-trace/test/llmobs/span_processor.spec.js
@@ -29,7 +29,7 @@ describe('span processor', () => {
       '../log': log,
     })
 
-    processor = new LLMObsSpanProcessor({ llmobs: { enabled: true } })
+    processor = new LLMObsSpanProcessor({ llmobs: { DD_LLMOBS_ENABLED: true } })
     processor.setWriter(writer)
   })
 
@@ -37,7 +37,7 @@ describe('span processor', () => {
     let span
 
     it('should do nothing if llmobs is not enabled', () => {
-      processor = new LLMObsSpanProcessor({ llmobs: { enabled: false } })
+      processor = new LLMObsSpanProcessor({ llmobs: { DD_LLMOBS_ENABLED: false } })
 
       processor.process(span)
     })
diff --git a/packages/dd-trace/test/llmobs/tagger.spec.js b/packages/dd-trace/test/llmobs/tagger.spec.js
index fcde0eb48a..bd326626e7 100644
--- a/packages/dd-trace/test/llmobs/tagger.spec.js
+++ b/packages/dd-trace/test/llmobs/tagger.spec.js
@@ -60,12 +60,12 @@ describe('tagger', () => {
 
   describe('without softFail', () => {
     beforeEach(() => {
-      tagger = new Tagger({ llmobs: { enabled: true, mlApp: 'my-default-ml-app' } })
+      tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: true, mlApp: 'my-default-ml-app' } })
     })
 
     describe('registerLLMObsSpan', () => {
       it('will not set tags if llmobs is not enabled', () => {
-        tagger = new Tagger({ llmobs: { enabled: false } })
+        tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: false } })
         tagger.registerLLMObsSpan(span, 'llm')
 
         assert.deepStrictEqual(Tagger.tagMap.get(span), undefined)
@@ -293,7 +293,7 @@ describe('tagger', () => {
 
       describe('with no global mlApp configured', () => {
         beforeEach(() => {
-          tagger = new Tagger({ llmobs: { enabled: true } })
+          tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: true } })
         })
 
         it('uses the mlApp from the propagated mlApp if no mlApp is provided', () => {
@@ -310,7 +310,7 @@ describe('tagger', () => {
         })
 
         it('uses the service name if no mlApp is provided and no propagated mlApp is provided', () => {
-          tagger = new Tagger({ llmobs: { enabled: true }, service: 'my-service' })
+          tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: true }, service: 'my-service' })
           tagger.registerLLMObsSpan(span, { kind: 'llm' })
 
           const tags = Tagger.tagMap.get(span)
@@ -344,7 +344,7 @@ describe('tagger', () => {
         })
 
         it('does not write bridge tags when llmobs is disabled', () => {
-          tagger = new Tagger({ llmobs: { enabled: false } })
+          tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: false } })
           tagger.registerLLMObsSpan(span, { kind: 'workflow' })
 
           assert.strictEqual(spanContext._trace.tags.llmobs_trace_id, undefined)
@@ -413,7 +413,7 @@ describe('tagger', () => {
                 findGenAIAncestorSpanId,
               },
             })
-            realTagger = new RealTagger({ llmobs: { enabled: true, mlApp: 'test-app' } })
+            realTagger = new RealTagger({ llmobs: { DD_LLMOBS_ENABLED: true, mlApp: 'test-app' } })
           })
 
           it('detects a real gen_ai.* ancestor, suppresses llmobs_parent_id, and uses ancestor as event parent', () => {
@@ -1233,7 +1233,7 @@ describe('tagger', () => {
 
   describe('with softFail', () => {
     beforeEach(() => {
-      tagger = new Tagger({ llmobs: { enabled: true, mlApp: 'my-default-ml-app' } }, true)
+      tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: true, mlApp: 'my-default-ml-app' } }, true)
     })
 
     it('logs a warning when an unexpected value is encountered for text tagging', () => {
diff --git a/packages/dd-trace/test/plugins/util/llm.spec.js b/packages/dd-trace/test/plugins/util/llm.spec.js
index 77c0fb4646..139b228495 100644
--- a/packages/dd-trace/test/plugins/util/llm.spec.js
+++ b/packages/dd-trace/test/plugins/util/llm.spec.js
@@ -43,8 +43,8 @@ describe('llm utils', () => {
     beforeEach(() => {
       utils = makeUtilities('langchain', {
         langchain: {
-          spanCharLimit: 100,
-          spanPromptCompletionSampleRate: 0.6,
+          DD_LANGCHAIN_SPAN_CHAR_LIMIT: 100,
+          DD_LANGCHAIN_SPAN_PROMPT_COMPLETION_SAMPLE_RATE: 0.6,
         },
       })
     })
diff --git a/packages/dd-trace/test/profiling/config.spec.js b/packages/dd-trace/test/profiling/config.spec.js
index 8bfc299232..02b87c27f8 100644
--- a/packages/dd-trace/test/profiling/config.spec.js
+++ b/packages/dd-trace/test/profiling/config.spec.js
@@ -76,7 +76,7 @@ describe('config', () => {
       service: tracerConfig.service,
       version: tracerConfig.version,
       env: tracerConfig.env,
-      activation: getActivation(tracerConfig.profiling.enabled),
+      activation: getActivation(tracerConfig.profiling.DD_PROFILING_ENABLED),
       uploadTimeout: tracerConfig.DD_PROFILING_UPLOAD_TIMEOUT,
       pprofPrefix: tracerConfig.DD_PROFILING_PPROF_PREFIX,
     }
@@ -828,7 +828,7 @@ describe('config', () => {
   })
 
   describe('getActivation', () => {
-    it('should map the canonical profiling.enabled value to an activation', () => {
+    it('should map the canonical profiling.DD_PROFILING_ENABLED value to an activation', () => {
       assert.strictEqual(getActivation('auto'), 'auto')
       assert.strictEqual(getActivation('true'), 'manual')
       assert.strictEqual(getActivation('false'), 'unknown')
diff --git a/packages/dd-trace/test/profiling/exporters/agent.spec.js b/packages/dd-trace/test/profiling/exporters/agent.spec.js
index a30fc9d681..74a368331f 100644
--- a/packages/dd-trace/test/profiling/exporters/agent.spec.js
+++ b/packages/dd-trace/test/profiling/exporters/agent.spec.js
@@ -43,7 +43,7 @@ const profilerConfig = {
   DD_PROFILING_V8_PROFILER_BUG_WORKAROUND: false,
   DD_PROFILING_ALLOCATION_ENABLED: false,
   DD_PROFILING_HEAP_SAMPLING_INTERVAL: 512 * 1024,
-  telemetry: { heartbeatInterval: 60 * 1e3 },
+  telemetry: { DD_TELEMETRY_HEARTBEAT_INTERVAL: 60 * 1e3 },
 }
 
 async function createProfile (periodType) {
diff --git a/packages/dd-trace/test/profiling/profilers/wall.spec.js b/packages/dd-trace/test/profiling/profilers/wall.spec.js
index c9c95f4337..70207cc159 100644
--- a/packages/dd-trace/test/profiling/profilers/wall.spec.js
+++ b/packages/dd-trace/test/profiling/profilers/wall.spec.js
@@ -30,7 +30,7 @@ function makeWall (Cls, {
     DD_PROFILING_ENDPOINT_COLLECTION_ENABLED: endpointCollectionEnabled,
     DD_PROFILING_TIMELINE_ENABLED: timelineEnabled,
     DD_PROFILING_V8_PROFILER_BUG_WORKAROUND: v8ProfilerBugWorkaroundEnabled,
-    telemetry: { heartbeatInterval },
+    telemetry: { DD_TELEMETRY_HEARTBEAT_INTERVAL: heartbeatInterval },
   }, { asyncContextFrameEnabled, flushInterval })
 }
 
diff --git a/packages/dd-trace/test/proxy.spec.js b/packages/dd-trace/test/proxy.spec.js
index 8120089461..c272725515 100644
--- a/packages/dd-trace/test/proxy.spec.js
+++ b/packages/dd-trace/test/proxy.spec.js
@@ -161,7 +161,7 @@ describe('TracerProxy', () => {
       DD_CRASHTRACKING_ENABLED: false,
       dynamicInstrumentation: {},
       remoteConfig: {
-        enabled: true,
+        DD_REMOTE_CONFIGURATION_ENABLED: true,
       },
       runtimeMetrics: {
         enabled: false,
@@ -285,7 +285,7 @@ describe('TracerProxy', () => {
       })
 
       it('should not enable remote config when disabled', () => {
-        config.remoteConfig.enabled = false
+        config.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED = false
 
         proxy.init()
 
@@ -536,7 +536,7 @@ describe('TracerProxy', () => {
       })
 
       it('should not load the profiler when not configured', () => {
-        config.profiling = { enabled: false }
+        config.profiling = { DD_PROFILING_ENABLED: false }
 
         proxy.init()
 
@@ -552,7 +552,7 @@ describe('TracerProxy', () => {
       })
 
       it('should load profiler when configured', () => {
-        config.profiling = { enabled: 'true' }
+        config.profiling = { DD_PROFILING_ENABLED: 'true' }
 
         proxy.init()
 
@@ -560,7 +560,7 @@ describe('TracerProxy', () => {
       })
 
       it('should throw an error since profiler fails to be imported', () => {
-        config.profiling = { enabled: 'true' }
+        config.profiling = { DD_PROFILING_ENABLED: 'true' }
 
         const ProfilerImportFailureProxy = proxyquire('../src/proxy', {
           './tracer': DatadogTracer,
diff --git a/packages/dd-trace/test/span_processor.spec.js b/packages/dd-trace/test/span_processor.spec.js
index fe616cddc0..344c6532b8 100644
--- a/packages/dd-trace/test/span_processor.spec.js
+++ b/packages/dd-trace/test/span_processor.spec.js
@@ -60,8 +60,9 @@ describe('SpanProcessor', () => {
     config = {
       flushMinSpans: 3,
       stats: {
-        enabled: false,
+        DD_TRACE_STATS_COMPUTATION_ENABLED: false,
       },
+      appsec: {},
     }
     spanFormat = sinon.stub().returns({ formatted: true })
 
@@ -142,7 +143,8 @@ describe('SpanProcessor', () => {
 
   it('should configure span sampler correctly', () => {
     const config = {
-      stats: { enabled: false },
+      stats: { DD_TRACE_STATS_COMPUTATION_ENABLED: false },
+      appsec: {},
       sampler: {
         sampleRate: 0,
         spanSamplingRules: [
@@ -166,8 +168,9 @@ describe('SpanProcessor', () => {
     const config = {
       tracing: false,
       stats: {
-        enabled: false,
+        DD_TRACE_STATS_COMPUTATION_ENABLED: false,
       },
+      appsec: {},
     }
 
     const processor = new SpanProcessor(exporter, prioritySampler, config)
@@ -246,7 +249,12 @@ describe('SpanProcessor', () => {
 
     it('applies the OTel HTTP rename to the exported span', () => {
       spanFormat.returns(formattedHttpSpan())
-      const otelConfig = { flushMinSpans: 3, stats: { enabled: false }, DD_TRACE_OTEL_SEMANTICS_ENABLED: true }
+      const otelConfig = {
+        flushMinSpans: 3,
+        stats: { DD_TRACE_STATS_COMPUTATION_ENABLED: false },
+        appsec: {},
+        DD_TRACE_OTEL_SEMANTICS_ENABLED: true,
+      }
       const processor = new SpanProcessor(exporter, prioritySampler, otelConfig)
       trace.started = [finishedSpan]
       trace.finished = [finishedSpan]
@@ -261,7 +269,12 @@ describe('SpanProcessor', () => {
 
     it('records span stats from the Datadog tag names, before the export-only rename', () => {
       spanFormat.returns(formattedHttpSpan())
-      const otelConfig = { flushMinSpans: 3, stats: { enabled: false }, DD_TRACE_OTEL_SEMANTICS_ENABLED: true }
+      const otelConfig = {
+        flushMinSpans: 3,
+        stats: { DD_TRACE_STATS_COMPUTATION_ENABLED: false },
+        appsec: {},
+        DD_TRACE_OTEL_SEMANTICS_ENABLED: true,
+      }
       const processor = new SpanProcessor(exporter, prioritySampler, otelConfig)
       const statsView = {}
       processor._stats = {
diff --git a/packages/dd-trace/test/span_stats.spec.js b/packages/dd-trace/test/span_stats.spec.js
index f650196895..166fd68873 100644
--- a/packages/dd-trace/test/span_stats.spec.js
+++ b/packages/dd-trace/test/span_stats.spec.js
@@ -304,7 +304,7 @@ describe('SpanStatsProcessor', () => {
 
   const config = {
     stats: {
-      enabled: true,
+      DD_TRACE_STATS_COMPUTATION_ENABLED: true,
       interval: 10,
     },
     hostname: '127.0.0.1',
@@ -328,14 +328,14 @@ describe('SpanStatsProcessor', () => {
     assert.strictEqual(processor.interval, config.stats.interval)
     assert.ok(processor.buckets instanceof TimeBuckets)
     assert.strictEqual(processor.hostname, hostname())
-    assert.strictEqual(processor.enabled, config.stats.enabled)
+    assert.strictEqual(processor.enabled, config.stats.DD_TRACE_STATS_COMPUTATION_ENABLED)
     assert.strictEqual(processor.env, config.env)
     assert.deepStrictEqual(processor.tags, config.tags)
     assert.strictEqual(processor.version, config.version)
   })
 
   it('should construct a disabled instance', () => {
-    const disabledConfig = { ...config, stats: { enabled: false, interval: 10 } }
+    const disabledConfig = { ...config, stats: { DD_TRACE_STATS_COMPUTATION_ENABLED: false, interval: 10 } }
     const processor = new SpanStatsProcessor(disabledConfig)
 
     assert.strictEqual(processor.enabled, false)
diff --git a/packages/dd-trace/test/startup-log.spec.js b/packages/dd-trace/test/startup-log.spec.js
index 78b1468cb9..aa0df80865 100644
--- a/packages/dd-trace/test/startup-log.spec.js
+++ b/packages/dd-trace/test/startup-log.spec.js
@@ -26,6 +26,7 @@ const configWithStartupLogs = {
   runtimeMetrics: true,
   startupLogs: true,
   appsec: { enabled: true },
+  profiling: { DD_PROFILING_ENABLED: false },
   dsmEnabled: true,
 }
 
diff --git a/packages/dd-trace/test/telemetry/dependencies.spec.js b/packages/dd-trace/test/telemetry/dependencies.spec.js
index 11e3c7c33e..a5b2baf80d 100644
--- a/packages/dd-trace/test/telemetry/dependencies.spec.js
+++ b/packages/dd-trace/test/telemetry/dependencies.spec.js
@@ -360,7 +360,7 @@ describe('dependencies', () => {
   describe('with configuration', () => {
     const config = {
       telemetry: {
-        dependencyCollection: false,
+        DD_TELEMETRY_DEPENDENCY_COLLECTION_ENABLED: false,
       },
     }
     const application = 'test'
diff --git a/packages/dd-trace/test/telemetry/endpoints.spec.js b/packages/dd-trace/test/telemetry/endpoints.spec.js
index 3db487f4f0..8efbd77be0 100644
--- a/packages/dd-trace/test/telemetry/endpoints.spec.js
+++ b/packages/dd-trace/test/telemetry/endpoints.spec.js
@@ -31,14 +31,14 @@ describe('endpoints telemetry', () => {
     })
 
     it('should subscribe', () => {
-      const config = { appsec: { apiSecurity: { endpointCollectionEnabled: true } } }
+      const config = { appsec: { DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: true } }
       endpoints.start(config)
 
       sinon.assert.calledThrice(subscribe)
     })
 
     it('should not subscribe', () => {
-      const config = { appsec: { apiSecurity: { endpointCollectionEnabled: false } } }
+      const config = { appsec: { DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false } }
       endpoints.start(config)
 
       sinon.assert.notCalled(subscribe)
@@ -68,10 +68,8 @@ describe('endpoints telemetry', () => {
 
       const config = {
         appsec: {
-          apiSecurity: {
-            endpointCollectionEnabled: true,
-            endpointCollectionMessageLimit: 100,
-          },
+          DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: true,
+          DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT: 100,
         },
       }
 
diff --git a/packages/dd-trace/test/telemetry/index.spec.js b/packages/dd-trace/test/telemetry/index.spec.js
index e636da486c..3257deb37a 100644
--- a/packages/dd-trace/test/telemetry/index.spec.js
+++ b/packages/dd-trace/test/telemetry/index.spec.js
@@ -43,7 +43,7 @@ describe('telemetry (proxy)', () => {
   })
 
   it('should proxy when enabled', () => {
-    const config = { telemetry: { enabled: true } }
+    const config = { telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true } }
 
     proxy.start(config)
     proxy.updateIntegrations()
@@ -57,7 +57,7 @@ describe('telemetry (proxy)', () => {
   })
 
   it('should proxy when enabled from updateConfig', () => {
-    const config = { telemetry: { enabled: true } }
+    const config = { telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true } }
 
     proxy.updateConfig([], config)
     proxy.updateIntegrations()
@@ -122,9 +122,9 @@ describe('telemetry', () => {
 
     telemetry.start({
       telemetry: {
-        enabled: true,
-        heartbeatInterval: DEFAULT_HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: DEFAULT_HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: traceAgent.address().port,
@@ -135,8 +135,8 @@ describe('telemetry', () => {
         'runtime-id': '1a2b3c',
       },
       circularObject,
-      appsec: { enabled: true },
-      profiling: { enabled: 'true' },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: 'true' },
       peerServiceMapping: {
         service_1: 'remapped_service_1',
         service_2: 'remapped_service_2',
@@ -254,13 +254,13 @@ describe('telemetry', () => {
     }).listen(0, () => {
       telemetry.start({
         telemetry: {
-          enabled: false,
-          heartbeatInterval: 60000,
-          extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+          DD_INSTRUMENTATION_TELEMETRY_ENABLED: false,
+          DD_TELEMETRY_HEARTBEAT_INTERVAL: 60000,
+          DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
         },
         hostname: 'localhost',
         port: (/** @type {import('net').AddressInfo} */ (server.address())).port,
-        appsec: { sca: { enabled: false } },
+        appsec: { DD_APPSEC_SCA_ENABLED: false },
       })
 
       setTimeout(() => {
@@ -279,12 +279,12 @@ describe('telemetry', () => {
     })
     notEnabledTelemetry.start({
       telemetry: {
-        enabled: false,
-        heartbeatInterval: DEFAULT_HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: false,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: DEFAULT_HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
-      appsec: { enabled: false, sca: { enabled: undefined } },
-      profiling: { enabled: false },
+      appsec: { enabled: false, DD_APPSEC_SCA_ENABLED: undefined },
+      profiling: { DD_PROFILING_ENABLED: false },
     }, {
       _pluginsByName: pluginsByName,
     })
@@ -331,16 +331,16 @@ describe('telemetry app-heartbeat', () => {
 
     telemetry.start({
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -399,16 +399,16 @@ describe('Telemetry extended heartbeat', () => {
 
     telemetry.start({
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -444,16 +444,16 @@ describe('Telemetry extended heartbeat', () => {
 
     const config = {
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -551,16 +551,16 @@ describe('Telemetry extended heartbeat', () => {
 
     const config = {
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -647,16 +647,16 @@ describe('Telemetry retry', () => {
 
     telemetry.start({
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -740,16 +740,16 @@ describe('Telemetry retry', () => {
 
     telemetry.start({
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -815,16 +815,16 @@ describe('Telemetry retry', () => {
 
     telemetry.start({
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -881,16 +881,16 @@ describe('Telemetry retry', () => {
     // Start function sends 2 messages app-started & app-integrations-change
     telemetry.start({
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -969,16 +969,16 @@ describe('Telemetry retry', () => {
     // Start function sends 2 messages app-started & app-integrations-change
     telemetry.start({
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -1068,9 +1068,9 @@ describe('AVM OSS', () => {
 
           telemetryConfig = {
             telemetry: {
-              enabled: true,
-              heartbeatInterval: HEARTBEAT_INTERVAL,
-              extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+              DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+              DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+              DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
             },
             hostname: 'localhost',
             port: traceAgent.address().port,
@@ -1080,8 +1080,8 @@ describe('AVM OSS', () => {
             tags: {
               'runtime-id': '1a2b3c',
             },
-            appsec: { enabled: false },
-            profiling: { enabled: false },
+            appsec: { enabled: false, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+            profiling: { DD_PROFILING_ENABLED: false },
           }
         })
 
@@ -1139,8 +1139,8 @@ describe('AVM OSS', () => {
     it('should log a warning when sca is enabled and telemetry no', () => {
       telemetry.start(
         {
-          telemetry: { enabled: false },
-          appsec: { sca: { enabled: true } },
+          telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: false },
+          appsec: { DD_APPSEC_SCA_ENABLED: true },
         }
       )
 
diff --git a/packages/dd-trace/test/telemetry/logs/index.spec.js b/packages/dd-trace/test/telemetry/logs/index.spec.js
index 4394f4d703..87b1611863 100644
--- a/packages/dd-trace/test/telemetry/logs/index.spec.js
+++ b/packages/dd-trace/test/telemetry/logs/index.spec.js
@@ -18,9 +18,9 @@ describe('telemetry logs', () => {
   beforeEach(() => {
     defaultConfig = {
       telemetry: {
-        enabled: true,
-        logCollection: true,
-        debug: false,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_LOG_COLLECTION_ENABLED: true,
+        DD_TELEMETRY_DEBUG: false,
       },
     }
 
@@ -65,7 +65,7 @@ describe('telemetry logs', () => {
         'dc-polyfill': dc,
       })
 
-      defaultConfig.telemetry.logCollection = false
+      defaultConfig.telemetry.DD_TELEMETRY_LOG_COLLECTION_ENABLED = false
       logs.start(defaultConfig)
 
       sinon.assert.notCalled(telemetryLog.subscribe)
@@ -222,7 +222,7 @@ describe('telemetry logs', () => {
     })
 
     it('should not drain logCollector and call sendData if not enabled', () => {
-      defaultConfig.telemetry.logCollection = false
+      defaultConfig.telemetry.DD_TELEMETRY_LOG_COLLECTION_ENABLED = false
 
       logs.start(defaultConfig)
 
diff --git a/packages/dd-trace/test/telemetry/send-data.spec.js b/packages/dd-trace/test/telemetry/send-data.spec.js
index b951a1d46c..b06416a378 100644
--- a/packages/dd-trace/test/telemetry/send-data.spec.js
+++ b/packages/dd-trace/test/telemetry/send-data.spec.js
@@ -83,7 +83,7 @@ describe('sendData', () => {
     sendDataModule.sendData({
       url: '/test',
       tags: { 'runtime-id': '123' },
-      telemetry: { debug: true },
+      telemetry: { DD_TELEMETRY_DEBUG: true },
     }, application, host, 'req-type')
 
     sinon.assert.calledOnce(request)
diff --git a/packages/dd-trace/test/telemetry/session-propagation.spec.js b/packages/dd-trace/test/telemetry/session-propagation.spec.js
index 00363dacbe..0db1f94ca5 100644
--- a/packages/dd-trace/test/telemetry/session-propagation.spec.js
+++ b/packages/dd-trace/test/telemetry/session-propagation.spec.js
@@ -40,13 +40,13 @@ describe('session-propagation', () => {
   function createConfig (overrides = {}) {
     /**
      * @type {{
-     *   telemetry: { enabled: boolean },
+     *   telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: boolean },
      *   DD_ROOT_JS_SESSION_ID: string | undefined,
      *   tags: { 'runtime-id': string }
      * }}
      */
     const config = {
-      telemetry: { enabled: true, ...overrides.telemetry },
+      telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true, ...overrides.telemetry },
       DD_ROOT_JS_SESSION_ID: undefined,
       tags: { 'runtime-id': 'current-id', ...overrides.tags },
     }
@@ -192,7 +192,7 @@ describe('session-propagation', () => {
     })
 
     it('does not change child process execution when telemetry is disabled', () => {
-      sessionPropagation.start(createConfig({ telemetry: { enabled: false } }))
+      sessionPropagation.start(createConfig({ telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: false } }))
 
       const context = {
         callArgs: ['node', ['test.js'], { cwd: '/tmp', env: { FOO: 'bar' } }],
diff --git a/scripts/generate-config-types.js b/scripts/generate-config-types.js
index bd7b05a302..6376b8c86e 100644
--- a/scripts/generate-config-types.js
+++ b/scripts/generate-config-types.js
@@ -57,8 +57,10 @@ function createTreeNode () {
 }
 
 function getPropertyName (canonicalName, entry) {
-  const configurationNames = entry.internalPropertyName ? [entry.internalPropertyName] : entry.configurationNames
-  return configurationNames?.[0] ?? canonicalName
+  if (entry.namespace) {
+    return `${entry.namespace}.${canonicalName}`
+  }
+  return entry.internalPropertyName ?? entry.configurationNames?.[0] ?? canonicalName
 }
 
 const FALLBACK_PATTERN =

From d1af821f7d4e1905b2d9653beccc4aed080a61be Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Fri, 26 Jun 2026 23:34:42 +0200
Subject: [PATCH 07/51] perf(loader): match instrumented modules with a
 shouldInclude predicate (#9026)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

import-in-the-middle scanned the include and exclude arrays once per resolved
module — up to ~290 include entries (RegExp.test or string compare) plus a
fileURLToPath on every resolve, nearly all against modules that match nothing.
Supplying iitm 3.2.0's shouldInclude predicate replaces that scan with a single
Set lookup for bare specifiers and one combined RegExp covering every
instrumented node_modules path and the configured security-control subpaths,
plus one RegExp for the exclusions. Over a mixed resolve corpus this drops the
per-resolve matching cost from ~2.5µs to ~25ns (about 100x).

The Set also carries each built-in's node: specifier, mirroring iitm's include
expansion, so `import 'node:crypto'` stays instrumented alongside
`import 'crypto'`. Package names pass through regexpEscape so a metacharacter in
a future package name cannot mis-match.

The .mjs rewriter loader spec was the repository's only .spec.mjs and no CI job
ran it: the misc suite glob matched .spec.js only, and the exercised-tests gate
collected .spec.js/.test.mjs but not .spec.mjs, so it could not flag the orphan.

1. Match *.spec.{js,mjs} in test:instrumentations:misc so the spec runs.
2. Widen verify-exercised-tests globs to @(spec|test).@(js|mjs|cjs) so every
   naming convention is tracked and an unrun one fails the gate.
3. Load the loader through require(esm) where the runtime supports it so its
   transforms land on nyc's CommonJS instrumentation path; gate on
   process.features.require_module so Node 18 falls back to import() instead of
   crashing the suite on the CommonJS compiler's SyntaxError.
---
 initialize.mjs                                |  11 +-
 loader-hook.mjs                               | 131 ++++++++++--------
 package.json                                  |   4 +-
 .../test/helpers/rewriter/loader.spec.mjs     |  22 ++-
 scripts/verify-exercised-tests.js             |  18 +--
 yarn.lock                                     |   8 +-
 6 files changed, 115 insertions(+), 79 deletions(-)

diff --git a/initialize.mjs b/initialize.mjs
index 9fda189d8c..df0ba5b6aa 100644
--- a/initialize.mjs
+++ b/initialize.mjs
@@ -19,7 +19,7 @@ import { isMainThread } from 'worker_threads'
 // This file must support Node.js 12.0.0 syntax
 
 import {
-  iitmExclusions,
+  iitmExclusionRegExp,
   load as hookLoad,
   resolve as hookResolve,
 } from './loader-hook.mjs'
@@ -67,8 +67,7 @@ const [NODE_MAJOR, NODE_MINOR] = process.versions.node.split('.').map(Number)
 const brokenLoaders = NODE_MAJOR === 18 && NODE_MINOR === 0
 
 export async function load (url, context, nextLoad) {
-  const iitmExclusionsMatch = iitmExclusions.some((exclusion) => exclusion.test(url))
-  const loadHook = (brokenLoaders || iitmExclusionsMatch) ? nextLoad : hookLoad
+  const loadHook = (brokenLoaders || iitmExclusionRegExp.test(url)) ? nextLoad : hookLoad
   return insertInit(await loadHook(url, context, nextLoad), url, context)
 }
 
@@ -78,8 +77,8 @@ if (isMainThread) {
   const require = Module.createRequire(import.meta.url)
   require('./init.js')
   if (Module.register) {
-    Module.register('./loader-hook.mjs', import.meta.url, {
-      data: { exclude: iitmExclusions },
-    })
+    // The loader builds its own include/exclude matcher in `initialize`, so no
+    // options need to cross the registration boundary.
+    Module.register('./loader-hook.mjs', import.meta.url)
   }
 }
diff --git a/loader-hook.mjs b/loader-hook.mjs
index c52e204c0a..5f363b9cde 100644
--- a/loader-hook.mjs
+++ b/loader-hook.mjs
@@ -13,12 +13,37 @@ import { isRelativeRequire } from './packages/datadog-instrumentations/src/helpe
 
 // This file must support Node.js 12.0.0 syntax
 
+const { builtinModules } = Module
 const regexpEscape = regexpEscapeModule.default
 const require = Module.createRequire(import.meta.url)
 let syncImportInTheMiddleHook
 
-// For some reason `getEnvironmentVariable` is not otherwise available to ESM.
-const env = configHelper.getEnvironmentVariable
+// The config helper's named exports aren't visible to ESM; destructure the default.
+const { getValueFromEnvSources } = configHelper
+
+// Substrings of resolved URLs that import-in-the-middle must never wrap: re-export
+// shims and internal helper graphs that break when proxied, plus iitm's own files
+// (via `middle`). One alternation so a single test() covers every excluded load.
+export const iitmExclusionRegExp = /middle|langsmith|openai\/_shims|openai\/resources\/chat\/completions\/messages|openai\/agents-core\/dist\/shims|@anthropic-ai\/sdk\/_shims/
+
+// Instrumented bare specifiers (`import 'express'`, builtins, symlinked or
+// workspace packages) match against the specifier (the Set); their files inside
+// node_modules match against the URL (the alternation). regexpEscape guards
+// against a regex metacharacter entering a package name.
+const includeModuleNames = new Set()
+let moduleNameAlternation = ''
+for (const moduleName of Object.keys(hooks)) {
+  // Relative hooks resolve outside node_modules and are not instrumented here.
+  if (isRelativeRequire(moduleName)) continue
+  includeModuleNames.add(moduleName)
+  // iitm matches a built-in by its node: specifier too, so mirror that and
+  // wrap `import 'node:crypto'` as well as `import 'crypto'`.
+  if (builtinModules.includes(moduleName)) includeModuleNames.add(`node:${moduleName}`)
+  if (moduleNameAlternation !== '') moduleNameAlternation += '|'
+  moduleNameAlternation += regexpEscape(moduleName)
+}
+
+const nodeModulesIncludeSource = `node_modules/(?:${moduleNameAlternation})/(?!node_modules).+`
 
 function initialize (data = {}) {
   prepareImportInTheMiddleOptions(data)
@@ -26,16 +51,59 @@ function initialize (data = {}) {
 }
 
 function prepareImportInTheMiddleOptions (data = {}) {
-  if (data.include == null) data.include = []
-  if (data.exclude == null) data.exclude = []
-
-  addInstrumentations(data)
-  addSecurityControls(data)
-  addExclusions(data)
+  // A consumer-owned shouldInclude predicate takes over the wrapping decision, so
+  // iitm ignores the include/exclude arrays. Building the matcher here keeps the
+  // synchronous and asynchronous loaders on one matching implementation.
+  data.shouldInclude = createShouldInclude(getValueFromEnvSources('DD_IAST_SECURITY_CONTROLS_CONFIGURATION'))
 
   return data
 }
 
+/**
+ * Builds the import-in-the-middle `shouldInclude(url, specifier)` predicate. iitm
+ * calls it for every resolved module and wraps the module when the result is
+ * truthy; supplying it replaces iitm's include/exclude list scan.
+ *
+ * @param {string} [securityControlsConfig] Raw `DD_IAST_SECURITY_CONTROLS_CONFIGURATION`;
+ *   each entry's module path is instrumented in addition to the hook table.
+ */
+function createShouldInclude (securityControlsConfig) {
+  const includeRegExp = new RegExp(buildIncludeSource(securityControlsConfig))
+
+  /**
+   * @param {string} url Resolved module URL (`file:`, `node:`, ...).
+   * @param {string} specifier Original import specifier.
+   */
+  return function shouldInclude (url, specifier) {
+    return (includeModuleNames.has(specifier) || includeRegExp.test(url)) && !iitmExclusionRegExp.test(url)
+  }
+}
+
+/**
+ * Appends each `DD_IAST_SECURITY_CONTROLS_CONFIGURATION` module path — the third
+ * `:`-separated segment of every `;`-separated `<type>:<marks>:<module>:<...>` entry —
+ * to the include alternation, escaped.
+ *
+ * @param {string} [securityControlsConfig] Raw `DD_IAST_SECURITY_CONTROLS_CONFIGURATION`.
+ */
+function buildIncludeSource (securityControlsConfig) {
+  if (!securityControlsConfig) return nodeModulesIncludeSource
+
+  let includeSource = nodeModulesIncludeSource
+  for (const entry of securityControlsConfig.split(';')) {
+    if (!entry) continue
+    const first = entry.indexOf(':')
+    if (first === -1) continue
+    const second = entry.indexOf(':', first + 1)
+    if (second === -1) continue
+    const third = entry.indexOf(':', second + 1)
+
+    const subpath = entry.slice(second + 1, third === -1 ? undefined : third).trim()
+    if (subpath) includeSource += `|${regexpEscape(subpath)}`
+  }
+  return includeSource
+}
+
 function load (url, context, nextLoad) {
   return rewriterLoader.load(url, context, (url, context) => origLoad(url, context, nextLoad))
 }
@@ -113,51 +181,4 @@ function registerSyncLoaderHooks (data = {}) {
   return true
 }
 
-function addInstrumentations (data) {
-  const instrumentations = Object.keys(hooks)
-
-  for (const moduleName of instrumentations) {
-    // Skip instrumentation hooks with relative module names
-    // since there is no current business need of instrumenting imports outside of the node_modules folder
-    if (!isRelativeRequire(moduleName)) {
-      data.include.push(new RegExp(`node_modules/${moduleName}/(?!node_modules).+`), moduleName)
-    }
-  }
-}
-
-function addSecurityControls (data) {
-  const raw = env('DD_IAST_SECURITY_CONTROLS_CONFIGURATION')
-  if (!raw) return
-  // Parse `;`-separated entries and take the 3rd `:`-separated segment.
-  // Expected form (per entry): `<...>:<...>:<subpath>:<...>`
-  const entries = raw.split(';')
-  for (const entry of entries) {
-    if (entry) {
-      const first = entry.indexOf(':')
-      if (first === -1) continue
-      const second = entry.indexOf(':', first + 1)
-      if (second === -1) continue
-      const third = entry.indexOf(':', second + 1)
-
-      const subpath = entry.slice(second + 1, third === -1 ? undefined : third).trim()
-      if (subpath) {
-        data.include.push(new RegExp(regexpEscape(subpath)))
-      }
-    }
-  }
-}
-
-function addExclusions (data) {
-  data.exclude.push(...iitmExclusions)
-}
-
-export const iitmExclusions = [
-  /middle/,
-  /langsmith/,
-  /openai\/_shims/,
-  /openai\/resources\/chat\/completions\/messages/,
-  /openai\/agents-core\/dist\/shims/,
-  /@anthropic-ai\/sdk\/_shims/,
-]
-
 export { initialize, load, registerSyncLoaderHooks, resolve }
diff --git a/package.json b/package.json
index d317a02211..80a44b2c5b 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "test:webpack:ci": "nyc --silent node init && nyc -- npm run test:webpack",
     "test:instrumentations": "mocha \"packages/datadog-instrumentations/test/@(${PLUGINS}).spec.js\"",
     "test:instrumentations:ci": "yarn services && nyc --silent node init && nyc -- npm run test:instrumentations",
-    "test:instrumentations:misc": "mocha \"packages/datadog-instrumentations/test/*/**/*.spec.js\"",
+    "test:instrumentations:misc": "mocha \"packages/datadog-instrumentations/test/*/**/*.spec.{js,mjs}\"",
     "test:instrumentations:misc:ci": "nyc --silent node init && nyc -- npm run test:instrumentations:misc",
     "test:core": "node scripts/mocha-parallel-files.js --expose-gc --timeout 30000 -- \"packages/datadog-core/test/**/*.spec.js\"",
     "test:core:ci": "nyc --silent node init && nyc -- npm run test:core",
@@ -164,7 +164,7 @@
   ],
   "dependencies": {
     "dc-polyfill": "^0.1.11",
-    "import-in-the-middle": "^3.1.0",
+    "import-in-the-middle": "^3.2.0",
     "opentracing": ">=0.14.7"
   },
   "optionalDependencies": {
diff --git a/packages/datadog-instrumentations/test/helpers/rewriter/loader.spec.mjs b/packages/datadog-instrumentations/test/helpers/rewriter/loader.spec.mjs
index dad773e6da..fdc68672ca 100644
--- a/packages/datadog-instrumentations/test/helpers/rewriter/loader.spec.mjs
+++ b/packages/datadog-instrumentations/test/helpers/rewriter/loader.spec.mjs
@@ -1,20 +1,36 @@
 import assert from 'node:assert/strict'
 import { spawnSync } from 'node:child_process'
 import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
 import { tmpdir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
 
 import { supportsSyncHooks } from 'import-in-the-middle/create-hook.mjs'
-import { describe, it } from 'mocha'
-
-import { load, loadSync } from '../../../src/helpers/rewriter/loader.mjs'
+import { before, describe, it } from 'mocha'
 
+const require = createRequire(import.meta.url)
 const source = 'export function getTracer () { return "tracer" }\n'
 const testDirectory = dirname(fileURLToPath(import.meta.url))
 const repositoryRoot = resolve(testDirectory, '../../../../..')
 
 describe('rewriter loader', () => {
+  let load
+  let loadSync
+
+  before(async () => {
+    // require(esm) keeps the loader on nyc's CommonJS instrumentation path so its
+    // transforms count as covered. Without require(esm), nyc's .mjs require extension
+    // feeds the module to the CommonJS compiler, which throws on its ESM `import`.
+    // The property is absent (undefined) before Node 20.19/22.10, which is the false branch.
+    // eslint-disable-next-line n/no-unsupported-features/node-builtins
+    const rewriterLoader = process.features.require_module
+      ? require('../../../src/helpers/rewriter/loader.mjs')
+      : await import('../../../src/helpers/rewriter/loader.mjs')
+    load = rewriterLoader.load
+    loadSync = rewriterLoader.loadSync
+  })
+
   it('rewrites async loader results', async () => {
     const url = createAiModuleUrl()
     const result = await load(url, { format: 'module' }, () => ({ format: 'module', source }))
diff --git a/scripts/verify-exercised-tests.js b/scripts/verify-exercised-tests.js
index 720ac8218e..c5e3a20d85 100644
--- a/scripts/verify-exercised-tests.js
+++ b/scripts/verify-exercised-tests.js
@@ -347,10 +347,10 @@ function parseExportAssignments (run) {
 function findTestFiles (repoRoot) {
   const commonGlobOpts = { cwd: repoRoot, nodir: true, windowsPathsNoEscape: true, ignore: DEFAULT_IGNORE_GLOBS }
 
-  const files = [
-    ...globSyncCached('**/*.spec.js', commonGlobOpts),
-    ...globSyncCached('**/*.test.mjs', commonGlobOpts),
-  ]
+  // Collect every test-file naming convention used in the repo so an unrun spec
+  // can never slip through untracked. Kept deliberately wide (js/mjs/cjs) even
+  // where no file currently uses an extension, so a future one is caught.
+  const files = globSyncCached('**/*.@(spec|test).@(js|mjs|cjs)', commonGlobOpts)
 
   files.sort((a, b) => a.localeCompare(b, 'en'))
   return files
@@ -883,7 +883,7 @@ function getTraceCoreCategoriesFromScripts (scripts) {
  * @returns {Set<string>}
  */
 function findDdTraceTestCategories (repoRoot) {
-  const files = globSyncCached('packages/dd-trace/test/*/**/*.spec.js', {
+  const files = globSyncCached('packages/dd-trace/test/*/**/*.@(spec|test).@(js|mjs|cjs)', {
     cwd: repoRoot,
     nodir: true,
     windowsPathsNoEscape: true,
@@ -912,7 +912,7 @@ function findDdTraceTestCategories (repoRoot) {
  * @returns {string[]}
  */
 function listDdTraceCategorySpecFiles (repoRoot, category) {
-  const files = globSyncCached(`packages/dd-trace/test/${category}/**/*.spec.js`, {
+  const files = globSyncCached(`packages/dd-trace/test/${category}/**/*.@(spec|test).@(js|mjs|cjs)`, {
     cwd: repoRoot,
     nodir: true,
     windowsPathsNoEscape: true,
@@ -953,7 +953,7 @@ function isCategoryCoveredByOtherScript (scriptPrefixes, category) {
  * @returns {Set<string>}
  */
 function buildAppsecPluginTestSet (repoRoot) {
-  const files = globSyncCached('packages/dd-trace/test/appsec/**/*.plugin.spec.js', {
+  const files = globSyncCached('packages/dd-trace/test/appsec/**/*.plugin.@(spec|test).@(js|mjs|cjs)', {
     cwd: repoRoot,
     nodir: true,
     windowsPathsNoEscape: true,
@@ -965,7 +965,7 @@ function buildAppsecPluginTestSet (repoRoot) {
   for (const f of files) {
     const base = path.basename(f)
     // e.g. graphql.apollo-server-express.plugin.spec.js -> apollo-server-express
-    const m = base.match(/\.([^.]+)\.plugin\.spec\.js$/)
+    const m = base.match(/\.([^.]+)\.plugin\.(?:spec|test)\.[mc]?js$/)
     if (m && m[1]) out.add(m[1])
   }
   return out
@@ -976,7 +976,7 @@ function buildAppsecPluginTestSet (repoRoot) {
  * @returns {Set<string>}
  */
 function buildLlmobsPluginTestSet (repoRoot) {
-  const files = globSyncCached('packages/dd-trace/test/llmobs/plugins/*/*.spec.js', {
+  const files = globSyncCached('packages/dd-trace/test/llmobs/plugins/*/*.@(spec|test).@(js|mjs|cjs)', {
     cwd: repoRoot,
     nodir: true,
     windowsPathsNoEscape: true,
diff --git a/yarn.lock b/yarn.lock
index 1c04c7f2bc..5773f4d2da 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2659,10 +2659,10 @@ import-fresh@^3.2.1:
     parent-module "^1.0.0"
     resolve-from "^4.0.0"
 
-import-in-the-middle@^3.1.0:
-  version "3.1.0"
-  resolved "https://registry.yarnpkg.com/import-in-the-middle/-/import-in-the-middle-3.1.0.tgz#0d0e88c93c276599bd4bf81835946d723656efab"
-  integrity sha512-c0AeAV8VcwZzfYE7euTZY3H+VXUPMVugiovdosq80lqEXJmOekg3zGUAYg6KImHMaMuBoTUfTv7xNpUFdy0hJA==
+import-in-the-middle@^3.2.0:
+  version "3.2.0"
+  resolved "https://registry.yarnpkg.com/import-in-the-middle/-/import-in-the-middle-3.2.0.tgz#ef596b83cdef975940239b2f04d874585910197a"
+  integrity sha512-vR2B6HKIhaBjcZr2bLpFiJ1VbzOlRQ7aby4/gw5WPIzToLjqpfWw3VJ4sk1uDchoOODEirvO2jyrSPtUSL5CrQ==
   dependencies:
     acorn "^8.15.0"
     acorn-import-attributes "^1.9.5"

From e97225d65c8d16cc71586bf76a2977120002bbee Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Fri, 26 Jun 2026 23:59:43 +0200
Subject: [PATCH 08/51] test(llmobs): use DD_LLMOBS_ENABLED in tagger sampling
 fixtures (#9107)

The sampling tests in #9030 build their own taggers with `{ llmobs:
{ enabled: true } }`, and #8943 renamed that config key to
`DD_LLMOBS_ENABLED` everywhere it could see. The two landed in parallel,
so #8943 normalized the rest of the file but never saw these four
fixtures. On master the tagger now reads `DD_LLMOBS_ENABLED`, finds it
undefined, and returns before registering the span; `Tagger.tagMap.get`
then yields undefined and the "DROPPED at sampleRate 0" test throws
synchronously, aborting the whole `test:llmobs:sdk:ci` run with exit 7.

Fixes: https://github.com/DataDog/dd-trace-js/actions/runs/28265509637/job/83751636644
---
 packages/dd-trace/test/llmobs/tagger.spec.js | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/dd-trace/test/llmobs/tagger.spec.js b/packages/dd-trace/test/llmobs/tagger.spec.js
index bd326626e7..b74f6645d9 100644
--- a/packages/dd-trace/test/llmobs/tagger.spec.js
+++ b/packages/dd-trace/test/llmobs/tagger.spec.js
@@ -196,7 +196,7 @@ describe('tagger', () => {
         })
 
         it('records a DROPPED decision on a root span when sampleRate is 0', () => {
-          tagger = new Tagger({ llmobs: { enabled: true, mlApp: 'my-default-ml-app', sampleRate: 0 } })
+          tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: true, mlApp: 'my-default-ml-app', sampleRate: 0 } })
           tagger.registerLLMObsSpan(span, { kind: 'llm' })
 
           const tags = Tagger.tagMap.get(span)
@@ -206,7 +206,7 @@ describe('tagger', () => {
 
         it('truncates a longer rate to at most 6 decimals', () => {
           // 1/3 = 0.3333... which must be capped at 6 decimal places.
-          tagger = new Tagger({ llmobs: { enabled: true, mlApp: 'my-default-ml-app', sampleRate: 1 / 3 } })
+          tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: true, mlApp: 'my-default-ml-app', sampleRate: 1 / 3 } })
           tagger.registerLLMObsSpan(span, { kind: 'llm' })
 
           assert.strictEqual(Tagger.tagMap.get(span)['_ml_obs.sample_rate'], '0.333333')
@@ -214,7 +214,7 @@ describe('tagger', () => {
 
         it('strips trailing zeros from a fractional rate', () => {
           // 0.25 -> "0.250000" via toFixed(6), which must be stripped back to "0.25".
-          tagger = new Tagger({ llmobs: { enabled: true, mlApp: 'my-default-ml-app', sampleRate: 0.25 } })
+          tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: true, mlApp: 'my-default-ml-app', sampleRate: 0.25 } })
           tagger.registerLLMObsSpan(span, { kind: 'llm' })
 
           assert.strictEqual(Tagger.tagMap.get(span)['_ml_obs.sample_rate'], '0.25')
@@ -253,7 +253,7 @@ describe('tagger', () => {
           // The tagger reads sampleRate from config on each root decision, so a
           // mutation (such as a future remote config update) takes effect without
           // re-instantiating the tagger.
-          const config = { llmobs: { enabled: true, mlApp: 'my-default-ml-app', sampleRate: 1 } }
+          const config = { llmobs: { DD_LLMOBS_ENABLED: true, mlApp: 'my-default-ml-app', sampleRate: 1 } }
           tagger = new Tagger(config)
 
           tagger.registerLLMObsSpan(span, { kind: 'llm' })

From 518772c283ed021abb7826d15e5c8f6c44a85c02 Mon Sep 17 00:00:00 2001
From: Crystal Luc-Magloire <crystal.magloire@datadoghq.com>
Date: Fri, 26 Jun 2026 23:06:07 -0400
Subject: [PATCH 09/51] refactor(graphql): migrate shimmer to orchestrion
 instrumentation (#7757)

feat(graphql): migrate instrumentation to orchestrion

  Migrates GraphQL instrumentation from shimmer wrappers to orchestrion AST rewriting for graphql execute / parse / validate entry points, including CJS and ESM paths for graphql >=0.10 and @graphql-tools/executor.

  Moves resolver instrumentation into the GraphQL execute plugin. The execute plugin now owns per-execute root context, resolver wrapping, resolve-span lifecycle, source tracking, and resolver hook invocation. The old separate resolve plugin is removed.

  Preserves and tests the existing cross-feature contracts:
  - IAST still receives one apm:graphql:resolve:start publish per resolver call, using the actual GraphQL args object.
  - AppSec still receives resolver payloads through datadog:graphql:resolver:start and can abort synchronously through the shared abort controller.
  - depth only limits resolve-span creation; IAST/AppSec resolver publishes still happen for depth-gated fields.
  - depth-gated resolvers now honor abort signals before falling through the no-span fast path.
  - caller-owned execute args and contextValue are preserved without mutation.
  - default field resolver behavior matches graphql for primitive parent values.
  - graphql-yoga / @graphql-tools/executor execution is instrumented.

  Adds public TypeScript declarations for the GraphQL resolve hook and FieldContext payload.

  Keeps the implementation orchestrion-only, with no shimmer fallback, and updates the GraphQL long benchmark calibration for the migrated hot path.

  Regression coverage was added for:
  - resolver abort behavior past the configured depth
  - depth: 0 AppSec resolver-channel publishing
  - primitive-source defaultFieldResolver parity
  - caller-supplied and frozen execute args
  - primitive contextValue forwarding
  - Yoga normalized executor instrumentation
  - IAST/AppSec per-resolver channel cardinality

  Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
  Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>
---
 .../references/orchestrion.md                 |  89 +++
 benchmark/sirun/plugin-graphql-long/meta.json |   2 +-
 docs/test.ts                                  |   3 +-
 index.d.ts                                    |  13 +
 index.d.v5.ts                                 |  13 +
 .../datadog-instrumentations/src/graphql.js   | 521 +-------------
 .../rewriter/instrumentations/graphql.js      | 201 ++++++
 .../rewriter/instrumentations/index.js        |   1 +
 .../datadog-plugin-graphql/src/execute.js     | 637 +++++++++++++++++-
 packages/datadog-plugin-graphql/src/index.js  |  21 +-
 packages/datadog-plugin-graphql/src/parse.js  |  28 +-
 .../datadog-plugin-graphql/src/resolve.js     | 170 -----
 .../datadog-plugin-graphql/src/validate.js    |  21 +-
 .../test/esm-test/esm-graphql-yoga-server.mjs |  10 +
 .../test/esm-test/esm.spec.js                 |  35 +
 .../datadog-plugin-graphql/test/index.spec.js | 258 ++++++-
 packages/dd-trace/src/appsec/channels.js      |   2 +-
 packages/dd-trace/src/appsec/graphql.js       |  10 +-
 packages/dd-trace/test/appsec/graphql.spec.js |  35 +-
 19 files changed, 1343 insertions(+), 727 deletions(-)
 create mode 100644 packages/datadog-instrumentations/src/helpers/rewriter/instrumentations/graphql.js
 delete mode 100644 packages/datadog-plugin-graphql/src/resolve.js

diff --git a/.agents/skills/apm-integrations/references/orchestrion.md b/.agents/skills/apm-integrations/references/orchestrion.md
index 092303d1cb..0ce4b8e2cd 100644
--- a/.agents/skills/apm-integrations/references/orchestrion.md
+++ b/.agents/skills/apm-integrations/references/orchestrion.md
@@ -208,6 +208,95 @@ For integrations wrapping multiple methods, create a separate plugin class per m
 - `ctx.error` — thrown error (on error)
 - `ctx.currentStore` — set by `startSpan` in `bindStart`
 
+## Propagating Synchronous Errors From `bindStart`
+
+Subscribers on the prefix `:start` channel and `bindStore` transforms **cannot
+propagate a synchronous throw** to the caller of an orchestrion-wrapped
+function. Both are wrapped in `try { ... } catch (err) { process.nextTick(() =>
+triggerUncaughtException(err)); ... }` by Node's `diagnostics_channel` (see
+`lib/diagnostics_channel.js`'s `wrapStoreRun` and `publish`). The error
+surfaces async as an uncaught exception, **after** the wrapped fn has already
+run and the call has returned normally.
+
+The wrapper's own catch block, however, **does** rethrow:
+
+```js
+return ch.start.runStores(__apm$ctx, () => {
+  try {
+    const result = __apm$traced();
+    __apm$ctx.result = result;
+    return result;
+  } catch (err) {
+    __apm$ctx.error = err;
+    ch.error.publish(__apm$ctx);
+    throw err;                  // <- propagates the wrapped fn's error to the caller
+  } finally {
+    ch.end.publish(__apm$ctx);
+  }
+});
+```
+
+When a contract requires `assert.throws(() => wrapped(...))`-style synchronous
+propagation from a `:start` observer (the canonical case is AppSec WAF's
+`abortController.abort()` model), use the **Proxy-on-arguments pattern**:
+
+```js
+bindStart (ctx) {
+  // ... normal setup, span creation ...
+  const abortController = new AbortController()
+  if (startCh.hasSubscribers) {
+    startCh.publish({ abortController, args })       // subscribers run sync
+    if (abortController.signal.aborted) {
+      // ctx.arguments is the SAME array reference the wrapper spreads into
+      // the wrapped fn (__apm$wrapped.apply(this, ctx.arguments)). Replace
+      // arguments[0] with a Proxy whose getters throw AbortError. The
+      // wrapped fn's first property access (typically a destructure of args)
+      // triggers the trap → the wrapper's catch+rethrow propagates AbortError
+      // to the caller. Span lifecycle still completes via end.publish.
+      ctx.arguments[0] = new Proxy({}, {
+        get () { throw new AbortError('Aborted') },
+        has () { throw new AbortError('Aborted') },
+      })
+      ctx.ddAborted = true
+      return ctx.currentStore
+    }
+  }
+  // ... rest of bindStart ...
+}
+
+error (ctx) {
+  if (ctx.ddAborted) return                          // abort != error tag
+  // ... regular error handling ...
+}
+```
+
+Reference implementation: `packages/datadog-plugin-graphql/src/execute.js`
+(`apm:graphql:execute:start` contract).
+
+Why this works:
+- `ctx.arguments` and the rewriter's `__apm$arguments` are the same array
+  reference (confirmed by capturing the rewriter output: `const __apm$traced
+  = () => __apm$wrapped.apply(this, __apm$arguments)`).
+- The wrapped fn's body almost always touches `arguments[0]` on the first
+  statement (destructure, property read, validation). Any read triggers the
+  Proxy trap.
+- The orchestrion wrapper's `catch { ...; throw err }` propagates the thrown
+  error synchronously to the caller — confirmed in the rewriter template
+  (vendor's `code-transformer/index.js`, `wrapSync` function).
+- `:end` still fires in `finally`, so the plugin's `end(ctx)` runs as usual
+  and the span lifecycle completes cleanly. Combined with an `error(ctx)`
+  that no-ops when `ctx.ddAborted`, the span finishes with `error === 0`
+  (matches the abort contract).
+
+When NOT to use this:
+- If you control the wrapped fn (e.g., it's a method you can wrap with
+  shimmer on top of orchestrion), do that — clearer and avoids the
+  Proxy indirection.
+- If the wrapped fn might catch its own errors before they escape (some
+  user-resolver patterns do this), the AbortError won't propagate. Verify
+  the wrapped fn does NOT have a top-level `try/catch` around the
+  property access that triggers the trap.
+
 ## Common Issues
 
 ### Wrong filePath
diff --git a/benchmark/sirun/plugin-graphql-long/meta.json b/benchmark/sirun/plugin-graphql-long/meta.json
index f35fe1ee3c..d84aaef57d 100644
--- a/benchmark/sirun/plugin-graphql-long/meta.json
+++ b/benchmark/sirun/plugin-graphql-long/meta.json
@@ -11,7 +11,7 @@
       "env": { "WITH_TRACER": "1", "WITH_DEPTH": "0", "OPERATIONS": "1150" }
     },
     "with-depth-on-max": {
-      "env": { "WITH_TRACER": "1", "WITH_DEPTH": "4", "OPERATIONS": "530" }
+      "env": { "WITH_TRACER": "1", "WITH_DEPTH": "4", "OPERATIONS": "800" }
     },
     "with-depth-and-collapse-off": {
       "env": { "WITH_TRACER": "1", "WITH_DEPTH_AND_COLLAPSE": "4,0", "OPERATIONS": "210" }
diff --git a/docs/test.ts b/docs/test.ts
index c866206fb8..fc987dfa51 100644
--- a/docs/test.ts
+++ b/docs/test.ts
@@ -230,7 +230,8 @@ const graphqlOptions: plugins.graphql = {
   hooks: {
     execute: (span?: Span, args?, res?) => { },
     validate: (span?: Span, document?, errors?) => { },
-    parse: (span?: Span, source?, document?) => { }
+    parse: (span?: Span, source?, document?) => { },
+    resolve: (span?: Span, field?) => { }
   }
 };
 
diff --git a/index.d.ts b/index.d.ts
index 7ad44fc878..d12949a9cb 100644
--- a/index.d.ts
+++ b/index.d.ts
@@ -2491,6 +2491,18 @@ declare namespace tracer {
     typeResolver?: any,
     }
 
+    /** Context object passed to the `hooks.resolve` callback for each instrumented field. */
+    interface FieldContext {
+      /** The field name being resolved */
+      fieldName: string;
+      /** The dot-separated field path (e.g. `'user.address.city'`) */
+      path: string;
+      /** The error from the resolver, or `null` if it succeeded */
+      error: Error | null;
+      /** The value returned by the resolver (sync resolvers only; `undefined` for async) */
+      result: unknown;
+    }
+
     /**
      * This plugin automatically instruments the
      * [graphql](https://github.com/graphql/graphql-js) module.
@@ -2569,6 +2581,7 @@ declare namespace tracer {
         execute?: (span?: Span, args?: ExecutionArgs, res?: any) => void;
         validate?: (span?: Span, document?: any, errors?: any) => void;
         parse?: (span?: Span, source?: any, document?: any) => void;
+        resolve?: (span?: Span, field?: FieldContext) => void;
       }
     }
 
diff --git a/index.d.v5.ts b/index.d.v5.ts
index ed0c27ac37..e694c3e6ac 100644
--- a/index.d.v5.ts
+++ b/index.d.v5.ts
@@ -2625,6 +2625,18 @@ declare namespace tracer {
     typeResolver?: any,
     }
 
+    /** Context object passed to the `hooks.resolve` callback for each instrumented field. */
+    interface FieldContext {
+      /** The field name being resolved */
+      fieldName: string;
+      /** The dot-separated field path (e.g. `'user.address.city'`) */
+      path: string;
+      /** The error from the resolver, or `null` if it succeeded */
+      error: Error | null;
+      /** The value returned by the resolver (sync resolvers only; `undefined` for async) */
+      result: unknown;
+    }
+
     /**
      * This plugin automatically instruments the
      * [graphql](https://github.com/graphql/graphql-js) module.
@@ -2703,6 +2715,7 @@ declare namespace tracer {
         execute?: (span?: Span, args?: ExecutionArgs, res?: any) => void;
         validate?: (span?: Span, document?: any, errors?: any) => void;
         parse?: (span?: Span, source?: any, document?: any) => void;
+        resolve?: (span?: Span, field?: FieldContext) => void;
       }
     }
 
diff --git a/packages/datadog-instrumentations/src/graphql.js b/packages/datadog-instrumentations/src/graphql.js
index 35c8f1e42d..1e90d03cd8 100644
--- a/packages/datadog-instrumentations/src/graphql.js
+++ b/packages/datadog-instrumentations/src/graphql.js
@@ -1,515 +1,46 @@
 'use strict'
 
-const { AsyncLocalStorage } = require('node:async_hooks')
+const { addHook, getHooks } = require('./helpers/instrument')
 
-const shimmer = require('../../datadog-shimmer')
-const {
-  addHook,
-  channel,
-} = require('./helpers/instrument')
+// Orchestrion rewriter handles wrapping of:
+// - graphql: execute, parse, validate (CJS + ESM)
+// - @graphql-tools/executor: execute, normalizedExecutor (CJS + ESM)
+// See helpers/rewriter/instrumentations/graphql.js for the full config.
+//
+// The plugin (packages/datadog-plugin-graphql/src/execute.js) handles the
+// `apm:graphql:execute:start` AppSec/WAF contract from inside its bindStart:
+// publishing the channel synchronously runs subscribers, and an
+// `abortController.abort()` from a subscriber is observed by replacing
+// `ctx.arguments[0]` with an object whose getters throw AbortError. The
+// orchestrion-emitted wrapper's `catch { ...; throw err }` block propagates
+// that throw to the caller of graphql.execute. No outer wrap needed.
 
-const ddGlobal = globalThis[Symbol.for('dd-trace')]
-
-/** cached objects */
-
-// `contexts` is the fast resolver-side lookup; `executeCtx` is the fallback
-// when `contextValue` is a primitive and cannot key a WeakMap.
-const contexts = new WeakMap()
-const executeCtx = new AsyncLocalStorage()
-// Tracks normalized args already instrumented in an outer wrap so graphql-yoga
-// (which stacks `execute` + `normalizedExecutor`) only emits one span per call.
-const instrumentedArgs = new WeakSet()
-const documentSources = new WeakMap()
-const patchedResolvers = new WeakSet()
-const patchedTypes = new WeakSet()
-
-/** CHANNELS */
-
-// execute channels
-const startExecuteCh = channel('apm:graphql:execute:start')
-const finishExecuteCh = channel('apm:graphql:execute:finish')
-const executeErrorCh = channel('apm:graphql:execute:error')
-
-// resolve channels
-const startResolveCh = channel('apm:graphql:resolve:start')
-const finishResolveCh = channel('apm:graphql:resolve:finish')
-const updateFieldCh = channel('apm:graphql:resolve:updateField')
-const resolveErrorCh = channel('apm:graphql:resolve:error')
-
-// parse channels
-const parseStartCh = channel('apm:graphql:parser:start')
-const parseFinishCh = channel('apm:graphql:parser:finish')
-const parseErrorCh = channel('apm:graphql:parser:error')
-
-// validate channels
-const validateStartCh = channel('apm:graphql:validate:start')
-const validateFinishCh = channel('apm:graphql:validate:finish')
-const validateErrorCh = channel('apm:graphql:validate:error')
-
-class AbortError extends Error {
-  constructor (message) {
-    super(message)
-    this.name = 'AbortError'
-  }
-}
-
-const types = new Set(['query', 'mutation', 'subscription'])
-
-function getOperation (document, operationName) {
-  if (!document || !Array.isArray(document.definitions)) {
-    return
-  }
-
-  for (const definition of document.definitions) {
-    if (definition && types.has(definition.operation) && (!operationName || definition.name?.value === operationName)) {
-      return definition
-    }
-  }
+for (const hook of getHooks('graphql')) {
+  addHook(hook, exports => exports)
 }
 
-function normalizeArgs (args, defaultFieldResolver) {
-  if (args.length !== 1) return normalizePositional(args, defaultFieldResolver)
-
-  const original = args[0]
-  const normalized = {
-    ...original,
-    fieldResolver: wrapResolve(original.fieldResolver || defaultFieldResolver),
-  }
-
-  args[0] = normalized
-  return normalized
-}
-
-function normalizePositional (args, defaultFieldResolver) {
-  args[6] = wrapResolve(args[6] || defaultFieldResolver) // fieldResolver
-  args.length = Math.max(args.length, 7)
-
-  return {
-    schema: args[0],
-    document: args[1],
-    rootValue: args[2],
-    contextValue: args[3],
-    variableValues: args[4],
-    operationName: args[5],
-    fieldResolver: args[6],
-  }
-}
-
-// `WeakMap.set` throws `TypeError` on a non-object key; `get`/`has`/`delete`
-// silently miss. Skip the WeakMap entirely for non-keyable `contextValue`.
-function isWeakMapKey (value) {
-  return value !== null && typeof value === 'object'
+for (const hook of getHooks('@graphql-tools/executor')) {
+  addHook(hook, exports => exports)
 }
 
-function wrapParse (parse) {
-  return function (source) {
-    if (!parseStartCh.hasSubscribers) {
-      return parse.apply(this, arguments)
-    }
-
-    const ctx = { source }
-    return parseStartCh.runStores(ctx, () => {
-      try {
-        ctx.document = parse.apply(this, arguments)
-        const operation = getOperation(ctx.document)
-
-        if (!operation) return ctx.document
-
-        if (source) {
-          documentSources.set(ctx.document, source.body || source)
-        }
-        ctx.docSource = documentSources.get(ctx.document)
-
-        return ctx.document
-      } catch (err) {
-        void err.stack
-        ctx.error = err
-        parseErrorCh.publish(ctx)
-
-        throw err
-      } finally {
-        parseFinishCh.publish(ctx)
-      }
-    })
-  }
-}
-
-function wrapValidate (validate) {
-  return function (_schema, document, _rules, _typeInfo) {
-    if (!validateStartCh.hasSubscribers) {
-      return validate.apply(this, arguments)
-    }
-
-    const ctx = { docSource: documentSources.get(document), document }
-    return validateStartCh.runStores(ctx, () => {
-      let errors
-      try {
-        errors = validate.apply(this, arguments)
-        if (errors && errors[0]) {
-          ctx.error = errors[0]
-          validateErrorCh.publish(ctx)
-        }
-        return errors
-      } catch (err) {
-        void err.stack
-        ctx.error = err
-        validateErrorCh.publish(ctx)
-
-        throw err
-      } finally {
-        ctx.errors = errors
-        validateFinishCh.publish(ctx)
-      }
-    })
-  }
-}
-
-function wrapExecute (execute) {
-  return function (exe) {
-    const defaultFieldResolver = execute.defaultFieldResolver
-    return function () {
-      if (!startExecuteCh.hasSubscribers) {
-        return exe.apply(this, arguments)
-      }
-
-      // The outer wrap leaves its normalized args object in `arguments[0]`; on
-      // graphql-yoga's inner wrap that reference is already known here.
-      if (instrumentedArgs.has(arguments[0])) {
-        return exe.apply(this, arguments)
-      }
-
-      const args = normalizeArgs(arguments, defaultFieldResolver)
-      const schema = args.schema
-      const document = args.document
-      const source = documentSources.get(document)
-      const contextValue = args.contextValue
-      const keyable = isWeakMapKey(contextValue)
-      const operation = getOperation(document, args.operationName)
-
-      if (keyable && contexts.has(contextValue)) {
-        return exe.apply(this, arguments)
-      }
-
-      const ctx = {
-        operation,
-        args,
-        docSource: source,
-        source,
-        fields: new Map(),
-        abortController: new AbortController(),
-      }
-
-      // Only the object form leaves a stable single-object handle in
-      // `arguments[0]` for the inner wrap to see.
-      if (args === arguments[0]) instrumentedArgs.add(args)
-
-      return startExecuteCh.runStores(ctx, () => {
-        if (schema) {
-          wrapFields(schema._queryType)
-          wrapFields(schema._mutationType)
-        }
-
-        if (keyable) contexts.set(contextValue, ctx)
-
-        const finish = (err, res) => {
-          if (finishResolveCh.hasSubscribers) finishResolvers(ctx)
-
-          const error = err || (res && res.errors && res.errors[0])
-
-          if (error) {
-            ctx.error = error
-            executeErrorCh.publish(ctx)
-          }
-
-          ctx.res = res
-          if (keyable) contexts.delete(contextValue)
-          instrumentedArgs.delete(args)
-          finishExecuteCh.publish(ctx)
-        }
-
-        // Skip the ALS entry on the common object-`contextValue` path; the
-        // resolver reaches `ctx` via the WeakMap there.
-        return keyable
-          ? callInAsyncScope(exe, this, arguments, ctx.abortController, finish)
-          : executeCtx.run(ctx, () => callInAsyncScope(exe, this, arguments, ctx.abortController, finish))
-      })
-    }
-  }
-}
-
-function wrapResolve (resolve) {
-  if (typeof resolve !== 'function' || patchedResolvers.has(resolve)) return resolve
-
-  function resolveAsync (source, args, contextValue, info) {
-    if (!startResolveCh.hasSubscribers) return resolve.apply(this, arguments)
-
-    // `WeakMap.get(primitive)` returns `undefined`, so the fallback covers
-    // executes that ran with a primitive `contextValue`.
-    const ctx = contexts.get(contextValue) ?? executeCtx.getStore()
-
-    /* istanbul ignore if: resolver invoked outside execute(), so no per-execute ctx was registered */
-    if (!ctx) return resolve.apply(this, arguments)
-
-    const field = assertField(ctx, info, args)
-
-    if (ctx.abortController.signal.aborted) {
-      publishResolverFinish(field, null)
-      throw new AbortError('Aborted')
-    }
-
-    try {
-      const result = resolve.call(this, source, args, contextValue, info)
-      if (result !== null && typeof result?.then === 'function') {
-        return result.then(
-          res => {
-            publishResolverFinish(field, null)
-            return res
-          },
-          error => {
-            publishResolverFinish(field, error)
-            throw error
-          }
-        )
-      }
-      publishResolverFinish(field, null)
-      return result
-    } catch (error) {
-      publishResolverFinish(field, error)
-      throw error
-    }
-  }
-
-  patchedResolvers.add(resolveAsync)
-
-  return resolveAsync
-}
-
-/**
- * @param {{ ctx: object, error: unknown }} field
- * @param {unknown} error
- */
-function publishResolverFinish (field, error) {
-  const fieldCtx = field.ctx
-  fieldCtx.error = error
-  fieldCtx.field = field
-  updateFieldCh.publish(fieldCtx)
-}
-
-function callInAsyncScope (fn, thisArg, args, abortController, cb) {
-  if (abortController.signal.aborted) {
-    cb(null, null)
-    throw new AbortError('Aborted')
-  }
-
-  try {
-    const result = fn.apply(thisArg, args)
-    if (result !== null && typeof result?.then === 'function') {
-      return result.then(
-        res => {
-          cb(null, res)
-          return res
-        },
-        /* istanbul ignore next: graphql.execute() rejects only via custom executors (graphql-yoga / graphql-tools) */
-        error => {
-          cb(error)
-          throw error
-        }
-      )
-    }
-    cb(null, result)
-    return result
-  } catch (error) {
-    cb(error)
-    throw error
-  }
-}
-
-/**
- * @typedef {{ prev: PathNode | undefined, key: string | number }} PathNode
- *
- * @typedef {{ error: unknown, ctx: object }} TrackedField
- */
-
-/**
- * @param {{
- *   fields: Map<object, TrackedField>,
- *   collapse: boolean,
- *   collapsedFields?: Map<string, TrackedField>,
- *   pathCache?: Map<PathNode, string>,
- * }} rootCtx
- * @param {import('graphql').GraphQLResolveInfo} info
- * @param {Record<string, unknown>} args
- */
-function assertField (rootCtx, info, args) {
-  const path = info.path
-  const collapse = rootCtx.collapse
-
-  const cache = rootCtx.pathCache ??= new Map()
-  const prev = path.prev
-  const key = path.key
-  const segment = collapse && typeof key !== 'string' ? '*' : key
-
-  const pathString = prev === undefined
-    ? String(segment)
-    : (cache.get(prev) ?? buildCachedPathString(prev, cache, collapse)) + '.' + segment
-  cache.set(path, pathString)
-
-  const fieldCtx = {
-    rootCtx,
-    args,
-    path,
-    pathString,
-    fieldName: info.fieldName,
-    returnType: info.returnType,
-    fieldNode: info.fieldNodes[0],
-    variableValues: info.variableValues,
-  }
-  // Publish per resolver call, before the collapse / depth dedupe below.
-  // IAST mutates each call's own args object; if siblings 2..N skip the
-  // publish, those args objects never get tainted.
-  startResolveCh.publish(fieldCtx)
-
-  let collapsedFields
-  if (collapse) {
-    collapsedFields = rootCtx.collapsedFields ??= new Map()
-    const existing = collapsedFields.get(pathString)
-    // Subsequent siblings of a collapsed list share the first sibling's field
-    // so updateFieldCh fires for every call and the span's finishTime tracks
-    // the last sibling's completion, not the first.
-    if (existing !== undefined) return existing
-  }
-
-  const field = { error: null, ctx: fieldCtx }
-  rootCtx.fields.set(path, field)
-  if (collapsedFields !== undefined) collapsedFields.set(pathString, field)
-  return field
-}
-
-/**
- * Cold path for assertField. graphql-js inserts a synthetic array-index
- * node between a list field and its items, and that node never reaches a
- * resolver — so assertField has no chance to cache it. The first child of
- * the list item that hits the path cache lands here to walk and populate
- * back to a cached ancestor.
- *
- * @param {PathNode} path
- * @param {Map<PathNode, string>} cache
- * @param {boolean} collapse
- */
-function buildCachedPathString (path, cache, collapse) {
-  const key = path.key
-  const segment = collapse && typeof key !== 'string' ? '*' : key
-  const prev = path.prev
-
-  const pathString = prev === undefined
-    ? String(segment)
-    : (cache.get(prev) ?? buildCachedPathString(prev, cache, collapse)) + '.' + segment
-  cache.set(path, pathString)
-  return pathString
-}
-
-function wrapFields (type) {
-  if (!type || !type._fields || patchedTypes.has(type)) {
-    return
-  }
-
-  patchedTypes.add(type)
-
-  for (const field of Object.values(type._fields)) {
-    wrapFieldResolve(field)
-    wrapFieldType(field)
-  }
-}
-
-function wrapFieldResolve (field) {
-  if (!field || !field.resolve) return
-  field.resolve = wrapResolve(field.resolve)
-}
-
-function wrapFieldType (field) {
-  if (!field || !field.type) return
-
-  let unwrappedType = field.type
-
-  while (unwrappedType.ofType) {
-    unwrappedType = unwrappedType.ofType
-  }
-
-  wrapFields(unwrappedType)
-}
-
-function finishResolvers ({ fields }) {
-  for (const field of fields.values()) {
-    const fieldCtx = field.ctx
-    // A depth-gated field publishes startResolveCh for IAST/AppSec but the
-    // resolve plugin's start short-circuits before creating a span, so there
-    // is no span here to finish.
-    if (fieldCtx.currentStore === undefined) continue
-    fieldCtx.finishTime = field.finishTime
-    fieldCtx.field = field
-    if (field.error) {
-      fieldCtx.error = field.error
-      resolveErrorCh.publish(fieldCtx)
-    }
-    finishResolveCh.publish(fieldCtx)
-  }
-}
-
-// The CJS package root re-exports `execute` and `normalizedExecutor` as
-// non-configurable tslib `__exportStar` getters that shimmer cannot rewrite in
-// place, so the inner execute.js hook below carries CJS instead: graphql-yoga
-// (`normalizedExecutor`) and direct callers both funnel through that `execute`.
-// Under iitm (ESM) the namespace is settable and the inner-file hook never
-// matches the `esm/` path, so the root wrap is the only option there.
-addHook({ name: '@graphql-tools/executor', versions: ['>=0.0.14'] }, (executor, _version, isIitm) => {
-  /* istanbul ignore if: covered only by the graphql-yoga ESM integration test (subprocess) */
-  if (isIitm) {
-    shimmer.wrap(executor, 'execute', wrapExecute(executor))
-    shimmer.wrap(executor, 'normalizedExecutor', wrapExecute(executor))
-  }
-  return executor
-})
-
-addHook({ name: '@graphql-tools/executor', file: 'cjs/execution/execute.js', versions: ['>=0.0.14'] }, execute => {
-  shimmer.wrap(execute, 'execute', wrapExecute(execute))
-  return execute
-})
-
-// TODO(BridgeAR): graphql >=17.0.0-alpha.9 routes execute() through
-// experimentalExecuteIncrementally(), bypassing this hook. The same
-// function returns { initialResult, subsequentResults } for @defer /
-// @stream which callInAsyncScope does not handle — execute finishes
-// before the streamed payloads land.
-addHook({ name: 'graphql', file: 'execution/execute.js', versions: ['>=0.10'] }, execute => {
-  shimmer.wrap(execute, 'execute', wrapExecute(execute))
-  return execute
-})
-
-addHook({ name: 'graphql', file: 'language/parser.js', versions: ['>=0.10'] }, parser => {
-  shimmer.wrap(parser, 'parse', wrapParse)
-  return parser
-})
-
-addHook({ name: 'graphql', file: 'validation/validate.js', versions: ['>=0.10'] }, validate => {
-  shimmer.wrap(validate, 'validate', wrapValidate)
-
-  return validate
-})
+// Module-load hooks: capture references on ddGlobal for cross-plugin access
+// (read lazily inside each callback so agent.load() between mocha suites can
+// rebind globalThis[dd-trace] without us stashing a stale reference).
 
 addHook({ name: 'graphql', file: 'language/printer.js', versions: ['>=0.10'] }, printer => {
-  // HACK: It's possible `graphql` is loaded before `@apollo/gateway` so we
-  //       can't use a channel as the latter plugin would load after the publish
-  //       happened. Not sure how to handle this so for now use a global.
-  ddGlobal.graphql_printer = printer
+  const ddGlobal = globalThis[Symbol.for('dd-trace')]
+  if (ddGlobal) ddGlobal.graphql_printer = printer
   return printer
 })
 
 addHook({ name: 'graphql', file: 'language/visitor.js', versions: ['>=0.10'] }, visitor => {
-  ddGlobal.graphql_visitor = visitor
+  const ddGlobal = globalThis[Symbol.for('dd-trace')]
+  if (ddGlobal) ddGlobal.graphql_visitor = visitor
   return visitor
 })
 
 addHook({ name: 'graphql', file: 'utilities/index.js', versions: ['>=0.10'] }, utilities => {
-  ddGlobal.graphql_utilities = utilities
+  const ddGlobal = globalThis[Symbol.for('dd-trace')]
+  if (ddGlobal) ddGlobal.graphql_utilities = utilities
   return utilities
 })
diff --git a/packages/datadog-instrumentations/src/helpers/rewriter/instrumentations/graphql.js b/packages/datadog-instrumentations/src/helpers/rewriter/instrumentations/graphql.js
new file mode 100644
index 0000000000..a36c1d0500
--- /dev/null
+++ b/packages/datadog-instrumentations/src/helpers/rewriter/instrumentations/graphql.js
@@ -0,0 +1,201 @@
+'use strict'
+
+module.exports = [
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'execution/execute.js',
+    },
+    functionQuery: {
+      functionName: 'execute',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:execute',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'execution/execute.mjs',
+    },
+    functionQuery: {
+      functionName: 'execute',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:execute',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'language/parser.js',
+    },
+    functionQuery: {
+      functionName: 'parse',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:parser',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'language/parser.mjs',
+    },
+    functionQuery: {
+      functionName: 'parse',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:parser',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'validation/validate.js',
+    },
+    functionQuery: {
+      functionName: 'validate',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:validate',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'validation/validate.mjs',
+    },
+    functionQuery: {
+      functionName: 'validate',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:validate',
+  },
+  // executeField / resolveField intentionally NOT instrumented here. Resolve spans
+  // are produced by wrapping user resolvers + the default field resolver at execute
+  // time (see packages/datadog-plugin-graphql/src/execute.js). That gives a zero-cost
+  // fast path when no subscribers are active, which per-field orchestrion hooks
+  // cannot offer (the publish is baked into graphql's compiled code).
+  {
+    module: {
+      name: '@graphql-tools/executor',
+      versionRange: '>=0.0.14',
+      filePath: 'cjs/execution/execute.js',
+    },
+    functionQuery: {
+      functionName: 'execute',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:execute',
+  },
+  {
+    module: {
+      name: '@graphql-tools/executor',
+      versionRange: '>=0.0.14',
+      filePath: 'esm/execution/execute.js',
+    },
+    functionQuery: {
+      functionName: 'execute',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:execute',
+  },
+  {
+    module: {
+      name: '@graphql-tools/executor',
+      versionRange: '>=0.0.14',
+      filePath: 'cjs/execution/normalizedExecutor.js',
+    },
+    functionQuery: {
+      functionName: 'normalizedExecutor',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:execute',
+  },
+  {
+    module: {
+      name: '@graphql-tools/executor',
+      versionRange: '>=0.0.14',
+      filePath: 'esm/execution/normalizedExecutor.js',
+    },
+    functionQuery: {
+      functionName: 'normalizedExecutor',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:execute',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'language/printer.js',
+    },
+    functionQuery: {
+      functionName: '__module_export__',
+      kind: 'Sync',
+    },
+    channelName: 'dd:graphql:printer:load',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'language/printer.mjs',
+    },
+    functionQuery: {
+      functionName: '__module_export__',
+      kind: 'Sync',
+    },
+    channelName: 'dd:graphql:printer:load',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'language/visitor.js',
+    },
+    functionQuery: {
+      functionName: '__module_export__',
+      kind: 'Sync',
+    },
+    channelName: 'dd:graphql:visitor:load',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'language/visitor.mjs',
+    },
+    functionQuery: {
+      functionName: '__module_export__',
+      kind: 'Sync',
+    },
+    channelName: 'dd:graphql:visitor:load',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'utilities/index.js',
+    },
+    functionQuery: {
+      functionName: '__module_export__',
+      kind: 'Sync',
+    },
+    channelName: 'dd:graphql:utilities:load',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'utilities/index.mjs',
+    },
+    functionQuery: {
+      functionName: '__module_export__',
+      kind: 'Sync',
+    },
+    channelName: 'dd:graphql:utilities:load',
+  },
+]
diff --git a/packages/datadog-instrumentations/src/helpers/rewriter/instrumentations/index.js b/packages/datadog-instrumentations/src/helpers/rewriter/instrumentations/index.js
index a37be387a4..e61db53e0b 100644
--- a/packages/datadog-instrumentations/src/helpers/rewriter/instrumentations/index.js
+++ b/packages/datadog-instrumentations/src/helpers/rewriter/instrumentations/index.js
@@ -4,6 +4,7 @@ module.exports = [
   ...require('./ai'),
   ...require('./azure-cosmos'),
   ...require('./bullmq'),
+  ...require('./graphql'),
   ...require('./langchain'),
   ...require('./langgraph'),
   ...require('./modelcontextprotocol-sdk'),
diff --git a/packages/datadog-plugin-graphql/src/execute.js b/packages/datadog-plugin-graphql/src/execute.js
index e574910f2d..68bf294a1a 100644
--- a/packages/datadog-plugin-graphql/src/execute.js
+++ b/packages/datadog-plugin-graphql/src/execute.js
@@ -1,21 +1,117 @@
 'use strict'
 
+const dc = require('dc-polyfill')
+
+const { storage } = require('../../datadog-core')
 const TracingPlugin = require('../../dd-trace/src/plugins/tracing')
+const GraphQLParsePlugin = require('./parse')
 const { extractErrorIntoSpanEvent, getSignature } = require('./utils')
 
+const legacyStorage = storage('legacy')
+
+const types = new Set(['query', 'mutation', 'subscription'])
+
+const iastResolveCh = dc.channel('apm:graphql:resolve:start')
+const resolverStartCh = dc.channel('datadog:graphql:resolver:start')
+const updateFieldCh = dc.channel('apm:graphql:resolve:updateField')
+
+// AppSec/WAF abort gate. Published synchronously from bindStart with a
+// payload carrying the abortController; subscribers that call
+// `payload.abortController.abort()` signal a pre-execute abort. bindStart
+// observes the aborted signal by replacing `ctx.arguments[0]` with a Proxy
+// whose getters throw AbortError — the orchestrion-emitted wrapper's
+// `try { __apm$traced() } catch { ...; throw err }` block then propagates
+// the AbortError to the caller of graphql.execute.
+const startExecuteCh = dc.channel('apm:graphql:execute:start')
+
+const contexts = new WeakMap()
+const instrumentedArgs = new WeakSet()
+
+const patchedResolvers = new WeakSet()
+const patchedTypes = new WeakSet()
+
+// Module-level fast path: skip the resolver-side WeakMap lookup entirely
+// when depth=0 disables resolver instrumentation.
+let depthDisabled = false
+
+class AbortError extends Error {
+  constructor (message) {
+    super(message)
+    this.name = 'AbortError'
+  }
+}
+
 class GraphQLExecutePlugin extends TracingPlugin {
   static id = 'graphql'
   static operation = 'execute'
   static type = 'graphql'
   static kind = 'server'
+  static prefix = 'tracing:orchestrion:graphql:apm:graphql:execute'
+
+  // @graphql-tools/executor (used by graphql-yoga) emits on a different channel
+  // prefix because the module name differs. Subscribe to both so Yoga execution
+  // produces graphql.execute spans.
+  static extraPrefixes = [
+    'tracing:orchestrion:@graphql-tools/executor:apm:graphql:execute',
+  ]
+
+  /**
+   * @param {{ depth?: number }} config
+   */
+  configure (config) {
+    super.configure(config)
+    depthDisabled = config.depth === 0
+  }
+
+  addTraceSubs () {
+    super.addTraceSubs()
+
+    for (const prefix of this.constructor.extraPrefixes) {
+      const events = ['start', 'end', 'asyncStart', 'asyncEnd', 'error', 'finish']
+
+      for (const event of events) {
+        const bindName = `bind${event.charAt(0).toUpperCase()}${event.slice(1)}`
+
+        if (this[event]) {
+          this.addSub(`${prefix}:${event}`, message => {
+            this[event](message)
+          })
+        }
+
+        if (this[bindName]) {
+          this.addBind(`${prefix}:${event}`, message => this[bindName](message))
+        }
+      }
+    }
+  }
 
   bindStart (ctx) {
-    const { operation, args, docSource } = ctx
+    const rawArgs = ctx.arguments
+    const objectForm = isObjectForm(rawArgs)
+    const args = readArgs(rawArgs, objectForm)
+
+    // Re-entrant execute() short-circuit (yoga's normalizedExecutor calls
+    // execute internally with the same arguments object — without this we'd
+    // double-span). The contextValue check catches object contexts; the args
+    // check also catches primitive contexts.
+    if (instrumentedArgs.has(rawArgs?.[0])) {
+      ctx.ddSkipped = true
+      return ctx.currentStore
+    }
+
+    const { contextValue } = args
+    if (contextValue && typeof contextValue === 'object' && contexts.has(contextValue)) {
+      ctx.ddSkipped = true
+      return ctx.currentStore
+    }
 
-    const type = operation && operation.operation
-    const name = operation && operation.name && operation.name.value
     const document = args.document
-    const source = this.config.source && document && docSource
+    const docSource = document ? GraphQLParsePlugin.documentSources.get(document) : undefined
+    const operation = getOperation(document, args.operationName)
+
+    const type = operation?.operation
+    const name = operation?.name?.value
+    const source = this.config.source && docSource
 
     ctx.collapse = this.config.collapse
 
@@ -33,25 +129,544 @@ class GraphQLExecutePlugin extends TracingPlugin {
 
     addVariableTags(this.config, span, args.variableValues)
 
+    const abortController = new AbortController()
+
+    // AppSec/WAF synchronous-abort gate. Publish before any resolver-wrapping
+    // work — if a subscriber aborts, none of that work matters because we'll
+    // make execute's body throw AbortError before it reaches any resolvers.
+    // bindStart runs as a bindStore transform on
+    // tracing:orchestrion:graphql:apm:graphql:execute:start, which fires
+    // BEFORE the orchestrion-emitted wrapper publishes its own :start and
+    // BEFORE the wrapped fn runs. The subscriber gets the abortController
+    // synchronously; on return we observe `signal.aborted` and act.
+    if (startExecuteCh.hasSubscribers) {
+      startExecuteCh.publish({ abortController, args })
+      if (abortController.signal.aborted) {
+        // Replace ctx.arguments[0] with a Proxy that throws AbortError on any
+        // property access. The orchestrion wrapper calls
+        // `__apm$wrapped.apply(this, ctx.arguments)`; graphql.execute's body
+        // begins with `const { schema, document, ... } = args` so the
+        // destructure triggers the trap immediately. The wrapper catches and
+        // rethrows, propagating AbortError to graphql.execute's caller.
+        ctx.arguments[0] = new Proxy({}, {
+          get () { throw new AbortError('Aborted') },
+          has () { throw new AbortError('Aborted') },
+        })
+        ctx.ddAborted = true
+        return ctx.currentStore
+      }
+    }
+
+    ctx.ddArgs = setWrappedFieldResolver(rawArgs, args, objectForm, defaultFieldResolver)
+    if (ctx.ddArgs && typeof ctx.ddArgs === 'object') {
+      instrumentedArgs.add(ctx.ddArgs)
+      ctx.ddInstrumentedArgs = ctx.ddArgs
+    }
+
+    const schema = args.schema
+    if (schema) {
+      wrapFields(schema._queryType)
+      wrapFields(schema._mutationType)
+      wrapFields(schema._subscriptionType)
+    }
+
+    const rootCtx = {
+      source: docSource,
+      config: this.config,
+      fields: new Map(),
+      pathCache: new Map(),
+      collapsedPathCache: this.config.collapse ? { byPath: new Map(), byParent: new Map() } : undefined,
+      abortController,
+      executeSpan: span,
+      plugin: this,
+    }
+    ctx.ddRootCtx = rootCtx
+    if (isWeakMapKey(contextValue)) {
+      contexts.set(contextValue, rootCtx)
+      ctx.ddContextValue = contextValue
+    } else {
+      // Primitive / non-keyable contextValue: stash rootCtx on the
+      // orchestrion-scoped store that runStores enters for execute. Wrapped
+      // resolvers read it via legacyStorage.getStore() and it unwinds with the
+      // frame — no enterWith store that leaks past execute.
+      ctx.currentStore.graphqlRootCtx = rootCtx
+    }
+
     return ctx.currentStore
   }
 
-  finish (ctx) {
-    const { res, args } = ctx
+  end (ctx) {
+    if (ctx.ddSkipped) return ctx.parentStore
+
+    const span = ctx?.currentStore?.span || this.activeSpan
+    if (!span) return
+
+    // Synchronous execute() throw (e.g. execute(null, doc)) — error handler
+    // already tagged the span, just finish it.
+    if (ctx.error) {
+      this.#drain(ctx, span)
+      return ctx.parentStore
+    }
+
+    const result = ctx.result
+
+    if (typeof result?.then === 'function') {
+      result.then(
+        (res) => this.#finishSpan(ctx, span, res),
+        (err) => {
+          span.setTag('error', err)
+          this.#drain(ctx, span)
+        }
+      )
+    } else {
+      this.#finishSpan(ctx, span, result)
+    }
+
+    return ctx.parentStore
+  }
+
+  error (ctx) {
+    // Pre-execute WAF abort isn't an error condition — opSpan.error must
+    // stay 0 per master's contract.
+    if (ctx.ddAborted) return
     const span = ctx?.currentStore?.span || this.activeSpan
-    this.config.hooks.execute(span, args, res)
-    if (res?.errors) {
+    if (span && ctx?.error) {
+      span.setTag('error', ctx.error)
+    }
+  }
+
+  #finishSpan (ctx, span, res) {
+    this.config.hooks.execute(span, ctx.ddArgs, res)
+
+    if (res?.errors?.length) {
+      span.setTag('error', res.errors[0])
       for (const err of res.errors) {
         extractErrorIntoSpanEvent(this._tracerConfig, span, err)
       }
     }
-    super.finish(ctx)
 
-    return ctx.parentStore
+    this.#drain(ctx, span)
+  }
+
+  #drain (ctx, span) {
+    span.finish()
+    if (ctx.ddContextValue) {
+      contexts.delete(ctx.ddContextValue)
+    }
+    if (ctx.ddInstrumentedArgs) {
+      instrumentedArgs.delete(ctx.ddInstrumentedArgs)
+    }
+  }
+
+  // Public — called from wrapResolve (free function, crosses class boundary).
+  // Resolve-span creation is inline at first-encounter; deferring to a batch
+  // produces a bursty encoder stall when many spans finish together.
+  startResolveSpan (field, rootCtx, executeSpan, startTime) {
+    const { fieldNode, fieldName, returnType, baseTypeName, variableValues, collapsedKey } = field
+
+    const parent = getParentField(rootCtx, field)
+    const childOf = parent?.span || executeSpan
+
+    const document = rootCtx.source
+    const loc = this.config.source && document && fieldNode && fieldNode.loc
+    const source = loc && document.slice(loc.start, loc.end)
+
+    const span = this.startSpan('graphql.resolve', {
+      service: this.config.service,
+      resource: `${fieldName}:${returnType}`,
+      childOf,
+      type: 'graphql',
+      startTime,
+      meta: {
+        'graphql.field.name': fieldName,
+        'graphql.field.path': collapsedKey,
+        'graphql.field.type': baseTypeName,
+        'graphql.source': source,
+      },
+    }, false)
+
+    if (fieldNode && this.config.variables && fieldNode.arguments) {
+      const variables = this.config.variables(variableValues)
+      for (const arg of fieldNode.arguments) {
+        if (arg.value?.name && arg.value.kind === 'Variable' && variables[arg.value.name.value]) {
+          const name = arg.value.name.value
+          span.setTag(`graphql.variables.${name}`, variables[name])
+        }
+      }
+    }
+
+    return span
+  }
+
+  // Public — called from wrapResolve. endTime reflects when the resolver
+  // actually completed, not when the field record was created.
+  finishResolveSpan (span, field, error, result, endTime) {
+    if (error) span.setTag('error', error)
+
+    if (this.config.hooks.resolve) {
+      this.config.hooks.resolve(span, {
+        fieldName: field.fieldName,
+        path: field.pathString,
+        error: error || null,
+        // Any thenable from any realm — keep undefined so the hook doesn't
+        // accidentally see the unresolved promise.
+        result: typeof result?.then === 'function' ? undefined : result,
+      })
+    }
+
+    span.finish(endTime)
+  }
+}
+
+// --- resolver wrapping --------------------------------------------------------
+
+function wrapResolve (resolve) {
+  if (typeof resolve !== 'function' || patchedResolvers.has(resolve)) return resolve
+
+  function resolveAsync (source, args, contextValue, info) {
+    const hasIastSub = iastResolveCh.hasSubscribers
+    const hasResolverSub = resolverStartCh.hasSubscribers
+
+    // Combined fast-path: depth=0 AND no IAST/AppSec subscriber means nothing
+    // to do — skip rootCtx lookup, path walk, publish gates.
+    if (depthDisabled && !hasIastSub && !hasResolverSub) {
+      return resolve.apply(this, arguments)
+    }
+
+    const rootCtx = contexts.get(contextValue) ?? legacyStorage.getStore()?.graphqlRootCtx
+    if (!rootCtx) return resolve.apply(this, arguments)
+
+    const infoPath = info?.path
+    const config = rootCtx.config
+
+    // pathString built incrementally off the parent's cached value
+    // (rootCtx.pathCache, keyed by path node) — avoids re-walking the whole
+    // path linked-list on every resolver call, which is O(depth) per call for
+    // deeply nested resolvers. Shared between the IAST publish and the field
+    // record. Collapse-aware: list-index segments become '*'.
+    let pathString
+    let collapsedKey
+    if (infoPath) {
+      pathString = buildCachedPathString(infoPath, rootCtx.pathCache, config.collapse)
+      if (config.collapse) collapsedKey = pathString
+    }
+
+    // IAST and AppSec subscribers see EVERY resolver call, regardless of
+    // depth or collapse. The depth knob caps span creation only.
+    if (hasIastSub) {
+      iastResolveCh.publish({ rootCtx, args, info, path: pathToArray(infoPath), pathString })
+    }
+    if (hasResolverSub) {
+      resolverStartCh.publish({
+        abortController: rootCtx.abortController,
+        resolverInfo: getResolverInfo(info, args),
+      })
+    }
+
+    if (depthDisabled || !shouldInstrumentNode(config, infoPath)) {
+      if (rootCtx.abortController?.signal.aborted) {
+        throw new AbortError('Aborted')
+      }
+
+      return resolve.apply(this, arguments)
+    }
+
+    const fieldKey = config.collapse ? buildCachedCollapsedPath(infoPath, rootCtx.collapsedPathCache) : infoPath
+    let field = rootCtx.fields.get(fieldKey)
+    const isFirst = !field
+
+    if (isFirst) {
+      field = {
+        fieldNode: info.fieldNodes?.[0],
+        fieldName: info.fieldName,
+        returnType: info.returnType,
+        baseTypeName: getBaseTypeName(info.returnType),
+        variableValues: info.variableValues,
+        args,
+        infoPath,
+        fieldKey,
+        pathString,
+        collapsedKey: collapsedKey ?? pathString,
+        span: null,
+      }
+      rootCtx.fields.set(fieldKey, field)
+    }
+
+    // Collapsed siblings still publish updateField (master's contract: one
+    // publish per resolver call, even when the span is collapsed) and route
+    // through callInAsyncScope so the abort signal stops them mid-flight.
+    if (!isFirst) {
+      return callInAsyncScope(resolve, this, arguments, rootCtx.abortController, (err) => {
+        if (updateFieldCh.hasSubscribers) {
+          updateFieldCh.publish({ rootCtx, field, error: err, pathString: field.pathString })
+        }
+      })
+    }
+
+    const executeSpan = rootCtx.executeSpan
+    const startTime = executeSpan._getTime()
+    const span = rootCtx.plugin.startResolveSpan(field, rootCtx, executeSpan, startTime)
+    field.span = span
+
+    return callInAsyncScope(resolve, this, arguments, rootCtx.abortController, (err, res) => {
+      const endTime = executeSpan._getTime()
+      rootCtx.plugin.finishResolveSpan(span, field, err, res, endTime || startTime)
+      if (updateFieldCh.hasSubscribers) {
+        updateFieldCh.publish({ rootCtx, field, error: err, pathString: field.pathString })
+      }
+    })
+  }
+
+  patchedResolvers.add(resolveAsync)
+  return resolveAsync
+}
+
+function wrapFields (type) {
+  if (!type?._fields || patchedTypes.has(type)) return
+
+  patchedTypes.add(type)
+
+  for (const field of Object.values(type._fields)) {
+    wrapFieldResolve(field)
+    wrapFieldType(field)
+  }
+}
+
+function wrapFieldResolve (field) {
+  if (!field?.resolve) return
+  field.resolve = wrapResolve(field.resolve)
+}
+
+function wrapFieldType (field) {
+  if (!field?.type) return
+
+  let unwrapped = field.type
+  while (unwrapped.ofType) unwrapped = unwrapped.ofType
+
+  wrapFields(unwrapped)
+}
+
+function callInAsyncScope (fn, thisArg, args, abortController, cb) {
+  cb ??= () => {}
+
+  if (abortController?.signal.aborted) {
+    cb(null, null)
+    throw new AbortError('Aborted')
+  }
+
+  try {
+    const result = fn.apply(thisArg, args)
+    if (typeof result?.then === 'function') {
+      return result.then(
+        res => { cb(null, res); return res },
+        err => { cb(err); throw err }
+      )
+    }
+    cb(null, result)
+    return result
+  } catch (err) {
+    cb(err)
+    throw err
+  }
+}
+
+function pathToArray (path) {
+  let length = 0
+  for (let curr = path; curr; curr = curr.prev) {
+    length += 1
+  }
+
+  const flattened = new Array(length)
+  let index = length
+  for (let curr = path; curr; curr = curr.prev) {
+    flattened[--index] = curr.key
+  }
+  return flattened
+}
+
+// Build the dotted pathString for a resolver's path node, caching per node on
+// rootCtx.pathCache so each call reuses the parent's already-built string
+// instead of re-walking the whole path linked-list (O(1) amortized per call).
+// Collapse-aware: numeric (list-index) segments become '*'. The recursion
+// handles the cold path where a parent node never hit a resolver (graphql
+// inserts a synthetic array-index node between a list field and its items).
+function buildCachedPathString (path, cache, collapse) {
+  const cached = cache.get(path)
+  if (cached !== undefined) return cached
+
+  const key = path.key
+  const segment = collapse && typeof key !== 'string' ? '*' : key
+  const prev = path.prev
+
+  const pathString = prev === undefined
+    ? String(segment)
+    : `${buildCachedPathString(prev, cache, collapse)}.${segment}`
+  cache.set(path, pathString)
+  return pathString
+}
+
+function buildCachedCollapsedPath (path, cache) {
+  if (!path) return
+
+  const cached = cache.byPath.get(path)
+  if (cached !== undefined) return cached
+
+  const segment = typeof path.key === 'string' ? path.key : '*'
+  const prev = path.prev === undefined
+    ? undefined
+    : buildCachedCollapsedPath(path.prev, cache)
+
+  let siblings = cache.byParent.get(prev)
+  if (siblings === undefined) {
+    siblings = new Map()
+    cache.byParent.set(prev, siblings)
+  }
+
+  let collapsedPath = siblings.get(segment)
+  if (collapsedPath === undefined) {
+    collapsedPath = { key: segment, prev }
+    siblings.set(segment, collapsedPath)
   }
+
+  cache.byPath.set(path, collapsedPath)
+  return collapsedPath
+}
+
+// Depth filtering directly on the linked-list node — no array allocation needed.
+// config.depth < 0 means no limit. In non-collapse mode only string segments
+// count toward depth (array indices are transparent). In collapse mode every
+// node counts (numbers have been conceptually '*'-collapsed).
+function shouldInstrumentNode (config, path) {
+  if (config.depth < 0) return true
+
+  let depth = 0
+  if (config.collapse) {
+    for (let curr = path; curr; curr = curr.prev) depth++
+  } else {
+    for (let curr = path; curr; curr = curr.prev) {
+      if (typeof curr.key === 'string') depth++
+    }
+  }
+
+  return config.depth >= depth
+}
+
+function getParentField (rootCtx, field) {
+  for (let curr = field.fieldKey?.prev; curr; curr = curr.prev) {
+    const innerField = rootCtx.fields.get(curr)
+    if (innerField) return innerField
+  }
+
+  return null
+}
+
+// Build the resolverInfo payload that AppSec's datadog:graphql:resolver:start
+// subscriber expects: { [fieldName]: { ...args, ...directives } }.
+function getResolverInfo (info, args) {
+  let resolverVars = args ? { ...args } : undefined
+
+  const directives = info.fieldNodes?.[0]?.directives
+  if (Array.isArray(directives)) {
+    for (const directive of directives) {
+      if (directive.arguments.length === 0) continue
+
+      const argList = {}
+      for (const argument of directive.arguments) {
+        argList[argument.name.value] = argument.value.value
+      }
+
+      resolverVars ??= {}
+      resolverVars[directive.name.value] = argList
+    }
+  }
+
+  return resolverVars === undefined ? null : { [info.fieldName]: resolverVars }
+}
+
+// --- arg / context normalization ---------------------------------------------
+
+// graphql.execute accepts either a single args object or positional arguments;
+// the object form is a lone non-array object in slot 0.
+function isObjectForm (args) {
+  return args?.length === 1 && args[0] && typeof args[0] === 'object' && !Array.isArray(args[0])
 }
 
-// span-related
+function readArgs (args, objectForm) {
+  if (!args || args.length === 0) return {}
+
+  if (objectForm) {
+    return args[0]
+  }
+
+  return {
+    schema: args[0],
+    document: args[1],
+    rootValue: args[2],
+    contextValue: args[3],
+    variableValues: args[4],
+    operationName: args[5],
+    fieldResolver: args[6],
+  }
+}
+
+// No user input may be modified. Object-form clones rawArgs[0]; positional
+// form rewrites its own arguments slots (no caller-observable mutation).
+// Returns the readArgs-shaped view of the (possibly cloned) args so the caller
+// doesn't have to re-readArgs after the swap.
+function setWrappedFieldResolver (rawArgs, args, objectForm, defaultFieldResolver) {
+  if (!rawArgs || rawArgs.length === 0) return args
+
+  if (objectForm) {
+    const clone = {
+      ...args,
+      fieldResolver: wrapResolve(args.fieldResolver || defaultFieldResolver),
+    }
+    rawArgs[0] = clone
+    return clone
+  }
+
+  rawArgs[6] = wrapResolve(args.fieldResolver || defaultFieldResolver)
+  if (rawArgs.length < 7) rawArgs.length = 7
+  args.fieldResolver = rawArgs[6]
+  return args
+}
+
+function isWeakMapKey (value) {
+  return value !== null && (typeof value === 'object' || typeof value === 'function')
+}
+
+// Unwrap GraphQL List/NonNull wrappers to get the underlying named type's name.
+// e.g. [Human] → 'Human', [Pet!] → 'Pet', String → 'String'
+function getBaseTypeName (type) {
+  let cursor = type
+  while (cursor && cursor.ofType) cursor = cursor.ofType
+  return cursor?.name
+}
+
+// Fallback resolver used when graphql.execute() is called without an explicit
+// fieldResolver and the schema field has no .resolve. Mirrors graphql's own
+// defaultFieldResolver: property access on source, calling it if it's a function.
+// Defined locally so it survives dd-trace plugin-manager reloads (agent.load()
+// recreates globalThis[Symbol.for('dd-trace')], so capturing defaultFieldResolver
+// via ddGlobal at IITM hook time would lose the reference across test suites).
+function defaultFieldResolver (source, args, contextValue, info) {
+  if ((typeof source === 'object' && source !== null) || typeof source === 'function') {
+    const property = source[info.fieldName]
+    if (typeof property === 'function') return source[info.fieldName](args, contextValue, info)
+    return property
+  }
+}
+
+function getOperation (document, operationName) {
+  if (!document || !Array.isArray(document.definitions)) return
+
+  for (const definition of document.definitions) {
+    if (definition && types.has(definition.operation) &&
+        (!operationName || definition.name?.value === operationName)) {
+      return definition
+    }
+  }
+}
 
 function addVariableTags (config, span, variableValues) {
   if (!variableValues || !config.variables) return
diff --git a/packages/datadog-plugin-graphql/src/index.js b/packages/datadog-plugin-graphql/src/index.js
index 91e79a2f4b..f1fbcab332 100644
--- a/packages/datadog-plugin-graphql/src/index.js
+++ b/packages/datadog-plugin-graphql/src/index.js
@@ -6,7 +6,6 @@ const log = require('../../dd-trace/src/log')
 const GraphQLExecutePlugin = require('./execute')
 const GraphQLParsePlugin = require('./parse')
 const GraphQLValidatePlugin = require('./validate')
-const GraphQLResolvePlugin = require('./resolve')
 
 class GraphQLPlugin extends CompositePlugin {
   static id = 'graphql'
@@ -15,7 +14,9 @@ class GraphQLPlugin extends CompositePlugin {
       execute: GraphQLExecutePlugin,
       parse: GraphQLParsePlugin,
       validate: GraphQLValidatePlugin,
-      resolve: GraphQLResolvePlugin,
+      // resolve plugin is absorbed into execute: per-field data is recorded
+      // synchronously in wrapResolve, and all graphql.resolve spans are
+      // materialized at execute end.
     }
   }
 
@@ -60,13 +61,19 @@ function getVariablesFilter (config) {
 }
 
 const noop = () => {}
+const noopHooks = { execute: noop, parse: noop, validate: noop, resolve: undefined }
 
 function getHooks ({ hooks }) {
-  const execute = hooks?.execute ?? noop
-  const parse = hooks?.parse ?? noop
-  const validate = hooks?.validate ?? noop
-
-  return { execute, parse, validate }
+  if (!hooks) return noopHooks
+  return {
+    execute: hooks.execute ?? noop,
+    parse: hooks.parse ?? noop,
+    validate: hooks.validate ?? noop,
+    // No noop fallback: `resolve` runs per-field (hot path); the plugin
+    // gates with `if (this.config.hooks.resolve)` so the absent-hook case
+    // skips both the call and the payload-object allocation.
+    resolve: hooks.resolve,
+  }
 }
 
 module.exports = GraphQLPlugin
diff --git a/packages/datadog-plugin-graphql/src/parse.js b/packages/datadog-plugin-graphql/src/parse.js
index d49ea837d5..ce23f3cae4 100644
--- a/packages/datadog-plugin-graphql/src/parse.js
+++ b/packages/datadog-plugin-graphql/src/parse.js
@@ -2,34 +2,54 @@
 
 const TracingPlugin = require('../../dd-trace/src/plugins/tracing')
 
+const documentSources = new WeakMap()
+
 class GraphQLParsePlugin extends TracingPlugin {
   static id = 'graphql'
   static operation = 'parser'
+  static prefix = 'tracing:orchestrion:graphql:apm:graphql:parser'
 
   bindStart (ctx) {
+    const source = ctx.arguments?.[0]
+
     this.startSpan('graphql.parse', {
       service: this.config.service,
       type: 'graphql',
       meta: {},
     }, ctx)
 
+    ctx.ddSource = source
+
     return ctx.currentStore
   }
 
-  finish (ctx) {
-    const { source, document, docSource } = ctx
+  end (ctx) {
+    const source = ctx.ddSource
+    const document = ctx.result
     const span = ctx?.currentStore?.span || this.activeSpan
 
-    if (this.config.source && document) {
+    let docSource
+    if (document) {
+      if (source) {
+        docSource = source.body || source
+        documentSources.set(document, docSource)
+      } else {
+        docSource = documentSources.get(document)
+      }
+    }
+
+    if (this.config.source && docSource) {
       span.setTag('graphql.source', docSource)
     }
 
     this.config.hooks.parse(span, source, document)
 
-    super.finish(ctx)
+    span.finish()
 
     return ctx.parentStore
   }
 }
 
+GraphQLParsePlugin.documentSources = documentSources
+
 module.exports = GraphQLParsePlugin
diff --git a/packages/datadog-plugin-graphql/src/resolve.js b/packages/datadog-plugin-graphql/src/resolve.js
deleted file mode 100644
index 3d9177f7f7..0000000000
--- a/packages/datadog-plugin-graphql/src/resolve.js
+++ /dev/null
@@ -1,170 +0,0 @@
-'use strict'
-
-const dc = require('dc-polyfill')
-const TracingPlugin = require('../../dd-trace/src/plugins/tracing')
-
-class GraphQLResolvePlugin extends TracingPlugin {
-  static id = 'graphql'
-  static operation = 'resolve'
-
-  /**
-   * @param {{
-   *   rootCtx: {
-   *     source?: string,
-   *     collapse: boolean,
-   *     collapsedFields?: Map<string, { ctx: object }>,
-   *   },
-   *   args: Record<string, unknown>,
-   *   path: { prev: object | undefined, key: string | number },
-   *   pathString: string,
-   *   fieldName: string,
-   *   returnType: { name: string },
-   *   fieldNode: { loc?: { start: number, end: number }, arguments?: object[], directives?: object[] } | undefined,
-   *   variableValues: Record<string, unknown> | undefined,
-   * }} fieldCtx
-   */
-  start (fieldCtx) {
-    if (!shouldInstrument(this.config, fieldCtx.path)) return
-
-    const { rootCtx, args, path, pathString, fieldName, returnType, fieldNode, variableValues } = fieldCtx
-
-    // Siblings 2..N of a collapsed list share the first sibling's span, so
-    // skip span creation here. updateField still fires on the shared ctx and
-    // advances the shared span's finishTime.
-    if (rootCtx.collapse && rootCtx.collapsedFields?.has(pathString)) return
-
-    const parentField = getParentField(rootCtx, path)
-    const childOf = parentField?.ctx?.currentStore?.span
-
-    const document = rootCtx.source
-    const loc = this.config.source && document && fieldNode && fieldNode.loc
-    const source = loc && document.slice(loc.start, loc.end)
-
-    let namedReturnType = returnType
-    while (namedReturnType.ofType) namedReturnType = namedReturnType.ofType
-
-    const span = this.startSpan('graphql.resolve', {
-      service: this.config.service,
-      resource: `${fieldName}:${returnType}`,
-      childOf,
-      type: 'graphql',
-      meta: {
-        'graphql.field.name': fieldName,
-        'graphql.field.path': pathString,
-        'graphql.field.type': namedReturnType.name,
-        'graphql.source': source,
-      },
-    }, fieldCtx)
-
-    if (fieldNode && this.config.variables && fieldNode.arguments) {
-      const variables = this.config.variables(variableValues)
-
-      for (const arg of fieldNode.arguments) {
-        if (arg.value?.name && arg.value.kind === 'Variable' && variables[arg.value.name.value]) {
-          const name = arg.value.name.value
-          span.setTag(`graphql.variables.${name}`, variables[name])
-        }
-      }
-    }
-
-    if (this.resolverStartCh.hasSubscribers) {
-      this.resolverStartCh.publish({ ctx: rootCtx, resolverInfo: getResolverInfo(fieldNode, fieldName, args) })
-    }
-
-    return fieldCtx.currentStore
-  }
-
-  constructor (...args) {
-    super(...args)
-
-    this.addTraceSub('updateField', (ctx) => {
-      // start short-circuited on the depth gate, so there is no span to advance.
-      if (ctx.currentStore === undefined) return
-
-      const { field, error } = ctx
-      const span = ctx.currentStore.span
-      field.finishTime = span._getTime ? span._getTime() : 0
-      field.error = field.error || error
-    })
-
-    this.resolverStartCh = dc.channel('datadog:graphql:resolver:start')
-  }
-
-  configure (config) {
-    // this will disable resolve subscribers if `config.depth` is set to 0
-    super.configure(config.depth === 0 ? false : config)
-  }
-
-  finish (ctx) {
-    const { finishTime } = ctx
-
-    const span = ctx?.currentStore?.span || this.activeSpan
-    span.finish(finishTime)
-
-    return ctx.parentStore
-  }
-}
-
-// helpers
-
-/**
- * @param {{ depth: number, collapse: boolean }} config
- * @param {{ prev: object | undefined, key: string | number }} path
- */
-function shouldInstrument (config, path) {
-  const depth = config.depth
-  if (depth < 0) return true
-
-  let count = 0
-  if (config.collapse) {
-    for (let curr = path; curr; curr = curr.prev) count += 1
-  } else {
-    for (let curr = path; curr; curr = curr.prev) {
-      if (typeof curr.key === 'string') count += 1
-    }
-  }
-  return depth >= count
-}
-
-/**
- * @param {object | undefined} fieldNode
- * @param {string} fieldName
- * @param {Record<string, unknown> | undefined} args
- */
-function getResolverInfo (fieldNode, fieldName, args) {
-  let resolverVars
-
-  if (args && Object.keys(args).length > 0) {
-    resolverVars = { ...args }
-  }
-
-  const directives = fieldNode?.directives
-  if (Array.isArray(directives)) {
-    for (const directive of directives) {
-      if (directive.arguments.length === 0) continue
-
-      const argList = {}
-      for (const argument of directive.arguments) {
-        argList[argument.name.value] = argument.value.value
-      }
-
-      resolverVars ??= {}
-      resolverVars[directive.name.value] = argList
-    }
-  }
-
-  return resolverVars === undefined ? null : { [fieldName]: resolverVars }
-}
-
-/**
- * @param {{ fields: Map<object, { error: unknown, ctx: object }> }} rootCtx
- * @param {{ prev: object | undefined }} path
- */
-function getParentField (rootCtx, path) {
-  for (let curr = path.prev; curr; curr = curr.prev) {
-    const field = rootCtx.fields.get(curr)
-    if (field) return field
-  }
-}
-
-module.exports = GraphQLResolvePlugin
diff --git a/packages/datadog-plugin-graphql/src/validate.js b/packages/datadog-plugin-graphql/src/validate.js
index 789df6a9da..dfeeb4ea0c 100644
--- a/packages/datadog-plugin-graphql/src/validate.js
+++ b/packages/datadog-plugin-graphql/src/validate.js
@@ -1,14 +1,18 @@
 'use strict'
 
 const TracingPlugin = require('../../dd-trace/src/plugins/tracing')
+const GraphQLParsePlugin = require('./parse')
 const { extractErrorIntoSpanEvent } = require('./utils')
 
 class GraphQLValidatePlugin extends TracingPlugin {
   static id = 'graphql'
   static operation = 'validate'
+  static prefix = 'tracing:orchestrion:graphql:apm:graphql:validate'
 
   bindStart (ctx) {
-    const { docSource, document } = ctx
+    // validate(schema, documentAST, rules, options, typeInfo)
+    const document = ctx.arguments?.[1]
+    const docSource = document ? GraphQLParsePlugin.documentSources.get(document) : undefined
     const source = this.config.source && document && docSource
 
     this.startSpan('graphql.validate', {
@@ -19,19 +23,26 @@ class GraphQLValidatePlugin extends TracingPlugin {
       },
     }, ctx)
 
+    ctx.ddDocument = document
+
     return ctx.currentStore
   }
 
-  finish (ctx) {
-    const { document, errors } = ctx
+  end (ctx) {
+    const document = ctx.ddDocument
+    const errors = ctx.result
     const span = ctx?.currentStore?.span || this.activeSpan
+
     this.config.hooks.validate(span, document, errors)
-    if (errors) {
+
+    if (errors?.length) {
+      span.setTag('error', errors[0])
       for (const err of errors) {
         extractErrorIntoSpanEvent(this._tracerConfig, span, err)
       }
     }
-    super.finish(ctx)
+
+    span.finish()
 
     return ctx.parentStore
   }
diff --git a/packages/datadog-plugin-graphql/test/esm-test/esm-graphql-yoga-server.mjs b/packages/datadog-plugin-graphql/test/esm-test/esm-graphql-yoga-server.mjs
index 94f94587dc..9d0e2603db 100644
--- a/packages/datadog-plugin-graphql/test/esm-test/esm-graphql-yoga-server.mjs
+++ b/packages/datadog-plugin-graphql/test/esm-test/esm-graphql-yoga-server.mjs
@@ -6,6 +6,9 @@ const typeDefs = /* GraphQL */ `
   type Query {
     hello(name: String): String
   }
+  type Subscription {
+    count: Int
+  }
 `
 
 const resolvers = {
@@ -14,6 +17,13 @@ const resolvers = {
       return `Hello, ${name || 'world'}!`
     },
   },
+  Subscription: {
+    count: {
+      subscribe: async function * () {
+        yield { count: 1 }
+      },
+    },
+  },
 }
 
 const schema = createSchema({
diff --git a/packages/datadog-plugin-graphql/test/esm-test/esm.spec.js b/packages/datadog-plugin-graphql/test/esm-test/esm.spec.js
index 71080a1022..5a3698e924 100644
--- a/packages/datadog-plugin-graphql/test/esm-test/esm.spec.js
+++ b/packages/datadog-plugin-graphql/test/esm-test/esm.spec.js
@@ -102,6 +102,41 @@ describe('Plugin (ESM)', () => {
 
           await res
         }).timeout(50000)
+
+        it('should instrument GraphQL Yoga subscriptions with ESM', async () => {
+          const res = agent.assertMessageReceived(({ headers, payload }) => {
+            assert.strictEqual(headers.host, `127.0.0.1:${agent.port}`)
+            assert.ok(Array.isArray(payload), `Expected array, got ${inspect(payload)}`)
+            assert.strictEqual(checkSpansForServiceName(payload, 'graphql.execute'), true)
+          })
+
+          proc = await spawnPluginIntegrationTestProc(
+            sandboxCwd(),
+            'esm-graphql-yoga-server.mjs',
+            agent.port,
+            { NODE_OPTIONS: '--no-warnings --loader=dd-trace/loader-hook.mjs' }
+          )
+
+          const query = `
+            subscription CountSubscription {
+              count
+            }
+          `
+
+          try {
+            await axios.post(`${proc.url}/graphql`, {
+              query,
+            }, {
+              headers: {
+                accept: 'text/event-stream',
+              },
+            })
+          } catch (error) {
+            // Server might not respond correctly, but we care about tracing
+          }
+
+          await res
+        }).timeout(50000)
       }
     })
   })
diff --git a/packages/datadog-plugin-graphql/test/index.spec.js b/packages/datadog-plugin-graphql/test/index.spec.js
index 346e97bbcf..bb7d108900 100644
--- a/packages/datadog-plugin-graphql/test/index.spec.js
+++ b/packages/datadog-plugin-graphql/test/index.spec.js
@@ -255,6 +255,10 @@ describe('Plugin', () => {
             const typeDefs = `
               type Query {
                 hello(name: String): String
+                error: String
+              }
+              type Subscription {
+                count: Int
               }
             `
 
@@ -263,6 +267,16 @@ describe('Plugin', () => {
                 hello: (_, { name }) => {
                   return `Hello, ${name || 'world'}!`
                 },
+                error: async () => {
+                  throw new Error('Yoga query failed')
+                },
+              },
+              Subscription: {
+                count: {
+                  subscribe: async function * () {
+                    yield { count: 1 }
+                  },
+                },
               },
             }
 
@@ -309,6 +323,7 @@ describe('Plugin', () => {
                 },
               })
               assert.ok(!('graphql.source' in spans[0].meta))
+              assert.strictEqual(spans.filter(span => span.name === expectedSchema.server.opName).length, 1)
             }, { spanResourceMatch: /MyQuery/ })
 
             return Promise.all([
@@ -316,6 +331,64 @@ describe('Plugin', () => {
               axios.post(`http://localhost:${port}/graphql`, { query }),
             ])
           })
+
+          it('should instrument graphql-yoga async execution errors', () => {
+            const query = `
+              query ErrorQuery {
+                error
+              }
+            `
+
+            const assertion = agent.assertSomeTraces(traces => {
+              const spans = sort(traces[0])
+
+              assertObjectContains(spans[0], {
+                name: expectedSchema.server.opName,
+                resource: 'query ErrorQuery{error}',
+                error: 1,
+                meta: {
+                  'graphql.operation.type': 'query',
+                  'graphql.operation.name': 'ErrorQuery',
+                },
+              })
+            }, { spanResourceMatch: /ErrorQuery/ })
+
+            return Promise.all([
+              assertion,
+              axios.post(`http://localhost:${port}/graphql`, { query }),
+            ])
+          })
+
+          it('should instrument graphql-yoga subscriptions', () => {
+            const query = `
+              subscription CountSubscription {
+                count
+              }
+            `
+
+            const assertion = agent.assertSomeTraces(traces => {
+              const spans = sort(traces[0])
+
+              assertObjectContains(spans[0], {
+                name: expectedSchema.server.opName,
+                resource: 'subscription CountSubscription{count}',
+                error: 0,
+                meta: {
+                  'graphql.operation.type': 'subscription',
+                  'graphql.operation.name': 'CountSubscription',
+                },
+              })
+            }, { spanResourceMatch: /CountSubscription/ })
+
+            return Promise.all([
+              assertion,
+              axios.post(`http://localhost:${port}/graphql`, { query }, {
+                headers: {
+                  accept: 'text/event-stream',
+                },
+              }),
+            ])
+          })
         })
       })
 
@@ -446,6 +519,56 @@ describe('Plugin', () => {
             'instrumentation must not overwrite the caller-supplied fieldResolver')
         })
 
+        it('should preserve graphql defaultFieldResolver behavior for primitive sources', async () => {
+          const Box = new graphql.GraphQLObjectType({
+            name: 'Box',
+            fields: {
+              length: {
+                type: graphql.GraphQLInt,
+              },
+            },
+          })
+          const query = new graphql.GraphQLObjectType({
+            name: 'Query',
+            fields: {
+              box: {
+                type: Box,
+                resolve: () => 'abc',
+              },
+            },
+          })
+          const localSchema = new graphql.GraphQLSchema({ query })
+          const document = graphql.parse('{ box { length } }')
+
+          const result = await graphql.execute({ schema: localSchema, document })
+
+          assert.strictEqual(result.data.box.length, null)
+        })
+
+        it('publishes caller-owned execute args before installing the wrapped fieldResolver', async () => {
+          const startChannel = dc.channel('apm:graphql:execute:start')
+          const document = graphql.parse('query MyQuery { hello(name: "world") }')
+          const callerFieldResolver = (source, args, contextValue, info) => 'caller-resolved'
+          const args = { schema, document, contextValue: {}, fieldResolver: callerFieldResolver }
+
+          let publishedArgs
+          const handler = ({ args: channelArgs }) => {
+            publishedArgs = channelArgs
+            assert.strictEqual(channelArgs, args)
+            assert.strictEqual(channelArgs.fieldResolver, callerFieldResolver)
+          }
+          startChannel.subscribe(handler)
+
+          try {
+            assert.ok(await graphql.execute(args), 'execute returned a result')
+          } finally {
+            startChannel.unsubscribe(handler)
+          }
+
+          assert.strictEqual(publishedArgs, args)
+          assert.strictEqual(args.fieldResolver, callerFieldResolver)
+        })
+
         describe('preserves the caller-supplied contextValue', () => {
           let recordingSchema
           let recordedContext
@@ -904,11 +1027,15 @@ describe('Plugin', () => {
 
           const [, result] = await Promise.all([
             agent.assertSomeTraces(traces => {
-              const paths = sort(traces[0])
-                .filter(span => span.name === 'graphql.resolve')
-                .map(span => span.meta['graphql.field.path'])
-                .sort()
+              const resolveSpans = sort(traces[0]).filter(span => span.name === 'graphql.resolve')
+              const paths = resolveSpans.map(span => span.meta['graphql.field.path']).sort()
               assert.deepStrictEqual(paths, ['matrix', 'matrix.*.*.value'])
+
+              const matrix = resolveSpans.find(span => span.meta['graphql.field.path'] === 'matrix')
+              const value = resolveSpans.find(span => span.meta['graphql.field.path'] === 'matrix.*.*.value')
+              assert.ok(matrix, 'expected matrix span')
+              assert.ok(value, 'expected matrix.*.*.value span')
+              assert.strictEqual(value.parent_id.toString(), matrix.span_id.toString())
             }),
             graphql.graphql({ schema: matrixSchema, source, rootValue }),
           ])
@@ -1517,6 +1644,27 @@ describe('Plugin', () => {
           }
         })
 
+        it('should publish empty resolver args with subscription to datadog:graphql:resolver:start', async () => {
+          const source = 'query MyQuery { human { name } }'
+          const document = graphql.parse(source)
+          const resolverInfo = []
+
+          const handler = ({ resolverInfo: info }) => {
+            resolverInfo.push(info)
+          }
+          dc.channel('datadog:graphql:resolver:start').subscribe(handler)
+
+          try {
+            await graphql.execute({ schema, document })
+          } finally {
+            dc.channel('datadog:graphql:resolver:start').unsubscribe(handler)
+          }
+
+          const humanResolverInfo = resolverInfo.find(info => info?.human)
+          assert.deepStrictEqual(humanResolverInfo, { human: {} },
+            `Expected empty human resolver args. Got ${inspect(resolverInfo)}`)
+        })
+
         it('should support multiple validations on a pre-parsed document', () => {
           const source = 'query MyQuery { hello(name: "world") }'
           const document = graphql.parse(source)
@@ -1859,6 +2007,26 @@ describe('Plugin', () => {
 
           graphql.graphql({ schema, source, rootValue }).catch(done)
         })
+
+        it('should publish resolver start for depth 0 AppSec subscribers', async () => {
+          const startCh = dc.channel('datadog:graphql:resolver:start')
+          const fields = []
+          const handler = ({ resolverInfo }) => {
+            fields.push(...Object.keys(resolverInfo || {}))
+          }
+
+          startCh.subscribe(handler)
+
+          try {
+            const source = '{ human { name } }'
+            const result = await graphql.graphql({ schema, source })
+
+            assert.ok(!result.errors || result.errors.length === 0, `Expected [${result.errors}] to be empty`)
+            assert.deepStrictEqual(fields.sort(), ['human', 'name'])
+          } finally {
+            startCh.unsubscribe(handler)
+          }
+        })
       })
 
       describe('with a depth >=1', () => {
@@ -1909,6 +2077,61 @@ describe('Plugin', () => {
           return Promise.all([assertion, graphql.graphql({ schema, source })])
         })
 
+        it('should honor resolver abort for fields gated by depth', async () => {
+          let streetResolverRan = false
+          const startCh = dc.channel('datadog:graphql:resolver:start')
+          const handler = ({ abortController, resolverInfo }) => {
+            if (resolverInfo?.street) abortController.abort()
+          }
+
+          const Address = new graphql.GraphQLObjectType({
+            name: 'DepthAbortAddress',
+            fields: {
+              street: {
+                type: graphql.GraphQLString,
+                resolve () {
+                  streetResolverRan = true
+                  return 'foo street'
+                },
+              },
+            },
+          })
+          const Human = new graphql.GraphQLObjectType({
+            name: 'DepthAbortHuman',
+            fields: {
+              address: {
+                type: Address,
+                resolve: () => ({}),
+              },
+            },
+          })
+          const query = new graphql.GraphQLObjectType({
+            name: 'DepthAbortQuery',
+            fields: {
+              human: {
+                type: Human,
+                resolve: () => ({}),
+              },
+            },
+          })
+          const localSchema = new graphql.GraphQLSchema({ query })
+
+          startCh.subscribe(handler)
+
+          try {
+            const result = await graphql.graphql({
+              schema: localSchema,
+              source: '{ human { address { street } } }',
+            })
+
+            assert.strictEqual(streetResolverRan, false)
+            assert.strictEqual(result.errors.length, 1)
+            assert.strictEqual(result.errors[0].originalError?.name, 'AbortError')
+          } finally {
+            startCh.unsubscribe(handler)
+          }
+        })
+
         it('publishes apm:graphql:resolve:start for every resolver, including depth-gated ones', async () => {
           // The depth knob caps span creation, not channel publishes.
           // IAST taint-tracking and AppSec WAF subscribers run on every resolver
@@ -2142,6 +2365,7 @@ describe('Plugin', () => {
             execute: sinon.spy((span, context, res) => {}),
             parse: sinon.spy((span, document, operation) => {}),
             validate: sinon.spy((span, document, error) => {}),
+            resolve: sinon.spy((span, field) => {}),
           },
         }
 
@@ -2279,6 +2503,32 @@ describe('Plugin', () => {
 
           return Promise.all([assertion, action])
         })
+
+        it('should run the resolve hook before graphql.resolve span is finished', () => {
+          const resolveSource = '{ hello(name: "world") }'
+
+          const assertion = agent.assertSomeTraces(traces => {
+            const spans = sort(traces[0])
+
+            assert.strictEqual(spans.length, 2)
+            assert.strictEqual(spans[1].name, 'graphql.resolve')
+            sinon.assert.calledOnce(config.hooks.resolve)
+
+            const span = config.hooks.resolve.firstCall.args[0]
+            const field = config.hooks.resolve.firstCall.args[1]
+
+            assert.strictEqual(span.context()._name, 'graphql.resolve')
+            assert.strictEqual(field.fieldName, 'hello')
+            assert.strictEqual(field.path, 'hello')
+            assert.strictEqual(field.error, null)
+            assert.strictEqual(field.result, 'world')
+          }, { spanResourceMatch: /hello:String/ })
+
+          return Promise.all([
+            assertion,
+            graphql.graphql({ schema, source: resolveSource }),
+          ])
+        })
       })
 
       withVersions('graphql', 'apollo-server-core', apolloVersion => {
diff --git a/packages/dd-trace/src/appsec/channels.js b/packages/dd-trace/src/appsec/channels.js
index 6e5deab3ff..608e5e3375 100644
--- a/packages/dd-trace/src/appsec/channels.js
+++ b/packages/dd-trace/src/appsec/channels.js
@@ -43,7 +43,7 @@ module.exports = {
   routerParam: dc.channel('datadog:router:param:start'),
   setCookieChannel: dc.channel('datadog:iast:set-cookie'),
   setUncaughtExceptionCaptureCallbackStart: dc.channel('datadog:process:setUncaughtExceptionCaptureCallback:start'),
-  startGraphqlResolve: dc.channel('datadog:graphql:resolver:start'),
+  startGraphqlResolver: dc.channel('datadog:graphql:resolver:start'),
   stripeCheckoutSessionCreate: dc.channel('datadog:stripe:checkoutSession:create:finish'),
   stripeConstructEvent: dc.channel('datadog:stripe:constructEvent:finish'),
   stripePaymentIntentCreate: dc.channel('datadog:stripe:paymentIntent:create:finish'),
diff --git a/packages/dd-trace/src/appsec/graphql.js b/packages/dd-trace/src/appsec/graphql.js
index 2209285cdf..3333889fed 100644
--- a/packages/dd-trace/src/appsec/graphql.js
+++ b/packages/dd-trace/src/appsec/graphql.js
@@ -12,7 +12,7 @@ const {
 const waf = require('./waf')
 const addresses = require('./addresses')
 const {
-  startGraphqlResolve,
+  startGraphqlResolver,
   graphqlMiddlewareChannel,
   apolloHttpServerChannel,
   apolloChannel,
@@ -32,7 +32,7 @@ function disable () {
   disableGraphql()
 }
 
-function onGraphqlStartResolve ({ context, resolverInfo }) {
+function onGraphqlStartResolver ({ abortController, resolverInfo }) {
   const req = getActiveRequest()
 
   if (!req) return
@@ -46,7 +46,7 @@ function onGraphqlStartResolve ({ context, resolverInfo }) {
     if (requestData?.isInGraphqlRequest) {
       requestData.blocked = true
       requestData.wafAction = blockingAction
-      context?.abortController?.abort()
+      abortController?.abort()
     }
   }
 }
@@ -153,11 +153,11 @@ function disableApollo () {
 }
 
 function enableGraphql () {
-  startGraphqlResolve.subscribe(onGraphqlStartResolve)
+  startGraphqlResolver.subscribe(onGraphqlStartResolver)
 }
 
 function disableGraphql () {
-  if (startGraphqlResolve.hasSubscribers) startGraphqlResolve.unsubscribe(onGraphqlStartResolve)
+  if (startGraphqlResolver.hasSubscribers) startGraphqlResolver.unsubscribe(onGraphqlStartResolver)
 }
 
 module.exports = {
diff --git a/packages/dd-trace/test/appsec/graphql.spec.js b/packages/dd-trace/test/appsec/graphql.spec.js
index a9ef1fe318..0b417a5e9f 100644
--- a/packages/dd-trace/test/appsec/graphql.spec.js
+++ b/packages/dd-trace/test/appsec/graphql.spec.js
@@ -12,7 +12,7 @@ const { withRequest } = require('../../src/appsec/store')
 const waf = require('../../src/appsec/waf')
 const web = require('../../src/plugins/util/web')
 const {
-  startGraphqlResolve,
+  startGraphqlResolver,
   graphqlMiddlewareChannel,
   apolloChannel,
   apolloServerCoreChannel,
@@ -64,7 +64,7 @@ describe('GraphQL', () => {
       assert.strictEqual(apolloChannel.asyncEnd.hasSubscribers, false)
       assert.strictEqual(apolloServerCoreChannel.start.hasSubscribers, false)
       assert.strictEqual(apolloServerCoreChannel.asyncEnd.hasSubscribers, false)
-      assert.strictEqual(startGraphqlResolve.hasSubscribers, false)
+      assert.strictEqual(startGraphqlResolver.hasSubscribers, false)
 
       graphql.enable()
 
@@ -73,7 +73,7 @@ describe('GraphQL', () => {
       assert.strictEqual(apolloChannel.asyncEnd.hasSubscribers, true)
       assert.strictEqual(apolloServerCoreChannel.start.hasSubscribers, true)
       assert.strictEqual(apolloServerCoreChannel.asyncEnd.hasSubscribers, true)
-      assert.strictEqual(startGraphqlResolve.hasSubscribers, true)
+      assert.strictEqual(startGraphqlResolver.hasSubscribers, true)
     })
   })
 
@@ -86,7 +86,7 @@ describe('GraphQL', () => {
       assert.strictEqual(apolloChannel.asyncEnd.hasSubscribers, true)
       assert.strictEqual(apolloServerCoreChannel.start.hasSubscribers, true)
       assert.strictEqual(apolloServerCoreChannel.asyncEnd.hasSubscribers, true)
-      assert.strictEqual(startGraphqlResolve.hasSubscribers, true)
+      assert.strictEqual(startGraphqlResolver.hasSubscribers, true)
 
       graphql.disable()
 
@@ -95,7 +95,7 @@ describe('GraphQL', () => {
       assert.strictEqual(apolloChannel.asyncEnd.hasSubscribers, false)
       assert.strictEqual(apolloServerCoreChannel.start.hasSubscribers, false)
       assert.strictEqual(apolloServerCoreChannel.asyncEnd.hasSubscribers, false)
-      assert.strictEqual(startGraphqlResolve.hasSubscribers, false)
+      assert.strictEqual(startGraphqlResolver.hasSubscribers, false)
     })
   })
 
@@ -113,46 +113,35 @@ describe('GraphQL', () => {
     })
 
     it('Should not call waf if resolvers is undefined', () => {
-      const context = {
-        resolver: undefined,
-      }
-
-      startGraphqlResolve.publish({ context })
+      startGraphqlResolver.publish({ resolverInfo: undefined })
 
       sinon.assert.notCalled(waf.run)
     })
 
     it('Should not call waf if resolvers is not an object', () => {
-      const context = {
-        resolver: '',
-      }
-
-      startGraphqlResolve.publish({ context })
+      startGraphqlResolver.publish({ resolverInfo: '' })
 
       sinon.assert.notCalled(waf.run)
     })
 
     it('Should not call waf if req is unavailable', () => {
-      const context = {}
       const resolverInfo = {
         user: [{ id: '1234' }],
       }
 
       storage('legacy').getStore.returns({})
 
-      startGraphqlResolve.publish({ context, resolverInfo })
+      startGraphqlResolver.publish({ resolverInfo })
 
       sinon.assert.notCalled(waf.run)
     })
 
     it('Should call waf if resolvers is well formatted', () => {
-      const context = {}
-
       const resolverInfo = {
         user: [{ id: '1234' }],
       }
 
-      startGraphqlResolve.publish({ context, resolverInfo })
+      startGraphqlResolver.publish({ resolverInfo })
 
       sinon.assert.calledOnceWithExactly(waf.run, {
         ephemeral: {
@@ -200,7 +189,7 @@ describe('GraphQL', () => {
 
       sinon.stub(waf, 'run').returns([''])
 
-      startGraphqlResolve.publish({ context, resolverInfo })
+      startGraphqlResolver.publish({ abortController, resolverInfo })
 
       sinon.assert.calledOnceWithExactly(waf.run, {
         ephemeral: {
@@ -226,7 +215,7 @@ describe('GraphQL', () => {
 
       sinon.stub(web, 'root').returns(rootSpan)
 
-      startGraphqlResolve.publish({ context, resolverInfo })
+      startGraphqlResolver.publish({ abortController, resolverInfo })
 
       sinon.assert.calledOnceWithExactly(waf.run, {
         ephemeral: {
@@ -258,7 +247,7 @@ describe('GraphQL', () => {
 
       sinon.stub(web, 'root').returns(rootSpan)
 
-      startGraphqlResolve.publish({ context, resolverInfo })
+      startGraphqlResolver.publish({ abortController, resolverInfo })
 
       sinon.assert.calledOnceWithExactly(waf.run, {
         ephemeral: {

From 4c79470fbe69f3b0ab16ae461e8e386e1de245ea Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 01:10:50 +0000
Subject: [PATCH 10/51] chore(deps): bump openai (#9122)

Bumps the test-versions group with 1 update in the /integration-tests/esbuild directory: [openai](https://github.com/openai/openai-node).


Updates `openai` from 6.44.0 to 6.45.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](https://github.com/openai/openai-node/compare/v6.44.0...v6.45.0)

---
updated-dependencies:
- dependency-name: openai
  dependency-version: 6.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-versions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 integration-tests/esbuild/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/integration-tests/esbuild/package.json b/integration-tests/esbuild/package.json
index 77865df969..65259e103c 100644
--- a/integration-tests/esbuild/package.json
+++ b/integration-tests/esbuild/package.json
@@ -29,6 +29,6 @@
     "express": "4.22.2",
     "knex": "3.2.10",
     "koa": "3.2.1",
-    "openai": "6.44.0"
+    "openai": "6.45.0"
   }
 }

From 02164283bb7134486519069f16098ec23c8a3da8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 01:12:13 +0000
Subject: [PATCH 11/51] chore(deps): bump the cloud-and-messaging group across
 1 directory with 10 updates (#9127)

Bumps the cloud-and-messaging group with 10 updates in the /packages/dd-trace/test/plugins/versions directory:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-bedrock-runtime](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-bedrock-runtime) | `3.1074.0` | `3.1075.0` |
| [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb) | `3.1074.0` | `3.1075.0` |
| [@aws-sdk/client-kinesis](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-kinesis) | `3.1074.0` | `3.1075.0` |
| [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-lambda) | `3.1074.0` | `3.1075.0` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1074.0` | `3.1075.0` |
| [@aws-sdk/client-sfn](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sfn) | `3.1074.0` | `3.1075.0` |
| [@aws-sdk/client-sns](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sns) | `3.1074.0` | `3.1075.0` |
| [@aws-sdk/client-sqs](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sqs) | `3.1074.0` | `3.1075.0` |
| [azure-functions-core-tools](https://github.com/Azure/azure-functions-core-tools) | `4.12.0` | `4.12.1` |
| [durable-functions](https://github.com/Azure/azure-functions-durable-js) | `3.3.1` | `3.4.0` |



Updates `@aws-sdk/client-bedrock-runtime` from 3.1074.0 to 3.1075.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-bedrock-runtime/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1075.0/clients/client-bedrock-runtime)

Updates `@aws-sdk/client-dynamodb` from 3.1074.0 to 3.1075.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1075.0/clients/client-dynamodb)

Updates `@aws-sdk/client-kinesis` from 3.1074.0 to 3.1075.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-kinesis/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1075.0/clients/client-kinesis)

Updates `@aws-sdk/client-lambda` from 3.1074.0 to 3.1075.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1075.0/clients/client-lambda)

Updates `@aws-sdk/client-s3` from 3.1074.0 to 3.1075.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1075.0/clients/client-s3)

Updates `@aws-sdk/client-sfn` from 3.1074.0 to 3.1075.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sfn/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1075.0/clients/client-sfn)

Updates `@aws-sdk/client-sns` from 3.1074.0 to 3.1075.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sns/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1075.0/clients/client-sns)

Updates `@aws-sdk/client-sqs` from 3.1074.0 to 3.1075.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sqs/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1075.0/clients/client-sqs)

Updates `azure-functions-core-tools` from 4.12.0 to 4.12.1
- [Release notes](https://github.com/Azure/azure-functions-core-tools/releases)
- [Changelog](https://github.com/Azure/azure-functions-core-tools/blob/4.12.1/release_notes.md)
- [Commits](https://github.com/Azure/azure-functions-core-tools/compare/4.12.0...4.12.1)

Updates `durable-functions` from 3.3.1 to 3.4.0
- [Release notes](https://github.com/Azure/azure-functions-durable-js/releases)
- [Commits](https://github.com/Azure/azure-functions-durable-js/compare/v3.3.1...v3.4.0)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-bedrock-runtime"
  dependency-version: 3.1075.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-dynamodb"
  dependency-version: 3.1075.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-kinesis"
  dependency-version: 3.1075.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-lambda"
  dependency-version: 3.1075.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1075.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-sfn"
  dependency-version: 3.1075.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-sns"
  dependency-version: 3.1075.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-sqs"
  dependency-version: 3.1075.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: azure-functions-core-tools
  dependency-version: 4.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cloud-and-messaging
- dependency-name: durable-functions
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .../test/plugins/versions/package.json        | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/packages/dd-trace/test/plugins/versions/package.json b/packages/dd-trace/test/plugins/versions/package.json
index 626396cb89..c3462d6fa7 100644
--- a/packages/dd-trace/test/plugins/versions/package.json
+++ b/packages/dd-trace/test/plugins/versions/package.json
@@ -14,14 +14,14 @@
     "@apollo/subgraph": "2.14.0",
     "@aws/durable-execution-sdk-js": "2.0.0",
     "@aws/durable-execution-sdk-js-testing": "1.1.1",
-    "@aws-sdk/client-bedrock-runtime": "3.1074.0",
-    "@aws-sdk/client-dynamodb": "3.1074.0",
-    "@aws-sdk/client-kinesis": "3.1074.0",
-    "@aws-sdk/client-lambda": "3.1074.0",
-    "@aws-sdk/client-s3": "3.1074.0",
-    "@aws-sdk/client-sfn": "3.1074.0",
-    "@aws-sdk/client-sns": "3.1074.0",
-    "@aws-sdk/client-sqs": "3.1074.0",
+    "@aws-sdk/client-bedrock-runtime": "3.1075.0",
+    "@aws-sdk/client-dynamodb": "3.1075.0",
+    "@aws-sdk/client-kinesis": "3.1075.0",
+    "@aws-sdk/client-lambda": "3.1075.0",
+    "@aws-sdk/client-s3": "3.1075.0",
+    "@aws-sdk/client-sfn": "3.1075.0",
+    "@aws-sdk/client-sns": "3.1075.0",
+    "@aws-sdk/client-sqs": "3.1075.0",
     "@aws-sdk/node-http-handler": "3.374.0",
     "@aws-sdk/smithy-client": "3.374.0",
     "@azure/cosmos": "4.9.3",
@@ -100,7 +100,7 @@
     "avsc": "5.7.9",
     "aws-sdk": "2.1693.0",
     "axios": "1.16.1",
-    "azure-functions-core-tools": "4.12.0",
+    "azure-functions-core-tools": "4.12.1",
     "babel-jest": "30.4.1",
     "bluebird": "3.7.2",
     "body-parser": "2.2.2",
@@ -116,7 +116,7 @@
     "cypress": "15.16.0",
     "cypress-fail-fast": "8.1.0",
     "dd-trace-api": "1.0.1",
-    "durable-functions": "3.3.1",
+    "durable-functions": "3.4.0",
     "ejs": "5.0.2",
     "elasticsearch": "16.7.3",
     "electron": "42.1.0",

From 30e270f26cc3154cdb1a57b0892edceb69bc2053 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 01:14:24 +0000
Subject: [PATCH 12/51] chore(deps): bump the test-versions group across 1
 directory with 4 updates (#9128)

Bumps the test-versions group with 4 updates in the /packages/dd-trace/test/plugins/versions directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm), [protobufjs](https://github.com/protobufjs/protobuf.js) and [stripe](https://github.com/stripe/stripe-node).


Updates `@types/node` from 26.0.0 to 26.0.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `pnpm` from 11.8.0 to 11.9.0
- [Release notes](https://github.com/pnpm/pnpm/releases)
- [Changelog](https://github.com/pnpm/pnpm/blob/main/pnpm11/pnpm/CHANGELOG.md)
- [Commits](https://github.com/pnpm/pnpm/commits/v11.9.0/pnpm11/pnpm)

Updates `protobufjs` from 8.6.4 to 8.6.5
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/protobufjs/protobuf.js/compare/protobufjs-v8.6.4...protobufjs-v8.6.5)

Updates `stripe` from 22.2.3 to 22.3.0
- [Release notes](https://github.com/stripe/stripe-node/releases)
- [Changelog](https://github.com/stripe/stripe-node/blob/master/CHANGELOG.md)
- [Commits](https://github.com/stripe/stripe-node/compare/v22.2.3...v22.3.0)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
- dependency-name: pnpm
  dependency-version: 11.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-versions
- dependency-name: protobufjs
  dependency-version: 8.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
- dependency-name: stripe
  dependency-version: 22.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-versions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 packages/dd-trace/test/plugins/versions/package.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/dd-trace/test/plugins/versions/package.json b/packages/dd-trace/test/plugins/versions/package.json
index c3462d6fa7..e9295a0019 100644
--- a/packages/dd-trace/test/plugins/versions/package.json
+++ b/packages/dd-trace/test/plugins/versions/package.json
@@ -85,7 +85,7 @@
     "@redis/client": "5.12.1",
     "@smithy/core": "3.26.0",
     "@smithy/smithy-client": "4.14.2",
-    "@types/node": "26.0.0",
+    "@types/node": "26.0.1",
     "@vitest/coverage-istanbul": "4.1.9",
     "@vitest/coverage-v8": "4.1.9",
     "@vitest/runner": "4.1.9",
@@ -198,11 +198,11 @@
     "pino-pretty": "13.1.3",
     "playwright": "1.61.0",
     "playwright-core": "1.61.0",
-    "pnpm": "11.8.0",
+    "pnpm": "11.9.0",
     "prisma": "7.8.0",
     "promise": "8.3.0",
     "promise-js": "0.0.7",
-    "protobufjs": "8.6.4",
+    "protobufjs": "8.6.5",
     "pug": "3.0.4",
     "q": "2.0.3",
     "react": "19.2.6",
@@ -217,7 +217,7 @@
     "sharedb": "5.2.2",
     "sinon": "22.0.0",
     "sqlite3": "6.0.1",
-    "stripe": "22.2.3",
+    "stripe": "22.3.0",
     "tedious": "19.2.1",
     "tinypool": "2.1.0",
     "typescript": "6.0.3",

From 6c386caea35d4d4b6809377d65f7b4991b887145 Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Mon, 29 Jun 2026 11:59:12 +0200
Subject: [PATCH 13/51] test(test-optimization): handle 5xx retry in
 getKnownTests error test (#9110)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The request helper retries once on a 5xx with a 5–7.5 s jittered delay, but
the getKnownTests "should return an error if the request fails" test mocked a
single 500 interceptor and used real timers. The retried request had no
interceptor and its retry timer always exceeded mocha's 5 s timeout, so the
callback never fired and the test timed out. Collapse the retry delay to 0 ms
and add a second 500 interceptor so the test exercises the real retry path and
asserts both requests are consumed.
---
 .../ci-visibility/exporters/ci-visibility-exporter.spec.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-exporter.spec.js b/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-exporter.spec.js
index 307a819576..4a9cc98e1e 100644
--- a/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-exporter.spec.js
+++ b/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-exporter.spec.js
@@ -766,9 +766,16 @@ describe('CI Visibility Exporter', () => {
       })
 
       it('should return an error if the request fails', (done) => {
+        // A 5xx triggers one jittered 5–7.5 s retry in the request helper, so the endpoint is
+        // hit twice and the retry delay must collapse to 0 ms to stay under the mocha timeout.
+        const realSetTimeout = setTimeout
+        sinon.stub(global, 'setTimeout').callsFake((fn, delay, ...args) =>
+          realSetTimeout(fn, delay > 100 ? 0 : delay, ...args))
         const scope = nock(url)
           .post('/api/v2/ci/libraries/tests')
           .reply(500)
+          .post('/api/v2/ci/libraries/tests')
+          .reply(500)
         const ciVisibilityExporter = new CiVisibilityExporter({ url })
 
         ciVisibilityExporter._resolveCanUseCiVisProtocol(true)

From c6a043eff79fd6c57b42ff9af810290afa3cddc7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Antonio=20Fern=C3=A1ndez=20de=20Alba?=
 <juan.fernandezdealba@datadoghq.com>
Date: Mon, 29 Jun 2026 12:17:33 +0200
Subject: [PATCH 14/51] fix(cypress): handle missing beforeEach task result
 (#9129)

---
 integration-tests/cypress.config.js           | 28 ++++++++
 integration-tests/cypress/cypress-itr.spec.js | 69 +++++++++++++++++++
 .../cypress-reporting-instrumentation.spec.js | 48 +++++++++++++
 .../src/cypress-plugin.js                     | 10 ++-
 .../datadog-plugin-cypress/src/support.js     | 46 ++++++++++++-
 5 files changed, 198 insertions(+), 3 deletions(-)

diff --git a/integration-tests/cypress.config.js b/integration-tests/cypress.config.js
index 3f18cb567a..026718e78e 100644
--- a/integration-tests/cypress.config.js
+++ b/integration-tests/cypress.config.js
@@ -26,6 +26,34 @@ module.exports = defineConfig({
           return ddAfterSpec(...args)
         })
       }
+      if (process.env.CYPRESS_DD_BEFORE_EACH_NO_RESULT_ONCE) {
+        const ddTracePlugin = require('dd-trace/ci/cypress/plugin')
+        let ddBeforeEachCalls = 0
+
+        const wrappedOn = (event, handler) => {
+          if (event !== 'task' || !handler['dd:beforeEach']) {
+            on(event, handler)
+            return
+          }
+
+          const ddBeforeEach = handler['dd:beforeEach']
+          on('task', {
+            ...handler,
+            'dd:beforeEach': (test) => {
+              ddBeforeEachCalls++
+              // eslint-disable-next-line no-console
+              console.log(`[datadog:test] dd:beforeEach call ${ddBeforeEachCalls}`)
+              const result = ddBeforeEach(test)
+              if (ddBeforeEachCalls === 1) {
+                return null
+              }
+              return result
+            },
+          })
+        }
+
+        return ddTracePlugin(wrappedOn, config)
+      }
       if (process.env.CYPRESS_ENABLE_MANUAL_PLUGIN) {
         return require('dd-trace/ci/cypress/plugin')(on, config)
       }
diff --git a/integration-tests/cypress/cypress-itr.spec.js b/integration-tests/cypress/cypress-itr.spec.js
index 0f785106e3..926ce22486 100644
--- a/integration-tests/cypress/cypress-itr.spec.js
+++ b/integration-tests/cypress/cypress-itr.spec.js
@@ -4,6 +4,7 @@ const assert = require('node:assert/strict')
 const { exec } = require('node:child_process')
 const { once } = require('node:events')
 
+const semver = require('semver')
 const {
   sandboxCwd,
   useSandbox,
@@ -33,6 +34,7 @@ const oldestVersion = DD_MAJOR >= 6 ? '12.0.0' : '6.7.0'
 const version = requestedVersion === 'oldest' ? oldestVersion : requestedVersion
 const hookFile = 'dd-trace/loader-hook.mjs'
 const CYPRESS_RUN_HARD_TIMEOUT = 70_000
+const over12It = (version === 'latest' || semver.gte(version, '12.0.0')) ? it : it.skip
 
 function assertItrSkippingEnabledTags (events, expected) {
   const testSuite = events.find(event => event.type === 'test_suite_end').content
@@ -272,6 +274,73 @@ moduleTypes.forEach(({
         ])
       })
 
+      over12It('does not count ITR-skipped tests twice when retrying a missing dd:beforeEach result', async () => {
+        receiver.setSuitesToSkip([
+          {
+            type: 'test',
+            attributes: {
+              name: 'context passes',
+              suite: 'cypress/e2e/other.cy.js',
+            },
+          },
+          {
+            type: 'test',
+            attributes: {
+              name: 'basic pass suite can pass',
+              suite: 'cypress/e2e/basic-pass.js',
+            },
+          },
+        ])
+
+        const envVars = getCiVisAgentlessConfig(receiver.port)
+        let testOutput = ''
+
+        childProcess = exec(
+          testCommand,
+          {
+            cwd,
+            env: {
+              ...envVars,
+              CYPRESS_BASE_URL: webAppBaseUrl,
+              CYPRESS_DD_BEFORE_EACH_NO_RESULT_ONCE: '1',
+              SPEC_PATTERN: 'cypress/e2e/{basic-pass,other.cy}.js',
+            },
+          }
+        )
+        childProcess.stdout?.on('data', (data) => { testOutput += data })
+        childProcess.stderr?.on('data', (data) => { testOutput += data })
+
+        const eventsPromise = gatherCypressPayloads(receiver, childProcess, '/api/v2/citestcycle', payloads => {
+          const events = payloads.flatMap(({ payload }) => payload.events)
+          const skippedTest = events.find(event =>
+            event.content.resource === 'cypress/e2e/other.cy.js.context passes'
+          ).content
+          assert.strictEqual(skippedTest.meta[TEST_STATUS], 'skip')
+          assert.strictEqual(skippedTest.meta[TEST_SKIPPED_BY_ITR], 'true')
+
+          const skippedTestInOtherSpec = events.find(event =>
+            event.content.resource === 'cypress/e2e/basic-pass.js.basic pass suite can pass'
+          ).content
+          assert.strictEqual(skippedTestInOtherSpec.meta[TEST_STATUS], 'skip')
+          assert.strictEqual(skippedTestInOtherSpec.meta[TEST_SKIPPED_BY_ITR], 'true')
+
+          const testSession = events.find(event => event.type === 'test_session_end').content
+          assert.strictEqual(testSession.metrics[TEST_ITR_SKIPPING_COUNT], 2)
+
+          const testModule = events.find(event => event.type === 'test_module_end').content
+          assert.strictEqual(testModule.metrics[TEST_ITR_SKIPPING_COUNT], 2)
+        })
+
+        const [[exitCode]] = await Promise.all([
+          once(childProcess, 'exit'),
+          eventsPromise,
+        ])
+
+        assert.strictEqual(exitCode, 0, 'cypress process should exit successfully')
+        assert.match(testOutput, /\[datadog:test\] dd:beforeEach call 1/)
+        assert.match(testOutput, /\[datadog:test\] dd:beforeEach call 2/)
+      })
+
       it('does not skip tests if test skipping is disabled by the API', async () => {
         let hasRequestedSkippable = false
         receiver.setSettings({
diff --git a/integration-tests/cypress/cypress-reporting-instrumentation.spec.js b/integration-tests/cypress/cypress-reporting-instrumentation.spec.js
index 70cf1f6d14..37d3457f41 100644
--- a/integration-tests/cypress/cypress-reporting-instrumentation.spec.js
+++ b/integration-tests/cypress/cypress-reporting-instrumentation.spec.js
@@ -317,6 +317,54 @@ moduleTypes.forEach(({
       }
     })
 
+    over10It('retries when dd:beforeEach returns no result once', async () => {
+      const envVars = getCiVisAgentlessConfig(receiver.port)
+      let testOutput = ''
+
+      childProcess = exec(testCommand, {
+        cwd,
+        env: {
+          ...envVars,
+          CYPRESS_BASE_URL: webAppBaseUrl,
+          CYPRESS_DD_BEFORE_EACH_NO_RESULT_ONCE: '1',
+          SPEC_PATTERN: 'cypress/e2e/basic-pass.js',
+        },
+      })
+      childProcess.stdout?.on('data', (data) => { testOutput += data })
+      childProcess.stderr?.on('data', (data) => { testOutput += data })
+
+      const receiverPromise = receiver
+        .gatherPayloadsUntilChildExit(
+          childProcess,
+          ({ url }) => url.endsWith('/api/v2/citestcycle'),
+          (payloads) => {
+            const events = payloads
+              .flatMap(({ payload }) => payload.events)
+              .filter(event => event.type === 'test')
+            const passedTest = events.find(event =>
+              event.content.resource === 'cypress/e2e/basic-pass.js.basic pass suite can pass'
+            )
+
+            assertObjectContains(passedTest?.content, {
+              meta: {
+                [TEST_STATUS]: 'pass',
+                [TEST_FRAMEWORK]: 'cypress',
+              },
+            })
+          },
+          { hardTimeout: 60000 }
+        )
+
+      const [[exitCode]] = await Promise.all([
+        once(childProcess, 'exit'),
+        receiverPromise,
+      ])
+
+      assert.strictEqual(exitCode, 0, 'cypress process should exit successfully')
+      assert.match(testOutput, /\[datadog:test\] dd:beforeEach call 1/)
+      assert.match(testOutput, /\[datadog:test\] dd:beforeEach call 2/)
+    })
+
     over10It('preserves config returned from setupNodeEvents', async () => {
       const envVars = getCiVisAgentlessConfig(receiver.port)
 
diff --git a/packages/datadog-plugin-cypress/src/cypress-plugin.js b/packages/datadog-plugin-cypress/src/cypress-plugin.js
index a34f26d9a0..f0ccabdfa8 100644
--- a/packages/datadog-plugin-cypress/src/cypress-plugin.js
+++ b/packages/datadog-plugin-cypress/src/cypress-plugin.js
@@ -390,6 +390,7 @@ class CypressPlugin {
   earlyFlakeDetectionFaultyThreshold = 0
   testsToSkip = []
   skippedTests = []
+  skippedTestIds = new Set()
   skippableTestsCoverage = {}
   testSessionCoverageMap = createCoverageMap()
   hasForcedToRunSuites = false
@@ -473,6 +474,7 @@ class CypressPlugin {
     this.earlyFlakeDetectionFaultyThreshold = 0
     this.testsToSkip = []
     this.skippedTests = []
+    this.skippedTestIds = new Set()
     this.skippableTestsCoverage = {}
     this.testSessionCoverageMap = createCoverageMap()
     this.hasForcedToRunSuites = false
@@ -1386,7 +1388,7 @@ class CypressPlugin {
         return suitePayload
       },
       'dd:beforeEach': (test) => {
-        const { testName, testSuite, isEfdRetry, efdRetryIndex } = test
+        const { testId, testName, testSuite, isEfdRetry, efdRetryIndex } = test
         if (isEfdRetry && this.shouldSkipEfdRetry(testSuite, testName, efdRetryIndex)) {
           return { shouldSkip: true, shouldDiscard: true }
         }
@@ -1398,7 +1400,11 @@ class CypressPlugin {
         const { isAttemptToFix, isDisabled, isQuarantined } = this.getTestProperties(testSuite, testName)
         // skip test
         if (shouldSkip && !isUnskippable) {
-          this.skippedTests.push(test)
+          const skippedTestId = `${testSuite}:${testId || testName}`
+          if (!this.skippedTestIds.has(skippedTestId)) {
+            this.skippedTestIds.add(skippedTestId)
+            this.skippedTests.push(test)
+          }
           this.isTestsSkipped = true
           return { shouldSkip: true }
         }
diff --git a/packages/datadog-plugin-cypress/src/support.js b/packages/datadog-plugin-cypress/src/support.js
index 831f551799..765d31bb7a 100644
--- a/packages/datadog-plugin-cypress/src/support.js
+++ b/packages/datadog-plugin-cypress/src/support.js
@@ -13,6 +13,8 @@ let testManagementTests = {}
 let isImpactedTestsEnabled = false
 let isModifiedTest = false
 let isTestIsolationEnabled = false
+let hasWarnedMissingBeforeEachTaskResult = false
+let hasWarnedMissingBeforeEachRetryResult = false
 // Array of test names that have been retried and the reason
 const retryReasonsByTestName = new Map()
 // Track test errors suppressed by test management so we can still report them to Datadog.
@@ -86,6 +88,47 @@ function getTestProperties (testName) {
   return { isAttemptToFix, isDisabled, isQuarantined }
 }
 
+/**
+ * @param {string} message
+ * @returns {void}
+ */
+function warnMissingBeforeEachTaskResult (message) {
+  // eslint-disable-next-line no-console
+  console.warn(message)
+}
+
+/**
+ * @param {object} test
+ * @returns {Cypress.Chainable<{ traceId?: string, shouldSkip?: boolean, shouldDiscard?: boolean }>}
+ */
+function runBeforeEachTask (test) {
+  return cy.task('dd:beforeEach', test).then((taskResult) => {
+    if (taskResult !== undefined && taskResult !== null) {
+      return taskResult
+    }
+
+    if (!hasWarnedMissingBeforeEachTaskResult) {
+      hasWarnedMissingBeforeEachTaskResult = true
+      warnMissingBeforeEachTaskResult('Datadog Cypress dd:beforeEach task returned no result. Retrying once.')
+    }
+
+    return cy.task('dd:beforeEach', test).then((retryTaskResult) => {
+      if (retryTaskResult !== undefined && retryTaskResult !== null) {
+        return retryTaskResult
+      }
+
+      if (!hasWarnedMissingBeforeEachRetryResult) {
+        hasWarnedMissingBeforeEachRetryResult = true
+        warnMissingBeforeEachTaskResult(
+          'Datadog Cypress dd:beforeEach task returned no result after retry. Continuing with an empty task result.'
+        )
+      }
+
+      return {}
+    })
+  })
+}
+
 // Catch test failures for quarantined tests and suppress them
 // By not re-throwing the error, Cypress marks the test as passed
 // This allows quarantined tests to run but not affect the exit code
@@ -263,7 +306,8 @@ beforeEach(function () {
     originalWindow = win
   })
 
-  cy.task('dd:beforeEach', {
+  runBeforeEachTask({
+    testId: currentTest.id,
     testName,
     testSuite: Cypress.mocha.getRootSuite().file,
     isEfdRetry: Cypress.mocha.getRunner().suite.ctx.currentTest._ddIsEfdRetry,

From 2e2db4d2fe357017999a0423c5e1697165c07717 Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Mon, 29 Jun 2026 12:43:26 +0200
Subject: [PATCH 15/51] refactor(config): derive supported config paths from
 canonical names (#9112)

`internalPropertyName` made each supported config carry a second hand-maintained runtime path next to its canonical env name. Drop that alias and derive the config-object path from the canonical name, with Test Optimization entries grouped under `testOptimization` and top-level entries using their canonical key directly.

The plugin shared-config boundary still forwards the existing per-plugin keys, including the flat dynamic-instrumentation flag `CiPlugin.configure` receives; plugins do not receive the namespaced tracer config.

Drive-by fix:

* Drop duplicate benchmark `enabled` leaves left behind by the previous namespace migration.
---
 benchmark/sirun/exporting-pipeline/index.js   |   1 -
 .../sirun/llmobs-span-processor/index.js      |   1 -
 packages/datadog-plugin-cucumber/src/index.js |   2 +-
 .../src/cypress-plugin.js                     |   4 +-
 packages/datadog-plugin-jest/src/index.js     |   2 +-
 packages/datadog-plugin-mocha/src/index.js    |   2 +-
 .../datadog-plugin-openai/src/services.js     |   4 +-
 .../datadog-plugin-playwright/src/index.js    |   2 +-
 packages/datadog-plugin-vitest/src/index.js   |   2 +-
 packages/dd-trace/src/aiguard/sdk.js          |   4 +-
 .../early-flake-detection/get-known-tests.js  |   6 +-
 .../exporters/agent-proxy/index.js            |   4 +-
 .../exporters/agentless/coverage-writer.js    |   2 +-
 .../exporters/agentless/di-logs-writer.js     |   2 +-
 .../exporters/agentless/index.js              |   5 +-
 .../exporters/agentless/writer.js             |   2 +-
 .../exporters/ci-visibility-exporter.js       |  26 +--
 .../exporters/git/git_metadata.js             |   4 +-
 .../get-skippable-suites.js                   |   6 +-
 .../log-submission/log-submission-plugin.js   |   4 +-
 .../requests/get-library-configuration.js     |   8 +-
 .../requests/upload-coverage-report.js        |   6 +-
 .../get-test-management-tests.js              |   6 +-
 .../src/config/generated-config-types.d.ts    |  58 +++---
 packages/dd-trace/src/config/index.js         |  12 +-
 packages/dd-trace/src/config/remote_config.js |   2 +-
 .../src/config/supported-configurations.json  |  73 ++++----
 .../src/exporters/agentless/writer.js         |   8 +-
 packages/dd-trace/src/llmobs/index.js         |   2 +-
 packages/dd-trace/src/llmobs/writers/base.js  |   2 +-
 packages/dd-trace/src/plugin_manager.js       |  14 +-
 packages/dd-trace/src/proxy.js                |   8 +-
 packages/dd-trace/src/span_processor.js       |   4 +-
 packages/dd-trace/src/telemetry/send-data.js  |  14 +-
 packages/dd-trace/test/aiguard/index.spec.js  |   4 +-
 .../exporters/agent-proxy/agent-proxy.spec.js |  18 +-
 .../agentless/di-logs-writer.spec.js          |   2 +-
 .../exporters/agentless/exporter.spec.js      |  55 ++++--
 .../exporters/ci-visibility-exporter.spec.js  |  88 ++++++---
 .../exporters/git/git_metadata.spec.js        |   4 +-
 .../get-skippable-suites.spec.js              |   4 +-
 packages/dd-trace/test/config/index.spec.js   | 171 ++++++++++--------
 .../test/exporters/agentless/writer.spec.js   |   2 +-
 packages/dd-trace/test/llmobs/index.spec.js   |   8 +-
 .../dd-trace/test/llmobs/sdk/index.spec.js    |   6 +-
 .../dd-trace/test/llmobs/writers/base.spec.js |   2 +-
 .../test/llmobs/writers/evaluations.spec.js   |   2 +-
 .../test/llmobs/writers/multi-tenant.spec.js  |   2 +-
 packages/dd-trace/test/plugin_manager.spec.js |   5 +-
 packages/dd-trace/test/proxy.spec.js          |  15 +-
 packages/dd-trace/test/span_processor.spec.js |   2 +-
 .../dd-trace/test/telemetry/send-data.spec.js |  12 +-
 52 files changed, 407 insertions(+), 297 deletions(-)

diff --git a/benchmark/sirun/exporting-pipeline/index.js b/benchmark/sirun/exporting-pipeline/index.js
index 176365f44b..6ccb059405 100644
--- a/benchmark/sirun/exporting-pipeline/index.js
+++ b/benchmark/sirun/exporting-pipeline/index.js
@@ -42,7 +42,6 @@ const prioritySampler = new PrioritySampler()
 const config = {
   flushMinSpans: 100,
   stats: {
-    enabled: WITH_STATS,
     DD_TRACE_STATS_COMPUTATION_ENABLED: WITH_STATS,
   },
   appsec: {},
diff --git a/benchmark/sirun/llmobs-span-processor/index.js b/benchmark/sirun/llmobs-span-processor/index.js
index bdaa70b4a0..9c92d2939e 100644
--- a/benchmark/sirun/llmobs-span-processor/index.js
+++ b/benchmark/sirun/llmobs-span-processor/index.js
@@ -34,7 +34,6 @@ const OPERATIONS = Number(process.env.OPERATIONS)
 // per-span LLMObs hot path, uncovered by the existing llmobs writer bench.
 const processor = new LLMObsSpanProcessor({
   llmobs: {
-    enabled: true,
     DD_LLMOBS_ENABLED: true,
   },
   version: '1.0.0',
diff --git a/packages/datadog-plugin-cucumber/src/index.js b/packages/datadog-plugin-cucumber/src/index.js
index df01de2da0..4cbef7a43f 100644
--- a/packages/datadog-plugin-cucumber/src/index.js
+++ b/packages/datadog-plugin-cucumber/src/index.js
@@ -130,7 +130,7 @@ class CucumberPlugin extends CiPlugin {
       finishAllTraceSpans(this.testSessionSpan)
       this.telemetry.count(TELEMETRY_TEST_SESSION, {
         provider: this.ciProviderName,
-        autoInjected: !!this._tracerConfig.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
+        autoInjected: !!this._tracerConfig.testOptimization.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
       })
 
       this.libraryConfig = null
diff --git a/packages/datadog-plugin-cypress/src/cypress-plugin.js b/packages/datadog-plugin-cypress/src/cypress-plugin.js
index f0ccabdfa8..f0c2357b4d 100644
--- a/packages/datadog-plugin-cypress/src/cypress-plugin.js
+++ b/packages/datadog-plugin-cypress/src/cypress-plugin.js
@@ -639,7 +639,7 @@ class CypressPlugin {
 
     this.isTestIsolationEnabled = getIsTestIsolationEnabled(cypressConfig)
 
-    this.rumFlushWaitMillis = getConfig().DD_CIVISIBILITY_RUM_FLUSH_WAIT_MILLIS
+    this.rumFlushWaitMillis = getConfig().testOptimization.DD_CIVISIBILITY_RUM_FLUSH_WAIT_MILLIS
 
     if (!this.isTestIsolationEnabled) {
       log.warn('Test isolation is disabled, retries will not be enabled')
@@ -1150,7 +1150,7 @@ class CypressPlugin {
       this.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'session')
       incrementCountMetric(TELEMETRY_TEST_SESSION, {
         provider: this.ciProviderName,
-        autoInjected: !!getConfig().DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
+        autoInjected: !!getConfig().testOptimization.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
       })
 
       finishAllTraceSpans(this.testSessionSpan)
diff --git a/packages/datadog-plugin-jest/src/index.js b/packages/datadog-plugin-jest/src/index.js
index 76e998defa..7841517716 100644
--- a/packages/datadog-plugin-jest/src/index.js
+++ b/packages/datadog-plugin-jest/src/index.js
@@ -177,7 +177,7 @@ class JestPlugin extends CiPlugin {
 
         this.telemetry.count(TELEMETRY_TEST_SESSION, {
           provider: this.ciProviderName,
-          autoInjected: !!this._tracerConfig.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
+          autoInjected: !!this._tracerConfig.testOptimization.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
         })
 
         appClosingTelemetry()
diff --git a/packages/datadog-plugin-mocha/src/index.js b/packages/datadog-plugin-mocha/src/index.js
index e9a6a049b8..f2f3d6abee 100644
--- a/packages/datadog-plugin-mocha/src/index.js
+++ b/packages/datadog-plugin-mocha/src/index.js
@@ -427,7 +427,7 @@ class MochaPlugin extends CiPlugin {
         finishAllTraceSpans(this.testSessionSpan)
         this.telemetry.count(TELEMETRY_TEST_SESSION, {
           provider: this.ciProviderName,
-          autoInjected: !!this._tracerConfig.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
+          autoInjected: !!this._tracerConfig.testOptimization.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
         })
       }
       this.libraryConfig = null
diff --git a/packages/datadog-plugin-openai/src/services.js b/packages/datadog-plugin-openai/src/services.js
index 93c4363ed4..67c5db5f0a 100644
--- a/packages/datadog-plugin-openai/src/services.js
+++ b/packages/datadog-plugin-openai/src/services.js
@@ -24,12 +24,12 @@ module.exports.init = function (tracerConfig) {
     })
     : new NoopDogStatsDClient()
 
-  logger = tracerConfig && tracerConfig.apiKey
+  logger = tracerConfig && tracerConfig.DD_API_KEY
     ? new ExternalLogger({
       ddsource: 'openai',
       hostname: tracerConfig.hostname,
       service: tracerConfig.service,
-      apiKey: tracerConfig.apiKey,
+      apiKey: tracerConfig.DD_API_KEY,
       interval: FLUSH_INTERVAL,
     })
     : new NoopExternalLogger()
diff --git a/packages/datadog-plugin-playwright/src/index.js b/packages/datadog-plugin-playwright/src/index.js
index a75e7ee26d..c84d0b2b22 100644
--- a/packages/datadog-plugin-playwright/src/index.js
+++ b/packages/datadog-plugin-playwright/src/index.js
@@ -108,7 +108,7 @@ class PlaywrightPlugin extends CiPlugin {
       finishAllTraceSpans(this.testSessionSpan)
       this.telemetry.count(TELEMETRY_TEST_SESSION, {
         provider: this.ciProviderName,
-        autoInjected: !!this._tracerConfig.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
+        autoInjected: !!this._tracerConfig.testOptimization.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
       })
       appClosingTelemetry()
       this.tracer._exporter.flush(onDone)
diff --git a/packages/datadog-plugin-vitest/src/index.js b/packages/datadog-plugin-vitest/src/index.js
index f88478368e..261be0771b 100644
--- a/packages/datadog-plugin-vitest/src/index.js
+++ b/packages/datadog-plugin-vitest/src/index.js
@@ -443,7 +443,7 @@ class VitestPlugin extends CiPlugin {
       finishAllTraceSpans(this.testSessionSpan)
       this.telemetry.count(TELEMETRY_TEST_SESSION, {
         provider: this.ciProviderName,
-        autoInjected: !!this._tracerConfig.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
+        autoInjected: !!this._tracerConfig.testOptimization.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
       })
       this.tracer._exporter.flush(onFinish)
     })
diff --git a/packages/dd-trace/src/aiguard/sdk.js b/packages/dd-trace/src/aiguard/sdk.js
index b9c87c2b19..952bcb3db7 100644
--- a/packages/dd-trace/src/aiguard/sdk.js
+++ b/packages/dd-trace/src/aiguard/sdk.js
@@ -93,14 +93,14 @@ class AIGuard extends NoopAIGuard {
   constructor (tracer, config) {
     super()
 
-    if (!config.apiKey || !config.DD_APP_KEY) {
+    if (!config.DD_API_KEY || !config.DD_APP_KEY) {
       log.error('AIGuard: missing api and/or app keys, use env DD_API_KEY and DD_APP_KEY')
       this.#initialized = false
       return
     }
     this.#tracer = tracer
     this.#headers = {
-      'DD-API-KEY': config.apiKey,
+      'DD-API-KEY': config.DD_API_KEY,
       'DD-APPLICATION-KEY': config.DD_APP_KEY,
       'DD-AI-GUARD-VERSION': tracerVersion,
       'DD-AI-GUARD-SOURCE': 'SDK',
diff --git a/packages/dd-trace/src/ci-visibility/early-flake-detection/get-known-tests.js b/packages/dd-trace/src/ci-visibility/early-flake-detection/get-known-tests.js
index 968a5c5244..13c789c10f 100644
--- a/packages/dd-trace/src/ci-visibility/early-flake-detection/get-known-tests.js
+++ b/packages/dd-trace/src/ci-visibility/early-flake-detection/get-known-tests.js
@@ -151,12 +151,12 @@ function fetchFromApi ({
     options.path = `${evpProxyPrefix}/api/v2/ci/libraries/tests`
     options.headers['X-Datadog-EVP-Subdomain'] = 'api'
   } else {
-    const { apiKey } = getConfig()
-    if (!apiKey) {
+    const { DD_API_KEY } = getConfig()
+    if (!DD_API_KEY) {
       return done(new Error('Known tests were not fetched because Datadog API key is not defined.'))
     }
 
-    options.headers['dd-api-key'] = apiKey
+    options.headers['dd-api-key'] = DD_API_KEY
   }
 
   const configurations = {
diff --git a/packages/dd-trace/src/ci-visibility/exporters/agent-proxy/index.js b/packages/dd-trace/src/ci-visibility/exporters/agent-proxy/index.js
index 1ab05936d6..6ce6e1ecb8 100644
--- a/packages/dd-trace/src/ci-visibility/exporters/agent-proxy/index.js
+++ b/packages/dd-trace/src/ci-visibility/exporters/agent-proxy/index.js
@@ -40,7 +40,7 @@ class AgentProxyCiVisibilityExporter extends CiVisibilityExporter {
       lookup,
       protocolVersion,
       headers,
-      isTestDynamicInstrumentationEnabled,
+      testOptimization,
     } = config
 
     fetchAgentInfo(this._url, (err, agentInfo) => {
@@ -68,7 +68,7 @@ class AgentProxyCiVisibilityExporter extends CiVisibilityExporter {
           evpProxyPrefix,
         })
         this._codeCoverageReportUrl = this._url
-        if (isTestDynamicInstrumentationEnabled) {
+        if (testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED) {
           const canFowardLogs = getCanForwardDebuggerLogs(err, agentInfo)
           if (canFowardLogs) {
             const DynamicInstrumentationLogsWriter = require('../agentless/di-logs-writer')
diff --git a/packages/dd-trace/src/ci-visibility/exporters/agentless/coverage-writer.js b/packages/dd-trace/src/ci-visibility/exporters/agentless/coverage-writer.js
index c43f260436..782b7640bd 100644
--- a/packages/dd-trace/src/ci-visibility/exporters/agentless/coverage-writer.js
+++ b/packages/dd-trace/src/ci-visibility/exporters/agentless/coverage-writer.js
@@ -29,7 +29,7 @@ class Writer extends BaseWriter {
       path: '/api/v2/citestcov',
       method: 'POST',
       headers: {
-        'dd-api-key': getConfig().apiKey,
+        'dd-api-key': getConfig().DD_API_KEY,
         ...form.getHeaders(),
       },
       timeout: 15_000,
diff --git a/packages/dd-trace/src/ci-visibility/exporters/agentless/di-logs-writer.js b/packages/dd-trace/src/ci-visibility/exporters/agentless/di-logs-writer.js
index 2b797f2704..c92da84a30 100644
--- a/packages/dd-trace/src/ci-visibility/exporters/agentless/di-logs-writer.js
+++ b/packages/dd-trace/src/ci-visibility/exporters/agentless/di-logs-writer.js
@@ -26,7 +26,7 @@ class DynamicInstrumentationLogsWriter extends BaseWriter {
       path: '/api/v2/logs',
       method: 'POST',
       headers: {
-        'dd-api-key': getConfig().apiKey,
+        'dd-api-key': getConfig().DD_API_KEY,
         'Content-Type': 'application/json',
       },
       timeout: this.timeout,
diff --git a/packages/dd-trace/src/ci-visibility/exporters/agentless/index.js b/packages/dd-trace/src/ci-visibility/exporters/agentless/index.js
index 74d5d8bbd3..b25d5b5707 100644
--- a/packages/dd-trace/src/ci-visibility/exporters/agentless/index.js
+++ b/packages/dd-trace/src/ci-visibility/exporters/agentless/index.js
@@ -9,7 +9,8 @@ const CoverageWriter = require('./coverage-writer')
 class AgentlessCiVisibilityExporter extends CiVisibilityExporter {
   constructor (config) {
     super(config)
-    const { tags, site, DD_CIVISIBILITY_AGENTLESS_URL: url, isTestDynamicInstrumentationEnabled } = config
+    const { tags, site, testOptimization } = config
+    const { DD_CIVISIBILITY_AGENTLESS_URL: url } = testOptimization
     // we don't need to request /info because we are using agentless by configuration
     this._isInitialized = true
     this._resolveCanUseCiVisProtocol(true)
@@ -23,7 +24,7 @@ class AgentlessCiVisibilityExporter extends CiVisibilityExporter {
 
     this._codeCoverageReportUrl = url || new URL(`https://ci-intake.${site}`)
 
-    if (isTestDynamicInstrumentationEnabled) {
+    if (testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED) {
       const DynamicInstrumentationLogsWriter = require('./di-logs-writer')
       this._logsUrl = url || new URL(`https://http-intake.logs.${site}`)
       this._logsWriter = new DynamicInstrumentationLogsWriter({ url: this._logsUrl, tags })
diff --git a/packages/dd-trace/src/ci-visibility/exporters/agentless/writer.js b/packages/dd-trace/src/ci-visibility/exporters/agentless/writer.js
index c092e1f1a1..2fad9a633a 100644
--- a/packages/dd-trace/src/ci-visibility/exporters/agentless/writer.js
+++ b/packages/dd-trace/src/ci-visibility/exporters/agentless/writer.js
@@ -30,7 +30,7 @@ class Writer extends BaseWriter {
       path: '/api/v2/citestcycle',
       method: 'POST',
       headers: {
-        'dd-api-key': getConfig().apiKey,
+        'dd-api-key': getConfig().DD_API_KEY,
         'Content-Type': 'application/msgpack',
       },
       timeout: 15_000,
diff --git a/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js b/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js
index e92e20890e..885d58850d 100644
--- a/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js
+++ b/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js
@@ -86,7 +86,7 @@ class CiVisibilityExporter extends BufferingExporter {
   }
 
   shouldRequestSkippableSuites () {
-    return !!(this._config.isIntelligentTestRunnerEnabled &&
+    return !!(this._config.testOptimization.DD_CIVISIBILITY_ITR_ENABLED &&
       this._canUseCiVisProtocol &&
       this._libraryConfig?.isSuitesSkippingEnabled)
   }
@@ -101,7 +101,7 @@ class CiVisibilityExporter extends BufferingExporter {
   shouldRequestTestManagementTests () {
     return !!(
       this._canUseCiVisProtocol &&
-      this._config.isTestManagementEnabled &&
+      this._config.testOptimization.DD_TEST_MANAGEMENT_ENABLED &&
       this._libraryConfig?.isTestManagementEnabled
     )
   }
@@ -218,29 +218,32 @@ class CiVisibilityExporter extends BufferingExporter {
       isImpactedTestsEnabled,
       isCoverageReportUploadEnabled,
     } = remoteConfiguration
+    const { testOptimization } = this._config
     return {
       isCodeCoverageEnabled,
       isSuitesSkippingEnabled,
       isItrEnabled,
       requireGit,
-      isEarlyFlakeDetectionEnabled: isEarlyFlakeDetectionEnabled && this._config.isEarlyFlakeDetectionEnabled,
+      isEarlyFlakeDetectionEnabled:
+        isEarlyFlakeDetectionEnabled && testOptimization.DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED,
       earlyFlakeDetectionNumRetries,
       earlyFlakeDetectionSlowTestRetries,
       earlyFlakeDetectionFaultyThreshold,
-      isFlakyTestRetriesEnabled: isFlakyTestRetriesEnabled && this._config.isFlakyTestRetriesEnabled,
-      flakyTestRetriesCount: this._config.flakyTestRetriesCount,
-      isDiEnabled: isDiEnabled && this._config.isTestDynamicInstrumentationEnabled,
+      isFlakyTestRetriesEnabled: isFlakyTestRetriesEnabled && testOptimization.DD_CIVISIBILITY_FLAKY_RETRY_ENABLED,
+      flakyTestRetriesCount: testOptimization.DD_CIVISIBILITY_FLAKY_RETRY_COUNT,
+      isDiEnabled: isDiEnabled && testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED,
       isKnownTestsEnabled,
-      isTestManagementEnabled: isTestManagementEnabled && this._config.isTestManagementEnabled,
+      isTestManagementEnabled: isTestManagementEnabled && testOptimization.DD_TEST_MANAGEMENT_ENABLED,
       testManagementAttemptToFixRetries:
-        testManagementAttemptToFixRetries ?? this._config.testManagementAttemptToFixRetries,
-      isImpactedTestsEnabled: isImpactedTestsEnabled && this._config.isImpactedTestsEnabled,
+        testManagementAttemptToFixRetries ?? testOptimization.DD_TEST_MANAGEMENT_ATTEMPT_TO_FIX_RETRIES,
+      isImpactedTestsEnabled:
+        isImpactedTestsEnabled && testOptimization.DD_CIVISIBILITY_IMPACTED_TESTS_DETECTION_ENABLED,
       isCoverageReportUploadEnabled,
     }
   }
 
   sendGitMetadata (repositoryUrl) {
-    if (!this._config.isGitUploadEnabled) {
+    if (!this._config.testOptimization.DD_CIVISIBILITY_GIT_UPLOAD_ENABLED) {
       return
     }
     this._canUseCiVisProtocolPromise.then((canUseCiVisProtocol) => {
@@ -318,7 +321,8 @@ class CiVisibilityExporter extends BufferingExporter {
   // DI logs
   exportDiLogs (testEnvironmentMetadata, logMessage) {
     // TODO: could we lose logs if it's not initialized?
-    if (!this._config.isTestDynamicInstrumentationEnabled || !this._isInitialized || !this._canForwardLogs) {
+    if (!this._config.testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED ||
+      !this._isInitialized || !this._canForwardLogs) {
       return
     }
 
diff --git a/packages/dd-trace/src/ci-visibility/exporters/git/git_metadata.js b/packages/dd-trace/src/ci-visibility/exporters/git/git_metadata.js
index f8feb908a2..4fcde1070d 100644
--- a/packages/dd-trace/src/ci-visibility/exporters/git/git_metadata.js
+++ b/packages/dd-trace/src/ci-visibility/exporters/git/git_metadata.js
@@ -50,7 +50,7 @@ function getCommonRequestOptions (url) {
   return {
     method: 'POST',
     headers: {
-      'dd-api-key': getConfig().apiKey,
+      'dd-api-key': getConfig().DD_API_KEY,
     },
     timeout: 15_000,
     url,
@@ -287,7 +287,7 @@ function sendGitMetadata (url, { isEvpProxy, evpProxyPrefix }, configRepositoryU
     }
     // Otherwise we unshallow and get commits to upload again
     log.debug('It is shallow clone, unshallowing...')
-    if (getConfig().DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED) {
+    if (getConfig().testOptimization.DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED) {
       unshallowRepository(false)
     }
 
diff --git a/packages/dd-trace/src/ci-visibility/intelligent-test-runner/get-skippable-suites.js b/packages/dd-trace/src/ci-visibility/intelligent-test-runner/get-skippable-suites.js
index 011f9a92f8..31498824eb 100644
--- a/packages/dd-trace/src/ci-visibility/intelligent-test-runner/get-skippable-suites.js
+++ b/packages/dd-trace/src/ci-visibility/intelligent-test-runner/get-skippable-suites.js
@@ -124,12 +124,12 @@ function fetchFromApi ({
     options.path = `${evpProxyPrefix}/api/v2/ci/tests/skippable`
     options.headers['X-Datadog-EVP-Subdomain'] = 'api'
   } else {
-    const { apiKey } = getConfig()
-    if (!apiKey) {
+    const { DD_API_KEY } = getConfig()
+    if (!DD_API_KEY) {
       return done(new Error('Skippable suites were not fetched because Datadog API key is not defined.'))
     }
 
-    options.headers['dd-api-key'] = apiKey
+    options.headers['dd-api-key'] = DD_API_KEY
   }
 
   const data = JSON.stringify({
diff --git a/packages/dd-trace/src/ci-visibility/log-submission/log-submission-plugin.js b/packages/dd-trace/src/ci-visibility/log-submission/log-submission-plugin.js
index 852fcf4127..86695d0ebb 100644
--- a/packages/dd-trace/src/ci-visibility/log-submission/log-submission-plugin.js
+++ b/packages/dd-trace/src/ci-visibility/log-submission/log-submission-plugin.js
@@ -4,14 +4,14 @@ const Plugin = require('../../plugins/plugin')
 const log = require('../../log')
 
 function getWinstonLogSubmissionParameters (config) {
-  const { site, service, apiKey, DD_AGENTLESS_LOG_SUBMISSION_URL } = config
+  const { site, service, DD_API_KEY, DD_AGENTLESS_LOG_SUBMISSION_URL } = config
 
   const defaultParameters = {
     host: `http-intake.logs.${site}`,
     path: `/api/v2/logs?ddsource=winston&service=${service}`,
     ssl: true,
     headers: {
-      'DD-API-KEY': apiKey,
+      'DD-API-KEY': DD_API_KEY,
     },
   }
 
diff --git a/packages/dd-trace/src/ci-visibility/requests/get-library-configuration.js b/packages/dd-trace/src/ci-visibility/requests/get-library-configuration.js
index 816a61d83e..1a054da02c 100644
--- a/packages/dd-trace/src/ci-visibility/requests/get-library-configuration.js
+++ b/packages/dd-trace/src/ci-visibility/requests/get-library-configuration.js
@@ -51,10 +51,10 @@ function getLibraryConfiguration ({
     options.path = `${evpProxyPrefix}/api/v2/libraries/tests/services/setting`
     options.headers['X-Datadog-EVP-Subdomain'] = 'api'
   } else {
-    if (!config.apiKey) {
+    if (!config.DD_API_KEY) {
       return done(new Error('Request to settings endpoint was not done because Datadog API key is not defined.'))
     }
-    options.headers['dd-api-key'] = config.apiKey
+    options.headers['dd-api-key'] = config.DD_API_KEY
   }
 
   const data = JSON.stringify({
@@ -132,11 +132,11 @@ function getLibraryConfiguration ({
 
         log.debug('Remote settings: %j', settings)
 
-        if (config.DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE) {
+        if (config.testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE) {
           settings.isCodeCoverageEnabled = true
           log.debug('Dangerously set code coverage to true')
         }
-        if (config.DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING) {
+        if (config.testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING) {
           settings.isSuitesSkippingEnabled = true
           log.debug('Dangerously set test skipping to true')
         }
diff --git a/packages/dd-trace/src/ci-visibility/requests/upload-coverage-report.js b/packages/dd-trace/src/ci-visibility/requests/upload-coverage-report.js
index b7d16c1af7..8b598fd6da 100644
--- a/packages/dd-trace/src/ci-visibility/requests/upload-coverage-report.js
+++ b/packages/dd-trace/src/ci-visibility/requests/upload-coverage-report.js
@@ -34,9 +34,9 @@ function uploadCoverageReport (
   { filePath, format, testEnvironmentMetadata, url, isEvpProxy, evpProxyPrefix },
   callback
 ) {
-  const apiKey = getConfig().apiKey
+  const { DD_API_KEY } = getConfig()
 
-  if (!apiKey && !isEvpProxy) {
+  if (!DD_API_KEY && !isEvpProxy) {
     return callback(new Error('DD_API_KEY is required for coverage report upload'))
   }
 
@@ -82,7 +82,7 @@ function uploadCoverageReport (
     options.headers['X-Datadog-EVP-Subdomain'] = 'ci-intake'
   } else {
     options.path = '/api/v2/cicovreprt'
-    options.headers['dd-api-key'] = apiKey
+    options.headers['dd-api-key'] = DD_API_KEY
   }
 
   log.debug('Uploading coverage report %s to %s%s', filePath, url, options.path)
diff --git a/packages/dd-trace/src/ci-visibility/test-management/get-test-management-tests.js b/packages/dd-trace/src/ci-visibility/test-management/get-test-management-tests.js
index 7191c2f058..e4b2b927fe 100644
--- a/packages/dd-trace/src/ci-visibility/test-management/get-test-management-tests.js
+++ b/packages/dd-trace/src/ci-visibility/test-management/get-test-management-tests.js
@@ -121,12 +121,12 @@ function fetchFromApi ({
     options.path = `${evpProxyPrefix}/api/v2/test/libraries/test-management/tests`
     options.headers['X-Datadog-EVP-Subdomain'] = 'api'
   } else {
-    const { apiKey } = getConfig()
-    if (!apiKey) {
+    const { DD_API_KEY } = getConfig()
+    if (!DD_API_KEY) {
       return done(new Error('Test management tests were not fetched because Datadog API key is not defined.'))
     }
 
-    options.headers['dd-api-key'] = apiKey
+    options.headers['dd-api-key'] = DD_API_KEY
   }
 
   const data = JSON.stringify({
diff --git a/packages/dd-trace/src/config/generated-config-types.d.ts b/packages/dd-trace/src/config/generated-config-types.d.ts
index 7f8747b5bb..fab4329069 100644
--- a/packages/dd-trace/src/config/generated-config-types.d.ts
+++ b/packages/dd-trace/src/config/generated-config-types.d.ts
@@ -3,7 +3,6 @@
 
 export interface GeneratedConfig {
   _DD_APM_TRACING_AGENTLESS_ENABLED: boolean;
-  apiKey: string | undefined;
   apmTracingEnabled: boolean;
   appsec: {
     blockedTemplateGraphql: string | undefined;
@@ -66,21 +65,10 @@ export interface GeneratedConfig {
   DD_ACTION_EXECUTION_ID: string | undefined;
   DD_AGENTLESS_LOG_SUBMISSION_ENABLED: boolean;
   DD_AGENTLESS_LOG_SUBMISSION_URL: string | undefined;
+  DD_API_KEY: string | undefined;
   DD_APM_FLUSH_DEADLINE_MILLISECONDS: number;
   DD_APP_KEY: string | undefined;
   DD_AZURE_RESOURCE_GROUP: string | undefined;
-  DD_CIVISIBILITY_AGENTLESS_ENABLED: boolean;
-  DD_CIVISIBILITY_AGENTLESS_URL: URL | undefined;
-  DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER: string | undefined;
-  DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE: boolean;
-  DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING: boolean;
-  DD_CIVISIBILITY_ENABLED: boolean;
-  DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED: boolean;
-  DD_CIVISIBILITY_MANUAL_API_ENABLED: boolean;
-  DD_CIVISIBILITY_RUM_FLUSH_WAIT_MILLIS: number;
-  DD_CIVISIBILITY_TEST_COMMAND: string | undefined;
-  DD_CIVISIBILITY_TEST_MODULE_ID: string | undefined;
-  DD_CIVISIBILITY_TEST_SESSION_ID: string | undefined;
   DD_CRASHTRACKING_ENABLED: boolean;
   DD_CUSTOM_PARENT_ID: string | undefined;
   DD_CUSTOM_TRACE_ID: string | undefined;
@@ -158,8 +146,6 @@ export interface GeneratedConfig {
   DD_RUNTIME_METRICS_FLUSH_INTERVAL: number;
   DD_SPAN_SAMPLING_RULES_FILE: string | undefined;
   DD_TELEMETRY_FORWARDER_PATH: string | undefined;
-  DD_TEST_FLEET_CONFIG_PATH: string | undefined;
-  DD_TEST_LOCAL_CONFIG_PATH: string | undefined;
   DD_TEST_SESSION_NAME: string | undefined;
   DD_TRACE_AEROSPIKE_ENABLED: boolean;
   DD_TRACE_AI_ENABLED: boolean;
@@ -245,6 +231,7 @@ export interface GeneratedConfig {
   DD_TRACE_ELASTIC_TRANSPORT_ENABLED: boolean;
   DD_TRACE_ELASTICSEARCH_ENABLED: boolean;
   DD_TRACE_ELECTRON_ENABLED: boolean;
+  DD_TRACE_ENABLED: boolean;
   DD_TRACE_ENCODING_DEBUG: boolean;
   DD_TRACE_EXPERIMENTAL_RUNTIME_ID_ENABLED: boolean;
   DD_TRACE_EXPERIMENTAL_SPAN_COUNTS: boolean;
@@ -338,6 +325,7 @@ export interface GeneratedConfig {
   DD_TRACE_NODE_REDIS_CLIENT_ENABLED: boolean;
   DD_TRACE_NODE_SERIALIZE_ENABLED: boolean;
   DD_TRACE_NYC_ENABLED: boolean;
+  DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP: string;
   DD_TRACE_OPENAI_ENABLED: boolean;
   DD_TRACE_OPENSEARCH_ENABLED: boolean;
   DD_TRACE_OPENSEARCH_PROJECT_OPENSEARCH_ENABLED: boolean;
@@ -372,9 +360,11 @@ export interface GeneratedConfig {
   DD_TRACE_REDIS_CLIENT_ENABLED: boolean;
   DD_TRACE_REDIS_ENABLED: boolean;
   DD_TRACE_REQUEST_ENABLED: boolean;
+  DD_TRACE_RESOURCE_RENAMING_ENABLED: boolean;
   DD_TRACE_RESTIFY_ENABLED: boolean;
   DD_TRACE_RHEA_ENABLED: boolean;
   DD_TRACE_ROUTER_ENABLED: boolean;
+  DD_TRACE_SCOPE: string | undefined;
   DD_TRACE_SELENIUM_ENABLED: boolean;
   DD_TRACE_SELENIUM_WEBDRIVER_ENABLED: boolean;
   DD_TRACE_SEQUELIZE_ENABLED: boolean;
@@ -435,7 +425,6 @@ export interface GeneratedConfig {
       };
     };
   };
-  flakyTestRetriesCount: number;
   flushInterval: number;
   flushMinSpans: number;
   headerTags: string[];
@@ -457,13 +446,6 @@ export interface GeneratedConfig {
     telemetryVerbosity: string;
   };
   inferredProxyServicesEnabled: boolean;
-  isEarlyFlakeDetectionEnabled: boolean;
-  isFlakyTestRetriesEnabled: boolean;
-  isGitUploadEnabled: boolean;
-  isImpactedTestsEnabled: boolean;
-  isIntelligentTestRunnerEnabled: boolean;
-  isTestDynamicInstrumentationEnabled: boolean;
-  isTestManagementEnabled: boolean;
   langchain: {
     DD_LANGCHAIN_SPAN_CHAR_LIMIT: number;
     DD_LANGCHAIN_SPAN_PROMPT_COMPLETION_SAMPLE_RATE: number;
@@ -517,14 +499,12 @@ export interface GeneratedConfig {
     DD_PROFILING_ENABLED: 'true' | 'false' | 'auto';
   };
   protocolVersion: string;
-  queryStringObfuscation: string;
   rateLimit: number;
   remoteConfig: {
     DD_REMOTE_CONFIGURATION_ENABLED: boolean;
     pollInterval: number;
   };
   reportHostname: boolean;
-  resourceRenamingEnabled: boolean;
   runtimeMetrics: {
     enabled: boolean;
     eventLoop: boolean;
@@ -534,7 +514,6 @@ export interface GeneratedConfig {
   runtimeMetricsRuntimeId: boolean;
   sampleRate: number | undefined;
   samplingRules: import('../../../../index').SamplingRule[];
-  scope: string | undefined;
   service: string;
   serviceMapping: Record<string, string>;
   site: string;
@@ -556,7 +535,31 @@ export interface GeneratedConfig {
     DD_TELEMETRY_LOG_COLLECTION_ENABLED: boolean;
     DD_TELEMETRY_METRICS_ENABLED: boolean;
   };
-  testManagementAttemptToFixRetries: number;
+  testOptimization: {
+    DD_CIVISIBILITY_AGENTLESS_ENABLED: boolean;
+    DD_CIVISIBILITY_AGENTLESS_URL: URL | undefined;
+    DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER: string | undefined;
+    DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE: boolean;
+    DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING: boolean;
+    DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED: boolean;
+    DD_CIVISIBILITY_ENABLED: boolean;
+    DD_CIVISIBILITY_FLAKY_RETRY_COUNT: number;
+    DD_CIVISIBILITY_FLAKY_RETRY_ENABLED: boolean;
+    DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED: boolean;
+    DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: boolean;
+    DD_CIVISIBILITY_IMPACTED_TESTS_DETECTION_ENABLED: boolean;
+    DD_CIVISIBILITY_ITR_ENABLED: boolean;
+    DD_CIVISIBILITY_MANUAL_API_ENABLED: boolean;
+    DD_CIVISIBILITY_RUM_FLUSH_WAIT_MILLIS: number;
+    DD_CIVISIBILITY_TEST_COMMAND: string | undefined;
+    DD_CIVISIBILITY_TEST_MODULE_ID: string | undefined;
+    DD_CIVISIBILITY_TEST_SESSION_ID: string | undefined;
+    DD_TEST_FAILED_TEST_REPLAY_ENABLED: boolean;
+    DD_TEST_FLEET_CONFIG_PATH: string | undefined;
+    DD_TEST_LOCAL_CONFIG_PATH: string | undefined;
+    DD_TEST_MANAGEMENT_ATTEMPT_TO_FIX_RETRIES: number;
+    DD_TEST_MANAGEMENT_ENABLED: boolean;
+  };
   traceId128BitGenerationEnabled: boolean;
   traceId128BitLoggingEnabled: boolean;
   tracePropagationStyle: {
@@ -566,7 +569,6 @@ export interface GeneratedConfig {
   traceWebsocketMessagesEnabled: boolean;
   traceWebsocketMessagesInheritSampling: boolean;
   traceWebsocketMessagesSeparateTraces: boolean;
-  tracing: boolean;
   url: string | URL;
   version: string | undefined;
   vertexai: {
diff --git a/packages/dd-trace/src/config/index.js b/packages/dd-trace/src/config/index.js
index 495da5ea06..c15862bbea 100644
--- a/packages/dd-trace/src/config/index.js
+++ b/packages/dd-trace/src/config/index.js
@@ -245,12 +245,12 @@ class Config extends ConfigBase {
       let entry = optionsTable[fullName]
       if (!entry) {
         // TODO: Fix this by by changing remote config to use env styles.
-        if (name !== 'tracing' || source !== 'remote_config') {
+        if (name !== 'DD_TRACE_ENABLED' || source !== 'remote_config') {
           log.warn('Unknown option %s with value %o', fullName, value)
           continue
         }
         // @ts-expect-error - The entry is defined in the configurationsTable.
-        entry = configurationsTable.tracing
+        entry = configurationsTable.DD_TRACE_ENABLED
       }
 
       if (entry.nestedProperties) {
@@ -286,7 +286,7 @@ class Config extends ConfigBase {
       }
       // TODO: Coerce mismatched types to the expected type, if possible. E.g., strings <> numbers
       const transformed = value !== undefined && entry.transformer ? entry.transformer(value, fullName, source) : value
-      setAndTrack(this, entry.property, transformed, value, source)
+      setAndTrack(this, entry.property ?? name, transformed, value, source)
     }
   }
 
@@ -370,10 +370,10 @@ class Config extends ConfigBase {
         Math.floor(this.telemetry.DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL * 1000))
     }
 
-    // Enable resourceRenamingEnabled when appsec is enabled and only
+    // Enable resource renaming when appsec is enabled and only
     // if DD_TRACE_RESOURCE_RENAMING_ENABLED is not explicitly set
-    if (!trackedConfigOrigins.has('resourceRenamingEnabled')) {
-      setAndTrack(this, 'resourceRenamingEnabled', this.appsec.enabled ?? false)
+    if (!trackedConfigOrigins.has('DD_TRACE_RESOURCE_RENAMING_ENABLED')) {
+      setAndTrack(this, 'DD_TRACE_RESOURCE_RENAMING_ENABLED', this.appsec.enabled ?? false)
     }
 
     if (!trackedConfigOrigins.has('spanComputePeerService') && this.spanAttributeSchema !== 'v0') {
diff --git a/packages/dd-trace/src/config/remote_config.js b/packages/dd-trace/src/config/remote_config.js
index f981dd37fe..a95ca899a7 100644
--- a/packages/dd-trace/src/config/remote_config.js
+++ b/packages/dd-trace/src/config/remote_config.js
@@ -228,7 +228,7 @@ const optionLookupTable = {
   code_origin_enabled: 'codeOriginForSpans.enabled',
   tracing_sampling_rate: 'sampleRate',
   log_injection_enabled: 'logInjection',
-  tracing_enabled: 'tracing',
+  tracing_enabled: 'DD_TRACE_ENABLED',
   tracing_sampling_rules: 'samplingRules',
   tracing_header_tags: 'headerTags',
   tracing_tags: 'tags',
diff --git a/packages/dd-trace/src/config/supported-configurations.json b/packages/dd-trace/src/config/supported-configurations.json
index 96104ea3b0..e729af8582 100644
--- a/packages/dd-trace/src/config/supported-configurations.json
+++ b/packages/dd-trace/src/config/supported-configurations.json
@@ -111,7 +111,6 @@
         "aliases": [
           "DATADOG_API_KEY"
         ],
-        "internalPropertyName": "apiKey",
         "sensitive": true
       }
     ],
@@ -450,7 +449,8 @@
       {
         "implementation": "A",
         "type": "boolean",
-        "default": "false"
+        "default": "false",
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_AGENTLESS_URL": [
@@ -458,28 +458,32 @@
         "implementation": "A",
         "type": "string",
         "transform": "toURL",
-        "default": null
+        "default": null,
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER": [
       {
         "implementation": "A",
         "type": "string",
-        "default": null
+        "default": null,
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE": [
       {
         "implementation": "A",
         "type": "boolean",
-        "default": "false"
+        "default": "false",
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING": [
       {
         "implementation": "A",
         "type": "boolean",
-        "default": "false"
+        "default": "false",
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED": [
@@ -487,14 +491,15 @@
         "implementation": "B",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "isEarlyFlakeDetectionEnabled"
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_ENABLED": [
       {
         "implementation": "A",
         "type": "boolean",
-        "default": "false"
+        "default": "false",
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_FLAKY_RETRY_COUNT": [
@@ -502,7 +507,7 @@
         "implementation": "A",
         "type": "int",
         "default": "5",
-        "internalPropertyName": "flakyTestRetriesCount"
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_FLAKY_RETRY_ENABLED": [
@@ -510,14 +515,15 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "isFlakyTestRetriesEnabled"
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED": [
       {
         "implementation": "A",
         "type": "boolean",
-        "default": "true"
+        "default": "true",
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_GIT_UPLOAD_ENABLED": [
@@ -525,7 +531,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "isGitUploadEnabled"
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_IMPACTED_TESTS_DETECTION_ENABLED": [
@@ -533,7 +539,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "isImpactedTestsEnabled"
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_ITR_ENABLED": [
@@ -541,7 +547,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "isIntelligentTestRunnerEnabled"
+        "namespace": "testOptimization"
       }
     ],
     "DD_ENABLE_LAGE_PACKAGE_NAME": [
@@ -555,35 +561,40 @@
       {
         "implementation": "A",
         "type": "boolean",
-        "default": "true"
+        "default": "true",
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_RUM_FLUSH_WAIT_MILLIS": [
       {
         "implementation": "A",
         "type": "int",
-        "default": "500"
+        "default": "500",
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_TEST_COMMAND": [
       {
         "implementation": "A",
         "type": "string",
-        "default": null
+        "default": null,
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_TEST_MODULE_ID": [
       {
         "implementation": "A",
         "type": "string",
-        "default": null
+        "default": null,
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_TEST_SESSION_ID": [
       {
         "implementation": "A",
         "type": "string",
-        "default": null
+        "default": null,
+        "namespace": "testOptimization"
       }
     ],
     "DD_CODE_ORIGIN_FOR_SPANS_ENABLED": [
@@ -1798,21 +1809,23 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "isTestDynamicInstrumentationEnabled"
+        "namespace": "testOptimization"
       }
     ],
     "DD_TEST_FLEET_CONFIG_PATH": [
       {
         "implementation": "A",
         "type": "string",
-        "default": null
+        "default": null,
+        "namespace": "testOptimization"
       }
     ],
     "DD_TEST_LOCAL_CONFIG_PATH": [
       {
         "implementation": "A",
         "type": "string",
-        "default": null
+        "default": null,
+        "namespace": "testOptimization"
       }
     ],
     "DD_TEST_MANAGEMENT_ATTEMPT_TO_FIX_RETRIES": [
@@ -1820,7 +1833,7 @@
         "implementation": "C",
         "type": "int",
         "default": "20",
-        "internalPropertyName": "testManagementAttemptToFixRetries"
+        "namespace": "testOptimization"
       }
     ],
     "DD_TEST_MANAGEMENT_ENABLED": [
@@ -1828,7 +1841,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "isTestManagementEnabled"
+        "namespace": "testOptimization"
       }
     ],
     "DD_TEST_SESSION_NAME": [
@@ -2560,8 +2573,7 @@
       {
         "implementation": "A",
         "type": "boolean",
-        "default": "true",
-        "internalPropertyName": "tracing"
+        "default": "true"
       }
     ],
     "DD_TRACE_ENCODING_DEBUG": [
@@ -3295,8 +3307,7 @@
       {
         "implementation": "F",
         "type": "string",
-        "default": "(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:(?:\\s|%20)*(?:=|%3D)[^&]+|(?:\"|%22)(?:\\s|%20)*(?::|%3A)(?:\\s|%20)*(?:\"|%22)(?:%2[^2]|%[^2]|[^\"%])+(?:\"|%22))|bearer(?:\\s|%20)+[a-z0-9\\._\\-]+|token(?::|%3A)[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L](?:[\\w=-]|%3D)+\\.ey[I-L](?:[\\w=-]|%3D)+(?:\\.(?:[\\w.+\\/=-]|%3D|%2F|%2B)+)?|[\\-]{5}BEGIN(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY[\\-]{5}[^\\-]+[\\-]{5}END(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY|ssh-rsa(?:\\s|%20)*(?:[a-z0-9\\/\\.+]|%2F|%5C|%2B){100,}",
-        "internalPropertyName": "queryStringObfuscation"
+        "default": "(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:(?:\\s|%20)*(?:=|%3D)[^&]+|(?:\"|%22)(?:\\s|%20)*(?::|%3A)(?:\\s|%20)*(?:\"|%22)(?:%2[^2]|%[^2]|[^\"%])+(?:\"|%22))|bearer(?:\\s|%20)+[a-z0-9\\._\\-]+|token(?::|%3A)[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L](?:[\\w=-]|%3D)+\\.ey[I-L](?:[\\w=-]|%3D)+(?:\\.(?:[\\w.+\\/=-]|%3D|%2F|%2B)+)?|[\\-]{5}BEGIN(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY[\\-]{5}[^\\-]+[\\-]{5}END(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY|ssh-rsa(?:\\s|%20)*(?:[a-z0-9\\/\\.+]|%2F|%5C|%2B){100,}"
       }
     ],
     "DD_TRACE_OPENAI_ENABLED": [
@@ -3636,8 +3647,7 @@
       {
         "implementation": "A",
         "type": "boolean",
-        "default": "false",
-        "internalPropertyName": "resourceRenamingEnabled"
+        "default": "false"
       }
     ],
     "DD_TRACE_RESTIFY_ENABLED": [
@@ -3688,8 +3698,7 @@
       {
         "implementation": "A",
         "type": "string",
-        "default": null,
-        "internalPropertyName": "scope"
+        "default": null
       }
     ],
     "DD_TRACE_SELENIUM_ENABLED": [
diff --git a/packages/dd-trace/src/exporters/agentless/writer.js b/packages/dd-trace/src/exporters/agentless/writer.js
index 2a884cb7c4..56c7511221 100644
--- a/packages/dd-trace/src/exporters/agentless/writer.js
+++ b/packages/dd-trace/src/exporters/agentless/writer.js
@@ -40,7 +40,7 @@ class AgentlessWriter extends BaseWriter {
       }
     }
 
-    if (!getConfig().apiKey) {
+    if (!getConfig().DD_API_KEY) {
       this.#apiKeyMissing = true
       log.error('DD_API_KEY is required for agentless trace intake. Set DD_API_KEY. Traces will not be sent.')
     }
@@ -109,8 +109,8 @@ class AgentlessWriter extends BaseWriter {
       return
     }
 
-    const apiKey = getConfig().apiKey
-    if (!apiKey) {
+    const { DD_API_KEY } = getConfig()
+    if (!DD_API_KEY) {
       if (!this.#apiKeyMissing) {
         this.#apiKeyMissing = true
         log.error('DD_API_KEY is required for agentless trace intake. Set DD_API_KEY. Traces will not be sent.')
@@ -126,7 +126,7 @@ class AgentlessWriter extends BaseWriter {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        'dd-api-key': apiKey,
+        'dd-api-key': DD_API_KEY,
         'X-Datadog-Trace-Count': String(count),
         'Datadog-Meta-Lang': 'nodejs',
         'Datadog-Meta-Lang-Version': process.version,
diff --git a/packages/dd-trace/src/llmobs/index.js b/packages/dd-trace/src/llmobs/index.js
index f78a4a538c..55c6469a08 100644
--- a/packages/dd-trace/src/llmobs/index.js
+++ b/packages/dd-trace/src/llmobs/index.js
@@ -75,7 +75,7 @@ function enable (config) {
   injectCh.subscribe(handleLLMObsInjection)
 
   setAgentStrategy(config, useAgentless => {
-    if (useAgentless && !(config.apiKey && config.site)) {
+    if (useAgentless && !(config.DD_API_KEY && config.site)) {
       if (DD_MAJOR < 6 || !config?.startupLogs) {
         // eslint-disable-next-line no-console
         console.error(INCOMPATIBLE_INITIALIZATION)
diff --git a/packages/dd-trace/src/llmobs/writers/base.js b/packages/dd-trace/src/llmobs/writers/base.js
index decb1896e2..89cbe5af19 100644
--- a/packages/dd-trace/src/llmobs/writers/base.js
+++ b/packages/dd-trace/src/llmobs/writers/base.js
@@ -229,7 +229,7 @@ class BaseLLMObsWriter {
     }
 
     if (this._agentless) {
-      options.headers['DD-API-KEY'] = this._config.apiKey || ''
+      options.headers['DD-API-KEY'] = this._config.DD_API_KEY || ''
     } else {
       options.headers[EVP_SUBDOMAIN_HEADER_NAME] = this._intake
     }
diff --git a/packages/dd-trace/src/plugin_manager.js b/packages/dd-trace/src/plugin_manager.js
index 552e4c242e..4c7aa52710 100644
--- a/packages/dd-trace/src/plugin_manager.js
+++ b/packages/dd-trace/src/plugin_manager.js
@@ -158,7 +158,7 @@ module.exports = class PluginManager {
     const {
       logInjection,
       serviceMapping,
-      queryStringObfuscation,
+      DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP,
       site,
       url,
       headerTags,
@@ -171,14 +171,14 @@ module.exports = class PluginManager {
       DD_TRACE_OTEL_SEMANTICS_ENABLED,
       DD_TEST_SESSION_NAME,
       DD_AGENTLESS_LOG_SUBMISSION_ENABLED,
-      isTestDynamicInstrumentationEnabled,
+      testOptimization,
       isServiceUserProvided,
       middlewareTracingEnabled,
       traceWebsocketMessagesEnabled,
       traceWebsocketMessagesInheritSampling,
       traceWebsocketMessagesSeparateTraces,
       experimental,
-      resourceRenamingEnabled,
+      DD_TRACE_RESOURCE_RENAMING_ENABLED,
     } = /** @type {import('./config/config-base')} */ (this._tracerConfig)
 
     const sharedConfig = {
@@ -193,21 +193,21 @@ module.exports = class PluginManager {
       clientIpHeader,
       DD_TEST_SESSION_NAME,
       DD_AGENTLESS_LOG_SUBMISSION_ENABLED,
-      isTestDynamicInstrumentationEnabled,
+      isTestDynamicInstrumentationEnabled: testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED,
       isServiceUserProvided,
       traceWebsocketMessagesEnabled,
       traceWebsocketMessagesInheritSampling,
       traceWebsocketMessagesSeparateTraces,
       experimental,
-      resourceRenamingEnabled,
+      resourceRenamingEnabled: DD_TRACE_RESOURCE_RENAMING_ENABLED,
     }
 
     if (logInjection !== undefined) {
       sharedConfig.logInjection = logInjection
     }
 
-    if (queryStringObfuscation !== undefined) {
-      sharedConfig.queryStringObfuscation = queryStringObfuscation
+    if (DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP !== undefined) {
+      sharedConfig.queryStringObfuscation = DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP
     }
 
     if (serviceMapping && serviceMapping[name]) {
diff --git a/packages/dd-trace/src/proxy.js b/packages/dd-trace/src/proxy.js
index bcc6ec9c8b..54d581a227 100644
--- a/packages/dd-trace/src/proxy.js
+++ b/packages/dd-trace/src/proxy.js
@@ -216,7 +216,7 @@ class Tracer extends NoopProxy {
 
       this._modules.rewriter.enable(config)
 
-      if (config.tracing && config.DD_CIVISIBILITY_MANUAL_API_ENABLED) {
+      if (config.DD_TRACE_ENABLED && config.testOptimization.DD_CIVISIBILITY_MANUAL_API_ENABLED) {
         const TestApiManualPlugin = require('./ci-visibility/test-api-manual/test-api-manual-plugin')
         this._testApiManualPlugin = new TestApiManualPlugin(this)
         // `shouldGetEnvironmentData` is passed as false so that we only lazily calculate it
@@ -225,7 +225,7 @@ class Tracer extends NoopProxy {
         this._testApiManualPlugin.configure({ ...config, enabled: true }, false)
       }
       if (config.DD_AGENTLESS_LOG_SUBMISSION_ENABLED) {
-        if (config.apiKey) {
+        if (config.DD_API_KEY) {
           const LogSubmissionPlugin = require('./ci-visibility/log-submission/log-submission-plugin')
           const automaticLogPlugin = new LogSubmissionPlugin(this)
           automaticLogPlugin.configure({ ...config, enabled: true })
@@ -237,7 +237,7 @@ class Tracer extends NoopProxy {
         }
       }
 
-      if (config.isTestDynamicInstrumentationEnabled) {
+      if (config.testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED) {
         const getDynamicInstrumentationClient = require('./ci-visibility/dynamic-instrumentation')
         // We instantiate the client but do not start the Worker here. The worker is started lazily
         getDynamicInstrumentationClient(config)
@@ -270,7 +270,7 @@ class Tracer extends NoopProxy {
    * @param {import('./config/config-base')} config - Tracer configuration
    */
   #updateTracing (config) {
-    if (config.tracing !== false) {
+    if (config.DD_TRACE_ENABLED !== false) {
       if (config.appsec.enabled) {
         this._modules.appsec.enable(config)
       }
diff --git a/packages/dd-trace/src/span_processor.js b/packages/dd-trace/src/span_processor.js
index 9165735feb..aa6c9a5df8 100644
--- a/packages/dd-trace/src/span_processor.js
+++ b/packages/dd-trace/src/span_processor.js
@@ -42,11 +42,11 @@ class SpanProcessor {
     const active = []
     const formatted = []
     const trace = spanContext._trace
-    const { flushMinSpans, tracing } = this._config
+    const { flushMinSpans, DD_TRACE_ENABLED } = this._config
     const { started, finished } = trace
 
     if (trace.record === false) return
-    if (tracing === false) {
+    if (DD_TRACE_ENABLED === false) {
       this._erase(trace, active)
       return
     }
diff --git a/packages/dd-trace/src/telemetry/send-data.js b/packages/dd-trace/src/telemetry/send-data.js
index 8d833e319a..28a2d019f8 100644
--- a/packages/dd-trace/src/telemetry/send-data.js
+++ b/packages/dd-trace/src/telemetry/send-data.js
@@ -91,8 +91,8 @@ function getHeaders (config, application, reqType) {
   if (debug) {
     headers['dd-telemetry-debug-enabled'] = 'true'
   }
-  if (config.apiKey) {
-    headers['dd-api-key'] = config.apiKey
+  if (config.DD_API_KEY) {
+    headers['dd-api-key'] = config.DD_API_KEY
   }
   return headers
 }
@@ -137,16 +137,16 @@ function sendData (config, application, host, reqType, payload = {}, cb = () =>
     hostname,
     port,
     isCiVisibility,
-    DD_CIVISIBILITY_AGENTLESS_ENABLED,
+    testOptimization,
   } = config
 
   let url = config.url
 
-  const isCiVisibilityAgentlessMode = isCiVisibility && DD_CIVISIBILITY_AGENTLESS_ENABLED
+  const isCiVisibilityAgentlessMode = isCiVisibility && testOptimization.DD_CIVISIBILITY_AGENTLESS_ENABLED
 
   if (isCiVisibilityAgentlessMode) {
     try {
-      url = config.DD_CIVISIBILITY_AGENTLESS_URL ?? new URL(getAgentlessTelemetryEndpoint(config.site))
+      url = testOptimization.DD_CIVISIBILITY_AGENTLESS_URL ?? new URL(getAgentlessTelemetryEndpoint(config.site))
     } catch (err) {
       log.error('Telemetry endpoint url is invalid', err)
       // No point to do the request if the URL is invalid
@@ -176,7 +176,7 @@ function sendData (config, application, host, reqType, payload = {}, cb = () =>
   })
 
   request(data, options, (error) => {
-    if (error && config.apiKey && config.site) {
+    if (error && config.DD_API_KEY && config.site) {
       if (agentTelemetry) {
         log.warn('Agent telemetry failed, started agentless telemetry')
         agentTelemetry = false
@@ -189,7 +189,7 @@ function sendData (config, application, host, reqType, payload = {}, cb = () =>
         log.error('Invalid Telemetry URL')
         return
       }
-      const backendHeader = { ...options.headers, 'DD-API-KEY': config.apiKey }
+      const backendHeader = { ...options.headers, 'DD-API-KEY': config.DD_API_KEY }
       const backendOptions = {
         ...options,
         url: backendUrl,
diff --git a/packages/dd-trace/test/aiguard/index.spec.js b/packages/dd-trace/test/aiguard/index.spec.js
index d2dfaa5061..797c095592 100644
--- a/packages/dd-trace/test/aiguard/index.spec.js
+++ b/packages/dd-trace/test/aiguard/index.spec.js
@@ -33,7 +33,7 @@ describe('AIGuard SDK', () => {
     flushInterval: 0,
     service: 'ai_guard_demo',
     env: 'test',
-    apiKey: 'API_KEY',
+    DD_API_KEY: 'API_KEY',
     DD_APP_KEY: 'APP_KEY',
     protocolVersion: '0.4',
     experimental: {
@@ -124,7 +124,7 @@ describe('AIGuard SDK', () => {
         headers: {
           'Content-Type': 'application/json',
           'Content-Length': Buffer.byteLength(postData),
-          'DD-API-KEY': config.apiKey,
+          'DD-API-KEY': config.DD_API_KEY,
           'DD-APPLICATION-KEY': config.DD_APP_KEY,
           'DD-AI-GUARD-VERSION': tracerVersion,
           'DD-AI-GUARD-SOURCE': 'SDK',
diff --git a/packages/dd-trace/test/ci-visibility/exporters/agent-proxy/agent-proxy.spec.js b/packages/dd-trace/test/ci-visibility/exporters/agent-proxy/agent-proxy.spec.js
index 6cac20369b..b4ed9d2af8 100644
--- a/packages/dd-trace/test/ci-visibility/exporters/agent-proxy/agent-proxy.spec.js
+++ b/packages/dd-trace/test/ci-visibility/exporters/agent-proxy/agent-proxy.spec.js
@@ -10,7 +10,7 @@ const nock = require('nock')
 
 const { assertObjectContains } = require('../../../../../../integration-tests/helpers')
 require('../../../../../dd-trace/test/setup/core')
-const AgentProxyCiVisibilityExporter = require('../../../../src/ci-visibility/exporters/agent-proxy')
+const AgentProxyCiVisibilityExporterBase = require('../../../../src/ci-visibility/exporters/agent-proxy')
 const AgentlessWriter = require('../../../../src/ci-visibility/exporters/agentless/writer')
 const DynamicInstrumentationLogsWriter = require('../../../../src/ci-visibility/exporters/agentless/di-logs-writer')
 const CoverageWriter = require('../../../../src/ci-visibility/exporters/agentless/coverage-writer')
@@ -18,6 +18,14 @@ const AgentWriter = require('../../../../src/exporters/agent/writer')
 const { clearCache } = require('../../../../src/agent/info')
 const { defaults: { hostname, port } } = require('../../../../src/config/defaults')
 
+// The real tracer Config always carries a `testOptimization` namespace object.
+// Default it here so the partial config stand-ins below mirror that guarantee.
+class AgentProxyCiVisibilityExporter extends AgentProxyCiVisibilityExporterBase {
+  constructor (config) {
+    super({ testOptimization: {}, ...config })
+  }
+}
+
 describe('AgentProxyCiVisibilityExporter', () => {
   beforeEach(() => {
     nock.abortPendingRequests()
@@ -140,7 +148,7 @@ describe('AgentProxyCiVisibilityExporter', () => {
         const agentProxyCiVisibilityExporter = new AgentProxyCiVisibilityExporter({
           url,
           tags,
-          isTestDynamicInstrumentationEnabled: true,
+          testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
         })
         await agentProxyCiVisibilityExporter._canUseCiVisProtocolPromise
         assert.ok(agentProxyCiVisibilityExporter._logsWriter instanceof DynamicInstrumentationLogsWriter)
@@ -154,7 +162,7 @@ describe('AgentProxyCiVisibilityExporter', () => {
         const agentProxyCiVisibilityExporter = new AgentProxyCiVisibilityExporter({
           url,
           tags,
-          isTestDynamicInstrumentationEnabled: true,
+          testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
         })
         await agentProxyCiVisibilityExporter._canUseCiVisProtocolPromise
         agentProxyCiVisibilityExporter._logsWriter = mockWriter
@@ -223,7 +231,7 @@ describe('AgentProxyCiVisibilityExporter', () => {
         const agentProxyCiVisibilityExporter = new AgentProxyCiVisibilityExporter({
           url,
           tags,
-          isTestDynamicInstrumentationEnabled: true,
+          testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
         })
         await agentProxyCiVisibilityExporter._canUseCiVisProtocolPromise
         assert.strictEqual(agentProxyCiVisibilityExporter._logsWriter, undefined)
@@ -237,7 +245,7 @@ describe('AgentProxyCiVisibilityExporter', () => {
         const agentProxyCiVisibilityExporter = new AgentProxyCiVisibilityExporter({
           url,
           tags,
-          isTestDynamicInstrumentationEnabled: true,
+          testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
         })
         await agentProxyCiVisibilityExporter._canUseCiVisProtocolPromise
         agentProxyCiVisibilityExporter._logsWriter = mockWriter
diff --git a/packages/dd-trace/test/ci-visibility/exporters/agentless/di-logs-writer.spec.js b/packages/dd-trace/test/ci-visibility/exporters/agentless/di-logs-writer.spec.js
index a63d840636..5eb254bafa 100644
--- a/packages/dd-trace/test/ci-visibility/exporters/agentless/di-logs-writer.spec.js
+++ b/packages/dd-trace/test/ci-visibility/exporters/agentless/di-logs-writer.spec.js
@@ -13,7 +13,7 @@ const log = require('../../../../src/log')
 
 const DynamicInstrumentationLogsWriterWithApiKey = proxyquire(
   '../../../../src/ci-visibility/exporters/agentless/di-logs-writer',
-  { '../../../config': () => ({ apiKey: '1' }) }
+  { '../../../config': () => ({ DD_API_KEY: '1' }) }
 )
 const DynamicInstrumentationLogsWriter = require('../../../../src/ci-visibility/exporters/agentless/di-logs-writer')
 
diff --git a/packages/dd-trace/test/ci-visibility/exporters/agentless/exporter.spec.js b/packages/dd-trace/test/ci-visibility/exporters/agentless/exporter.spec.js
index b4dfbd860d..729c8e7bab 100644
--- a/packages/dd-trace/test/ci-visibility/exporters/agentless/exporter.spec.js
+++ b/packages/dd-trace/test/ci-visibility/exporters/agentless/exporter.spec.js
@@ -11,9 +11,17 @@ const sinon = require('sinon')
 const nock = require('nock')
 
 require('../../../../../dd-trace/test/setup/core')
-const AgentlessCiVisibilityExporter = require('../../../../src/ci-visibility/exporters/agentless')
+const AgentlessCiVisibilityExporterBase = require('../../../../src/ci-visibility/exporters/agentless')
 const DynamicInstrumentationLogsWriter = require('../../../../src/ci-visibility/exporters/agentless/di-logs-writer')
 
+// The real tracer Config always carries a `testOptimization` namespace object.
+// Default it here so the partial config stand-ins below mirror that guarantee.
+class AgentlessCiVisibilityExporter extends AgentlessCiVisibilityExporterBase {
+  constructor (config) {
+    super({ testOptimization: {}, ...config })
+  }
+}
+
 // Used by the negative "no API key" test to inject a stubbed getConfig singleton into
 // the request chain. The stubbed singleton still pulls every other field from the real
 // tracer Config so the rest of the exporter behaves normally.
@@ -53,7 +61,7 @@ describe('CI Visibility Agentless Exporter', () => {
 
   it('can use CI Vis protocol right away', () => {
     const agentlessExporter = new AgentlessCiVisibilityExporter({
-      DD_CIVISIBILITY_AGENTLESS_URL: url, isGitUploadEnabled: true, tags: {},
+      testOptimization: { DD_CIVISIBILITY_AGENTLESS_URL: url, DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true }, tags: {},
     })
     assert.strictEqual(agentlessExporter.canReportSessionTraces(), true)
   })
@@ -73,8 +81,10 @@ describe('CI Visibility Agentless Exporter', () => {
         }))
       const agentlessExporter = new AgentlessCiVisibilityExporter({
         site: 'datadoge.c0m',
-        isGitUploadEnabled: true,
-        isIntelligentTestRunnerEnabled: true,
+        testOptimization: {
+          DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          DD_CIVISIBILITY_ITR_ENABLED: true,
+        },
         tags: {},
       })
       agentlessExporter.getLibraryConfiguration({}, () => {
@@ -104,8 +114,10 @@ describe('CI Visibility Agentless Exporter', () => {
 
       const agentlessExporter = new AgentlessCiVisibilityExporter({
         site: 'datadoge.c0m',
-        isGitUploadEnabled: true,
-        isIntelligentTestRunnerEnabled: true,
+        testOptimization: {
+          DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          DD_CIVISIBILITY_ITR_ENABLED: true,
+        },
         tags: {},
       })
       agentlessExporter._resolveGit()
@@ -130,7 +142,12 @@ describe('CI Visibility Agentless Exporter', () => {
           },
         }))
       const agentlessExporter = new AgentlessCiVisibilityExporter({
-        DD_CIVISIBILITY_AGENTLESS_URL: url, isGitUploadEnabled: true, isIntelligentTestRunnerEnabled: true, tags: {},
+        testOptimization: {
+          DD_CIVISIBILITY_AGENTLESS_URL: url,
+          DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          DD_CIVISIBILITY_ITR_ENABLED: true,
+        },
+        tags: {},
       })
       agentlessExporter.getLibraryConfiguration({}, () => {
         assert.strictEqual(scope.isDone(), true)
@@ -153,7 +170,12 @@ describe('CI Visibility Agentless Exporter', () => {
           },
         }))
       const agentlessExporter = new AgentlessCiVisibilityExporter({
-        DD_CIVISIBILITY_AGENTLESS_URL: url, isGitUploadEnabled: true, isIntelligentTestRunnerEnabled: true, tags: {},
+        testOptimization: {
+          DD_CIVISIBILITY_AGENTLESS_URL: url,
+          DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          DD_CIVISIBILITY_ITR_ENABLED: true,
+        },
+        tags: {},
       })
       agentlessExporter.getLibraryConfiguration({}, () => {
         assert.strictEqual(scope.isDone(), true)
@@ -163,8 +185,8 @@ describe('CI Visibility Agentless Exporter', () => {
     })
 
     it('will not allow skippable request if ITR configuration fails', (done) => {
-      // Stub apiKey to be missing so the request is never sent.
-      const AgentlessCiVisibilityExporter = loadAgentlessExporterWithFakeConfig({ apiKey: undefined })
+      // Stub the API key to be missing so the request is never sent.
+      const AgentlessCiVisibilityExporter = loadAgentlessExporterWithFakeConfig({ DD_API_KEY: undefined })
 
       const scope = nock('http://www.example.com')
         .post('/api/v2/libraries/tests/services/setting')
@@ -179,7 +201,12 @@ describe('CI Visibility Agentless Exporter', () => {
         }))
 
       const agentlessExporter = new AgentlessCiVisibilityExporter({
-        DD_CIVISIBILITY_AGENTLESS_URL: url, isGitUploadEnabled: true, isIntelligentTestRunnerEnabled: true, tags: {},
+        testOptimization: {
+          DD_CIVISIBILITY_AGENTLESS_URL: url,
+          DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          DD_CIVISIBILITY_ITR_ENABLED: true,
+        },
+        tags: {},
       })
       agentlessExporter.sendGitMetadata = () => {
         return /** @type {Promise<void>} */ (new Promise(resolve => {
@@ -204,7 +231,7 @@ describe('CI Visibility Agentless Exporter', () => {
     it('should initialise DynamicInstrumentationLogsWriter', async () => {
       const agentProxyCiVisibilityExporter = new AgentlessCiVisibilityExporter({
         tags: {},
-        isTestDynamicInstrumentationEnabled: true,
+        testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
       })
       await agentProxyCiVisibilityExporter._canUseCiVisProtocolPromise
       assert.ok(agentProxyCiVisibilityExporter._logsWriter instanceof DynamicInstrumentationLogsWriter)
@@ -217,7 +244,7 @@ describe('CI Visibility Agentless Exporter', () => {
       }
       const agentProxyCiVisibilityExporter = new AgentlessCiVisibilityExporter({
         tags: {},
-        isTestDynamicInstrumentationEnabled: true,
+        testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
       })
       await agentProxyCiVisibilityExporter._canUseCiVisProtocolPromise
       agentProxyCiVisibilityExporter._logsWriter = mockWriter
@@ -237,7 +264,7 @@ describe('CI Visibility Agentless Exporter', () => {
 
     it('uses DD_CIVISIBILITY_AGENTLESS_URL as the intake override for every endpoint', () => {
       const agentlessExporter = new AgentlessCiVisibilityExporter({
-        DD_CIVISIBILITY_AGENTLESS_URL: url, site: 'd4tad0g.com', tags: {},
+        testOptimization: { DD_CIVISIBILITY_AGENTLESS_URL: url }, site: 'd4tad0g.com', tags: {},
       })
       assert.strictEqual(agentlessExporter._url.href, 'http://www.example.com/')
       assert.strictEqual(agentlessExporter._coverageUrl.href, 'http://www.example.com/')
diff --git a/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-exporter.spec.js b/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-exporter.spec.js
index 4a9cc98e1e..0a72264525 100644
--- a/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-exporter.spec.js
+++ b/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-exporter.spec.js
@@ -13,9 +13,17 @@ const nock = require('nock')
 
 const { assertObjectContains } = require('../../../../../integration-tests/helpers')
 require('../../../../dd-trace/test/setup/core')
-const CiVisibilityExporter = require('../../../src/ci-visibility/exporters/ci-visibility-exporter')
+const CiVisibilityExporterBase = require('../../../src/ci-visibility/exporters/ci-visibility-exporter')
 const { defaults: { hostname, port } } = require('../../../src/config/defaults')
 
+// The real tracer Config always carries a `testOptimization` namespace object.
+// Default it here so the partial config stand-ins below mirror that guarantee.
+class CiVisibilityExporter extends CiVisibilityExporterBase {
+  constructor (config) {
+    super({ testOptimization: {}, ...config })
+  }
+}
+
 describe('CI Visibility Exporter', () => {
   const url = new URL(`http://${hostname}:${port}`)
 
@@ -41,7 +49,10 @@ describe('CI Visibility Exporter', () => {
         .post('/api/v2/git/repository/packfile')
         .reply(202, '')
 
-      const ciVisibilityExporter = new CiVisibilityExporter({ url, isGitUploadEnabled: true })
+      const ciVisibilityExporter = new CiVisibilityExporter({
+        url,
+        testOptimization: { DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true },
+      })
 
       ciVisibilityExporter._gitUploadPromise.then((err) => {
         assert.ok(err == null, `Expected ${err} == null`)
@@ -57,7 +68,10 @@ describe('CI Visibility Exporter', () => {
         .post('/api/v2/git/repository/search_commits')
         .reply(404)
 
-      const ciVisibilityExporter = new CiVisibilityExporter({ url, isGitUploadEnabled: true })
+      const ciVisibilityExporter = new CiVisibilityExporter({
+        url,
+        testOptimization: { DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true },
+      })
 
       ciVisibilityExporter._gitUploadPromise.then((err) => {
         assert.match(err.message, /Error fetching commits to exclude/)
@@ -79,7 +93,10 @@ describe('CI Visibility Exporter', () => {
         .post('/api/v2/git/repository/packfile')
         .reply(202, '')
 
-      const ciVisibilityExporter = new CiVisibilityExporter({ url, isGitUploadEnabled: true })
+      const ciVisibilityExporter = new CiVisibilityExporter({
+        url,
+        testOptimization: { DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true },
+      })
 
       ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
       ciVisibilityExporter.sendGitMetadata('https://custom-git@datadog.com')
@@ -96,7 +113,10 @@ describe('CI Visibility Exporter', () => {
         .post('/api/v2/git/repository/packfile')
         .reply(202, '')
 
-      const ciVisibilityExporter = new CiVisibilityExporter({ url, isGitUploadEnabled: true })
+      const ciVisibilityExporter = new CiVisibilityExporter({
+        url,
+        testOptimization: { DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true },
+      })
       ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
       ciVisibilityExporter.getLibraryConfiguration({}, () => {})
       ciVisibilityExporter._gitUploadPromise.then(() => {
@@ -125,7 +145,7 @@ describe('CI Visibility Exporter', () => {
 
         const ciVisibilityExporter = new CiVisibilityExporter({
           url,
-          isIntelligentTestRunnerEnabled: true,
+          testOptimization: { DD_CIVISIBILITY_ITR_ENABLED: true },
           tags: {
             'test.configuration.my_custom_config': 'my_custom_config_value',
           },
@@ -159,7 +179,7 @@ describe('CI Visibility Exporter', () => {
           }))
         const ciVisibilityExporter = new CiVisibilityExporter({
           url,
-          isIntelligentTestRunnerEnabled: true,
+          testOptimization: { DD_CIVISIBILITY_ITR_ENABLED: true },
         })
         const testConfiguration = {
           tag: 'v1.0.0',
@@ -193,7 +213,10 @@ describe('CI Visibility Exporter', () => {
             },
           }))
 
-        const ciVisibilityExporter = new CiVisibilityExporter({ url, isIntelligentTestRunnerEnabled: true })
+        const ciVisibilityExporter = new CiVisibilityExporter({
+          url,
+          testOptimization: { DD_CIVISIBILITY_ITR_ENABLED: true },
+        })
 
         ciVisibilityExporter.getLibraryConfiguration({}, (err, libraryConfig) => {
           assertObjectContains(libraryConfig, {
@@ -223,7 +246,10 @@ describe('CI Visibility Exporter', () => {
             },
           }))
 
-        const ciVisibilityExporter = new CiVisibilityExporter({ url, isIntelligentTestRunnerEnabled: true })
+        const ciVisibilityExporter = new CiVisibilityExporter({
+          url,
+          testOptimization: { DD_CIVISIBILITY_ITR_ENABLED: true },
+        })
         assert.strictEqual(ciVisibilityExporter.shouldRequestSkippableSuites(), false)
 
         ciVisibilityExporter.getLibraryConfiguration({}, () => {
@@ -258,7 +284,7 @@ describe('CI Visibility Exporter', () => {
           }))
 
         const ciVisibilityExporter = new CiVisibilityExporter({
-          url, isIntelligentTestRunnerEnabled: true,
+          url, testOptimization: { DD_CIVISIBILITY_ITR_ENABLED: true },
         })
         ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
         ciVisibilityExporter.getLibraryConfiguration({}, (err, libraryConfig) => {
@@ -299,7 +325,7 @@ describe('CI Visibility Exporter', () => {
           }))
 
         const ciVisibilityExporter = new CiVisibilityExporter({
-          url, isIntelligentTestRunnerEnabled: true,
+          url, testOptimization: { DD_CIVISIBILITY_ITR_ENABLED: true },
         })
         ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
         ciVisibilityExporter.getLibraryConfiguration({}, (err, libraryConfig) => {
@@ -336,7 +362,10 @@ describe('CI Visibility Exporter', () => {
           .post('/api/v2/ci/tests/skippable')
           .reply(200)
 
-        const ciVisibilityExporter = new CiVisibilityExporter({ url, isIntelligentTestRunnerEnabled: true })
+        const ciVisibilityExporter = new CiVisibilityExporter({
+          url,
+          testOptimization: { DD_CIVISIBILITY_ITR_ENABLED: true },
+        })
 
         ciVisibilityExporter._resolveCanUseCiVisProtocol(false)
         ciVisibilityExporter._resolveGit()
@@ -377,8 +406,10 @@ describe('CI Visibility Exporter', () => {
 
         const ciVisibilityExporter = new CiVisibilityExporter({
           url,
-          isIntelligentTestRunnerEnabled: true,
-          isGitUploadEnabled: true,
+          testOptimization: {
+            DD_CIVISIBILITY_ITR_ENABLED: true,
+            DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          },
           tags: {
             'test.configuration.my_custom_config_2': 'my_custom_config_value_2',
           },
@@ -421,8 +452,10 @@ describe('CI Visibility Exporter', () => {
 
         const ciVisibilityExporter = new CiVisibilityExporter({
           url,
-          isIntelligentTestRunnerEnabled: true,
-          isGitUploadEnabled: true,
+          testOptimization: {
+            DD_CIVISIBILITY_ITR_ENABLED: true,
+            DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          },
         })
 
         ciVisibilityExporter._libraryConfig = { isSuitesSkippingEnabled: true }
@@ -443,7 +476,10 @@ describe('CI Visibility Exporter', () => {
           .post('/api/v2/ci/tests/skippable')
           .reply(200)
 
-        const ciVisibilityExporter = new CiVisibilityExporter({ url, isIntelligentTestRunnerEnabled: true })
+        const ciVisibilityExporter = new CiVisibilityExporter({
+          url,
+          testOptimization: { DD_CIVISIBILITY_ITR_ENABLED: true },
+        })
 
         ciVisibilityExporter._libraryConfig = { isSuitesSkippingEnabled: true }
         ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
@@ -491,8 +527,10 @@ describe('CI Visibility Exporter', () => {
           })
         const ciVisibilityExporter = new CiVisibilityExporter({
           url,
-          isIntelligentTestRunnerEnabled: true,
-          isGitUploadEnabled: true,
+          testOptimization: {
+            DD_CIVISIBILITY_ITR_ENABLED: true,
+            DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          },
         })
         ciVisibilityExporter._libraryConfig = { isSuitesSkippingEnabled: true }
         ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
@@ -538,8 +576,10 @@ describe('CI Visibility Exporter', () => {
           })
         const ciVisibilityExporter = new CiVisibilityExporter({
           url,
-          isIntelligentTestRunnerEnabled: true,
-          isGitUploadEnabled: true,
+          testOptimization: {
+            DD_CIVISIBILITY_ITR_ENABLED: true,
+            DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          },
         })
         ciVisibilityExporter._libraryConfig = { isSuitesSkippingEnabled: true }
         ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
@@ -1032,7 +1072,7 @@ describe('CI Visibility Exporter', () => {
         const log = { message: 'log' }
         const ciVisibilityExporter = new CiVisibilityExporter({
           url,
-          isTestDynamicInstrumentationEnabled: true,
+          testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
         })
         ciVisibilityExporter.exportDiLogs(log)
         ciVisibilityExporter._export = sinon.spy()
@@ -1050,7 +1090,7 @@ describe('CI Visibility Exporter', () => {
         const log = { message: 'log' }
         const ciVisibilityExporter = new CiVisibilityExporter({
           url,
-          isTestDynamicInstrumentationEnabled: true,
+          testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
         })
         ciVisibilityExporter._isInitialized = true
         ciVisibilityExporter._logsWriter = writer
@@ -1096,7 +1136,7 @@ describe('CI Visibility Exporter', () => {
           env: 'ci',
           version: '1.0.0',
           url,
-          isTestDynamicInstrumentationEnabled: true,
+          testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
           service: 'my-service',
         })
         ciVisibilityExporter._isInitialized = true
diff --git a/packages/dd-trace/test/ci-visibility/exporters/git/git_metadata.spec.js b/packages/dd-trace/test/ci-visibility/exporters/git/git_metadata.spec.js
index 09d7c20fa2..e20626636e 100644
--- a/packages/dd-trace/test/ci-visibility/exporters/git/git_metadata.spec.js
+++ b/packages/dd-trace/test/ci-visibility/exporters/git/git_metadata.spec.js
@@ -60,7 +60,7 @@ describe('git_metadata', () => {
 
     generatePackFilesForCommitsStub = sinon.stub().returns([temporaryPackFile])
 
-    fakeConfig = { apiKey: 'api-key', DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED: true }
+    fakeConfig = { DD_API_KEY: 'api-key', testOptimization: { DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED: true } }
 
     // Most tests inject requestStub directly so they never touch nock or the
     // real HTTP stack. This avoids the Windows CI hang caused by nock's
@@ -132,7 +132,7 @@ describe('git_metadata', () => {
   })
 
   it('should not unshallow if the parameter to enable unshallow is false', (done) => {
-    fakeConfig.DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED = false
+    fakeConfig.testOptimization.DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED = false
     requestStub.onCall(0).callsArgWith(2, null, JSON.stringify({ data: [] }), 200)
     requestStub.onCall(1).callsArgWith(2, null, JSON.stringify({ data: [] }), 200)
     requestStub.onCall(2).callsArgWith(2, null, '', 204)
diff --git a/packages/dd-trace/test/ci-visibility/intelligent-test-runner/get-skippable-suites.spec.js b/packages/dd-trace/test/ci-visibility/intelligent-test-runner/get-skippable-suites.spec.js
index bafe54093b..2e87fd5a89 100644
--- a/packages/dd-trace/test/ci-visibility/intelligent-test-runner/get-skippable-suites.spec.js
+++ b/packages/dd-trace/test/ci-visibility/intelligent-test-runner/get-skippable-suites.spec.js
@@ -111,7 +111,7 @@ function cleanup (params) {
 describe('get-skippable-suites', () => {
   beforeEach(() => {
     process.env.DD_API_KEY = 'test-api-key'
-    getConfig().apiKey = 'test-api-key'
+    getConfig().DD_API_KEY = 'test-api-key'
     process.env.DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = 'true'
     getConfig().DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = true
     cleanup(DEFAULT_PARAMS)
@@ -120,7 +120,7 @@ describe('get-skippable-suites', () => {
 
   afterEach(() => {
     delete process.env.DD_API_KEY
-    getConfig().apiKey = undefined
+    getConfig().DD_API_KEY = undefined
     delete process.env.DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE
     getConfig().DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = false
     cleanup(DEFAULT_PARAMS)
diff --git a/packages/dd-trace/test/config/index.spec.js b/packages/dd-trace/test/config/index.spec.js
index dfa982a4d9..d77ecb0005 100644
--- a/packages/dd-trace/test/config/index.spec.js
+++ b/packages/dd-trace/test/config/index.spec.js
@@ -246,6 +246,19 @@ describe('Config', () => {
       assert.strictEqual(iastEntry.internalPropertyName, undefined)
     })
 
+    it('does not retain any internalPropertyName entries in supported-configurations.json', () => {
+      const { supportedConfigurations } = require('../../src/config/supported-configurations.json')
+      const offenders = []
+      for (const [canonicalName, entries] of Object.entries(supportedConfigurations)) {
+        for (const entry of entries) {
+          if (entry.internalPropertyName !== undefined) {
+            offenders.push(`${canonicalName} -> ${entry.internalPropertyName}`)
+          }
+        }
+      }
+      assert.deepStrictEqual(offenders, [], 'internalPropertyName is replaced by namespace or the canonical name')
+    })
+
     it('loads v5 config repeatedly after security controls are restored', () => {
       const firstConfig = getConfig(undefined, { ddMajor: 5 })
       const secondConfig = getConfig(undefined, { ddMajor: 5 })
@@ -589,7 +602,7 @@ describe('Config', () => {
 
       const config = getConfig()
 
-      assert.strictEqual(config.apiKey, 'SENTINEL_DATADOG_API_KEY')
+      assert.strictEqual(config.DD_API_KEY, 'SENTINEL_DATADOG_API_KEY')
       for (const entry of telemetryEntries()) {
         const value = typeof entry.value === 'string' ? entry.value : JSON.stringify(entry.value)
         assert.ok(
@@ -873,7 +886,7 @@ describe('Config', () => {
       middlewareTracingEnabled: true,
       plugins: true,
       protocolVersion: '0.4',
-      tracing: true,
+      DD_TRACE_ENABLED: true,
       tags: {
         service: 'node',
       },
@@ -889,7 +902,7 @@ describe('Config', () => {
       },
       runtimeMetricsRuntimeId: false,
       sampleRate: undefined,
-      scope: undefined,
+      DD_TRACE_SCOPE: undefined,
       service: 'node',
       spanAttributeSchema: 'v0',
       spanComputePeerService: false,
@@ -906,7 +919,7 @@ describe('Config', () => {
     assert.deepStrictEqual(config.serviceMapping, {})
     assert.deepStrictEqual(config.tracePropagationStyle.extract, ['datadog', 'tracecontext', 'baggage'])
     assert.deepStrictEqual(config.tracePropagationStyle.inject, ['datadog', 'tracecontext', 'baggage'])
-    assert.strictEqual(config.queryStringObfuscation.length, 626)
+    assert.strictEqual(config.DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP.length, 626)
     assert.strictEqual(config.appsec.obfuscatorKeyRegex.length, 190)
     assert.strictEqual(config.appsec.obfuscatorValueRegex.length, 578)
 
@@ -1020,7 +1033,7 @@ describe('Config', () => {
       { name: 'DD_TRACE_AGENT_PROTOCOL_VERSION', value: '0.4', origin: 'default' },
       {
         name: 'DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP',
-        value: config.queryStringObfuscation,
+        value: config.DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP,
         origin: 'default',
       },
       { name: 'DD_REMOTE_CONFIGURATION_ENABLED', value: true, origin: 'default' },
@@ -1348,7 +1361,7 @@ describe('Config', () => {
       },
       middlewareTracingEnabled: false,
       protocolVersion: '0.5',
-      queryStringObfuscation: '.*',
+      DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP: '.*',
       remoteConfig: {
         DD_REMOTE_CONFIGURATION_ENABLED: false,
         pollInterval: 42,
@@ -1376,7 +1389,7 @@ describe('Config', () => {
       traceId128BitGenerationEnabled: true,
       traceId128BitLoggingEnabled: true,
       DD_TRACE_PROPAGATION_BEHAVIOR_EXTRACT: 'restart',
-      tracing: true,
+      DD_TRACE_ENABLED: true,
       version: '1.0.0',
     })
     assert.deepStrictEqual(config.DD_GRPC_CLIENT_ERROR_STATUSES, [3, 13, 400, 401, 402, 403])
@@ -1607,7 +1620,7 @@ describe('Config', () => {
     assert.strictEqual(config.url.toString(), 'https://agent2:7777/')
 
     assertObjectContains(config, {
-      tracing: false,
+      DD_TRACE_ENABLED: false,
       dogstatsd: {
         hostname: 'agent',
       },
@@ -3220,7 +3233,7 @@ describe('Config', () => {
         const config = getConfig()
 
         assert.strictEqual(config.url.toString(), 'http://127.0.0.1:8126/')
-        assert.strictEqual(config.DD_CIVISIBILITY_AGENTLESS_URL, undefined)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_AGENTLESS_URL, undefined)
       })
 
       it('should resolve url to the agent and expose DD_CIVISIBILITY_AGENTLESS_URL as the intake override', () => {
@@ -3230,7 +3243,7 @@ describe('Config', () => {
         const config = getConfig()
 
         assert.strictEqual(config.url.toString(), 'http://127.0.0.1:8126/')
-        assert.strictEqual(config.DD_CIVISIBILITY_AGENTLESS_URL.toString(), 'https://my-intake.example/')
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_AGENTLESS_URL.toString(), 'https://my-intake.example/')
       })
     })
 
@@ -3319,7 +3332,7 @@ describe('Config', () => {
         } else {
           assert.strictEqual(config.url.toString(), 'unix:///var/run/datadog/apm.socket')
         }
-        assert.strictEqual(config.DD_CIVISIBILITY_AGENTLESS_URL, undefined)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_AGENTLESS_URL, undefined)
       })
     })
   })
@@ -3345,30 +3358,30 @@ describe('Config', () => {
       })
       it('should activate git upload by default', () => {
         const config = getConfig(options)
-        assert.strictEqual(config.isGitUploadEnabled, true)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_GIT_UPLOAD_ENABLED, true)
       })
       it('should disable git upload if the DD_CIVISIBILITY_GIT_UPLOAD_ENABLED is set to false', () => {
         process.env.DD_CIVISIBILITY_GIT_UPLOAD_ENABLED = 'false'
         const config = getConfig(options)
-        assert.strictEqual(config.isGitUploadEnabled, false)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_GIT_UPLOAD_ENABLED, false)
       })
       it('should activate ITR by default', () => {
         const config = getConfig(options)
-        assert.strictEqual(config.isIntelligentTestRunnerEnabled, true)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_ITR_ENABLED, true)
       })
       it('should disable ITR if DD_CIVISIBILITY_ITR_ENABLED is set to false', () => {
         process.env.DD_CIVISIBILITY_ITR_ENABLED = 'false'
         const config = getConfig(options)
-        assert.strictEqual(config.isIntelligentTestRunnerEnabled, false)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_ITR_ENABLED, false)
       })
       it('should enable manual testing API by default', () => {
         const config = getConfig(options)
-        assert.strictEqual(config.DD_CIVISIBILITY_MANUAL_API_ENABLED, true)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_MANUAL_API_ENABLED, true)
       })
       it('should disable manual testing API if DD_CIVISIBILITY_MANUAL_API_ENABLED is set to false', () => {
         process.env.DD_CIVISIBILITY_MANUAL_API_ENABLED = 'false'
         const config = getConfig(options)
-        assert.strictEqual(config.DD_CIVISIBILITY_MANUAL_API_ENABLED, false)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_MANUAL_API_ENABLED, false)
       })
       it('should disable memcached command tagging by default', () => {
         const config = getConfig(options)
@@ -3385,40 +3398,40 @@ describe('Config', () => {
       })
       it('should enable early flake detection by default', () => {
         const config = getConfig(options)
-        assert.strictEqual(config.isEarlyFlakeDetectionEnabled, true)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED, true)
       })
       it('should disable early flake detection if DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED is false', () => {
         process.env.DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED = 'false'
         const config = getConfig(options)
-        assert.strictEqual(config.isEarlyFlakeDetectionEnabled, false)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED, false)
       })
       it('should enable flaky test retries by default', () => {
         const config = getConfig(options)
-        assert.strictEqual(config.isFlakyTestRetriesEnabled, true)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_FLAKY_RETRY_ENABLED, true)
       })
-      it('should disable flaky test retries if isFlakyTestRetriesEnabled is false', () => {
+      it('should disable flaky test retries if DD_CIVISIBILITY_FLAKY_RETRY_ENABLED is false', () => {
         process.env.DD_CIVISIBILITY_FLAKY_RETRY_ENABLED = 'false'
         const config = getConfig(options)
-        assert.strictEqual(config.isFlakyTestRetriesEnabled, false)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_FLAKY_RETRY_ENABLED, false)
       })
       it('should read DD_CIVISIBILITY_FLAKY_RETRY_COUNT if present', () => {
         process.env.DD_CIVISIBILITY_FLAKY_RETRY_COUNT = '4'
         const config = getConfig(options)
-        assert.strictEqual(config.flakyTestRetriesCount, 4)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_FLAKY_RETRY_COUNT, 4)
       })
       it('should default DD_CIVISIBILITY_FLAKY_RETRY_COUNT to 5', () => {
         const config = getConfig(options)
-        assert.strictEqual(config.flakyTestRetriesCount, 5)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_FLAKY_RETRY_COUNT, 5)
       })
       it('should round non integer values of DD_CIVISIBILITY_FLAKY_RETRY_COUNT', () => {
         process.env.DD_CIVISIBILITY_FLAKY_RETRY_COUNT = '4.1'
         const config = getConfig(options)
-        assert.strictEqual(config.flakyTestRetriesCount, 4)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_FLAKY_RETRY_COUNT, 4)
       })
       it('should set the default to DD_CIVISIBILITY_FLAKY_RETRY_COUNT if it is not a number', () => {
         process.env.DD_CIVISIBILITY_FLAKY_RETRY_COUNT = 'a'
         const config = getConfig(options)
-        assert.strictEqual(config.flakyTestRetriesCount, 5)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_FLAKY_RETRY_COUNT, 5)
       })
       it('should set the session name if DD_TEST_SESSION_NAME is set', () => {
         process.env.DD_TEST_SESSION_NAME = 'my-test-session'
@@ -3434,15 +3447,15 @@ describe('Config', () => {
         const config = getConfig(options)
         assert.strictEqual(config.DD_AGENTLESS_LOG_SUBMISSION_ENABLED, true)
       })
-      it('should set isTestDynamicInstrumentationEnabled by default', () => {
+      it('should set DD_TEST_FAILED_TEST_REPLAY_ENABLED by default', () => {
         const config = getConfig(options)
-        assert.strictEqual(config.isTestDynamicInstrumentationEnabled, true)
+        assert.strictEqual(config.testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED, true)
       })
-      it('should set isTestDynamicInstrumentationEnabled to false if DD_TEST_FAILED_TEST_REPLAY_ENABLED is false',
+      it('should set DD_TEST_FAILED_TEST_REPLAY_ENABLED to false if DD_TEST_FAILED_TEST_REPLAY_ENABLED is false',
         () => {
           process.env.DD_TEST_FAILED_TEST_REPLAY_ENABLED = 'false'
           const config = getConfig(options)
-          assert.strictEqual(config.isTestDynamicInstrumentationEnabled, false)
+          assert.strictEqual(config.testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED, false)
         })
     })
     context('ci visibility mode is not enabled', () => {
@@ -3452,8 +3465,10 @@ describe('Config', () => {
         const config = getConfig(options)
         assertObjectContains(config, {
           isCiVisibility: false,
-          isIntelligentTestRunnerEnabled: true,
-          isGitUploadEnabled: true,
+          testOptimization: {
+            DD_CIVISIBILITY_ITR_ENABLED: true,
+            DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          },
         })
       })
     })
@@ -3461,7 +3476,7 @@ describe('Config', () => {
     it('should accept all values for DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER', () => {
       for (const provider of ['github', 'gitlab', 'circleci', 'jenkins']) {
         process.env.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER = provider
-        assert.strictEqual(getConfig(options).DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER, provider)
+        assert.strictEqual(getConfig(options).testOptimization.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER, provider)
       }
     })
 
@@ -3988,7 +4003,7 @@ apm_configuration_default:
 `)
       let config = getConfig()
       assertObjectContains(config, {
-        apiKey: 'local-api-key',
+        DD_API_KEY: 'local-api-key',
         DD_APP_KEY: 'local-app-key',
         DD_INSTRUMENTATION_INSTALL_ID: 'local-install-id',
         DD_INSTRUMENTATION_INSTALL_TIME: '1234567890',
@@ -4006,7 +4021,7 @@ apm_configuration_default:
       process.env.DD_TRACE_CLOUD_PAYLOAD_TAGGING_MAX_DEPTH = '7'
       config = getConfig()
       assertObjectContains(config, {
-        apiKey: 'env-api-key',
+        DD_API_KEY: 'env-api-key',
         DD_APP_KEY: 'env-app-key',
         DD_INSTRUMENTATION_INSTALL_ID: 'env-install-id',
         cloudPayloadTagging: {
@@ -4036,7 +4051,7 @@ rules:
 `)
       config = getConfig()
       assertObjectContains(config, {
-        apiKey: 'fleet-api-key',
+        DD_API_KEY: 'fleet-api-key',
         DD_APP_KEY: 'fleet-app-key',
         DD_INSTRUMENTATION_INSTALL_ID: 'fleet-install-id',
         DD_INSTRUMENTATION_INSTALL_TIME: '9999999999',
@@ -4076,60 +4091,60 @@ rules:
 
     it('should be false by default', () => {
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should be enabled when DD_TRACE_RESOURCE_RENAMING_ENABLED is true', () => {
       process.env.DD_TRACE_RESOURCE_RENAMING_ENABLED = 'true'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, true)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, true)
     })
 
     it('should be disabled when DD_TRACE_RESOURCE_RENAMING_ENABLED is false', () => {
       process.env.DD_TRACE_RESOURCE_RENAMING_ENABLED = 'false'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should be enabled when appsec is enabled via env var', () => {
       process.env.DD_APPSEC_ENABLED = 'true'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, true)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, true)
     })
 
     it('should be enabled when appsec is enabled via options', () => {
       const config = getConfig({ appsec: { enabled: true } })
-      assert.strictEqual(config.resourceRenamingEnabled, true)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, true)
     })
 
     it('should prioritize DD_TRACE_RESOURCE_RENAMING_ENABLED over appsec setting', () => {
       process.env.DD_APPSEC_ENABLED = 'true'
       process.env.DD_TRACE_RESOURCE_RENAMING_ENABLED = 'false'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should prioritize DD_TRACE_RESOURCE_RENAMING_ENABLED over appsec option', () => {
       process.env.DD_TRACE_RESOURCE_RENAMING_ENABLED = 'false'
       const config = getConfig({ appsec: { enabled: true } })
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should enable when appsec is enabled via both env and options', () => {
       process.env.DD_APPSEC_ENABLED = 'true'
       const config = getConfig({ appsec: { enabled: true } })
-      assert.strictEqual(config.resourceRenamingEnabled, true)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, true)
     })
 
     it('should remain false when appsec is disabled', () => {
       process.env.DD_APPSEC_ENABLED = 'false'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should remain false when appsec is disabled via options', () => {
       const config = getConfig({ appsec: { enabled: false } })
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
   })
 
@@ -4300,60 +4315,60 @@ rules:
 
     it('should be false by default', () => {
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should be enabled when DD_TRACE_RESOURCE_RENAMING_ENABLED is true', () => {
       process.env.DD_TRACE_RESOURCE_RENAMING_ENABLED = 'true'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, true)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, true)
     })
 
     it('should be disabled when DD_TRACE_RESOURCE_RENAMING_ENABLED is false', () => {
       process.env.DD_TRACE_RESOURCE_RENAMING_ENABLED = 'false'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should be enabled when appsec is enabled via env var', () => {
       process.env.DD_APPSEC_ENABLED = 'true'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, true)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, true)
     })
 
     it('should be enabled when appsec is enabled via options', () => {
       const config = getConfig({ appsec: { enabled: true } })
-      assert.strictEqual(config.resourceRenamingEnabled, true)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, true)
     })
 
     it('should prioritize DD_TRACE_RESOURCE_RENAMING_ENABLED over appsec setting', () => {
       process.env.DD_APPSEC_ENABLED = 'true'
       process.env.DD_TRACE_RESOURCE_RENAMING_ENABLED = 'false'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should prioritize DD_TRACE_RESOURCE_RENAMING_ENABLED over appsec option', () => {
       process.env.DD_TRACE_RESOURCE_RENAMING_ENABLED = 'false'
       const config = getConfig({ appsec: { enabled: true } })
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should enable when appsec is enabled via both env and options', () => {
       process.env.DD_APPSEC_ENABLED = 'true'
       const config = getConfig({ appsec: { enabled: true } })
-      assert.strictEqual(config.resourceRenamingEnabled, true)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, true)
     })
 
     it('should remain false when appsec is disabled', () => {
       process.env.DD_APPSEC_ENABLED = 'false'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should remain false when appsec is disabled via options', () => {
       const config = getConfig({ appsec: { enabled: false } })
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
   })
 
@@ -4420,12 +4435,12 @@ rules:
       assert.strictEqual(config.logInjection, false)
     })
 
-    it('should map tracing_enabled to tracing', () => {
+    it('should map tracing_enabled to DD_TRACE_ENABLED', () => {
       // Tracing is not exposed as programmatic option and will be ignored.
       const config = getConfig({ tracing: false })
-      assert.strictEqual(config.tracing, true)
-      config.setRemoteConfig({ tracing: false })
-      assert.strictEqual(config.tracing, false)
+      assert.strictEqual(config.DD_TRACE_ENABLED, true)
+      config.setRemoteConfig({ DD_TRACE_ENABLED: false })
+      assert.strictEqual(config.DD_TRACE_ENABLED, false)
     })
 
     it('should map tracing_sampling_rules to samplingRules', () => {
@@ -4465,15 +4480,15 @@ rules:
       const config = getConfig({ logInjection: true, sampleRate: 0.5 })
 
       assertObjectContains(config, {
-        tracing: true,
+        DD_TRACE_ENABLED: true,
         logInjection: true,
         sampleRate: 0.5,
       })
 
-      config.setRemoteConfig({ tracing: false })
+      config.setRemoteConfig({ DD_TRACE_ENABLED: false })
 
       assertObjectContains(config, {
-        tracing: false,
+        DD_TRACE_ENABLED: false,
         logInjection: true,
         sampleRate: 0.5,
       })
@@ -4481,7 +4496,7 @@ rules:
       config.setRemoteConfig(null)
 
       assertObjectContains(config, {
-        tracing: true,
+        DD_TRACE_ENABLED: true,
         logInjection: true,
         sampleRate: 0.5,
       })
@@ -4496,14 +4511,14 @@ rules:
     it('should treat null values as unset', () => {
       const config = getConfig({ sampleRate: 0.5, tracing: true })
       assert.strictEqual(config.sampleRate, 0.5)
-      assert.strictEqual(config.tracing, true)
-      config.setRemoteConfig({ sampleRate: 0.8, tracing: false })
+      assert.strictEqual(config.DD_TRACE_ENABLED, true)
+      config.setRemoteConfig({ sampleRate: 0.8, DD_TRACE_ENABLED: false })
       assert.strictEqual(config.sampleRate, 0.8)
-      assert.strictEqual(config.tracing, false)
+      assert.strictEqual(config.DD_TRACE_ENABLED, false)
       assert.strictEqual(config.logInjection, true)
       config.setRemoteConfig({ logInjection: false })
       assert.strictEqual(config.sampleRate, 0.5)
-      assert.strictEqual(config.tracing, true)
+      assert.strictEqual(config.DD_TRACE_ENABLED, true)
       assert.strictEqual(config.logInjection, false)
     })
 
@@ -4560,20 +4575,20 @@ rules:
       updateConfig.resetHistory()
 
       config.setRemoteConfig({
-        tracing: false,
+        DD_TRACE_ENABLED: false,
         sampleRate: 0.8,
       })
 
-      assert.strictEqual(config.getOrigin('tracing'), 'remote_config')
+      assert.strictEqual(config.getOrigin('DD_TRACE_ENABLED'), 'remote_config')
       assert.strictEqual(config.getOrigin('sampleRate'), 'remote_config')
 
       config.setRemoteConfig({
         sampleRate: 0.8,
       })
 
-      assert.strictEqual(config.tracing, true)
+      assert.strictEqual(config.DD_TRACE_ENABLED, true)
       assert.strictEqual(config.sampleRate, 0.8)
-      assert.strictEqual(config.getOrigin('tracing'), 'default')
+      assert.strictEqual(config.getOrigin('DD_TRACE_ENABLED'), 'default')
       assert.strictEqual(config.getOrigin('sampleRate'), 'remote_config')
     })
 
@@ -4583,7 +4598,7 @@ rules:
       updateConfig.resetHistory()
 
       config.setRemoteConfig({
-        tracing: false,
+        DD_TRACE_ENABLED: false,
         sampleRate: 0.1,
       })
       config.setRemoteConfig({
@@ -4606,30 +4621,30 @@ rules:
       const config = getConfig()
 
       assertObjectContains(config, {
-        tracing: true,
+        DD_TRACE_ENABLED: true,
         logInjection: true,
       })
 
       assert.strictEqual(config.sampleRate, undefined)
 
       config.setRemoteConfig({
-        tracing: true,
+        DD_TRACE_ENABLED: true,
         logInjection: false,
         sampleRate: 0.8,
       })
 
       assertObjectContains(config, {
-        tracing: true,
+        DD_TRACE_ENABLED: true,
         logInjection: false,
         sampleRate: 0.8,
       })
 
       config.setRemoteConfig({
-        tracing: false,
+        DD_TRACE_ENABLED: false,
       })
 
       assertObjectContains(config, {
-        tracing: false,
+        DD_TRACE_ENABLED: false,
         logInjection: true,
       })
       assert.strictEqual(config.sampleRate, undefined)
diff --git a/packages/dd-trace/test/exporters/agentless/writer.spec.js b/packages/dd-trace/test/exporters/agentless/writer.spec.js
index 75d135f3c5..4e6b2cdb1d 100644
--- a/packages/dd-trace/test/exporters/agentless/writer.spec.js
+++ b/packages/dd-trace/test/exporters/agentless/writer.spec.js
@@ -53,7 +53,7 @@ describe('AgentlessWriter', () => {
       '../../encode/agentless-json': { AgentlessJSONEncoder },
       '../../../../../package.json': { version: 'tracerVersion' },
       '../../log': log,
-      '../../config': () => ({ apiKey }),
+      '../../config': () => ({ DD_API_KEY: apiKey }),
     })
   })
 
diff --git a/packages/dd-trace/test/llmobs/index.spec.js b/packages/dd-trace/test/llmobs/index.spec.js
index 7fd14e5a9f..e818bbff63 100644
--- a/packages/dd-trace/test/llmobs/index.spec.js
+++ b/packages/dd-trace/test/llmobs/index.spec.js
@@ -230,7 +230,7 @@ describe('module', () => {
           llmobs: {
             agentlessEnabled: true,
           },
-          apiKey: 'test',
+          DD_API_KEY: 'test',
           site: 'datadoghq.com',
         })
 
@@ -285,7 +285,7 @@ describe('module', () => {
         it('configures the agentless writers', () => {
           llmobsModule.enable({
             llmobs: {},
-            apiKey: 'test',
+            DD_API_KEY: 'test',
             site: 'datadoghq.com',
           })
 
@@ -327,7 +327,7 @@ describe('module', () => {
 
       describe('when no site is provided', () => {
         it('throws an error', () => {
-          llmobsModule.enable({ llmobs: {}, apiKey: 'test', startupLogs: true })
+          llmobsModule.enable({ llmobs: {}, DD_API_KEY: 'test', startupLogs: true })
 
           sinon.assert.calledWith(startupLogStub, INCOMPATIBLE_INITIALIZATION)
         })
@@ -335,7 +335,7 @@ describe('module', () => {
 
       describe('when an API key is provided', () => {
         it('configures the agentless writers', () => {
-          llmobsModule.enable({ llmobs: {}, apiKey: 'test', site: 'datadoghq.com' })
+          llmobsModule.enable({ llmobs: {}, DD_API_KEY: 'test', site: 'datadoghq.com' })
 
           sinon.assert.calledWith(LLMObsSpanWriterSpy().setAgentless, true)
           sinon.assert.calledWith(LLMObsEvalMetricsWriterSpy().setAgentless, true)
diff --git a/packages/dd-trace/test/llmobs/sdk/index.spec.js b/packages/dd-trace/test/llmobs/sdk/index.spec.js
index 4ea62a887c..d023fe94ac 100644
--- a/packages/dd-trace/test/llmobs/sdk/index.spec.js
+++ b/packages/dd-trace/test/llmobs/sdk/index.spec.js
@@ -1411,8 +1411,8 @@ describe('sdk', () => {
     let originalApiKey
 
     before(() => {
-      originalApiKey = tracer._tracer._config.apiKey
-      tracer._tracer._config.apiKey = 'test'
+      originalApiKey = tracer._tracer._config.DD_API_KEY
+      tracer._tracer._config.DD_API_KEY = 'test'
     })
 
     beforeEach(() => {
@@ -1423,7 +1423,7 @@ describe('sdk', () => {
     })
 
     after(() => {
-      tracer._tracer._config.apiKey = originalApiKey
+      tracer._tracer._config.DD_API_KEY = originalApiKey
     })
 
     it('does not submit an evaluation if llmobs is disabled', () => {
diff --git a/packages/dd-trace/test/llmobs/writers/base.spec.js b/packages/dd-trace/test/llmobs/writers/base.spec.js
index 57d664a50c..e603296bdb 100644
--- a/packages/dd-trace/test/llmobs/writers/base.spec.js
+++ b/packages/dd-trace/test/llmobs/writers/base.spec.js
@@ -43,7 +43,7 @@ describe('BaseLLMObsWriter', () => {
       config: {
         site: 'site.com',
         url: new URL('http://localhost:8126'),
-        apiKey: 'test',
+        DD_API_KEY: 'test',
       },
     }
   })
diff --git a/packages/dd-trace/test/llmobs/writers/evaluations.spec.js b/packages/dd-trace/test/llmobs/writers/evaluations.spec.js
index aea247a426..7d863792e6 100644
--- a/packages/dd-trace/test/llmobs/writers/evaluations.spec.js
+++ b/packages/dd-trace/test/llmobs/writers/evaluations.spec.js
@@ -45,7 +45,7 @@ describe('LLMObsEvalMetricsWriter', () => {
   it('builds the payload correctly', () => {
     writer = new LLMObsEvalMetricsWriter({
       site: 'datadoghq.com',
-      apiKey: 'test',
+      DD_API_KEY: 'test',
     })
     writer.setAgentless(true)
 
diff --git a/packages/dd-trace/test/llmobs/writers/multi-tenant.spec.js b/packages/dd-trace/test/llmobs/writers/multi-tenant.spec.js
index 5d5b52da06..8bb17755de 100644
--- a/packages/dd-trace/test/llmobs/writers/multi-tenant.spec.js
+++ b/packages/dd-trace/test/llmobs/writers/multi-tenant.spec.js
@@ -21,7 +21,7 @@ describe('Multi-Tenant Routing', () => {
     site: 'default-site.com',
     hostname: 'localhost',
     port: 8126,
-    apiKey: 'default-key',
+    DD_API_KEY: 'default-key',
   }
 
   beforeEach(() => {
diff --git a/packages/dd-trace/test/plugin_manager.spec.js b/packages/dd-trace/test/plugin_manager.spec.js
index 16b95b7bf8..409644f87e 100644
--- a/packages/dd-trace/test/plugin_manager.spec.js
+++ b/packages/dd-trace/test/plugin_manager.spec.js
@@ -29,6 +29,9 @@ describe('Plugin Manager', () => {
       plugins: true,
       spanAttributeSchema: 'v0',
       spanRemoveIntegrationFromService: false,
+      // The real tracer Config always carries the testOptimization namespace;
+      // #getSharedConfig reads it, so the stand-in must provide it too.
+      testOptimization: {},
       ...overrides,
     }
   }
@@ -368,7 +371,7 @@ describe('Plugin Manager', () => {
       pm.configure(makeTracerConfig({
         serviceMapping: { two: 'deux' },
         logInjection: true,
-        queryStringObfuscation: '.*',
+        DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP: '.*',
         clientIpEnabled: true,
       }))
       loadChannel.publish({ name: 'two' })
diff --git a/packages/dd-trace/test/proxy.spec.js b/packages/dd-trace/test/proxy.spec.js
index c272725515..3389365825 100644
--- a/packages/dd-trace/test/proxy.spec.js
+++ b/packages/dd-trace/test/proxy.spec.js
@@ -145,7 +145,8 @@ describe('TracerProxy', () => {
     NoopDogStatsDClient = sinon.stub().returns(noopDogStatsDClient)
 
     config = {
-      tracing: true,
+      DD_TRACE_ENABLED: true,
+      testOptimization: {},
       experimental: {
         flaggingProvider: {},
         aiguard: {
@@ -294,7 +295,7 @@ describe('TracerProxy', () => {
       })
 
       it('should not initialize when disabled', () => {
-        config.tracing = false
+        config.DD_TRACE_ENABLED = false
 
         proxy.init()
 
@@ -411,12 +412,12 @@ describe('TracerProxy', () => {
         sinon.assert.notCalled(appsec.enable)
         sinon.assert.notCalled(iast.enable)
 
-        let conf = { tracing: false }
+        let conf = { DD_TRACE_ENABLED: false }
         handlers.get('APM_TRACING')(createApmTracingTransaction('test-config-1', conf))
         sinon.assert.notCalled(appsec.disable)
         sinon.assert.notCalled(iast.disable)
 
-        conf = { tracing: true }
+        conf = { DD_TRACE_ENABLED: true }
         handlers.get('APM_TRACING')(createApmTracingTransaction('test-config-1', conf, 'modify'))
         sinon.assert.calledOnce(DatadogTracer)
         sinon.assert.calledOnce(AppsecSdk)
@@ -438,7 +439,7 @@ describe('TracerProxy', () => {
         config.appsec.enabled = true
         config.iast.enabled = true
         config.setRemoteConfig = conf => {
-          config.tracing = conf.tracing
+          config.DD_TRACE_ENABLED = conf.DD_TRACE_ENABLED
         }
 
         const remoteConfigProxy = new RemoteConfigProxy()
@@ -447,12 +448,12 @@ describe('TracerProxy', () => {
         sinon.assert.calledOnceWithExactly(appsec.enable, config)
         sinon.assert.calledOnceWithExactly(iast.enable, config, tracer)
 
-        let conf = { tracing: false }
+        let conf = { DD_TRACE_ENABLED: false }
         handlers.get('APM_TRACING')(createApmTracingTransaction('test-config-2', conf))
         sinon.assert.called(appsec.disable)
         sinon.assert.called(iast.disable)
 
-        conf = { tracing: true }
+        conf = { DD_TRACE_ENABLED: true }
         handlers.get('APM_TRACING')(createApmTracingTransaction('test-config-2', conf, 'modify'))
         sinon.assert.calledTwice(appsec.enable)
         sinon.assert.calledWithExactly(appsec.enable.secondCall, config)
diff --git a/packages/dd-trace/test/span_processor.spec.js b/packages/dd-trace/test/span_processor.spec.js
index 344c6532b8..ccf712ec4e 100644
--- a/packages/dd-trace/test/span_processor.spec.js
+++ b/packages/dd-trace/test/span_processor.spec.js
@@ -166,7 +166,7 @@ describe('SpanProcessor', () => {
 
   it('should erase the trace and stop execution when tracing=false', () => {
     const config = {
-      tracing: false,
+      DD_TRACE_ENABLED: false,
       stats: {
         DD_TRACE_STATS_COMPUTATION_ENABLED: false,
       },
diff --git a/packages/dd-trace/test/telemetry/send-data.spec.js b/packages/dd-trace/test/telemetry/send-data.spec.js
index b06416a378..aefe0dced3 100644
--- a/packages/dd-trace/test/telemetry/send-data.spec.js
+++ b/packages/dd-trace/test/telemetry/send-data.spec.js
@@ -161,7 +161,7 @@ describe('sendData', () => {
     sendDataModule.sendData(
       {
         isCiVisibility: true,
-        DD_CIVISIBILITY_AGENTLESS_ENABLED: true,
+        testOptimization: { DD_CIVISIBILITY_AGENTLESS_ENABLED: true },
         tags: { 'runtime-id': '123' },
         site: 'datadoghq.eu',
       },
@@ -184,8 +184,10 @@ describe('sendData', () => {
     sendDataModule.sendData(
       {
         isCiVisibility: true,
-        DD_CIVISIBILITY_AGENTLESS_ENABLED: true,
-        DD_CIVISIBILITY_AGENTLESS_URL: new URL('https://my-intake.example/'),
+        testOptimization: {
+          DD_CIVISIBILITY_AGENTLESS_ENABLED: true,
+          DD_CIVISIBILITY_AGENTLESS_URL: new URL('https://my-intake.example/'),
+        },
         tags: { 'runtime-id': '123' },
         site: 'datadoghq.eu',
       },
@@ -205,7 +207,7 @@ describe('sendData', () => {
 
     sendDataModule.sendData(
       {
-        apiKey: 'secret-key',
+        DD_API_KEY: 'secret-key',
         site: 'datadoghq.eu',
         tags: { 'runtime-id': '123' },
       },
@@ -225,7 +227,7 @@ describe('sendData', () => {
 
     sendDataModule.sendData(
       {
-        apiKey: 'secret-key',
+        DD_API_KEY: 'secret-key',
         site: 'x:notaport',
         tags: { 'runtime-id': '123' },
       },

From 0395404c94d5bf7bcfea363b46cfec665ec8d938 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Kay?=
 <92582590+cbasitodx@users.noreply.github.com>
Date: Mon, 29 Jun 2026 16:23:56 +0200
Subject: [PATCH 16/51] feat(test optimization) Add Test Optimization HTTP
 cache reader (#8860)

---
 .../early-flake-detection/get-known-tests.js  |  21 +-
 .../exporters/ci-visibility-exporter.js       |  42 +-
 .../get-skippable-suites.js                   |  67 +-
 .../requests/get-library-configuration.js     | 113 ++--
 .../get-test-management-tests.js              |  22 +-
 .../test-optimization-http-cache-schema.js    | 128 ++++
 .../test-optimization-http-cache.js           | 287 ++++++++
 .../get-known-tests.spec.js                   |  41 +-
 .../ci-visibility-http-cache.spec.js          | 622 ++++++++++++++++++
 .../get-skippable-suites.spec.js              |  66 +-
 .../get-library-configuration.spec.js         | 156 +++++
 .../get-test-management-tests.spec.js         |  36 +
 .../test-optimization-http-cache.spec.js      | 369 +++++++++++
 13 files changed, 1887 insertions(+), 83 deletions(-)
 create mode 100644 packages/dd-trace/src/ci-visibility/test-optimization-http-cache-schema.js
 create mode 100644 packages/dd-trace/src/ci-visibility/test-optimization-http-cache.js
 create mode 100644 packages/dd-trace/test/ci-visibility/exporters/ci-visibility-http-cache.spec.js
 create mode 100644 packages/dd-trace/test/ci-visibility/requests/get-library-configuration.spec.js
 create mode 100644 packages/dd-trace/test/ci-visibility/test-optimization-http-cache.spec.js

diff --git a/packages/dd-trace/src/ci-visibility/early-flake-detection/get-known-tests.js b/packages/dd-trace/src/ci-visibility/early-flake-detection/get-known-tests.js
index 13c789c10f..6f5fa560ab 100644
--- a/packages/dd-trace/src/ci-visibility/early-flake-detection/get-known-tests.js
+++ b/packages/dd-trace/src/ci-visibility/early-flake-detection/get-known-tests.js
@@ -17,6 +17,7 @@ const {
 
 const { getNumFromKnownTests } = require('../../plugins/util/test')
 const { buildCacheKey, writeToCache, withCache } = require('../requests/fs-cache')
+const { validateKnownTestsResponse } = require('../test-optimization-http-cache-schema')
 
 const MAX_KNOWN_TESTS_PAGES = 10_000
 
@@ -52,6 +53,19 @@ function mergeKnownTests (aggregate, page) {
   return aggregate
 }
 
+function parseJsonResponse (rawJson) {
+  return typeof rawJson === 'string' ? JSON.parse(rawJson) : rawJson
+}
+
+function parseKnownTestsResponse (rawJson, options = {}) {
+  const parsedResponse = parseJsonResponse(rawJson)
+  if (options.validateRequiredFields) {
+    validateKnownTestsResponse(parsedResponse)
+  }
+  const { data: { attributes: { tests } } } = parsedResponse
+  return tests
+}
+
 function getKnownTests ({
   url,
   isEvpProxy,
@@ -211,8 +225,9 @@ function fetchFromApi ({
       try {
         totalResponseBytes += res.length
 
-        const { data: { attributes } } = JSON.parse(res)
-        const { tests: pageTests, page_info: responsePageInfo } = attributes
+        const parsedResponse = parseJsonResponse(res)
+        const pageTests = parseKnownTestsResponse(parsedResponse)
+        const { page_info: responsePageInfo } = parsedResponse.data.attributes
 
         aggregateTests = mergeKnownTests(aggregateTests, pageTests)
 
@@ -251,4 +266,4 @@ function fetchFromApi ({
   fetchPage(null)
 }
 
-module.exports = { getKnownTests }
+module.exports = { getKnownTests, parseKnownTestsResponse }
diff --git a/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js b/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js
index 885d58850d..7b3a0cf636 100644
--- a/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js
+++ b/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js
@@ -7,6 +7,8 @@ const { getSkippableSuites: getSkippableSuitesRequest } = require('../intelligen
 const { getKnownTests: getKnownTestsRequest } = require('../early-flake-detection/get-known-tests')
 const { getTestManagementTests: getTestManagementTestsRequest } =
   require('../test-management/get-test-management-tests')
+const { writeSettingsToCache } = require('../test-optimization-cache')
+const { CACHE_MISS, TestOptimizationHttpCache } = require('../test-optimization-http-cache')
 const { uploadCoverageReport: uploadCoverageReportRequest } = require('../requests/upload-coverage-report')
 const log = require('../../log')
 const BufferingExporter = require('../../exporters/common/buffering-exporter')
@@ -42,6 +44,7 @@ class CiVisibilityExporter extends BufferingExporter {
     this._coverageTimer = undefined
     this._logsTimer = undefined
     this._coverageBuffer = []
+    this._testOptimizationHttpCache = new TestOptimizationHttpCache()
     // The library can use new features like ITR and test suite level visibility
     // AKA CI Vis Protocol
     this._canUseCiVisProtocol = false
@@ -133,11 +136,21 @@ class CiVisibilityExporter extends BufferingExporter {
     if (!this.shouldRequestSkippableSuites()) {
       return callback(null, [])
     }
+    const requestConfiguration = this.getRequestConfiguration(testConfiguration)
+    const cachedSkippableSuites = this._testOptimizationHttpCache.readSkippableSuites({
+      testLevel: requestConfiguration.testLevel,
+      isCoverageReportUploadEnabled: requestConfiguration.isCoverageReportUploadEnabled,
+    })
+    if (cachedSkippableSuites !== CACHE_MISS) {
+      const { skippableSuites, correlationId, coverage } = cachedSkippableSuites
+      return callback(null, skippableSuites, correlationId, coverage)
+    }
+
     this._gitUploadPromise.then(gitUploadError => {
       if (gitUploadError) {
         return callback(gitUploadError, [])
       }
-      getSkippableSuitesRequest(this.getRequestConfiguration(testConfiguration), callback)
+      getSkippableSuitesRequest(requestConfiguration, callback)
     })
   }
 
@@ -145,6 +158,10 @@ class CiVisibilityExporter extends BufferingExporter {
     if (!this.shouldRequestKnownTests()) {
       return callback(null)
     }
+    const cachedKnownTests = this._testOptimizationHttpCache.readKnownTests()
+    if (cachedKnownTests !== CACHE_MISS) {
+      return callback(null, cachedKnownTests)
+    }
     getKnownTestsRequest(this.getRequestConfiguration(testConfiguration), callback)
   }
 
@@ -152,6 +169,10 @@ class CiVisibilityExporter extends BufferingExporter {
     if (!this.shouldRequestTestManagementTests()) {
       return callback(null)
     }
+    const cachedTestManagementTests = this._testOptimizationHttpCache.readTestManagementTests()
+    if (cachedTestManagementTests !== CACHE_MISS) {
+      return callback(null, cachedTestManagementTests)
+    }
     getTestManagementTestsRequest(this.getRequestConfiguration(testConfiguration), callback)
   }
 
@@ -161,13 +182,30 @@ class CiVisibilityExporter extends BufferingExporter {
    */
   getLibraryConfiguration (testConfiguration, callback) {
     const { repositoryUrl } = testConfiguration
-    this.sendGitMetadata(repositoryUrl)
     this._canUseCiVisProtocolPromise.then((canUseCiVisProtocol) => {
       if (!canUseCiVisProtocol) {
         return callback(null, {})
       }
       const configuration = this.getRequestConfiguration(testConfiguration)
+      const cachedLibraryConfig = this._testOptimizationHttpCache.readSettings()
+      if (cachedLibraryConfig !== CACHE_MISS) {
+        log.debug('Test Optimization HTTP cache settings found, skipping settings request')
+        writeSettingsToCache(cachedLibraryConfig)
+        this._libraryConfig = this.filterConfiguration(cachedLibraryConfig)
+        const canUseCachedSkippableSuites = !this.shouldRequestSkippableSuites() ||
+          this._testOptimizationHttpCache.hasValidSkippableSuites({
+            testLevel: configuration.testLevel,
+            isCoverageReportUploadEnabled: configuration.isCoverageReportUploadEnabled,
+          })
+        if (this._libraryConfig.requireGit && !canUseCachedSkippableSuites) {
+          this.sendGitMetadata(repositoryUrl)
+        } else {
+          this._resolveGit()
+        }
+        return callback(null, this._libraryConfig)
+      }
 
+      this.sendGitMetadata(repositoryUrl)
       getLibraryConfigurationRequest(configuration, (err, libraryConfig) => {
         /**
          * **Important**: this._libraryConfig remains empty in testing frameworks
diff --git a/packages/dd-trace/src/ci-visibility/intelligent-test-runner/get-skippable-suites.js b/packages/dd-trace/src/ci-visibility/intelligent-test-runner/get-skippable-suites.js
index 31498824eb..1402f34346 100644
--- a/packages/dd-trace/src/ci-visibility/intelligent-test-runner/get-skippable-suites.js
+++ b/packages/dd-trace/src/ci-visibility/intelligent-test-runner/get-skippable-suites.js
@@ -14,6 +14,42 @@ const {
   TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_BYTES,
 } = require('../../ci-visibility/telemetry')
 const { buildCacheKey, writeToCache, withCache } = require('../requests/fs-cache')
+const { validateSkippableTestsResponse } = require('../test-optimization-http-cache-schema')
+
+function parseJsonResponse (rawJson) {
+  return typeof rawJson === 'string' ? JSON.parse(rawJson) : rawJson
+}
+
+function parseSkippableSuitesResponse (
+  rawJson,
+  { testLevel = 'suite', isCoverageReportUploadEnabled = false, validateRequiredFields = false } = {}
+) {
+  const parsedResponse = parseJsonResponse(rawJson)
+  if (validateRequiredFields) {
+    validateSkippableTestsResponse(parsedResponse)
+  }
+  const coverage = parsedResponse.meta?.coverage || {}
+
+  const skippableItems = parsedResponse
+    .data
+    .filter(({ type }) => type === testLevel)
+  const skippableSuites = []
+  for (const {
+    attributes: {
+      suite,
+      name,
+      _is_missing_line_code_coverage: isMissingLineCodeCoverage,
+    },
+  } of skippableItems) {
+    // Only reject candidates without backend line coverage when we need that coverage to backfill reports.
+    if (isCoverageReportUploadEnabled && isMissingLineCodeCoverage) continue
+
+    skippableSuites.push(testLevel === 'suite' ? suite : { suite, name })
+  }
+  const correlationId = parsedResponse.meta?.correlation_id
+
+  return { skippableSuites, correlationId, coverage }
+}
 
 function getSkippableSuites ({
   url,
@@ -163,26 +199,12 @@ function fetchFromApi ({
       done(err)
     } else {
       try {
-        const parsedResponse = JSON.parse(res)
-        const coverage = parsedResponse.meta?.coverage || {}
-
-        const skippableItems = parsedResponse
-          .data
-          .filter(({ type }) => type === testLevel)
-        const skippableSuites = []
-        for (const {
-          attributes: {
-            suite,
-            name,
-            _is_missing_line_code_coverage: isMissingLineCodeCoverage,
-          },
-        } of skippableItems) {
-          // Only reject candidates without backend line coverage when we need that coverage to backfill reports.
-          if (isCoverageReportUploadEnabled && isMissingLineCodeCoverage) continue
-
-          skippableSuites.push(testLevel === 'suite' ? suite : { suite, name })
-        }
-        const correlationId = parsedResponse.meta?.correlation_id
+        const parsedResponse = parseJsonResponse(res)
+        const result = parseSkippableSuitesResponse(parsedResponse, {
+          testLevel,
+          isCoverageReportUploadEnabled,
+        })
+        const skippableItems = parsedResponse.data.filter(({ type }) => type === testLevel)
         incrementCountMetric(
           testLevel === 'test'
             ? TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_TESTS
@@ -191,9 +213,8 @@ function fetchFromApi ({
           skippableItems.length
         )
         distributionMetric(TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_BYTES, {}, res.length)
-        log.debug('Number of received skippable %ss:', testLevel, skippableSuites.length)
+        log.debug('Number of received skippable %ss:', testLevel, result.skippableSuites.length)
 
-        const result = { skippableSuites, correlationId, coverage }
         writeToCache(cacheKey, result)
 
         done(null, result)
@@ -204,4 +225,4 @@ function fetchFromApi ({
   })
 }
 
-module.exports = { getSkippableSuites }
+module.exports = { getSkippableSuites, parseSkippableSuitesResponse }
diff --git a/packages/dd-trace/src/ci-visibility/requests/get-library-configuration.js b/packages/dd-trace/src/ci-visibility/requests/get-library-configuration.js
index 1a054da02c..aad4594155 100644
--- a/packages/dd-trace/src/ci-visibility/requests/get-library-configuration.js
+++ b/packages/dd-trace/src/ci-visibility/requests/get-library-configuration.js
@@ -12,12 +12,72 @@ const {
   TELEMETRY_GIT_REQUESTS_SETTINGS_RESPONSE,
 } = require('../telemetry')
 const { writeSettingsToCache } = require('../test-optimization-cache')
+const { validateSettingsResponse } = require('../test-optimization-http-cache-schema')
 const request = require('./request')
 
 const DEFAULT_EARLY_FLAKE_DETECTION_NUM_RETRIES = 2
 const DEFAULT_EARLY_FLAKE_DETECTION_SLOW_TEST_RETRIES = { '5s': 10, '10s': 5, '30s': 3, '5m': 2 }
 const DEFAULT_EARLY_FLAKE_DETECTION_ERROR_THRESHOLD = 30
 
+function parseJsonResponse (rawJson) {
+  return typeof rawJson === 'string' ? JSON.parse(rawJson) : rawJson
+}
+
+function parseLibraryConfigurationResponse (rawJson, config = getConfig(), options = {}) {
+  const parsedResponse = parseJsonResponse(rawJson)
+  if (options.validateRequiredFields) {
+    validateSettingsResponse(parsedResponse)
+  }
+  const {
+    code_coverage: isCodeCoverageEnabled,
+    tests_skipping: isSuitesSkippingEnabled,
+    itr_enabled: isItrEnabled,
+    require_git: requireGit,
+    early_flake_detection: earlyFlakeDetectionConfig,
+    flaky_test_retries_enabled: isFlakyTestRetriesEnabled,
+    di_enabled: isDiEnabled,
+    known_tests_enabled: isKnownTestsEnabled,
+    test_management: testManagementConfig,
+    impacted_tests_enabled: isImpactedTestsEnabled,
+    coverage_report_upload_enabled: isCoverageReportUploadEnabled,
+  } = parsedResponse?.data?.attributes ?? parsedResponse
+
+  const settings = {
+    isCodeCoverageEnabled,
+    isSuitesSkippingEnabled,
+    isItrEnabled,
+    requireGit,
+    isEarlyFlakeDetectionEnabled: isKnownTestsEnabled && (earlyFlakeDetectionConfig?.enabled ?? false),
+    earlyFlakeDetectionNumRetries:
+      earlyFlakeDetectionConfig?.slow_test_retries?.['5s'] || DEFAULT_EARLY_FLAKE_DETECTION_NUM_RETRIES,
+    earlyFlakeDetectionSlowTestRetries:
+      earlyFlakeDetectionConfig?.slow_test_retries ?? DEFAULT_EARLY_FLAKE_DETECTION_SLOW_TEST_RETRIES,
+    earlyFlakeDetectionFaultyThreshold:
+      earlyFlakeDetectionConfig?.faulty_session_threshold ?? DEFAULT_EARLY_FLAKE_DETECTION_ERROR_THRESHOLD,
+    isFlakyTestRetriesEnabled,
+    isDiEnabled: isDiEnabled && isFlakyTestRetriesEnabled,
+    isKnownTestsEnabled,
+    isTestManagementEnabled: (testManagementConfig?.enabled ?? false),
+    testManagementAttemptToFixRetries:
+      testManagementConfig?.attempt_to_fix_retries,
+    isImpactedTestsEnabled,
+    isCoverageReportUploadEnabled: isCoverageReportUploadEnabled ?? false,
+  }
+
+  log.debug('Remote settings: %j', settings)
+
+  if (config.testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE) {
+    settings.isCodeCoverageEnabled = true
+    log.debug('Dangerously set code coverage to true')
+  }
+  if (config.testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING) {
+    settings.isSuitesSkippingEnabled = true
+    log.debug('Dangerously set test skipping to true')
+  }
+
+  return settings
+}
+
 function getLibraryConfiguration ({
   url,
   isEvpProxy,
@@ -90,56 +150,7 @@ function getLibraryConfiguration ({
       done(err)
     } else {
       try {
-        const {
-          data: {
-            attributes: {
-              code_coverage: isCodeCoverageEnabled,
-              tests_skipping: isSuitesSkippingEnabled,
-              itr_enabled: isItrEnabled,
-              require_git: requireGit,
-              early_flake_detection: earlyFlakeDetectionConfig,
-              flaky_test_retries_enabled: isFlakyTestRetriesEnabled,
-              di_enabled: isDiEnabled,
-              known_tests_enabled: isKnownTestsEnabled,
-              test_management: testManagementConfig,
-              impacted_tests_enabled: isImpactedTestsEnabled,
-              coverage_report_upload_enabled: isCoverageReportUploadEnabled,
-            },
-          },
-        } = JSON.parse(res)
-
-        const settings = {
-          isCodeCoverageEnabled,
-          isSuitesSkippingEnabled,
-          isItrEnabled,
-          requireGit,
-          isEarlyFlakeDetectionEnabled: isKnownTestsEnabled && (earlyFlakeDetectionConfig?.enabled ?? false),
-          earlyFlakeDetectionNumRetries:
-            earlyFlakeDetectionConfig?.slow_test_retries?.['5s'] || DEFAULT_EARLY_FLAKE_DETECTION_NUM_RETRIES,
-          earlyFlakeDetectionSlowTestRetries:
-            earlyFlakeDetectionConfig?.slow_test_retries ?? DEFAULT_EARLY_FLAKE_DETECTION_SLOW_TEST_RETRIES,
-          earlyFlakeDetectionFaultyThreshold:
-            earlyFlakeDetectionConfig?.faulty_session_threshold ?? DEFAULT_EARLY_FLAKE_DETECTION_ERROR_THRESHOLD,
-          isFlakyTestRetriesEnabled,
-          isDiEnabled: isDiEnabled && isFlakyTestRetriesEnabled,
-          isKnownTestsEnabled,
-          isTestManagementEnabled: (testManagementConfig?.enabled ?? false),
-          testManagementAttemptToFixRetries:
-            testManagementConfig?.attempt_to_fix_retries,
-          isImpactedTestsEnabled,
-          isCoverageReportUploadEnabled: isCoverageReportUploadEnabled ?? false,
-        }
-
-        log.debug('Remote settings: %j', settings)
-
-        if (config.testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE) {
-          settings.isCodeCoverageEnabled = true
-          log.debug('Dangerously set code coverage to true')
-        }
-        if (config.testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING) {
-          settings.isSuitesSkippingEnabled = true
-          log.debug('Dangerously set test skipping to true')
-        }
+        const settings = parseLibraryConfigurationResponse(res, config)
 
         incrementCountMetric(TELEMETRY_GIT_REQUESTS_SETTINGS_RESPONSE, settings)
 
@@ -153,4 +164,4 @@ function getLibraryConfiguration ({
   })
 }
 
-module.exports = { getLibraryConfiguration }
+module.exports = { getLibraryConfiguration, parseLibraryConfigurationResponse }
diff --git a/packages/dd-trace/src/ci-visibility/test-management/get-test-management-tests.js b/packages/dd-trace/src/ci-visibility/test-management/get-test-management-tests.js
index e4b2b927fe..f8b9eaaf6e 100644
--- a/packages/dd-trace/src/ci-visibility/test-management/get-test-management-tests.js
+++ b/packages/dd-trace/src/ci-visibility/test-management/get-test-management-tests.js
@@ -16,6 +16,7 @@ const {
 } = require('../telemetry')
 
 const { buildCacheKey, writeToCache, withCache } = require('../requests/fs-cache')
+const { validateTestManagementTestsResponse } = require('../test-optimization-http-cache-schema')
 
 // Calculate the number of tests from the test management tests response, which has a shape like:
 // { module: { suites: { suite: { tests: { testName: { properties: {...} } } } } } }
@@ -39,6 +40,19 @@ function getNumFromTestManagementTests (testManagementTests) {
   return totalNumTests
 }
 
+function parseJsonResponse (rawJson) {
+  return typeof rawJson === 'string' ? JSON.parse(rawJson) : rawJson
+}
+
+function parseTestManagementTestsResponse (rawJson, options = {}) {
+  const parsedResponse = parseJsonResponse(rawJson)
+  if (options.validateRequiredFields) {
+    validateTestManagementTestsResponse(parsedResponse)
+  }
+  const { data: { attributes: { modules: testManagementTests } } } = parsedResponse
+  return testManagementTests
+}
+
 function getTestManagementTests ({
   url,
   isEvpProxy,
@@ -155,7 +169,7 @@ function fetchFromApi ({
       done(err)
     } else {
       try {
-        const { data: { attributes: { modules: testManagementTests } } } = JSON.parse(res)
+        const testManagementTests = parseTestManagementTestsResponse(res)
 
         const numTests = getNumFromTestManagementTests(testManagementTests)
 
@@ -174,4 +188,8 @@ function fetchFromApi ({
   })
 }
 
-module.exports = { getTestManagementTests }
+module.exports = {
+  getNumFromTestManagementTests, // Exported for later use in the cache
+  getTestManagementTests,
+  parseTestManagementTestsResponse,
+}
diff --git a/packages/dd-trace/src/ci-visibility/test-optimization-http-cache-schema.js b/packages/dd-trace/src/ci-visibility/test-optimization-http-cache-schema.js
new file mode 100644
index 0000000000..9f68258e9d
--- /dev/null
+++ b/packages/dd-trace/src/ci-visibility/test-optimization-http-cache-schema.js
@@ -0,0 +1,128 @@
+'use strict'
+
+const REQUIRED_SETTINGS_KEYS = [
+  'code_coverage',
+  'tests_skipping',
+  'itr_enabled',
+  'require_git',
+  'early_flake_detection',
+  'flaky_test_retries_enabled',
+  'di_enabled',
+  'known_tests_enabled',
+  'test_management',
+  'impacted_tests_enabled',
+  'coverage_report_upload_enabled',
+]
+
+function isObject (value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+function assertObject (value, message) {
+  if (!isObject(value)) {
+    throw new Error(message)
+  }
+}
+
+function assertHasKeys (value, keys, endpoint) {
+  for (const key of keys) {
+    if (!Object.hasOwn(value, key)) {
+      throw new Error(`Invalid ${endpoint} response: missing ${key}`)
+    }
+  }
+}
+
+function getAttributes (response, endpoint) {
+  const attributes = response?.data?.attributes
+  assertObject(attributes, `Invalid ${endpoint} response: attributes must be an object`)
+  return attributes
+}
+
+function validateSettingsResponse (response) {
+  const attributes = response?.data?.attributes ?? response
+  assertObject(attributes, 'Invalid settings response: attributes must be an object')
+  assertHasKeys(attributes, REQUIRED_SETTINGS_KEYS, 'settings')
+  assertObject(attributes.early_flake_detection, 'Invalid settings response: early_flake_detection must be an object')
+  assertObject(attributes.test_management, 'Invalid settings response: test_management must be an object')
+  assertHasKeys(attributes.early_flake_detection, ['enabled'], 'settings early_flake_detection')
+  assertHasKeys(attributes.test_management, ['enabled'], 'settings test_management')
+}
+
+function validateKnownTestsResponse (response) {
+  const attributes = getAttributes(response, 'known tests')
+  assertHasKeys(attributes, ['tests'], 'known tests')
+
+  const { tests } = attributes
+  if (tests === null) return
+  assertObject(tests, 'Invalid known tests response: tests must be an object or null')
+
+  for (const suites of Object.values(tests)) {
+    assertObject(suites, 'Invalid known tests response: module suites must be objects')
+    for (const testNames of Object.values(suites)) {
+      if (!Array.isArray(testNames)) {
+        throw new TypeError('Invalid known tests response: suite tests must be arrays')
+      }
+      for (const testName of testNames) {
+        if (typeof testName !== 'string') {
+          throw new TypeError('Invalid known tests response: test names must be strings')
+        }
+      }
+    }
+  }
+}
+
+function validateSkippableTestsResponse (response) {
+  assertObject(response, 'Invalid skippable tests response: response must be an object')
+  if (!Array.isArray(response.data)) {
+    throw new TypeError('Invalid skippable tests response: data must be an array')
+  }
+  if (response.meta !== undefined) {
+    assertObject(response.meta, 'Invalid skippable tests response: meta must be an object')
+  }
+  if (response.meta?.coverage !== undefined) {
+    assertObject(response.meta.coverage, 'Invalid skippable tests response: meta.coverage must be an object')
+  }
+  if (response.meta?.correlation_id !== undefined && typeof response.meta.correlation_id !== 'string') {
+    throw new Error('Invalid skippable tests response: meta.correlation_id must be a string')
+  }
+
+  for (const item of response.data) {
+    assertObject(item, 'Invalid skippable tests response: data entries must be objects')
+    if (typeof item.type !== 'string') {
+      throw new TypeError('Invalid skippable tests response: data entry type must be a string')
+    }
+    assertObject(item.attributes, 'Invalid skippable tests response: data entry attributes must be an object')
+    if ((item.type === 'suite' || item.type === 'test') && typeof item.attributes.suite !== 'string') {
+      throw new Error('Invalid skippable tests response: data entry suite must be a string')
+    }
+    if (item.type === 'test' && typeof item.attributes.name !== 'string') {
+      throw new Error('Invalid skippable tests response: data entry name must be a string')
+    }
+  }
+}
+
+function validateTestManagementTestsResponse (response) {
+  const attributes = getAttributes(response, 'test management tests')
+  assertHasKeys(attributes, ['modules'], 'test management tests')
+  assertObject(attributes.modules, 'Invalid test management tests response: modules must be an object')
+
+  for (const testModule of Object.values(attributes.modules)) {
+    assertObject(testModule, 'Invalid test management tests response: modules entries must be objects')
+    assertObject(testModule.suites, 'Invalid test management tests response: module suites must be objects')
+    for (const suite of Object.values(testModule.suites)) {
+      assertObject(suite, 'Invalid test management tests response: suites entries must be objects')
+      assertObject(suite.tests, 'Invalid test management tests response: suite tests must be objects')
+      for (const test of Object.values(suite.tests)) {
+        assertObject(test, 'Invalid test management tests response: tests entries must be objects')
+        assertObject(test.properties, 'Invalid test management tests response: test properties must be objects')
+      }
+    }
+  }
+}
+
+module.exports = {
+  validateKnownTestsResponse,
+  validateSettingsResponse,
+  validateSkippableTestsResponse,
+  validateTestManagementTestsResponse,
+}
diff --git a/packages/dd-trace/src/ci-visibility/test-optimization-http-cache.js b/packages/dd-trace/src/ci-visibility/test-optimization-http-cache.js
new file mode 100644
index 0000000000..a7b4ac11f5
--- /dev/null
+++ b/packages/dd-trace/src/ci-visibility/test-optimization-http-cache.js
@@ -0,0 +1,287 @@
+'use strict'
+
+const fs = require('node:fs')
+const path = require('node:path')
+
+const log = require('../log')
+const { getNumFromKnownTests } = require('../plugins/util/test')
+const { parseKnownTestsResponse } = require('./early-flake-detection/get-known-tests')
+const { parseSkippableSuitesResponse } = require('./intelligent-test-runner/get-skippable-suites')
+const { parseLibraryConfigurationResponse } = require('./requests/get-library-configuration')
+const {
+  getNumFromTestManagementTests,
+  parseTestManagementTestsResponse,
+} = require('./test-management/get-test-management-tests')
+const {
+  incrementCountMetric,
+  distributionMetric,
+  TELEMETRY_GIT_REQUESTS_SETTINGS_RESPONSE,
+  TELEMETRY_KNOWN_TESTS_RESPONSE_TESTS,
+  TELEMETRY_KNOWN_TESTS_RESPONSE_BYTES,
+  TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_SUITES,
+  TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_TESTS,
+  TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_BYTES,
+  TELEMETRY_TEST_MANAGEMENT_TESTS_RESPONSE_TESTS,
+  TELEMETRY_TEST_MANAGEMENT_TESTS_RESPONSE_BYTES,
+} = require('./telemetry')
+
+const CACHE_MISS = Symbol('test optimization http cache miss')
+
+const PLAN_FOLDER = '.testoptimization'
+const MANIFEST_FILE_NAME = 'manifest.txt'
+const SUPPORTED_MANIFEST_VERSION = '1'
+const CACHE_FOLDER_NAME = 'cache'
+const HTTP_CACHE_FOLDER_NAME = 'http'
+
+const ENV_MANIFEST_FILE = 'TEST_OPTIMIZATION_MANIFEST_FILE'
+const ENV_MANIFEST_FILE_ALIAS = 'DD_TEST_OPTIMIZATION_MANIFEST_FILE'
+const ENV_RUNFILES_DIR = 'RUNFILES_DIR'
+const ENV_RUNFILES_MANIFEST_FILE = 'RUNFILES_MANIFEST_FILE'
+const ENV_TEST_SRCDIR = 'TEST_SRCDIR'
+
+const SETTINGS_FILE_NAME = 'settings.json'
+const KNOWN_TESTS_FILE_NAME = 'known_tests.json'
+const SKIPPABLE_TESTS_FILE_NAME = 'skippable_tests.json'
+const TEST_MANAGEMENT_FILE_NAME = 'test_management.json'
+
+const RUNFILES_MANIFEST_SEPARATOR = ' '
+
+function parseManifestVersion (content) {
+  // Supported just the number version or 'version=x'
+  const version = content.replace(/^\uFEFF/, '').trim()
+  const match = version.match(/^version=(.+)$/)
+  return match ? match[1].trim() : version
+}
+
+class TestOptimizationHttpCache {
+  constructor ({ cwd = process.cwd(), env } = {}) {
+    this._cwd = cwd
+    // This cache intentionally consumes env vars that are not tracer config keys. (??)
+    // eslint-disable-next-line eslint-rules/eslint-process-env
+    this._env = env ?? process.env
+    this._manifestPath = this._resolveManifestPath()
+    this._testOptimizationPath = undefined
+    this._httpCachePath = undefined
+    this._available = false
+
+    this._buildReader()
+  }
+
+  isAvailable () {
+    return this._available
+  }
+
+  readSettings () {
+    const payload = this._readFile(SETTINGS_FILE_NAME)
+    if (payload === CACHE_MISS) {
+      this._disable()
+      return CACHE_MISS
+    }
+
+    try {
+      const settings = parseLibraryConfigurationResponse(payload, undefined, { validateRequiredFields: true })
+      incrementCountMetric(TELEMETRY_GIT_REQUESTS_SETTINGS_RESPONSE, settings)
+      return settings
+    } catch (err) {
+      this._logInvalidCacheFile(SETTINGS_FILE_NAME, err)
+      this._disable()
+      return CACHE_MISS
+    }
+  }
+
+  readKnownTests () {
+    const payload = this._readFile(KNOWN_TESTS_FILE_NAME)
+    if (payload === CACHE_MISS) return CACHE_MISS
+
+    try {
+      const knownTests = parseKnownTestsResponse(payload, { validateRequiredFields: true })
+      distributionMetric(TELEMETRY_KNOWN_TESTS_RESPONSE_TESTS, {}, getNumFromKnownTests(knownTests))
+      distributionMetric(TELEMETRY_KNOWN_TESTS_RESPONSE_BYTES, {}, payload.length)
+      return knownTests
+    } catch (err) {
+      this._logInvalidCacheFile(KNOWN_TESTS_FILE_NAME, err)
+      return CACHE_MISS
+    }
+  }
+
+  readSkippableSuites (options = {}) {
+    const payload = this._readFile(SKIPPABLE_TESTS_FILE_NAME)
+    if (payload === CACHE_MISS) return CACHE_MISS
+
+    try {
+      const parsedResponse = JSON.parse(payload)
+      const result = parseSkippableSuitesResponse(parsedResponse, { ...options, validateRequiredFields: true })
+      const testLevel = options.testLevel || 'suite'
+      const skippableItems = parsedResponse.data.filter(({ type }) => type === testLevel)
+      incrementCountMetric(
+        testLevel === 'test'
+          ? TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_TESTS
+          : TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_SUITES,
+        {},
+        skippableItems.length
+      )
+      distributionMetric(TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_BYTES, {}, payload.length)
+      return result
+    } catch (err) {
+      this._logInvalidCacheFile(SKIPPABLE_TESTS_FILE_NAME, err)
+      return CACHE_MISS
+    }
+  }
+
+  hasValidSkippableSuites (options = {}) {
+    const payload = this._readFile(SKIPPABLE_TESTS_FILE_NAME)
+    if (payload === CACHE_MISS) return false
+
+    try {
+      parseSkippableSuitesResponse(JSON.parse(payload), { ...options, validateRequiredFields: true })
+      return true
+    } catch {
+      return false
+    }
+  }
+
+  readTestManagementTests () {
+    const payload = this._readFile(TEST_MANAGEMENT_FILE_NAME)
+    if (payload === CACHE_MISS) return CACHE_MISS
+
+    try {
+      const testManagementTests = parseTestManagementTestsResponse(payload, { validateRequiredFields: true })
+      distributionMetric(
+        TELEMETRY_TEST_MANAGEMENT_TESTS_RESPONSE_TESTS,
+        {},
+        getNumFromTestManagementTests(testManagementTests)
+      )
+      distributionMetric(TELEMETRY_TEST_MANAGEMENT_TESTS_RESPONSE_BYTES, {}, payload.length)
+      return testManagementTests
+    } catch (err) {
+      this._logInvalidCacheFile(TEST_MANAGEMENT_FILE_NAME, err)
+      return CACHE_MISS
+    }
+  }
+
+  _buildReader () {
+    if (!this._manifestPath) {
+      log.debug('Test Optimization HTTP cache manifest not found')
+      return
+    }
+
+    const version = this._readManifestVersion(this._manifestPath)
+    if (version !== SUPPORTED_MANIFEST_VERSION) {
+      log.debug('Unsupported Test Optimization HTTP cache manifest version %j at %s', version, this._manifestPath)
+      return
+    }
+
+    this._testOptimizationPath = path.dirname(this._manifestPath)
+    this._httpCachePath = path.join(
+      this._testOptimizationPath,
+      CACHE_FOLDER_NAME,
+      HTTP_CACHE_FOLDER_NAME
+    )
+
+    const settingsPath = path.join(this._httpCachePath, SETTINGS_FILE_NAME)
+    if (!fs.existsSync(settingsPath)) {
+      log.debug('Test Optimization HTTP cache settings file not found at %s', settingsPath)
+      return
+    }
+
+    log.debug('Test Optimization HTTP cache found at %s', this._httpCachePath)
+    this._available = true
+  }
+
+  _resolveManifestPath () {
+    const localManifest = path.join(this._cwd, PLAN_FOLDER, MANIFEST_FILE_NAME)
+    if (fs.existsSync(localManifest)) {
+      return localManifest
+    }
+
+    const manifestFile = this._env[ENV_MANIFEST_FILE] || this._env[ENV_MANIFEST_FILE_ALIAS]
+    if (!manifestFile) return
+
+    const resolvedManifestPath = this._resolveRunfilePath(manifestFile)
+    if (fs.existsSync(resolvedManifestPath)) {
+      return resolvedManifestPath
+    }
+  }
+
+  _resolveRunfilePath (manifestFile) {
+    if (fs.existsSync(manifestFile)) {
+      return manifestFile
+    }
+
+    const runfilesDir = this._env[ENV_RUNFILES_DIR]
+    if (runfilesDir) {
+      const candidate = path.join(runfilesDir, manifestFile)
+      if (fs.existsSync(candidate)) {
+        return candidate
+      }
+    }
+
+    const runfilesManifestCandidate = this._resolveRunfilePathFromManifest(manifestFile)
+    if (runfilesManifestCandidate) {
+      return runfilesManifestCandidate
+    }
+
+    const testSrcdir = this._env[ENV_TEST_SRCDIR]
+    if (testSrcdir) {
+      const candidate = path.join(testSrcdir, manifestFile)
+      if (fs.existsSync(candidate)) {
+        return candidate
+      }
+    }
+
+    return manifestFile
+  }
+
+  _resolveRunfilePathFromManifest (manifestFile) {
+    const runfilesManifest = this._env[ENV_RUNFILES_MANIFEST_FILE]
+    if (!runfilesManifest || !fs.existsSync(runfilesManifest)) return
+
+    try {
+      const lines = fs.readFileSync(runfilesManifest, 'utf8').split('\n')
+      for (const line of lines) {
+        const separatorIndex = line.indexOf(RUNFILES_MANIFEST_SEPARATOR)
+        if (separatorIndex <= 0) continue
+        if (line.slice(0, separatorIndex) !== manifestFile) continue
+
+        const resolvedPath = line.slice(separatorIndex + 1).trim()
+        if (resolvedPath) return resolvedPath
+      }
+    } catch (err) {
+      log.debug('Failed to resolve Test Optimization HTTP cache manifest from %s: %s', runfilesManifest, err.message)
+    }
+  }
+
+  _readManifestVersion (manifestPath) {
+    try {
+      return parseManifestVersion(fs.readFileSync(manifestPath, 'utf8'))
+    } catch (err) {
+      log.debug('Failed to read Test Optimization HTTP cache manifest %s: %s', manifestPath, err.message)
+    }
+  }
+
+  _readFile (fileName) {
+    if (!this.isAvailable()) return CACHE_MISS
+
+    const filePath = path.join(this._httpCachePath, fileName)
+    try {
+      log.debug('Reading Test Optimization HTTP cache file %s', filePath)
+      return fs.readFileSync(filePath, 'utf8')
+    } catch (err) {
+      log.debug('Test Optimization HTTP cache file %s could not be read: %s', filePath, err.message)
+      return CACHE_MISS
+    }
+  }
+
+  _logInvalidCacheFile (fileName, err) {
+    log.debug('Test Optimization HTTP cache file %s could not be parsed: %s', fileName, err.message)
+  }
+
+  _disable () {
+    this._available = false
+  }
+}
+
+module.exports = {
+  CACHE_MISS,
+  TestOptimizationHttpCache,
+}
diff --git a/packages/dd-trace/test/ci-visibility/early-flake-detection/get-known-tests.spec.js b/packages/dd-trace/test/ci-visibility/early-flake-detection/get-known-tests.spec.js
index 3c706ee25d..32608b767b 100644
--- a/packages/dd-trace/test/ci-visibility/early-flake-detection/get-known-tests.spec.js
+++ b/packages/dd-trace/test/ci-visibility/early-flake-detection/get-known-tests.spec.js
@@ -8,7 +8,11 @@ const nock = require('nock')
 
 require('../../setup/core')
 
-const { getKnownTests } = require('../../../src/ci-visibility/early-flake-detection/get-known-tests')
+const {
+  getKnownTests,
+  parseKnownTestsResponse,
+} = require('../../../src/ci-visibility/early-flake-detection/get-known-tests')
+const getConfig = require('../../../src/config')
 const {
   buildCacheKey,
   getCachePath,
@@ -72,13 +76,17 @@ function cleanup (params) {
 describe('get-known-tests', () => {
   beforeEach(() => {
     process.env.DD_API_KEY = 'test-api-key'
+    getConfig().DD_API_KEY = 'test-api-key'
     process.env.DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = 'true'
+    getConfig().DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = true
     cleanup(DEFAULT_PARAMS)
   })
 
   afterEach(() => {
     delete process.env.DD_API_KEY
+    getConfig().DD_API_KEY = undefined
     delete process.env.DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE
+    getConfig().DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = false
     cleanup(DEFAULT_PARAMS)
     nock.cleanAll()
   })
@@ -329,3 +337,34 @@ describe('get-known-tests', () => {
     })
   })
 })
+
+describe('parseKnownTestsResponse', () => {
+  it('returns tests from a raw backend response', () => {
+    assert.deepStrictEqual(
+      parseKnownTestsResponse(JSON.stringify(KNOWN_TESTS_RESPONSE)),
+      KNOWN_TESTS_RESPONSE.data.attributes.tests
+    )
+  })
+
+  it('preserves null tests from a raw backend response', () => {
+    assert.strictEqual(parseKnownTestsResponse(JSON.stringify(EMPTY_KNOWN_TESTS_RESPONSE)), null)
+  })
+
+  it('validates known tests response shape when requested', () => {
+    assert.deepStrictEqual(
+      parseKnownTestsResponse(JSON.stringify(KNOWN_TESTS_RESPONSE), { validateRequiredFields: true }),
+      KNOWN_TESTS_RESPONSE.data.attributes.tests
+    )
+    assert.throws(
+      () => parseKnownTestsResponse(JSON.stringify({ data: { attributes: {} } }), { validateRequiredFields: true }),
+      /Invalid known tests response: missing tests/
+    )
+    assert.throws(
+      () => parseKnownTestsResponse(
+        JSON.stringify({ data: { attributes: { tests: { jest: { 'suite.js': 'test' } } } } }),
+        { validateRequiredFields: true }
+      ),
+      /Invalid known tests response: suite tests must be arrays/
+    )
+  })
+})
diff --git a/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-http-cache.spec.js b/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-http-cache.spec.js
new file mode 100644
index 0000000000..74aa42ea04
--- /dev/null
+++ b/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-http-cache.spec.js
@@ -0,0 +1,622 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+
+const { describe, it, beforeEach, afterEach } = require('mocha')
+const nock = require('nock')
+const proxyquire = require('proxyquire').noPreserveCache()
+
+require('../../setup/core')
+
+const getConfig = require('../../../src/config')
+const CiVisibilityExporterBase = require('../../../src/ci-visibility/exporters/ci-visibility-exporter')
+const { defaults: { hostname, port } } = require('../../../src/config/defaults')
+
+const ALL_FEATURE_GATES_ENABLED = {
+  DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED: true,
+  DD_CIVISIBILITY_FLAKY_RETRY_ENABLED: true,
+  DD_CIVISIBILITY_IMPACTED_TESTS_DETECTION_ENABLED: true,
+  DD_CIVISIBILITY_ITR_ENABLED: true,
+  DD_TEST_FAILED_TEST_REPLAY_ENABLED: true,
+  DD_TEST_MANAGEMENT_ENABLED: true,
+}
+
+const ITR_FEATURE_GATE_ENABLED = {
+  DD_CIVISIBILITY_ITR_ENABLED: true,
+}
+
+const TEST_MANAGEMENT_FEATURE_GATE_ENABLED = {
+  DD_TEST_MANAGEMENT_ENABLED: true,
+}
+
+function withTestOptimizationDefaults (Exporter) {
+  return class CiVisibilityExporter extends Exporter {
+    constructor (config = {}) {
+      super({ testOptimization: {}, ...config })
+    }
+  }
+}
+
+const CiVisibilityExporter = withTestOptimizationDefaults(CiVisibilityExporterBase)
+
+const SETTINGS_RESPONSE = {
+  data: {
+    attributes: {
+      code_coverage: true,
+      tests_skipping: true,
+      itr_enabled: true,
+      require_git: true,
+      early_flake_detection: {
+        enabled: true,
+        slow_test_retries: {
+          '5s': 4,
+        },
+        faulty_session_threshold: 12,
+      },
+      flaky_test_retries_enabled: true,
+      di_enabled: true,
+      known_tests_enabled: true,
+      test_management: {
+        enabled: true,
+        attempt_to_fix_retries: 8,
+      },
+      impacted_tests_enabled: true,
+      coverage_report_upload_enabled: true,
+    },
+  },
+}
+
+const KNOWN_TESTS_RESPONSE = {
+  data: {
+    attributes: {
+      tests: {
+        jest: {
+          'suite1.spec.js': ['test1'],
+        },
+      },
+    },
+  },
+}
+
+const SKIPPABLE_RESPONSE = {
+  meta: {
+    correlation_id: 'corr-123',
+    coverage: {
+      'src/file.js': 'gA==',
+    },
+  },
+  data: [
+    { type: 'suite', attributes: { suite: 'suite1.spec.js' } },
+  ],
+}
+
+const TEST_MANAGEMENT_RESPONSE = {
+  data: {
+    attributes: {
+      modules: {
+        jest: {
+          suites: {
+            'suite1.spec.js': {
+              tests: {
+                test1: { properties: { disabled: true } },
+              },
+            },
+          },
+        },
+      },
+    },
+  },
+}
+
+function writeCacheLayout (root, options = {}) {
+  const {
+    settings = SETTINGS_RESPONSE,
+    knownTests = KNOWN_TESTS_RESPONSE,
+    skippableTests = SKIPPABLE_RESPONSE,
+    testManagement = TEST_MANAGEMENT_RESPONSE,
+  } = options
+  const httpCachePath = path.join(root, '.testoptimization', 'cache', 'http')
+  fs.mkdirSync(httpCachePath, { recursive: true })
+  fs.writeFileSync(path.join(root, '.testoptimization', 'manifest.txt'), '1\n')
+  if (settings !== undefined) {
+    fs.writeFileSync(path.join(httpCachePath, 'settings.json'), JSON.stringify(settings))
+  }
+  if (knownTests !== undefined) {
+    fs.writeFileSync(path.join(httpCachePath, 'known_tests.json'), JSON.stringify(knownTests))
+  }
+  if (skippableTests !== undefined) {
+    fs.writeFileSync(path.join(httpCachePath, 'skippable_tests.json'), JSON.stringify(skippableTests))
+  }
+  if (testManagement !== undefined) {
+    fs.writeFileSync(path.join(httpCachePath, 'test_management.json'), JSON.stringify(testManagement))
+  }
+}
+
+function loadCiVisibilityExporterWithGitUpload (sendGitMetadata) {
+  const Exporter = proxyquire('../../../src/ci-visibility/exporters/ci-visibility-exporter', {
+    './git/git_metadata': {
+      sendGitMetadata,
+    },
+  })
+  return withTestOptimizationDefaults(Exporter)
+}
+
+describe('CI Visibility Exporter Test Optimization HTTP cache', () => {
+  const url = new URL(`http://${hostname}:${port}`)
+
+  let previousCwd
+  let previousSettingsCachePath
+  let tmpRoot
+
+  beforeEach(() => {
+    previousCwd = process.cwd()
+    previousSettingsCachePath = process.env.DD_EXPERIMENTAL_TEST_OPT_SETTINGS_CACHE
+    tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-js-exporter-http-cache-'))
+    writeCacheLayout(tmpRoot)
+    process.chdir(tmpRoot)
+    delete process.env.DD_API_KEY
+    delete process.env.DD_EXPERIMENTAL_TEST_OPT_SETTINGS_CACHE
+    getConfig().DD_API_KEY = undefined
+    nock.cleanAll()
+  })
+
+  afterEach(() => {
+    process.chdir(previousCwd)
+    fs.rmSync(tmpRoot, { recursive: true, force: true })
+    process.env.DD_API_KEY = '1'
+    if (previousSettingsCachePath === undefined) {
+      delete process.env.DD_EXPERIMENTAL_TEST_OPT_SETTINGS_CACHE
+    } else {
+      process.env.DD_EXPERIMENTAL_TEST_OPT_SETTINGS_CACHE = previousSettingsCachePath
+    }
+    getConfig().DD_API_KEY = '1'
+    nock.cleanAll()
+  })
+
+  it('uses cached settings without an API key or settings HTTP request', (done) => {
+    const settingsScope = nock(url)
+      .post('/api/v2/libraries/tests/services/setting')
+      .reply(200, {})
+
+    const ciVisibilityExporter = new CiVisibilityExporter({
+      url,
+      testOptimization: ALL_FEATURE_GATES_ENABLED,
+    })
+
+    ciVisibilityExporter.getLibraryConfiguration({}, (err, libraryConfig) => {
+      assert.strictEqual(err, null)
+      assert.strictEqual(libraryConfig.requireGit, true)
+      assert.strictEqual(libraryConfig.isCodeCoverageEnabled, true)
+      assert.strictEqual(libraryConfig.isSuitesSkippingEnabled, true)
+      assert.strictEqual(libraryConfig.isEarlyFlakeDetectionEnabled, true)
+      assert.strictEqual(libraryConfig.isTestManagementEnabled, true)
+      assert.strictEqual(libraryConfig.isImpactedTestsEnabled, true)
+      assert.strictEqual(libraryConfig.isCoverageReportUploadEnabled, true)
+      assert.strictEqual(settingsScope.isDone(), false)
+      done()
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+  })
+
+  it('writes cached settings to the nyc settings handoff cache', (done) => {
+    const settingsCachePath = path.join(tmpRoot, 'nyc-settings.json')
+    process.env.DD_EXPERIMENTAL_TEST_OPT_SETTINGS_CACHE = settingsCachePath
+
+    const ciVisibilityExporter = new CiVisibilityExporter({
+      url,
+      testOptimization: ALL_FEATURE_GATES_ENABLED,
+    })
+
+    ciVisibilityExporter.getLibraryConfiguration({}, (err, libraryConfig) => {
+      try {
+        assert.strictEqual(err, null)
+        assert.strictEqual(libraryConfig.isCoverageReportUploadEnabled, true)
+
+        const cachedSettings = JSON.parse(fs.readFileSync(settingsCachePath, 'utf8'))
+        assert.strictEqual(cachedSettings.isCoverageReportUploadEnabled, true)
+        assert.strictEqual(cachedSettings.isCodeCoverageEnabled, true)
+        assert.strictEqual(cachedSettings.requireGit, true)
+        done()
+      } catch (err) {
+        done(err)
+      }
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+  })
+
+  it('falls back to live settings when cached settings are missing', (done) => {
+    fs.rmSync(path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'settings.json'))
+    const liveSettingsResponse = JSON.parse(JSON.stringify(SETTINGS_RESPONSE))
+    liveSettingsResponse.data.attributes.require_git = false
+    getConfig().DD_API_KEY = '1'
+
+    const settingsScope = nock(url)
+      .post('/api/v2/libraries/tests/services/setting')
+      .reply(200, JSON.stringify(liveSettingsResponse))
+
+    const ciVisibilityExporter = new CiVisibilityExporter({
+      url,
+      testOptimization: ALL_FEATURE_GATES_ENABLED,
+    })
+
+    ciVisibilityExporter.getLibraryConfiguration({
+      repositoryUrl: 'https://github.com/example/repo',
+    }, (err, libraryConfig) => {
+      assert.strictEqual(err, null)
+      assert.strictEqual(libraryConfig.requireGit, false)
+      assert.strictEqual(libraryConfig.isCodeCoverageEnabled, true)
+      assert.strictEqual(libraryConfig.isSuitesSkippingEnabled, true)
+      assert.strictEqual(libraryConfig.isEarlyFlakeDetectionEnabled, true)
+      assert.strictEqual(libraryConfig.isKnownTestsEnabled, true)
+      assert.strictEqual(libraryConfig.isTestManagementEnabled, true)
+      assert.strictEqual(libraryConfig.isImpactedTestsEnabled, true)
+      assert.strictEqual(libraryConfig.isCoverageReportUploadEnabled, true)
+      assert.strictEqual(settingsScope.isDone(), true)
+      done()
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+  })
+
+  it('falls back to live settings when cached settings are missing required attributes', (done) => {
+    fs.writeFileSync(
+      path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'settings.json'),
+      JSON.stringify({ data: { attributes: { itr_enabled: true } } })
+    )
+    const liveSettingsResponse = JSON.parse(JSON.stringify(SETTINGS_RESPONSE))
+    liveSettingsResponse.data.attributes.require_git = false
+    getConfig().DD_API_KEY = '1'
+
+    const settingsScope = nock(url)
+      .post('/api/v2/libraries/tests/services/setting')
+      .reply(200, JSON.stringify(liveSettingsResponse))
+
+    const ciVisibilityExporter = new CiVisibilityExporter({
+      url,
+      testOptimization: ALL_FEATURE_GATES_ENABLED,
+    })
+
+    ciVisibilityExporter.getLibraryConfiguration({
+      repositoryUrl: 'https://github.com/example/repo',
+    }, (err, libraryConfig) => {
+      assert.strictEqual(err, null)
+      assert.strictEqual(libraryConfig.requireGit, false)
+      assert.strictEqual(libraryConfig.isCodeCoverageEnabled, true)
+      assert.strictEqual(libraryConfig.isSuitesSkippingEnabled, true)
+      assert.strictEqual(libraryConfig.isEarlyFlakeDetectionEnabled, true)
+      assert.strictEqual(libraryConfig.isKnownTestsEnabled, true)
+      assert.strictEqual(libraryConfig.isTestManagementEnabled, true)
+      assert.strictEqual(libraryConfig.isImpactedTestsEnabled, true)
+      assert.strictEqual(libraryConfig.isCoverageReportUploadEnabled, true)
+      assert.strictEqual(settingsScope.isDone(), true)
+      done()
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+  })
+
+  it('skips git metadata upload after cached settings are read', (done) => {
+    const gitScope = nock(url)
+      .post('/api/v2/git/repository/search_commits')
+      .reply(200, { data: [] })
+
+    const ciVisibilityExporter = new CiVisibilityExporter({
+      url,
+      testOptimization: {
+        DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+        DD_CIVISIBILITY_ITR_ENABLED: true,
+      },
+    })
+
+    ciVisibilityExporter.getLibraryConfiguration({}, (err, libraryConfig) => {
+      assert.strictEqual(err, null)
+      assert.strictEqual(libraryConfig.requireGit, true)
+      ciVisibilityExporter._gitUploadPromise.then((gitUploadError) => {
+        assert.strictEqual(gitUploadError, undefined)
+        assert.strictEqual(gitScope.isDone(), false)
+        done()
+      })
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+  })
+
+  it('uploads git metadata before retrying live settings when cached settings are malformed', (done) => {
+    fs.writeFileSync(path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'settings.json'), '{invalid json')
+    getConfig().DD_API_KEY = '1'
+
+    const firstLiveSettingsResponse = JSON.parse(JSON.stringify(SETTINGS_RESPONSE))
+    firstLiveSettingsResponse.data.attributes.require_git = true
+    const finalLiveSettingsResponse = JSON.parse(JSON.stringify(SETTINGS_RESPONSE))
+    finalLiveSettingsResponse.data.attributes.require_git = false
+
+    let gitUploadCalls = 0
+    let hasUploadedGit = false
+    let uploadedRepositoryUrl
+    let secondSettingsRequestSawGitUploaded = false
+    const GitUploadingCiVisibilityExporter = loadCiVisibilityExporterWithGitUpload(
+      (_url, _options, repositoryUrl, callback) => {
+        gitUploadCalls++
+        uploadedRepositoryUrl = repositoryUrl
+        setImmediate(() => {
+          hasUploadedGit = true
+          callback()
+        })
+      })
+
+    const settingsScope = nock(url)
+      .post('/api/v2/libraries/tests/services/setting')
+      .reply(200, JSON.stringify(firstLiveSettingsResponse))
+      .post('/api/v2/libraries/tests/services/setting', () => {
+        secondSettingsRequestSawGitUploaded = hasUploadedGit
+        return true
+      })
+      .reply(200, JSON.stringify(finalLiveSettingsResponse))
+
+    const ciVisibilityExporter = new GitUploadingCiVisibilityExporter({
+      url,
+      testOptimization: {
+        ...ALL_FEATURE_GATES_ENABLED,
+        DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+      },
+    })
+
+    ciVisibilityExporter.getLibraryConfiguration({
+      repositoryUrl: 'https://github.com/example/repo',
+    }, (err, libraryConfig) => {
+      assert.strictEqual(err, null)
+      assert.strictEqual(libraryConfig.requireGit, false)
+      assert.strictEqual(gitUploadCalls, 1)
+      assert.strictEqual(uploadedRepositoryUrl, 'https://github.com/example/repo')
+      assert.strictEqual(secondSettingsRequestSawGitUploaded, true)
+      assert.strictEqual(settingsScope.isDone(), true)
+      done()
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+  })
+
+  it('uses cached known tests without an API key or known-tests HTTP request', (done) => {
+    const knownTestsScope = nock(url)
+      .post('/api/v2/ci/libraries/tests')
+      .reply(200, {})
+
+    const ciVisibilityExporter = new CiVisibilityExporter({ url })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+    ciVisibilityExporter._libraryConfig = { isKnownTestsEnabled: true }
+
+    ciVisibilityExporter.getKnownTests({}, (err, knownTests) => {
+      assert.strictEqual(err, null)
+      assert.deepStrictEqual(knownTests, KNOWN_TESTS_RESPONSE.data.attributes.tests)
+      assert.strictEqual(knownTestsScope.isDone(), false)
+      done()
+    })
+  })
+
+  it('falls back to live known tests when cached known tests are missing', (done) => {
+    fs.rmSync(path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'known_tests.json'))
+    getConfig().DD_API_KEY = '1'
+    const knownTestsScope = nock(url)
+      .post('/api/v2/ci/libraries/tests')
+      .reply(200, JSON.stringify(KNOWN_TESTS_RESPONSE))
+
+    const ciVisibilityExporter = new CiVisibilityExporter({ url })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+    ciVisibilityExporter._libraryConfig = { isKnownTestsEnabled: true }
+
+    ciVisibilityExporter.getKnownTests({}, (err, knownTests) => {
+      assert.strictEqual(err, null)
+      assert.deepStrictEqual(knownTests, KNOWN_TESTS_RESPONSE.data.attributes.tests)
+      assert.strictEqual(knownTestsScope.isDone(), true)
+      done()
+    })
+  })
+
+  it('falls back to live known tests when cached known tests are malformed', (done) => {
+    fs.writeFileSync(
+      path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'known_tests.json'),
+      JSON.stringify({ data: { attributes: {} } })
+    )
+    getConfig().DD_API_KEY = '1'
+    const knownTestsScope = nock(url)
+      .post('/api/v2/ci/libraries/tests')
+      .reply(200, JSON.stringify(KNOWN_TESTS_RESPONSE))
+
+    const ciVisibilityExporter = new CiVisibilityExporter({ url })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+    ciVisibilityExporter._libraryConfig = { isKnownTestsEnabled: true }
+
+    ciVisibilityExporter.getKnownTests({}, (err, knownTests) => {
+      assert.strictEqual(err, null)
+      assert.deepStrictEqual(knownTests, KNOWN_TESTS_RESPONSE.data.attributes.tests)
+      assert.strictEqual(knownTestsScope.isDone(), true)
+      done()
+    })
+  })
+
+  it('uses cached skippable tests without waiting on git upload', (done) => {
+    const skippableScope = nock(url)
+      .post('/api/v2/ci/tests/skippable')
+      .reply(200, {})
+
+    const ciVisibilityExporter = new CiVisibilityExporter({ url, testOptimization: ITR_FEATURE_GATE_ENABLED })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+    ciVisibilityExporter._libraryConfig = { isSuitesSkippingEnabled: true }
+
+    ciVisibilityExporter.getSkippableSuites({}, (err, skippableSuites, correlationId, coverage) => {
+      assert.strictEqual(err, null)
+      assert.deepStrictEqual(skippableSuites, ['suite1.spec.js'])
+      assert.strictEqual(correlationId, 'corr-123')
+      assert.deepStrictEqual(coverage, { 'src/file.js': 'gA==' })
+      assert.strictEqual(skippableScope.isDone(), false)
+      done()
+    })
+  })
+
+  it('falls back to live skippable tests when cached skippable tests are missing', (done) => {
+    fs.rmSync(path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'skippable_tests.json'))
+    getConfig().DD_API_KEY = '1'
+    let gitUploadCalls = 0
+    let hasUploadedGit = false
+    let uploadedRepositoryUrl
+    let skippableRequestSawGitUploaded = false
+    const GitUploadingCiVisibilityExporter = loadCiVisibilityExporterWithGitUpload(
+      (_url, _options, repositoryUrl, callback) => {
+        gitUploadCalls++
+        uploadedRepositoryUrl = repositoryUrl
+        setImmediate(() => {
+          hasUploadedGit = true
+          callback()
+        })
+      })
+    const skippableScope = nock(url)
+      .post('/api/v2/ci/tests/skippable', () => {
+        skippableRequestSawGitUploaded = hasUploadedGit
+        return true
+      })
+      .reply(200, JSON.stringify(SKIPPABLE_RESPONSE))
+
+    const ciVisibilityExporter = new GitUploadingCiVisibilityExporter({
+      url,
+      testOptimization: {
+        DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+        DD_CIVISIBILITY_ITR_ENABLED: true,
+      },
+    })
+    ciVisibilityExporter.getLibraryConfiguration({
+      repositoryUrl: 'https://github.com/example/repo',
+    }, (settingsErr) => {
+      assert.strictEqual(settingsErr, null)
+      ciVisibilityExporter.getSkippableSuites({}, (err, skippableSuites, correlationId, coverage) => {
+        assert.strictEqual(err, null)
+        assert.deepStrictEqual(skippableSuites, ['suite1.spec.js'])
+        assert.strictEqual(correlationId, 'corr-123')
+        assert.deepStrictEqual(coverage, { 'src/file.js': 'gA==' })
+        assert.strictEqual(gitUploadCalls, 1)
+        assert.strictEqual(uploadedRepositoryUrl, 'https://github.com/example/repo')
+        assert.strictEqual(skippableRequestSawGitUploaded, true)
+        assert.strictEqual(skippableScope.isDone(), true)
+        done()
+      })
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+  })
+
+  it('falls back to live skippable tests when cached skippable tests are malformed', (done) => {
+    fs.writeFileSync(
+      path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'skippable_tests.json'),
+      JSON.stringify({ data: [{ type: 'suite', attributes: {} }] })
+    )
+    getConfig().DD_API_KEY = '1'
+    let gitUploadCalls = 0
+    let hasUploadedGit = false
+    let uploadedRepositoryUrl
+    let skippableRequestSawGitUploaded = false
+    const GitUploadingCiVisibilityExporter = loadCiVisibilityExporterWithGitUpload(
+      (_url, _options, repositoryUrl, callback) => {
+        gitUploadCalls++
+        uploadedRepositoryUrl = repositoryUrl
+        setImmediate(() => {
+          hasUploadedGit = true
+          callback()
+        })
+      })
+    const skippableScope = nock(url)
+      .post('/api/v2/ci/tests/skippable', () => {
+        skippableRequestSawGitUploaded = hasUploadedGit
+        return true
+      })
+      .reply(200, JSON.stringify(SKIPPABLE_RESPONSE))
+
+    const ciVisibilityExporter = new GitUploadingCiVisibilityExporter({
+      url,
+      testOptimization: {
+        DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+        DD_CIVISIBILITY_ITR_ENABLED: true,
+      },
+    })
+    ciVisibilityExporter.getLibraryConfiguration({
+      repositoryUrl: 'https://github.com/example/repo',
+    }, (settingsErr) => {
+      assert.strictEqual(settingsErr, null)
+      ciVisibilityExporter.getSkippableSuites({}, (err, skippableSuites, correlationId, coverage) => {
+        assert.strictEqual(err, null)
+        assert.deepStrictEqual(skippableSuites, ['suite1.spec.js'])
+        assert.strictEqual(correlationId, 'corr-123')
+        assert.deepStrictEqual(coverage, { 'src/file.js': 'gA==' })
+        assert.strictEqual(gitUploadCalls, 1)
+        assert.strictEqual(uploadedRepositoryUrl, 'https://github.com/example/repo')
+        assert.strictEqual(skippableRequestSawGitUploaded, true)
+        assert.strictEqual(skippableScope.isDone(), true)
+        done()
+      })
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+  })
+
+  it('uses cached test management tests without an API key or test-management HTTP request', (done) => {
+    const testManagementScope = nock(url)
+      .post('/api/v2/test/libraries/test-management/tests')
+      .reply(200, {})
+
+    const ciVisibilityExporter = new CiVisibilityExporter({
+      url,
+      testOptimization: TEST_MANAGEMENT_FEATURE_GATE_ENABLED,
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+    ciVisibilityExporter._libraryConfig = { isTestManagementEnabled: true }
+
+    ciVisibilityExporter.getTestManagementTests({}, (err, tests) => {
+      assert.strictEqual(err, null)
+      assert.deepStrictEqual(tests, TEST_MANAGEMENT_RESPONSE.data.attributes.modules)
+      assert.strictEqual(testManagementScope.isDone(), false)
+      done()
+    })
+  })
+
+  it('falls back to live test management tests when cached test management tests are malformed', (done) => {
+    fs.writeFileSync(
+      path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'test_management.json'),
+      JSON.stringify({ data: { attributes: {} } })
+    )
+    getConfig().DD_API_KEY = '1'
+    const testManagementScope = nock(url)
+      .post('/api/v2/test/libraries/test-management/tests')
+      .reply(200, JSON.stringify(TEST_MANAGEMENT_RESPONSE))
+
+    const ciVisibilityExporter = new CiVisibilityExporter({
+      url,
+      testOptimization: TEST_MANAGEMENT_FEATURE_GATE_ENABLED,
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+    ciVisibilityExporter._libraryConfig = { isTestManagementEnabled: true }
+
+    ciVisibilityExporter.getTestManagementTests({}, (err, tests) => {
+      assert.strictEqual(err, null)
+      assert.deepStrictEqual(tests, TEST_MANAGEMENT_RESPONSE.data.attributes.modules)
+      assert.strictEqual(testManagementScope.isDone(), true)
+      done()
+    })
+  })
+
+  it('falls back to live test management tests when cached test management tests are missing', (done) => {
+    fs.rmSync(path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'test_management.json'))
+    getConfig().DD_API_KEY = '1'
+    const testManagementScope = nock(url)
+      .post('/api/v2/test/libraries/test-management/tests')
+      .reply(200, JSON.stringify(TEST_MANAGEMENT_RESPONSE))
+
+    const ciVisibilityExporter = new CiVisibilityExporter({
+      url,
+      testOptimization: TEST_MANAGEMENT_FEATURE_GATE_ENABLED,
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+    ciVisibilityExporter._libraryConfig = { isTestManagementEnabled: true }
+
+    ciVisibilityExporter.getTestManagementTests({}, (err, tests) => {
+      assert.strictEqual(err, null)
+      assert.deepStrictEqual(tests, TEST_MANAGEMENT_RESPONSE.data.attributes.modules)
+      assert.strictEqual(testManagementScope.isDone(), true)
+      done()
+    })
+  })
+})
diff --git a/packages/dd-trace/test/ci-visibility/intelligent-test-runner/get-skippable-suites.spec.js b/packages/dd-trace/test/ci-visibility/intelligent-test-runner/get-skippable-suites.spec.js
index 2e87fd5a89..1662453dd4 100644
--- a/packages/dd-trace/test/ci-visibility/intelligent-test-runner/get-skippable-suites.spec.js
+++ b/packages/dd-trace/test/ci-visibility/intelligent-test-runner/get-skippable-suites.spec.js
@@ -8,7 +8,10 @@ const nock = require('nock')
 
 require('../../setup/core')
 
-const { getSkippableSuites } = require('../../../src/ci-visibility/intelligent-test-runner/get-skippable-suites')
+const {
+  getSkippableSuites,
+  parseSkippableSuitesResponse,
+} = require('../../../src/ci-visibility/intelligent-test-runner/get-skippable-suites')
 const getConfig = require('../../../src/config')
 const {
   buildCacheKey,
@@ -255,3 +258,64 @@ describe('get-skippable-suites', () => {
     })
   })
 })
+
+describe('parseSkippableSuitesResponse', () => {
+  it('returns suite-level skippable data with correlation id and coverage', () => {
+    const result = parseSkippableSuitesResponse(JSON.stringify(SKIPPABLE_RESPONSE_WITH_COVERAGE), {
+      testLevel: 'suite',
+    })
+
+    assert.deepStrictEqual(result, {
+      skippableSuites: ['suite1.spec.js', 'suite2.spec.js'],
+      correlationId: 'corr-123',
+      coverage: {
+        'src/file1.js': 'gA==',
+        'src/file2.js': 'IA==',
+      },
+    })
+  })
+
+  it('returns test-level skippable data', () => {
+    const result = parseSkippableSuitesResponse(JSON.stringify({
+      data: [
+        { type: 'suite', attributes: { suite: 'suite1.spec.js' } },
+        { type: 'test', attributes: { suite: 'suite1.spec.js', name: 'test 1' } },
+      ],
+      meta: { correlation_id: 'corr-123' },
+    }), { testLevel: 'test' })
+
+    assert.deepStrictEqual(result, {
+      skippableSuites: [{ suite: 'suite1.spec.js', name: 'test 1' }],
+      correlationId: 'corr-123',
+      coverage: {},
+    })
+  })
+
+  it('filters missing line coverage when coverage report upload is enabled', () => {
+    const result = parseSkippableSuitesResponse(JSON.stringify(SKIPPABLE_RESPONSE_WITH_MISSING_LINE_COVERAGE), {
+      testLevel: 'suite',
+      isCoverageReportUploadEnabled: true,
+    })
+
+    assert.deepStrictEqual(result.skippableSuites, ['suite2.spec.js'])
+  })
+
+  it('validates skippable tests response shape when requested', () => {
+    const result = parseSkippableSuitesResponse(JSON.stringify(SKIPPABLE_RESPONSE), {
+      validateRequiredFields: true,
+    })
+
+    assert.deepStrictEqual(result.skippableSuites, ['suite1.spec.js', 'suite2.spec.js'])
+    assert.throws(
+      () => parseSkippableSuitesResponse(JSON.stringify({}), { validateRequiredFields: true }),
+      /Invalid skippable tests response: data must be an array/
+    )
+    assert.throws(
+      () => parseSkippableSuitesResponse(
+        JSON.stringify({ data: [{ type: 'suite', attributes: {} }] }),
+        { validateRequiredFields: true }
+      ),
+      /Invalid skippable tests response: data entry suite must be a string/
+    )
+  })
+})
diff --git a/packages/dd-trace/test/ci-visibility/requests/get-library-configuration.spec.js b/packages/dd-trace/test/ci-visibility/requests/get-library-configuration.spec.js
new file mode 100644
index 0000000000..cc1a9a8288
--- /dev/null
+++ b/packages/dd-trace/test/ci-visibility/requests/get-library-configuration.spec.js
@@ -0,0 +1,156 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+
+const { describe, it, beforeEach, afterEach } = require('mocha')
+
+require('../../setup/core')
+
+const getConfig = require('../../../src/config')
+const {
+  parseLibraryConfigurationResponse,
+} = require('../../../src/ci-visibility/requests/get-library-configuration')
+
+const COMPLETE_SETTINGS_ATTRIBUTES = {
+  code_coverage: true,
+  tests_skipping: true,
+  itr_enabled: true,
+  require_git: false,
+  early_flake_detection: {
+    enabled: true,
+    slow_test_retries: {
+      '5s': 4,
+      '10s': 3,
+    },
+    faulty_session_threshold: 12,
+  },
+  flaky_test_retries_enabled: true,
+  di_enabled: true,
+  known_tests_enabled: true,
+  test_management: {
+    enabled: true,
+    attempt_to_fix_retries: 8,
+  },
+  impacted_tests_enabled: true,
+  coverage_report_upload_enabled: true,
+}
+
+describe('get-library-configuration', () => {
+  beforeEach(() => {
+    getConfig().testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE = false
+    getConfig().testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING = false
+  })
+
+  afterEach(() => {
+    getConfig().testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE = false
+    getConfig().testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING = false
+  })
+
+  describe('parseLibraryConfigurationResponse', () => {
+    it('normalizes raw settings responses', () => {
+      const settings = parseLibraryConfigurationResponse(JSON.stringify({
+        data: {
+          attributes: COMPLETE_SETTINGS_ATTRIBUTES,
+        },
+      }))
+
+      assert.deepStrictEqual(settings, {
+        isCodeCoverageEnabled: true,
+        isSuitesSkippingEnabled: true,
+        isItrEnabled: true,
+        requireGit: false,
+        isEarlyFlakeDetectionEnabled: true,
+        earlyFlakeDetectionNumRetries: 4,
+        earlyFlakeDetectionSlowTestRetries: {
+          '5s': 4,
+          '10s': 3,
+        },
+        earlyFlakeDetectionFaultyThreshold: 12,
+        isFlakyTestRetriesEnabled: true,
+        isDiEnabled: true,
+        isKnownTestsEnabled: true,
+        isTestManagementEnabled: true,
+        testManagementAttemptToFixRetries: 8,
+        isImpactedTestsEnabled: true,
+        isCoverageReportUploadEnabled: true,
+      })
+    })
+
+    it('accepts bare settings attributes like the Ruby cache reader', () => {
+      const settings = parseLibraryConfigurationResponse(JSON.stringify({
+        code_coverage: true,
+        tests_skipping: false,
+        itr_enabled: true,
+        require_git: false,
+        known_tests_enabled: false,
+      }))
+
+      assert.strictEqual(settings.isCodeCoverageEnabled, true)
+      assert.strictEqual(settings.isSuitesSkippingEnabled, false)
+      assert.strictEqual(settings.isItrEnabled, true)
+      assert.strictEqual(settings.requireGit, false)
+      assert.strictEqual(settings.isEarlyFlakeDetectionEnabled, false)
+    })
+
+    it('validates complete cached settings attributes', () => {
+      const apiSettings = parseLibraryConfigurationResponse(JSON.stringify({
+        data: {
+          attributes: COMPLETE_SETTINGS_ATTRIBUTES,
+        },
+      }), undefined, { validateRequiredFields: true })
+      const bareSettings = parseLibraryConfigurationResponse(
+        JSON.stringify(COMPLETE_SETTINGS_ATTRIBUTES),
+        undefined,
+        { validateRequiredFields: true }
+      )
+
+      assert.strictEqual(apiSettings.isCodeCoverageEnabled, true)
+      assert.strictEqual(bareSettings.isCodeCoverageEnabled, true)
+    })
+
+    it('rejects cached settings without all required attributes', () => {
+      const partialSettingsAttributes = { ...COMPLETE_SETTINGS_ATTRIBUTES }
+      delete partialSettingsAttributes.require_git
+
+      assert.throws(
+        () => parseLibraryConfigurationResponse(JSON.stringify({}), undefined, { validateRequiredFields: true }),
+        /Invalid settings response: missing code_coverage/
+      )
+      assert.throws(
+        () => parseLibraryConfigurationResponse(
+          JSON.stringify({ data: { attributes: {} } }),
+          undefined,
+          { validateRequiredFields: true }
+        ),
+        /Invalid settings response: missing code_coverage/
+      )
+      assert.throws(
+        () => parseLibraryConfigurationResponse(
+          JSON.stringify({ data: { attributes: partialSettingsAttributes } }),
+          undefined,
+          { validateRequiredFields: true }
+        ),
+        /Invalid settings response: missing require_git/
+      )
+    })
+
+    it('applies dangerous force flags after parsing', () => {
+      getConfig().testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE = true
+      getConfig().testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING = true
+
+      const settings = parseLibraryConfigurationResponse(JSON.stringify({
+        data: {
+          attributes: {
+            code_coverage: false,
+            tests_skipping: false,
+            itr_enabled: true,
+            require_git: false,
+          },
+        },
+      }))
+
+      assert.strictEqual(settings.isCodeCoverageEnabled, true)
+      assert.strictEqual(settings.isSuitesSkippingEnabled, true)
+    })
+  })
+})
diff --git a/packages/dd-trace/test/ci-visibility/test-management/get-test-management-tests.spec.js b/packages/dd-trace/test/ci-visibility/test-management/get-test-management-tests.spec.js
index 42ed2858ba..54e8467921 100644
--- a/packages/dd-trace/test/ci-visibility/test-management/get-test-management-tests.spec.js
+++ b/packages/dd-trace/test/ci-visibility/test-management/get-test-management-tests.spec.js
@@ -10,7 +10,9 @@ require('../../setup/core')
 
 const {
   getTestManagementTests,
+  parseTestManagementTestsResponse,
 } = require('../../../src/ci-visibility/test-management/get-test-management-tests')
+const getConfig = require('../../../src/config')
 const {
   buildCacheKey,
   getCachePath,
@@ -64,13 +66,17 @@ function cleanup (params) {
 describe('get-test-management-tests', () => {
   beforeEach(() => {
     process.env.DD_API_KEY = 'test-api-key'
+    getConfig().DD_API_KEY = 'test-api-key'
     process.env.DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = 'true'
+    getConfig().DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = true
     cleanup(DEFAULT_PARAMS)
   })
 
   afterEach(() => {
     delete process.env.DD_API_KEY
+    getConfig().DD_API_KEY = undefined
     delete process.env.DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE
+    getConfig().DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = false
     cleanup(DEFAULT_PARAMS)
     nock.cleanAll()
   })
@@ -124,3 +130,33 @@ describe('get-test-management-tests', () => {
     })
   })
 })
+
+describe('parseTestManagementTestsResponse', () => {
+  it('returns modules from a raw backend response', () => {
+    assert.deepStrictEqual(
+      parseTestManagementTestsResponse(JSON.stringify(TEST_MGMT_RESPONSE)),
+      TEST_MGMT_RESPONSE.data.attributes.modules
+    )
+  })
+
+  it('validates test management tests response shape when requested', () => {
+    assert.deepStrictEqual(
+      parseTestManagementTestsResponse(JSON.stringify(TEST_MGMT_RESPONSE), { validateRequiredFields: true }),
+      TEST_MGMT_RESPONSE.data.attributes.modules
+    )
+    assert.throws(
+      () => parseTestManagementTestsResponse(
+        JSON.stringify({ data: { attributes: {} } }),
+        { validateRequiredFields: true }
+      ),
+      /Invalid test management tests response: missing modules/
+    )
+    assert.throws(
+      () => parseTestManagementTestsResponse(
+        JSON.stringify({ data: { attributes: { modules: { jest: {} } } } }),
+        { validateRequiredFields: true }
+      ),
+      /Invalid test management tests response: module suites must be objects/
+    )
+  })
+})
diff --git a/packages/dd-trace/test/ci-visibility/test-optimization-http-cache.spec.js b/packages/dd-trace/test/ci-visibility/test-optimization-http-cache.spec.js
new file mode 100644
index 0000000000..d4bd952503
--- /dev/null
+++ b/packages/dd-trace/test/ci-visibility/test-optimization-http-cache.spec.js
@@ -0,0 +1,369 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+
+const { describe, it, beforeEach, afterEach } = require('mocha')
+
+require('../setup/core')
+
+const {
+  CACHE_MISS,
+  TestOptimizationHttpCache,
+} = require('../../src/ci-visibility/test-optimization-http-cache')
+
+const SETTINGS_RESPONSE = {
+  data: {
+    attributes: {
+      code_coverage: true,
+      tests_skipping: true,
+      itr_enabled: true,
+      require_git: false,
+      early_flake_detection: {
+        enabled: true,
+        slow_test_retries: {
+          '5s': 4,
+        },
+        faulty_session_threshold: 12,
+      },
+      flaky_test_retries_enabled: true,
+      di_enabled: true,
+      known_tests_enabled: true,
+      test_management: {
+        enabled: true,
+        attempt_to_fix_retries: 8,
+      },
+      impacted_tests_enabled: true,
+      coverage_report_upload_enabled: true,
+    },
+  },
+}
+
+const DISABLED_SETTINGS_RESPONSE = {
+  data: {
+    attributes: {
+      code_coverage: false,
+      tests_skipping: false,
+      itr_enabled: false,
+      require_git: false,
+      early_flake_detection: {
+        enabled: false,
+        slow_test_retries: {},
+        faulty_session_threshold: 0,
+      },
+      flaky_test_retries_enabled: false,
+      di_enabled: false,
+      known_tests_enabled: false,
+      test_management: {
+        enabled: false,
+      },
+      impacted_tests_enabled: false,
+      coverage_report_upload_enabled: false,
+    },
+  },
+}
+
+const KNOWN_TESTS_RESPONSE = {
+  data: {
+    attributes: {
+      tests: {
+        jest: {
+          'suite1.spec.js': ['test1'],
+        },
+      },
+    },
+  },
+}
+
+const SKIPPABLE_RESPONSE = {
+  meta: {
+    correlation_id: 'corr-123',
+  },
+  data: [
+    { type: 'suite', attributes: { suite: 'suite1.spec.js' } },
+  ],
+}
+
+const TEST_MANAGEMENT_RESPONSE = {
+  data: {
+    attributes: {
+      modules: {
+        jest: {
+          suites: {
+            'suite1.spec.js': {
+              tests: {
+                test1: { properties: { disabled: true } },
+              },
+            },
+          },
+        },
+      },
+    },
+  },
+}
+
+const ENV_NAMES = [
+  'TEST_OPTIMIZATION_MANIFEST_FILE',
+  'DD_TEST_OPTIMIZATION_MANIFEST_FILE',
+  'RUNFILES_DIR',
+  'RUNFILES_MANIFEST_FILE',
+  'TEST_SRCDIR',
+]
+
+function writeCacheLayout (root, options = {}) {
+  const { manifest = '1\n' } = options
+  const settings = Object.hasOwn(options, 'settings') ? options.settings : SETTINGS_RESPONSE
+  const testOptimizationPath = path.join(root, '.testoptimization')
+  const httpCachePath = path.join(testOptimizationPath, 'cache', 'http')
+
+  fs.mkdirSync(httpCachePath, { recursive: true })
+  fs.writeFileSync(path.join(testOptimizationPath, 'manifest.txt'), manifest)
+  if (settings !== undefined) {
+    fs.writeFileSync(path.join(httpCachePath, 'settings.json'), JSON.stringify(settings))
+  }
+
+  return {
+    manifestPath: path.join(testOptimizationPath, 'manifest.txt'),
+    httpCachePath,
+  }
+}
+
+function writeHttpCacheFile (root, fileName, payload) {
+  const filePath = path.join(root, '.testoptimization', 'cache', 'http', fileName)
+  fs.mkdirSync(path.dirname(filePath), { recursive: true })
+  fs.writeFileSync(filePath, typeof payload === 'string' ? payload : JSON.stringify(payload))
+  return filePath
+}
+
+describe('test-optimization-http-cache', () => {
+  let previousCwd
+  let tmpRoot
+  let previousEnv
+
+  beforeEach(() => {
+    previousCwd = process.cwd()
+    previousEnv = {}
+    for (const envName of ENV_NAMES) {
+      previousEnv[envName] = process.env[envName]
+      delete process.env[envName]
+    }
+
+    tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-js-http-cache-'))
+    process.chdir(tmpRoot)
+  })
+
+  afterEach(() => {
+    process.chdir(previousCwd)
+    for (const envName of ENV_NAMES) {
+      if (previousEnv[envName] === undefined) {
+        delete process.env[envName]
+      } else {
+        process.env[envName] = previousEnv[envName]
+      }
+    }
+    fs.rmSync(tmpRoot, { recursive: true, force: true })
+  })
+
+  it('discovers local manifest before env vars', () => {
+    writeCacheLayout(tmpRoot, { settings: SETTINGS_RESPONSE })
+
+    const envRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-js-http-cache-env-'))
+    const { manifestPath } = writeCacheLayout(envRoot, { settings: DISABLED_SETTINGS_RESPONSE })
+    process.env.TEST_OPTIMIZATION_MANIFEST_FILE = manifestPath
+
+    try {
+      const cache = new TestOptimizationHttpCache()
+      const settings = cache.readSettings()
+
+      assert.strictEqual(cache.isAvailable(), true)
+      assert.strictEqual(settings.isCodeCoverageEnabled, true)
+    } finally {
+      fs.rmSync(envRoot, { recursive: true, force: true })
+    }
+  })
+
+  it('uses TEST_OPTIMIZATION_MANIFEST_FILE when no local manifest exists', () => {
+    const envRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-js-http-cache-env-'))
+    const { manifestPath } = writeCacheLayout(envRoot)
+    process.env.TEST_OPTIMIZATION_MANIFEST_FILE = manifestPath
+
+    try {
+      const cache = new TestOptimizationHttpCache()
+
+      assert.strictEqual(cache.isAvailable(), true)
+      assert.strictEqual(cache.readSettings().isCodeCoverageEnabled, true)
+    } finally {
+      fs.rmSync(envRoot, { recursive: true, force: true })
+    }
+  })
+
+  it('uses DD_TEST_OPTIMIZATION_MANIFEST_FILE as an alias', () => {
+    const envRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-js-http-cache-env-'))
+    const { manifestPath } = writeCacheLayout(envRoot)
+    process.env.DD_TEST_OPTIMIZATION_MANIFEST_FILE = manifestPath
+
+    try {
+      const cache = new TestOptimizationHttpCache()
+
+      assert.strictEqual(cache.isAvailable(), true)
+      assert.strictEqual(cache.readSettings().isCodeCoverageEnabled, true)
+    } finally {
+      fs.rmSync(envRoot, { recursive: true, force: true })
+    }
+  })
+
+  it('resolves manifests through RUNFILES_DIR', () => {
+    const runfilesDir = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-js-runfiles-dir-'))
+    const layoutRoot = path.join(runfilesDir, 'workspace')
+    writeCacheLayout(layoutRoot)
+
+    process.env.TEST_OPTIMIZATION_MANIFEST_FILE = 'workspace/.testoptimization/manifest.txt'
+    process.env.RUNFILES_DIR = runfilesDir
+
+    try {
+      const cache = new TestOptimizationHttpCache()
+      assert.strictEqual(cache.isAvailable(), true)
+    } finally {
+      fs.rmSync(runfilesDir, { recursive: true, force: true })
+    }
+  })
+
+  it('resolves manifests through RUNFILES_MANIFEST_FILE', () => {
+    const actualRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-js-runfiles-manifest-'))
+    const { manifestPath } = writeCacheLayout(actualRoot)
+    const runfilesManifestPath = path.join(tmpRoot, 'MANIFEST')
+
+    process.env.TEST_OPTIMIZATION_MANIFEST_FILE = 'workspace/.testoptimization/manifest.txt'
+    process.env.RUNFILES_MANIFEST_FILE = runfilesManifestPath
+    fs.writeFileSync(runfilesManifestPath, `workspace/.testoptimization/manifest.txt ${manifestPath}\n`)
+
+    try {
+      const cache = new TestOptimizationHttpCache()
+      assert.strictEqual(cache.isAvailable(), true)
+    } finally {
+      fs.rmSync(actualRoot, { recursive: true, force: true })
+    }
+  })
+
+  it('resolves manifests through TEST_SRCDIR', () => {
+    const testSrcdir = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-js-test-srcdir-'))
+    const layoutRoot = path.join(testSrcdir, 'workspace')
+    writeCacheLayout(layoutRoot)
+
+    process.env.TEST_OPTIMIZATION_MANIFEST_FILE = 'workspace/.testoptimization/manifest.txt'
+    process.env.TEST_SRCDIR = testSrcdir
+
+    try {
+      const cache = new TestOptimizationHttpCache()
+      assert.strictEqual(cache.isAvailable(), true)
+    } finally {
+      fs.rmSync(testSrcdir, { recursive: true, force: true })
+    }
+  })
+
+  it('accepts supported manifest version formats', () => {
+    writeCacheLayout(tmpRoot, { manifest: '\uFEFFversion=1\n' })
+
+    const cache = new TestOptimizationHttpCache()
+    assert.strictEqual(cache.isAvailable(), true)
+  })
+
+  it('rejects unsupported manifests', () => {
+    writeCacheLayout(tmpRoot, { manifest: '2\n' })
+
+    const cache = new TestOptimizationHttpCache()
+    assert.strictEqual(cache.isAvailable(), false)
+    assert.strictEqual(cache.readSettings(), CACHE_MISS)
+  })
+
+  it('treats a supported manifest as unavailable when settings.json is absent', () => {
+    writeCacheLayout(tmpRoot, { settings: undefined })
+
+    const cache = new TestOptimizationHttpCache()
+    assert.strictEqual(cache.isAvailable(), false)
+    assert.strictEqual(cache.readSettings(), CACHE_MISS)
+  })
+
+  it('reads endpoint files relative to the manifest directory', () => {
+    writeCacheLayout(tmpRoot)
+    writeHttpCacheFile(tmpRoot, 'known_tests.json', KNOWN_TESTS_RESPONSE)
+    writeHttpCacheFile(tmpRoot, 'skippable_tests.json', SKIPPABLE_RESPONSE)
+    writeHttpCacheFile(tmpRoot, 'test_management.json', TEST_MANAGEMENT_RESPONSE)
+
+    const cache = new TestOptimizationHttpCache()
+    assert.deepStrictEqual(cache.readKnownTests(), KNOWN_TESTS_RESPONSE.data.attributes.tests)
+    assert.deepStrictEqual(cache.readSkippableSuites().skippableSuites, ['suite1.spec.js'])
+    assert.deepStrictEqual(cache.readTestManagementTests(), TEST_MANAGEMENT_RESPONSE.data.attributes.modules)
+  })
+
+  it('returns cache miss for missing optional endpoint files', () => {
+    writeCacheLayout(tmpRoot)
+
+    const cache = new TestOptimizationHttpCache()
+
+    assert.strictEqual(cache.readKnownTests(), CACHE_MISS)
+    assert.strictEqual(cache.readSkippableSuites(), CACHE_MISS)
+    assert.strictEqual(cache.readTestManagementTests(), CACHE_MISS)
+  })
+
+  it('returns cache miss for invalid cache files', () => {
+    writeCacheLayout(tmpRoot)
+
+    const cache = new TestOptimizationHttpCache()
+    writeHttpCacheFile(tmpRoot, 'settings.json', '{invalid json')
+    assert.strictEqual(cache.readSettings(), CACHE_MISS)
+    writeHttpCacheFile(tmpRoot, 'known_tests.json', '{invalid json')
+    assert.strictEqual(cache.readKnownTests(), CACHE_MISS)
+    writeHttpCacheFile(tmpRoot, 'skippable_tests.json', '{invalid json')
+    assert.strictEqual(cache.readSkippableSuites(), CACHE_MISS)
+    writeHttpCacheFile(tmpRoot, 'test_management.json', '{invalid json')
+    assert.strictEqual(cache.readTestManagementTests(), CACHE_MISS)
+  })
+
+  it('returns cache miss for settings files missing required attributes', () => {
+    for (const settings of [
+      {},
+      { data: {} },
+      { data: { attributes: { code_coverage: true } } },
+    ]) {
+      fs.rmSync(path.join(tmpRoot, '.testoptimization'), { recursive: true, force: true })
+      writeCacheLayout(tmpRoot, { settings })
+
+      const cache = new TestOptimizationHttpCache()
+      assert.strictEqual(cache.readSettings(), CACHE_MISS)
+      assert.strictEqual(cache.isAvailable(), false)
+    }
+  })
+
+  it('ignores optional endpoint files after invalid settings disable the cache', () => {
+    writeCacheLayout(tmpRoot, { settings: { data: { attributes: { code_coverage: true } } } })
+    writeHttpCacheFile(tmpRoot, 'known_tests.json', KNOWN_TESTS_RESPONSE)
+
+    const cache = new TestOptimizationHttpCache()
+
+    assert.strictEqual(cache.readSettings(), CACHE_MISS)
+    assert.strictEqual(cache.readKnownTests(), CACHE_MISS)
+  })
+
+  it('returns per-file cache miss for optional files missing required attributes', () => {
+    writeCacheLayout(tmpRoot)
+
+    const cache = new TestOptimizationHttpCache()
+    writeHttpCacheFile(tmpRoot, 'known_tests.json', { data: { attributes: {} } })
+    assert.strictEqual(cache.readKnownTests(), CACHE_MISS)
+    assert.strictEqual(cache.isAvailable(), true)
+
+    writeHttpCacheFile(tmpRoot, 'skippable_tests.json', { data: [{ type: 'suite', attributes: {} }] })
+    assert.strictEqual(cache.readSkippableSuites(), CACHE_MISS)
+    assert.strictEqual(cache.isAvailable(), true)
+
+    writeHttpCacheFile(tmpRoot, 'test_management.json', { data: { attributes: {} } })
+    assert.strictEqual(cache.readTestManagementTests(), CACHE_MISS)
+    assert.strictEqual(cache.isAvailable(), true)
+
+    writeHttpCacheFile(tmpRoot, 'known_tests.json', KNOWN_TESTS_RESPONSE)
+    assert.deepStrictEqual(cache.readKnownTests(), KNOWN_TESTS_RESPONSE.data.attributes.tests)
+  })
+})

From 7b6e65e2c240803840841d6a1a75f85880ef1ab8 Mon Sep 17 00:00:00 2001
From: Sam Brenner <106700075+sabrenner@users.noreply.github.com>
Date: Mon, 29 Jun 2026 10:56:34 -0400
Subject: [PATCH 17/51] test(langchain): bump tested langchain versions with
 new cassette (#9135)

---
 .../anthropic_v1_messages_post_f33becab.json  | 64 +++++++++++++++++++
 .../test/plugins/versions/package.json        | 10 +--
 2 files changed, 69 insertions(+), 5 deletions(-)
 create mode 100644 packages/dd-trace/test/llmobs/cassettes/anthropic/anthropic_v1_messages_post_f33becab.json

diff --git a/packages/dd-trace/test/llmobs/cassettes/anthropic/anthropic_v1_messages_post_f33becab.json b/packages/dd-trace/test/llmobs/cassettes/anthropic/anthropic_v1_messages_post_f33becab.json
new file mode 100644
index 0000000000..79041e55a8
--- /dev/null
+++ b/packages/dd-trace/test/llmobs/cassettes/anthropic/anthropic_v1_messages_post_f33becab.json
@@ -0,0 +1,64 @@
+{
+  "request": {
+    "method": "POST",
+    "url": "https://api.anthropic.com/v1/messages",
+    "headers": {
+      "Connection": "keep-alive",
+      "Accept": "application/json",
+      "User-Agent": "Anthropic/JS 0.103.0",
+      "X-Stainless-Retry-Count": "0",
+      "X-Stainless-Timeout": "600",
+      "X-Stainless-Lang": "js",
+      "X-Stainless-Package-Version": "0.103.0",
+      "X-Stainless-OS": "MacOS",
+      "X-Stainless-Arch": "arm64",
+      "X-Stainless-Runtime": "node",
+      "X-Stainless-Runtime-Version": "v24.14.1",
+      "anthropic-dangerous-direct-browser-access": "true",
+      "anthropic-version": "2023-06-01",
+      "Content-Type": "application/json",
+      "Accept-Language": "*",
+      "sec-fetch-mode": "cors",
+      "Accept-Encoding": "gzip, deflate",
+      "Content-Length": "119"
+    },
+    "body": "{\"model\":\"claude-haiku-4-5-20251001\",\"stream\":false,\"max_tokens\":16384,\"messages\":[{\"role\":\"user\",\"content\":\"Hello!\"}]}"
+  },
+  "response": {
+    "status": {
+      "code": 200,
+      "message": "OK"
+    },
+    "headers": {
+      "Date": "Mon, 29 Jun 2026 14:16:58 GMT",
+      "Content-Type": "application/json",
+      "Transfer-Encoding": "chunked",
+      "Connection": "keep-alive",
+      "anthropic-ratelimit-requests-limit": "20000",
+      "anthropic-ratelimit-requests-remaining": "19998",
+      "anthropic-ratelimit-requests-reset": "2026-06-29T14:16:58Z",
+      "anthropic-ratelimit-input-tokens-limit": "33800000",
+      "anthropic-ratelimit-input-tokens-remaining": "33800000",
+      "anthropic-ratelimit-input-tokens-reset": "2026-06-29T14:16:58Z",
+      "anthropic-ratelimit-output-tokens-limit": "5100000",
+      "anthropic-ratelimit-output-tokens-remaining": "5100000",
+      "anthropic-ratelimit-output-tokens-reset": "2026-06-29T14:16:58Z",
+      "anthropic-ratelimit-tokens-limit": "38900000",
+      "anthropic-ratelimit-tokens-remaining": "38900000",
+      "anthropic-ratelimit-tokens-reset": "2026-06-29T14:16:58Z",
+      "request-id": "req_011CcXhCJTXFMEuMGt6iEuHA",
+      "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
+      "anthropic-organization-id": "4257e925-ee99-4ee8-9c62-8e53716d5203",
+      "traceresponse": "00-75c1a803ef6b4f92f13c54ae89f07e25-a2248baea3a4f9cf-01",
+      "Server": "cloudflare",
+      "Content-Encoding": "gzip",
+      "vary": "Accept-Encoding",
+      "set-cookie": "_cfuvid=ov4s.yYh5a1cexjfcJhG8G45yw0PzpbmovIDjn8nwHs-1782742618.0674112-1.0.1.1-p3F3KU37ARKYBb0tekk.tvPEZexvEl_nj_aMRcnWKqI; HttpOnly; SameSite=None; Secure; Path=/; Domain=api.anthropic.com",
+      "X-Robots-Tag": "none",
+      "cf-cache-status": "DYNAMIC",
+      "Content-Security-Policy": "default-src 'none'; frame-ancestors 'none'",
+      "CF-RAY": "a1358d52eedc09ae-EWR"
+    },
+    "body": "{\"model\":\"claude-haiku-4-5-20251001\",\"id\":\"msg_01Umb157FEvyPktZZSgdcmZQ\",\"type\":\"message\",\"role\":\"assistant\",\"content\":[{\"type\":\"text\",\"text\":\"Hi there! How can I help you today?\"}],\"stop_reason\":\"end_turn\",\"stop_sequence\":null,\"stop_details\":null,\"usage\":{\"input_tokens\":9,\"cache_creation_input_tokens\":0,\"cache_read_input_tokens\":0,\"cache_creation\":{\"ephemeral_5m_input_tokens\":0,\"ephemeral_1h_input_tokens\":0},\"output_tokens\":13,\"service_tier\":\"standard\",\"inference_geo\":\"not_available\"}}"
+  }
+}
diff --git a/packages/dd-trace/test/plugins/versions/package.json b/packages/dd-trace/test/plugins/versions/package.json
index e9295a0019..eb3f489850 100644
--- a/packages/dd-trace/test/plugins/versions/package.json
+++ b/packages/dd-trace/test/plugins/versions/package.json
@@ -54,13 +54,13 @@
     "@jest/test-sequencer": "30.4.1",
     "@jest/transform": "30.4.1",
     "@koa/router": "15.5.0",
-    "@langchain/anthropic": "1.5.0",
-    "@langchain/classic": "1.0.36",
+    "@langchain/anthropic": "1.5.1",
+    "@langchain/classic": "1.0.38",
     "@langchain/cohere": "1.1.0",
-    "@langchain/core": "1.2.0",
+    "@langchain/core": "1.2.1",
     "@langchain/google-genai": "2.2.0",
-    "@langchain/langgraph": "1.4.4",
-    "@langchain/openai": "1.5.1",
+    "@langchain/langgraph": "1.4.7",
+    "@langchain/openai": "1.5.3",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@nats-io/nats-core": "3.4.0",
     "@nats-io/transport-node": "3.4.0",

From 908b6b957810f47ab6444d1d50329b7b13413b45 Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Mon, 29 Jun 2026 21:54:08 +0200
Subject: [PATCH 18/51] fix(iast): scope the mongodb nosql-analysis marker per
 query (#9076)

The NoSQL injection analyzer used `enterWith` to mark the async context,
which leaked the marker past the query. A request that ended before its
query finished stranded the marker for the next request, so that
request's injection went unreported. Two concurrent queries within the
same request also saw each other's marker, leaving one unanalyzed.

Binding the marker on the query-build channel fixed the leak but lost it
on deferred queries. A mongoose query builds, executes, and reaches the
driver in three separate async steps. `find().then()`/`.exec()` runs the
driver a turn after the synchronous build, outside the build's
`runStores` scope, so the driver re-analyzed the same filter and
reported the injection twice. Binding the marker around the execution
channel instead covers the full async scope that reaches the driver, and
`runStores` restores the parent on its own.

This re-enables the mongoose nosqli suite on Node 20 + Express 5 (skipped
for APPSEC-66705) and the mquery nosqli integration suite (skipped for
APPSEC-62431, where the unscoped marker caused each injection to be
reported N+1 times). The mquery suite skips mongodb >=7 on Node < 20:
that driver reads Web Crypto off the `crypto` global, which Node 18 does
not expose by default.
---
 .../datadog-instrumentations/src/mongoose.js  |  16 ++-
 .../nosql-injection-mongodb-analyzer.js       |  45 ++++----
 ...n-mongodb-analyzer.mongoose.plugin.spec.js |   7 +-
 ...ion-mongodb-analyzer.mquery.plugin.spec.js |  18 ++-
 .../nosql-injection-mongodb-analyzer.spec.js  | 107 ++++++++++++++++++
 5 files changed, 162 insertions(+), 31 deletions(-)

diff --git a/packages/datadog-instrumentations/src/mongoose.js b/packages/datadog-instrumentations/src/mongoose.js
index b5c6e5ab69..c0b765fac2 100644
--- a/packages/datadog-instrumentations/src/mongoose.js
+++ b/packages/datadog-instrumentations/src/mongoose.js
@@ -6,6 +6,12 @@ const { wrapThen } = require('./helpers/promise')
 
 const startCh = channel('datadog:mongoose:model:filter:start')
 const finishCh = channel('datadog:mongoose:model:filter:finish')
+// Bound around the deferred query execution. A subscriber returns the store that
+// stays active for the whole async scope that reaches the mongodb driver, so the
+// nested driver query can see the parent's analysis marker without it leaking
+// past the query. `runStores` enters the store only for that scope and restores
+// the parent on its own.
+const execCh = channel('datadog:mongoose:model:filter:exec')
 // this channel is for wrapping the callback of exec methods and handling store context
 const execStartCh = channel('apm:mongoose:exec:start')
 const execFinishCh = channel('apm:mongoose:exec:finish')
@@ -103,7 +109,13 @@ addHook({
         return startCh.runStores(ctx, () => {
           wrapCallbackIfExist(args, ctx)
 
-          const res = method.apply(this, args)
+          // A callback query executes synchronously inside `method.apply`, so the
+          // exec scope (and the deferred driver call it spawns) must be entered
+          // here. A promise query defers execution to a later `exec`/`then`, which
+          // is bound separately below.
+          const res = callbackWrapped
+            ? execCh.runStores(ctx, () => method.apply(this, args))
+            : method.apply(this, args)
 
           // if it is not callback, wrap exec method and its then
           if (!callbackWrapped) {
@@ -113,7 +125,7 @@ addHook({
                   wrapCallbackIfExist(args, ctx)
                 }
 
-                const execResult = originalExec.apply(this, args)
+                const execResult = execCh.runStores(ctx, () => originalExec.apply(this, args))
 
                 if (callbackWrapped || typeof execResult?.then !== 'function') {
                   return execResult
diff --git a/packages/dd-trace/src/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.js b/packages/dd-trace/src/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.js
index daf3252d6c..b0082e571d 100644
--- a/packages/dd-trace/src/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.js
+++ b/packages/dd-trace/src/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.js
@@ -15,6 +15,20 @@ const EXCLUDED_PATHS_FROM_STACK = getNodeModulesPaths('mongodb', 'mongoose', 'mq
 const SAFE_OPERATORS = new Set(['$eq', '$gt', '$gte', '$in', '$lt', '$lte', '$ne', '$nin',
   '$exists', '$type', '$mod', '$bitsAllClear', '$bitsAllSet', '$bitsAnyClear', '$bitsAnySet'])
 
+// Scope a marked child store for a query's deferred execution so the nested mongodb
+// driver query skips re-analysis. `bindStore` enters the child only for that async
+// scope and restores the parent on its own, so no marker can be stranded for a later
+// request to inherit, and two concurrent queries of the same request each branch from
+// the shared parent rather than from each other.
+function markExecStore () {
+  const store = storage('legacy').getStore()
+  if (store && !store.nosqlAnalyzed && getIastContext(store)) {
+    return { ...store, nosqlAnalyzed: true }
+  }
+
+  return store
+}
+
 class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
   constructor () {
     super(NOSQL_MONGODB_INJECTION)
@@ -27,7 +41,7 @@ class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
     // Anything that accesses the storage is context dependent
     const onStart = ({ filters }) => {
       const store = storage('legacy').getStore()
-      if (store && !store.nosqlAnalyzed && filters?.length) {
+      if (store && !store.nosqlAnalyzed && filters?.length && getIastContext(store)) {
         for (const filter of filters) {
           this.analyze({ filter }, store)
         }
@@ -36,30 +50,23 @@ class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
       return store
     }
 
-    const onStartAndEnterWithStore = (message) => {
-      const store = onStart(message || {})
-      if (store) {
-        storage('legacy').enterWith({ ...store, nosqlAnalyzed: true, nosqlParentStore: store })
-      }
-    }
-
-    // Anything that accesses the storage is context dependent
-    // eslint-disable-next-line unicorn/consistent-function-scoping
-    const onFinish = () => {
-      const store = storage('legacy').getStore()
-      if (store?.nosqlParentStore) {
-        storage('legacy').enterWith(store.nosqlParentStore)
-      }
+    // mquery analyzes and marks on the same channel: its tracing start both reaches
+    // the driver scope and is the first place the filters are available.
+    const onStartAndBind = (message) => {
+      onStart(message)
+      return markExecStore()
     }
 
     this.addSub('datadog:mongodb:collection:filter:start', onStart)
 
-    this.addSub('datadog:mongoose:model:filter:start', onStartAndEnterWithStore)
-    this.addSub('datadog:mongoose:model:filter:finish', onFinish)
+    // A mongoose query builds, executes, and reaches the driver in separate async
+    // steps. The filters are analyzed at the build, but the marker is bound around
+    // the execution channel, where the driver call still runs under the parent store.
+    this.addSub('datadog:mongoose:model:filter:start', onStart)
+    this.addBind('datadog:mongoose:model:filter:exec', markExecStore)
 
     this.addSub('datadog:mquery:filter:prepare', onStart)
-    this.addSub('tracing:datadog:mquery:filter:start', onStartAndEnterWithStore)
-    this.addSub('tracing:datadog:mquery:filter:asyncEnd', onFinish)
+    this.addBind('tracing:datadog:mquery:filter:start', onStartAndBind)
   }
 
   configureSanitizers () {
diff --git a/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.mongoose.plugin.spec.js b/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.mongoose.plugin.spec.js
index c6aca3e971..c5754e08bc 100644
--- a/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.mongoose.plugin.spec.js
+++ b/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.mongoose.plugin.spec.js
@@ -8,14 +8,9 @@ const semver = require('semver')
 const { prepareTestServerForIastInExpress } = require('../utils')
 const agent = require('../../../plugins/agent')
 const { withVersions } = require('../../../setup/mocha')
-const { NODE_MAJOR } = require('../../../../../../version')
 
 describe('nosql injection detection in mongodb - whole feature', () => {
-  withVersions('mongoose', 'express', (expressVersion, _moduleName, resolvedExpressVersion) => {
-    // Node 20 + Express 5 loses IAST taint on the per-request `req.query` getter;
-    // passes on Node 18 and Node 24. See APPSEC-66705.
-    if (NODE_MAJOR === 20 && semver.major(resolvedExpressVersion) >= 5) return
-
+  withVersions('mongoose', 'express', expressVersion => {
     withVersions('mongoose', 'mongoose', '>4.0.0', mongooseVersion => {
       const specificMongooseVersion = require(`../../../../../../versions/mongoose@${mongooseVersion}`).version()
 
diff --git a/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.mquery.plugin.spec.js b/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.mquery.plugin.spec.js
index db9d1aa22b..40c2f93e70 100644
--- a/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.mquery.plugin.spec.js
+++ b/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.mquery.plugin.spec.js
@@ -7,17 +7,27 @@ const path = require('node:path')
 
 const axios = require('axios')
 const { after, before, describe } = require('mocha')
+const satisfies = require('semifies')
 
 const agent = require('../../../plugins/agent')
 const { withVersions } = require('../../../setup/mocha')
 const { prepareTestServerForIastInExpress } = require('../utils')
+const { NODE_MAJOR } = require('../../../../../../version')
 
-// TODO(APPSEC-62431): re-enable once duplicate NOSQL_MONGODB_INJECTION
-// detection (N+1 !== N) is fixed
-describe.skip('nosql injection detection with mquery', () => {
+describe('nosql injection detection with mquery', () => {
   // https://github.com/fiznool/express-mongo-sanitize/issues/200
   withVersions('mquery', 'express', '>4.18.0 <5.0.0', expressVersion => {
     withVersions('mquery', 'mongodb', mongodbVersion => {
+      const mongodb = require(`../../../../../../versions/mongodb@${mongodbVersion}`)
+
+      // TODO: remove once Node.js 18 is no longer supported
+      if (satisfies(mongodb.version(), '>=7') && NODE_MAJOR < 20) {
+        describe.skip(
+          `Skipping the tests as mongodb@${mongodb.version()} requires Node.js >= 20 (current: ${NODE_MAJOR})`
+        )
+        return
+      }
+
       const vulnerableMethodFilename = 'mquery-vulnerable-method.js'
       let client, testCollection, tmpFilePath, dbName
 
@@ -28,7 +38,7 @@ describe.skip('nosql injection detection with mquery', () => {
       before(async () => {
         const id = require('../../../../src/id')
         dbName = id().toString()
-        const mongo = require(`../../../../../../versions/mongodb@${mongodbVersion}`).get()
+        const mongo = mongodb.get()
 
         client = new mongo.MongoClient(`mongodb://localhost:27017/${dbName}`)
         await client.connect()
diff --git a/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.spec.js b/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.spec.js
index ec84c4d4e4..1119fa4bc9 100644
--- a/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.spec.js
+++ b/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.spec.js
@@ -4,7 +4,9 @@ const assert = require('node:assert/strict')
 
 const { afterEach, before, beforeEach, describe, it } = require('mocha')
 const proxyquire = require('proxyquire')
+const sinon = require('sinon')
 
+const { storage } = require('../../../../../datadog-core')
 const { channel } = require('../../../../../datadog-instrumentations/src/helpers/instrument')
 const {
   createTransaction,
@@ -12,6 +14,7 @@ const {
   removeTransaction,
   getRanges,
 } = require('../../../../src/appsec/iast/taint-tracking/operations')
+const { IAST_CONTEXT_KEY } = require('../../../../src/appsec/iast/iast-context')
 const { NOSQL_MONGODB_INJECTION_MARK } = require('../../../../src/appsec/iast/taint-tracking/secure-marks')
 
 const sanitizeMiddlewareFinished = channel('datadog:express-mongo-sanitize:filter:finish')
@@ -127,4 +130,108 @@ describe('nosql injection detection in mongodb', () => {
       })
     })
   })
+
+  describe('per-query analysis scoping', () => {
+    const legacyStorage = storage('legacy')
+    const nosqlAnalyzer = require('../../../../src/appsec/iast/analyzers/nosql-injection-mongodb-analyzer')
+    const mongooseFilterStart = channel('datadog:mongoose:model:filter:start')
+    const mongooseFilterExec = channel('datadog:mongoose:model:filter:exec')
+    const mongodbFilterStart = channel('datadog:mongodb:collection:filter:start')
+
+    let analyze
+
+    // Drive an outer mongoose query the way the instrumentation does: the filters
+    // are analyzed at the synchronous build (`model:filter:start`), then the query
+    // executes inside `model:filter:exec`'s `runStores`, which enters the marked
+    // store the analyzer's bound transform returns. The nested mongodb driver start
+    // fires a turn later, from inside that execution scope, mirroring mongoose
+    // deferring to the driver after the build has returned. `model:filter:start`
+    // uses `runStores` to match the instrumentation: that is what makes the build
+    // analysis run, so a marker missing at execution time surfaces as a second
+    // analysis on the deferred driver call.
+    function runMongooseQuery (store, filter) {
+      return new Promise((resolve, reject) => {
+        legacyStorage.run(store, () => {
+          mongooseFilterStart.runStores({ filters: [filter] }, () => {})
+
+          mongooseFilterExec.runStores({ filters: [filter] }, () => {
+            setImmediate(() => {
+              try {
+                mongodbFilterStart.publish({ filters: [filter] })
+                resolve()
+              } catch (error) {
+                reject(error)
+              }
+            })
+          })
+        })
+      })
+    }
+
+    beforeEach(() => {
+      nosqlAnalyzer.configure({ enabled: true })
+      analyze = sinon.spy(nosqlAnalyzer, 'analyze')
+    })
+
+    afterEach(() => {
+      analyze.restore()
+      nosqlAnalyzer.configure({ enabled: false })
+    })
+
+    it('analyzes an outer query once and skips its deferred driver call', async () => {
+      const store = { [IAST_CONTEXT_KEY]: {} }
+
+      await runMongooseQuery(store, { name: 'value' })
+
+      assert.strictEqual(analyze.callCount, 1)
+    })
+
+    it('analyzes a direct mongodb driver query with no outer mongoose layer', () => {
+      const store = { [IAST_CONTEXT_KEY]: {} }
+
+      legacyStorage.run(store, () => {
+        mongodbFilterStart.publish({ filters: [{ name: 'value' }] })
+      })
+
+      assert.strictEqual(analyze.callCount, 1)
+    })
+
+    it('does not analyze when there is no IAST context in the store', async () => {
+      await runMongooseQuery({}, { name: 'value' })
+
+      assert.strictEqual(analyze.callCount, 0)
+    })
+
+    it('skips a query whose store is already marked as analyzed', async () => {
+      const store = { [IAST_CONTEXT_KEY]: {}, nosqlAnalyzed: true }
+
+      await runMongooseQuery(store, { name: 'value' })
+
+      assert.strictEqual(analyze.callCount, 0)
+    })
+
+    it('analyzes both of two concurrent queries in the same request', async () => {
+      // Two queries of the same request run concurrently: each execution scope
+      // branches from the shared request store, not from the sibling's child
+      // store, so neither query's marker suppresses the other. Both outer filters
+      // are analyzed and each deferred driver call is skipped.
+      const requestStore = { [IAST_CONTEXT_KEY]: {} }
+      const filterA = { name: 'a' }
+      const filterB = { name: 'b' }
+
+      await new Promise((resolve, reject) => {
+        legacyStorage.run(requestStore, () => {
+          Promise.all([
+            runMongooseQuery(requestStore, filterA),
+            runMongooseQuery(requestStore, filterB),
+          ]).then(resolve, reject)
+        })
+      })
+
+      assert.strictEqual(analyze.callCount, 2)
+      const analyzedFilters = new Set(analyze.args.map(([value]) => value.filter))
+      assert.ok(analyzedFilters.has(filterA), 'query A filter analyzed')
+      assert.ok(analyzedFilters.has(filterB), 'query B filter analyzed')
+    })
+  })
 })

From 16bd4db7620814bc0b7f04eaef8141162eb26e50 Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Tue, 30 Jun 2026 01:08:06 +0200
Subject: [PATCH 19/51] fix(graphql)!: decouple resolver depth from path
 collapsing (#8774)

The `depth` filter counted a resolver's full execution path, including the
numeric list indices that `collapse` later folds away. The same query therefore
reached a different depth depending on whether `collapse` was on: a field one
list-hop below the limit was instrumented when collapsing was off and dropped
when it was on, even though both describe the same selection-set nesting.

Count only selection-set segments (string path keys) toward `depth`, so the
limit tracks query structure rather than execution artifacts.

This shifts which resolvers are instrumented at a given `depth`, so it is gated
behind `DD_MAJOR`: the v5 line keeps the old list-index counting when collapsing
is on, and v6 counts selection-set depth only. The `countListIndices` config
flag carries the gate so `shouldInstrumentNode` stays free of version checks.

Fixes: #7468
---
 MIGRATING.md                                  | 13 ++++
 benchmark/sirun/plugin-graphql-long/meta.json |  2 +-
 index.d.ts                                    |  2 +
 .../datadog-plugin-graphql/src/execute.js     |  9 ++-
 packages/datadog-plugin-graphql/src/index.js  |  7 +-
 .../test/config.spec.js                       | 58 +++++++++++++++
 .../datadog-plugin-graphql/test/index.spec.js | 73 +++++++++++++------
 7 files changed, 136 insertions(+), 28 deletions(-)
 create mode 100644 packages/datadog-plugin-graphql/test/config.spec.js

diff --git a/MIGRATING.md b/MIGRATING.md
index d21a0e3d80..a6e55ccc99 100644
--- a/MIGRATING.md
+++ b/MIGRATING.md
@@ -113,6 +113,19 @@ The `ingestion: { sampleRate, rateLimit }` wrapper has been removed. Set
 `sampleRate` and `rateLimit` directly on the top-level `TracerOptions` object,
 or use `DD_TRACE_SAMPLE_RATE` / `DD_TRACE_RATE_LIMIT`.
 
+### GraphQL resolver `depth` no longer counts list indices
+
+The `graphql` plugin's `depth` option counted a resolver's full execution path,
+including the numeric list indices that `collapse` folds away. The same query
+therefore reached a different depth depending on whether `collapse` was enabled:
+a field one list-hop below the limit was instrumented with `collapse: false` and
+dropped with the default `collapse: true`.
+
+v6 counts only selection-set nesting (named fields) toward `depth`, so the limit
+tracks query structure rather than execution artifacts and is independent of
+`collapse`. At a given `depth`, a resolver nested under a list is now reached one
+level sooner than on v5's default. Lower `depth` to restore the previous cutoff.
+
 ## 4.0 to 5.0
 
 ### Node 16 is no longer supported
diff --git a/benchmark/sirun/plugin-graphql-long/meta.json b/benchmark/sirun/plugin-graphql-long/meta.json
index d84aaef57d..641061a633 100644
--- a/benchmark/sirun/plugin-graphql-long/meta.json
+++ b/benchmark/sirun/plugin-graphql-long/meta.json
@@ -11,7 +11,7 @@
       "env": { "WITH_TRACER": "1", "WITH_DEPTH": "0", "OPERATIONS": "1150" }
     },
     "with-depth-on-max": {
-      "env": { "WITH_TRACER": "1", "WITH_DEPTH": "4", "OPERATIONS": "800" }
+      "env": { "WITH_TRACER": "1", "WITH_DEPTH": "6", "OPERATIONS": "800" }
     },
     "with-depth-and-collapse-off": {
       "env": { "WITH_TRACER": "1", "WITH_DEPTH_AND_COLLAPSE": "4,0", "OPERATIONS": "210" }
diff --git a/index.d.ts b/index.d.ts
index d12949a9cb..87dbcb25f8 100644
--- a/index.d.ts
+++ b/index.d.ts
@@ -2531,6 +2531,8 @@ declare namespace tracer {
       /**
        * The maximum depth of fields/resolvers to instrument. Set to `0` to only
        * instrument the operation or to `-1` to instrument all fields/resolvers.
+       * Counts selection-set nesting (named fields) only; list indices do not
+       * count toward the limit, regardless of `collapse`.
        *
        * @default -1
        */
diff --git a/packages/datadog-plugin-graphql/src/execute.js b/packages/datadog-plugin-graphql/src/execute.js
index 68bf294a1a..19785af918 100644
--- a/packages/datadog-plugin-graphql/src/execute.js
+++ b/packages/datadog-plugin-graphql/src/execute.js
@@ -533,14 +533,15 @@ function buildCachedCollapsedPath (path, cache) {
 }
 
 // Depth filtering directly on the linked-list node — no array allocation needed.
-// config.depth < 0 means no limit. In non-collapse mode only string segments
-// count toward depth (array indices are transparent). In collapse mode every
-// node counts (numbers have been conceptually '*'-collapsed).
+// config.depth < 0 means no limit. Only selection-set segments (string keys)
+// count toward depth; list indices are execution artifacts and are transparent.
+// On the v5 line `countListIndices` keeps the legacy behaviour of counting every
+// node when collapsing folds the numeric indices into '*'.
 function shouldInstrumentNode (config, path) {
   if (config.depth < 0) return true
 
   let depth = 0
-  if (config.collapse) {
+  if (config.countListIndices) {
     for (let curr = path; curr; curr = curr.prev) depth++
   } else {
     for (let curr = path; curr; curr = curr.prev) {
diff --git a/packages/datadog-plugin-graphql/src/index.js b/packages/datadog-plugin-graphql/src/index.js
index f1fbcab332..a679c15424 100644
--- a/packages/datadog-plugin-graphql/src/index.js
+++ b/packages/datadog-plugin-graphql/src/index.js
@@ -1,6 +1,7 @@
 'use strict'
 
 const pick = require('../../datadog-core/src/utils/src/pick')
+const { DD_MAJOR } = require('../../../version')
 const CompositePlugin = require('../../dd-trace/src/plugins/composite')
 const log = require('../../dd-trace/src/log')
 const GraphQLExecutePlugin = require('./execute')
@@ -31,11 +32,15 @@ class GraphQLPlugin extends CompositePlugin {
 // config validator helpers
 
 function validateConfig (config) {
+  const collapse = config.collapse === undefined || !!config.collapse
   return {
     ...config,
     depth: getDepth(config),
     variables: getVariablesFilter(config),
-    collapse: config.collapse === undefined || !!config.collapse,
+    collapse,
+    // v5 counted collapsed list indices toward `depth`, so the same query reached a
+    // different depth depending on `collapse`. v6 counts selection-set depth only.
+    countListIndices: DD_MAJOR < 6 && collapse,
     hooks: getHooks(config),
   }
 }
diff --git a/packages/datadog-plugin-graphql/test/config.spec.js b/packages/datadog-plugin-graphql/test/config.spec.js
new file mode 100644
index 0000000000..dd35517850
--- /dev/null
+++ b/packages/datadog-plugin-graphql/test/config.spec.js
@@ -0,0 +1,58 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+
+const { before, describe, it } = require('mocha')
+const proxyquire = require('proxyquire').noPreserveCache()
+
+// `countListIndices` decides whether numeric list-index path segments count toward
+// the resolver `depth` limit. The v5 release line counts them when collapsing; v6
+// never does, so depth always tracks selection-set nesting. The behaviour is gated
+// on DD_MAJOR, so stub the version constant to reach both arms on either release line.
+function loadPluginFor (DD_MAJOR) {
+  const GraphQLPlugin = proxyquire('../src', {
+    '../../../version': { DD_MAJOR, '@noCallThru': true },
+  })
+
+  return new GraphQLPlugin({}, {})
+}
+
+// CompositePlugin spreads the validated config into every sub-plugin, so the
+// execute plugin (which carries the depth gate) sees `countListIndices`.
+function countListIndicesFor (plugin, options) {
+  plugin.configure({ depth: 2, ...options })
+  return plugin.execute.config.countListIndices
+}
+
+describe('graphql plugin depth/collapse gate', () => {
+  describe('v5 (DD_MAJOR < 6)', () => {
+    let plugin
+
+    before(() => {
+      plugin = loadPluginFor(5)
+    })
+
+    it('counts collapsed list indices toward depth (collapse defaults on)', () => {
+      assert.strictEqual(countListIndicesFor(plugin, {}), true)
+      assert.strictEqual(countListIndicesFor(plugin, { collapse: true }), true)
+    })
+
+    it('counts only field segments when collapsing is disabled', () => {
+      assert.strictEqual(countListIndicesFor(plugin, { collapse: false }), false)
+    })
+  })
+
+  describe('v6 (DD_MAJOR >= 6)', () => {
+    let plugin
+
+    before(() => {
+      plugin = loadPluginFor(6)
+    })
+
+    it('never counts list indices, regardless of collapse', () => {
+      assert.strictEqual(countListIndicesFor(plugin, {}), false)
+      assert.strictEqual(countListIndicesFor(plugin, { collapse: true }), false)
+      assert.strictEqual(countListIndicesFor(plugin, { collapse: false }), false)
+    })
+  })
+})
diff --git a/packages/datadog-plugin-graphql/test/index.spec.js b/packages/datadog-plugin-graphql/test/index.spec.js
index bb7d108900..7ae02f32ed 100644
--- a/packages/datadog-plugin-graphql/test/index.spec.js
+++ b/packages/datadog-plugin-graphql/test/index.spec.js
@@ -12,6 +12,7 @@ const semver = require('semver')
 const sinon = require('sinon')
 
 const { assertObjectContains } = require('../../../integration-tests/helpers')
+const { DD_MAJOR } = require('../../../version')
 const { ERROR_MESSAGE, ERROR_TYPE, ERROR_STACK } = require('../../dd-trace/src/constants')
 const agent = require('../../dd-trace/test/plugins/agent')
 const { withNamingSchema, withVersions } = require('../../dd-trace/test/setup/mocha')
@@ -2045,33 +2046,61 @@ describe('Plugin', () => {
           buildSchema()
         })
 
-        it('should only instrument up to the specified depth', () => {
-          const source = `
-            {
-              human {
-                name
-                address {
-                  civicNumber
-                  street
-                }
-              }
-              friends {
-                name
+        const source = `
+          {
+            human {
+              name
+              address {
+                civicNumber
+                street
               }
             }
-          `
+            friends {
+              name
+            }
+          }
+        `
+
+        // friends.*.name sits two fields deep (friends -> name); the list index
+        // between them is an execution artifact, not a query level, so depth: 2
+        // reaches it. human.address.civicNumber / human.address.street sit three
+        // fields deep and stay gated.
+        const v6DepthTest = DD_MAJOR >= 6 ? it : it.skip
+        v6DepthTest('counts selection-set depth only, so a collapsed list field resolves at its field depth', () => {
+          const assertion = agent.assertSomeTraces(traces => {
+            const paths = sort(traces[0])
+              .filter(span => span.name === 'graphql.resolve')
+              .map(span => span.meta['graphql.field.path'])
+              .sort()
 
+            assert.deepStrictEqual(paths, [
+              'friends',
+              'friends.*.name',
+              'human',
+              'human.address',
+              'human.name',
+            ])
+          })
+
+          return Promise.all([assertion, graphql.graphql({ schema, source })])
+        })
+
+        // v5 counted the collapsed list index toward depth, so friends.*.name sat
+        // three segments deep and was gated. Pin that contract on the v5 line.
+        const legacyDepthTest = DD_MAJOR < 6 ? it : it.skip
+        legacyDepthTest('counts collapsed list indices toward depth on v5', () => {
           const assertion = agent.assertSomeTraces(traces => {
-            const spans = sort(traces[0])
-            const ignored = spans.filter(span => {
-              return [
-                'human.address.civicNumber',
-                'human.address.street',
-              ].indexOf(span.resource) !== -1
-            })
+            const paths = sort(traces[0])
+              .filter(span => span.name === 'graphql.resolve')
+              .map(span => span.meta['graphql.field.path'])
+              .sort()
 
-            assert.strictEqual(spans.length, 5)
-            assert.strictEqual(ignored.length, 0)
+            assert.deepStrictEqual(paths, [
+              'friends',
+              'human',
+              'human.address',
+              'human.name',
+            ])
           })
 
           return Promise.all([assertion, graphql.graphql({ schema, source })])

From 1f899b5aec1bd29d9638e3a41b095f9be61352d0 Mon Sep 17 00:00:00 2001
From: Carles Capell <107924659+CarlesDD@users.noreply.github.com>
Date: Tue, 30 Jun 2026 07:00:18 +0200
Subject: [PATCH 20/51] feat(aap): In App WAF support for lambda (#7783)

Adds AppSec support for AWS lambda to dd-trace-js by introducing DC handlers that allow the datadog-lambda-js layer to delegate WAF execution to the tracer.
---
 packages/dd-trace/src/appsec/channels.js      |   2 +
 packages/dd-trace/src/appsec/index.js         |  11 +-
 packages/dd-trace/src/appsec/lambda.js        | 132 +++++
 packages/dd-trace/src/appsec/reporter.js      |  59 +-
 packages/dd-trace/src/appsec/waf/index.js     |  20 +-
 .../src/appsec/waf/waf_context_wrapper.js     |   8 +-
 packages/dd-trace/test/appsec/lambda.spec.js  | 502 ++++++++++++++++++
 .../dd-trace/test/appsec/reporter.spec.js     |  43 ++
 .../dd-trace/test/appsec/waf/index.spec.js    |  10 +-
 9 files changed, 763 insertions(+), 24 deletions(-)
 create mode 100644 packages/dd-trace/src/appsec/lambda.js
 create mode 100644 packages/dd-trace/test/appsec/lambda.spec.js

diff --git a/packages/dd-trace/src/appsec/channels.js b/packages/dd-trace/src/appsec/channels.js
index 608e5e3375..5cdd6e52d2 100644
--- a/packages/dd-trace/src/appsec/channels.js
+++ b/packages/dd-trace/src/appsec/channels.js
@@ -27,6 +27,8 @@ module.exports = {
   httpClientResponseFinish: dc.channel('apm:http:client:response:finish'),
   incomingHttpRequestEnd: dc.channel('dd-trace:incomingHttpRequestEnd'),
   incomingHttpRequestStart: dc.channel('dd-trace:incomingHttpRequestStart'),
+  lambdaStartInvocation: dc.channel('datadog:lambda:start-invocation'),
+  lambdaEndInvocation: dc.channel('datadog:lambda:end-invocation'),
   multerParser: dc.channel('datadog:multer:read:finish'),
   mysql2OuterQueryStart: dc.channel('datadog:mysql2:outerquery:start'),
   nextBodyParsed: dc.channel('apm:next:body-parsed'),
diff --git a/packages/dd-trace/src/appsec/index.js b/packages/dd-trace/src/appsec/index.js
index 1c847aad19..1fcb9221a8 100644
--- a/packages/dd-trace/src/appsec/index.js
+++ b/packages/dd-trace/src/appsec/index.js
@@ -16,6 +16,8 @@ const {
   fastifyCookieParser,
   incomingHttpRequestStart,
   incomingHttpRequestEnd,
+  lambdaStartInvocation,
+  lambdaEndInvocation,
   passportVerify,
   passportUser,
   expressSession,
@@ -43,6 +45,7 @@ const { isBlocked, block, callBlockDelegation, setTemplates, getBlockingAction }
 const { getActiveRequest } = require('./store')
 const UserTracking = require('./user_tracking')
 const graphql = require('./graphql')
+const lambda = require('./lambda')
 const rasp = require('./rasp')
 
 const responseAnalyzedSet = new WeakSet()
@@ -99,11 +102,15 @@ function enable (_config) {
     stripeCheckoutSessionCreate.subscribe(onStripeCheckoutSessionCreate)
     stripePaymentIntentCreate.subscribe(onStripePaymentIntentCreate)
     stripeConstructEvent.subscribe(onStripeConstructEvent)
+    lambdaStartInvocation.subscribe(lambda.onLambdaStartInvocation)
+    lambdaEndInvocation.subscribe(lambda.onLambdaEndInvocation)
 
     isEnabled = true
     config = _config
   } catch (err) {
-    if (!IS_SERVERLESS) {
+    if (IS_SERVERLESS) {
+      log.debug('[ASM] Serverless mode: suppressing error log, calling disable()')
+    } else {
       log.error('[ASM] Unable to start AppSec', err)
     }
 
@@ -544,6 +551,8 @@ function disable () {
   if (stripeCheckoutSessionCreate.hasSubscribers) stripeCheckoutSessionCreate.unsubscribe(onStripeCheckoutSessionCreate)
   if (stripePaymentIntentCreate.hasSubscribers) stripePaymentIntentCreate.unsubscribe(onStripePaymentIntentCreate)
   if (stripeConstructEvent.hasSubscribers) stripeConstructEvent.unsubscribe(onStripeConstructEvent)
+  if (lambdaStartInvocation.hasSubscribers) lambdaStartInvocation.unsubscribe(lambda.onLambdaStartInvocation)
+  if (lambdaEndInvocation.hasSubscribers) lambdaEndInvocation.unsubscribe(lambda.onLambdaEndInvocation)
 }
 
 /**
diff --git a/packages/dd-trace/src/appsec/lambda.js b/packages/dd-trace/src/appsec/lambda.js
new file mode 100644
index 0000000000..6b11e72c69
--- /dev/null
+++ b/packages/dd-trace/src/appsec/lambda.js
@@ -0,0 +1,132 @@
+'use strict'
+
+const { HTTP_CLIENT_IP } = require('../../../../ext/tags')
+
+const log = require('../log')
+const addresses = require('./addresses')
+const Reporter = require('./reporter')
+const waf = require('./waf')
+
+// Tracks spans for which start-invocation has been processed, so that
+// end-invocation can gate correctly
+const activeInvocations = new WeakSet()
+
+/**
+ * Maps pre-extracted HTTP data from the Lambda event to WAF addresses,
+ * runs the WAF, and reports results on the span.
+ *
+ * @param {{ span: object, headers: Record<string, string>, method: string, path: string,
+ *           query: Record<string, string | string[]> | undefined, body: string | object | undefined,
+ *           isBase64Encoded: boolean, clientIp: string | undefined,
+ *           pathParams: Record<string, string> | undefined,
+ *           cookies: Record<string, string> | undefined,
+ *           route: string | undefined }} data
+ */
+function onLambdaStartInvocation (data) {
+  try {
+    const { span, headers, method, path, query, body, clientIp, pathParams, cookies } = data
+
+    if (!span) {
+      log.warn('[ASM] No span provided in Lambda start invocation')
+      return
+    }
+
+    activeInvocations.add(span)
+
+    span.setTag('_dd.appsec.enabled', 1)
+
+    const persistent = {}
+
+    if (path) {
+      persistent[addresses.HTTP_INCOMING_URL] = path
+    }
+
+    if (method) {
+      persistent[addresses.HTTP_INCOMING_METHOD] = method
+    }
+
+    if (headers) {
+      // Cookie header is already stripped by the Lambda layer's event-data-extractor
+      persistent[addresses.HTTP_INCOMING_HEADERS] = headers
+    }
+
+    if (clientIp) {
+      span.setTag(HTTP_CLIENT_IP, clientIp)
+      persistent[addresses.HTTP_CLIENT_IP] = clientIp
+    }
+
+    if (query) {
+      persistent[addresses.HTTP_INCOMING_QUERY] = query
+    }
+
+    if (body !== undefined && body !== null) {
+      persistent[addresses.HTTP_INCOMING_BODY] = body
+    }
+
+    if (pathParams) {
+      persistent[addresses.HTTP_INCOMING_PARAMS] = pathParams
+    }
+
+    if (cookies) {
+      persistent[addresses.HTTP_INCOMING_COOKIES] = cookies
+    }
+
+    waf.run({ persistent }, span, undefined, span)
+  } catch (err) {
+    log.error('[ASM] Error in Lambda start-invocation handler', err)
+  }
+}
+
+/**
+ * Maps response data to WAF addresses, runs a final WAF pass,
+ * disposes the WAF context, and finishes the request report.
+ *
+ * @param {{ span: object, statusCode: string | undefined,
+ *           responseHeaders: Record<string, string> | undefined }} data
+ */
+function onLambdaEndInvocation (data) {
+  try {
+    const { span, statusCode, responseHeaders } = data
+
+    if (!span) {
+      log.warn('[ASM] No span provided in Lambda end invocation')
+      return
+    }
+
+    if (!activeInvocations.has(span)) {
+      return
+    }
+
+    activeInvocations.delete(span)
+
+    let hasPersistentData = false
+    const persistent = {}
+
+    if (statusCode) {
+      persistent[addresses.HTTP_INCOMING_RESPONSE_CODE] = String(statusCode)
+      hasPersistentData = true
+    }
+
+    if (responseHeaders) {
+      const filteredHeaders = { ...responseHeaders }
+      delete filteredHeaders['set-cookie']
+      persistent[addresses.HTTP_INCOMING_RESPONSE_HEADERS] = filteredHeaders
+      hasPersistentData = true
+    }
+
+    if (hasPersistentData) {
+      waf.run({ persistent }, span, undefined, span)
+    }
+
+    waf.disposeContext(span)
+
+    Reporter.finishRequest(span, null, {}, undefined, span)
+  } catch (err) {
+    log.error('[ASM] Error in Lambda end-invocation handler', err)
+  }
+}
+
+module.exports = {
+  onLambdaStartInvocation,
+  onLambdaEndInvocation,
+}
diff --git a/packages/dd-trace/src/appsec/reporter.js b/packages/dd-trace/src/appsec/reporter.js
index 5db5a3ed04..c2fb000d9b 100644
--- a/packages/dd-trace/src/appsec/reporter.js
+++ b/packages/dd-trace/src/appsec/reporter.js
@@ -318,13 +318,21 @@ function reportWafConfigUpdate (product, rcConfigId, diagnostics, wafVersion) {
   }
 }
 
-function reportMetrics (metrics, raspRule, req) {
+/**
+ * @param {object} metrics - WAF run metrics
+ * @param {string} [raspRule] - RASP rule identifier
+ * @param {object} [req] - Request key (plain object for lambda)
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function reportMetrics (metrics, raspRule, req, rootSpan) {
   if (!req) {
     req = getActiveRequest()
   }
-  const rootSpan = req && web.root(req)
+  if (!rootSpan) {
+    rootSpan = req && web.root(req)
+  }
 
-  if (!rootSpan) return
+  if (!req || !rootSpan) return
 
   if (metrics.rulesVersion) {
     rootSpan.setTag('_dd.appsec.event_rules.version', metrics.rulesVersion)
@@ -353,13 +361,26 @@ function reportTruncationMetrics (rootSpan, metrics) {
   }
 }
 
-function reportAttack ({ events: attackData, actions }, req) {
+// NOTE: `req` in the WAF execution path may be any object, not necessarily
+// an HTTP IncomingMessage. In Lambda, it is a plain context key ({}) with no
+// HTTP properties. Always guard HTTP-specific property access
+// See tests in lambda.spec.js for enforcement.
+
+/**
+ * @param {{ events: Array, actions: object }} result - WAF result with attack data
+ * @param {object} [req] - Request key. May be an HTTP IncomingMessage or a plain object (Lambda)
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function reportAttack ({ events: attackData, actions }, req, rootSpan) {
   if (!req) {
     req = getActiveRequest()
   }
 
-  const rootSpan = web.root(req)
-  if (!rootSpan) return
+  if (!rootSpan) {
+    rootSpan = web.root(req)
+  }
+
+  if (!req || !rootSpan) return
 
   const spanContext = rootSpan.context()
 
@@ -494,14 +515,21 @@ function isSchemaAttribute (attribute) {
   return attribute.startsWith('_dd.appsec.s.')
 }
 
-function reportAttributes (attributes, req) {
+/**
+ * @param {object} [attributes] - WAF result attributes
+ * @param {object} [req] - Request key (plain object for lambda)
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function reportAttributes (attributes, req, rootSpan) {
   if (!attributes) return
 
   if (!req) {
     req = getActiveRequest()
   }
 
-  const rootSpan = web.root(req)
+  if (!rootSpan) {
+    rootSpan = web.root(req)
+  }
 
   if (!rootSpan) return
 
@@ -517,8 +545,17 @@ function reportAttributes (attributes, req) {
   rootSpan.addTags(tags)
 }
 
-function finishRequest (req, res, storedResponseHeaders, requestBody) {
-  const rootSpan = web.root(req)
+/**
+ * @param {object} [req] - Request key (null for Lambda)
+ * @param {object} [res] - Response object (null for lambda)
+ * @param {object} storedResponseHeaders
+ * @param {object} [requestBody]
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function finishRequest (req, res, storedResponseHeaders, requestBody, rootSpan) {
+  if (!rootSpan) {
+    rootSpan = web.root(req)
+  }
   if (!rootSpan) return
 
   if (metricsQueue.size) {
@@ -569,6 +606,8 @@ function finishRequest (req, res, storedResponseHeaders, requestBody) {
     rootSpan.setTag('_dd.appsec.rasp.rule.eval', metrics.raspEvalCount)
   }
 
+  if (!req) return
+
   incrementWafRequestsMetric(req)
 
   const tags = rootSpan.context().getTags()
diff --git a/packages/dd-trace/src/appsec/waf/index.js b/packages/dd-trace/src/appsec/waf/index.js
index caa613ebb1..7601c64b53 100644
--- a/packages/dd-trace/src/appsec/waf/index.js
+++ b/packages/dd-trace/src/appsec/waf/index.js
@@ -110,7 +110,19 @@ function removeConfig (configPath) {
   }
 }
 
-function run (data, req, raspRule) {
+// `req` in the WAF execution path may be any object, not necessarily
+// an HTTP IncomingMessage (it is a plain object for lambda).
+// Always guard HTTP-specific property access.
+// @see packages/dd-trace/test/appsec/lambda.spec.js
+
+/**
+ * @param {object} data - WAF address data ({ persistent, ephemeral })
+ * @param {object} req - Request key for WAF context lookup. May be an HTTP
+ *   IncomingMessage or a plain object (Lambda invocation key).
+ * @param {string} [raspRule] - RASP rule identifier
+ * @param {object} [rootSpan] - Root span to tag (required for Lambda)
+ */
+function run (data, req, raspRule, rootSpan) {
   if (!req) {
     req = getActiveRequest()
     if (!req) {
@@ -120,12 +132,12 @@ function run (data, req, raspRule) {
   }
 
   const wafContext = waf.wafManager.getWAFContext(req)
-  const result = wafContext.run(data, raspRule, req)
+  const result = wafContext.run(data, raspRule, req, rootSpan)
 
   if (result?.keep) {
     if (limiter.isAllowed()) {
-      const rootSpan = web.root(req)
-      keepTrace(rootSpan, ASM)
+      const span = rootSpan || web.root(req)
+      keepTrace(span, ASM)
     } else {
       updateRateLimitedMetric(req)
     }
diff --git a/packages/dd-trace/src/appsec/waf/waf_context_wrapper.js b/packages/dd-trace/src/appsec/waf/waf_context_wrapper.js
index e733c30e41..4aaed79fbf 100644
--- a/packages/dd-trace/src/appsec/waf/waf_context_wrapper.js
+++ b/packages/dd-trace/src/appsec/waf/waf_context_wrapper.js
@@ -36,7 +36,7 @@ class WAFContextWrapper {
     }
   }
 
-  run ({ persistent, ephemeral }, raspRule, req) {
+  run ({ persistent, ephemeral }, raspRule, req, rootSpan) {
     if (this.ddwafContext.disposed) {
       log.warn('[ASM] Calling run on a disposed context')
       if (raspRule) {
@@ -156,10 +156,10 @@ class WAFContextWrapper {
       metrics.wafTimeout = result.timeout
 
       if (ruleTriggered) {
-        Reporter.reportAttack(result, req)
+        Reporter.reportAttack(result, req, rootSpan)
       }
 
-      Reporter.reportAttributes(result.attributes, req)
+      Reporter.reportAttributes(result.attributes, req, rootSpan)
 
       return result
     } catch (err) {
@@ -171,7 +171,7 @@ class WAFContextWrapper {
         wafRunFinished.publish({ payload })
       }
 
-      Reporter.reportMetrics(metrics, raspRule, req)
+      Reporter.reportMetrics(metrics, raspRule, req, rootSpan)
     }
   }
 
diff --git a/packages/dd-trace/test/appsec/lambda.spec.js b/packages/dd-trace/test/appsec/lambda.spec.js
new file mode 100644
index 0000000000..29f282ce91
--- /dev/null
+++ b/packages/dd-trace/test/appsec/lambda.spec.js
@@ -0,0 +1,502 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+
+const { afterEach, beforeEach, describe, it } = require('mocha')
+const sinon = require('sinon')
+const proxyquire = require('proxyquire')
+
+describe('AppSec Lambda handler', () => {
+  let lambda
+  let waf
+  let Reporter
+  let keepTrace
+  let log
+  let addresses
+
+  const fakeSpan = () => {
+    const tags = {}
+    const spanContext = {
+      getTag (key) { return tags[key] },
+    }
+    return {
+      addTags: sinon.stub().callsFake((obj) => Object.assign(tags, obj)),
+      setTag: sinon.stub().callsFake((k, v) => { tags[k] = v }),
+      context: sinon.stub().returns(spanContext),
+    }
+  }
+
+  beforeEach(() => {
+    waf = {
+      run: sinon.stub(),
+      disposeContext: sinon.stub(),
+    }
+
+    Reporter = {
+      finishRequest: sinon.stub(),
+    }
+
+    keepTrace = sinon.stub()
+
+    log = {
+      warn: sinon.stub(),
+      error: sinon.stub(),
+      debug: sinon.stub(),
+    }
+
+    addresses = require('../../src/appsec/addresses')
+
+    lambda = proxyquire('../../src/appsec/lambda', {
+      '../log': log,
+      './waf': waf,
+      './reporter': Reporter,
+      '../priority_sampler': { keepTrace },
+    })
+  })
+
+  afterEach(() => {
+    sinon.restore()
+  })
+
+  describe('onLambdaStartInvocation', () => {
+    it('should warn and return when no span is provided', () => {
+      lambda.onLambdaStartInvocation({})
+
+      sinon.assert.calledOnce(log.warn)
+      sinon.assert.notCalled(waf.run)
+    })
+
+    it('should set appsec enabled tags on the span', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({
+        span,
+        headers: { host: 'example.com' },
+        method: 'GET',
+        path: '/test',
+      })
+
+      assert.equal(span.context().getTag('_dd.appsec.enabled'), 1)
+    })
+
+    it('should set HTTP_CLIENT_IP tag when clientIp is provided', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({
+        span,
+        headers: {},
+        method: 'GET',
+        path: '/',
+        clientIp: '1.2.3.4',
+      })
+
+      assert.equal(span.context().getTag('http.client_ip'), '1.2.3.4')
+    })
+
+    it('should call waf.run with mapped addresses using span as the invocation key', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({
+        span,
+        headers: { host: 'example.com' },
+        method: 'POST',
+        path: '/api/test',
+        query: { foo: 'bar' },
+        body: { key: 'value' },
+        clientIp: '10.0.0.1',
+        pathParams: { id: '123' },
+        cookies: { session: 'abc' },
+      })
+
+      sinon.assert.calledOnce(waf.run)
+
+      const [data, key, raspRule, rootSpan] = waf.run.firstCall.args
+      assert.deepStrictEqual(data.persistent, {
+        [addresses.HTTP_INCOMING_URL]: '/api/test',
+        [addresses.HTTP_INCOMING_METHOD]: 'POST',
+        [addresses.HTTP_INCOMING_HEADERS]: { host: 'example.com' },
+        [addresses.HTTP_CLIENT_IP]: '10.0.0.1',
+        [addresses.HTTP_INCOMING_QUERY]: { foo: 'bar' },
+        [addresses.HTTP_INCOMING_BODY]: { key: 'value' },
+        [addresses.HTTP_INCOMING_PARAMS]: { id: '123' },
+        [addresses.HTTP_INCOMING_COOKIES]: { session: 'abc' },
+      })
+      assert.equal(key, span)
+      assert.equal(raspRule, undefined)
+      assert.equal(rootSpan, span)
+    })
+
+    it('should not include undefined optional fields in WAF addresses', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({
+        span,
+        headers: { host: 'example.com' },
+        method: 'GET',
+        path: '/',
+      })
+
+      sinon.assert.calledOnce(waf.run)
+      const persistent = waf.run.firstCall.args[0].persistent
+      assert.ok(!(addresses.HTTP_INCOMING_QUERY in persistent))
+      assert.ok(!(addresses.HTTP_INCOMING_BODY in persistent))
+      assert.ok(!(addresses.HTTP_INCOMING_PARAMS in persistent))
+      assert.ok(!(addresses.HTTP_INCOMING_COOKIES in persistent))
+      assert.ok(!(addresses.HTTP_CLIENT_IP in persistent))
+    })
+
+    it('should catch errors and log them', () => {
+      const span = fakeSpan()
+      waf.run.throws(new Error('boom'))
+
+      lambda.onLambdaStartInvocation({
+        span,
+        headers: {},
+        method: 'GET',
+        path: '/',
+      })
+
+      sinon.assert.calledOnce(log.error)
+    })
+  })
+
+  describe('onLambdaEndInvocation', () => {
+    it('should warn and return when no span is provided', () => {
+      lambda.onLambdaEndInvocation({})
+
+      sinon.assert.calledOnce(log.warn)
+      sinon.assert.notCalled(waf.run)
+    })
+
+    it('should return silently when start-invocation was not called for this span', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaEndInvocation({ span })
+
+      sinon.assert.notCalled(waf.run)
+      sinon.assert.notCalled(waf.disposeContext)
+    })
+
+    it('should run WAF with response addresses and dispose context', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({ span, headers: {}, method: 'GET', path: '/' })
+      waf.run.reset()
+
+      lambda.onLambdaEndInvocation({
+        span,
+        statusCode: '200',
+        responseHeaders: { 'content-type': 'application/json', 'set-cookie': 'foo=bar' },
+      })
+
+      sinon.assert.calledOnce(waf.run)
+      const [data, key] = waf.run.firstCall.args
+      assert.equal(data.persistent[addresses.HTTP_INCOMING_RESPONSE_CODE], '200')
+      assert.deepStrictEqual(data.persistent[addresses.HTTP_INCOMING_RESPONSE_HEADERS], {
+        'content-type': 'application/json',
+      })
+      assert.ok(!('set-cookie' in data.persistent[addresses.HTTP_INCOMING_RESPONSE_HEADERS]))
+      assert.equal(key, span)
+
+      sinon.assert.calledOnce(waf.disposeContext)
+      sinon.assert.calledOnce(Reporter.finishRequest)
+    })
+
+    it('should skip WAF run when no response data', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({ span, headers: {}, method: 'GET', path: '/' })
+      waf.run.reset()
+
+      lambda.onLambdaEndInvocation({ span })
+
+      sinon.assert.notCalled(waf.run)
+      sinon.assert.calledOnce(waf.disposeContext)
+      sinon.assert.calledOnce(Reporter.finishRequest)
+    })
+
+    it('should not process end-invocation twice for the same span', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({ span, headers: {}, method: 'GET', path: '/' })
+      lambda.onLambdaEndInvocation({ span, statusCode: '200' })
+      lambda.onLambdaEndInvocation({ span, statusCode: '200' })
+
+      assert.equal(waf.disposeContext.callCount, 1)
+      assert.equal(Reporter.finishRequest.callCount, 1)
+    })
+
+    it('should pass the span as rootSpan to Reporter.finishRequest', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({ span, headers: {}, method: 'GET', path: '/' })
+      lambda.onLambdaEndInvocation({ span, statusCode: '200' })
+
+      sinon.assert.calledOnce(Reporter.finishRequest)
+      const args = Reporter.finishRequest.firstCall.args
+      assert.equal(args[4], span)
+    })
+
+    it('should pass span as req to Reporter.finishRequest', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({ span, headers: {}, method: 'GET', path: '/' })
+      lambda.onLambdaEndInvocation({ span, statusCode: '200' })
+
+      sinon.assert.calledOnce(Reporter.finishRequest)
+      const [req, res, storedHeaders, body, rootSpan] = Reporter.finishRequest.firstCall.args
+      assert.equal(req, span)
+      assert.equal(res, null)
+      assert.deepStrictEqual(storedHeaders, {})
+      assert.equal(body, undefined)
+      assert.equal(rootSpan, span)
+    })
+
+    it('should catch errors and log them', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({ span, headers: {}, method: 'GET', path: '/' })
+      waf.disposeContext.throws(new Error('boom'))
+
+      lambda.onLambdaEndInvocation({ span, statusCode: '200' })
+
+      sinon.assert.calledOnce(log.error)
+    })
+
+    it('should use span as key for WAF run and dispose across start and end', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({
+        span,
+        headers: { host: 'example.com' },
+        method: 'GET',
+        path: '/',
+      })
+
+      lambda.onLambdaEndInvocation({ span, statusCode: '200' })
+
+      const startKey = waf.run.firstCall.args[1]
+      const endKey = waf.run.secondCall.args[1]
+      const disposeKey = waf.disposeContext.firstCall.args[0]
+
+      assert.equal(startKey, span)
+      assert.equal(endKey, span)
+      assert.equal(disposeKey, span)
+    })
+  })
+})
+
+// ─── WAF path safety: contract enforcement for non-HTTP req ───────────────────
+//
+// In Lambda, `req` in the WAF execution path is the span object, which has no
+// HTTP properties (no socket, headers, body, etc.). The tests below exercise
+// the real WAFContextWrapper → Reporter chain with such an object to verify that
+// no unguarded req property access exists.
+//
+// A Proxy-based `strictNonHttpReq` is used as the req object. It allows access
+// to properties that have been audited as safe (they return undefined and all
+// call-sites guard against it), and throws on any NEW property access. This
+// forces developers to explicitly acknowledge and guard new req usages.
+// ──────────────────────────────────────────────────────────────────────────────
+
+describe('WAF path safety with non-HTTP req', () => {
+  let RealReporter
+  let WAFContextWrapper
+  let web
+  let telemetry
+
+  // Properties on req that are known to be accessed in the WAF/reporter path
+  // and have been verified safe for non-HTTP objects (all return undefined).
+  // If you need to access a new req property, add it here AND ensure the
+  // call-site guards against undefined (e.g. req?.prop, if (prop) ...).
+  const AUDITED_REQ_PROPERTIES = new Set([
+    'socket', // reportAttack: guarded with req?.socket
+    'body', // reportAttack: only reached when config.raspBodyCollection && isRaspAttack; undefined is safe
+  ])
+
+  function makeStrictNonHttpReq () {
+    return new Proxy(Object.create(null), {
+      get (_target, prop) {
+        if (typeof prop === 'symbol') return undefined
+        if (AUDITED_REQ_PROPERTIES.has(prop)) return undefined
+        throw new Error(
+          `Unguarded access to req.${String(prop)} in WAF path — ` +
+          'req may not be an HTTP request (e.g. Lambda invocation key). ' +
+          'Guard the access or add the property to AUDITED_REQ_PROPERTIES in lambda.spec.js.'
+        )
+      },
+    })
+  }
+
+  const fakeSpan = () => {
+    const tags = {}
+    const spanContext = {
+      getTags () { return tags },
+      getTag (key) { return tags[key] },
+      setTag (key, value) { tags[key] = value },
+      hasTag (key) { return key in tags },
+    }
+    return {
+      addTags: sinon.stub().callsFake((obj) => Object.assign(tags, obj)),
+      setTag: sinon.stub().callsFake((k, v) => { tags[k] = v }),
+      context: sinon.stub().returns(spanContext),
+      keep: sinon.stub(),
+    }
+  }
+
+  beforeEach(() => {
+    web = {
+      root: sinon.stub(),
+      getContext: sinon.stub(),
+    }
+
+    telemetry = {
+      incrementWafInitMetric: sinon.stub(),
+      incrementWafConfigErrorsMetric: sinon.stub(),
+      incrementWafUpdatesMetric: sinon.stub(),
+      incrementWafRequestsMetric: sinon.stub(),
+      updateWafRequestsMetricTags: sinon.stub(),
+      updateRaspRequestsMetricTags: sinon.stub(),
+      updateRaspRuleSkippedMetricTags: sinon.stub(),
+      updateRateLimitedMetric: sinon.stub(),
+      getRequestMetrics: sinon.stub(),
+    }
+
+    RealReporter = proxyquire('../../src/appsec/reporter', {
+      '../plugins/util/web': web,
+      './telemetry': telemetry,
+    })
+
+    WAFContextWrapper = proxyquire('../../src/appsec/waf/waf_context_wrapper', {
+      '../reporter': RealReporter,
+      '../../log': { warn: sinon.stub(), error: sinon.stub() },
+      '../blocking': { getBlockingAction: () => undefined },
+      '../channels': { wafRunFinished: { hasSubscribers: false } },
+    })
+  })
+
+  afterEach(() => {
+    sinon.restore()
+  })
+
+  it('should complete WAF run with attack result without accessing non-HTTP req properties', () => {
+    const req = makeStrictNonHttpReq()
+    const span = fakeSpan()
+
+    const mockDdwafContext = {
+      disposed: false,
+      run: sinon.stub().returns({
+        events: [{ rule: { id: 'ua0-600-55x', tags: { type: 'security_scanner' } } }],
+        actions: {},
+        duration: 100,
+        timeout: false,
+        metrics: {},
+      }),
+    }
+
+    const knownAddresses = new Set([
+      'server.request.headers.no_cookies',
+      'server.request.uri.raw',
+      'server.request.method',
+    ])
+
+    const ctx = new WAFContextWrapper(mockDdwafContext, 5000, '1.18.0', '1.13.3', knownAddresses)
+
+    ctx.run(
+      { persistent: { 'server.request.headers.no_cookies': { host: 'example.com' } } },
+      undefined,
+      req,
+      span
+    )
+
+    assert.equal(span.context().getTag('appsec.event'), 'true')
+    assert.ok(span.context().getTag('_dd.appsec.json'))
+    assert.equal(span.context().getTag('network.client.ip'), undefined)
+  })
+
+  it('should complete WAF run without attack without accessing non-HTTP req properties', () => {
+    const req = makeStrictNonHttpReq()
+    const span = fakeSpan()
+
+    const mockDdwafContext = {
+      disposed: false,
+      run: sinon.stub().returns({
+        events: [],
+        actions: {},
+        duration: 50,
+        timeout: false,
+        metrics: {},
+      }),
+    }
+
+    const knownAddresses = new Set(['server.request.uri.raw'])
+    const ctx = new WAFContextWrapper(mockDdwafContext, 5000, '1.18.0', '1.13.3', knownAddresses)
+
+    ctx.run(
+      { persistent: { 'server.request.uri.raw': '/test' } },
+      undefined,
+      req,
+      span
+    )
+
+    sinon.assert.calledOnce(telemetry.updateWafRequestsMetricTags)
+    assert.equal(span.context().getTag('appsec.event'), undefined)
+  })
+
+  it('should complete WAF run with attributes without accessing non-HTTP req properties', () => {
+    const req = makeStrictNonHttpReq()
+    const span = fakeSpan()
+
+    const mockDdwafContext = {
+      disposed: false,
+      run: sinon.stub().returns({
+        events: [],
+        actions: {},
+        duration: 50,
+        timeout: false,
+        metrics: {},
+        attributes: { '_dd.appsec.s.req.body': [{ key: [8] }] },
+      }),
+    }
+
+    const knownAddresses = new Set(['server.request.uri.raw'])
+    const ctx = new WAFContextWrapper(mockDdwafContext, 5000, '1.18.0', '1.13.3', knownAddresses)
+
+    ctx.run(
+      { persistent: { 'server.request.uri.raw': '/test' } },
+      undefined,
+      req,
+      span
+    )
+
+    assert.ok(span.context().getTag('_dd.appsec.s.req.body'))
+  })
+
+  it('should complete finishRequest with span as req without crash', () => {
+    const span = fakeSpan()
+
+    RealReporter.finishRequest(span, null, {}, undefined, span)
+  })
+
+  it('should flush metricsQueue in finishRequest with span as req (Lambda production path)', () => {
+    const span = fakeSpan()
+
+    RealReporter.metricsQueue.set('_dd.appsec.waf.duration', 100)
+
+    RealReporter.finishRequest(span, null, {}, undefined, span)
+
+    assert.equal(span.context().getTag('_dd.appsec.waf.duration'), 100)
+    assert.equal(RealReporter.metricsQueue.size, 0)
+  })
+
+  it('should use Proxy as a valid WeakMap key for telemetry and WAF contexts', () => {
+    const req = makeStrictNonHttpReq()
+    const weakMap = new WeakMap()
+
+    weakMap.set(req, { duration: 42 })
+    assert.deepStrictEqual(weakMap.get(req), { duration: 42 })
+
+    weakMap.delete(req)
+    assert.equal(weakMap.get(req), undefined)
+  })
+})
diff --git a/packages/dd-trace/test/appsec/reporter.spec.js b/packages/dd-trace/test/appsec/reporter.spec.js
index 3d534fbde7..a38cfa0c50 100644
--- a/packages/dd-trace/test/appsec/reporter.spec.js
+++ b/packages/dd-trace/test/appsec/reporter.spec.js
@@ -1332,5 +1332,48 @@ describe('reporter', () => {
         sinon.assert.calledWith(span.addTags, expectedTags)
       })
     })
+
+    describe('Lambda (null req)', () => {
+      it('should not crash when req is null and rootSpan is provided', () => {
+        Reporter.finishRequest(null, null, {}, undefined, span)
+
+        sinon.assert.notCalled(span.addTags)
+      })
+
+      it('should still flush metricsQueue when req is null but rootSpan is provided', () => {
+        Reporter.metricsQueue.set('_dd.appsec.json', '{"triggers":[]}')
+
+        Reporter.finishRequest(null, null, {}, undefined, span)
+
+        sinon.assert.calledWithExactly(span.setTag, '_dd.appsec.json', '{"triggers":[]}')
+        assert.strictEqual(Reporter.metricsQueue.size, 0)
+      })
+    })
+  })
+
+  describe('reportAttack (Lambda path)', () => {
+    it('should not crash when req is an empty object and rootSpan is provided', () => {
+      const fakeReq = {}
+
+      Reporter.reportAttack({
+        events: [{ rule: { id: 'test-rule' } }],
+        actions: {},
+      }, fakeReq, span)
+
+      sinon.assert.calledOnce(span.addTags)
+      const tags = span.addTags.firstCall.args[0]
+      assert.strictEqual(tags['appsec.event'], 'true')
+      assert.ok(tags['_dd.appsec.json'].includes('test-rule'))
+    })
+
+    it('should not set NETWORK_CLIENT_IP when req has no socket', () => {
+      Reporter.reportAttack({
+        events: [{ rule: { id: 'test-rule' } }],
+        actions: {},
+      }, {}, span)
+
+      const tags = span.addTags.firstCall.args[0]
+      assert.strictEqual(tags['network.client.ip'], undefined)
+    })
   })
 })
diff --git a/packages/dd-trace/test/appsec/waf/index.spec.js b/packages/dd-trace/test/appsec/waf/index.spec.js
index 2ee308842f..d8180c948d 100644
--- a/packages/dd-trace/test/appsec/waf/index.spec.js
+++ b/packages/dd-trace/test/appsec/waf/index.spec.js
@@ -128,7 +128,7 @@ describe('WAF Manager', () => {
       const req = {}
       waf.run(payload, req, 'ssrf')
 
-      sinon.assert.calledOnceWithExactly(run, payload, 'ssrf', req)
+      sinon.assert.calledOnceWithExactly(run, payload, 'ssrf', req, undefined)
     })
 
     it('should call wafManager.run without raspRuleType', () => {
@@ -140,7 +140,7 @@ describe('WAF Manager', () => {
       const req = {}
       waf.run(payload, req)
 
-      sinon.assert.calledOnceWithExactly(run, payload, undefined, req)
+      sinon.assert.calledOnceWithExactly(run, payload, undefined, req, undefined)
     })
 
     describe('sampling priority', () => {
@@ -458,7 +458,7 @@ describe('WAF Manager', () => {
 
         wafContextWrapper.run(params, undefined, req)
 
-        sinon.assert.calledOnceWithExactly(Reporter.reportAttack, match({ events: ['ATTACK DATA'] }), req)
+        sinon.assert.calledOnceWithExactly(Reporter.reportAttack, match({ events: ['ATTACK DATA'] }), req, undefined)
       })
 
       it('should report if rule is triggered', () => {
@@ -582,7 +582,7 @@ describe('WAF Manager', () => {
         ddwafContext.run.returns(result)
 
         wafContextWrapper.run(params, undefined, req)
-        sinon.assert.calledOnceWithExactly(Reporter.reportAttributes, result.attributes, req)
+        sinon.assert.calledOnceWithExactly(Reporter.reportAttributes, result.attributes, req, undefined)
       })
 
       it('should report fingerprints when ddwafContext returns fingerprints in results attributes', () => {
@@ -604,7 +604,7 @@ describe('WAF Manager', () => {
             'server.request.body': 'foo',
           },
         }, undefined, req)
-        sinon.assert.calledOnceWithExactly(Reporter.reportAttributes, result.attributes, req)
+        sinon.assert.calledOnceWithExactly(Reporter.reportAttributes, result.attributes, req, undefined)
       })
     })
   })

From c6f323db25793557e3a5fbefacc60b31de34b469 Mon Sep 17 00:00:00 2001
From: Carles Capell <107924659+CarlesDD@users.noreply.github.com>
Date: Tue, 30 Jun 2026 15:27:53 +0200
Subject: [PATCH 21/51] Add runtime family tag on appsec lambda span (#9153)

---
 packages/dd-trace/src/appsec/lambda.js       | 5 ++++-
 packages/dd-trace/test/appsec/lambda.spec.js | 1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/packages/dd-trace/src/appsec/lambda.js b/packages/dd-trace/src/appsec/lambda.js
index 6b11e72c69..8563a012d1 100644
--- a/packages/dd-trace/src/appsec/lambda.js
+++ b/packages/dd-trace/src/appsec/lambda.js
@@ -33,7 +33,10 @@ function onLambdaStartInvocation (data) {
 
     activeInvocations.add(span)
 
-    span.setTag('_dd.appsec.enabled', 1)
+    span.addTags({
+      '_dd.appsec.enabled': 1,
+      '_dd.runtime_family': 'nodejs',
+    })
 
     const persistent = {}
 
diff --git a/packages/dd-trace/test/appsec/lambda.spec.js b/packages/dd-trace/test/appsec/lambda.spec.js
index 29f282ce91..f4e6f623eb 100644
--- a/packages/dd-trace/test/appsec/lambda.spec.js
+++ b/packages/dd-trace/test/appsec/lambda.spec.js
@@ -77,6 +77,7 @@ describe('AppSec Lambda handler', () => {
       })
 
       assert.equal(span.context().getTag('_dd.appsec.enabled'), 1)
+      assert.equal(span.context().getTag('_dd.runtime_family'), 'nodejs')
     })
 
     it('should set HTTP_CLIENT_IP tag when clientIp is provided', () => {

From f4c6d9d5896c6f279720084842eacc2d95fedb4d Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Tue, 30 Jun 2026 17:54:12 +0200
Subject: [PATCH 22/51] chore: drop dead profile assert helper and fix
 telemetry typo (#7686)

1. Remove test/asserts/profile.js. Nothing requires it; the only profile
   value-type assertion in use is the standalone helper in the profiling
   agent exporter spec.
2. Fix the "amont" -> "amount" typo in both telemetry heartbeat comments.
---
 packages/dd-trace/test/asserts/profile.js     | 63 -------------------
 .../dd-trace/test/telemetry/index.spec.js     |  4 +-
 2 files changed, 2 insertions(+), 65 deletions(-)
 delete mode 100644 packages/dd-trace/test/asserts/profile.js

diff --git a/packages/dd-trace/test/asserts/profile.js b/packages/dd-trace/test/asserts/profile.js
deleted file mode 100644
index 537c10d670..0000000000
--- a/packages/dd-trace/test/asserts/profile.js
+++ /dev/null
@@ -1,63 +0,0 @@
-'use strict'
-
-const assert = require('node:assert/strict')
-const { inspect } = require('node:util')
-module.exports = ({ Assertion, expect }, { expectTypes }) => {
-  Assertion.addProperty('valueType', function () {
-    const obj = this._obj
-
-    assert.ok(typeof obj === 'object' && obj !== null, `Expected non-null object, got ${inspect(obj)}`)
-    assert.strictEqual(typeof obj.type, 'number')
-    assert.strictEqual(typeof obj.unit, 'number')
-  })
-
-  Assertion.addProperty('numeric', function () {
-    expectTypes(this, ['number', 'bigint'])
-  })
-
-  Assertion.addProperty('profile', function () {
-    const obj = this._obj
-
-    assert.ok(typeof obj === 'object' && obj !== null, `Expected non-null object, got ${inspect(obj)}`)
-
-    assert.strictEqual(typeof obj.timeNanos, 'bigint')
-    expect(obj.period).to.be.numeric
-    expect(obj.periodType).to.be.a.valueType
-    assert.ok(Array.isArray(obj.sampleType), `Expected array, got ${inspect(obj.sampleType)}`)
-    assert.strictEqual(obj.sampleType.length, 2)
-    assert.ok(Array.isArray(obj.sample), `Expected array, got ${inspect(obj.sample)}`)
-    assert.ok(Array.isArray(obj.location), `Expected array, got ${inspect(obj.location)}`)
-    assert.ok(Array.isArray(obj.function), `Expected array, got ${inspect(obj.function)}`)
-    assert.ok(Array.isArray(obj.stringTable.strings), `Expected array, got ${inspect(obj.stringTable.strings)}`)
-    assert.ok(obj.stringTable.strings.length >= 1, `Expected ${obj.stringTable.strings.length} >= 1`)
-    assert.strictEqual(obj.stringTable.strings[0], '')
-
-    for (const sampleType of obj.sampleType) {
-      expect(sampleType).to.be.a.valueType
-    }
-
-    for (const fn of obj.function) {
-      assert.strictEqual(typeof fn.filename, 'number')
-      assert.strictEqual(typeof fn.systemName, 'number')
-      assert.strictEqual(typeof fn.name, 'number')
-      assert.ok(Number.isSafeInteger(fn.id), `Expected isSafeInteger, got ${inspect(fn.id)}`)
-    }
-
-    for (const location of obj.location) {
-      assert.ok(Number.isSafeInteger(location.id), `Expected isSafeInteger, got ${inspect(location.id)}`)
-      assert.ok(Array.isArray(location.line), `Expected array, got ${inspect(location.line)}`)
-
-      for (const line of location.line) {
-        assert.ok(Number.isSafeInteger(line.functionId), `Expected isSafeInteger, got ${inspect(line.functionId)}`)
-        assert.strictEqual(typeof line.line, 'number')
-      }
-    }
-
-    for (const sample of obj.sample) {
-      assert.ok(Array.isArray(sample.locationId), `Expected array, got ${inspect(sample.locationId)}`)
-      assert.ok(sample.locationId.length >= 1, `Expected ${sample.locationId.length} >= 1`)
-      assert.ok(Array.isArray(sample.value), `Expected array, got ${inspect(sample.value)}`)
-      assert.strictEqual(sample.value.length, obj.sampleType.length)
-    }
-  })
-}
diff --git a/packages/dd-trace/test/telemetry/index.spec.js b/packages/dd-trace/test/telemetry/index.spec.js
index 3257deb37a..392a037d50 100644
--- a/packages/dd-trace/test/telemetry/index.spec.js
+++ b/packages/dd-trace/test/telemetry/index.spec.js
@@ -311,7 +311,7 @@ describe('telemetry app-heartbeat', () => {
   })
 
   it('should send heartbeat in uniform intervals', (done) => {
-    let beats = 0 // to keep track of the amont of times extendedHeartbeat is called
+    let beats = 0 // to keep track of the amount of times extendedHeartbeat is called
     const sendDataRequest = {
       sendData: (config, application, host, reqType, payload, cb = () => {}) => {
         if (reqType === 'app-heartbeat') {
@@ -373,7 +373,7 @@ describe('Telemetry extended heartbeat', () => {
 
   it('should be sent every 24 hours', (done) => {
     let extendedHeartbeatRequest
-    let beats = 0 // to keep track of the amont of times extendedHeartbeat is called
+    let beats = 0 // to keep track of the amount of times extendedHeartbeat is called
     const sendDataRequest = {
       sendData: (config, application, host, reqType, payload, cb = () => {}) => {
         if (reqType === 'app-started') {

From 94e3cfa963eb1be8a722e7d47d07801d64d1ec5c Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Tue, 30 Jun 2026 18:08:30 +0200
Subject: [PATCH 23/51] ci(scripts): disable V8 Maglev for Windows test
 children (#9131)

* ci(scripts): disable V8 Maglev for Windows test children

Network-heavy specs intermittently abort with STATUS_STACK_BUFFER_OVERRUN
(0xC0000409) on Windows: mocha-run-file forces process.exit() the moment
mocha finishes, and that races V8's Maglev teardown while libuv still has
in-flight sockets from the spec's real HTTP traffic. The child dies with no
stderr and no crash report, so mocha-parallel-files only sees a non-zero exit
and reports the file as crashed (e.g. inferred_proxy.spec.js, which is just
whichever network spec lost the race that run).

--no-maglev sidesteps the faulty tier and can only be passed as a CLI flag,
not through NODE_OPTIONS, so the runner injects it into the spawned per-file
node processes on win32.

Refs: https://github.com/nodejs/node/issues/62260

* ci(scripts): gate --no-maglev by V8 version

The Windows --no-maglev workaround was appended on every win32 child, but the
top-level --maglev/--no-maglev toggle only exists from V8 11 (Node 20). On the
supported Node 18 line (V8 10) the flag does not exist, so each spawned spec
aborts with `bad option: --no-maglev` (exit 9) before mocha runs, breaking the
parallel runner for Windows Node 18. Gate on the running V8 major, which the
children inherit via the shared binary.
---
 scripts/mocha-parallel-files.js | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/scripts/mocha-parallel-files.js b/scripts/mocha-parallel-files.js
index 74bf1fa285..ed46806b4f 100644
--- a/scripts/mocha-parallel-files.js
+++ b/scripts/mocha-parallel-files.js
@@ -10,6 +10,12 @@ const { globSync } = require('glob')
 
 const multiMochaRc = require('../.mochamultireporterrc')
 
+// V8's top-level `--maglev`/`--no-maglev` toggle landed in V8 11 (Node 20). On
+// V8 10 (Node 18) the flag does not exist, so passing it aborts the child with
+// `bad option: --no-maglev` (exit 9) before mocha runs. Children reuse this
+// process's binary, so our own V8 major decides whether the flag is safe.
+const SUPPORTS_NO_MAGLEV = Number.parseInt(process.versions.v8, 10) >= 11
+
 /**
  * @param {string} openTag
  * @param {string} name
@@ -549,6 +555,11 @@ async function main () {
 
         const nodeArgs = []
         if (opts.exposeGc) nodeArgs.push('--expose-gc')
+        // Network-heavy specs intermittently abort with STATUS_STACK_BUFFER_OVERRUN
+        // (0xC0000409) when mocha-run-file's process.exit() races V8's Maglev teardown
+        // on Windows. Maglev can only be disabled via a CLI flag, not NODE_OPTIONS.
+        // TODO(BridgeAR): drop once https://github.com/nodejs/node/issues/62260 is fixed.
+        if (process.platform === 'win32' && SUPPORTS_NO_MAGLEV) nodeArgs.push('--no-maglev')
         nodeArgs.push(runFileScript, file)
 
         entry.started = true

From 98bdb97549caec600e704a1d5420c36365f9382d Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Tue, 30 Jun 2026 18:10:06 +0200
Subject: [PATCH 24/51] fix(instrumentation): wrap lazily defined fs.opendir on
 Node 20 (#9094)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Node 20 defines `fs.opendir` / `fs.opendirSync` as lazy getter+setter accessor
properties that resolve the real function on first read. Handing such a property
to `shimmer.wrap` instrumented the getter, so the property access was traced
while the real call ran uninstrumented — IAST then saw no `opendir` operation
and reported no PATH_TRAVERSAL vulnerability. Node 18/22 define these as plain
data properties, which is why the gap was Node-20-only.

Extend `shimmer.wrap`'s existing `replaceGetter` option to cover the lazy
getter+setter case: resolve the value once through the getter and wrap that,
rather than re-implementing the resolution in the fs instrumentation. The
property keeps its original shape — a getter+setter pair stays a getter+setter
pair whose setter still materializes a writable data property on assignment, so
the descriptor remains observationally identical for a downstream consumer that
inspects or overwrites it on that Node.js version.

A getter+setter pair without `replaceGetter` keeps being wrapped in place — the
wrapper becomes the new getter and the original setter is left untouched, as the
`url` instrumentation relies on for the `URL.prototype` `host` / `hostname`
accessors. Only a setter-only property throws. Narrowing the guard to reject
every unguarded getter+setter pair would have thrown inside the `url` hook,
silently dropping that instrumentation and the AppSec / IAST coverage built on
it.

`fs.js` now passes `{ replaceGetter: true }` through its `wrap` / `massWrap`
helpers instead of carrying its own materialization helper.
---
 packages/datadog-instrumentations/src/fs.js   | 14 +--
 .../datadog-instrumentations/test/fs.spec.js  | 85 ++++++++++++++++++-
 packages/datadog-shimmer/src/shimmer.js       | 53 ++++++++----
 packages/datadog-shimmer/test/shimmer.spec.js | 80 +++++++++++++++++
 4 files changed, 209 insertions(+), 23 deletions(-)

diff --git a/packages/datadog-instrumentations/src/fs.js b/packages/datadog-instrumentations/src/fs.js
index 0ab68bfe55..4001cc1455 100644
--- a/packages/datadog-instrumentations/src/fs.js
+++ b/packages/datadog-instrumentations/src/fs.js
@@ -88,8 +88,10 @@ addHook({ name: 'fs' }, fs => {
   const asyncMethods = Object.keys(paramsByMethod)
   const syncMethods = asyncMethods.map(name => `${name}Sync`)
 
-  massWrap(fs, asyncMethods, createWrapFunction())
-  massWrap(fs, syncMethods, createWrapFunction())
+  // Node 20 defines `fs.opendir` / `fs.opendirSync` as lazy accessor properties;
+  // `replaceGetter` resolves the method so the call is wrapped, not the accessor.
+  massWrap(fs, asyncMethods, createWrapFunction(), { replaceGetter: true })
+  massWrap(fs, syncMethods, createWrapFunction(), { replaceGetter: true })
   massWrap(fs.promises, asyncMethods, createWrapFunction('promises.'))
 
   wrap(fs.realpath, 'native', createWrapFunction('', 'realpath.native'))
@@ -355,15 +357,15 @@ function getMessage (operation, params, args, self) {
   return { operation, ...metadata }
 }
 
-function massWrap (target, methods, wrapper) {
+function massWrap (target, methods, wrapper, options) {
   for (const method of methods) {
-    wrap(target, method, wrapper)
+    wrap(target, method, wrapper, options)
   }
 }
 
-function wrap (target, method, wrapper) {
+function wrap (target, method, wrapper, options) {
   try {
-    shimmer.wrap(target, method, wrapper)
+    shimmer.wrap(target, method, wrapper, options)
   } catch {
     // skip unavailable method
   }
diff --git a/packages/datadog-instrumentations/test/fs.spec.js b/packages/datadog-instrumentations/test/fs.spec.js
index dd3967b929..85b1d5ca33 100644
--- a/packages/datadog-instrumentations/test/fs.spec.js
+++ b/packages/datadog-instrumentations/test/fs.spec.js
@@ -1,10 +1,16 @@
 'use strict'
 
 const assert = require('node:assert')
-const { describe, it, afterEach } = require('mocha')
+const os = require('node:os')
+const path = require('node:path')
+const { describe, it, after, afterEach, before } = require('mocha')
+
+const dc = require('dc-polyfill')
 
 const agent = require('../../dd-trace/test/plugins/agent')
 
+const opStartCh = dc.channel('apm:fs:operation:start')
+
 describe('fs instrumentation', () => {
   afterEach(() => {
     return agent.close()
@@ -21,4 +27,81 @@ describe('fs instrumentation', () => {
     const fs = require('fs')
     assert.notStrictEqual(fs, undefined)
   })
+
+  // Node 20 defines `fs.opendir` / `fs.opendirSync` as lazy accessor properties.
+  // The instrumentation has to wrap the resolved method, not the accessor, so the
+  // start channel publishes the method's own operation and path. Activating the
+  // hook before the accessor is first read reproduces the order that broke: a
+  // wrapped getter leaves the real call uninstrumented.
+  describe('lazily defined methods', () => {
+    let fs, dirname, lazyAccessorShape
+
+    before(async () => {
+      // Capture the pristine descriptor shape before the hook wraps `fs`: on Node
+      // versions that define `opendir` as a lazy getter+setter accessor we assert
+      // the wrap preserves that shape; on versions where it is already a data
+      // property there is no accessor to preserve.
+      lazyAccessorShape = typeof Object.getOwnPropertyDescriptor(require('fs'), 'opendir')?.get === 'function'
+
+      await agent.load('fs', undefined, { flushInterval: 1 })
+      fs = require('fs')
+      dirname = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-fs-opendir-'))
+    })
+
+    after(() => {
+      fs.rmdirSync(dirname)
+    })
+
+    it('instruments opendirSync while preserving its descriptor shape', () => {
+      // On Node 20 `opendirSync` is a lazy getter+setter accessor; the wrap must
+      // keep it an accessor pair (a downstream consumer may inspect the descriptor
+      // or assign to it on that version), not flatten it to a data property.
+      const descriptor = Object.getOwnPropertyDescriptor(fs, 'opendirSync')
+      if (lazyAccessorShape) {
+        assert.strictEqual(typeof descriptor.get, 'function', 'opendirSync getter must be preserved')
+        assert.strictEqual(typeof descriptor.set, 'function', 'opendirSync setter must be preserved')
+      }
+
+      const operations = []
+      const onStart = (ctx) => operations.push({ operation: ctx.operation, path: ctx.path })
+
+      opStartCh.subscribe(onStart)
+      try {
+        fs.opendirSync(dirname).closeSync()
+      } finally {
+        opStartCh.unsubscribe(onStart)
+      }
+
+      assert.ok(
+        operations.some(({ operation, path: opPath }) => operation === 'opendirSync' && opPath === dirname),
+        `Expected an opendirSync start for ${dirname}, got ${JSON.stringify(operations)}`
+      )
+    })
+
+    it('instruments opendir while preserving its descriptor shape', async () => {
+      const descriptor = Object.getOwnPropertyDescriptor(fs, 'opendir')
+      if (lazyAccessorShape) {
+        assert.strictEqual(typeof descriptor.get, 'function', 'opendir getter must be preserved')
+        assert.strictEqual(typeof descriptor.set, 'function', 'opendir setter must be preserved')
+      }
+
+      const operations = []
+      const onStart = (ctx) => operations.push({ operation: ctx.operation, path: ctx.path })
+
+      opStartCh.subscribe(onStart)
+      try {
+        const dir = await new Promise((resolve, reject) => {
+          fs.opendir(dirname, (error, openedDir) => error ? reject(error) : resolve(openedDir))
+        })
+        dir.closeSync()
+      } finally {
+        opStartCh.unsubscribe(onStart)
+      }
+
+      assert.ok(
+        operations.some(({ operation, path: opPath }) => operation === 'opendir' && opPath === dirname),
+        `Expected an opendir start for ${dirname}, got ${JSON.stringify(operations)}`
+      )
+    })
+  })
 })
diff --git a/packages/datadog-shimmer/src/shimmer.js b/packages/datadog-shimmer/src/shimmer.js
index 3b410030a9..3af1e25a70 100644
--- a/packages/datadog-shimmer/src/shimmer.js
+++ b/packages/datadog-shimmer/src/shimmer.js
@@ -119,11 +119,14 @@ function wrapCallback (original, wrapper) {
  * object.
  * @param {string | symbol} name - The property key of the method to wrap.
  * @param {(original: Function) => (...args: unknown[]) => unknown} wrapper - The wrapper function.
- * @param {{ replaceGetter?: boolean }} [options] - If `replaceGetter` is set to
- * true, the getter is accessed and the getter is replaced with one that just
- * returns the earlier retrieved value. Use with care! This may only be done in
- * case the getter absolutely has no side effect and no setter is defined for the
- * property.
+ * @param {{ replaceGetter?: boolean }} [options] - By default the getter is
+ * wrapped in place, so each property access runs the wrapper. A getter+setter
+ * pair keeps its setter; a setter-only property throws. If `replaceGetter` is
+ * true, the getter is instead accessed once and replaced with one returning the
+ * resolved wrapped value — for a lazy getter+setter pair (e.g. Node 20's
+ * `fs.opendir`) the setter is rebuilt to materialize a writable data property on
+ * assignment, keeping the descriptor observationally identical for downstream
+ * consumers. Use with care! This may only be done when the getter has no side effect.
  * @returns {Record<string | symbol, unknown> | Function | undefined} The target object with
  * the wrapped method.
  */
@@ -151,17 +154,13 @@ function wrap (target, name, wrapper, options) {
     enumerable: false,
   }
 
-  if (descriptor.set && (!descriptor.get || options?.replaceGetter)) {
-    // It is possible to support these cases by instrumenting both the getter
-    // and setter (or only the setter, in case that is a use case).
-    // For now, this is not supported due to the complexity and the fact that
-    // this is not a common use case.
-    throw new Error(options?.replaceGetter
-      ? 'Replacing a getter/setter pair is not supported. Implement if required.'
-      : 'Replacing setters is not supported. Implement if required.')
+  // A setter-only property has nothing to wrap. Instrumenting the setter is not
+  // implemented; a getter+setter pair is handled below.
+  if (descriptor.set && !descriptor.get) {
+    throw new Error('Replacing setters is not supported. Implement if required.')
   }
 
-  const original = descriptor.value ?? options?.replaceGetter ? target[name] : descriptor.get
+  const original = (descriptor.value ?? options?.replaceGetter) ? target[name] : descriptor.get
 
   assertMethod(target, name, original)
 
@@ -176,8 +175,30 @@ function wrap (target, name, wrapper, options) {
     }
     descriptor.value = wrapped
   } else {
-    if (descriptor.get) {
-      // `replaceGetter` may only be used when the getter has no side effect.
+    if (descriptor.set && options?.replaceGetter) {
+      // A lazy accessor pair (e.g. Node 20's `fs.opendir`). `original` already
+      // resolved the value through the getter. Keep the property an accessor pair
+      // so the shape stays observationally identical — a downstream consumer may
+      // read the descriptor or assign to it on a specific Node.js version. The
+      // getter returns the wrapped value; the setter mirrors the native lazy
+      // contract (assignment self-replaces the property with a writable data
+      // property holding the assigned value), so a caller that overwrites the
+      // method gets exactly what they set, unwrapped, as before. The descriptor
+      // is the original accessor descriptor (no `value`/`writable` slots), so
+      // reassigning `get`/`set` keeps it a valid accessor descriptor.
+      descriptor.get = () => wrapped
+      descriptor.set = function (value) {
+        Object.defineProperty(this, name, {
+          configurable: descriptor.configurable,
+          enumerable: descriptor.enumerable,
+          writable: true,
+          value,
+        })
+      }
+    } else if (descriptor.get) {
+      // Wrap the getter in place; for a getter+setter pair the original setter
+      // stays untouched. `replaceGetter` (no side effect on read) instead returns
+      // the value resolved once into `wrapped`.
       descriptor.get = options?.replaceGetter ? () => wrapped : wrapped
     } else {
       descriptor.value = wrapped
diff --git a/packages/datadog-shimmer/test/shimmer.spec.js b/packages/datadog-shimmer/test/shimmer.spec.js
index 5fd61dbdeb..8532e2bd0e 100644
--- a/packages/datadog-shimmer/test/shimmer.spec.js
+++ b/packages/datadog-shimmer/test/shimmer.spec.js
@@ -57,6 +57,86 @@ describe('shimmer', () => {
       assert.strictEqual(called, 1)
     })
 
+    it('should wrap a lazy getter/setter pair while preserving the accessor shape', () => {
+      // Mirrors Node 20's `fs.opendir`: a lazy accessor that resolves the real
+      // function on first read and self-replaces with a data property on write.
+      // The wrap must keep it an accessor pair so the descriptor shape stays
+      // observationally identical for downstream consumers on that Node version.
+      const target = () => 'original'
+      const obj = {}
+      Object.defineProperty(obj, 'method', {
+        configurable: true,
+        enumerable: true,
+        get () { return target },
+        set (value) {
+          Object.defineProperty(obj, 'method', { configurable: true, enumerable: true, writable: true, value })
+        },
+      })
+
+      let called = 0
+      shimmer.wrap(obj, 'method', method => (...args) => {
+        called++
+        return method(...args)
+      }, { replaceGetter: true })
+
+      // Still an accessor pair, with the original configurable/enumerable flags.
+      const descriptor = Object.getOwnPropertyDescriptor(obj, 'method')
+      assert.strictEqual(typeof descriptor.get, 'function')
+      assert.strictEqual(typeof descriptor.set, 'function')
+      assert.strictEqual(descriptor.configurable, true)
+      assert.strictEqual(descriptor.enumerable, true)
+
+      // Reading returns the wrapped method.
+      assert.strictEqual(obj.method.name, target.name)
+      assert.strictEqual(obj.method(), 'original')
+      assert.strictEqual(called, 1)
+
+      // Assignment mirrors the native lazy contract: it materializes the property
+      // as a writable data property holding exactly what was set (unwrapped).
+      const replacement = () => 'replacement'
+      obj.method = replacement
+      const afterSet = Object.getOwnPropertyDescriptor(obj, 'method')
+      assert.strictEqual(afterSet.get, undefined)
+      assert.strictEqual(afterSet.set, undefined)
+      assert.strictEqual(afterSet.writable, true)
+      assert.strictEqual(obj.method, replacement)
+      assert.strictEqual(obj.method(), 'replacement')
+      assert.strictEqual(called, 1, 'a caller-supplied replacement is not wrapped')
+    })
+
+    it('should wrap a getter/setter pair in place without the replaceGetter option', () => {
+      // Mirrors `url.js` wrapping the `URL.prototype` `host`/`hostname` getters,
+      // which are getter+setter accessor pairs. Each read must run the wrapper,
+      // and the original setter is left untouched.
+      let setValue
+      const obj = {}
+      Object.defineProperty(obj, 'method', {
+        configurable: true,
+        enumerable: true,
+        get () { return 'original' },
+        set (value) { setValue = value },
+      })
+
+      let called = 0
+      shimmer.wrap(obj, 'method', getter => function () {
+        called++
+        return getter.call(this)
+      })
+
+      const descriptor = Object.getOwnPropertyDescriptor(obj, 'method')
+      assert.strictEqual(typeof descriptor.get, 'function')
+      assert.strictEqual(typeof descriptor.set, 'function')
+
+      assert.strictEqual(obj.method, 'original')
+      assert.strictEqual(called, 1)
+      assert.strictEqual(obj.method, 'original')
+      assert.strictEqual(called, 2)
+
+      obj.method = 42
+      assert.strictEqual(setValue, 42)
+      assert.strictEqual(typeof Object.getOwnPropertyDescriptor(obj, 'method').set, 'function')
+    })
+
     it('should not wrap setter only method', () => {
       // eslint-disable-next-line accessor-pairs
       const obj = { set setter (_method_) {} }

From aca9c415e39ce1af6aa941efd624240b41e36c57 Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Tue, 30 Jun 2026 18:16:53 +0200
Subject: [PATCH 25/51] test(kafkajs): drop retries:0 from header-disable
 producer tests (#9106)

The second sendBatch/send in these tests is a real broker call that the
test expects to succeed after the stub is restored. A fresh topic's first
produce routinely returns the retryable NOT_LEADER_FOR_PARTITION while
metadata propagates; kafkajs normally refreshes metadata and retries it,
but retry:{retries:0} stripped that safety net, surfacing the transient
error as a hard KafkaJSNonRetriableError and flaking CI.

retries:0 bought nothing for the first call it was meant to speed up: the
stubbed UNKNOWN error is non-retryable, so it already fails on the first
attempt regardless of the retry count. Removing it restores the retry on
the real call while leaving the stubbed-rejection assertions unchanged.
---
 packages/datadog-plugin-kafkajs/test/index.spec.js | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/packages/datadog-plugin-kafkajs/test/index.spec.js b/packages/datadog-plugin-kafkajs/test/index.spec.js
index 2082406c17..c65a3a8e6e 100644
--- a/packages/datadog-plugin-kafkajs/test/index.spec.js
+++ b/packages/datadog-plugin-kafkajs/test/index.spec.js
@@ -269,9 +269,6 @@ describe('Plugin', () => {
               const otherKafka = new Kafka({
                 clientId: `kafkajs-test-${version}`,
                 brokers: ['127.0.0.1:9092'],
-                retry: {
-                  retries: 0,
-                },
               })
 
               sendRequestStub = sinon.stub(Broker.prototype, 'produce').rejects(error)
@@ -492,7 +489,6 @@ describe('Plugin', () => {
               const otherKafka = new Kafka({
                 clientId: `kafkajs-test-${version}`,
                 brokers: ['127.0.0.1:9092'],
-                retry: { retries: 0 },
               })
               produceStub = sinon.stub(Broker.prototype, 'produce').rejects(error)
               producer = otherKafka.producer({ transactionTimeout: 10 })

From 7ade5fe68707d6bfbc018a00f1e4eed6616967b8 Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Tue, 30 Jun 2026 18:40:28 +0200
Subject: [PATCH 26/51] test(runtime-metrics): widen GC pause p95 bound to
 deflake (#9121)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The non-native runtime metrics test asserted that
runtime.node.gc.pause.by.type.95percentile lands in [0.1ms, 100ms).
On a fast or idle runner a gc_type can have a single scavenge sample
whose p95 sits below 0.1ms, so the matcher rejected a legitimate value
and the test failed on Windows.

The bounds exist to catch a unit-conversion regression, not to assert a
minimum pause length: a sub-microsecond value would mean the ms->ns
conversion was dropped, a value over 100ms that it was left in ms or
seconds. Lower the floor to 1µs so it still trips on a dropped
conversion while no longer assuming a GC pause takes at least 0.1ms.
---
 packages/dd-trace/test/runtime_metrics.spec.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/packages/dd-trace/test/runtime_metrics.spec.js b/packages/dd-trace/test/runtime_metrics.spec.js
index f1c3a0fcc7..3aa7410c73 100644
--- a/packages/dd-trace/test/runtime_metrics.spec.js
+++ b/packages/dd-trace/test/runtime_metrics.spec.js
@@ -326,7 +326,12 @@ function createGarbage (count = 50) {
             return value > 0 && Number.isInteger(value)
           })
           const isGC95Percentile = sinon.match((value) => {
-            return value >= 1e5 && value < 1e8 // In Nanoseconds. 0.1ms to 100ms.
+            // Nanoseconds, 1µs to 100ms. These bounds guard the unit conversion, not the timing:
+            // a sub-microsecond value means the ms→ns conversion (`entry.duration * 1e6`) was
+            // dropped, and a value over 100ms means it was left in milliseconds or seconds. The
+            // floor used to be 0.1ms, which flaked on fast/idle runners where a single scavenge
+            // pause is the only sample for a gc_type and its p95 sits below that.
+            return value >= 1e3 && value < 1e8
           })
           const isHeapSpace = sinon.match((metricName) => {
             return /^heap_space:[a-z_]+$/.test(metricName)

From 599b825d4d5707a00d92ffd74d127fb39349e268 Mon Sep 17 00:00:00 2001
From: Pablo Erhard <104538390+pabloerhard@users.noreply.github.com>
Date: Tue, 30 Jun 2026 12:15:12 -0600
Subject: [PATCH 27/51] ci(engines): widen engines.node to >=18 in CI to keep
 Node 18/20 jobs running (#9145)

* ci(engines): widen engines.node to >=18 in CI to keep Node 18/20 jobs running

engines.node is bumped to >=22 to match the supported runtime range. The
runtime guard (packages/dd-trace/src/guardrails/index.js) and the withVersions
test helper both read engines.node and bail when the running major is below it,
so on Node 18/20 every suite would silently skip (withVersions returns early,
the init guard short-circuits, mocha reports 0 passing).

CI widens engines.node back to >=18 at the action level (right after
actions/setup-node) via scripts/ci/widen-engines-for-ci.js, so Node 18/20 jobs
keep exercising real tests. The on-disk package.json that ships is unchanged
(engines.node stays >=22).

Co-authored-by: Cursor <cursoragent@cursor.com>

* ci(engines): only widen engines.node on Node 18/20 jobs

The widen step lives in the shared node/setup action, so it ran on every CI job,
including integration-guardrails-unsupported, which installs Node 0.8 through 14 on
purpose to verify the runtime guard aborts. Two problems: the script used a
node:-prefixed require (unsupported before Node 14.18) so it crashed and failed those
jobs, and even had it run, rewriting engines.node there would undermine a test that
relies on the shipped >=22.

Gate the step in the action so it only runs when the installed major is 18 or 20 (the
supported majors the >=22 bump newly excludes). Every other version, including the
unsupported matrix, keeps the shipped >=22 and the script is never parsed by a runtime
too old to run it.

Co-authored-by: Cursor <cursoragent@cursor.com>

* ci(node): pin oldest alias to Node 18 instead of deriving from engines.node

Commit 1a79e1027 (prepare to drop Node 18/20) changed the `oldest` version alias
to read the minimum major out of package.json engines.node. With engines.node now
bumped to >=22, `oldest` resolved to Node 22, which dropped Node 18 from the matrix
and shifted the child_process job's legs to {22,20,24,26}. The resulting leg order
(Node 22 first, then 20) destabilized the Bluebird global-Promise tests on the Node
20 leg, which pass on master's {18,20,24,26}.

Pin `oldest` back to a literal 18 so CI keeps testing the oldest version we still
exercise, decoupled from the shipped engines floor. This restores the matrix and leg
order to match master; the widen step still restores >=18 on the 18/20 legs.

Co-authored-by: Cursor <cursoragent@cursor.com>

* add early return

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/actions/node/setup/action.yml | 22 +++++++++++++++--
 scripts/ci/widen-engines-for-ci.js    | 35 +++++++++++++++++++++++++++
 2 files changed, 55 insertions(+), 2 deletions(-)
 create mode 100644 scripts/ci/widen-engines-for-ci.js

diff --git a/.github/actions/node/setup/action.yml b/.github/actions/node/setup/action.yml
index 745c7ba6fd..ef54965603 100644
--- a/.github/actions/node/setup/action.yml
+++ b/.github/actions/node/setup/action.yml
@@ -27,8 +27,10 @@ runs:
         }
         case "$VERSION" in
           eol)         version=16 ;;
-          oldest)      oldest_major=$(awk '/"node"/{match($0,/[0-9]+/);print substr($0,RSTART,RLENGTH);exit}' package.json)
-                      version=$(node_version "$oldest_major") ;;
+          # Pinned to 18 rather than derived from package.json engines.node: CI keeps testing the
+          # oldest version we still exercise (18) even though the shipped engines floor is now >=22.
+          # See the Widen engines.node for CI step below, which restores >=18 on the 18/20 legs.
+          oldest)      version=$(node_version 18) ;;
           maintenance) version=$(node_version 20) ;;
           active)      version=$(node_version 24) ;;
           latest)      version=${LATEST_VERSION:-$(node_version 26)}
@@ -44,6 +46,22 @@ runs:
         node-version: ${{ steps.node-version.outputs.version }}
         registry-url: ${{ inputs.registry-url || 'https://registry.npmjs.org' }}
 
+    # The shipped package.json pins engines.node to the supported runtime range, but CI keeps
+    # running the full suite on Node 18/20. Widen the field to >=18 for this checkout so the
+    # runtime guard and the withVersions test helper don't bail and silently skip those jobs.
+    # Gate on the major so this never runs on the ancient runtimes the guardrails-unsupported
+    # job installs (those must keep seeing the shipped >=22 so the guard aborts), and so the
+    # script is only ever parsed by a Node version new enough to run it.
+    - name: Widen engines.node for CI
+      shell: bash
+      run: |
+        MAJOR=$(node -e "process.stdout.write(String(parseInt(process.versions.node)))")
+        if [ "$MAJOR" = "18" ] || [ "$MAJOR" = "20" ]; then
+          node scripts/ci/widen-engines-for-ci.js
+        else
+          echo "Leaving engines.node unchanged on Node $(node -v) (only widened on Node 18/20)."
+        fi
+
     # Persist the resolved version so subsequent runs within this 60-minute window can reuse it.
     - name: Save resolved version
       if: steps.node-version-cache.outputs.cache-hit != 'true'
diff --git a/scripts/ci/widen-engines-for-ci.js b/scripts/ci/widen-engines-for-ci.js
new file mode 100644
index 0000000000..375f7e5d32
--- /dev/null
+++ b/scripts/ci/widen-engines-for-ci.js
@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+
+'use strict'
+
+// CI-only helper. The shipped package.json pins `engines.node` to the supported
+// runtime range (`>=22`), but CI still runs the full suite on Node 18 and 20 to
+// keep those jobs exercising real tests. The runtime guard
+// (packages/dd-trace/src/guardrails/index.js) and the `withVersions` test helper
+// both read `engines.node` and bail when the running major is below it, which would
+// silently skip every suite on those majors. Widening the field to `>=18` for the
+// CI checkout keeps those jobs honest without touching what we publish.
+//
+// The node/setup action gates this step so it only runs on the supported majors the
+// `>=22` bump newly excludes (18 and 20); it is never invoked on the ancient runtimes
+// the `integration-guardrails-unsupported` job installs, which must keep seeing the
+// shipped `>=22` so the guard aborts.
+
+const fs = require('node:fs')
+const path = require('node:path')
+
+const CI_MIN_NODE = '>=18'
+
+const packageJsonPath = path.join(__dirname, '..', '..', 'package.json')
+const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'))
+
+const before = pkg.engines.node
+if (before === CI_MIN_NODE) return
+
+pkg.engines.node = CI_MIN_NODE
+const after = pkg.engines.node
+
+fs.writeFileSync(packageJsonPath, JSON.stringify(pkg, null, 2) + '\n')
+
+// eslint-disable-next-line no-console
+console.log(`Widened engines.node for CI: ${before} -> ${after}`)

From 797f843530139249f4c5978fb4c754495611456b Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Tue, 30 Jun 2026 20:39:21 +0200
Subject: [PATCH 28/51] test(child_process): load the mock agent once per suite
 (#9113)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* test(child_process): load the mock agent once per suite

The Integration and Bluebird suites called agent.load / agent.close in
beforeEach / afterEach, so every test tore down the mock agent and the next
brought a new one up on a fresh port. Async child processes spawned in a test
finish on their own 'close' event, which can fire after the test resolves —
during the teardown gap. The leaked command_execution span then flushed to the
previous test's now-closed port (ECONNREFUSED), and a stale assertion handler
matched the leftover manual 'parent' span instead, timing the next test out.
Under CI load the first miss cascaded across the whole suite.

Loading the agent once per describe block in before / after keeps a single
port alive for every test in the block, so a late span lands on the still-open
agent. The Bluebird global.Promise swap stays per-test in beforeEach / afterEach.

Fixes: https://github.com/DataDog/dd-trace-js/actions/runs/28281208791

* test(child_process): drain ls spans in span-maintenance tests

The shared mock agent now stays alive across every test in the Integration
suite. The "should maintain previous span" cases spawn an async ls child
process but never await its command_execution span, so a late flush can land
during a later test whose expectSomeSpan carries the same ls expectation and be
consumed there, masking a regression in that later command instead of failing.
Awaiting the span in the originating test consumes it before the next test runs.

Refs: https://github.com/DataDog/dd-trace-js/pull/9113#discussion_r3485658968
---
 .../test/index.spec.js                        | 72 ++++++++++---------
 1 file changed, 40 insertions(+), 32 deletions(-)

diff --git a/packages/datadog-plugin-child_process/test/index.spec.js b/packages/datadog-plugin-child_process/test/index.spec.js
index 94b07fb688..6b1076e764 100644
--- a/packages/datadog-plugin-child_process/test/index.spec.js
+++ b/packages/datadog-plugin-child_process/test/index.spec.js
@@ -1,6 +1,7 @@
 'use strict'
 
 const assert = require('node:assert/strict')
+const events = require('node:events')
 
 const { after, afterEach, before, beforeEach, describe, it } = require('mocha')
 const sinon = require('sinon')
@@ -389,20 +390,23 @@ describe('Child process plugin', () => {
     let originalPromise
     let Bluebird
 
-    beforeEach(async () => {
+    before(async () => {
       tracer = await agent.load('child_process', undefined, { flushInterval: 1 })
       childProcess = require('child_process')
       util = require('util')
       tracer.use('child_process', { enabled: true })
       Bluebird = require('../../../versions/bluebird').get()
+    })
+
+    after(() => agent.close())
 
+    beforeEach(() => {
       originalPromise = global.Promise
       global.Promise = Bluebird
     })
 
     afterEach(() => {
       global.Promise = originalPromise
-      return agent.close()
     })
 
     it('should not crash with "this._then is not a function" when using Bluebird promises', async () => {
@@ -494,13 +498,14 @@ describe('Child process plugin', () => {
       const execSyncMethods = ['execSync']
       let childProcess, tracer
 
-      beforeEach(async () => {
+      before(async () => {
         tracer = await agent.load('child_process', undefined, { flushInterval: 1 })
         childProcess = require('child_process')
         tracer.use('child_process', { enabled: true })
       })
 
-      afterEach(() => agent.close())
+      after(() => agent.close())
+
       const parentSpanList = [true, false]
       parentSpanList.forEach(hasParentSpan => {
         let parentSpan
@@ -524,19 +529,19 @@ describe('Child process plugin', () => {
 
           methods.forEach(({ methodName, async }) => {
             describe(methodName, () => {
-              it('should be instrumented', (done) => {
-                const expected = {
-                  type: 'system',
-                  name: 'command_execution',
-                  error: 0,
-                  meta: {
-                    component: 'subprocess',
-                    'cmd.shell': 'ls',
-                    'cmd.exit_code': '0',
-                  },
-                }
+              const lsExpected = {
+                type: 'system',
+                name: 'command_execution',
+                error: 0,
+                meta: {
+                  component: 'subprocess',
+                  'cmd.shell': 'ls',
+                  'cmd.exit_code': '0',
+                },
+              }
 
-                expectSomeSpan(agent, expected).then(done, done)
+              it('should be instrumented', (done) => {
+                expectSomeSpan(agent, lsExpected).then(done, done)
 
                 const res = childProcess[methodName]('ls')
                 if (async) {
@@ -544,27 +549,29 @@ describe('Child process plugin', () => {
                 }
               })
 
-              it('should maintain previous span after the execution', (done) => {
+              it('should maintain previous span after the execution', async () => {
+                const drained = expectSomeSpan(agent, lsExpected)
+
                 const res = childProcess[methodName]('ls')
-                const span = storage('legacy').getStore()?.span
-                assert.strictEqual(span, parentSpan)
+                assert.strictEqual(storage('legacy').getStore()?.span, parentSpan)
                 if (async) {
-                  res.on('close', () => {
-                    assert.strictEqual(span, parentSpan)
-                    done()
-                  })
+                  await Promise.all([drained, (async () => {
+                    await events.once(res, 'close')
+                    assert.strictEqual(storage('legacy').getStore()?.span, parentSpan)
+                  })()])
                 } else {
-                  done()
+                  await drained
                 }
               })
 
               if (async) {
-                it('should maintain previous span in the callback', (done) => {
-                  childProcess[methodName]('ls', () => {
-                    const span = storage('legacy').getStore()?.span
-                    assert.strictEqual(span, parentSpan)
-                    done()
-                  })
+                it('should maintain previous span in the callback', async () => {
+                  await Promise.all([expectSomeSpan(agent, lsExpected), new Promise(resolve => {
+                    childProcess[methodName]('ls', () => {
+                      assert.strictEqual(storage('legacy').getStore()?.span, parentSpan)
+                      resolve()
+                    })
+                  })])
                 })
               }
 
@@ -637,13 +644,14 @@ describe('Child process plugin', () => {
       const execSyncMethods = ['execFileSync', 'spawnSync']
       let childProcess, tracer
 
-      beforeEach(async () => {
+      before(async () => {
         tracer = await agent.load('child_process', undefined, { flushInterval: 1 })
         childProcess = require('child_process')
         tracer.use('child_process', { enabled: true })
       })
 
-      afterEach(() => agent.close())
+      after(() => agent.close())
+
       const parentSpanList = [true, false]
       parentSpanList.forEach(parentSpan => {
         describe(`${parentSpan ? 'with' : 'without'} parent span`, () => {

From 654a3fbf27b7e9dac2d11c362b49397f16af30c3 Mon Sep 17 00:00:00 2001
From: Yiming Luo <10097700+lym953@users.noreply.github.com>
Date: Tue, 30 Jun 2026 14:57:00 -0400
Subject: [PATCH 29/51] feat: [SVLS-9168] add aws.durable.operation_attempt tag
 to durable operation spans (#8595)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* workflow(aws-durable-execution-sdk-js): install_package

* workflow(aws-durable-execution-sdk-js): generate_app

* workflow(aws-durable-execution-sdk-js): compile

* workflow(aws-durable-execution-sdk-js): test:att1:iter1:fixer

* workflow(aws-durable-execution-sdk-js): test:att1:iter2:fixer

* workflow(aws-durable-execution-sdk-js): feature_implement

* workflow(aws-durable-execution-sdk-js): get_lint_failures

* workflow(aws-durable-execution-sdk-js): lint_and_fix:att1:iter1:fix_lint_errors

* workflow(aws-durable-execution-sdk-js): review_cycle:att1:iter1:batch_fix

* remove the unnecessary dd-api-key

* clean up

# Conflicts:
#	index.d.ts

* yarn.lock changed...

* fixing yarn.lock

* remove the unintended finish() guard

* update span names

* use a fixed service name instead

* update resource names

* naming consistency

* small fix

* Python  PR parity

* Undo unnecessary changes

* Finish error spans on asyncEnd

* Simplify orchestrion file

* Class/file name changes

* Several simplifications and improvements

* Do not explicitly set component

* Remove includeReplayedTag

* Smaller simplifications

* Tests simplification

* chore: update supported-integrations

* More test simplification

* Add aws.durable.operation_id and aws.durable.operation_name

* Fix checks

* Linter

* Test simplifications

* More test improvements

* Lazy thenables + only close this integration's spans

* Code simplifications

* Fix rebase

* Mirror changes in v5

* Test waitForCondition happy path

* Comment improvements based on guidelines

* supress child context for WaitForCallback

* Increase tested version

* Address review comments

* Avoid patching on the plugin by creating a "settle" channel

* Do not skipTime to avoid interfering with tracer's timers

* Fix test flakiness

* Test durable-execution-sdk-js  only on node >=22

* Linter

* feat(aws-durable-execution-sdk-js): trace-context checkpoint for cross-invocation continuity

Persist the current trace context as a synthetic `_datadog_{N}` STEP operation
when the SDK suspends to PENDING, so subsequent invocations (read by the
upstream datadog-lambda-js wrapper) can resume the same trace.

Files:
- src/handler.js: install a hook on the SDK's terminationManager.terminate
  inside bindStart. Save fires only for resumable reasons (PENDING_TERMINATION_REASONS
  allow-list mirrors the SDK's TerminationReason enum entries that result in
  Status: PENDING). Gated by DD_DURABLE_CROSS_INVOCATION_TRACING_ENABLED
  (default on; opt out with 'false'/'0').
- src/trace-checkpoint.js: NEW. Datadog-only header inject (private
  TextMapPropagator with tracePropagationStyle.inject = ['datadog'], shadows
  the live tracer config), dedup against prior _datadog_N op via
  JSON.stringify-after-stripping-x-datadog-parent-id, deterministic blake2b
  stepId so the save is idempotent within an execution.
- test/handler.checkpoint.spec.js: unit tests for the termination hook
  (pending vs non-pending reasons, env-var gate, idempotency, default reason).
- test/trace-checkpoint.spec.js: unit tests for the save module
  (queue START+SUCCEED before terminating, dedup on parent-id-only changes).
- test/index.spec.js: integration coverage for SDK safe-paths
  (single cycle, child-context, step-suspend-step).
- packages/dd-trace/src/config/supported-configurations.json and
  generated-config-types.d.ts: register DD_DURABLE_CROSS_INVOCATION_TRACING_ENABLED.

* small fixes: align format

* test(aws-durable-execution-sdk-js): skip 3 tests that race against TimerScheduler bug

Skip wait_for_callback (happy path) and the entire invoke describe block
(happy + error). All three fail deterministically in CI under
@aws/durable-execution-sdk-js-testing's current TimerScheduler, whose
hasScheduledFunction() undercounts in-flight scheduled functions and
trips the test orchestrator's "Cannot return PENDING status with no
pending operations." validation. Production (real AWS backend) is not
affected — the validation is mock-only.

Fix is open upstream as aws/aws-durable-execution-sdk-js#544; re-enable
these tests once a release containing it is pinned in
packages/dd-trace/test/plugins/versions/package.json.

* refactor(aws-durable-execution-sdk-js): remove kTerminationHookInstalled guard

The guard was defensive against a "same terminationManager passed to
bindStart twice" scenario that cannot happen in the SDK as it stands —
each Lambda invocation calls initializeExecutionContext, which constructs
a fresh `new TerminationManager()`, so warm starts share the wrapper
closure but not the terminationManager instance. Removing the Symbol +
the guard + the explicit "twice across invocations" unit test that only
covered a contrived re-entry.

Drive-by: fix four pre-existing space-before-function-paren lint errors
in the same file.

* refactor(aws-durable-execution-sdk-js): anchor checkpoints at the execute span, not its parent

Drop the `getParentSpanId` helper and inline the read directly during
`state` initialization. While inlining, switch the anchor from the
execute span's *parent* (typically `aws.lambda`'s id) to the execute
span's *own* id (`span.context().toSpanId()`).

Why anchor at the execute span:
- It's a span this integration owns and just created, so always defined
  and never depends on what upstream context happened to be active when
  `bindStart` fired.
- Topology becomes "resumed invocations are continuations of the first
  execute" — matching the user-facing model of a single durable
  execution. The old shape made resumes look like sibling Lambda
  invocations under whatever upstream span happened to be there.
- In the no-upstream case the old code already fell through to the
  propagator default (= execute span's own id) via `if (parentId)` —
  so this just makes the behavior consistent across environments.

Rename for clarity:
- `saveTraceContextCheckpointIfUpdated`'s `checkpointAnchorSpanId`
  parameter -> `firstExecutionSpanId`. JSDoc spells out it's only
  consulted on the very first save; once a prior `_datadog_{N}` exists,
  the function reuses that checkpoint's `x-datadog-parent-id` verbatim.
- The local `latestParentId` (the value carried forward across saves)
  -> `anchoredSpanId`, reflecting that it IS the anchor we've been
  using since the first save.
- handler.js's `state.parentSpanId` -> `state.firstExecutionSpanId`.

Note: dd-trace-py's `_resolve_override_parent_id` currently anchors at
the execute span's parent (matching the old JS behavior). A follow-up
should bring Python in line with this change so both languages produce
the same trace shape.

* Revert "test(aws-durable-execution-sdk-js): skip 3 tests that race against TimerScheduler bug"

This reverts commit 8baa8ce12580c3686a1f367f7b78b62389b43c19.

* Reapply "test(aws-durable-execution-sdk-js): skip 3 tests that race against TimerScheduler bug"

This reverts commit 748a82629f1bbd8e6949de967969194bc42fa81e.

* force-disable legacyBaggageEnabled

* Rename context variables

* feat(aws-durable-execution-sdk-js): add aws.durable.operation_attempt tag

Tag aws.durable.step and aws.durable.wait_for_condition spans with the
1-indexed attempt number (1 for the original attempt, 2 for the first retry,
etc.), matching the AWS UI's attempt-count convention. Sourced from the
SDK's checkpoint StepDetails.Attempt field; defaults to 1 when no checkpoint
exists yet (the very first execution before the START checkpoint).

Mirrors dd-trace-py #18191.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(aws-durable-execution-sdk-js): use 0-indexed operation_attempt

Pass StepDetails.Attempt through as-is (0 = original attempt, 1 = first
retry, etc.) instead of remapping with max(1, …). The production AWS
Lambda Durable service stores Attempt as "number of prior failed
attempts" starting at 0, so the raw value already carries correct
0-indexed semantics. Default to 0 (not 1) when no checkpoint exists yet.

Matches dd-trace-py after end-to-end verification on a deployed Lambda:
CloudWatch logs confirmed server values 0/1/2 for original/retry/retry.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Apply suggestions from code review

Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>

* make installTerminationCheckpointHook real private

* simplify getDatadogOnlyPropagator

* better names

* lint

* refactor(aws-durable-execution-sdk-js): use static retryable property instead of span name Set

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(aws-durable-execution-sdk-js): derive test RETRYABLE_SPAN_NAMES from plugin static property

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Lint

* remove unnecessary try catch

* return undefined instead of null

* use timers.promises.setImmediate() instead

* Add esbuild bundling acceptance test

* ESM smoke tests

* Update packages/datadog-plugin-aws-durable-execution-sdk-js/src/handler.js

Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>

* don't skip the established tests

* also update buildPlugin

* Use the normalized `tracer` getter, not the raw `_tracer`: the latter is the proxy, whose`_config` is undefined. trace-checkpoint reads `tracer._config`, so it needs the unwrapped tracer that actually carries the config.

* lint

* improve the coverage

* Update packages/datadog-plugin-aws-durable-execution-sdk-js/src/checkpoint.js

Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>

* Address various review comments

* Operation name

* fix(aws-durable-execution-sdk-js): correct operation_attempt on replayed ops

On a SUCCEEDED checkpoint (an op replayed from its stored result),
StepDetails.Attempt holds the 1-indexed number of the attempt that
succeeded rather than the "prior failed attempts" count used on a live
run, so a replayed op reported its attempt one too high. Subtract 1 in
that case, floored at 0, so a replay agrees with the original run.

Mirrors dd-trace-py#18520.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor(aws-durable-execution-sdk-js): gate termination hook install in bindStart

Extract #shouldInstallTerminationHook so bindStart decides whether to install
the cross-invocation checkpoint hook, instead of the hook self-gating with
early returns. The hook now assumes its preconditions and recomputes the
handler args, execute span, and termination manager it wraps.

Stub operationName() in the handler checkpoint spec: it reaches into the
tracer's nomenclature, which the bare tracer stub doesn't provide.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* refactor and move instrumentation logic to aws-durable-execution-sdk-js so that it's only done once instead of every invocation

* Apply suggestion from @BridgeAR

Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>

* modify a inefficient check

* simplify comparison

* Update packages/datadog-plugin-aws-durable-execution-sdk-js/src/handler.js

Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>

* Update packages/datadog-plugin-aws-durable-execution-sdk-js/src/trace-checkpoint.js

Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>

* Update packages/datadog-plugin-aws-durable-execution-sdk-js/src/trace-checkpoint.js

Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>

* enhance getDatadogOnlyPropagator

* docs(aws-durable-execution-sdk-js): avoid hyphen line-break in getOperationAttempt comment

Reflow so "server-maintained" stays on one line, per review feedback.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(aws-durable-execution-sdk-js): cover waitForCondition replay attempt normalization

waitForCondition is the other retryable op and shares step's StepDetails.Attempt
convention (1-indexed on a SUCCEEDED replay), so add a replay test asserting its
operation_attempt normalizes back to 0. Guards against the SDK diverging the two
operations' attempt semantics. Per review feedback.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor(aws-durable-execution-sdk-js): make retryable an explicit required option

Drop the `retryable = false` default and the `= {}` fallback in
makeContextPlugin so every call site states retryability explicitly,
matching the named-boolean-option convention used elsewhere (e.g.
createCallbackInstrumentor's { captureResult }).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(aws-durable-execution-sdk-js): spell out "operation" in util.js JSDoc

Replace the "op" shorthand with "operation" in the addOpMeta and
getOperationAttempt JSDoc prose.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(aws-durable-execution-sdk-js): revert to "op" shorthand in util.js JSDoc

"op" is already the established shorthand across the durable plugin, so
keep the JSDoc consistent with it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(aws-durable-execution-sdk-js): tighten getOperationAttempt JSDoc

Condense the attempt-indexing explanation while keeping the non-obvious
parts: the pending-vs-SUCCEEDED dual indexing and the floor-at-0 rationale.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(aws-durable-execution-sdk-js): cover waitForCondition live attempt=1 on second poll

A multi-poll waitForCondition (first check returns shouldContinue:true) emits a
separate span per poll, the second carrying operation_attempt=1. This exercises
getOperationAttempt's live (non-replay) branch at attempt>0 for waitForCondition,
the path that would catch the SDK ever indexing its StepDetails.Attempt
differently from step's. No production change — verified the value is already
correct on the current code.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* refactor(aws-durable-execution-sdk-js): declare retryable=false explicitly on RunInChildContextPlugin

RunInChildContextPlugin is the one context plugin not built via
makeContextPlugin, so it relied on this.constructor.retryable resolving to
undefined. Declare it explicitly so every concrete plugin states its
retryability, matching the required option on the makeContextPlugin calls.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* refactor(aws-durable-execution-sdk-js): resolve next-step lookup once per span start

Extract getStepDataForNext, which resolves the next stepId and its checkpoint
entry in one pass. addOpMeta and getOperationAttempt now consume the
pre-resolved data instead of each calling getNextStepId() + getStepData(), so a
retryable span start no longer traverses the SDK internals twice. No behavior
change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(aws-durable-execution-sdk-js): guard getOperationAttempt against non-finite Attempt

typeof NaN === 'number', so a NaN StepDetails.Attempt slipped past the old
guard and propagated as a NaN metric, which span_format.js silently drops —
the operation_attempt metric would vanish instead of defaulting to 0.
Number.isFinite rejects NaN and Infinity too, so it falls back to 0 explicitly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Joey Zhao <5253430+joeyzhao2018@users.noreply.github.com>
Co-authored-by: Pablo Martínez Bernardo <pablo.martinezbernardo@datadoghq.com>
Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>
Co-authored-by: pablomartinezbernardo <134320516+pablomartinezbernardo@users.noreply.github.com>
---
 .../src/client.js                             |   4 +-
 .../src/context.js                            |  28 +++--
 .../src/util.js                               |  50 ++++++--
 .../test/index.spec.js                        | 118 ++++++++++++++++--
 4 files changed, 169 insertions(+), 31 deletions(-)

diff --git a/packages/datadog-plugin-aws-durable-execution-sdk-js/src/client.js b/packages/datadog-plugin-aws-durable-execution-sdk-js/src/client.js
index 0974490065..ff18741995 100644
--- a/packages/datadog-plugin-aws-durable-execution-sdk-js/src/client.js
+++ b/packages/datadog-plugin-aws-durable-execution-sdk-js/src/client.js
@@ -1,7 +1,7 @@
 'use strict'
 
 const ClientPlugin = require('../../dd-trace/src/plugins/client')
-const { addOpMeta, unwrapDurableError } = require('./util')
+const { addOpMeta, getStepDataForNext, unwrapDurableError } = require('./util')
 
 class AwsDurableExecutionSdkJsClientPlugin extends ClientPlugin {
   static id = 'aws-durable-execution-sdk-js'
@@ -29,7 +29,7 @@ class AwsDurableExecutionSdkJsClientPlugin extends ClientPlugin {
     if (operationName) {
       meta['aws.durable.operation_name'] = operationName
     }
-    addOpMeta(meta, ctx.self)
+    addOpMeta(meta, getStepDataForNext(ctx.self))
 
     this.startSpan(this.operationName(), {
       resource: operationName,
diff --git a/packages/datadog-plugin-aws-durable-execution-sdk-js/src/context.js b/packages/datadog-plugin-aws-durable-execution-sdk-js/src/context.js
index 513da12488..b9dd0b874e 100644
--- a/packages/datadog-plugin-aws-durable-execution-sdk-js/src/context.js
+++ b/packages/datadog-plugin-aws-durable-execution-sdk-js/src/context.js
@@ -2,7 +2,7 @@
 
 const { storage } = require('../../datadog-core')
 const TracingPlugin = require('../../dd-trace/src/plugins/tracing')
-const { addOpMeta, unwrapDurableError } = require('./util')
+const { addOpMeta, getOperationAttempt, getStepDataForNext, unwrapDurableError } = require('./util')
 
 // Span names whose direct children must keep the default resource.
 // These can have very high cardinality which is undesireable in the resource.
@@ -41,12 +41,18 @@ class BaseContextPlugin extends TracingPlugin {
     if (operationName) {
       meta['aws.durable.operation_name'] = operationName
     }
-    addOpMeta(meta, ctx.self)
+    const stepInfo = getStepDataForNext(ctx.self)
+    addOpMeta(meta, stepInfo)
+
+    const metrics = this.constructor.retryable
+      ? { 'aws.durable.operation_attempt': getOperationAttempt(stepInfo.stepData) }
+      : undefined
 
     this.startSpan(spanName, {
       resource,
       kind: this.constructor.kind,
       meta,
+      metrics,
     }, ctx)
 
     return ctx.currentStore
@@ -71,11 +77,12 @@ class BaseContextPlugin extends TracingPlugin {
   }
 }
 
-function makeContextPlugin (method, spanName) {
+function makeContextPlugin (method, spanName, { retryable }) {
   return class extends BaseContextPlugin {
     static prefix = `tracing:orchestrion:@aws/durable-execution-sdk-js:DurableContextImpl_${method}`
     static settleChannel = `apm:aws-durable-execution-sdk-js:${method}:settle`
     static spanName = spanName
+    static retryable = retryable
   }
 }
 
@@ -83,6 +90,7 @@ class RunInChildContextPlugin extends BaseContextPlugin {
   static prefix = 'tracing:orchestrion:@aws/durable-execution-sdk-js:DurableContextImpl_runInChildContext'
   static settleChannel = 'apm:aws-durable-execution-sdk-js:runInChildContext:settle'
   static spanName = 'aws.durable.child_context'
+  static retryable = false
 
   bindStart (ctx) {
     if (SUPPRESSED_CHILD_CONTEXT_SUBTYPES.has(getRunInChildContextSubType(ctx))) {
@@ -103,12 +111,12 @@ function getRunInChildContextSubType (ctx) {
 }
 
 module.exports = {
-  step: makeContextPlugin('step', 'aws.durable.step'),
-  wait: makeContextPlugin('wait', 'aws.durable.wait'),
-  waitForCondition: makeContextPlugin('waitForCondition', 'aws.durable.wait_for_condition'),
-  waitForCallback: makeContextPlugin('waitForCallback', 'aws.durable.wait_for_callback'),
-  createCallback: makeContextPlugin('createCallback', 'aws.durable.create_callback'),
-  map: makeContextPlugin('map', 'aws.durable.map'),
-  parallel: makeContextPlugin('parallel', 'aws.durable.parallel'),
+  step: makeContextPlugin('step', 'aws.durable.step', { retryable: true }),
+  wait: makeContextPlugin('wait', 'aws.durable.wait', { retryable: false }),
+  waitForCondition: makeContextPlugin('waitForCondition', 'aws.durable.wait_for_condition', { retryable: true }),
+  waitForCallback: makeContextPlugin('waitForCallback', 'aws.durable.wait_for_callback', { retryable: false }),
+  createCallback: makeContextPlugin('createCallback', 'aws.durable.create_callback', { retryable: false }),
+  map: makeContextPlugin('map', 'aws.durable.map', { retryable: false }),
+  parallel: makeContextPlugin('parallel', 'aws.durable.parallel', { retryable: false }),
   runInChildContext: RunInChildContextPlugin,
 }
diff --git a/packages/datadog-plugin-aws-durable-execution-sdk-js/src/util.js b/packages/datadog-plugin-aws-durable-execution-sdk-js/src/util.js
index 5236fb4f3c..2196543e62 100644
--- a/packages/datadog-plugin-aws-durable-execution-sdk-js/src/util.js
+++ b/packages/datadog-plugin-aws-durable-execution-sdk-js/src/util.js
@@ -3,26 +3,56 @@
 const { createHash } = require('node:crypto')
 
 /**
- * Populates the replay and operation_id tags for the op the DurableContextImpl is about to
- * run, deriving both from a single `getNextStepId()` call. `aws.durable.replayed` is always
- * set ('true' when the next stepId already has a SUCCEEDED checkpoint entry, i.e. the op will
- * be served from the SDK's checkpoint). `aws.durable.operation_id` — the 16-hex-char MD5 of
- * the stepId, mirroring the SDK's internal calculation — is only added when a stepId exists.
- * @param {Record<string, string>} meta - The span meta/tags object to populate.
+ * Resolves the SDK's next stepId and its checkpoint entry in a single pass, so one span start can
+ * feed both addOpMeta and getOperationAttempt without traversing the SDK internals twice. `stepData`
+ * is undefined when there is no next stepId, or no checkpoint entry exists for it yet.
  * @param {object} [ctxImpl] - The DurableContextImpl about to run the op.
- * @returns {void}
+ * @returns {{ stepId: string | undefined, stepData: object | undefined }}
  */
-function addOpMeta (meta, ctxImpl) {
+function getStepDataForNext (ctxImpl) {
   const stepId = ctxImpl?.getNextStepId?.()
+  const stepData = stepId ? ctxImpl?._executionContext?.getStepData?.(stepId) : undefined
+  return { stepId, stepData }
+}
+
+/**
+ * Populates the replay and operation_id tags from a pre-resolved step lookup (see
+ * getStepDataForNext). `aws.durable.replayed` is always set ('true' when the next stepId already
+ * has a SUCCEEDED checkpoint entry, i.e. the op will be served from the SDK's checkpoint).
+ * `aws.durable.operation_id` — the 16-hex-char MD5 of the stepId, mirroring the SDK's internal
+ * calculation — is only added when a stepId exists.
+ * @param {Record<string, string>} meta - The span meta/tags object to populate.
+ * @param {{ stepId?: string, stepData?: object }} stepInfo - Resolved next stepId and checkpoint entry.
+ * @returns {void}
+ */
+function addOpMeta (meta, { stepId, stepData }) {
   if (!stepId) {
     meta['aws.durable.replayed'] = 'false'
     return
   }
-  const stepData = ctxImpl?._executionContext?.getStepData?.(stepId)
   meta['aws.durable.replayed'] = String(stepData?.Status === 'SUCCEEDED')
   meta['aws.durable.operation_id'] = createHash('md5').update(stepId).digest('hex').slice(0, 16)
 }
 
+/**
+ * Returns the 0-indexed attempt number for the op (0 original, 1 first retry, …) from a pre-resolved
+ * checkpoint entry (see getStepDataForNext), defaulting to 0 before any checkpoint exists.
+ *
+ * StepDetails.Attempt is indexed differently depending on checkpoint status: on a pending/retry
+ * checkpoint it's the count of prior failed attempts (already 0-indexed), but on a SUCCEEDED
+ * checkpoint (a replay) it's the 1-indexed attempt that succeeded. We subtract 1 in the latter
+ * case so a replay agrees with the original run, flooring at 0 since the 1-indexing is observed
+ * server behavior, not an SDK guarantee.
+ *
+ * @param {object} [stepData] - The checkpoint entry for the next stepId.
+ * @returns {number}
+ */
+function getOperationAttempt (stepData) {
+  const attempt = stepData?.StepDetails?.Attempt
+  if (!Number.isFinite(attempt)) return 0
+  return stepData.Status === 'SUCCEEDED' ? Math.max(0, attempt - 1) : attempt
+}
+
 /**
  * The SDK wraps user errors in typed classes (StepError, ChildContextError, etc.); we follow the
  * `.cause` chain to recover the user's original Error. SDK wrappers expose a string `errorType`
@@ -40,4 +70,4 @@ function unwrapDurableError (ctx) {
   return err
 }
 
-module.exports = { addOpMeta, unwrapDurableError }
+module.exports = { addOpMeta, getOperationAttempt, getStepDataForNext, unwrapDurableError }
diff --git a/packages/datadog-plugin-aws-durable-execution-sdk-js/test/index.spec.js b/packages/datadog-plugin-aws-durable-execution-sdk-js/test/index.spec.js
index b98751f4b6..a46211af40 100644
--- a/packages/datadog-plugin-aws-durable-execution-sdk-js/test/index.spec.js
+++ b/packages/datadog-plugin-aws-durable-execution-sdk-js/test/index.spec.js
@@ -125,6 +125,12 @@ createIntegrationTestSuite('aws-durable-execution-sdk-js', '@aws/durable-executi
     })
   })
 
+  // Derived from the plugin's static retryable property — stays in sync automatically.
+  const contextPlugins = require('../src/context')
+  const RETRYABLE_SPAN_NAMES = new Set(
+    Object.values(contextPlugins).filter(cls => cls.retryable).map(cls => cls.spanName)
+  )
+
   for (const { span, operationName, run, opts, disableCrossInvocationTracing } of [
     {
       span: 'aws.durable.step',
@@ -183,6 +189,14 @@ createIntegrationTestSuite('aws-durable-execution-sdk-js', '@aws/durable-executi
         })
         assert.match(matched.meta?.['aws.durable.operation_id'] ?? '', OPERATION_ID_RE)
         assert.notEqual(matched.error, 1, `${span} happy path should not be errored`)
+        if (RETRYABLE_SPAN_NAMES.has(span)) {
+          // 0-indexed: original attempt has 0 prior failures.
+          assert.equal(matched.metrics?.['aws.durable.operation_attempt'], 0,
+            `${span} should carry aws.durable.operation_attempt`)
+        } else {
+          assert.equal(matched.metrics?.['aws.durable.operation_attempt'], undefined,
+            `${span} must not carry aws.durable.operation_attempt`)
+        }
       })
       const invoke = () => invokeHandler(async (event, ctx) => run(ctx), opts)
       await (disableCrossInvocationTracing ? withCrossInvocationTracingDisabled(invoke) : invoke())
@@ -341,18 +355,25 @@ createIntegrationTestSuite('aws-durable-execution-sdk-js', '@aws/durable-executi
   })
 
   it('checkpoint plugin: fail-then-succeed retry produces a span per attempt', async () => {
-    const failedAttemptSpan = agent.assertSomeTraces(traces => assertSpanByName(traces, {
-      name: 'aws.durable.step',
-      resource: 'retry-step',
-      meta: { 'error.type': 'Error', 'error.message': 'transient failure' },
-      error: 1,
-    }))
+    const failedAttemptSpan = agent.assertSomeTraces(traces => {
+      const span = assertSpanByName(traces, {
+        name: 'aws.durable.step',
+        resource: 'retry-step',
+        meta: { 'error.type': 'Error', 'error.message': 'transient failure' },
+        error: 1,
+      })
+      // Original attempt: 0 prior failed attempts.
+      assert.equal(span.metrics?.['aws.durable.operation_attempt'], 0,
+        'failed original attempt should carry aws.durable.operation_attempt=0')
+    })
     const succeededAttemptSpan = agent.assertSomeTraces(traces => {
       const span = traces.flat().find(s =>
-        s.name === 'aws.durable.step' && s.resource === 'retry-step'
+        s.name === 'aws.durable.step' && s.resource === 'retry-step' && s.error !== 1
       )
-      assert.ok(span, 'expected step span')
-      assert.notEqual(span.error, 1, 'successful retry attempt must not be tagged as errored')
+      assert.ok(span, 'expected successful step span')
+      // First retry: 1 prior failed attempt.
+      assert.equal(span.metrics?.['aws.durable.operation_attempt'], 1,
+        'successful retry attempt should carry aws.durable.operation_attempt=1')
     }, { timeoutMs: 5000 })
     const successfulExecuteSpan = agent.assertSomeTraces(traces => assertSpanByName(traces, {
       name: 'aws.durable.execute',
@@ -373,6 +394,85 @@ createIntegrationTestSuite('aws-durable-execution-sdk-js', '@aws/durable-executi
     return Promise.all([failedAttemptSpan, succeededAttemptSpan, successfulExecuteSpan])
   })
 
+  it('checkpoint plugin: replayed step that succeeded first try reports operation_attempt=0', async () => {
+    const replayedStep = agent.assertSomeTraces(traces => {
+      const span = traces.flat().find(s =>
+        s.name === 'aws.durable.step' &&
+        s.resource === 'first-try-step' &&
+        s.meta?.['aws.durable.replayed'] === 'true'
+      )
+      assert.ok(span, 'expected a replayed first-try-step span')
+      // The step succeeded on its first attempt. On replay the SDK reloads the
+      // SUCCEEDED checkpoint, whose StepDetails.Attempt is the 1-indexed number of
+      // the attempt that succeeded (1), not the "prior failed attempts" count used
+      // on the live run (0). We must normalize back to 0 so the replay agrees with
+      // the original attempt span.
+      assert.equal(span.metrics?.['aws.durable.operation_attempt'], 0,
+        'replayed first-try step should carry aws.durable.operation_attempt=0')
+    }, { timeoutMs: 5000 })
+
+    await invokeHandler(async (event, ctx) => {
+      await ctx.step('first-try-step', async () => 'ok')
+      await ctx.wait('suspend-trigger', { seconds: 1 })
+    })
+
+    return replayedStep
+  })
+
+  // waitForCondition is the other retryable op. Its StepDetails.Attempt follows the
+  // same convention as step (live: prior-attempt count; SUCCEEDED replay: 1-indexed
+  // attempt that succeeded), so it must get the same replay normalization. This guards
+  // against the SDK diverging the two operations' attempt semantics in the future.
+  it('checkpoint plugin: replayed waitForCondition that passed first check reports operation_attempt=0', async () => {
+    const replayedCondition = agent.assertSomeTraces(traces => {
+      const span = traces.flat().find(s =>
+        s.name === 'aws.durable.wait_for_condition' &&
+        s.resource === 'first-check-condition' &&
+        s.meta?.['aws.durable.replayed'] === 'true'
+      )
+      assert.ok(span, 'expected a replayed first-check-condition span')
+      assert.equal(span.metrics?.['aws.durable.operation_attempt'], 0,
+        'replayed first-check waitForCondition should carry aws.durable.operation_attempt=0')
+    }, { timeoutMs: 5000 })
+
+    await invokeHandler(async (event, ctx) => {
+      await ctx.waitForCondition('first-check-condition', async () => 'done', {
+        initialState: 'pending',
+        waitStrategy: () => ({ shouldContinue: false }),
+      })
+      await ctx.wait('suspend-trigger', { seconds: 1 })
+    })
+
+    return replayedCondition
+  })
+
+  // Live multi-poll: the first check returns shouldContinue:true, forcing a second poll. Each poll
+  // is a separate retryable waitForCondition span, and the second carries operation_attempt=1. This
+  // is the only path that exercises getOperationAttempt's live (non-replay) branch at attempt>0 for
+  // waitForCondition — without it the op is only ever covered at attempt=0, so a future SDK that
+  // indexed waitForCondition's StepDetails.Attempt differently from step's would slip through.
+  it('checkpoint plugin: waitForCondition reports operation_attempt=1 on its second poll', async () => {
+    const secondPollSpan = agent.assertSomeTraces(traces => {
+      const span = traces.flat().find(s =>
+        s.name === 'aws.durable.wait_for_condition' &&
+        s.resource === 'multi-poll-condition' &&
+        s.metrics?.['aws.durable.operation_attempt'] === 1
+      )
+      assert.ok(span, 'expected a second-poll waitForCondition span with operation_attempt=1')
+    }, { timeoutMs: 5000 })
+
+    let polls = 0
+    await invokeHandler(async (event, ctx) => {
+      await ctx.waitForCondition('multi-poll-condition', async () => 'done', {
+        initialState: 'pending',
+        waitStrategy: () => ({ shouldContinue: polls++ < 1, delay: { seconds: 1 } }),
+      })
+    })
+    assert.equal(polls, 2, 'expected the condition to be polled twice (initial + one retry)')
+
+    return secondPollSpan
+  })
+
   // Regression coverage for the SDK "safe paths" the trace-checkpoint hook relies on
   // (see packages/datadog-plugin-aws-durable-execution-sdk-js/src/trace-checkpoint.js).
   // These exercise the real @aws/durable-execution-sdk-js + @aws/durable-execution-sdk-js-testing

From a6e0a6226dc3f8613b338c2e937b60a5b09772ef Mon Sep 17 00:00:00 2001
From: Pablo Erhard <104538390+pabloerhard@users.noreply.github.com>
Date: Tue, 30 Jun 2026 15:12:18 -0600
Subject: [PATCH 30/51] chore(release): add v6 into release workflows (#9103)

* chore(release): add v6 into release workflows

* fix(sts): add v6 into job_workflow_ref
---
 .github/chainguard/self.github.release.push-tags.sts.yaml | 4 ++--
 .github/workflows/release.yml                             | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/chainguard/self.github.release.push-tags.sts.yaml b/.github/chainguard/self.github.release.push-tags.sts.yaml
index c69957e33c..4394bc806e 100644
--- a/.github/chainguard/self.github.release.push-tags.sts.yaml
+++ b/.github/chainguard/self.github.release.push-tags.sts.yaml
@@ -4,9 +4,9 @@ subject: repo:DataDog/dd-trace-js:environment:npm
 
 claim_pattern:
   event_name: (push|workflow_dispatch)
-  ref: refs/heads/(v[345]\.x|master)
+  ref: refs/heads/(v[3456]\.x|master)
   repository: DataDog/dd-trace-js
-  job_workflow_ref: DataDog/dd-trace-js/\.github/workflows/release\.yml@refs/heads/(v[345]\.x|master)
+  job_workflow_ref: DataDog/dd-trace-js/\.github/workflows/release\.yml@refs/heads/(v[3456]\.x|master)
 
 permissions:
   contents: write
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 414ef18549..4f3e2ee69a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,6 +6,7 @@ on:
       - v3.x
       - v4.x
       - v5.x
+      - v6.x
   workflow_dispatch:
 
 concurrency:
@@ -24,6 +25,7 @@ jobs:
         v3.x latest-node14
         v4.x latest-node16
         v5.x latest-node18
+        v6.x latest-node22
     outputs:
       npm_tag: ${{ steps.compute.outputs.npm_tag }}
       is_latest: ${{ steps.compute.outputs.is_latest }}

From 396642a0625db501e61a56744a41013ab30342d7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Jul 2026 01:16:04 +0000
Subject: [PATCH 31/51] chore(deps): bump bullmq (#9164)

Bumps the cloud-and-messaging group with 1 update in the /packages/dd-trace/test/plugins/versions directory: [bullmq](https://github.com/taskforcesh/bullmq).


Updates `bullmq` from 5.79.1 to 5.79.2
- [Release notes](https://github.com/taskforcesh/bullmq/releases)
- [Commits](https://github.com/taskforcesh/bullmq/compare/v5.79.1...v5.79.2)

---
updated-dependencies:
- dependency-name: bullmq
  dependency-version: 5.79.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cloud-and-messaging
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 packages/dd-trace/test/plugins/versions/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/dd-trace/test/plugins/versions/package.json b/packages/dd-trace/test/plugins/versions/package.json
index eb3f489850..558849c270 100644
--- a/packages/dd-trace/test/plugins/versions/package.json
+++ b/packages/dd-trace/test/plugins/versions/package.json
@@ -105,7 +105,7 @@
     "bluebird": "3.7.2",
     "body-parser": "2.2.2",
     "bson": "7.2.0",
-    "bullmq": "5.79.1",
+    "bullmq": "5.79.2",
     "bunyan": "2.0.5",
     "cassandra-driver": "4.9.0",
     "collections": "5.1.13",

From 0ba18d129f4f44e3bc42d49b13f5fa8f5c40ec06 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Jul 2026 01:18:18 +0000
Subject: [PATCH 32/51] chore(deps): bump the gh-actions-packages group across
 3 directories with 3 updates (#9166)

Bumps the gh-actions-packages group with 3 updates in the / directory: [raven-actions/actionlint](https://github.com/raven-actions/actionlint), [actions/cache](https://github.com/actions/cache) and [actions/setup-python](https://github.com/actions/setup-python).
Bumps the gh-actions-packages group with 1 update in the /.github/actions/install/branch-diff directory: [actions/cache](https://github.com/actions/cache).
Bumps the gh-actions-packages group with 3 updates in the /.github/workflows directory: [raven-actions/actionlint](https://github.com/raven-actions/actionlint), [actions/cache](https://github.com/actions/cache) and [actions/setup-python](https://github.com/actions/setup-python).


Updates `raven-actions/actionlint` from 2.1.2 to 2.2.0
- [Release notes](https://github.com/raven-actions/actionlint/releases)
- [Commits](https://github.com/raven-actions/actionlint/compare/205b530c5d9fa8f44ae9ed59f341a0db994aa6f8...3d39aea434753780c3b3d4a1a31c854b4dbf49d7)

Updates `actions/cache` from 5.0.5 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9)

Updates `actions/setup-python` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61a1)

Updates `actions/cache` from 5.0.5 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9)

Updates `raven-actions/actionlint` from 2.1.2 to 2.2.0
- [Release notes](https://github.com/raven-actions/actionlint/releases)
- [Commits](https://github.com/raven-actions/actionlint/compare/205b530c5d9fa8f44ae9ed59f341a0db994aa6f8...3d39aea434753780c3b3d4a1a31c854b4dbf49d7)

Updates `actions/cache` from 5.0.5 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9)

Updates `actions/setup-python` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61a1)

---
updated-dependencies:
- dependency-name: raven-actions/actionlint
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gh-actions-packages
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gh-actions-packages
- dependency-name: actions/setup-python
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gh-actions-packages
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gh-actions-packages
- dependency-name: raven-actions/actionlint
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gh-actions-packages
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gh-actions-packages
- dependency-name: actions/setup-python
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gh-actions-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/actions/install/branch-diff/action.yml | 2 +-
 .github/workflows/project.yml                  | 2 +-
 .github/workflows/test-optimization.yml        | 4 ++--
 .github/workflows/update-3rdparty-licenses.yml | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/actions/install/branch-diff/action.yml b/.github/actions/install/branch-diff/action.yml
index 1827f26d95..aafe85501e 100644
--- a/.github/actions/install/branch-diff/action.yml
+++ b/.github/actions/install/branch-diff/action.yml
@@ -7,7 +7,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.npm
         key: ${{ github.workflow }}-branch-diff-3.1.1
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index 78835dc521..8ed66a7db3 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -19,7 +19,7 @@ jobs:
       - uses: ./.github/actions/node/latest
       - name: actionlint
         id: actionlint
-        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2.1.2
+        uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
         with:
           matcher: true
           fail-on-error: true
diff --git a/.github/workflows/test-optimization.yml b/.github/workflows/test-optimization.yml
index 6be2dc0107..ec7bcb0bfe 100644
--- a/.github/workflows/test-optimization.yml
+++ b/.github/workflows/test-optimization.yml
@@ -60,7 +60,7 @@ jobs:
           echo "version=$PLAYWRIGHT_VERSION" >> $GITHUB_OUTPUT
           echo "Playwright version: $PLAYWRIGHT_VERSION"
       - name: Cache Playwright browsers
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/ms-playwright
           key: playwright-browsers-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}
@@ -413,7 +413,7 @@ jobs:
           fi
           echo "resolved=$RESOLVED" >> $GITHUB_OUTPUT
       - name: Cache Cypress binary
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/Cypress
           key: cypress-binary-${{ steps.cypress-version.outputs.resolved }}
diff --git a/.github/workflows/update-3rdparty-licenses.yml b/.github/workflows/update-3rdparty-licenses.yml
index 5623dfa5b2..cf49b8cb10 100644
--- a/.github/workflows/update-3rdparty-licenses.yml
+++ b/.github/workflows/update-3rdparty-licenses.yml
@@ -23,7 +23,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.14"
 

From 4235b4b1ab4ebf06e8db54f26c5c3903b532db47 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Antonio=20Fern=C3=A1ndez=20de=20Alba?=
 <juan.fernandezdealba@datadoghq.com>
Date: Wed, 1 Jul 2026 12:30:14 +0200
Subject: [PATCH 33/51] fix(vitest): route thread workers through main process
 (#9169)

---
 .../run-tinypool-with-vitest-env.mjs          |  19 +++
 .../ci-visibility/tinypool-app/worker.js      |   8 +
 .../vitest/vitest.advanced.spec.js            |  19 +++
 integration-tests/vitest/vitest.core.spec.js  |  68 ++++-----
 .../datadog-instrumentations/src/vitest.js    | 137 ++++++++++++++----
 .../exporters/test-worker/writer.js           |  17 +++
 .../exporters/test-worker/exporter.spec.js    |  20 +++
 7 files changed, 227 insertions(+), 61 deletions(-)
 create mode 100644 integration-tests/ci-visibility/run-tinypool-with-vitest-env.mjs
 create mode 100644 integration-tests/ci-visibility/tinypool-app/worker.js

diff --git a/integration-tests/ci-visibility/run-tinypool-with-vitest-env.mjs b/integration-tests/ci-visibility/run-tinypool-with-vitest-env.mjs
new file mode 100644
index 0000000000..cadebb61c7
--- /dev/null
+++ b/integration-tests/ci-visibility/run-tinypool-with-vitest-env.mjs
@@ -0,0 +1,19 @@
+import Tinypool from 'tinypool'
+
+const pool = new Tinypool({
+  filename: new URL('./tinypool-app/worker.js', import.meta.url).href,
+  env: {
+    ...process.env,
+    VITEST: 'true',
+  },
+})
+
+const result = await pool.run({ a: 4, b: 6 })
+// eslint-disable-next-line no-console
+console.log('result', result.sum)
+// eslint-disable-next-line no-console
+console.log('dd vitest worker', result.ddVitestWorker)
+
+// Make sure to destroy pool once it's not needed anymore
+// This terminates all pool's idle workers
+await pool.destroy()
diff --git a/integration-tests/ci-visibility/tinypool-app/worker.js b/integration-tests/ci-visibility/tinypool-app/worker.js
new file mode 100644
index 0000000000..b760739d25
--- /dev/null
+++ b/integration-tests/ci-visibility/tinypool-app/worker.js
@@ -0,0 +1,8 @@
+'use strict'
+
+module.exports = ({ a, b }) => {
+  return {
+    sum: a + b,
+    ddVitestWorker: process.env.DD_VITEST_WORKER,
+  }
+}
diff --git a/integration-tests/vitest/vitest.advanced.spec.js b/integration-tests/vitest/vitest.advanced.spec.js
index ab42de1c6d..9a5768aeff 100644
--- a/integration-tests/vitest/vitest.advanced.spec.js
+++ b/integration-tests/vitest/vitest.advanced.spec.js
@@ -315,6 +315,25 @@ versions.forEach((version) => {
       })
     })
 
+    it('does not mark application tinypool workers as Vitest workers', (done) => {
+      childProcess = exec('node ./ci-visibility/run-tinypool-with-vitest-env.mjs', {
+        cwd,
+        env: getCiVisAgentlessConfig(receiver.port),
+      })
+      childProcess.stdout?.on('data', (chunk) => {
+        testOutput += chunk.toString()
+      })
+      childProcess.stderr?.on('data', (chunk) => {
+        testOutput += chunk.toString()
+      })
+      childProcess.on('exit', (code) => {
+        assert.match(testOutput, /result 10/)
+        assert.match(testOutput, /dd vitest worker undefined/)
+        assert.strictEqual(code, 0)
+        done()
+      })
+    })
+
     context('programmatic api', () => {
       it('can report data using the vitest programmatic api', async () => {
         const eventsPromise = receiver
diff --git a/integration-tests/vitest/vitest.core.spec.js b/integration-tests/vitest/vitest.core.spec.js
index c952f1ce81..6e09ddae53 100644
--- a/integration-tests/vitest/vitest.core.spec.js
+++ b/integration-tests/vitest/vitest.core.spec.js
@@ -231,19 +231,13 @@ versions.forEach((version) => {
             )
 
             testEvents.forEach(test => {
-              // `threads` config will report directly. TODO: update this once we're testing vitest@>=4
-              if (poolConfig === 'forks') {
-                assert.strictEqual(test.content.meta[TEST_IS_TEST_FRAMEWORK_WORKER], 'true')
-              }
+              assert.strictEqual(test.content.meta[TEST_IS_TEST_FRAMEWORK_WORKER], 'true')
               assert.ok(test.content.metrics[DD_HOST_CPU_COUNT])
               assert.strictEqual(test.content.meta[DD_TEST_IS_USER_PROVIDED_SERVICE], 'false')
             })
 
             testSuiteEvents.forEach(testSuite => {
-              // `threads` config will report directly. TODO: update this once we're testing vitest@>=4
-              if (poolConfig === 'forks') {
-                assert.strictEqual(testSuite.content.meta[TEST_IS_TEST_FRAMEWORK_WORKER], 'true')
-              }
+              assert.strictEqual(testSuite.content.meta[TEST_IS_TEST_FRAMEWORK_WORKER], 'true')
               assert.strictEqual(
                 testSuite.content.meta[TEST_SOURCE_FILE].startsWith('ci-visibility/vitest-tests/test-visibility'),
                 true
@@ -256,38 +250,40 @@ versions.forEach((version) => {
       })
     })
 
-    newerVitestIt('sets DD_VITEST_WORKER in workers with pool=forks', async () => {
-      const eventsPromise = receiver
-        .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
-          const events = payloads.flatMap(({ payload }) => payload.events)
-          const test = events.find(event => event.type === 'test').content
+    for (const workerPoolConfig of poolConfig) {
+      it(`sets DD_VITEST_WORKER in workers with pool=${workerPoolConfig}`, async () => {
+        const eventsPromise = receiver
+          .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
+            const events = payloads.flatMap(({ payload }) => payload.events)
+            const test = events.find(event => event.type === 'test').content
 
-          assert.ok(test)
-          assert.strictEqual(test.meta[TEST_NAME], 'vitest worker env sets DD_VITEST_WORKER')
-          assert.strictEqual(test.meta[TEST_STATUS], 'pass')
-        }, 25000)
+            assert.ok(test)
+            assert.strictEqual(test.meta[TEST_NAME], 'vitest worker env sets DD_VITEST_WORKER')
+            assert.strictEqual(test.meta[TEST_STATUS], 'pass')
+          }, 25000)
 
-      childProcess = exec(
-        './node_modules/.bin/vitest run',
-        {
-          cwd,
-          env: {
-            ...getCiVisAgentlessConfig(receiver.port),
-            NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
-            TEST_DIR: 'ci-visibility/vitest-tests/vitest-worker-env.mjs',
-            POOL_CONFIG: 'forks',
-            DD_SERVICE: undefined,
-          },
-        }
-      )
+        childProcess = exec(
+          './node_modules/.bin/vitest run',
+          {
+            cwd,
+            env: {
+              ...getCiVisAgentlessConfig(receiver.port),
+              NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
+              TEST_DIR: 'ci-visibility/vitest-tests/vitest-worker-env.mjs',
+              POOL_CONFIG: workerPoolConfig,
+              DD_SERVICE: undefined,
+            },
+          }
+        )
 
-      const [[code]] = await Promise.all([
-        once(childProcess, 'exit'),
-        eventsPromise,
-      ])
+        const [[code]] = await Promise.all([
+          once(childProcess, 'exit'),
+          eventsPromise,
+        ])
 
-      assert.strictEqual(code, 0)
-    })
+        assert.strictEqual(code, 0)
+      })
+    }
 
     newerVitestIt('sets DD_VITEST_WORKER in workers when a fork project has a threads root pool', async () => {
       const eventsPromise = receiver
diff --git a/packages/datadog-instrumentations/src/vitest.js b/packages/datadog-instrumentations/src/vitest.js
index b594a81fbb..8b35673ebe 100644
--- a/packages/datadog-instrumentations/src/vitest.js
+++ b/packages/datadog-instrumentations/src/vitest.js
@@ -5,6 +5,8 @@ const realSetTimeout = setTimeout
 
 const path = require('node:path')
 const { performance } = require('node:perf_hooks')
+const { fileURLToPath } = require('node:url')
+const { MessagePort } = require('node:worker_threads')
 
 const shimmer = require('../../datadog-shimmer')
 const log = require('../../dd-trace/src/log')
@@ -98,6 +100,8 @@ let testCodeCoverageLinesTotal
 let coverageRootDir
 let isSessionStarted = false
 let vitestPool = null
+let isMessagePortWrapped = false
+const tinyPoolClassWrappers = new WeakMap()
 
 const BREAKPOINT_HIT_GRACE_PERIOD_MS = 400
 
@@ -913,6 +917,10 @@ function isThreadPool (pool) {
   return pool === 'threads' || pool === 'vmThreads'
 }
 
+function isVitestWorkerPool (pool) {
+  return isForkPool(pool) || isThreadPool(pool)
+}
+
 /**
  * Return the project object attached to a Vitest test specification.
  *
@@ -931,13 +939,13 @@ function getTestSpecificationPool (testSpecification) {
   return project?.config?.pool || project?.serializedConfig?.pool || project?.pool || testSpecification?.pool
 }
 
-function hasForkPoolTestSpecification (testSpecifications) {
+function hasVitestWorkerPoolTestSpecification (testSpecifications) {
   if (!Array.isArray(testSpecifications)) {
     return false
   }
 
   for (const testSpecification of testSpecifications) {
-    if (isForkPool(getTestSpecificationPool(testSpecification))) {
+    if (isVitestWorkerPool(getTestSpecificationPool(testSpecification))) {
       return true
     }
   }
@@ -946,8 +954,8 @@ function hasForkPoolTestSpecification (testSpecifications) {
 }
 
 function shouldMarkVitestWorkerEnv (pool, testSpecifications) {
-  return isForkPool(pool) || hasForkPoolTestSpecification(testSpecifications) ||
-    (!testSpecifications && !isThreadPool(pool))
+  return isVitestWorkerPool(pool) || hasVitestWorkerPoolTestSpecification(testSpecifications) ||
+    (!testSpecifications && pool === undefined)
 }
 
 function markVitestWorkerEnv (ctx, testSpecifications) {
@@ -1011,20 +1019,41 @@ function threadHandler (thread) {
   workerProcesses.add(workerProcess)
   workerProcess.on('message', (message) => {
     if (message.__tinypool_worker_message__ && message.data) {
-      if (message.interprocessCode === VITEST_WORKER_TRACE_PAYLOAD_CODE) {
-        collectTestOptimizationSummariesFromTraces(message.data, {
-          newTestsWithDynamicNames,
-          attemptToFixExecutions,
-        })
-        workerReportTraceCh.publish(message.data)
-      } else if (message.interprocessCode === VITEST_WORKER_LOGS_PAYLOAD_CODE) {
-        workerReportLogsCh.publish(message.data)
-      }
+      handleWorkerReport(message.interprocessCode, message.data)
     }
   })
 }
 
+function isVitestTinypoolOptions (options) {
+  if (options?.env?.VITEST !== 'true' || typeof options.filename !== 'string') return false
+
+  let filename = options.filename
+  if (filename.startsWith('file:')) {
+    try {
+      filename = fileURLToPath(filename)
+    } catch {
+      return false
+    }
+  }
+
+  const workerPath = path.normalize(filename)
+  const workerDir = path.dirname(workerPath)
+  const packageDir = path.dirname(workerDir)
+
+  return path.basename(workerPath) === 'worker.js' &&
+    path.basename(workerDir) === 'dist' &&
+    path.basename(packageDir) === 'vitest'
+}
+
+function markVitestTinypoolOptions (options) {
+  if (!isVitestTinypoolOptions(options)) return
+
+  options.env.DD_VITEST_WORKER = '1'
+}
+
 function wrapTinyPoolRun (TinyPool) {
+  if (!TinyPool?.prototype?.run) return
+
   shimmer.wrap(TinyPool.prototype, 'run', run => async function () {
     // We have to do this before and after because the threads list gets recycled, that is, the processes are re-created
     // eslint-disable-next-line unicorn/no-array-for-each
@@ -1036,13 +1065,51 @@ function wrapTinyPoolRun (TinyPool) {
   })
 }
 
+function wrapTinyPoolClass (TinyPool) {
+  if (typeof TinyPool !== 'function') return TinyPool
+
+  const wrappedTinyPool = tinyPoolClassWrappers.get(TinyPool)
+  if (wrappedTinyPool) return wrappedTinyPool
+
+  class DatadogTinyPool extends TinyPool {
+    constructor (options) {
+      markVitestTinypoolOptions(options)
+      super(options)
+    }
+  }
+
+  tinyPoolClassWrappers.set(TinyPool, DatadogTinyPool)
+  wrapTinyPoolRun(DatadogTinyPool)
+
+  return DatadogTinyPool
+}
+
+function wrapTinyPool (TinyPool) {
+  if (typeof TinyPool === 'function') {
+    return wrapTinyPoolClass(TinyPool)
+  }
+
+  const defaultTinyPool = wrapTinyPoolClass(TinyPool?.default)
+  if (defaultTinyPool) {
+    TinyPool.default = defaultTinyPool
+  }
+
+  const namedTinyPool = TinyPool?.Tinypool === TinyPool?.default
+    ? defaultTinyPool
+    : wrapTinyPoolClass(TinyPool?.Tinypool)
+  if (namedTinyPool) {
+    TinyPool.Tinypool = namedTinyPool
+  }
+
+  return TinyPool
+}
+
 addHook({
   name: 'tinypool',
   // version from tinypool@0.8 was used in vitest@1.6.0
   versions: ['>=0.8.0'],
 }, (TinyPool) => {
-  wrapTinyPoolRun(TinyPool)
-  return TinyPool
+  return wrapTinyPool(TinyPool)
 })
 
 function getWrappedOn (on) {
@@ -1056,17 +1123,10 @@ function getWrappedOn (on) {
     arguments[1] = shimmer.wrapFunction(callback, callback => function (message) {
       if (message.type !== 'Buffer' && Array.isArray(message)) {
         const [interprocessCode, data] = message
-        if (interprocessCode === VITEST_WORKER_TRACE_PAYLOAD_CODE) {
-          collectTestOptimizationSummariesFromTraces(data, {
-            newTestsWithDynamicNames,
-            attemptToFixExecutions,
-          })
-          workerReportTraceCh.publish(data)
-        } else if (interprocessCode === VITEST_WORKER_LOGS_PAYLOAD_CODE) {
-          workerReportLogsCh.publish(data)
+        if (handleWorkerReport(interprocessCode, data)) {
+          // If we execute the callback vitest crashes, as the message is not supported
+          return
         }
-        // If we execute the callback vitest crashes, as the message is not supported
-        return
       }
       return callback.apply(this, arguments)
     })
@@ -1074,12 +1134,39 @@ function getWrappedOn (on) {
   }
 }
 
+function handleWorkerReport (interprocessCode, data) {
+  if (interprocessCode === VITEST_WORKER_TRACE_PAYLOAD_CODE) {
+    collectTestOptimizationSummariesFromTraces(data, {
+      newTestsWithDynamicNames,
+      attemptToFixExecutions,
+    })
+    workerReportTraceCh.publish(data)
+    return true
+  }
+
+  if (interprocessCode === VITEST_WORKER_LOGS_PAYLOAD_CODE) {
+    workerReportLogsCh.publish(data)
+    return true
+  }
+
+  return false
+}
+
+function wrapMessagePortOn () {
+  if (isMessagePortWrapped) return
+
+  isMessagePortWrapped = true
+  shimmer.wrap(MessagePort.prototype, 'on', getWrappedOn)
+  shimmer.wrap(MessagePort.prototype, 'addListener', getWrappedOn)
+}
+
 function getStartVitestWrapper (cliApiPackage, frameworkVersion) {
   if (!isCliApiPackage(cliApiPackage)) {
     return cliApiPackage
   }
   const startVitestExport = findExportByName(cliApiPackage, 'startVitest')
   shimmer.wrap(cliApiPackage, startVitestExport.key, getCliOrStartVitestWrapper(frameworkVersion))
+  wrapMessagePortOn()
 
   const vitest = getVitestExport(cliApiPackage)
   if (vitest) {
diff --git a/packages/dd-trace/src/ci-visibility/exporters/test-worker/writer.js b/packages/dd-trace/src/ci-visibility/exporters/test-worker/writer.js
index af364020cd..fb48f570d1 100644
--- a/packages/dd-trace/src/ci-visibility/exporters/test-worker/writer.js
+++ b/packages/dd-trace/src/ci-visibility/exporters/test-worker/writer.js
@@ -3,6 +3,11 @@ const { JSONEncoder } = require('../../encode/json-encoder')
 const { getEnvironmentVariable } = require('../../../config/helper')
 const log = require('../../../log')
 
+function getVitestWorkerPort () {
+  const port = globalThis.__vitest_worker__?.ctx?.port
+  return typeof port?.postMessage === 'function' ? port : undefined
+}
+
 class Writer {
   constructor (interprocessCode) {
     this._encoder = new JSONEncoder()
@@ -37,6 +42,18 @@ class Writer {
       ? { __tinypool_worker_message__: true, interprocessCode: this._interprocessCode, data }
       : [this._interprocessCode, data]
 
+    const vitestWorkerPort = getVitestWorkerPort()
+    if (vitestWorkerPort) {
+      try {
+        vitestWorkerPort.postMessage(payload)
+      } catch (error) {
+        log.error('Error posting message to vitest worker port', error)
+      } finally {
+        onDone()
+      }
+      return
+    }
+
     // child_process workers (jest default, cucumber)
     if (process.send) {
       process.send(payload, () => {
diff --git a/packages/dd-trace/test/ci-visibility/exporters/test-worker/exporter.spec.js b/packages/dd-trace/test/ci-visibility/exporters/test-worker/exporter.spec.js
index 4968b37469..783e5b3926 100644
--- a/packages/dd-trace/test/ci-visibility/exporters/test-worker/exporter.spec.js
+++ b/packages/dd-trace/test/ci-visibility/exporters/test-worker/exporter.spec.js
@@ -160,6 +160,7 @@ describe('CI Visibility Test Worker Exporter', () => {
     afterEach(() => {
       delete process.env.DD_VITEST_WORKER
       delete process.env.TINYPOOL_WORKER_ID
+      delete globalThis.__vitest_worker__
     })
 
     it('can export traces (vitest >=4)', () => {
@@ -186,6 +187,25 @@ describe('CI Visibility Test Worker Exporter', () => {
       })
     })
 
+    it('can export traces through the worker port in legacy thread workers (vitest <4)', () => {
+      process.env.DD_VITEST_WORKER = '1'
+      delete process.send
+      const postMessage = sinon.spy()
+      const trace = [{ type: 'test' }]
+      globalThis.__vitest_worker__ = {
+        ctx: {
+          port: {
+            postMessage,
+          },
+        },
+      }
+      const vitestWorkerExporter = new TestWorkerCiVisibilityExporter()
+      vitestWorkerExporter.export(trace)
+      vitestWorkerExporter.flush()
+      sinon.assert.calledWith(postMessage, [VITEST_WORKER_TRACE_PAYLOAD_CODE, JSON.stringify([trace])])
+      sinon.assert.notCalled(send)
+    })
+
     it('does not break if process.send is undefined', () => {
       process.env.DD_VITEST_WORKER = '1'
       delete process.send

From b895093baeb5d5d8feff8cff98b26be710ceaa3f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Antonio=20Fern=C3=A1ndez=20de=20Alba?=
 <juan.fernandezdealba@datadoghq.com>
Date: Wed, 1 Jul 2026 12:46:26 +0200
Subject: [PATCH 34/51] refactor(vitest): split main and worker instrumentation
 (#9170)

---
 .../src/vitest-main.js                        |  904 ++++++++
 .../src/vitest-util.js                        |  225 ++
 .../src/vitest-worker.js                      |  788 +++++++
 .../datadog-instrumentations/src/vitest.js    | 1949 +----------------
 4 files changed, 1922 insertions(+), 1944 deletions(-)
 create mode 100644 packages/datadog-instrumentations/src/vitest-main.js
 create mode 100644 packages/datadog-instrumentations/src/vitest-util.js
 create mode 100644 packages/datadog-instrumentations/src/vitest-worker.js

diff --git a/packages/datadog-instrumentations/src/vitest-main.js b/packages/datadog-instrumentations/src/vitest-main.js
new file mode 100644
index 0000000000..4299b46f0a
--- /dev/null
+++ b/packages/datadog-instrumentations/src/vitest-main.js
@@ -0,0 +1,904 @@
+'use strict'
+
+const path = require('node:path')
+const { fileURLToPath } = require('node:url')
+const { MessagePort } = require('node:worker_threads')
+
+const shimmer = require('../../datadog-shimmer')
+const log = require('../../dd-trace/src/log')
+const {
+  VITEST_WORKER_TRACE_PAYLOAD_CODE,
+  VITEST_WORKER_LOGS_PAYLOAD_CODE,
+  getMaxEfdRetryCount,
+  collectTestOptimizationSummariesFromTraces,
+  logTestOptimizationSummary,
+  getTestOptimizationRequestResults,
+} = require('../../dd-trace/src/plugins/util/test')
+const { addHook } = require('./helpers/instrument')
+const {
+  testSessionStartCh,
+  testSessionFinishCh,
+  testSessionConfigurationCh,
+  libraryConfigurationCh,
+  knownTestsCh,
+  isEarlyFlakeDetectionFaultyCh,
+  testManagementTestsCh,
+  modifiedFilesCh,
+  workerReportTraceCh,
+  workerReportLogsCh,
+  codeCoverageReportCh,
+  findExportByName,
+  getChannelPromise,
+  getWorkspaceProject,
+  setProvidedContext,
+} = require('./vitest-util')
+
+const newTestsWithDynamicNames = new Set()
+const attemptToFixExecutions = new Map()
+const workerProcesses = new WeakSet()
+const mainProcessSetupPromises = new WeakMap()
+const coverageWrappedProviders = new WeakSet()
+const finishWrappedContexts = new WeakSet()
+let isFlakyTestRetriesEnabled = false
+let flakyTestRetriesCount = 0
+let isEarlyFlakeDetectionEnabled = false
+let earlyFlakeDetectionNumRetries = 0
+let earlyFlakeDetectionSlowTestRetries = {}
+let isEarlyFlakeDetectionFaulty = false
+let isKnownTestsEnabled = false
+let isTestManagementTestsEnabled = false
+let isImpactedTestsEnabled = false
+let testManagementAttemptToFixRetries = 0
+let isDiEnabled = false
+let testCodeCoverageLinesTotal
+let coverageRootDir
+let isSessionStarted = false
+let vitestPool = null
+let isMessagePortWrapped = false
+const tinyPoolClassWrappers = new WeakMap()
+
+function getConfiguredEfdRetryCount (slowTestRetries, fallbackRetryCount) {
+  if (!slowTestRetries || !Object.keys(slowTestRetries).length) {
+    return fallbackRetryCount
+  }
+  return getMaxEfdRetryCount(slowTestRetries)
+}
+
+function getTestCommand () {
+  return `vitest ${process.argv.slice(2).join(' ')}`
+}
+
+function isValidKnownTests (receivedKnownTests) {
+  return !!receivedKnownTests.vitest
+}
+
+function isReporterPackage (vitestPackage) {
+  return vitestPackage.B?.name === 'BaseSequencer'
+}
+
+function isReporterPackageNew (vitestPackage) {
+  return vitestPackage.e?.name === 'BaseSequencer'
+}
+
+function isReporterPackageNewest (vitestPackage) {
+  return vitestPackage.h?.name === 'BaseSequencer'
+}
+
+function getBaseSequencerExport (vitestPackage) {
+  return findExportByName(vitestPackage, 'BaseSequencer')
+}
+
+function isCliApiPackage (vitestPackage) {
+  return !!findExportByName(vitestPackage, 'startVitest')
+}
+
+function getVitestExport (vitestPackage) {
+  return findExportByName(vitestPackage, 'Vitest')
+}
+
+function getForksPoolWorkerExport (vitestPackage) {
+  return findExportByName(vitestPackage, 'ForksPoolWorker')
+}
+
+function getThreadsPoolWorkerExport (vitestPackage) {
+  return findExportByName(vitestPackage, 'ThreadsPoolWorker')
+}
+
+function getSessionStatus (state) {
+  if (state.getCountOfFailedTests() > 0) {
+    return 'fail'
+  }
+  if (state.pathsSet.size === 0) {
+    return 'skip'
+  }
+  return 'pass'
+}
+
+function getTestFilepathsFromSpecifications (testSpecifications) {
+  if (!Array.isArray(testSpecifications) || !testSpecifications.length) {
+    return
+  }
+
+  return testSpecifications.map(testSpecification => {
+    const testFile = Array.isArray(testSpecification) ? testSpecification[1] : testSpecification
+    return testFile?.moduleId || testFile?.filepath || testFile
+  })
+}
+
+function getTestFilepaths (ctx, testSpecifications) {
+  const testFilepaths = getTestFilepathsFromSpecifications(testSpecifications)
+  if (testFilepaths) {
+    return testFilepaths
+  }
+
+  const getFilePaths = ctx.getTestFilepaths || ctx._globTestFilepaths
+  return getFilePaths.call(ctx)
+}
+
+function wrapCoverageProvider (ctx) {
+  const { coverageProvider } = ctx
+  if (!coverageProvider?.generateCoverage || coverageWrappedProviders.has(coverageProvider)) {
+    return
+  }
+  coverageWrappedProviders.add(coverageProvider)
+
+  // Capture coverage root directory from config (default is 'coverage' in cwd)
+  try {
+    const coverageConfig = ctx.config?.coverage
+    const reportsDirectory = coverageConfig?.reportsDirectory || 'coverage'
+    const rootDir = ctx.config?.root || process.cwd()
+    coverageRootDir = path.isAbsolute(reportsDirectory) ? reportsDirectory : path.join(rootDir, reportsDirectory)
+  } catch {
+    // Fallback to cwd if we can't get config
+    coverageRootDir = process.cwd()
+  }
+
+  shimmer.wrap(coverageProvider, 'generateCoverage', generateCoverage => async function () {
+    const totalCodeCoverage = await generateCoverage.apply(this, arguments)
+
+    try {
+      testCodeCoverageLinesTotal = totalCodeCoverage.getCoverageSummary().lines.pct
+    } catch {
+      // ignore errors
+    }
+    return totalCodeCoverage
+  })
+}
+
+function wrapSessionFinish (ctx) {
+  if (finishWrappedContexts.has(ctx)) {
+    return
+  }
+  finishWrappedContexts.add(ctx)
+
+  shimmer.wrap(ctx, 'exit', getFinishWrapper)
+  shimmer.wrap(ctx, 'close', getFinishWrapper)
+}
+
+async function runMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
+  if (!testSessionFinishCh.hasSubscribers) {
+    return
+  }
+
+  try {
+    const { err, libraryConfig } = await getChannelPromise(libraryConfigurationCh, frameworkVersion)
+    if (!err) {
+      isFlakyTestRetriesEnabled = libraryConfig.isFlakyTestRetriesEnabled
+      flakyTestRetriesCount = libraryConfig.flakyTestRetriesCount
+      isEarlyFlakeDetectionEnabled = libraryConfig.isEarlyFlakeDetectionEnabled
+      earlyFlakeDetectionNumRetries = libraryConfig.earlyFlakeDetectionNumRetries
+      earlyFlakeDetectionSlowTestRetries = libraryConfig.earlyFlakeDetectionSlowTestRetries ?? {}
+      isDiEnabled = libraryConfig.isDiEnabled
+      isKnownTestsEnabled = libraryConfig.isKnownTestsEnabled
+      isTestManagementTestsEnabled = libraryConfig.isTestManagementEnabled
+      testManagementAttemptToFixRetries = libraryConfig.testManagementAttemptToFixRetries
+      isImpactedTestsEnabled = libraryConfig.isImpactedTestsEnabled
+    }
+  } catch {
+    isFlakyTestRetriesEnabled = false
+    isEarlyFlakeDetectionEnabled = false
+    isDiEnabled = false
+    isKnownTestsEnabled = false
+    isImpactedTestsEnabled = false
+  }
+
+  if (testSessionConfigurationCh.hasSubscribers) {
+    const { testSessionId, testModuleId, testCommand, repositoryRoot, codeOwnersEntries } = await getChannelPromise(
+      testSessionConfigurationCh,
+      frameworkVersion
+    )
+    setProvidedContext(ctx, {
+      _ddTestSessionId: testSessionId,
+      _ddTestModuleId: testModuleId,
+      _ddTestCommand: testCommand,
+      _ddRepositoryRoot: repositoryRoot,
+      _ddCodeOwnersEntries: codeOwnersEntries,
+    }, 'Could not send test session configuration to workers.')
+  }
+
+  const {
+    knownTestsResponse,
+    testManagementTestsResponse,
+  } = await getTestOptimizationRequestResults({
+    isKnownTestsEnabled,
+    isTestManagementTestsEnabled,
+    getKnownTests: () => getChannelPromise(knownTestsCh),
+    getTestManagementTests: () => getChannelPromise(testManagementTestsCh),
+  })
+
+  const flakyTestRetriesConfiguration = configureFlakyTestRetries(ctx, testSpecifications)
+  if (flakyTestRetriesConfiguration) {
+    setProvidedContext(ctx, {
+      _ddIsFlakyTestRetriesEnabled: isFlakyTestRetriesEnabled,
+      _ddFlakyTestRetriesCount: flakyTestRetriesCount,
+      _ddFlakyTestRetriesIncludesUnnamedProject: flakyTestRetriesConfiguration.includesUnnamedProject,
+      _ddFlakyTestRetriesProjectNames: flakyTestRetriesConfiguration.projectNames,
+    }, 'Could not send library configuration to workers.')
+  }
+
+  if (isKnownTestsEnabled) {
+    const currentKnownTestsResponse = knownTestsResponse || await getChannelPromise(knownTestsCh)
+    if (currentKnownTestsResponse.err) {
+      isEarlyFlakeDetectionEnabled = false
+    } else {
+      const knownTests = currentKnownTestsResponse.knownTests
+      const testFilepaths = await getTestFilepaths(ctx, testSpecifications)
+
+      if (isValidKnownTests(knownTests)) {
+        isEarlyFlakeDetectionFaultyCh.publish({
+          knownTests: knownTests.vitest,
+          testFilepaths,
+          onDone: (isFaulty) => {
+            isEarlyFlakeDetectionFaulty = isFaulty
+          },
+        })
+        if (isEarlyFlakeDetectionFaulty) {
+          isEarlyFlakeDetectionEnabled = false
+          log.warn('New test detection is disabled because the number of new tests is too high.')
+        } else {
+          setProvidedContext(ctx, {
+            _ddIsKnownTestsEnabled: isKnownTestsEnabled,
+            _ddKnownTests: knownTests,
+            _ddIsEarlyFlakeDetectionEnabled: isEarlyFlakeDetectionEnabled,
+            _ddEarlyFlakeDetectionNumRetries:
+              getConfiguredEfdRetryCount(earlyFlakeDetectionSlowTestRetries, earlyFlakeDetectionNumRetries),
+            _ddEarlyFlakeDetectionSlowTestRetries: earlyFlakeDetectionSlowTestRetries,
+          }, 'Could not send known tests to workers so Early Flake Detection will not work.')
+        }
+      } else {
+        isEarlyFlakeDetectionFaulty = true
+        isEarlyFlakeDetectionEnabled = false
+      }
+    }
+  }
+
+  if (isDiEnabled) {
+    setProvidedContext(ctx, {
+      _ddIsDiEnabled: isDiEnabled,
+    }, 'Could not send Dynamic Instrumentation configuration to workers.')
+  }
+
+  if (isTestManagementTestsEnabled) {
+    const { err, testManagementTests: receivedTestManagementTests } =
+      testManagementTestsResponse || await getChannelPromise(testManagementTestsCh)
+    if (err) {
+      isTestManagementTestsEnabled = false
+      log.error('Could not get test management tests.')
+    } else {
+      setProvidedContext(ctx, {
+        _ddIsTestManagementTestsEnabled: isTestManagementTestsEnabled,
+        _ddTestManagementAttemptToFixRetries: testManagementAttemptToFixRetries,
+        _ddTestManagementTests: receivedTestManagementTests,
+      }, 'Could not send test management tests to workers so Test Management will not work.')
+    }
+  }
+
+  if (isImpactedTestsEnabled) {
+    const { err, modifiedFiles } = await getChannelPromise(modifiedFilesCh)
+    if (err) {
+      log.error('Could not get modified tests.')
+    } else {
+      setProvidedContext(ctx, {
+        _ddIsImpactedTestsEnabled: isImpactedTestsEnabled,
+        _ddModifiedFiles: modifiedFiles,
+      }, 'Could not send modified tests to workers so Impacted Tests will not work.')
+    }
+  }
+
+  wrapCoverageProvider(ctx)
+  wrapSessionFinish(ctx)
+}
+
+function ensureMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
+  let setupPromise = mainProcessSetupPromises.get(ctx)
+  if (!setupPromise) {
+    setupPromise = runMainProcessSetup(ctx, frameworkVersion, testSpecifications)
+    mainProcessSetupPromises.set(ctx, setupPromise)
+  }
+  return setupPromise
+}
+
+function configureFlakyTestRetries (ctx, testSpecifications) {
+  if (!isFlakyTestRetriesEnabled || flakyTestRetriesCount <= 0) return
+
+  let configured = false
+  let includesUnnamedProject = false
+  const projectNames = []
+  for (const { config, projectName } of getVitestProjectConfigs(ctx, testSpecifications)) {
+    if (!config.retry) {
+      config.retry = flakyTestRetriesCount
+      configured = true
+      if (projectName) {
+        projectNames.push(projectName)
+      } else {
+        includesUnnamedProject = true
+      }
+    }
+  }
+
+  if (!configured) return
+
+  return {
+    includesUnnamedProject,
+    projectNames,
+  }
+}
+
+function getVitestProjectConfigs (ctx, testSpecifications) {
+  const entries = []
+
+  addTestSpecificationConfigs(entries, testSpecifications)
+  if (entries.length > 0) {
+    return entries
+  }
+
+  const selectedProjectNames = getSelectedProjectNames()
+  addSelectedInlineProjectConfigs(entries, safeConfig(ctx), selectedProjectNames)
+  addSelectedRuntimeProjectConfigs(entries, ctx?.projects, selectedProjectNames)
+  if (entries.length > 0) {
+    return entries
+  }
+
+  if (Array.isArray(ctx?.projects)) {
+    for (const project of ctx.projects) {
+      addConfig(entries, safeConfig(project), getProjectName(project))
+    }
+    if (entries.length > 0) {
+      return entries
+    }
+  }
+
+  addConfig(entries, safeConfig(ctx))
+  addConfig(entries, safeConfig(safeWorkspaceProject(ctx)))
+
+  return entries
+}
+
+function addTestSpecificationConfigs (entries, testSpecifications) {
+  if (!Array.isArray(testSpecifications)) return
+
+  for (const testSpecification of testSpecifications) {
+    const project = getTestSpecificationProject(testSpecification)
+    addConfig(entries, safeConfig(project), getProjectName(project))
+  }
+}
+
+function addSelectedInlineProjectConfigs (entries, rootConfig, selectedProjectNames) {
+  if (selectedProjectNames.length === 0 || !Array.isArray(rootConfig?.projects)) return
+
+  for (const project of rootConfig.projects) {
+    const config = getInlineProjectConfig(project)
+    const projectName = getProjectName(project)
+    if (selectedProjectNames.includes(projectName)) {
+      addConfig(entries, config, projectName)
+    }
+  }
+}
+
+function addSelectedRuntimeProjectConfigs (entries, projects, selectedProjectNames) {
+  if (selectedProjectNames.length === 0 || !Array.isArray(projects)) return
+
+  for (const project of projects) {
+    const projectName = getProjectName(project)
+    if (selectedProjectNames.includes(projectName)) {
+      addConfig(entries, safeConfig(project), projectName)
+    }
+  }
+}
+
+function getSelectedProjectNames () {
+  const names = []
+  for (let index = 0; index < process.argv.length; index++) {
+    const argument = process.argv[index]
+    if (argument === '--project' && process.argv[index + 1]) {
+      names.push(process.argv[index + 1])
+      index++
+    } else if (argument.startsWith('--project=')) {
+      names.push(argument.slice('--project='.length))
+    }
+  }
+  return names
+}
+
+function getInlineProjectConfig (project) {
+  return project?.test || project
+}
+
+function getProjectName (project) {
+  return normalizeProjectName(project?.name || project?.config?.name || project?.test?.name)
+}
+
+function normalizeProjectName (name) {
+  if (typeof name === 'string') return name
+
+  const label = name?.label
+  return typeof label === 'string' ? label : undefined
+}
+
+function addConfig (entries, config, projectName) {
+  if (config && !entries.some(entry => entry.config === config || (projectName && entry.projectName === projectName))) {
+    entries.push({ config, projectName })
+  }
+}
+
+function safeConfig (project) {
+  let config
+  try {
+    config = project?.config
+  } catch {}
+  return config
+}
+
+function safeWorkspaceProject (ctx) {
+  let project
+  try {
+    project = getWorkspaceProject(ctx)
+  } catch {}
+  return project
+}
+
+function getSortWrapper (sort, frameworkVersion) {
+  return async function () {
+    await ensureMainProcessSetup(this.ctx, frameworkVersion, arguments[0])
+    return sort.apply(this, arguments)
+  }
+}
+
+function getFinishWrapper (exitOrClose) {
+  let isClosed = false
+  return async function () {
+    if (isClosed) { // needed because exit calls close
+      return exitOrClose.apply(this, arguments)
+    }
+    isClosed = true
+
+    if (!testSessionFinishCh.hasSubscribers) {
+      return exitOrClose.apply(this, arguments)
+    }
+
+    let onFinish
+
+    const flushPromise = new Promise(resolve => {
+      onFinish = resolve
+    })
+    const failedSuites = this.state.getFailedFilepaths()
+    let error
+    if (failedSuites.length) {
+      error = new Error(`Test suites failed: ${failedSuites.length}.`)
+    }
+
+    testSessionFinishCh.publish({
+      status: getSessionStatus(this.state),
+      testCodeCoverageLinesTotal,
+      error,
+      isEarlyFlakeDetectionEnabled,
+      isEarlyFlakeDetectionFaulty,
+      isTestManagementTestsEnabled,
+      vitestPool,
+      onFinish,
+    })
+
+    logTestOptimizationSummary({ attemptToFixExecutions, newTestsWithDynamicNames })
+
+    await flushPromise
+
+    // If coverage was generated, publish coverage report channel for upload
+    if (coverageRootDir && codeCoverageReportCh.hasSubscribers) {
+      await new Promise((resolve) => {
+        codeCoverageReportCh.publish({ rootDir: coverageRootDir, onDone: resolve })
+      })
+    }
+
+    return exitOrClose.apply(this, arguments)
+  }
+}
+
+function getCliOrStartVitestWrapper (frameworkVersion) {
+  return function (oldCliOrStartVitest) {
+    return function (...args) {
+      if (!testSessionStartCh.hasSubscribers || isSessionStarted) {
+        return oldCliOrStartVitest.apply(this, args)
+      }
+      isSessionStarted = true
+      testSessionStartCh.publish({ command: getTestCommand(), frameworkVersion })
+      return oldCliOrStartVitest.apply(this, args)
+    }
+  }
+}
+
+function isForkPool (pool) {
+  return pool === 'forks' || pool === 'vmForks'
+}
+
+function isThreadPool (pool) {
+  return pool === 'threads' || pool === 'vmThreads'
+}
+
+function isVitestWorkerPool (pool) {
+  return isForkPool(pool) || isThreadPool(pool)
+}
+
+function getTestSpecificationProject (testSpecification) {
+  if (Array.isArray(testSpecification)) {
+    return testSpecification[0]
+  }
+  return testSpecification?.project
+}
+
+function getTestSpecificationPool (testSpecification) {
+  const project = getTestSpecificationProject(testSpecification)
+  return project?.config?.pool || project?.serializedConfig?.pool || project?.pool || testSpecification?.pool
+}
+
+function hasVitestWorkerPoolTestSpecification (testSpecifications) {
+  if (!Array.isArray(testSpecifications)) {
+    return false
+  }
+
+  for (const testSpecification of testSpecifications) {
+    if (isVitestWorkerPool(getTestSpecificationPool(testSpecification))) {
+      return true
+    }
+  }
+
+  return false
+}
+
+function shouldMarkVitestWorkerEnv (pool, testSpecifications) {
+  return isVitestWorkerPool(pool) || hasVitestWorkerPoolTestSpecification(testSpecifications) ||
+    (!testSpecifications && pool === undefined)
+}
+
+function markVitestWorkerEnv (ctx, testSpecifications) {
+  const config = ctx?.config
+  if (!config || !shouldMarkVitestWorkerEnv(config.pool, testSpecifications)) {
+    return
+  }
+  config.env = config.env || {}
+  config.env.DD_VITEST_WORKER = '1'
+}
+
+function wrapVitestRunFiles (Vitest, frameworkVersion) {
+  if (!Vitest?.prototype?.runFiles) {
+    return
+  }
+
+  shimmer.wrap(Vitest.prototype, 'runFiles', runFiles => async function (testSpecifications) {
+    markVitestWorkerEnv(this, testSpecifications)
+    await ensureMainProcessSetup(this, frameworkVersion, testSpecifications)
+    return runFiles.apply(this, arguments)
+  })
+
+  if (Vitest.prototype.collectTests) {
+    shimmer.wrap(Vitest.prototype, 'collectTests', collectTests => function () {
+      markVitestWorkerEnv(this)
+      return collectTests.apply(this, arguments)
+    })
+  }
+}
+
+function getCreateCliWrapper (vitestPackage, frameworkVersion) {
+  const createCliExport = findExportByName(vitestPackage, 'createCLI')
+  if (!createCliExport) {
+    return vitestPackage
+  }
+  shimmer.wrap(vitestPackage, createCliExport.key, getCliOrStartVitestWrapper(frameworkVersion))
+
+  return vitestPackage
+}
+
+function threadHandler (thread) {
+  const { runtime } = thread
+  let workerProcess
+  if (runtime === 'child_process') {
+    vitestPool = 'child_process'
+    workerProcess = thread.process
+  } else if (runtime === 'worker_threads') {
+    vitestPool = 'worker_threads'
+    workerProcess = thread.thread
+  } else {
+    vitestPool = 'unknown'
+  }
+  if (!workerProcess) {
+    log.error('Vitest error: could not get process or thread from TinyPool#run')
+    return
+  }
+
+  if (workerProcesses.has(workerProcess)) {
+    return
+  }
+  workerProcesses.add(workerProcess)
+  workerProcess.on('message', (message) => {
+    if (message.__tinypool_worker_message__ && message.data) {
+      handleWorkerReport(message.interprocessCode, message.data)
+    }
+  })
+}
+
+function isVitestTinypoolOptions (options) {
+  if (options?.env?.VITEST !== 'true' || typeof options.filename !== 'string') return false
+
+  let filename = options.filename
+  if (filename.startsWith('file:')) {
+    try {
+      filename = fileURLToPath(filename)
+    } catch {
+      return false
+    }
+  }
+
+  const workerPath = path.normalize(filename)
+  const workerDir = path.dirname(workerPath)
+  const packageDir = path.dirname(workerDir)
+
+  return path.basename(workerPath) === 'worker.js' &&
+    path.basename(workerDir) === 'dist' &&
+    path.basename(packageDir) === 'vitest'
+}
+
+function markVitestTinypoolOptions (options) {
+  if (!isVitestTinypoolOptions(options)) return
+
+  options.env.DD_VITEST_WORKER = '1'
+}
+
+function wrapTinyPoolRun (TinyPool) {
+  if (!TinyPool?.prototype?.run) return
+
+  shimmer.wrap(TinyPool.prototype, 'run', run => async function () {
+    // We have to do this before and after because the threads list gets recycled, that is, the processes are re-created
+    // eslint-disable-next-line unicorn/no-array-for-each
+    this.threads.forEach(threadHandler)
+    const runResult = await run.apply(this, arguments)
+    // eslint-disable-next-line unicorn/no-array-for-each
+    this.threads.forEach(threadHandler)
+    return runResult
+  })
+}
+
+function wrapTinyPoolClass (TinyPool) {
+  if (typeof TinyPool !== 'function') return TinyPool
+
+  const wrappedTinyPool = tinyPoolClassWrappers.get(TinyPool)
+  if (wrappedTinyPool) return wrappedTinyPool
+
+  class DatadogTinyPool extends TinyPool {
+    constructor (options) {
+      markVitestTinypoolOptions(options)
+      super(options)
+    }
+  }
+
+  tinyPoolClassWrappers.set(TinyPool, DatadogTinyPool)
+  wrapTinyPoolRun(DatadogTinyPool)
+
+  return DatadogTinyPool
+}
+
+function wrapTinyPool (TinyPool) {
+  if (typeof TinyPool === 'function') {
+    return wrapTinyPoolClass(TinyPool)
+  }
+
+  const defaultTinyPool = wrapTinyPoolClass(TinyPool?.default)
+  if (defaultTinyPool) {
+    TinyPool.default = defaultTinyPool
+  }
+
+  const namedTinyPool = TinyPool?.Tinypool === TinyPool?.default
+    ? defaultTinyPool
+    : wrapTinyPoolClass(TinyPool?.Tinypool)
+  if (namedTinyPool) {
+    TinyPool.Tinypool = namedTinyPool
+  }
+
+  return TinyPool
+}
+
+function getWrappedOn (on) {
+  return function (event, callback) {
+    if (event !== 'message') {
+      return on.apply(this, arguments)
+    }
+    // `arguments[1]` is the callback function, which
+    // we modify to intercept our messages to not interfere
+    // with vitest's own messages
+    arguments[1] = shimmer.wrapFunction(callback, callback => function (message) {
+      if (message.type !== 'Buffer' && Array.isArray(message)) {
+        const [interprocessCode, data] = message
+        if (handleWorkerReport(interprocessCode, data)) {
+          // If we execute the callback vitest crashes, as the message is not supported
+          return
+        }
+      }
+      return callback.apply(this, arguments)
+    })
+    return on.apply(this, arguments)
+  }
+}
+
+function handleWorkerReport (interprocessCode, data) {
+  if (interprocessCode === VITEST_WORKER_TRACE_PAYLOAD_CODE) {
+    collectTestOptimizationSummariesFromTraces(data, {
+      newTestsWithDynamicNames,
+      attemptToFixExecutions,
+    })
+    workerReportTraceCh.publish(data)
+    return true
+  }
+
+  if (interprocessCode === VITEST_WORKER_LOGS_PAYLOAD_CODE) {
+    workerReportLogsCh.publish(data)
+    return true
+  }
+
+  return false
+}
+
+function wrapMessagePortOn () {
+  if (isMessagePortWrapped) return
+
+  isMessagePortWrapped = true
+  shimmer.wrap(MessagePort.prototype, 'on', getWrappedOn)
+  shimmer.wrap(MessagePort.prototype, 'addListener', getWrappedOn)
+}
+
+function getStartVitestWrapper (cliApiPackage, frameworkVersion) {
+  if (!isCliApiPackage(cliApiPackage)) {
+    return cliApiPackage
+  }
+  const startVitestExport = findExportByName(cliApiPackage, 'startVitest')
+  shimmer.wrap(cliApiPackage, startVitestExport.key, getCliOrStartVitestWrapper(frameworkVersion))
+  wrapMessagePortOn()
+
+  const vitest = getVitestExport(cliApiPackage)
+  if (vitest) {
+    wrapVitestRunFiles(vitest.value, frameworkVersion)
+  }
+
+  const forksPoolWorker = getForksPoolWorkerExport(cliApiPackage)
+  if (forksPoolWorker) {
+    // function is async
+    shimmer.wrap(forksPoolWorker.value.prototype, 'start', start => function (...args) {
+      vitestPool = 'child_process'
+      this.env.DD_VITEST_WORKER = '1'
+
+      return start.apply(this, args)
+    })
+    shimmer.wrap(forksPoolWorker.value.prototype, 'on', getWrappedOn)
+  }
+
+  const threadsPoolWorker = getThreadsPoolWorkerExport(cliApiPackage)
+  if (threadsPoolWorker) {
+    // function is async
+    shimmer.wrap(threadsPoolWorker.value.prototype, 'start', start => function (...args) {
+      vitestPool = 'worker_threads'
+      this.env.DD_VITEST_WORKER = '1'
+      return start.apply(this, args)
+    })
+    shimmer.wrap(threadsPoolWorker.value.prototype, 'on', getWrappedOn)
+  }
+  return cliApiPackage
+}
+
+addHook({
+  name: 'tinypool',
+  // version from tinypool@0.8 was used in vitest@1.6.0
+  versions: ['>=0.8.0'],
+}, (TinyPool) => {
+  return wrapTinyPool(TinyPool)
+})
+
+// There are multiple index* files across different versions of vitest,
+// so we check for the existence of BaseSequencer to determine if we are in the right file
+addHook({
+  name: 'vitest',
+  versions: ['>=1.6.0 <2.0.0'],
+  filePattern: 'dist/vendor/index.*',
+}, (vitestPackage) => {
+  if (isReporterPackage(vitestPackage)) {
+    shimmer.wrap(vitestPackage.B.prototype, 'sort', getSortWrapper)
+  }
+
+  return vitestPackage
+})
+
+addHook({
+  name: 'vitest',
+  versions: ['>=2.0.0 <2.0.5'],
+  filePattern: 'dist/vendor/index.*',
+}, (vitestPackage) => {
+  if (isReporterPackageNew(vitestPackage)) {
+    shimmer.wrap(vitestPackage.e.prototype, 'sort', getSortWrapper)
+  }
+
+  return vitestPackage
+})
+
+addHook({
+  name: 'vitest',
+  versions: ['>=2.0.5 <2.1.0'],
+  filePattern: 'dist/chunks/index.*',
+}, (vitestPackage) => {
+  if (isReporterPackageNewest(vitestPackage)) {
+    shimmer.wrap(vitestPackage.h.prototype, 'sort', getSortWrapper)
+  }
+
+  return vitestPackage
+})
+
+addHook({
+  name: 'vitest',
+  versions: ['>=2.1.0 <3.0.0'],
+  filePattern: 'dist/chunks/RandomSequencer.*',
+}, (randomSequencerPackage) => {
+  shimmer.wrap(randomSequencerPackage.B.prototype, 'sort', getSortWrapper)
+  return randomSequencerPackage
+})
+
+addHook({
+  name: 'vitest',
+  versions: ['>=3.0.9'],
+  filePattern: 'dist/chunks/coverage.*',
+}, (coveragePackage) => {
+  const baseSequencer = getBaseSequencerExport(coveragePackage)
+  if (baseSequencer) {
+    shimmer.wrap(baseSequencer.value.prototype, 'sort', getSortWrapper)
+  }
+  return coveragePackage
+})
+
+addHook({
+  name: 'vitest',
+  versions: ['>=3.0.0 <3.0.9'],
+  filePattern: 'dist/chunks/resolveConfig.*',
+}, (resolveConfigPackage) => {
+  shimmer.wrap(resolveConfigPackage.B.prototype, 'sort', getSortWrapper)
+  return resolveConfigPackage
+})
+
+// Can't specify file because compiled vitest includes hashes in their files
+// Following 3 wrappers are for test session start
+addHook({
+  name: 'vitest',
+  versions: ['>=1.6.0 <2.0.5'],
+  filePattern: 'dist/vendor/cac.*',
+}, getCreateCliWrapper)
+
+addHook({
+  name: 'vitest',
+  versions: ['>=2.0.5'],
+  filePattern: 'dist/chunks/cac.*',
+}, getCreateCliWrapper)
+
+addHook({
+  name: 'vitest',
+  versions: ['>=1.6.0 <2.0.5'],
+  filePattern: 'dist/vendor/cli-api.*',
+}, getStartVitestWrapper)
+
+addHook({
+  name: 'vitest',
+  versions: ['>=2.0.5'],
+  filePattern: 'dist/chunks/cli-api.*',
+}, getStartVitestWrapper)
diff --git a/packages/datadog-instrumentations/src/vitest-util.js b/packages/datadog-instrumentations/src/vitest-util.js
new file mode 100644
index 0000000000..d41a31dcbe
--- /dev/null
+++ b/packages/datadog-instrumentations/src/vitest-util.js
@@ -0,0 +1,225 @@
+'use strict'
+
+const log = require('../../dd-trace/src/log')
+const { channel } = require('./helpers/instrument')
+
+// test hooks
+const testStartCh = channel('ci:vitest:test:start')
+const testFinishTimeCh = channel('ci:vitest:test:finish-time')
+const testPassCh = channel('ci:vitest:test:pass')
+const testErrorCh = channel('ci:vitest:test:error')
+const testSkipCh = channel('ci:vitest:test:skip')
+const isNewTestCh = channel('ci:vitest:test:is-new')
+const isAttemptToFixCh = channel('ci:vitest:test:is-attempt-to-fix')
+const isDisabledCh = channel('ci:vitest:test:is-disabled')
+const isQuarantinedCh = channel('ci:vitest:test:is-quarantined')
+const isModifiedCh = channel('ci:vitest:test:is-modified')
+const testFnCh = channel('ci:vitest:test:fn')
+
+// test suite hooks
+const testSuiteStartCh = channel('ci:vitest:test-suite:start')
+const testSuiteFinishCh = channel('ci:vitest:test-suite:finish')
+const testSuiteErrorCh = channel('ci:vitest:test-suite:error')
+
+// test session hooks
+const testSessionStartCh = channel('ci:vitest:session:start')
+const testSessionFinishCh = channel('ci:vitest:session:finish')
+const testSessionConfigurationCh = channel('ci:vitest:session:configuration')
+const libraryConfigurationCh = channel('ci:vitest:library-configuration')
+const knownTestsCh = channel('ci:vitest:known-tests')
+const isEarlyFlakeDetectionFaultyCh = channel('ci:vitest:is-early-flake-detection-faulty')
+const testManagementTestsCh = channel('ci:vitest:test-management-tests')
+const modifiedFilesCh = channel('ci:vitest:modified-files')
+
+const workerReportTraceCh = channel('ci:vitest:worker-report:trace')
+const workerReportLogsCh = channel('ci:vitest:worker-report:logs')
+const codeCoverageReportCh = channel('ci:vitest:coverage-report')
+
+function findExportByName (pkg, name) {
+  for (const [key, value] of Object.entries(pkg)) {
+    if (value?.name === name) {
+      return { key, value }
+    }
+  }
+}
+
+function getChannelPromise (channelToPublishTo, frameworkVersion) {
+  return new Promise(resolve => {
+    channelToPublishTo.publish({ onDone: resolve, frameworkVersion })
+  })
+}
+
+function getTestRunnerExport (testPackage) {
+  return findExportByName(testPackage, 'VitestTestRunner') || findExportByName(testPackage, 'TestRunner')
+}
+
+function getTypeTasks (fileTasks, type = 'test') {
+  const typeTasks = []
+
+  function getTasks (tasks) {
+    for (const task of tasks) {
+      if (task.type === type) {
+        typeTasks.push(task)
+      } else if (task.tasks) {
+        getTasks(task.tasks)
+      }
+    }
+  }
+
+  getTasks(fileTasks)
+
+  return typeTasks
+}
+
+function getTestName (task) {
+  let testName = task.name
+  let currentTask = task.suite
+
+  while (currentTask) {
+    if (currentTask.name) {
+      testName = `${currentTask.name} ${testName}`
+    }
+    currentTask = currentTask.suite
+  }
+
+  return testName
+}
+
+function getWorkspaceProject (ctx) {
+  return ctx.getCoreWorkspaceProject
+    ? ctx.getCoreWorkspaceProject()
+    : ctx.getRootProject()
+}
+
+function setProvidedContext (ctx, values, warningMessage) {
+  try {
+    Object.assign(getWorkspaceProject(ctx)._provided, values)
+  } catch {
+    log.warn(warningMessage)
+  }
+}
+
+function getProvidedContext () {
+  try {
+    const {
+      _ddIsEarlyFlakeDetectionEnabled,
+      _ddIsDiEnabled,
+      _ddKnownTests: knownTests,
+      _ddEarlyFlakeDetectionNumRetries: numRepeats,
+      _ddEarlyFlakeDetectionSlowTestRetries: slowTestRetries,
+      _ddIsKnownTestsEnabled: isKnownTestsEnabled,
+      _ddIsTestManagementTestsEnabled: isTestManagementTestsEnabled,
+      _ddTestManagementAttemptToFixRetries: testManagementAttemptToFixRetries,
+      _ddTestManagementTests: testManagementTests,
+      _ddIsFlakyTestRetriesEnabled: isFlakyTestRetriesEnabled,
+      _ddFlakyTestRetriesCount: flakyTestRetriesCount,
+      _ddFlakyTestRetriesIncludesUnnamedProject: flakyTestRetriesIncludesUnnamedProject,
+      _ddFlakyTestRetriesProjectNames: flakyTestRetriesProjectNames,
+      _ddIsImpactedTestsEnabled: isImpactedTestsEnabled,
+      _ddModifiedFiles: modifiedFiles,
+      _ddTestSessionId: testSessionId,
+      _ddTestModuleId: testModuleId,
+      _ddTestCommand: testCommand,
+      _ddRepositoryRoot: repositoryRoot,
+      _ddCodeOwnersEntries: codeOwnersEntries,
+    } = globalThis.__vitest_worker__.providedContext
+
+    return {
+      isDiEnabled: _ddIsDiEnabled,
+      isEarlyFlakeDetectionEnabled: _ddIsEarlyFlakeDetectionEnabled,
+      knownTests,
+      numRepeats,
+      slowTestRetries: slowTestRetries ?? {},
+      isKnownTestsEnabled,
+      isTestManagementTestsEnabled,
+      testManagementAttemptToFixRetries,
+      testManagementTests,
+      isFlakyTestRetriesEnabled,
+      flakyTestRetriesCount: flakyTestRetriesCount ?? 0,
+      flakyTestRetriesIncludesUnnamedProject,
+      flakyTestRetriesProjectNames,
+      isImpactedTestsEnabled,
+      modifiedFiles,
+      testSessionId,
+      testModuleId,
+      testCommand,
+      repositoryRoot,
+      codeOwnersEntries,
+    }
+  } catch {
+    log.error('Vitest workers could not parse provided context, so some features will not work.')
+    return {
+      isDiEnabled: false,
+      isEarlyFlakeDetectionEnabled: false,
+      knownTests: {},
+      numRepeats: 0,
+      slowTestRetries: {},
+      isKnownTestsEnabled: false,
+      isTestManagementTestsEnabled: false,
+      testManagementAttemptToFixRetries: 0,
+      testManagementTests: {},
+      isFlakyTestRetriesEnabled: false,
+      flakyTestRetriesCount: 0,
+      flakyTestRetriesIncludesUnnamedProject: false,
+      flakyTestRetriesProjectNames: undefined,
+      isImpactedTestsEnabled: false,
+      modifiedFiles: {},
+      testSessionId: undefined,
+      testModuleId: undefined,
+      testCommand: undefined,
+      repositoryRoot: undefined,
+      codeOwnersEntries: undefined,
+    }
+  }
+}
+
+function isFlakyTestRetriesEnabledForTask (providedContext, task) {
+  if (!providedContext.isFlakyTestRetriesEnabled) return false
+
+  const { flakyTestRetriesProjectNames } = providedContext
+  if (!Array.isArray(flakyTestRetriesProjectNames)) return true
+
+  const projectName = task.file?.projectName
+  if (!projectName) {
+    return providedContext.flakyTestRetriesIncludesUnnamedProject === true
+  }
+
+  return flakyTestRetriesProjectNames.includes(projectName)
+}
+
+module.exports = {
+  testStartCh,
+  testFinishTimeCh,
+  testPassCh,
+  testErrorCh,
+  testSkipCh,
+  isNewTestCh,
+  isAttemptToFixCh,
+  isDisabledCh,
+  isQuarantinedCh,
+  isModifiedCh,
+  testFnCh,
+  testSuiteStartCh,
+  testSuiteFinishCh,
+  testSuiteErrorCh,
+  testSessionStartCh,
+  testSessionFinishCh,
+  testSessionConfigurationCh,
+  libraryConfigurationCh,
+  knownTestsCh,
+  isEarlyFlakeDetectionFaultyCh,
+  testManagementTestsCh,
+  modifiedFilesCh,
+  workerReportTraceCh,
+  workerReportLogsCh,
+  codeCoverageReportCh,
+  findExportByName,
+  getChannelPromise,
+  getTestRunnerExport,
+  getTypeTasks,
+  getTestName,
+  getWorkspaceProject,
+  setProvidedContext,
+  getProvidedContext,
+  isFlakyTestRetriesEnabledForTask,
+}
diff --git a/packages/datadog-instrumentations/src/vitest-worker.js b/packages/datadog-instrumentations/src/vitest-worker.js
new file mode 100644
index 0000000000..0eab9ab37a
--- /dev/null
+++ b/packages/datadog-instrumentations/src/vitest-worker.js
@@ -0,0 +1,788 @@
+'use strict'
+
+// Capture real timers at module load time, before any test can install fake timers.
+const realSetTimeout = setTimeout
+
+const { performance } = require('node:perf_hooks')
+
+const shimmer = require('../../datadog-shimmer')
+const {
+  DYNAMIC_NAME_RE,
+  getTestSuitePath,
+  getEfdRetryCount,
+  recordAttemptToFixExecution,
+  logAttemptToFixTestExecution,
+} = require('../../dd-trace/src/plugins/util/test')
+const { addHook } = require('./helpers/instrument')
+const {
+  testStartCh,
+  testFinishTimeCh,
+  testPassCh,
+  testErrorCh,
+  testSkipCh,
+  isNewTestCh,
+  isAttemptToFixCh,
+  isDisabledCh,
+  isQuarantinedCh,
+  isModifiedCh,
+  testFnCh,
+  testSuiteStartCh,
+  testSuiteFinishCh,
+  testSuiteErrorCh,
+  findExportByName,
+  getTestRunnerExport,
+  getTypeTasks,
+  getTestName,
+  getProvidedContext,
+  isFlakyTestRetriesEnabledForTask,
+} = require('./vitest-util')
+
+const BREAKPOINT_HIT_GRACE_PERIOD_MS = 400
+
+const taskToCtx = new WeakMap()
+const taskToStatuses = new WeakMap()
+const taskToReportedErrorCount = new WeakMap()
+const attemptToFixTaskToStatuses = new WeakMap()
+const originalHookFns = new WeakMap()
+const newTasks = new WeakSet()
+const dynamicNameTasks = new WeakSet()
+const disabledTasks = new WeakSet()
+const quarantinedTasks = new WeakSet()
+const attemptToFixTasks = new WeakSet()
+const modifiedTasks = new WeakSet()
+const efdDeterminedRetries = new WeakMap()
+const efdSlowAbortedTasks = new WeakSet()
+const efdExecutionStartByTask = new WeakMap()
+const efdSkippedRetryResults = new WeakMap()
+const attemptToFixExecutions = new Map()
+const loggedAttemptToFixTests = new Set()
+let isRetryReasonEfd = false
+let isRetryReasonAttemptToFix = false
+const switchedStatuses = new WeakSet()
+let vitestGetFn = null
+let vitestSetFn = null
+let vitestGetHooks = null
+
+function waitForHitProbe () {
+  return new Promise(resolve => {
+    realSetTimeout(() => {
+      resolve()
+    }, BREAKPOINT_HIT_GRACE_PERIOD_MS)
+  })
+}
+
+function getVitestTestStatus (test, retryCount) {
+  if (test.result.state !== 'fail' && (!test.repeats || (test.retry ?? 0) === retryCount)) {
+    return 'pass'
+  }
+  return 'fail'
+}
+
+function getFinalAttemptToFixStatus (task, state, isSwitchedStatus, testCtx) {
+  if (isSwitchedStatus && attemptToFixTasks.has(task) && testCtx?.status) {
+    return testCtx.status
+  }
+
+  return state === 'fail' ? 'fail' : 'pass'
+}
+
+function recordFinalAttemptToFixExecution (task, status, providedContext) {
+  const statuses = attemptToFixTaskToStatuses.get(task)
+  if (statuses && statuses.length <= providedContext.testManagementAttemptToFixRetries) {
+    statuses.push(status)
+  }
+
+  recordAttemptToFixExecution(attemptToFixExecutions, {
+    testSuite: getTestSuitePath(task.file.filepath, process.cwd()),
+    testName: getTestName(task),
+    status,
+    isDisabled: disabledTasks.has(task),
+    isQuarantined: quarantinedTasks.has(task),
+  })
+}
+
+function disableFrameworkRetries (task) {
+  task.retry = 0
+}
+
+function getCurrentAttemptTestError (task, errors) {
+  if (!errors?.length) return
+
+  const previousErrorCount = taskToReportedErrorCount.get(task) ?? 0
+  const testError = errors[previousErrorCount] ?? errors[0]
+  taskToReportedErrorCount.set(task, errors.length)
+  return testError
+}
+
+function wrapTestScopedFn (task, fn) {
+  return shimmer.wrapFunction(fn, fn => function (...args) {
+    return testFnCh.runStores(taskToCtx.get(task), () => fn.apply(this, args))
+  })
+}
+
+function wrapBeforeEachCleanupResult (task, result) {
+  if (typeof result === 'function') {
+    return wrapTestScopedFn(task, result)
+  }
+
+  if (result && typeof result.then === 'function') {
+    return result.then(cleanupFn => wrapBeforeEachCleanupResult(task, cleanupFn))
+  }
+
+  return result
+}
+
+function wrapVitestTestRunner (VitestTestRunner) {
+  // `onBeforeRunTask` is run before any repetition or attempt is run
+  // `onBeforeRunTask` is an async function
+  shimmer.wrap(VitestTestRunner.prototype, 'onBeforeRunTask', onBeforeRunTask => function (task) {
+    const testName = getTestName(task)
+
+    const {
+      knownTests,
+      isEarlyFlakeDetectionEnabled,
+      isKnownTestsEnabled,
+      numRepeats,
+      isTestManagementTestsEnabled,
+      testManagementAttemptToFixRetries,
+      testManagementTests,
+      isImpactedTestsEnabled,
+      modifiedFiles,
+    } = getProvidedContext()
+
+    if (isTestManagementTestsEnabled) {
+      isAttemptToFixCh.publish({
+        testManagementTests,
+        testSuiteAbsolutePath: task.file.filepath,
+        testName,
+        onDone: (isAttemptToFix) => {
+          if (isAttemptToFix) {
+            isRetryReasonAttemptToFix = task.repeats !== testManagementAttemptToFixRetries
+            disableFrameworkRetries(task)
+            task.repeats = testManagementAttemptToFixRetries
+            attemptToFixTasks.add(task)
+            attemptToFixTaskToStatuses.set(task, [])
+          }
+        },
+      })
+      isDisabledCh.publish({
+        testManagementTests,
+        testSuiteAbsolutePath: task.file.filepath,
+        testName,
+        onDone: (isTestDisabled) => {
+          if (isTestDisabled) {
+            disabledTasks.add(task)
+            if (!attemptToFixTasks.has(task)) {
+              // we only actually skip if the test is not being attempted to be fixed
+              task.mode = 'skip'
+            }
+          }
+        },
+      })
+    }
+
+    if (isImpactedTestsEnabled) {
+      isModifiedCh.publish({
+        modifiedFiles,
+        testSuiteAbsolutePath: task.file.filepath,
+        onDone: (isImpacted) => {
+          if (isImpacted) {
+            if (isEarlyFlakeDetectionEnabled) {
+              isRetryReasonEfd = true
+              disableFrameworkRetries(task)
+              task.repeats = numRepeats
+            }
+            modifiedTasks.add(task)
+            taskToStatuses.set(task, [])
+          }
+        },
+      })
+    }
+
+    if (isKnownTestsEnabled) {
+      isNewTestCh.publish({
+        knownTests,
+        testSuiteAbsolutePath: task.file.filepath,
+        testName,
+        onDone: (isNew) => {
+          if (isNew && !attemptToFixTasks.has(task)) {
+            if (isEarlyFlakeDetectionEnabled && !modifiedTasks.has(task)) {
+              isRetryReasonEfd = true
+              disableFrameworkRetries(task)
+              task.repeats = numRepeats
+            }
+            newTasks.add(task)
+            taskToStatuses.set(task, [])
+            if (DYNAMIC_NAME_RE.test(testName)) {
+              dynamicNameTasks.add(task)
+            }
+          }
+        },
+      })
+    }
+
+    return onBeforeRunTask.apply(this, arguments)
+  })
+
+  // `onAfterRunTask` is run after all repetitions or attempts are run
+  // `onAfterRunTask` is an async function
+  shimmer.wrap(VitestTestRunner.prototype, 'onAfterRunTask', onAfterRunTask => function (task) {
+    const { isEarlyFlakeDetectionEnabled, isTestManagementTestsEnabled } = getProvidedContext()
+
+    if (isTestManagementTestsEnabled) {
+      const isAttemptingToFix = attemptToFixTasks.has(task)
+      const isQuarantined = quarantinedTasks.has(task)
+
+      if (isAttemptingToFix) {
+        const statuses = attemptToFixTaskToStatuses.get(task)
+        if (task.result.state === 'pass' && statuses?.includes('fail')) {
+          switchedStatuses.add(task)
+          task.result.state = 'fail'
+        }
+      }
+
+      if (!isAttemptingToFix && isQuarantined) {
+        if (task.result.state === 'fail') {
+          switchedStatuses.add(task)
+        }
+        task.result.state = 'pass'
+      }
+    }
+
+    if (isEarlyFlakeDetectionEnabled && taskToStatuses.has(task) && !attemptToFixTasks.has(task)) {
+      const statuses = taskToStatuses.get(task)
+      // If the test has passed at least once, we consider it passed
+      if (statuses.includes('pass')) {
+        if (task.result.state === 'fail') {
+          switchedStatuses.add(task)
+        }
+        task.result.state = 'pass'
+      }
+    }
+
+    return onAfterRunTask.apply(this, arguments)
+  })
+
+  // test start (only tests that are not marked as skip or todo)
+  // `onBeforeTryTask` is run for every repetition and attempt of the test
+  shimmer.wrap(VitestTestRunner.prototype, 'onBeforeTryTask', onBeforeTryTask => async function (task, retryInfo) {
+    if (!testPassCh.hasSubscribers && !testErrorCh.hasSubscribers && !testSkipCh.hasSubscribers) {
+      return onBeforeTryTask.apply(this, arguments)
+    }
+    const testName = getTestName(task)
+    let isNew = false
+    let isQuarantined = false
+
+    const providedContext = getProvidedContext()
+    const {
+      isKnownTestsEnabled,
+      isEarlyFlakeDetectionEnabled,
+      isDiEnabled,
+      isTestManagementTestsEnabled,
+      testManagementTests,
+      slowTestRetries,
+    } = providedContext
+
+    if (isKnownTestsEnabled) {
+      isNew = newTasks.has(task)
+    }
+
+    if (isTestManagementTestsEnabled) {
+      isQuarantinedCh.publish({
+        testManagementTests,
+        testSuiteAbsolutePath: task.file.filepath,
+        testName,
+        onDone: (isTestQuarantined) => {
+          isQuarantined = isTestQuarantined
+          if (isTestQuarantined) {
+            quarantinedTasks.add(task)
+          }
+        },
+      })
+    }
+
+    const { retry: numAttempt, repeats: numRepetition } = retryInfo
+    const isEfdManagedTask = isEarlyFlakeDetectionEnabled && taskToStatuses.has(task) && !attemptToFixTasks.has(task)
+
+    if (isEfdManagedTask && numRepetition > 0 && !efdDeterminedRetries.has(task)) {
+      const previousExecutionStart = efdExecutionStartByTask.get(task)
+      const duration = previousExecutionStart === undefined
+        ? task.result?.duration ?? 0
+        : performance.now() - previousExecutionStart
+      const retryCount = getEfdRetryCount(duration, slowTestRetries)
+      efdDeterminedRetries.set(task, retryCount)
+      task.repeats = retryCount
+      if (retryCount === 0) {
+        efdSlowAbortedTasks.add(task)
+      }
+    }
+
+    const efdRetryCount = efdDeterminedRetries.get(task)
+    if (isEfdManagedTask && efdRetryCount !== undefined && numRepetition > efdRetryCount) {
+      if (task.result) {
+        efdSkippedRetryResults.set(task, {
+          ...task.result,
+          errors: task.result.errors?.slice(),
+        })
+      }
+      if (vitestSetFn) {
+        const noop = function () {}
+        noop.__ddTraceWrapped = true
+        vitestSetFn(task, noop)
+      }
+      return onBeforeTryTask.apply(this, arguments)
+    }
+    if (isEfdManagedTask) {
+      efdExecutionStartByTask.set(task, performance.now())
+    }
+
+    // We finish the previous test here because we know it has failed already
+    if (numAttempt > 0) {
+      const shouldWaitForHitProbe = isDiEnabled && numAttempt > 1
+      if (shouldWaitForHitProbe) {
+        await waitForHitProbe()
+      }
+
+      const promises = {}
+      const shouldSetProbe = isDiEnabled && numAttempt === 1
+      const ctx = taskToCtx.get(task)
+      const testError = getCurrentAttemptTestError(task, task.result?.errors)
+      if (ctx) {
+        testErrorCh.publish({
+          error: testError,
+          shouldSetProbe,
+          promises,
+          ...ctx.currentStore,
+        })
+        // We wait for the probe to be set
+        if (promises.setProbePromise) {
+          await promises.setProbePromise
+        }
+      }
+    }
+
+    const lastExecutionStatus = task.result.state
+    const isAtf = attemptToFixTasks.has(task)
+    const shouldTrackStatuses = isEarlyFlakeDetectionEnabled || isAtf
+    const shouldFlipStatus = isEarlyFlakeDetectionEnabled || isAtf
+    const statuses = isAtf ? attemptToFixTaskToStatuses.get(task) : taskToStatuses.get(task)
+
+    // These clauses handle task.repeats, whether EFD is enabled or not
+    // The only thing that EFD does is to forcefully pass the test if it has passed at least once
+    if (numRepetition > 0 && numRepetition < task.repeats) { // it may or may have not failed
+      // Here we finish the earlier iteration,
+      // as long as it's not the _last_ iteration (which will be finished normally)
+
+      const ctx = taskToCtx.get(task)
+      if (ctx) {
+        if (lastExecutionStatus === 'fail') {
+          const testError = getCurrentAttemptTestError(task, task.result?.errors)
+          testErrorCh.publish({ error: testError, ...ctx.currentStore })
+        } else {
+          testPassCh.publish({ task, ...ctx.currentStore })
+        }
+        if (shouldTrackStatuses && statuses) {
+          statuses.push(lastExecutionStatus)
+        }
+        if (shouldFlipStatus) {
+          // If we don't "reset" the result.state to "pass", once a repetition fails,
+          // vitest will always consider the test as failed, so we can't read the actual status
+          // This means that we change vitest's behavior:
+          // if the last attempt passes, vitest would consider the test as failed
+          // but after this change, it will consider the test as passed
+          task.result.state = 'pass'
+        }
+      }
+    } else if (numRepetition === task.repeats) {
+      if (shouldTrackStatuses && statuses) {
+        statuses.push(lastExecutionStatus)
+      }
+
+      const ctx = taskToCtx.get(task)
+      if (lastExecutionStatus === 'fail') {
+        const testError = getCurrentAttemptTestError(task, task.result?.errors)
+        testErrorCh.publish({ error: testError, ...ctx.currentStore })
+      } else {
+        testPassCh.publish({ task, ...ctx.currentStore })
+      }
+      if (shouldFlipStatus) {
+        task.result.state = 'pass'
+      }
+    }
+
+    const isRetryReasonAtr = numAttempt > 0 &&
+      isFlakyTestRetriesEnabledForTask(providedContext, task) &&
+      !isRetryReasonAttemptToFix &&
+      !isRetryReasonEfd
+
+    const ctx = {
+      testName,
+      testSuiteAbsolutePath: task.file.filepath,
+      isRetry: numAttempt > 0 || numRepetition > 0,
+      isRetryReasonEfd,
+      isRetryReasonAttemptToFix: isRetryReasonAttemptToFix && numRepetition > 0,
+      isNew,
+      hasDynamicName: dynamicNameTasks.has(task),
+      mightHitProbe: isDiEnabled && numAttempt > 0,
+      isAttemptToFix: attemptToFixTasks.has(task),
+      isDisabled: disabledTasks.has(task),
+      isQuarantined,
+      isRetryReasonAtr,
+      isModified: modifiedTasks.has(task),
+    }
+    taskToCtx.set(task, ctx)
+
+    if (attemptToFixTasks.has(task)) {
+      logAttemptToFixTestExecution(
+        getTestSuitePath(task.file.filepath, process.cwd()),
+        testName,
+        loggedAttemptToFixTests
+      )
+    }
+
+    testStartCh.runStores(ctx, () => {})
+
+    // Wrap the test function so it runs inside the test span context.
+    // Without this, HTTP requests during test execution become orphaned root spans.
+    if (vitestGetFn && vitestSetFn) {
+      const originalFn = vitestGetFn(task)
+      if (originalFn && !originalFn.__ddTraceWrapped) {
+        const wrappedFn = wrapTestScopedFn(task, originalFn)
+        wrappedFn.__ddTraceWrapped = true
+        vitestSetFn(task, wrappedFn)
+      }
+    }
+
+    // Wrap beforeEach/afterEach hooks so they also run inside the test span context.
+    // In vitest 4+, hooks are in a WeakMap accessed via getHooks(). In older versions, they're on suite.hooks.
+    let currentSuite = task.suite
+    while (currentSuite) {
+      const hooks = vitestGetHooks ? vitestGetHooks(currentSuite) : currentSuite.hooks
+      if (hooks) {
+        for (const hookType of ['beforeEach', 'afterEach']) {
+          const hookArray = hooks[hookType]
+          if (!hookArray) continue
+          for (let i = 0; i < hookArray.length; i++) {
+            const currentFn = hookArray[i]
+            const originalFn = originalHookFns.get(currentFn) || currentFn
+            const wrappedFn = shimmer.wrapFunction(originalFn, fn => function (...args) {
+              const result = testFnCh.runStores(taskToCtx.get(task), () => fn.apply(this, args))
+
+              if (hookType === 'beforeEach') {
+                return wrapBeforeEachCleanupResult(task, result)
+              }
+
+              return result
+            })
+            originalHookFns.set(wrappedFn, originalFn)
+            hookArray[i] = wrappedFn
+          }
+        }
+      }
+      currentSuite = currentSuite.suite
+    }
+
+    return onBeforeTryTask.apply(this, arguments)
+  })
+
+  // test finish (only passed tests)
+  shimmer.wrap(VitestTestRunner.prototype, 'onAfterTryTask', onAfterTryTask =>
+    async function (task, retryInfo) {
+      if (!testPassCh.hasSubscribers && !testErrorCh.hasSubscribers && !testSkipCh.hasSubscribers) {
+        return onAfterTryTask.apply(this, arguments)
+      }
+      const result = await onAfterTryTask.apply(this, arguments)
+
+      const {
+        isEarlyFlakeDetectionEnabled,
+        testManagementAttemptToFixRetries,
+        slowTestRetries,
+      } = getProvidedContext()
+
+      const status = getVitestTestStatus(task, retryInfo.retry)
+      const ctx = taskToCtx.get(task)
+
+      const { isDiEnabled } = getProvidedContext()
+
+      if (efdSkippedRetryResults.has(task)) {
+        task.result = efdSkippedRetryResults.get(task)
+        efdSkippedRetryResults.delete(task)
+        return result
+      }
+
+      if (isDiEnabled && retryInfo.retry > 1) {
+        await waitForHitProbe()
+      }
+
+      if (
+        isEarlyFlakeDetectionEnabled &&
+        (retryInfo.repeats ?? 0) === 0 &&
+        taskToStatuses.has(task) &&
+        !attemptToFixTasks.has(task) &&
+        !efdDeterminedRetries.has(task)
+      ) {
+        const executionStart = efdExecutionStartByTask.get(task)
+        const duration = executionStart === undefined ? task.result?.duration ?? 0 : performance.now() - executionStart
+        const retryCount = getEfdRetryCount(duration, slowTestRetries)
+        efdDeterminedRetries.set(task, retryCount)
+        task.repeats = retryCount
+        if (retryCount === 0) {
+          efdSlowAbortedTasks.add(task)
+        }
+      }
+
+      let attemptToFixPassed = false
+      let attemptToFixFailed = false
+      if (attemptToFixTasks.has(task)) {
+        const statuses = attemptToFixTaskToStatuses.get(task)
+        if (statuses.length === testManagementAttemptToFixRetries) {
+          if (status === 'pass' && statuses.every(status => status === 'pass')) {
+            attemptToFixPassed = true
+          } else if (status === 'fail' || statuses.includes('fail')) {
+            attemptToFixFailed = true
+          }
+        }
+      }
+
+      if (ctx) {
+        // We don't finish here because the test might fail in a later hook (afterEach)
+        ctx.status = status
+        ctx.task = task
+        ctx.attemptToFixPassed = attemptToFixPassed
+        ctx.attemptToFixFailed = attemptToFixFailed
+        testFinishTimeCh.runStores(ctx, () => {})
+      }
+
+      return result
+    })
+}
+
+function captureRunnerFunctions (pkg) {
+  if (vitestGetFn) return
+  const getFnExport = findExportByName(pkg, 'getFn')
+  const setFnExport = findExportByName(pkg, 'setFn')
+  if (getFnExport && setFnExport) {
+    vitestGetFn = getFnExport.value
+    vitestSetFn = setFnExport.value
+  }
+  const getHooksExport = findExportByName(pkg, 'getHooks')
+  if (getHooksExport) {
+    vitestGetHooks = getHooksExport.value
+  }
+}
+
+addHook({
+  name: 'vitest',
+  versions: ['>=4.0.0'],
+  filePattern: 'dist/chunks/test.*',
+}, (testPackage) => {
+  const testRunner = getTestRunnerExport(testPackage)
+  if (!testRunner) {
+    return testPackage
+  }
+
+  captureRunnerFunctions(testPackage)
+  wrapVitestTestRunner(testRunner.value)
+
+  return testPackage
+})
+
+addHook({
+  name: '@vitest/runner',
+  versions: ['>=1.6.0'],
+}, (runnerModule) => {
+  if (!vitestGetFn && runnerModule.getFn && runnerModule.setFn) {
+    vitestGetFn = runnerModule.getFn
+    vitestSetFn = runnerModule.setFn
+  }
+  if (!vitestGetHooks && runnerModule.getHooks) {
+    vitestGetHooks = runnerModule.getHooks
+  }
+  return runnerModule
+})
+
+addHook({
+  name: 'vitest',
+  versions: ['>=1.6.0 <4.0.0'],
+  file: 'dist/runners.js',
+}, (vitestPackage) => {
+  const { VitestTestRunner } = vitestPackage
+
+  wrapVitestTestRunner(VitestTestRunner)
+
+  return vitestPackage
+})
+
+// test suite start and finish
+// only relevant for workers
+addHook({
+  name: '@vitest/runner',
+  versions: ['>=1.6.0'],
+}, (vitestPackage, frameworkVersion) => {
+  shimmer.wrap(vitestPackage, 'startTests', startTests => async function (testPaths) {
+    let testSuiteError = null
+    if (!testSuiteFinishCh.hasSubscribers) {
+      return startTests.apply(this, arguments)
+    }
+    // From >=3.0.1, the first arguments changes from a string to an object containing the filepath
+    const testSuiteAbsolutePath = testPaths[0]?.filepath || testPaths[0]
+    const providedContext = getProvidedContext()
+
+    const testSuiteCtx = {
+      testSuiteAbsolutePath,
+      frameworkVersion,
+      testSessionId: providedContext.testSessionId,
+      testModuleId: providedContext.testModuleId,
+      testCommand: providedContext.testCommand,
+      repositoryRoot: providedContext.repositoryRoot,
+      codeOwnersEntries: providedContext.codeOwnersEntries,
+    }
+    testSuiteStartCh.runStores(testSuiteCtx, () => {})
+    const startTestsResponse = await startTests.apply(this, arguments)
+
+    let onFinish = null
+    const onFinishPromise = new Promise(resolve => {
+      onFinish = resolve
+    })
+
+    const testTasks = getTypeTasks(startTestsResponse[0].tasks)
+
+    // Only one test task per test, even if there are retries
+    for (const task of testTasks) {
+      const testCtx = taskToCtx.get(task)
+      const { result } = task
+      // We have to trick vitest into thinking that the test has passed
+      // but we want to report it as failed if it did fail
+      const isSwitchedStatus = switchedStatuses.has(task)
+
+      if (result) {
+        const { state, duration, errors } = result
+        const testError = getCurrentAttemptTestError(task, errors)
+        if (attemptToFixTasks.has(task)) {
+          const status = getFinalAttemptToFixStatus(task, state, isSwitchedStatus, testCtx)
+          recordFinalAttemptToFixExecution(task, status, providedContext)
+        }
+
+        if (state === 'skip') { // programmatic skip
+          testSkipCh.publish({
+            testName: getTestName(task),
+            testSuiteAbsolutePath: task.file.filepath,
+            isNew: newTasks.has(task),
+            isDisabled: disabledTasks.has(task),
+          })
+        } else if (state === 'pass' && !isSwitchedStatus) {
+          if (testCtx) {
+            const isSkippedByTestManagement =
+              !attemptToFixTasks.has(task) && (disabledTasks.has(task) || quarantinedTasks.has(task))
+            testPassCh.publish({
+              task,
+              finalStatus: isSkippedByTestManagement ? 'skip' : 'pass',
+              earlyFlakeAbortReason: efdSlowAbortedTasks.has(task) ? 'slow' : undefined,
+              ...testCtx.currentStore,
+            })
+          }
+        } else if (state === 'fail' || isSwitchedStatus) {
+          let hasFailedAllRetries = false
+          let attemptToFixFailed = false
+          if (attemptToFixTasks.has(task)) {
+            const statuses = attemptToFixTaskToStatuses.get(task)
+            if (statuses.includes('fail')) {
+              attemptToFixFailed = true
+            }
+            if (statuses.every(status => status === 'fail')) {
+              hasFailedAllRetries = true
+            }
+          }
+
+          // Check if all EFD retries failed
+          const isEfdRetry =
+            providedContext.isEarlyFlakeDetectionEnabled && (newTasks.has(task) || modifiedTasks.has(task))
+          if (isEfdRetry) {
+            const statuses = taskToStatuses.get(task)
+            const efdRetryCount = efdDeterminedRetries.get(task) ?? providedContext.numRepeats
+            // statuses only includes repetitions (not the initial run), so we check against retry count (not +1)
+            if (efdRetryCount > 0 && statuses && statuses.length === efdRetryCount &&
+              statuses.every(status => status === 'fail')) {
+              hasFailedAllRetries = true
+            }
+          }
+
+          // ATR: set hasFailedAllRetries when all auto test retries were exhausted and every attempt failed
+          const isAtrRetry = isFlakyTestRetriesEnabledForTask(providedContext, task) && !attemptToFixTasks.has(task) &&
+            !newTasks.has(task) && !modifiedTasks.has(task)
+          if (isAtrRetry) {
+            const maxRetries = providedContext.flakyTestRetriesCount ?? 0
+            if (maxRetries > 0 && task.result?.retryCount === maxRetries) {
+              hasFailedAllRetries = true
+            }
+          }
+
+          if (testCtx) {
+            const isRetry = task.result?.retryCount > 0
+            // `duration` is the duration of all the retries, so it can't be used if there are retries
+
+            let finalStatus
+            if (isSwitchedStatus) {
+              if (!attemptToFixTasks.has(task) && (disabledTasks.has(task) || quarantinedTasks.has(task))) {
+                finalStatus = 'skip'
+              } else if (isAtrRetry || isEfdRetry) {
+                finalStatus = hasFailedAllRetries ? 'fail' : 'pass'
+              } else if (attemptToFixTasks.has(task)) {
+                finalStatus = attemptToFixFailed ? 'fail' : 'pass'
+              } else {
+                finalStatus = undefined
+              }
+            } else {
+              finalStatus = 'fail'
+            }
+
+            testErrorCh.publish({
+              duration: isRetry ? undefined : duration,
+              error: testError,
+              hasFailedAllRetries,
+              attemptToFixFailed,
+              finalStatus,
+              earlyFlakeAbortReason: efdSlowAbortedTasks.has(task) ? 'slow' : undefined,
+              ...testCtx.currentStore,
+            })
+          }
+          if (errors?.length) {
+            testSuiteError = testError // we store the error to bubble it up to the suite
+          }
+        }
+      } else { // test.skip or test.todo
+        testSkipCh.publish({
+          testName: getTestName(task),
+          testSuiteAbsolutePath: task.file.filepath,
+          isNew: newTasks.has(task),
+          isDisabled: disabledTasks.has(task),
+        })
+      }
+    }
+
+    const testSuiteResult = startTestsResponse[0].result
+
+    if (testSuiteResult.errors?.length) { // Errors from root level hooks
+      testSuiteError = testSuiteResult.errors[0]
+    } else if (testSuiteResult.state === 'fail') { // Errors from `describe` level hooks
+      const suiteTasks = getTypeTasks(startTestsResponse[0].tasks, 'suite')
+      const failedSuites = suiteTasks.filter(task => task.result?.state === 'fail')
+      if (failedSuites.length && failedSuites[0].result?.errors?.length) {
+        testSuiteError = failedSuites[0].result.errors[0]
+      }
+    }
+
+    if (testSuiteError) {
+      testSuiteCtx.error = testSuiteError
+      testSuiteErrorCh.runStores(testSuiteCtx, () => {})
+    }
+
+    testSuiteFinishCh.publish({ status: testSuiteResult.state, onFinish, ...testSuiteCtx.currentStore })
+
+    await onFinishPromise
+
+    return startTestsResponse
+  })
+
+  return vitestPackage
+})
diff --git a/packages/datadog-instrumentations/src/vitest.js b/packages/datadog-instrumentations/src/vitest.js
index 8b35673ebe..ca32789bf1 100644
--- a/packages/datadog-instrumentations/src/vitest.js
+++ b/packages/datadog-instrumentations/src/vitest.js
@@ -1,1948 +1,9 @@
 'use strict'
 
-// Capture real timers at module load time, before any test can install fake timers.
-const realSetTimeout = setTimeout
+const { getEnvironmentVariable } = require('../../dd-trace/src/config/helper')
 
-const path = require('node:path')
-const { performance } = require('node:perf_hooks')
-const { fileURLToPath } = require('node:url')
-const { MessagePort } = require('node:worker_threads')
-
-const shimmer = require('../../datadog-shimmer')
-const log = require('../../dd-trace/src/log')
-const {
-  VITEST_WORKER_TRACE_PAYLOAD_CODE,
-  VITEST_WORKER_LOGS_PAYLOAD_CODE,
-  DYNAMIC_NAME_RE,
-  getTestSuitePath,
-  getEfdRetryCount,
-  getMaxEfdRetryCount,
-  recordAttemptToFixExecution,
-  collectTestOptimizationSummariesFromTraces,
-  logAttemptToFixTestExecution,
-  logTestOptimizationSummary,
-  getTestOptimizationRequestResults,
-} = require('../../dd-trace/src/plugins/util/test')
-const { addHook, channel } = require('./helpers/instrument')
-
-// test hooks
-const testStartCh = channel('ci:vitest:test:start')
-const testFinishTimeCh = channel('ci:vitest:test:finish-time')
-const testPassCh = channel('ci:vitest:test:pass')
-const testErrorCh = channel('ci:vitest:test:error')
-const testSkipCh = channel('ci:vitest:test:skip')
-const isNewTestCh = channel('ci:vitest:test:is-new')
-const isAttemptToFixCh = channel('ci:vitest:test:is-attempt-to-fix')
-const isDisabledCh = channel('ci:vitest:test:is-disabled')
-const isQuarantinedCh = channel('ci:vitest:test:is-quarantined')
-const isModifiedCh = channel('ci:vitest:test:is-modified')
-const testFnCh = channel('ci:vitest:test:fn')
-
-// test suite hooks
-const testSuiteStartCh = channel('ci:vitest:test-suite:start')
-const testSuiteFinishCh = channel('ci:vitest:test-suite:finish')
-const testSuiteErrorCh = channel('ci:vitest:test-suite:error')
-
-// test session hooks
-const testSessionStartCh = channel('ci:vitest:session:start')
-const testSessionFinishCh = channel('ci:vitest:session:finish')
-const testSessionConfigurationCh = channel('ci:vitest:session:configuration')
-const libraryConfigurationCh = channel('ci:vitest:library-configuration')
-const knownTestsCh = channel('ci:vitest:known-tests')
-const isEarlyFlakeDetectionFaultyCh = channel('ci:vitest:is-early-flake-detection-faulty')
-const testManagementTestsCh = channel('ci:vitest:test-management-tests')
-const modifiedFilesCh = channel('ci:vitest:modified-files')
-
-const workerReportTraceCh = channel('ci:vitest:worker-report:trace')
-const workerReportLogsCh = channel('ci:vitest:worker-report:logs')
-const codeCoverageReportCh = channel('ci:vitest:coverage-report')
-
-const taskToCtx = new WeakMap()
-const taskToStatuses = new WeakMap()
-const taskToReportedErrorCount = new WeakMap()
-const attemptToFixTaskToStatuses = new WeakMap()
-const originalHookFns = new WeakMap()
-const newTasks = new WeakSet()
-const dynamicNameTasks = new WeakSet()
-const newTestsWithDynamicNames = new Set()
-const disabledTasks = new WeakSet()
-const quarantinedTasks = new WeakSet()
-const attemptToFixTasks = new WeakSet()
-const modifiedTasks = new WeakSet()
-const efdDeterminedRetries = new WeakMap()
-const efdSlowAbortedTasks = new WeakSet()
-const efdExecutionStartByTask = new WeakMap()
-const efdSkippedRetryResults = new WeakMap()
-const attemptToFixExecutions = new Map()
-const loggedAttemptToFixTests = new Set()
-let isRetryReasonEfd = false
-let isRetryReasonAttemptToFix = false
-const switchedStatuses = new WeakSet()
-const workerProcesses = new WeakSet()
-const mainProcessSetupPromises = new WeakMap()
-const coverageWrappedProviders = new WeakSet()
-const finishWrappedContexts = new WeakSet()
-let isFlakyTestRetriesEnabled = false
-let flakyTestRetriesCount = 0
-let isEarlyFlakeDetectionEnabled = false
-let earlyFlakeDetectionNumRetries = 0
-let earlyFlakeDetectionSlowTestRetries = {}
-let isEarlyFlakeDetectionFaulty = false
-let isKnownTestsEnabled = false
-let isTestManagementTestsEnabled = false
-let isImpactedTestsEnabled = false
-let vitestGetFn = null
-let vitestSetFn = null
-let vitestGetHooks = null
-let testManagementAttemptToFixRetries = 0
-let isDiEnabled = false
-let testCodeCoverageLinesTotal
-let coverageRootDir
-let isSessionStarted = false
-let vitestPool = null
-let isMessagePortWrapped = false
-const tinyPoolClassWrappers = new WeakMap()
-
-const BREAKPOINT_HIT_GRACE_PERIOD_MS = 400
-
-function getConfiguredEfdRetryCount (slowTestRetries, fallbackRetryCount) {
-  if (!slowTestRetries || !Object.keys(slowTestRetries).length) {
-    return fallbackRetryCount
-  }
-  return getMaxEfdRetryCount(slowTestRetries)
-}
-
-function getTestCommand () {
-  return `vitest ${process.argv.slice(2).join(' ')}`
-}
-
-function waitForHitProbe () {
-  return new Promise(resolve => {
-    realSetTimeout(() => {
-      resolve()
-    }, BREAKPOINT_HIT_GRACE_PERIOD_MS)
-  })
-}
-
-function isValidKnownTests (receivedKnownTests) {
-  return !!receivedKnownTests.vitest
-}
-
-function getProvidedContext () {
-  try {
-    const {
-      _ddIsEarlyFlakeDetectionEnabled,
-      _ddIsDiEnabled,
-      _ddKnownTests: knownTests,
-      _ddEarlyFlakeDetectionNumRetries: numRepeats,
-      _ddEarlyFlakeDetectionSlowTestRetries: slowTestRetries,
-      _ddIsKnownTestsEnabled: isKnownTestsEnabled,
-      _ddIsTestManagementTestsEnabled: isTestManagementTestsEnabled,
-      _ddTestManagementAttemptToFixRetries: testManagementAttemptToFixRetries,
-      _ddTestManagementTests: testManagementTests,
-      _ddIsFlakyTestRetriesEnabled: isFlakyTestRetriesEnabled,
-      _ddFlakyTestRetriesCount: flakyTestRetriesCount,
-      _ddFlakyTestRetriesIncludesUnnamedProject: flakyTestRetriesIncludesUnnamedProject,
-      _ddFlakyTestRetriesProjectNames: flakyTestRetriesProjectNames,
-      _ddIsImpactedTestsEnabled: isImpactedTestsEnabled,
-      _ddModifiedFiles: modifiedFiles,
-      _ddTestSessionId: testSessionId,
-      _ddTestModuleId: testModuleId,
-      _ddTestCommand: testCommand,
-      _ddRepositoryRoot: repositoryRoot,
-      _ddCodeOwnersEntries: codeOwnersEntries,
-    } = globalThis.__vitest_worker__.providedContext
-
-    return {
-      isDiEnabled: _ddIsDiEnabled,
-      isEarlyFlakeDetectionEnabled: _ddIsEarlyFlakeDetectionEnabled,
-      knownTests,
-      numRepeats,
-      slowTestRetries: slowTestRetries ?? {},
-      isKnownTestsEnabled,
-      isTestManagementTestsEnabled,
-      testManagementAttemptToFixRetries,
-      testManagementTests,
-      isFlakyTestRetriesEnabled,
-      flakyTestRetriesCount: flakyTestRetriesCount ?? 0,
-      flakyTestRetriesIncludesUnnamedProject,
-      flakyTestRetriesProjectNames,
-      isImpactedTestsEnabled,
-      modifiedFiles,
-      testSessionId,
-      testModuleId,
-      testCommand,
-      repositoryRoot,
-      codeOwnersEntries,
-    }
-  } catch {
-    log.error('Vitest workers could not parse provided context, so some features will not work.')
-    return {
-      isDiEnabled: false,
-      isEarlyFlakeDetectionEnabled: false,
-      knownTests: {},
-      numRepeats: 0,
-      slowTestRetries: {},
-      isKnownTestsEnabled: false,
-      isTestManagementTestsEnabled: false,
-      testManagementAttemptToFixRetries: 0,
-      testManagementTests: {},
-      isFlakyTestRetriesEnabled: false,
-      flakyTestRetriesCount: 0,
-      flakyTestRetriesIncludesUnnamedProject: false,
-      flakyTestRetriesProjectNames: undefined,
-      isImpactedTestsEnabled: false,
-      modifiedFiles: {},
-      testSessionId: undefined,
-      testModuleId: undefined,
-      testCommand: undefined,
-      repositoryRoot: undefined,
-      codeOwnersEntries: undefined,
-    }
-  }
-}
-
-function isReporterPackage (vitestPackage) {
-  return vitestPackage.B?.name === 'BaseSequencer'
-}
-
-// from 2.0.0
-function isReporterPackageNew (vitestPackage) {
-  return vitestPackage.e?.name === 'BaseSequencer'
-}
-
-function isReporterPackageNewest (vitestPackage) {
-  return vitestPackage.h?.name === 'BaseSequencer'
-}
-
-/**
- * Finds an export by its `.name` property in a minified vitest chunk.
- * Minified export keys change across versions, so we search by function/class name.
- * @param {object} pkg - The module exports object
- * @param {string} name - The `.name` value to look for
- * @returns {{ key: string, value: Function } | undefined}
- */
-function findExportByName (pkg, name) {
-  for (const [key, value] of Object.entries(pkg)) {
-    if (value?.name === name) {
-      return { key, value }
-    }
-  }
-}
-
-function getBaseSequencerExport (vitestPackage) {
-  return findExportByName(vitestPackage, 'BaseSequencer')
-}
-
-function getChannelPromise (channelToPublishTo, frameworkVersion) {
-  return new Promise(resolve => {
-    channelToPublishTo.publish({ onDone: resolve, frameworkVersion })
-  })
-}
-
-function isCliApiPackage (vitestPackage) {
-  return !!findExportByName(vitestPackage, 'startVitest')
-}
-
-function getTestRunnerExport (testPackage) {
-  return findExportByName(testPackage, 'VitestTestRunner') || findExportByName(testPackage, 'TestRunner')
-}
-
-function getVitestExport (vitestPackage) {
-  return findExportByName(vitestPackage, 'Vitest')
-}
-
-function getForksPoolWorkerExport (vitestPackage) {
-  return findExportByName(vitestPackage, 'ForksPoolWorker')
-}
-
-function getThreadsPoolWorkerExport (vitestPackage) {
-  return findExportByName(vitestPackage, 'ThreadsPoolWorker')
-}
-
-function getSessionStatus (state) {
-  if (state.getCountOfFailedTests() > 0) {
-    return 'fail'
-  }
-  if (state.pathsSet.size === 0) {
-    return 'skip'
-  }
-  return 'pass'
-}
-
-// From https://github.com/vitest-dev/vitest/blob/51c04e2f44d91322b334f8ccbcdb368facc3f8ec/packages/runner/src/run.ts#L243-L250
-function getVitestTestStatus (test, retryCount) {
-  if (test.result.state !== 'fail' && (!test.repeats || (test.retry ?? 0) === retryCount)) {
-    return 'pass'
-  }
-  return 'fail'
-}
-
-function getTypeTasks (fileTasks, type = 'test') {
-  const typeTasks = []
-
-  function getTasks (tasks) {
-    for (const task of tasks) {
-      if (task.type === type) {
-        typeTasks.push(task)
-      } else if (task.tasks) {
-        getTasks(task.tasks)
-      }
-    }
-  }
-
-  getTasks(fileTasks)
-
-  return typeTasks
-}
-
-function getTestName (task) {
-  let testName = task.name
-  let currentTask = task.suite
-
-  while (currentTask) {
-    if (currentTask.name) {
-      testName = `${currentTask.name} ${testName}`
-    }
-    currentTask = currentTask.suite
-  }
-
-  return testName
-}
-
-function getFinalAttemptToFixStatus (task, state, isSwitchedStatus, testCtx) {
-  if (isSwitchedStatus && attemptToFixTasks.has(task) && testCtx?.status) {
-    return testCtx.status
-  }
-
-  return state === 'fail' ? 'fail' : 'pass'
-}
-
-function recordFinalAttemptToFixExecution (task, status, providedContext) {
-  const statuses = attemptToFixTaskToStatuses.get(task)
-  if (statuses && statuses.length <= providedContext.testManagementAttemptToFixRetries) {
-    statuses.push(status)
-  }
-
-  recordAttemptToFixExecution(attemptToFixExecutions, {
-    testSuite: getTestSuitePath(task.file.filepath, process.cwd()),
-    testName: getTestName(task),
-    status,
-    isDisabled: disabledTasks.has(task),
-    isQuarantined: quarantinedTasks.has(task),
-  })
-}
-
-function disableFrameworkRetries (task) {
-  task.retry = 0
-}
-
-/**
- * Vitest accumulates retry and repeat errors on one task result. The first error added since
- * the last reported attempt is the primary error for the failed attempt currently being reported.
- *
- * @param {object} task
- * @param {Array<object> | undefined} errors
- * @returns {object | undefined}
- */
-function getCurrentAttemptTestError (task, errors) {
-  if (!errors?.length) return
-
-  const previousErrorCount = taskToReportedErrorCount.get(task) ?? 0
-  const testError = errors[previousErrorCount] ?? errors[0]
-  taskToReportedErrorCount.set(task, errors.length)
-  return testError
-}
-
-/**
- * Wraps a function so it runs inside the current test span context.
- * @param {object} task
- * @param {Function} fn
- * @returns {Function}
- */
-function wrapTestScopedFn (task, fn) {
-  return shimmer.wrapFunction(fn, fn => function (...args) {
-    return testFnCh.runStores(taskToCtx.get(task), () => fn.apply(this, args))
-  })
-}
-
-/**
- * Wraps a `beforeEach` cleanup callback so it inherits the test span context.
- * Vitest allows `beforeEach` to return a cleanup function, including via a promise.
- * @param {object} task
- * @param {unknown} result
- * @returns {unknown}
- */
-function wrapBeforeEachCleanupResult (task, result) {
-  if (typeof result === 'function') {
-    return wrapTestScopedFn(task, result)
-  }
-
-  if (result && typeof result.then === 'function') {
-    return result.then(cleanupFn => wrapBeforeEachCleanupResult(task, cleanupFn))
-  }
-
-  return result
-}
-
-function getWorkspaceProject (ctx) {
-  return ctx.getCoreWorkspaceProject
-    ? ctx.getCoreWorkspaceProject()
-    : ctx.getRootProject()
-}
-
-function setProvidedContext (ctx, values, warningMessage) {
-  try {
-    Object.assign(getWorkspaceProject(ctx)._provided, values)
-  } catch {
-    log.warn(warningMessage)
-  }
-}
-
-function getTestFilepathsFromSpecifications (testSpecifications) {
-  if (!Array.isArray(testSpecifications) || !testSpecifications.length) {
-    return
-  }
-
-  return testSpecifications.map(testSpecification => {
-    const testFile = Array.isArray(testSpecification) ? testSpecification[1] : testSpecification
-    return testFile?.moduleId || testFile?.filepath || testFile
-  })
-}
-
-function getTestFilepaths (ctx, testSpecifications) {
-  const testFilepaths = getTestFilepathsFromSpecifications(testSpecifications)
-  if (testFilepaths) {
-    return testFilepaths
-  }
-
-  const getFilePaths = ctx.getTestFilepaths || ctx._globTestFilepaths
-  return getFilePaths.call(ctx)
-}
-
-function wrapCoverageProvider (ctx) {
-  const { coverageProvider } = ctx
-  if (!coverageProvider?.generateCoverage || coverageWrappedProviders.has(coverageProvider)) {
-    return
-  }
-  coverageWrappedProviders.add(coverageProvider)
-
-  // Capture coverage root directory from config (default is 'coverage' in cwd)
-  try {
-    const coverageConfig = ctx.config?.coverage
-    const reportsDirectory = coverageConfig?.reportsDirectory || 'coverage'
-    const rootDir = ctx.config?.root || process.cwd()
-    coverageRootDir = path.isAbsolute(reportsDirectory) ? reportsDirectory : path.join(rootDir, reportsDirectory)
-  } catch {
-    // Fallback to cwd if we can't get config
-    coverageRootDir = process.cwd()
-  }
-
-  shimmer.wrap(coverageProvider, 'generateCoverage', generateCoverage => async function () {
-    const totalCodeCoverage = await generateCoverage.apply(this, arguments)
-
-    try {
-      testCodeCoverageLinesTotal = totalCodeCoverage.getCoverageSummary().lines.pct
-    } catch {
-      // ignore errors
-    }
-    return totalCodeCoverage
-  })
-}
-
-function wrapSessionFinish (ctx) {
-  if (finishWrappedContexts.has(ctx)) {
-    return
-  }
-  finishWrappedContexts.add(ctx)
-
-  shimmer.wrap(ctx, 'exit', getFinishWrapper)
-  shimmer.wrap(ctx, 'close', getFinishWrapper)
-}
-
-async function runMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
-  if (!testSessionFinishCh.hasSubscribers) {
-    return
-  }
-
-  try {
-    const { err, libraryConfig } = await getChannelPromise(libraryConfigurationCh, frameworkVersion)
-    if (!err) {
-      isFlakyTestRetriesEnabled = libraryConfig.isFlakyTestRetriesEnabled
-      flakyTestRetriesCount = libraryConfig.flakyTestRetriesCount
-      isEarlyFlakeDetectionEnabled = libraryConfig.isEarlyFlakeDetectionEnabled
-      earlyFlakeDetectionNumRetries = libraryConfig.earlyFlakeDetectionNumRetries
-      earlyFlakeDetectionSlowTestRetries = libraryConfig.earlyFlakeDetectionSlowTestRetries ?? {}
-      isDiEnabled = libraryConfig.isDiEnabled
-      isKnownTestsEnabled = libraryConfig.isKnownTestsEnabled
-      isTestManagementTestsEnabled = libraryConfig.isTestManagementEnabled
-      testManagementAttemptToFixRetries = libraryConfig.testManagementAttemptToFixRetries
-      isImpactedTestsEnabled = libraryConfig.isImpactedTestsEnabled
-    }
-  } catch {
-    isFlakyTestRetriesEnabled = false
-    isEarlyFlakeDetectionEnabled = false
-    isDiEnabled = false
-    isKnownTestsEnabled = false
-    isImpactedTestsEnabled = false
-  }
-
-  if (testSessionConfigurationCh.hasSubscribers) {
-    const { testSessionId, testModuleId, testCommand, repositoryRoot, codeOwnersEntries } = await getChannelPromise(
-      testSessionConfigurationCh,
-      frameworkVersion
-    )
-    setProvidedContext(ctx, {
-      _ddTestSessionId: testSessionId,
-      _ddTestModuleId: testModuleId,
-      _ddTestCommand: testCommand,
-      _ddRepositoryRoot: repositoryRoot,
-      _ddCodeOwnersEntries: codeOwnersEntries,
-    }, 'Could not send test session configuration to workers.')
-  }
-
-  const {
-    knownTestsResponse,
-    testManagementTestsResponse,
-  } = await getTestOptimizationRequestResults({
-    isKnownTestsEnabled,
-    isTestManagementTestsEnabled,
-    getKnownTests: () => getChannelPromise(knownTestsCh),
-    getTestManagementTests: () => getChannelPromise(testManagementTestsCh),
-  })
-
-  const flakyTestRetriesConfiguration = configureFlakyTestRetries(ctx, testSpecifications)
-  if (flakyTestRetriesConfiguration) {
-    setProvidedContext(ctx, {
-      _ddIsFlakyTestRetriesEnabled: isFlakyTestRetriesEnabled,
-      _ddFlakyTestRetriesCount: flakyTestRetriesCount,
-      _ddFlakyTestRetriesIncludesUnnamedProject: flakyTestRetriesConfiguration.includesUnnamedProject,
-      _ddFlakyTestRetriesProjectNames: flakyTestRetriesConfiguration.projectNames,
-    }, 'Could not send library configuration to workers.')
-  }
-
-  if (isKnownTestsEnabled) {
-    const currentKnownTestsResponse = knownTestsResponse || await getChannelPromise(knownTestsCh)
-    if (currentKnownTestsResponse.err) {
-      isEarlyFlakeDetectionEnabled = false
-    } else {
-      const knownTests = currentKnownTestsResponse.knownTests
-      const testFilepaths = await getTestFilepaths(ctx, testSpecifications)
-
-      if (isValidKnownTests(knownTests)) {
-        isEarlyFlakeDetectionFaultyCh.publish({
-          knownTests: knownTests.vitest,
-          testFilepaths,
-          onDone: (isFaulty) => {
-            isEarlyFlakeDetectionFaulty = isFaulty
-          },
-        })
-        if (isEarlyFlakeDetectionFaulty) {
-          isEarlyFlakeDetectionEnabled = false
-          log.warn('New test detection is disabled because the number of new tests is too high.')
-        } else {
-          setProvidedContext(ctx, {
-            _ddIsKnownTestsEnabled: isKnownTestsEnabled,
-            _ddKnownTests: knownTests,
-            _ddIsEarlyFlakeDetectionEnabled: isEarlyFlakeDetectionEnabled,
-            _ddEarlyFlakeDetectionNumRetries:
-              getConfiguredEfdRetryCount(earlyFlakeDetectionSlowTestRetries, earlyFlakeDetectionNumRetries),
-            _ddEarlyFlakeDetectionSlowTestRetries: earlyFlakeDetectionSlowTestRetries,
-          }, 'Could not send known tests to workers so Early Flake Detection will not work.')
-        }
-      } else {
-        isEarlyFlakeDetectionFaulty = true
-        isEarlyFlakeDetectionEnabled = false
-      }
-    }
-  }
-
-  if (isDiEnabled) {
-    setProvidedContext(ctx, {
-      _ddIsDiEnabled: isDiEnabled,
-    }, 'Could not send Dynamic Instrumentation configuration to workers.')
-  }
-
-  if (isTestManagementTestsEnabled) {
-    const { err, testManagementTests: receivedTestManagementTests } =
-      testManagementTestsResponse || await getChannelPromise(testManagementTestsCh)
-    if (err) {
-      isTestManagementTestsEnabled = false
-      log.error('Could not get test management tests.')
-    } else {
-      setProvidedContext(ctx, {
-        _ddIsTestManagementTestsEnabled: isTestManagementTestsEnabled,
-        _ddTestManagementAttemptToFixRetries: testManagementAttemptToFixRetries,
-        _ddTestManagementTests: receivedTestManagementTests,
-      }, 'Could not send test management tests to workers so Test Management will not work.')
-    }
-  }
-
-  if (isImpactedTestsEnabled) {
-    const { err, modifiedFiles } = await getChannelPromise(modifiedFilesCh)
-    if (err) {
-      log.error('Could not get modified tests.')
-    } else {
-      setProvidedContext(ctx, {
-        _ddIsImpactedTestsEnabled: isImpactedTestsEnabled,
-        _ddModifiedFiles: modifiedFiles,
-      }, 'Could not send modified tests to workers so Impacted Tests will not work.')
-    }
-  }
-
-  wrapCoverageProvider(ctx)
-  wrapSessionFinish(ctx)
-}
-
-function ensureMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
-  let setupPromise = mainProcessSetupPromises.get(ctx)
-  if (!setupPromise) {
-    setupPromise = runMainProcessSetup(ctx, frameworkVersion, testSpecifications)
-    mainProcessSetupPromises.set(ctx, setupPromise)
-  }
-  return setupPromise
-}
-
-/**
- * Configure Vitest retries for the root project and resolved workspace projects.
- *
- * @param {object} ctx
- * @param {unknown[]|undefined} testSpecifications
- * @returns {{ projectNames: string[], includesUnnamedProject: boolean }|undefined}
- */
-function configureFlakyTestRetries (ctx, testSpecifications) {
-  if (!isFlakyTestRetriesEnabled || flakyTestRetriesCount <= 0) return
-
-  let configured = false
-  let includesUnnamedProject = false
-  const projectNames = []
-  for (const { config, projectName } of getVitestProjectConfigs(ctx, testSpecifications)) {
-    if (!config.retry) {
-      config.retry = flakyTestRetriesCount
-      configured = true
-      if (projectName) {
-        projectNames.push(projectName)
-      } else {
-        includesUnnamedProject = true
-      }
-    }
-  }
-
-  if (!configured) return
-
-  return {
-    includesUnnamedProject,
-    projectNames,
-  }
-}
-
-/**
- * Return unique Vitest configs that can be used to run tests.
- *
- * @param {object} ctx
- * @param {unknown[]|undefined} testSpecifications
- * @returns {{ config: object, projectName?: string }[]}
- */
-function getVitestProjectConfigs (ctx, testSpecifications) {
-  const entries = []
-
-  addTestSpecificationConfigs(entries, testSpecifications)
-  if (entries.length > 0) {
-    return entries
-  }
-
-  const selectedProjectNames = getSelectedProjectNames()
-  addSelectedInlineProjectConfigs(entries, safeConfig(ctx), selectedProjectNames)
-  addSelectedRuntimeProjectConfigs(entries, ctx?.projects, selectedProjectNames)
-  if (entries.length > 0) {
-    return entries
-  }
-
-  if (Array.isArray(ctx?.projects)) {
-    for (const project of ctx.projects) {
-      addConfig(entries, safeConfig(project), getProjectName(project))
-    }
-    if (entries.length > 0) {
-      return entries
-    }
-  }
-
-  addConfig(entries, safeConfig(ctx))
-  addConfig(entries, safeConfig(safeWorkspaceProject(ctx)))
-
-  return entries
-}
-
-/**
- * Add configs from runnable test specifications once.
- *
- * @param {{ config: object, projectName?: string }[]} entries
- * @param {unknown[]|undefined} testSpecifications
- */
-function addTestSpecificationConfigs (entries, testSpecifications) {
-  if (!Array.isArray(testSpecifications)) return
-
-  for (const testSpecification of testSpecifications) {
-    const project = getTestSpecificationProject(testSpecification)
-    addConfig(entries, safeConfig(project), getProjectName(project))
-  }
-}
-
-/**
- * Add selected inline project configs from the root Vitest config once.
- *
- * @param {{ config: object, projectName?: string }[]} entries
- * @param {object|undefined} rootConfig
- * @param {string[]} selectedProjectNames
- */
-function addSelectedInlineProjectConfigs (entries, rootConfig, selectedProjectNames) {
-  if (selectedProjectNames.length === 0 || !Array.isArray(rootConfig?.projects)) return
-
-  for (const project of rootConfig.projects) {
-    const config = getInlineProjectConfig(project)
-    const projectName = getProjectName(project)
-    if (selectedProjectNames.includes(projectName)) {
-      addConfig(entries, config, projectName)
-    }
-  }
-}
-
-/**
- * Add selected resolved project configs once.
- *
- * @param {{ config: object, projectName?: string }[]} entries
- * @param {unknown[]|undefined} projects
- * @param {string[]} selectedProjectNames
- */
-function addSelectedRuntimeProjectConfigs (entries, projects, selectedProjectNames) {
-  if (selectedProjectNames.length === 0 || !Array.isArray(projects)) return
-
-  for (const project of projects) {
-    const projectName = getProjectName(project)
-    if (selectedProjectNames.includes(projectName)) {
-      addConfig(entries, safeConfig(project), projectName)
-    }
-  }
-}
-
-/**
- * Return selected project names from the Vitest CLI arguments.
- *
- * @returns {string[]}
- */
-function getSelectedProjectNames () {
-  const names = []
-  for (let index = 0; index < process.argv.length; index++) {
-    const argument = process.argv[index]
-    if (argument === '--project' && process.argv[index + 1]) {
-      names.push(process.argv[index + 1])
-      index++
-    } else if (argument.startsWith('--project=')) {
-      names.push(argument.slice('--project='.length))
-    }
-  }
-  return names
-}
-
-/**
- * Return the test config from an inline Vitest project entry.
- *
- * @param {unknown} project
- * @returns {object|undefined}
- */
-function getInlineProjectConfig (project) {
-  return project?.test || project
-}
-
-/**
- * Return a Vitest project name from runtime or inline project objects.
- *
- * @param {unknown} project
- * @returns {string|undefined}
- */
-function getProjectName (project) {
-  return normalizeProjectName(project?.name || project?.config?.name || project?.test?.name)
-}
-
-/**
- * Return a normalized Vitest project name.
- *
- * @param {unknown} name
- * @returns {string|undefined}
- */
-function normalizeProjectName (name) {
-  if (typeof name === 'string') return name
-
-  const label = name?.label
-  return typeof label === 'string' ? label : undefined
-}
-
-/**
- * Add a config object once.
- *
- * @param {{ config: object, projectName?: string }[]} entries
- * @param {object|undefined} config
- * @param {string|undefined} projectName
- */
-function addConfig (entries, config, projectName) {
-  if (config && !entries.some(entry => entry.config === config || (projectName && entry.projectName === projectName))) {
-    entries.push({ config, projectName })
-  }
-}
-
-/**
- * Read a Vitest config object without assuming the project is initialized.
- *
- * @param {object|undefined} project
- * @returns {object|undefined}
- */
-function safeConfig (project) {
-  let config
-  try {
-    config = project?.config
-  } catch {}
-  return config
-}
-
-/**
- * Read the workspace project without assuming the root server is initialized.
- *
- * @param {object} ctx
- * @returns {object|undefined}
- */
-function safeWorkspaceProject (ctx) {
-  let project
-  try {
-    project = getWorkspaceProject(ctx)
-  } catch {}
-  return project
-}
-
-/**
- * Return whether Datadog configured ATR retries for a task.
- *
- * @param {object} providedContext
- * @param {object} task
- * @returns {boolean}
- */
-function isFlakyTestRetriesEnabledForTask (providedContext, task) {
-  if (!providedContext.isFlakyTestRetriesEnabled) return false
-
-  const { flakyTestRetriesProjectNames } = providedContext
-  if (!Array.isArray(flakyTestRetriesProjectNames)) return true
-
-  const projectName = task.file?.projectName
-  if (!projectName) {
-    return providedContext.flakyTestRetriesIncludesUnnamedProject === true
-  }
-
-  return flakyTestRetriesProjectNames.includes(projectName)
-}
-
-function getSortWrapper (sort, frameworkVersion) {
-  return async function () {
-    await ensureMainProcessSetup(this.ctx, frameworkVersion, arguments[0])
-    return sort.apply(this, arguments)
-  }
-}
-
-function getFinishWrapper (exitOrClose) {
-  let isClosed = false
-  return async function () {
-    if (isClosed) { // needed because exit calls close
-      return exitOrClose.apply(this, arguments)
-    }
-    isClosed = true
-
-    if (!testSessionFinishCh.hasSubscribers) {
-      return exitOrClose.apply(this, arguments)
-    }
-
-    let onFinish
-
-    const flushPromise = new Promise(resolve => {
-      onFinish = resolve
-    })
-    const failedSuites = this.state.getFailedFilepaths()
-    let error
-    if (failedSuites.length) {
-      error = new Error(`Test suites failed: ${failedSuites.length}.`)
-    }
-
-    testSessionFinishCh.publish({
-      status: getSessionStatus(this.state),
-      testCodeCoverageLinesTotal,
-      error,
-      isEarlyFlakeDetectionEnabled,
-      isEarlyFlakeDetectionFaulty,
-      isTestManagementTestsEnabled,
-      vitestPool,
-      onFinish,
-    })
-
-    logTestOptimizationSummary({ attemptToFixExecutions, newTestsWithDynamicNames })
-    loggedAttemptToFixTests.clear()
-
-    await flushPromise
-
-    // If coverage was generated, publish coverage report channel for upload
-    if (coverageRootDir && codeCoverageReportCh.hasSubscribers) {
-      await new Promise((resolve) => {
-        codeCoverageReportCh.publish({ rootDir: coverageRootDir, onDone: resolve })
-      })
-    }
-
-    return exitOrClose.apply(this, arguments)
-  }
+if (getEnvironmentVariable('DD_VITEST_WORKER') === '1') {
+  require('./vitest-worker')
+} else {
+  require('./vitest-main')
 }
-
-function getCliOrStartVitestWrapper (frameworkVersion) {
-  return function (oldCliOrStartVitest) {
-    return function (...args) {
-      if (!testSessionStartCh.hasSubscribers || isSessionStarted) {
-        return oldCliOrStartVitest.apply(this, args)
-      }
-      isSessionStarted = true
-      testSessionStartCh.publish({ command: getTestCommand(), frameworkVersion })
-      return oldCliOrStartVitest.apply(this, args)
-    }
-  }
-}
-
-function isForkPool (pool) {
-  return pool === 'forks' || pool === 'vmForks'
-}
-
-function isThreadPool (pool) {
-  return pool === 'threads' || pool === 'vmThreads'
-}
-
-function isVitestWorkerPool (pool) {
-  return isForkPool(pool) || isThreadPool(pool)
-}
-
-/**
- * Return the project object attached to a Vitest test specification.
- *
- * @param {unknown} testSpecification
- * @returns {object|undefined}
- */
-function getTestSpecificationProject (testSpecification) {
-  if (Array.isArray(testSpecification)) {
-    return testSpecification[0]
-  }
-  return testSpecification?.project
-}
-
-function getTestSpecificationPool (testSpecification) {
-  const project = getTestSpecificationProject(testSpecification)
-  return project?.config?.pool || project?.serializedConfig?.pool || project?.pool || testSpecification?.pool
-}
-
-function hasVitestWorkerPoolTestSpecification (testSpecifications) {
-  if (!Array.isArray(testSpecifications)) {
-    return false
-  }
-
-  for (const testSpecification of testSpecifications) {
-    if (isVitestWorkerPool(getTestSpecificationPool(testSpecification))) {
-      return true
-    }
-  }
-
-  return false
-}
-
-function shouldMarkVitestWorkerEnv (pool, testSpecifications) {
-  return isVitestWorkerPool(pool) || hasVitestWorkerPoolTestSpecification(testSpecifications) ||
-    (!testSpecifications && pool === undefined)
-}
-
-function markVitestWorkerEnv (ctx, testSpecifications) {
-  const config = ctx?.config
-  if (!config || !shouldMarkVitestWorkerEnv(config.pool, testSpecifications)) {
-    return
-  }
-  config.env = config.env || {}
-  config.env.DD_VITEST_WORKER = '1'
-}
-
-function wrapVitestRunFiles (Vitest, frameworkVersion) {
-  if (!Vitest?.prototype?.runFiles) {
-    return
-  }
-
-  shimmer.wrap(Vitest.prototype, 'runFiles', runFiles => async function (testSpecifications) {
-    markVitestWorkerEnv(this, testSpecifications)
-    await ensureMainProcessSetup(this, frameworkVersion, testSpecifications)
-    return runFiles.apply(this, arguments)
-  })
-
-  if (Vitest.prototype.collectTests) {
-    shimmer.wrap(Vitest.prototype, 'collectTests', collectTests => function () {
-      markVitestWorkerEnv(this)
-      return collectTests.apply(this, arguments)
-    })
-  }
-}
-
-function getCreateCliWrapper (vitestPackage, frameworkVersion) {
-  const createCliExport = findExportByName(vitestPackage, 'createCLI')
-  if (!createCliExport) {
-    return vitestPackage
-  }
-  shimmer.wrap(vitestPackage, createCliExport.key, getCliOrStartVitestWrapper(frameworkVersion))
-
-  return vitestPackage
-}
-
-function threadHandler (thread) {
-  const { runtime } = thread
-  let workerProcess
-  if (runtime === 'child_process') {
-    vitestPool = 'child_process'
-    workerProcess = thread.process
-  } else if (runtime === 'worker_threads') {
-    vitestPool = 'worker_threads'
-    workerProcess = thread.thread
-  } else {
-    vitestPool = 'unknown'
-  }
-  if (!workerProcess) {
-    log.error('Vitest error: could not get process or thread from TinyPool#run')
-    return
-  }
-
-  if (workerProcesses.has(workerProcess)) {
-    return
-  }
-  workerProcesses.add(workerProcess)
-  workerProcess.on('message', (message) => {
-    if (message.__tinypool_worker_message__ && message.data) {
-      handleWorkerReport(message.interprocessCode, message.data)
-    }
-  })
-}
-
-function isVitestTinypoolOptions (options) {
-  if (options?.env?.VITEST !== 'true' || typeof options.filename !== 'string') return false
-
-  let filename = options.filename
-  if (filename.startsWith('file:')) {
-    try {
-      filename = fileURLToPath(filename)
-    } catch {
-      return false
-    }
-  }
-
-  const workerPath = path.normalize(filename)
-  const workerDir = path.dirname(workerPath)
-  const packageDir = path.dirname(workerDir)
-
-  return path.basename(workerPath) === 'worker.js' &&
-    path.basename(workerDir) === 'dist' &&
-    path.basename(packageDir) === 'vitest'
-}
-
-function markVitestTinypoolOptions (options) {
-  if (!isVitestTinypoolOptions(options)) return
-
-  options.env.DD_VITEST_WORKER = '1'
-}
-
-function wrapTinyPoolRun (TinyPool) {
-  if (!TinyPool?.prototype?.run) return
-
-  shimmer.wrap(TinyPool.prototype, 'run', run => async function () {
-    // We have to do this before and after because the threads list gets recycled, that is, the processes are re-created
-    // eslint-disable-next-line unicorn/no-array-for-each
-    this.threads.forEach(threadHandler)
-    const runResult = await run.apply(this, arguments)
-    // eslint-disable-next-line unicorn/no-array-for-each
-    this.threads.forEach(threadHandler)
-    return runResult
-  })
-}
-
-function wrapTinyPoolClass (TinyPool) {
-  if (typeof TinyPool !== 'function') return TinyPool
-
-  const wrappedTinyPool = tinyPoolClassWrappers.get(TinyPool)
-  if (wrappedTinyPool) return wrappedTinyPool
-
-  class DatadogTinyPool extends TinyPool {
-    constructor (options) {
-      markVitestTinypoolOptions(options)
-      super(options)
-    }
-  }
-
-  tinyPoolClassWrappers.set(TinyPool, DatadogTinyPool)
-  wrapTinyPoolRun(DatadogTinyPool)
-
-  return DatadogTinyPool
-}
-
-function wrapTinyPool (TinyPool) {
-  if (typeof TinyPool === 'function') {
-    return wrapTinyPoolClass(TinyPool)
-  }
-
-  const defaultTinyPool = wrapTinyPoolClass(TinyPool?.default)
-  if (defaultTinyPool) {
-    TinyPool.default = defaultTinyPool
-  }
-
-  const namedTinyPool = TinyPool?.Tinypool === TinyPool?.default
-    ? defaultTinyPool
-    : wrapTinyPoolClass(TinyPool?.Tinypool)
-  if (namedTinyPool) {
-    TinyPool.Tinypool = namedTinyPool
-  }
-
-  return TinyPool
-}
-
-addHook({
-  name: 'tinypool',
-  // version from tinypool@0.8 was used in vitest@1.6.0
-  versions: ['>=0.8.0'],
-}, (TinyPool) => {
-  return wrapTinyPool(TinyPool)
-})
-
-function getWrappedOn (on) {
-  return function (event, callback) {
-    if (event !== 'message') {
-      return on.apply(this, arguments)
-    }
-    // `arguments[1]` is the callback function, which
-    // we modify to intercept our messages to not interfere
-    // with vitest's own messages
-    arguments[1] = shimmer.wrapFunction(callback, callback => function (message) {
-      if (message.type !== 'Buffer' && Array.isArray(message)) {
-        const [interprocessCode, data] = message
-        if (handleWorkerReport(interprocessCode, data)) {
-          // If we execute the callback vitest crashes, as the message is not supported
-          return
-        }
-      }
-      return callback.apply(this, arguments)
-    })
-    return on.apply(this, arguments)
-  }
-}
-
-function handleWorkerReport (interprocessCode, data) {
-  if (interprocessCode === VITEST_WORKER_TRACE_PAYLOAD_CODE) {
-    collectTestOptimizationSummariesFromTraces(data, {
-      newTestsWithDynamicNames,
-      attemptToFixExecutions,
-    })
-    workerReportTraceCh.publish(data)
-    return true
-  }
-
-  if (interprocessCode === VITEST_WORKER_LOGS_PAYLOAD_CODE) {
-    workerReportLogsCh.publish(data)
-    return true
-  }
-
-  return false
-}
-
-function wrapMessagePortOn () {
-  if (isMessagePortWrapped) return
-
-  isMessagePortWrapped = true
-  shimmer.wrap(MessagePort.prototype, 'on', getWrappedOn)
-  shimmer.wrap(MessagePort.prototype, 'addListener', getWrappedOn)
-}
-
-function getStartVitestWrapper (cliApiPackage, frameworkVersion) {
-  if (!isCliApiPackage(cliApiPackage)) {
-    return cliApiPackage
-  }
-  const startVitestExport = findExportByName(cliApiPackage, 'startVitest')
-  shimmer.wrap(cliApiPackage, startVitestExport.key, getCliOrStartVitestWrapper(frameworkVersion))
-  wrapMessagePortOn()
-
-  const vitest = getVitestExport(cliApiPackage)
-  if (vitest) {
-    wrapVitestRunFiles(vitest.value, frameworkVersion)
-  }
-
-  const forksPoolWorker = getForksPoolWorkerExport(cliApiPackage)
-  if (forksPoolWorker) {
-    // function is async
-    shimmer.wrap(forksPoolWorker.value.prototype, 'start', start => function (...args) {
-      vitestPool = 'child_process'
-      this.env.DD_VITEST_WORKER = '1'
-
-      return start.apply(this, args)
-    })
-    shimmer.wrap(forksPoolWorker.value.prototype, 'on', getWrappedOn)
-  }
-
-  const threadsPoolWorker = getThreadsPoolWorkerExport(cliApiPackage)
-  if (threadsPoolWorker) {
-    // function is async
-    shimmer.wrap(threadsPoolWorker.value.prototype, 'start', start => function (...args) {
-      vitestPool = 'worker_threads'
-      this.env.DD_VITEST_WORKER = '1'
-      return start.apply(this, args)
-    })
-    shimmer.wrap(threadsPoolWorker.value.prototype, 'on', getWrappedOn)
-  }
-  return cliApiPackage
-}
-
-function wrapVitestTestRunner (VitestTestRunner) {
-  // `onBeforeRunTask` is run before any repetition or attempt is run
-  // `onBeforeRunTask` is an async function
-  shimmer.wrap(VitestTestRunner.prototype, 'onBeforeRunTask', onBeforeRunTask => function (task) {
-    const testName = getTestName(task)
-
-    const {
-      knownTests,
-      isEarlyFlakeDetectionEnabled,
-      isKnownTestsEnabled,
-      numRepeats,
-      isTestManagementTestsEnabled,
-      testManagementAttemptToFixRetries,
-      testManagementTests,
-      isImpactedTestsEnabled,
-      modifiedFiles,
-    } = getProvidedContext()
-
-    if (isTestManagementTestsEnabled) {
-      isAttemptToFixCh.publish({
-        testManagementTests,
-        testSuiteAbsolutePath: task.file.filepath,
-        testName,
-        onDone: (isAttemptToFix) => {
-          if (isAttemptToFix) {
-            isRetryReasonAttemptToFix = task.repeats !== testManagementAttemptToFixRetries
-            disableFrameworkRetries(task)
-            task.repeats = testManagementAttemptToFixRetries
-            attemptToFixTasks.add(task)
-            attemptToFixTaskToStatuses.set(task, [])
-          }
-        },
-      })
-      isDisabledCh.publish({
-        testManagementTests,
-        testSuiteAbsolutePath: task.file.filepath,
-        testName,
-        onDone: (isTestDisabled) => {
-          if (isTestDisabled) {
-            disabledTasks.add(task)
-            if (!attemptToFixTasks.has(task)) {
-              // we only actually skip if the test is not being attempted to be fixed
-              task.mode = 'skip'
-            }
-          }
-        },
-      })
-    }
-
-    if (isImpactedTestsEnabled) {
-      isModifiedCh.publish({
-        modifiedFiles,
-        testSuiteAbsolutePath: task.file.filepath,
-        onDone: (isImpacted) => {
-          if (isImpacted) {
-            if (isEarlyFlakeDetectionEnabled) {
-              isRetryReasonEfd = true
-              disableFrameworkRetries(task)
-              task.repeats = numRepeats
-            }
-            modifiedTasks.add(task)
-            taskToStatuses.set(task, [])
-          }
-        },
-      })
-    }
-
-    if (isKnownTestsEnabled) {
-      isNewTestCh.publish({
-        knownTests,
-        testSuiteAbsolutePath: task.file.filepath,
-        testName,
-        onDone: (isNew) => {
-          if (isNew && !attemptToFixTasks.has(task)) {
-            if (isEarlyFlakeDetectionEnabled && !modifiedTasks.has(task)) {
-              isRetryReasonEfd = true
-              disableFrameworkRetries(task)
-              task.repeats = numRepeats
-            }
-            newTasks.add(task)
-            taskToStatuses.set(task, [])
-            if (DYNAMIC_NAME_RE.test(testName)) {
-              dynamicNameTasks.add(task)
-            }
-          }
-        },
-      })
-    }
-
-    return onBeforeRunTask.apply(this, arguments)
-  })
-
-  // `onAfterRunTask` is run after all repetitions or attempts are run
-  // `onAfterRunTask` is an async function
-  shimmer.wrap(VitestTestRunner.prototype, 'onAfterRunTask', onAfterRunTask => function (task) {
-    const { isEarlyFlakeDetectionEnabled, isTestManagementTestsEnabled } = getProvidedContext()
-
-    if (isTestManagementTestsEnabled) {
-      const isAttemptingToFix = attemptToFixTasks.has(task)
-      const isQuarantined = quarantinedTasks.has(task)
-
-      if (isAttemptingToFix) {
-        const statuses = attemptToFixTaskToStatuses.get(task)
-        if (task.result.state === 'pass' && statuses?.includes('fail')) {
-          switchedStatuses.add(task)
-          task.result.state = 'fail'
-        }
-      }
-
-      if (!isAttemptingToFix && isQuarantined) {
-        if (task.result.state === 'fail') {
-          switchedStatuses.add(task)
-        }
-        task.result.state = 'pass'
-      }
-    }
-
-    if (isEarlyFlakeDetectionEnabled && taskToStatuses.has(task) && !attemptToFixTasks.has(task)) {
-      const statuses = taskToStatuses.get(task)
-      // If the test has passed at least once, we consider it passed
-      if (statuses.includes('pass')) {
-        if (task.result.state === 'fail') {
-          switchedStatuses.add(task)
-        }
-        task.result.state = 'pass'
-      }
-    }
-
-    return onAfterRunTask.apply(this, arguments)
-  })
-
-  // test start (only tests that are not marked as skip or todo)
-  // `onBeforeTryTask` is run for every repetition and attempt of the test
-  shimmer.wrap(VitestTestRunner.prototype, 'onBeforeTryTask', onBeforeTryTask => async function (task, retryInfo) {
-    if (!testPassCh.hasSubscribers && !testErrorCh.hasSubscribers && !testSkipCh.hasSubscribers) {
-      return onBeforeTryTask.apply(this, arguments)
-    }
-    const testName = getTestName(task)
-    let isNew = false
-    let isQuarantined = false
-
-    const providedContext = getProvidedContext()
-    const {
-      isKnownTestsEnabled,
-      isEarlyFlakeDetectionEnabled,
-      isDiEnabled,
-      isTestManagementTestsEnabled,
-      testManagementTests,
-      slowTestRetries,
-    } = providedContext
-
-    if (isKnownTestsEnabled) {
-      isNew = newTasks.has(task)
-    }
-
-    if (isTestManagementTestsEnabled) {
-      isQuarantinedCh.publish({
-        testManagementTests,
-        testSuiteAbsolutePath: task.file.filepath,
-        testName,
-        onDone: (isTestQuarantined) => {
-          isQuarantined = isTestQuarantined
-          if (isTestQuarantined) {
-            quarantinedTasks.add(task)
-          }
-        },
-      })
-    }
-
-    const { retry: numAttempt, repeats: numRepetition } = retryInfo
-    const isEfdManagedTask = isEarlyFlakeDetectionEnabled && taskToStatuses.has(task) && !attemptToFixTasks.has(task)
-
-    if (isEfdManagedTask && numRepetition > 0 && !efdDeterminedRetries.has(task)) {
-      const previousExecutionStart = efdExecutionStartByTask.get(task)
-      const duration = previousExecutionStart === undefined
-        ? task.result?.duration ?? 0
-        : performance.now() - previousExecutionStart
-      const retryCount = getEfdRetryCount(duration, slowTestRetries)
-      efdDeterminedRetries.set(task, retryCount)
-      task.repeats = retryCount
-      if (retryCount === 0) {
-        efdSlowAbortedTasks.add(task)
-      }
-    }
-
-    const efdRetryCount = efdDeterminedRetries.get(task)
-    if (isEfdManagedTask && efdRetryCount !== undefined && numRepetition > efdRetryCount) {
-      if (task.result) {
-        efdSkippedRetryResults.set(task, {
-          ...task.result,
-          errors: task.result.errors?.slice(),
-        })
-      }
-      if (vitestSetFn) {
-        const noop = function () {}
-        noop.__ddTraceWrapped = true
-        vitestSetFn(task, noop)
-      }
-      return onBeforeTryTask.apply(this, arguments)
-    }
-    if (isEfdManagedTask) {
-      efdExecutionStartByTask.set(task, performance.now())
-    }
-
-    // We finish the previous test here because we know it has failed already
-    if (numAttempt > 0) {
-      const shouldWaitForHitProbe = isDiEnabled && numAttempt > 1
-      if (shouldWaitForHitProbe) {
-        await waitForHitProbe()
-      }
-
-      const promises = {}
-      const shouldSetProbe = isDiEnabled && numAttempt === 1
-      const ctx = taskToCtx.get(task)
-      const testError = getCurrentAttemptTestError(task, task.result?.errors)
-      if (ctx) {
-        testErrorCh.publish({
-          error: testError,
-          shouldSetProbe,
-          promises,
-          ...ctx.currentStore,
-        })
-        // We wait for the probe to be set
-        if (promises.setProbePromise) {
-          await promises.setProbePromise
-        }
-      }
-    }
-
-    const lastExecutionStatus = task.result.state
-    const isAtf = attemptToFixTasks.has(task)
-    const shouldTrackStatuses = isEarlyFlakeDetectionEnabled || isAtf
-    const shouldFlipStatus = isEarlyFlakeDetectionEnabled || isAtf
-    const statuses = isAtf ? attemptToFixTaskToStatuses.get(task) : taskToStatuses.get(task)
-
-    // These clauses handle task.repeats, whether EFD is enabled or not
-    // The only thing that EFD does is to forcefully pass the test if it has passed at least once
-    if (numRepetition > 0 && numRepetition < task.repeats) { // it may or may have not failed
-      // Here we finish the earlier iteration,
-      // as long as it's not the _last_ iteration (which will be finished normally)
-
-      const ctx = taskToCtx.get(task)
-      if (ctx) {
-        if (lastExecutionStatus === 'fail') {
-          const testError = getCurrentAttemptTestError(task, task.result?.errors)
-          testErrorCh.publish({ error: testError, ...ctx.currentStore })
-        } else {
-          testPassCh.publish({ task, ...ctx.currentStore })
-        }
-        if (shouldTrackStatuses && statuses) {
-          statuses.push(lastExecutionStatus)
-        }
-        if (shouldFlipStatus) {
-          // If we don't "reset" the result.state to "pass", once a repetition fails,
-          // vitest will always consider the test as failed, so we can't read the actual status
-          // This means that we change vitest's behavior:
-          // if the last attempt passes, vitest would consider the test as failed
-          // but after this change, it will consider the test as passed
-          task.result.state = 'pass'
-        }
-      }
-    } else if (numRepetition === task.repeats) {
-      if (shouldTrackStatuses && statuses) {
-        statuses.push(lastExecutionStatus)
-      }
-
-      const ctx = taskToCtx.get(task)
-      if (lastExecutionStatus === 'fail') {
-        const testError = getCurrentAttemptTestError(task, task.result?.errors)
-        testErrorCh.publish({ error: testError, ...ctx.currentStore })
-      } else {
-        testPassCh.publish({ task, ...ctx.currentStore })
-      }
-      if (shouldFlipStatus) {
-        task.result.state = 'pass'
-      }
-    }
-
-    const isRetryReasonAtr = numAttempt > 0 &&
-      isFlakyTestRetriesEnabledForTask(providedContext, task) &&
-      !isRetryReasonAttemptToFix &&
-      !isRetryReasonEfd
-
-    const ctx = {
-      testName,
-      testSuiteAbsolutePath: task.file.filepath,
-      isRetry: numAttempt > 0 || numRepetition > 0,
-      isRetryReasonEfd,
-      isRetryReasonAttemptToFix: isRetryReasonAttemptToFix && numRepetition > 0,
-      isNew,
-      hasDynamicName: dynamicNameTasks.has(task),
-      mightHitProbe: isDiEnabled && numAttempt > 0,
-      isAttemptToFix: attemptToFixTasks.has(task),
-      isDisabled: disabledTasks.has(task),
-      isQuarantined,
-      isRetryReasonAtr,
-      isModified: modifiedTasks.has(task),
-    }
-    taskToCtx.set(task, ctx)
-
-    if (attemptToFixTasks.has(task)) {
-      logAttemptToFixTestExecution(
-        getTestSuitePath(task.file.filepath, process.cwd()),
-        testName,
-        loggedAttemptToFixTests
-      )
-    }
-
-    testStartCh.runStores(ctx, () => {})
-
-    // Wrap the test function so it runs inside the test span context.
-    // Without this, HTTP requests during test execution become orphaned root spans.
-    if (vitestGetFn && vitestSetFn) {
-      const originalFn = vitestGetFn(task)
-      if (originalFn && !originalFn.__ddTraceWrapped) {
-        const wrappedFn = wrapTestScopedFn(task, originalFn)
-        wrappedFn.__ddTraceWrapped = true
-        vitestSetFn(task, wrappedFn)
-      }
-    }
-
-    // Wrap beforeEach/afterEach hooks so they also run inside the test span context.
-    // In vitest 4+, hooks are in a WeakMap accessed via getHooks(). In older versions, they're on suite.hooks.
-    let currentSuite = task.suite
-    while (currentSuite) {
-      const hooks = vitestGetHooks ? vitestGetHooks(currentSuite) : currentSuite.hooks
-      if (hooks) {
-        for (const hookType of ['beforeEach', 'afterEach']) {
-          const hookArray = hooks[hookType]
-          if (!hookArray) continue
-          for (let i = 0; i < hookArray.length; i++) {
-            const currentFn = hookArray[i]
-            const originalFn = originalHookFns.get(currentFn) || currentFn
-            const wrappedFn = shimmer.wrapFunction(originalFn, fn => function (...args) {
-              const result = testFnCh.runStores(taskToCtx.get(task), () => fn.apply(this, args))
-
-              if (hookType === 'beforeEach') {
-                return wrapBeforeEachCleanupResult(task, result)
-              }
-
-              return result
-            })
-            originalHookFns.set(wrappedFn, originalFn)
-            hookArray[i] = wrappedFn
-          }
-        }
-      }
-      currentSuite = currentSuite.suite
-    }
-
-    return onBeforeTryTask.apply(this, arguments)
-  })
-
-  // test finish (only passed tests)
-  shimmer.wrap(VitestTestRunner.prototype, 'onAfterTryTask', onAfterTryTask =>
-    async function (task, retryInfo) {
-      if (!testPassCh.hasSubscribers && !testErrorCh.hasSubscribers && !testSkipCh.hasSubscribers) {
-        return onAfterTryTask.apply(this, arguments)
-      }
-      const result = await onAfterTryTask.apply(this, arguments)
-
-      const {
-        isEarlyFlakeDetectionEnabled,
-        testManagementAttemptToFixRetries,
-        slowTestRetries,
-      } = getProvidedContext()
-
-      const status = getVitestTestStatus(task, retryInfo.retry)
-      const ctx = taskToCtx.get(task)
-
-      const { isDiEnabled } = getProvidedContext()
-
-      if (efdSkippedRetryResults.has(task)) {
-        task.result = efdSkippedRetryResults.get(task)
-        efdSkippedRetryResults.delete(task)
-        return result
-      }
-
-      if (isDiEnabled && retryInfo.retry > 1) {
-        await waitForHitProbe()
-      }
-
-      if (
-        isEarlyFlakeDetectionEnabled &&
-        (retryInfo.repeats ?? 0) === 0 &&
-        taskToStatuses.has(task) &&
-        !attemptToFixTasks.has(task) &&
-        !efdDeterminedRetries.has(task)
-      ) {
-        const executionStart = efdExecutionStartByTask.get(task)
-        const duration = executionStart === undefined ? task.result?.duration ?? 0 : performance.now() - executionStart
-        const retryCount = getEfdRetryCount(duration, slowTestRetries)
-        efdDeterminedRetries.set(task, retryCount)
-        task.repeats = retryCount
-        if (retryCount === 0) {
-          efdSlowAbortedTasks.add(task)
-        }
-      }
-
-      let attemptToFixPassed = false
-      let attemptToFixFailed = false
-      if (attemptToFixTasks.has(task)) {
-        const statuses = attemptToFixTaskToStatuses.get(task)
-        if (statuses.length === testManagementAttemptToFixRetries) {
-          if (status === 'pass' && statuses.every(status => status === 'pass')) {
-            attemptToFixPassed = true
-          } else if (status === 'fail' || statuses.includes('fail')) {
-            attemptToFixFailed = true
-          }
-        }
-      }
-
-      if (ctx) {
-        // We don't finish here because the test might fail in a later hook (afterEach)
-        ctx.status = status
-        ctx.task = task
-        ctx.attemptToFixPassed = attemptToFixPassed
-        ctx.attemptToFixFailed = attemptToFixFailed
-        testFinishTimeCh.runStores(ctx, () => {})
-      }
-
-      return result
-    })
-}
-
-function captureRunnerFunctions (pkg) {
-  if (vitestGetFn) return
-  const getFnExport = findExportByName(pkg, 'getFn')
-  const setFnExport = findExportByName(pkg, 'setFn')
-  if (getFnExport && setFnExport) {
-    vitestGetFn = getFnExport.value
-    vitestSetFn = setFnExport.value
-  }
-  const getHooksExport = findExportByName(pkg, 'getHooks')
-  if (getHooksExport) {
-    vitestGetHooks = getHooksExport.value
-  }
-}
-
-addHook({
-  name: 'vitest',
-  versions: ['>=4.0.0'],
-  filePattern: 'dist/chunks/test.*',
-}, (testPackage) => {
-  const testRunner = getTestRunnerExport(testPackage)
-  if (!testRunner) {
-    return testPackage
-  }
-
-  captureRunnerFunctions(testPackage)
-  wrapVitestTestRunner(testRunner.value)
-
-  return testPackage
-})
-
-addHook({
-  name: '@vitest/runner',
-  versions: ['>=1.6.0'],
-}, (runnerModule) => {
-  if (!vitestGetFn && runnerModule.getFn && runnerModule.setFn) {
-    vitestGetFn = runnerModule.getFn
-    vitestSetFn = runnerModule.setFn
-  }
-  if (!vitestGetHooks && runnerModule.getHooks) {
-    vitestGetHooks = runnerModule.getHooks
-  }
-  return runnerModule
-})
-
-addHook({
-  name: 'vitest',
-  versions: ['>=1.6.0 <4.0.0'],
-  file: 'dist/runners.js',
-}, (vitestPackage) => {
-  const { VitestTestRunner } = vitestPackage
-
-  wrapVitestTestRunner(VitestTestRunner)
-
-  return vitestPackage
-})
-
-// There are multiple index* files across different versions of vitest,
-// so we check for the existence of BaseSequencer to determine if we are in the right file
-addHook({
-  name: 'vitest',
-  versions: ['>=1.6.0 <2.0.0'],
-  filePattern: 'dist/vendor/index.*',
-}, (vitestPackage) => {
-  if (isReporterPackage(vitestPackage)) {
-    shimmer.wrap(vitestPackage.B.prototype, 'sort', getSortWrapper)
-  }
-
-  return vitestPackage
-})
-
-addHook({
-  name: 'vitest',
-  versions: ['>=2.0.0 <2.0.5'],
-  filePattern: 'dist/vendor/index.*',
-}, (vitestPackage) => {
-  if (isReporterPackageNew(vitestPackage)) {
-    shimmer.wrap(vitestPackage.e.prototype, 'sort', getSortWrapper)
-  }
-
-  return vitestPackage
-})
-
-addHook({
-  name: 'vitest',
-  versions: ['>=2.0.5 <2.1.0'],
-  filePattern: 'dist/chunks/index.*',
-}, (vitestPackage) => {
-  if (isReporterPackageNewest(vitestPackage)) {
-    shimmer.wrap(vitestPackage.h.prototype, 'sort', getSortWrapper)
-  }
-
-  return vitestPackage
-})
-
-addHook({
-  name: 'vitest',
-  versions: ['>=2.1.0 <3.0.0'],
-  filePattern: 'dist/chunks/RandomSequencer.*',
-}, (randomSequencerPackage) => {
-  shimmer.wrap(randomSequencerPackage.B.prototype, 'sort', getSortWrapper)
-  return randomSequencerPackage
-})
-
-addHook({
-  name: 'vitest',
-  versions: ['>=3.0.9'],
-  filePattern: 'dist/chunks/coverage.*',
-}, (coveragePackage) => {
-  const baseSequencer = getBaseSequencerExport(coveragePackage)
-  if (baseSequencer) {
-    shimmer.wrap(baseSequencer.value.prototype, 'sort', getSortWrapper)
-  }
-  return coveragePackage
-})
-
-addHook({
-  name: 'vitest',
-  versions: ['>=3.0.0 <3.0.9'],
-  filePattern: 'dist/chunks/resolveConfig.*',
-}, (resolveConfigPackage) => {
-  shimmer.wrap(resolveConfigPackage.B.prototype, 'sort', getSortWrapper)
-  return resolveConfigPackage
-})
-
-// Can't specify file because compiled vitest includes hashes in their files
-// Following 3 wrappers are for test session start
-addHook({
-  name: 'vitest',
-  versions: ['>=1.6.0 <2.0.5'],
-  filePattern: 'dist/vendor/cac.*',
-}, getCreateCliWrapper)
-
-addHook({
-  name: 'vitest',
-  versions: ['>=2.0.5'],
-  filePattern: 'dist/chunks/cac.*',
-}, getCreateCliWrapper)
-
-addHook({
-  name: 'vitest',
-  versions: ['>=1.6.0 <2.0.5'],
-  filePattern: 'dist/vendor/cli-api.*',
-}, getStartVitestWrapper)
-
-addHook({
-  name: 'vitest',
-  versions: ['>=2.0.5'],
-  filePattern: 'dist/chunks/cli-api.*',
-}, getStartVitestWrapper)
-
-// test suite start and finish
-// only relevant for workers
-addHook({
-  name: '@vitest/runner',
-  versions: ['>=1.6.0'],
-}, (vitestPackage, frameworkVersion) => {
-  shimmer.wrap(vitestPackage, 'startTests', startTests => async function (testPaths) {
-    let testSuiteError = null
-    if (!testSuiteFinishCh.hasSubscribers) {
-      return startTests.apply(this, arguments)
-    }
-    // From >=3.0.1, the first arguments changes from a string to an object containing the filepath
-    const testSuiteAbsolutePath = testPaths[0]?.filepath || testPaths[0]
-    const providedContext = getProvidedContext()
-
-    const testSuiteCtx = {
-      testSuiteAbsolutePath,
-      frameworkVersion,
-      testSessionId: providedContext.testSessionId,
-      testModuleId: providedContext.testModuleId,
-      testCommand: providedContext.testCommand,
-      repositoryRoot: providedContext.repositoryRoot,
-      codeOwnersEntries: providedContext.codeOwnersEntries,
-    }
-    testSuiteStartCh.runStores(testSuiteCtx, () => {})
-    const startTestsResponse = await startTests.apply(this, arguments)
-
-    let onFinish = null
-    const onFinishPromise = new Promise(resolve => {
-      onFinish = resolve
-    })
-
-    const testTasks = getTypeTasks(startTestsResponse[0].tasks)
-
-    // Only one test task per test, even if there are retries
-    for (const task of testTasks) {
-      const testCtx = taskToCtx.get(task)
-      const { result } = task
-      // We have to trick vitest into thinking that the test has passed
-      // but we want to report it as failed if it did fail
-      const isSwitchedStatus = switchedStatuses.has(task)
-
-      if (result) {
-        const { state, duration, errors } = result
-        const testError = getCurrentAttemptTestError(task, errors)
-        if (attemptToFixTasks.has(task)) {
-          const status = getFinalAttemptToFixStatus(task, state, isSwitchedStatus, testCtx)
-          recordFinalAttemptToFixExecution(task, status, providedContext)
-        }
-
-        if (state === 'skip') { // programmatic skip
-          testSkipCh.publish({
-            testName: getTestName(task),
-            testSuiteAbsolutePath: task.file.filepath,
-            isNew: newTasks.has(task),
-            isDisabled: disabledTasks.has(task),
-          })
-        } else if (state === 'pass' && !isSwitchedStatus) {
-          if (testCtx) {
-            const isSkippedByTestManagement =
-              !attemptToFixTasks.has(task) && (disabledTasks.has(task) || quarantinedTasks.has(task))
-            testPassCh.publish({
-              task,
-              finalStatus: isSkippedByTestManagement ? 'skip' : 'pass',
-              earlyFlakeAbortReason: efdSlowAbortedTasks.has(task) ? 'slow' : undefined,
-              ...testCtx.currentStore,
-            })
-          }
-        } else if (state === 'fail' || isSwitchedStatus) {
-          let hasFailedAllRetries = false
-          let attemptToFixFailed = false
-          if (attemptToFixTasks.has(task)) {
-            const statuses = attemptToFixTaskToStatuses.get(task)
-            if (statuses.includes('fail')) {
-              attemptToFixFailed = true
-            }
-            if (statuses.every(status => status === 'fail')) {
-              hasFailedAllRetries = true
-            }
-          }
-
-          // Check if all EFD retries failed
-          const isEfdRetry =
-            providedContext.isEarlyFlakeDetectionEnabled && (newTasks.has(task) || modifiedTasks.has(task))
-          if (isEfdRetry) {
-            const statuses = taskToStatuses.get(task)
-            const efdRetryCount = efdDeterminedRetries.get(task) ?? providedContext.numRepeats
-            // statuses only includes repetitions (not the initial run), so we check against retry count (not +1)
-            if (efdRetryCount > 0 && statuses && statuses.length === efdRetryCount &&
-              statuses.every(status => status === 'fail')) {
-              hasFailedAllRetries = true
-            }
-          }
-
-          // ATR: set hasFailedAllRetries when all auto test retries were exhausted and every attempt failed
-          const isAtrRetry = isFlakyTestRetriesEnabledForTask(providedContext, task) && !attemptToFixTasks.has(task) &&
-            !newTasks.has(task) && !modifiedTasks.has(task)
-          if (isAtrRetry) {
-            const maxRetries = providedContext.flakyTestRetriesCount ?? 0
-            if (maxRetries > 0 && task.result?.retryCount === maxRetries) {
-              hasFailedAllRetries = true
-            }
-          }
-
-          if (testCtx) {
-            const isRetry = task.result?.retryCount > 0
-            // `duration` is the duration of all the retries, so it can't be used if there are retries
-
-            let finalStatus
-            if (isSwitchedStatus) {
-              if (!attemptToFixTasks.has(task) && (disabledTasks.has(task) || quarantinedTasks.has(task))) {
-                finalStatus = 'skip'
-              } else if (isAtrRetry || isEfdRetry) {
-                finalStatus = hasFailedAllRetries ? 'fail' : 'pass'
-              } else if (attemptToFixTasks.has(task)) {
-                finalStatus = attemptToFixFailed ? 'fail' : 'pass'
-              } else {
-                finalStatus = undefined
-              }
-            } else {
-              finalStatus = 'fail'
-            }
-
-            testErrorCh.publish({
-              duration: isRetry ? undefined : duration,
-              error: testError,
-              hasFailedAllRetries,
-              attemptToFixFailed,
-              finalStatus,
-              earlyFlakeAbortReason: efdSlowAbortedTasks.has(task) ? 'slow' : undefined,
-              ...testCtx.currentStore,
-            })
-          }
-          if (errors?.length) {
-            testSuiteError = testError // we store the error to bubble it up to the suite
-          }
-        }
-      } else { // test.skip or test.todo
-        testSkipCh.publish({
-          testName: getTestName(task),
-          testSuiteAbsolutePath: task.file.filepath,
-          isNew: newTasks.has(task),
-          isDisabled: disabledTasks.has(task),
-        })
-      }
-    }
-
-    const testSuiteResult = startTestsResponse[0].result
-
-    if (testSuiteResult.errors?.length) { // Errors from root level hooks
-      testSuiteError = testSuiteResult.errors[0]
-    } else if (testSuiteResult.state === 'fail') { // Errors from `describe` level hooks
-      const suiteTasks = getTypeTasks(startTestsResponse[0].tasks, 'suite')
-      const failedSuites = suiteTasks.filter(task => task.result?.state === 'fail')
-      if (failedSuites.length && failedSuites[0].result?.errors?.length) {
-        testSuiteError = failedSuites[0].result.errors[0]
-      }
-    }
-
-    if (testSuiteError) {
-      testSuiteCtx.error = testSuiteError
-      testSuiteErrorCh.runStores(testSuiteCtx, () => {})
-    }
-
-    testSuiteFinishCh.publish({ status: testSuiteResult.state, onFinish, ...testSuiteCtx.currentStore })
-
-    await onFinishPromise
-
-    return startTestsResponse
-  })
-
-  return vitestPackage
-})

From e22306caad311b96548e1be7bb3be16259d5153c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Antonio=20Fern=C3=A1ndez=20de=20Alba?=
 <juan.fernandezdealba@datadoghq.com>
Date: Wed, 1 Jul 2026 16:25:16 +0200
Subject: [PATCH 35/51] refactor(vitest): prepare test metadata in main (#9171)

---
 .../run-programmatic-api-rerun.mjs            |  26 ++
 .../test-programmatic-api-first.mjs           |   7 +
 .../test-programmatic-api-second.mjs          |   7 +
 .../vitest/vitest.advanced.spec.js            |  72 ++++-
 .../src/vitest-main.js                        | 305 +++++++++++++++---
 .../src/vitest-util.js                        |  62 ++--
 .../src/vitest-worker.js                      | 155 ++++-----
 packages/datadog-plugin-vitest/src/index.js   | 106 +++---
 8 files changed, 530 insertions(+), 210 deletions(-)
 create mode 100644 integration-tests/ci-visibility/vitest-tests-programmatic-api/run-programmatic-api-rerun.mjs
 create mode 100644 integration-tests/ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-first.mjs
 create mode 100644 integration-tests/ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-second.mjs

diff --git a/integration-tests/ci-visibility/vitest-tests-programmatic-api/run-programmatic-api-rerun.mjs b/integration-tests/ci-visibility/vitest-tests-programmatic-api/run-programmatic-api-rerun.mjs
new file mode 100644
index 0000000000..4568f922e4
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests-programmatic-api/run-programmatic-api-rerun.mjs
@@ -0,0 +1,26 @@
+import { createVitest } from 'vitest/node'
+
+async function runProgrammaticTests () {
+  let vitest
+  try {
+    vitest = await createVitest('test', {
+      test: {
+        environment: 'node',
+      },
+      watch: false,
+    })
+
+    await vitest.standalone()
+    await vitest.runTestFiles(['./test-programmatic-api-first.mjs'])
+    await vitest.runTestFiles(['./test-programmatic-api-second.mjs'])
+  } catch (error) {
+    process.stderr.write(`${error?.stack || error}\n`)
+    process.exitCode = 1
+  } finally {
+    if (vitest) {
+      await vitest.close()
+    }
+  }
+}
+
+runProgrammaticTests()
diff --git a/integration-tests/ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-first.mjs b/integration-tests/ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-first.mjs
new file mode 100644
index 0000000000..6bd7c397b4
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-first.mjs
@@ -0,0 +1,7 @@
+import { describe, expect, test } from 'vitest'
+
+describe('programmatic api first run', () => {
+  test('can pass before a rerun', () => {
+    expect(1 + 1).toBe(2)
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-second.mjs b/integration-tests/ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-second.mjs
new file mode 100644
index 0000000000..d77088a975
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-second.mjs
@@ -0,0 +1,7 @@
+import { describe, test } from 'vitest'
+
+describe('programmatic api second run', () => {
+  test('is disabled by Test Management', () => {
+    throw new Error('This test should have been disabled by Test Management.')
+  })
+})
diff --git a/integration-tests/vitest/vitest.advanced.spec.js b/integration-tests/vitest/vitest.advanced.spec.js
index 9a5768aeff..50e925a896 100644
--- a/integration-tests/vitest/vitest.advanced.spec.js
+++ b/integration-tests/vitest/vitest.advanced.spec.js
@@ -54,6 +54,7 @@ versions.forEach((version) => {
   describe(`vitest@${version}`, () => {
     let cwd, receiver, childProcess, testOutput
     const vitestProjectsIt = version === 'latest' && NODE_MAJOR >= 20 ? it : it.skip
+    const latestVitestIt = version === 'latest' ? it : it.skip
 
     useSandbox([
       `vitest@${version}`,
@@ -366,7 +367,7 @@ versions.forEach((version) => {
             env: {
               ...getCiVisAgentlessConfig(receiver.port),
               NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
-              TEST_DIR: './test-programmatic-api*',
+              TEST_DIR: './test-programmatic-api.mjs',
             },
           }
         )
@@ -376,6 +377,75 @@ versions.forEach((version) => {
           once(childProcess, 'exit'),
         ])
       })
+
+      latestVitestIt('refreshes metadata when the vitest programmatic api reruns different files', async () => {
+        const disabledTestName = 'programmatic api second run is disabled by Test Management'
+        receiver.setSettings({
+          test_management: {
+            enabled: true,
+          },
+        })
+        receiver.setTestManagementTests({
+          vitest: {
+            suites: {
+              'ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-second.mjs': {
+                tests: {
+                  [disabledTestName]: {
+                    properties: {
+                      disabled: true,
+                    },
+                  },
+                },
+              },
+            },
+          },
+        })
+
+        const eventsPromise = receiver
+          .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', payloads => {
+            const events = payloads.flatMap(({ payload }) => payload.events)
+            const tests = events
+              .filter(event => event.type === 'test')
+              .map(test => test.content)
+              .filter(test => test.meta[TEST_SOURCE_FILE].startsWith(
+                'ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-'
+              ))
+
+            const testDetails = events
+              .filter(event => event.type === 'test')
+              .map(test => ({
+                name: test.content.meta[TEST_NAME],
+                sourceFile: test.content.meta[TEST_SOURCE_FILE],
+              }))
+            assert.strictEqual(tests.length, 2, inspect(testDetails))
+
+            const disabledTest = tests.find(test => test.meta[TEST_NAME] === disabledTestName)
+            assert.ok(disabledTest, inspect(tests.map(test => test.meta[TEST_NAME])))
+            assert.strictEqual(disabledTest.meta[TEST_STATUS], 'skip')
+            assert.strictEqual(disabledTest.meta[TEST_MANAGEMENT_IS_DISABLED], 'true')
+          })
+
+        childProcess = exec(
+          'node run-programmatic-api-rerun.mjs',
+          {
+            cwd: `${cwd}/ci-visibility/vitest-tests-programmatic-api`,
+            env: {
+              ...getCiVisAgentlessConfig(receiver.port),
+              NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
+              TEST_DIR: './test-programmatic-api-*',
+            },
+          }
+        )
+        childProcess.stdout.on('data', data => { testOutput += data })
+        childProcess.stderr.on('data', data => { testOutput += data })
+
+        const [[exitCode]] = await Promise.all([
+          once(childProcess, 'exit'),
+          eventsPromise,
+        ])
+
+        assert.strictEqual(exitCode, 0, testOutput)
+      })
     })
 
     // Coverage report upload only works for >=2.0.0 (when vitest has proper coverage support)
diff --git a/packages/datadog-instrumentations/src/vitest-main.js b/packages/datadog-instrumentations/src/vitest-main.js
index 4299b46f0a..94f37a9c79 100644
--- a/packages/datadog-instrumentations/src/vitest-main.js
+++ b/packages/datadog-instrumentations/src/vitest-main.js
@@ -13,6 +13,8 @@ const {
   collectTestOptimizationSummariesFromTraces,
   logTestOptimizationSummary,
   getTestOptimizationRequestResults,
+  getTestSuitePath,
+  isModifiedTest,
 } = require('../../dd-trace/src/plugins/util/test')
 const { addHook } = require('./helpers/instrument')
 const {
@@ -36,7 +38,7 @@ const {
 const newTestsWithDynamicNames = new Set()
 const attemptToFixExecutions = new Map()
 const workerProcesses = new WeakSet()
-const mainProcessSetupPromises = new WeakMap()
+const mainProcessSetupStates = new WeakMap()
 const coverageWrappedProviders = new WeakSet()
 const finishWrappedContexts = new WeakSet()
 let isFlakyTestRetriesEnabled = false
@@ -125,6 +127,26 @@ function getTestFilepathsFromSpecifications (testSpecifications) {
   })
 }
 
+function getTestSpecificationsKey (testSpecifications) {
+  if (!Array.isArray(testSpecifications) || !testSpecifications.length) return
+
+  const keyParts = []
+  for (const testSpecification of testSpecifications) {
+    const testFile = Array.isArray(testSpecification) ? testSpecification[1] : testSpecification
+    const testFilepath = testFile?.moduleId || testFile?.filepath || testFile
+    if (!testFilepath) continue
+
+    const projectName = getProjectName(getTestSpecificationProject(testSpecification)) || ''
+    const pool = getTestSpecificationPool(testSpecification) || ''
+    keyParts.push(`${projectName}\0${pool}\0${testFilepath}`)
+  }
+
+  if (!keyParts.length) return
+
+  keyParts.sort()
+  return keyParts.join('\0')
+}
+
 function getTestFilepaths (ctx, testSpecifications) {
   const testFilepaths = getTestFilepathsFromSpecifications(testSpecifications)
   if (testFilepaths) {
@@ -135,6 +157,138 @@ function getTestFilepaths (ctx, testSpecifications) {
   return getFilePaths.call(ctx)
 }
 
+/**
+ * @typedef {{
+ *   isAttemptToFix?: boolean,
+ *   isDisabled?: boolean,
+ *   isQuarantined?: boolean
+ * }} VitestTestManagementProperties
+ *
+ * @typedef {{
+ *   testSuite?: string,
+ *   knownTests?: string[],
+ *   testManagementTests?: Record<string, VitestTestManagementProperties>,
+ *   isModified?: boolean
+ * }} VitestTestProperties
+ */
+
+/**
+ * Normalize a Vitest test file path to the test suite path used by Test Optimization APIs.
+ *
+ * @param {string} testFilepath
+ * @param {string} repositoryRoot
+ * @returns {string}
+ */
+function getNormalizedTestSuitePath (testFilepath, repositoryRoot) {
+  const testSuiteAbsolutePath = path.isAbsolute(testFilepath) ? testFilepath : path.join(repositoryRoot, testFilepath)
+  return getTestSuitePath(testSuiteAbsolutePath, repositoryRoot)
+}
+
+/**
+ * Build simplified Test Management metadata grouped by normalized test suite path.
+ *
+ * @param {{ vitest?: { suites?: Record<string, { tests?: Record<string, { properties?: {
+ *   attempt_to_fix?: boolean,
+ *   disabled?: boolean,
+ *   quarantined?: boolean
+ * } }> }> } }} testManagementTests
+ * @returns {Record<string, Record<string, VitestTestManagementProperties>>}
+ */
+function getTestManagementTestsBySuite (testManagementTests) {
+  const testManagementTestsBySuite = {}
+  const suites = testManagementTests?.vitest?.suites
+  if (!suites) return testManagementTestsBySuite
+
+  for (const [testSuite, suite] of Object.entries(suites)) {
+    const tests = suite?.tests
+    if (!tests) continue
+
+    const testsByName = {}
+    let hasTests = false
+    for (const [testName, test] of Object.entries(tests)) {
+      const properties = test?.properties
+      const testProperties = {
+        isAttemptToFix: properties?.attempt_to_fix,
+        isDisabled: properties?.disabled,
+        isQuarantined: properties?.quarantined,
+      }
+      testsByName[testName] = testProperties
+      hasTests = true
+    }
+    if (hasTests) {
+      testManagementTestsBySuite[testSuite] = testsByName
+    }
+  }
+
+  return testManagementTestsBySuite
+}
+
+/**
+ * Build a set-like object for test suites modified in the current pull request diff.
+ *
+ * @param {Record<string, number[]>|undefined} modifiedFiles
+ * @returns {Record<string, boolean>}
+ */
+function getImpactedTestSuites (modifiedFiles) {
+  const impactedTestSuites = {}
+  if (!modifiedFiles) return impactedTestSuites
+
+  for (const testSuite of Object.keys(modifiedFiles)) {
+    if (isModifiedTest(testSuite, 0, 0, modifiedFiles, 'vitest')) {
+      impactedTestSuites[testSuite] = true
+    }
+  }
+
+  return impactedTestSuites
+}
+
+/**
+ * Build the worker-ready test metadata map keyed by Vitest's absolute filepath.
+ *
+ * @param {string[]} testFilepaths
+ * @param {string} repositoryRoot
+ * @param {Record<string, string[]>|undefined} knownTestsBySuite
+ * @param {Record<string, Record<string, VitestTestManagementProperties>>|undefined} testManagementTestsBySuite
+ * @param {Record<string, boolean>|undefined} impactedTestSuites
+ * @returns {Record<string, VitestTestProperties>}
+ */
+function getTestPropertiesByFilepath (
+  testFilepaths,
+  repositoryRoot,
+  knownTestsBySuite,
+  testManagementTestsBySuite,
+  impactedTestSuites
+) {
+  const testPropertiesByFilepath = {}
+  if (!Array.isArray(testFilepaths)) return testPropertiesByFilepath
+
+  for (const testFilepath of testFilepaths) {
+    if (typeof testFilepath !== 'string') continue
+
+    const testSuite = getNormalizedTestSuitePath(testFilepath, repositoryRoot)
+    const testProperties = { testSuite }
+    const hasProperties = knownTestsBySuite !== undefined ||
+      testManagementTestsBySuite !== undefined ||
+      impactedTestSuites !== undefined
+
+    if (knownTestsBySuite) {
+      testProperties.knownTests = knownTestsBySuite[testSuite] || []
+    }
+    if (testManagementTestsBySuite) {
+      testProperties.testManagementTests = testManagementTestsBySuite[testSuite] || {}
+    }
+    if (impactedTestSuites?.[testSuite]) {
+      testProperties.isModified = true
+    }
+
+    if (hasProperties) {
+      testPropertiesByFilepath[testFilepath] = testProperties
+    }
+  }
+
+  return testPropertiesByFilepath
+}
+
 function wrapCoverageProvider (ctx) {
   const { coverageProvider } = ctx
   if (!coverageProvider?.generateCoverage || coverageWrappedProviders.has(coverageProvider)) {
@@ -175,38 +329,92 @@ function wrapSessionFinish (ctx) {
   shimmer.wrap(ctx, 'close', getFinishWrapper)
 }
 
+function resetLibraryConfig () {
+  isFlakyTestRetriesEnabled = false
+  flakyTestRetriesCount = 0
+  isEarlyFlakeDetectionEnabled = false
+  earlyFlakeDetectionNumRetries = 0
+  earlyFlakeDetectionSlowTestRetries = {}
+  isEarlyFlakeDetectionFaulty = false
+  isDiEnabled = false
+  isKnownTestsEnabled = false
+  isTestManagementTestsEnabled = false
+  isImpactedTestsEnabled = false
+  testManagementAttemptToFixRetries = 0
+}
+
+function applyLibraryConfig (libraryConfig) {
+  isFlakyTestRetriesEnabled = libraryConfig.isFlakyTestRetriesEnabled
+  flakyTestRetriesCount = libraryConfig.flakyTestRetriesCount
+  isEarlyFlakeDetectionEnabled = libraryConfig.isEarlyFlakeDetectionEnabled
+  earlyFlakeDetectionNumRetries = libraryConfig.earlyFlakeDetectionNumRetries
+  earlyFlakeDetectionSlowTestRetries = libraryConfig.earlyFlakeDetectionSlowTestRetries ?? {}
+  isEarlyFlakeDetectionFaulty = false
+  isDiEnabled = libraryConfig.isDiEnabled
+  isKnownTestsEnabled = libraryConfig.isKnownTestsEnabled
+  isTestManagementTestsEnabled = libraryConfig.isTestManagementEnabled
+  testManagementAttemptToFixRetries = libraryConfig.testManagementAttemptToFixRetries
+  isImpactedTestsEnabled = libraryConfig.isImpactedTestsEnabled
+}
+
+function resetMainProcessProvidedContext (ctx) {
+  setProvidedContext(ctx, {
+    _ddIsDiEnabled: false,
+    _ddIsEarlyFlakeDetectionEnabled: false,
+    _ddEarlyFlakeDetectionNumRetries: 0,
+    _ddEarlyFlakeDetectionSlowTestRetries: {},
+    _ddIsFlakyTestRetriesEnabled: false,
+    _ddFlakyTestRetriesCount: 0,
+    _ddFlakyTestRetriesIncludesUnnamedProject: false,
+    _ddFlakyTestRetriesProjectNames: undefined,
+    _ddIsImpactedTestsEnabled: false,
+    _ddIsKnownTestsEnabled: false,
+    _ddIsTestManagementTestsEnabled: false,
+    _ddTestManagementAttemptToFixRetries: 0,
+    _ddTestPropertiesByFilepath: {},
+  }, 'Could not reset Test Optimization context for workers.')
+}
+
 async function runMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
   if (!testSessionFinishCh.hasSubscribers) {
     return
   }
 
+  let repositoryRoot = process.cwd()
+  let testFilepaths
+  let shouldSendTestProperties = false
+  let knownTestsBySuite
+  let testManagementTestsBySuite
+  let impactedTestSuites
+  const getCurrentTestFilepaths = async () => {
+    if (testFilepaths === undefined) {
+      testFilepaths = await getTestFilepaths(ctx, testSpecifications)
+    }
+    return testFilepaths
+  }
+
   try {
     const { err, libraryConfig } = await getChannelPromise(libraryConfigurationCh, frameworkVersion)
-    if (!err) {
-      isFlakyTestRetriesEnabled = libraryConfig.isFlakyTestRetriesEnabled
-      flakyTestRetriesCount = libraryConfig.flakyTestRetriesCount
-      isEarlyFlakeDetectionEnabled = libraryConfig.isEarlyFlakeDetectionEnabled
-      earlyFlakeDetectionNumRetries = libraryConfig.earlyFlakeDetectionNumRetries
-      earlyFlakeDetectionSlowTestRetries = libraryConfig.earlyFlakeDetectionSlowTestRetries ?? {}
-      isDiEnabled = libraryConfig.isDiEnabled
-      isKnownTestsEnabled = libraryConfig.isKnownTestsEnabled
-      isTestManagementTestsEnabled = libraryConfig.isTestManagementEnabled
-      testManagementAttemptToFixRetries = libraryConfig.testManagementAttemptToFixRetries
-      isImpactedTestsEnabled = libraryConfig.isImpactedTestsEnabled
+    if (err) {
+      resetLibraryConfig()
+    } else {
+      applyLibraryConfig(libraryConfig)
     }
   } catch {
-    isFlakyTestRetriesEnabled = false
-    isEarlyFlakeDetectionEnabled = false
-    isDiEnabled = false
-    isKnownTestsEnabled = false
-    isImpactedTestsEnabled = false
+    resetLibraryConfig()
   }
 
+  resetMainProcessProvidedContext(ctx)
+
   if (testSessionConfigurationCh.hasSubscribers) {
-    const { testSessionId, testModuleId, testCommand, repositoryRoot, codeOwnersEntries } = await getChannelPromise(
-      testSessionConfigurationCh,
-      frameworkVersion
-    )
+    const {
+      testSessionId,
+      testModuleId,
+      testCommand,
+      repositoryRoot: receivedRepositoryRoot,
+      codeOwnersEntries,
+    } = await getChannelPromise(testSessionConfigurationCh, frameworkVersion)
+    repositoryRoot = receivedRepositoryRoot || repositoryRoot
     setProvidedContext(ctx, {
       _ddTestSessionId: testSessionId,
       _ddTestModuleId: testModuleId,
@@ -242,12 +450,12 @@ async function runMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
       isEarlyFlakeDetectionEnabled = false
     } else {
       const knownTests = currentKnownTestsResponse.knownTests
-      const testFilepaths = await getTestFilepaths(ctx, testSpecifications)
+      const currentTestFilepaths = await getCurrentTestFilepaths()
 
       if (isValidKnownTests(knownTests)) {
         isEarlyFlakeDetectionFaultyCh.publish({
           knownTests: knownTests.vitest,
-          testFilepaths,
+          testFilepaths: currentTestFilepaths,
           onDone: (isFaulty) => {
             isEarlyFlakeDetectionFaulty = isFaulty
           },
@@ -256,9 +464,10 @@ async function runMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
           isEarlyFlakeDetectionEnabled = false
           log.warn('New test detection is disabled because the number of new tests is too high.')
         } else {
+          knownTestsBySuite = knownTests.vitest
+          shouldSendTestProperties = true
           setProvidedContext(ctx, {
             _ddIsKnownTestsEnabled: isKnownTestsEnabled,
-            _ddKnownTests: knownTests,
             _ddIsEarlyFlakeDetectionEnabled: isEarlyFlakeDetectionEnabled,
             _ddEarlyFlakeDetectionNumRetries:
               getConfiguredEfdRetryCount(earlyFlakeDetectionSlowTestRetries, earlyFlakeDetectionNumRetries),
@@ -285,10 +494,11 @@ async function runMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
       isTestManagementTestsEnabled = false
       log.error('Could not get test management tests.')
     } else {
+      testManagementTestsBySuite = getTestManagementTestsBySuite(receivedTestManagementTests)
+      shouldSendTestProperties = true
       setProvidedContext(ctx, {
         _ddIsTestManagementTestsEnabled: isTestManagementTestsEnabled,
         _ddTestManagementAttemptToFixRetries: testManagementAttemptToFixRetries,
-        _ddTestManagementTests: receivedTestManagementTests,
       }, 'Could not send test management tests to workers so Test Management will not work.')
     }
   }
@@ -298,24 +508,41 @@ async function runMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
     if (err) {
       log.error('Could not get modified tests.')
     } else {
+      impactedTestSuites = getImpactedTestSuites(modifiedFiles)
+      shouldSendTestProperties = true
       setProvidedContext(ctx, {
         _ddIsImpactedTestsEnabled: isImpactedTestsEnabled,
-        _ddModifiedFiles: modifiedFiles,
       }, 'Could not send modified tests to workers so Impacted Tests will not work.')
     }
   }
 
+  if (shouldSendTestProperties) {
+    setProvidedContext(ctx, {
+      _ddTestPropertiesByFilepath: getTestPropertiesByFilepath(
+        await getCurrentTestFilepaths(),
+        repositoryRoot,
+        knownTestsBySuite,
+        testManagementTestsBySuite,
+        impactedTestSuites
+      ),
+    }, 'Could not send test properties to workers so some Test Optimization features will not work.')
+  }
+
   wrapCoverageProvider(ctx)
   wrapSessionFinish(ctx)
 }
 
 function ensureMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
-  let setupPromise = mainProcessSetupPromises.get(ctx)
-  if (!setupPromise) {
-    setupPromise = runMainProcessSetup(ctx, frameworkVersion, testSpecifications)
-    mainProcessSetupPromises.set(ctx, setupPromise)
+  const specificationsKey = getTestSpecificationsKey(testSpecifications)
+  let setupState = mainProcessSetupStates.get(ctx)
+  if (!setupState || setupState.specificationsKey !== specificationsKey) {
+    setupState = {
+      setupPromise: runMainProcessSetup(ctx, frameworkVersion, testSpecifications),
+      specificationsKey,
+    }
+    mainProcessSetupStates.set(ctx, setupState)
   }
-  return setupPromise
+  return setupState.setupPromise
 }
 
 function configureFlakyTestRetries (ctx, testSpecifications) {
@@ -574,8 +801,7 @@ function markVitestWorkerEnv (ctx, testSpecifications) {
   if (!config || !shouldMarkVitestWorkerEnv(config.pool, testSpecifications)) {
     return
   }
-  config.env = config.env || {}
-  config.env.DD_VITEST_WORKER = '1'
+  config.env = getVitestWorkerEnv(config.env)
 }
 
 function wrapVitestRunFiles (Vitest, frameworkVersion) {
@@ -659,7 +885,14 @@ function isVitestTinypoolOptions (options) {
 function markVitestTinypoolOptions (options) {
   if (!isVitestTinypoolOptions(options)) return
 
-  options.env.DD_VITEST_WORKER = '1'
+  options.env = getVitestWorkerEnv(options.env)
+}
+
+function getVitestWorkerEnv (env = {}) {
+  return {
+    ...env,
+    DD_VITEST_WORKER: '1',
+  }
 }
 
 function wrapTinyPoolRun (TinyPool) {
@@ -781,7 +1014,7 @@ function getStartVitestWrapper (cliApiPackage, frameworkVersion) {
     // function is async
     shimmer.wrap(forksPoolWorker.value.prototype, 'start', start => function (...args) {
       vitestPool = 'child_process'
-      this.env.DD_VITEST_WORKER = '1'
+      this.env = getVitestWorkerEnv(this.env)
 
       return start.apply(this, args)
     })
@@ -793,7 +1026,7 @@ function getStartVitestWrapper (cliApiPackage, frameworkVersion) {
     // function is async
     shimmer.wrap(threadsPoolWorker.value.prototype, 'start', start => function (...args) {
       vitestPool = 'worker_threads'
-      this.env.DD_VITEST_WORKER = '1'
+      this.env = getVitestWorkerEnv(this.env)
       return start.apply(this, args)
     })
     shimmer.wrap(threadsPoolWorker.value.prototype, 'on', getWrappedOn)
diff --git a/packages/datadog-instrumentations/src/vitest-util.js b/packages/datadog-instrumentations/src/vitest-util.js
index d41a31dcbe..379f2faf2e 100644
--- a/packages/datadog-instrumentations/src/vitest-util.js
+++ b/packages/datadog-instrumentations/src/vitest-util.js
@@ -9,11 +9,6 @@ const testFinishTimeCh = channel('ci:vitest:test:finish-time')
 const testPassCh = channel('ci:vitest:test:pass')
 const testErrorCh = channel('ci:vitest:test:error')
 const testSkipCh = channel('ci:vitest:test:skip')
-const isNewTestCh = channel('ci:vitest:test:is-new')
-const isAttemptToFixCh = channel('ci:vitest:test:is-attempt-to-fix')
-const isDisabledCh = channel('ci:vitest:test:is-disabled')
-const isQuarantinedCh = channel('ci:vitest:test:is-quarantined')
-const isModifiedCh = channel('ci:vitest:test:is-modified')
 const testFnCh = channel('ci:vitest:test:fn')
 
 // test suite hooks
@@ -104,19 +99,17 @@ function getProvidedContext () {
     const {
       _ddIsEarlyFlakeDetectionEnabled,
       _ddIsDiEnabled,
-      _ddKnownTests: knownTests,
+      _ddTestPropertiesByFilepath: testPropertiesByFilepath,
       _ddEarlyFlakeDetectionNumRetries: numRepeats,
       _ddEarlyFlakeDetectionSlowTestRetries: slowTestRetries,
       _ddIsKnownTestsEnabled: isKnownTestsEnabled,
       _ddIsTestManagementTestsEnabled: isTestManagementTestsEnabled,
       _ddTestManagementAttemptToFixRetries: testManagementAttemptToFixRetries,
-      _ddTestManagementTests: testManagementTests,
       _ddIsFlakyTestRetriesEnabled: isFlakyTestRetriesEnabled,
       _ddFlakyTestRetriesCount: flakyTestRetriesCount,
       _ddFlakyTestRetriesIncludesUnnamedProject: flakyTestRetriesIncludesUnnamedProject,
       _ddFlakyTestRetriesProjectNames: flakyTestRetriesProjectNames,
       _ddIsImpactedTestsEnabled: isImpactedTestsEnabled,
-      _ddModifiedFiles: modifiedFiles,
       _ddTestSessionId: testSessionId,
       _ddTestModuleId: testModuleId,
       _ddTestCommand: testCommand,
@@ -127,19 +120,17 @@ function getProvidedContext () {
     return {
       isDiEnabled: _ddIsDiEnabled,
       isEarlyFlakeDetectionEnabled: _ddIsEarlyFlakeDetectionEnabled,
-      knownTests,
+      testPropertiesByFilepath,
       numRepeats,
       slowTestRetries: slowTestRetries ?? {},
       isKnownTestsEnabled,
       isTestManagementTestsEnabled,
       testManagementAttemptToFixRetries,
-      testManagementTests,
       isFlakyTestRetriesEnabled,
       flakyTestRetriesCount: flakyTestRetriesCount ?? 0,
       flakyTestRetriesIncludesUnnamedProject,
       flakyTestRetriesProjectNames,
       isImpactedTestsEnabled,
-      modifiedFiles,
       testSessionId,
       testModuleId,
       testCommand,
@@ -151,19 +142,17 @@ function getProvidedContext () {
     return {
       isDiEnabled: false,
       isEarlyFlakeDetectionEnabled: false,
-      knownTests: {},
+      testPropertiesByFilepath: {},
       numRepeats: 0,
       slowTestRetries: {},
       isKnownTestsEnabled: false,
       isTestManagementTestsEnabled: false,
       testManagementAttemptToFixRetries: 0,
-      testManagementTests: {},
       isFlakyTestRetriesEnabled: false,
       flakyTestRetriesCount: 0,
       flakyTestRetriesIncludesUnnamedProject: false,
       flakyTestRetriesProjectNames: undefined,
       isImpactedTestsEnabled: false,
-      modifiedFiles: {},
       testSessionId: undefined,
       testModuleId: undefined,
       testCommand: undefined,
@@ -187,17 +176,51 @@ function isFlakyTestRetriesEnabledForTask (providedContext, task) {
   return flakyTestRetriesProjectNames.includes(projectName)
 }
 
+/**
+ * Return the main-prepared Test Optimization metadata for a Vitest test.
+ *
+ * @param {{ testPropertiesByFilepath?: Record<string, {
+ *   testSuite?: string,
+ *   knownTests?: string[],
+ *   testManagementTests?: Record<string, {
+ *     isAttemptToFix?: boolean,
+ *     isDisabled?: boolean,
+ *     isQuarantined?: boolean
+ *   }>,
+ *   isModified?: boolean
+ * }> }} providedContext
+ * @param {string} testSuiteAbsolutePath
+ * @param {string} testName
+ * @returns {{
+ *   testSuite?: string,
+ *   isNew: boolean,
+ *   isModified: boolean,
+ *   isAttemptToFix?: boolean,
+ *   isDisabled?: boolean,
+ *   isQuarantined?: boolean
+ * }}
+ */
+function getVitestTestProperties (providedContext, testSuiteAbsolutePath, testName) {
+  const testProperties = providedContext.testPropertiesByFilepath?.[testSuiteAbsolutePath]
+  const knownTests = testProperties?.knownTests
+  const testManagementProperties = testProperties?.testManagementTests?.[testName] || {}
+
+  return {
+    testSuite: testProperties?.testSuite,
+    isNew: Array.isArray(knownTests) ? !knownTests.includes(testName) : false,
+    isModified: testProperties?.isModified === true,
+    isAttemptToFix: testManagementProperties.isAttemptToFix,
+    isDisabled: testManagementProperties.isDisabled,
+    isQuarantined: testManagementProperties.isQuarantined,
+  }
+}
+
 module.exports = {
   testStartCh,
   testFinishTimeCh,
   testPassCh,
   testErrorCh,
   testSkipCh,
-  isNewTestCh,
-  isAttemptToFixCh,
-  isDisabledCh,
-  isQuarantinedCh,
-  isModifiedCh,
   testFnCh,
   testSuiteStartCh,
   testSuiteFinishCh,
@@ -222,4 +245,5 @@ module.exports = {
   setProvidedContext,
   getProvidedContext,
   isFlakyTestRetriesEnabledForTask,
+  getVitestTestProperties,
 }
diff --git a/packages/datadog-instrumentations/src/vitest-worker.js b/packages/datadog-instrumentations/src/vitest-worker.js
index 0eab9ab37a..ee93561c51 100644
--- a/packages/datadog-instrumentations/src/vitest-worker.js
+++ b/packages/datadog-instrumentations/src/vitest-worker.js
@@ -8,7 +8,6 @@ const { performance } = require('node:perf_hooks')
 const shimmer = require('../../datadog-shimmer')
 const {
   DYNAMIC_NAME_RE,
-  getTestSuitePath,
   getEfdRetryCount,
   recordAttemptToFixExecution,
   logAttemptToFixTestExecution,
@@ -20,11 +19,6 @@ const {
   testPassCh,
   testErrorCh,
   testSkipCh,
-  isNewTestCh,
-  isAttemptToFixCh,
-  isDisabledCh,
-  isQuarantinedCh,
-  isModifiedCh,
   testFnCh,
   testSuiteStartCh,
   testSuiteFinishCh,
@@ -35,11 +29,13 @@ const {
   getTestName,
   getProvidedContext,
   isFlakyTestRetriesEnabledForTask,
+  getVitestTestProperties,
 } = require('./vitest-util')
 
 const BREAKPOINT_HIT_GRACE_PERIOD_MS = 400
 
 const taskToCtx = new WeakMap()
+const taskToTestProperties = new WeakMap()
 const taskToStatuses = new WeakMap()
 const taskToReportedErrorCount = new WeakMap()
 const attemptToFixTaskToStatuses = new WeakMap()
@@ -86,6 +82,16 @@ function getFinalAttemptToFixStatus (task, state, isSwitchedStatus, testCtx) {
   return state === 'fail' ? 'fail' : 'pass'
 }
 
+/**
+ * Return the normalized test suite path prepared by the main process for a Vitest task.
+ *
+ * @param {{ file: { filepath: string } }} task
+ * @returns {string}
+ */
+function getTaskTestSuite (task) {
+  return taskToTestProperties.get(task)?.testSuite || task.file.filepath
+}
+
 function recordFinalAttemptToFixExecution (task, status, providedContext) {
   const statuses = attemptToFixTaskToStatuses.get(task)
   if (statuses && statuses.length <= providedContext.testManagementAttemptToFixRetries) {
@@ -93,7 +99,7 @@ function recordFinalAttemptToFixExecution (task, status, providedContext) {
   }
 
   recordAttemptToFixExecution(attemptToFixExecutions, {
-    testSuite: getTestSuitePath(task.file.filepath, process.cwd()),
+    testSuite: getTaskTestSuite(task),
     testName: getTestName(task),
     status,
     isDisabled: disabledTasks.has(task),
@@ -138,87 +144,64 @@ function wrapVitestTestRunner (VitestTestRunner) {
   shimmer.wrap(VitestTestRunner.prototype, 'onBeforeRunTask', onBeforeRunTask => function (task) {
     const testName = getTestName(task)
 
+    const providedContext = getProvidedContext()
     const {
-      knownTests,
       isEarlyFlakeDetectionEnabled,
       isKnownTestsEnabled,
       numRepeats,
       isTestManagementTestsEnabled,
       testManagementAttemptToFixRetries,
-      testManagementTests,
       isImpactedTestsEnabled,
-      modifiedFiles,
-    } = getProvidedContext()
+    } = providedContext
+    const testProperties = getVitestTestProperties(providedContext, task.file.filepath, testName)
+    taskToTestProperties.set(task, testProperties)
 
     if (isTestManagementTestsEnabled) {
-      isAttemptToFixCh.publish({
-        testManagementTests,
-        testSuiteAbsolutePath: task.file.filepath,
-        testName,
-        onDone: (isAttemptToFix) => {
-          if (isAttemptToFix) {
-            isRetryReasonAttemptToFix = task.repeats !== testManagementAttemptToFixRetries
-            disableFrameworkRetries(task)
-            task.repeats = testManagementAttemptToFixRetries
-            attemptToFixTasks.add(task)
-            attemptToFixTaskToStatuses.set(task, [])
-          }
-        },
-      })
-      isDisabledCh.publish({
-        testManagementTests,
-        testSuiteAbsolutePath: task.file.filepath,
-        testName,
-        onDone: (isTestDisabled) => {
-          if (isTestDisabled) {
-            disabledTasks.add(task)
-            if (!attemptToFixTasks.has(task)) {
-              // we only actually skip if the test is not being attempted to be fixed
-              task.mode = 'skip'
-            }
-          }
-        },
-      })
+      const {
+        isAttemptToFix,
+        isDisabled,
+        isQuarantined,
+      } = testProperties
+      if (isAttemptToFix) {
+        isRetryReasonAttemptToFix = task.repeats !== testManagementAttemptToFixRetries
+        disableFrameworkRetries(task)
+        task.repeats = testManagementAttemptToFixRetries
+        attemptToFixTasks.add(task)
+        attemptToFixTaskToStatuses.set(task, [])
+      }
+      if (isQuarantined) {
+        quarantinedTasks.add(task)
+      }
+      if (isDisabled) {
+        disabledTasks.add(task)
+        if (!attemptToFixTasks.has(task)) {
+          // we only actually skip if the test is not being attempted to be fixed
+          task.mode = 'skip'
+        }
+      }
     }
 
-    if (isImpactedTestsEnabled) {
-      isModifiedCh.publish({
-        modifiedFiles,
-        testSuiteAbsolutePath: task.file.filepath,
-        onDone: (isImpacted) => {
-          if (isImpacted) {
-            if (isEarlyFlakeDetectionEnabled) {
-              isRetryReasonEfd = true
-              disableFrameworkRetries(task)
-              task.repeats = numRepeats
-            }
-            modifiedTasks.add(task)
-            taskToStatuses.set(task, [])
-          }
-        },
-      })
+    if (isImpactedTestsEnabled && testProperties.isModified) {
+      if (isEarlyFlakeDetectionEnabled) {
+        isRetryReasonEfd = true
+        disableFrameworkRetries(task)
+        task.repeats = numRepeats
+      }
+      modifiedTasks.add(task)
+      taskToStatuses.set(task, [])
     }
 
-    if (isKnownTestsEnabled) {
-      isNewTestCh.publish({
-        knownTests,
-        testSuiteAbsolutePath: task.file.filepath,
-        testName,
-        onDone: (isNew) => {
-          if (isNew && !attemptToFixTasks.has(task)) {
-            if (isEarlyFlakeDetectionEnabled && !modifiedTasks.has(task)) {
-              isRetryReasonEfd = true
-              disableFrameworkRetries(task)
-              task.repeats = numRepeats
-            }
-            newTasks.add(task)
-            taskToStatuses.set(task, [])
-            if (DYNAMIC_NAME_RE.test(testName)) {
-              dynamicNameTasks.add(task)
-            }
-          }
-        },
-      })
+    if (isKnownTestsEnabled && testProperties.isNew && !attemptToFixTasks.has(task)) {
+      if (isEarlyFlakeDetectionEnabled && !modifiedTasks.has(task)) {
+        isRetryReasonEfd = true
+        disableFrameworkRetries(task)
+        task.repeats = numRepeats
+      }
+      newTasks.add(task)
+      taskToStatuses.set(task, [])
+      if (DYNAMIC_NAME_RE.test(testName)) {
+        dynamicNameTasks.add(task)
+      }
     }
 
     return onBeforeRunTask.apply(this, arguments)
@@ -271,15 +254,11 @@ function wrapVitestTestRunner (VitestTestRunner) {
     }
     const testName = getTestName(task)
     let isNew = false
-    let isQuarantined = false
-
     const providedContext = getProvidedContext()
     const {
       isKnownTestsEnabled,
       isEarlyFlakeDetectionEnabled,
       isDiEnabled,
-      isTestManagementTestsEnabled,
-      testManagementTests,
       slowTestRetries,
     } = providedContext
 
@@ -287,20 +266,6 @@ function wrapVitestTestRunner (VitestTestRunner) {
       isNew = newTasks.has(task)
     }
 
-    if (isTestManagementTestsEnabled) {
-      isQuarantinedCh.publish({
-        testManagementTests,
-        testSuiteAbsolutePath: task.file.filepath,
-        testName,
-        onDone: (isTestQuarantined) => {
-          isQuarantined = isTestQuarantined
-          if (isTestQuarantined) {
-            quarantinedTasks.add(task)
-          }
-        },
-      })
-    }
-
     const { retry: numAttempt, repeats: numRepetition } = retryInfo
     const isEfdManagedTask = isEarlyFlakeDetectionEnabled && taskToStatuses.has(task) && !attemptToFixTasks.has(task)
 
@@ -426,7 +391,7 @@ function wrapVitestTestRunner (VitestTestRunner) {
       mightHitProbe: isDiEnabled && numAttempt > 0,
       isAttemptToFix: attemptToFixTasks.has(task),
       isDisabled: disabledTasks.has(task),
-      isQuarantined,
+      isQuarantined: quarantinedTasks.has(task),
       isRetryReasonAtr,
       isModified: modifiedTasks.has(task),
     }
@@ -434,7 +399,7 @@ function wrapVitestTestRunner (VitestTestRunner) {
 
     if (attemptToFixTasks.has(task)) {
       logAttemptToFixTestExecution(
-        getTestSuitePath(task.file.filepath, process.cwd()),
+        getTaskTestSuite(task),
         testName,
         loggedAttemptToFixTests
       )
diff --git a/packages/datadog-plugin-vitest/src/index.js b/packages/datadog-plugin-vitest/src/index.js
index 261be0771b..b4a5e9943a 100644
--- a/packages/datadog-plugin-vitest/src/index.js
+++ b/packages/datadog-plugin-vitest/src/index.js
@@ -32,10 +32,10 @@ const {
   TEST_HAS_FAILED_ALL_RETRIES,
   getLibraryCapabilitiesTags,
   TEST_RETRY_REASON_TYPES,
-  isModifiedTest,
   TEST_IS_MODIFIED,
   TEST_HAS_DYNAMIC_NAME,
   TEST_FINAL_STATUS,
+  TEST_IS_TEST_FRAMEWORK_WORKER,
 } = require('../../dd-trace/src/plugins/util/test')
 const { COMPONENT } = require('../../dd-trace/src/constants')
 const {
@@ -70,49 +70,6 @@ class VitestPlugin extends CiPlugin {
       })
     })
 
-    this.addSub('ci:vitest:test:is-new', ({ knownTests, testSuiteAbsolutePath, testName, onDone }) => {
-      // if for whatever reason the worker does not receive valid known tests, we don't consider it as new
-      if (!knownTests.vitest) {
-        return onDone(false)
-      }
-      const testSuite = getTestSuitePath(testSuiteAbsolutePath, this.repositoryRoot)
-      const testsForThisTestSuite = knownTests.vitest[testSuite] || []
-      onDone(!testsForThisTestSuite.includes(testName))
-    })
-
-    this.addSub('ci:vitest:test:is-attempt-to-fix', ({
-      testManagementTests,
-      testSuiteAbsolutePath,
-      testName,
-      onDone,
-    }) => {
-      const testSuite = getTestSuitePath(testSuiteAbsolutePath, this.repositoryRoot)
-      const { isAttemptToFix } = this.getTestProperties(testManagementTests, testSuite, testName)
-
-      onDone(isAttemptToFix ?? false)
-    })
-
-    this.addSub('ci:vitest:test:is-disabled', ({ testManagementTests, testSuiteAbsolutePath, testName, onDone }) => {
-      const testSuite = getTestSuitePath(testSuiteAbsolutePath, this.repositoryRoot)
-      const { isDisabled } = this.getTestProperties(testManagementTests, testSuite, testName)
-
-      onDone(isDisabled)
-    })
-
-    this.addSub('ci:vitest:test:is-quarantined', ({ testManagementTests, testSuiteAbsolutePath, testName, onDone }) => {
-      const testSuite = getTestSuitePath(testSuiteAbsolutePath, this.repositoryRoot)
-      const { isQuarantined } = this.getTestProperties(testManagementTests, testSuite, testName)
-
-      onDone(isQuarantined)
-    })
-
-    this.addSub('ci:vitest:test:is-modified', ({ modifiedFiles, testSuiteAbsolutePath, onDone }) => {
-      const testSuite = getTestSuitePath(testSuiteAbsolutePath, this.repositoryRoot)
-      const isModified = isModifiedTest(testSuite, 0, 0, modifiedFiles, this.constructor.id)
-
-      onDone(isModified)
-    })
-
     this.addSub('ci:vitest:is-early-flake-detection-faulty', ({
       knownTests,
       testFilepaths,
@@ -141,12 +98,16 @@ class VitestPlugin extends CiPlugin {
         isRetryReasonAttemptToFix,
         isRetryReasonAtr,
         isModified,
+        isTestFrameworkWorker,
+        requestErrorTags,
       } = ctx
 
       const testSuite = getTestSuitePath(testSuiteAbsolutePath, this.repositoryRoot)
-      const store = storage('legacy').getStore()
+      const store = ctx.currentStore || storage('legacy').getStore()
+      const testSuiteSpan = store?.testSuiteSpan || this.testSuiteSpan
 
       const extraTags = {
+        ...requestErrorTags,
         [TEST_SOURCE_FILE]: testSuite,
       }
       if (isRetry) {
@@ -179,11 +140,14 @@ class VitestPlugin extends CiPlugin {
       if (isModified) {
         extraTags[TEST_IS_MODIFIED] = 'true'
       }
+      if (isTestFrameworkWorker) {
+        extraTags[TEST_IS_TEST_FRAMEWORK_WORKER] = 'true'
+      }
 
       const span = this.startTestSpan(
         testName,
         testSuite,
-        this.testSuiteSpan,
+        testSuiteSpan,
         extraTags
       )
 
@@ -204,7 +168,7 @@ class VitestPlugin extends CiPlugin {
     })
 
     this.addBind('ci:vitest:test:finish-time', (ctx) => {
-      const { status, task, attemptToFixPassed, attemptToFixFailed } = ctx
+      const { status, task, attemptToFixPassed, attemptToFixFailed, duration } = ctx
       const span = ctx.currentStore?.span
 
       // we store the finish time to finish at a later hook
@@ -218,7 +182,8 @@ class VitestPlugin extends CiPlugin {
           span.setTag(TEST_MANAGEMENT_ATTEMPT_TO_FIX_PASSED, 'false')
         }
 
-        this.taskToFinishTime.set(task, span._getTime())
+        const finishTime = typeof duration === 'number' ? span._startTime + duration : span._getTime()
+        this.taskToFinishTime.set(task, finishTime)
 
         ctx.parentStore = ctx.currentStore
         ctx.currentStore = { ...ctx.currentStore, span }
@@ -291,19 +256,29 @@ class VitestPlugin extends CiPlugin {
       finishAllTraceSpans(span)
     })
 
-    this.addSub('ci:vitest:test:skip', ({ testName, testSuiteAbsolutePath, isNew, isDisabled }) => {
+    this.addSub('ci:vitest:test:skip', ({
+      testName,
+      testSuiteAbsolutePath,
+      isNew,
+      isDisabled,
+      isTestFrameworkWorker,
+      requestErrorTags,
+      testSuiteSpan,
+    }) => {
       const testSuite = getTestSuitePath(testSuiteAbsolutePath, this.repositoryRoot)
       const testSpan = this.startTestSpan(
         testName,
         testSuite,
-        this.testSuiteSpan,
+        testSuiteSpan || this.testSuiteSpan,
         {
+          ...requestErrorTags,
           [TEST_SOURCE_FILE]: testSuite,
           [TEST_SOURCE_START]: 1, // we can't get the proper start line in vitest
           [TEST_STATUS]: 'skip',
           [TEST_FINAL_STATUS]: 'skip',
           ...(isDisabled ? { [TEST_MANAGEMENT_IS_DISABLED]: 'true' } : {}),
           ...(isNew ? { [TEST_IS_NEW]: 'true' } : {}),
+          ...(isTestFrameworkWorker ? { [TEST_IS_TEST_FRAMEWORK_WORKER]: 'true' } : {}),
         }
       )
       this.telemetry.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'test', this.getTestTelemetryTags(testSpan))
@@ -311,7 +286,14 @@ class VitestPlugin extends CiPlugin {
     })
 
     this.addBind('ci:vitest:test-suite:start', (ctx) => {
-      const { codeOwnersEntries, repositoryRoot, testSuiteAbsolutePath, frameworkVersion } = ctx
+      const {
+        codeOwnersEntries,
+        repositoryRoot,
+        requestErrorTags,
+        testSuiteAbsolutePath,
+        frameworkVersion,
+        isTestFrameworkWorker,
+      } = ctx
 
       const testCommand = ctx.testCommand || 'vitest run'
       const { testSessionId, testModuleId } = ctx
@@ -348,9 +330,13 @@ class VitestPlugin extends CiPlugin {
           testSuite,
           'vitest'
         ),
+        ...requestErrorTags,
         [TEST_SOURCE_FILE]: testSuite,
         [TEST_SOURCE_START]: 1,
       }
+      if (isTestFrameworkWorker) {
+        testSuiteMetadata[TEST_IS_TEST_FRAMEWORK_WORKER] = 'true'
+      }
 
       const codeOwners = this.getCodeOwners(testSuiteMetadata)
       if (codeOwners) {
@@ -374,13 +360,17 @@ class VitestPlugin extends CiPlugin {
       return ctx.currentStore
     })
 
-    this.addSub('ci:vitest:test-suite:finish', ({ testSuiteSpan, status, onFinish }) => {
+    this.addSub('ci:vitest:test-suite:finish', ({ testSuiteSpan, status, deferFlush, onFinish }) => {
       if (testSuiteSpan) {
         testSuiteSpan.setTag(TEST_STATUS, status)
         testSuiteSpan.finish()
         finishAllTraceSpans(testSuiteSpan)
       }
       this.telemetry.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'suite')
+      if (deferFlush) {
+        onFinish()
+        return
+      }
       this.tracer._exporter.flush(onFinish)
       if (this.runningTestProbe) {
         this.removeDiProbe(this.runningTestProbe)
@@ -409,9 +399,14 @@ class VitestPlugin extends CiPlugin {
       isEarlyFlakeDetectionEnabled,
       isEarlyFlakeDetectionFaulty,
       isTestManagementTestsEnabled,
+      requestErrorTags,
       vitestPool,
       onFinish,
     }) => {
+      for (const [tag, value] of Object.entries(requestErrorTags || {})) {
+        this.testSessionSpan.setTag(tag, value)
+        this.testModuleSpan.setTag(tag, value)
+      }
       this.testSessionSpan.setTag(TEST_STATUS, status)
       this.testModuleSpan.setTag(TEST_STATUS, status)
       if (error) {
@@ -469,13 +464,6 @@ class VitestPlugin extends CiPlugin {
       onDone,
     })
   }
-
-  getTestProperties (testManagementTests, testSuite, testName) {
-    const { attempt_to_fix: isAttemptToFix, disabled: isDisabled, quarantined: isQuarantined } =
-      testManagementTests?.vitest?.suites?.[testSuite]?.tests?.[testName]?.properties || {}
-
-    return { isAttemptToFix, isDisabled, isQuarantined }
-  }
 }
 
 module.exports = VitestPlugin

From 2de7de134f3d9cfeddeda6279058bd5810a35b2a Mon Sep 17 00:00:00 2001
From: Yiming Luo <10097700+lym953@users.noreply.github.com>
Date: Wed, 1 Jul 2026 11:11:11 -0400
Subject: [PATCH 36/51] fix(aws-durable-execution-sdk-js): treat FAILED
 checkpoints as replays (#9160)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A durable operation served from a FAILED checkpoint on replay (the SDK
re-raises the stored error without running the body) was not recognized as a
replay: both `aws.durable.replayed` and the `aws.durable.operation_attempt`
normalization keyed only on `Status === 'SUCCEEDED'`.

As a result a caught-then-replayed failed operation reported
`replayed=false` and a 1-indexed `operation_attempt` (e.g. 2 for a step whose
2nd attempt failed) — one higher than, and inconsistent with, the live final
attempt (1). This is the same off-by-one #8595 fixed for SUCCEEDED, still open
for FAILED.

Treat a terminal checkpoint (SUCCEEDED or FAILED) as a replay for both tags, so
the replay agrees with the live run (replayed=true, operation_attempt=1).
Verified in production on a durable Lambda.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../src/util.js                               | 24 +++++++++-----
 .../test/index.spec.js                        | 33 +++++++++++++++++++
 2 files changed, 48 insertions(+), 9 deletions(-)

diff --git a/packages/datadog-plugin-aws-durable-execution-sdk-js/src/util.js b/packages/datadog-plugin-aws-durable-execution-sdk-js/src/util.js
index 2196543e62..d2f1303697 100644
--- a/packages/datadog-plugin-aws-durable-execution-sdk-js/src/util.js
+++ b/packages/datadog-plugin-aws-durable-execution-sdk-js/src/util.js
@@ -2,6 +2,12 @@
 
 const { createHash } = require('node:crypto')
 
+// A checkpoint in one of these terminal states means the operation is served from the checkpoint
+// on a replay rather than executed: the SDK reloads a SUCCEEDED result or re-raises a FAILED error
+// without running the user function. Both also carry the 1-indexed attempt that reached the terminal
+// state, so both need the same normalization to agree with the 0-indexed live run.
+const REPLAYED_STATUSES = new Set(['SUCCEEDED', 'FAILED'])
+
 /**
  * Resolves the SDK's next stepId and its checkpoint entry in a single pass, so one span start can
  * feed both addOpMeta and getOperationAttempt without traversing the SDK internals twice. `stepData`
@@ -18,9 +24,9 @@ function getStepDataForNext (ctxImpl) {
 /**
  * Populates the replay and operation_id tags from a pre-resolved step lookup (see
  * getStepDataForNext). `aws.durable.replayed` is always set ('true' when the next stepId already
- * has a SUCCEEDED checkpoint entry, i.e. the op will be served from the SDK's checkpoint).
- * `aws.durable.operation_id` — the 16-hex-char MD5 of the stepId, mirroring the SDK's internal
- * calculation — is only added when a stepId exists.
+ * has a terminal checkpoint entry — SUCCEEDED or FAILED — i.e. the op will be served from the SDK's
+ * checkpoint rather than executed). `aws.durable.operation_id` — the 16-hex-char MD5 of the stepId,
+ * mirroring the SDK's internal calculation — is only added when a stepId exists.
  * @param {Record<string, string>} meta - The span meta/tags object to populate.
  * @param {{ stepId?: string, stepData?: object }} stepInfo - Resolved next stepId and checkpoint entry.
  * @returns {void}
@@ -30,7 +36,7 @@ function addOpMeta (meta, { stepId, stepData }) {
     meta['aws.durable.replayed'] = 'false'
     return
   }
-  meta['aws.durable.replayed'] = String(stepData?.Status === 'SUCCEEDED')
+  meta['aws.durable.replayed'] = String(REPLAYED_STATUSES.has(stepData?.Status))
   meta['aws.durable.operation_id'] = createHash('md5').update(stepId).digest('hex').slice(0, 16)
 }
 
@@ -39,10 +45,10 @@ function addOpMeta (meta, { stepId, stepData }) {
  * checkpoint entry (see getStepDataForNext), defaulting to 0 before any checkpoint exists.
  *
  * StepDetails.Attempt is indexed differently depending on checkpoint status: on a pending/retry
- * checkpoint it's the count of prior failed attempts (already 0-indexed), but on a SUCCEEDED
- * checkpoint (a replay) it's the 1-indexed attempt that succeeded. We subtract 1 in the latter
- * case so a replay agrees with the original run, flooring at 0 since the 1-indexing is observed
- * server behavior, not an SDK guarantee.
+ * checkpoint it's the count of prior failed attempts (already 0-indexed), but on a terminal
+ * checkpoint read on replay (SUCCEEDED or FAILED) it's the 1-indexed attempt that reached that
+ * state. We subtract 1 in the terminal case so a replay agrees with the original run, flooring at
+ * 0 since the 1-indexing is observed server behavior, not an SDK guarantee.
  *
  * @param {object} [stepData] - The checkpoint entry for the next stepId.
  * @returns {number}
@@ -50,7 +56,7 @@ function addOpMeta (meta, { stepId, stepData }) {
 function getOperationAttempt (stepData) {
   const attempt = stepData?.StepDetails?.Attempt
   if (!Number.isFinite(attempt)) return 0
-  return stepData.Status === 'SUCCEEDED' ? Math.max(0, attempt - 1) : attempt
+  return REPLAYED_STATUSES.has(stepData.Status) ? Math.max(0, attempt - 1) : attempt
 }
 
 /**
diff --git a/packages/datadog-plugin-aws-durable-execution-sdk-js/test/index.spec.js b/packages/datadog-plugin-aws-durable-execution-sdk-js/test/index.spec.js
index a46211af40..dad750351d 100644
--- a/packages/datadog-plugin-aws-durable-execution-sdk-js/test/index.spec.js
+++ b/packages/datadog-plugin-aws-durable-execution-sdk-js/test/index.spec.js
@@ -419,6 +419,39 @@ createIntegrationTestSuite('aws-durable-execution-sdk-js', '@aws/durable-executi
     return replayedStep
   })
 
+  it('checkpoint plugin: replayed step that failed permanently reports normalized operation_attempt', async () => {
+    const replayedFailedStep = agent.assertSomeTraces(traces => {
+      const span = traces.flat().find(s =>
+        s.name === 'aws.durable.step' &&
+        s.resource === 'always-fails' &&
+        s.meta?.['aws.durable.replayed'] === 'true'
+      )
+      assert.ok(span, 'expected a replayed FAILED step span')
+      // The step exhausts its retries and fails on its 2nd attempt. On replay the SDK reloads the
+      // FAILED checkpoint (re-raising without running the body), whose StepDetails.Attempt is the
+      // 1-indexed attempt that failed (2). A FAILED checkpoint is a replay just like a SUCCEEDED
+      // one, so it is tagged replayed=true and normalized back to the live 0-indexed final attempt.
+      assert.equal(span.metrics?.['aws.durable.operation_attempt'], 1,
+        'replayed FAILED step should carry the normalized operation_attempt=1')
+    }, { timeoutMs: 8000 })
+
+    await invokeHandler(async (event, ctx) => {
+      try {
+        await ctx.step(
+          'always-fails',
+          async () => { throw new Error('permanent failure') },
+          { retryStrategy: (error, attempt) => ({ shouldRetry: attempt < 2, delay: { seconds: 1 } }) }
+        )
+      } catch {
+        // The durable step surfaces the permanent failure; swallow it so the execution continues
+        // to the wait below, whose replay re-reads the now-FAILED checkpoint.
+      }
+      await ctx.wait('suspend-trigger', { seconds: 1 })
+    })
+
+    return replayedFailedStep
+  })
+
   // waitForCondition is the other retryable op. Its StepDetails.Attempt follows the
   // same convention as step (live: prior-attempt count; SUCCEEDED replay: 1-indexed
   // attempt that succeeded), so it must get the same replay normalization. This guards

From 282cbe8f086b7def9cb76076a8968eaae6161c26 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Jul 2026 20:58:03 +0200
Subject: [PATCH 37/51] chore(deps): bump the
 vendor-minor-and-patch-dependencies group across 1 directory with 2 updates
 (#9163)

Bumps the vendor-minor-and-patch-dependencies group with 2 updates in the /vendor directory: [protobufjs](https://github.com/protobufjs/protobuf.js) and [shell-quote](https://github.com/ljharb/shell-quote).


Updates `protobufjs` from 8.6.4 to 8.6.5
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/protobufjs/protobuf.js/compare/protobufjs-v8.6.4...protobufjs-v8.6.5)

Updates `shell-quote` from 1.8.4 to 1.9.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ljharb/shell-quote/compare/v1.8.4...v1.9.0)

---
updated-dependencies:
- dependency-name: protobufjs
  dependency-version: 8.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: vendor-minor-and-patch-dependencies
- dependency-name: shell-quote
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: vendor-minor-and-patch-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 vendor/package-lock.json | 16 ++++++++--------
 vendor/package.json      |  4 ++--
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/vendor/package-lock.json b/vendor/package-lock.json
index 1f89fa32fd..085b8bc688 100644
--- a/vendor/package-lock.json
+++ b/vendor/package-lock.json
@@ -26,11 +26,11 @@
         "module-details-from-path": "^1.0.4",
         "mutexify": "^1.4.0",
         "pprof-format": "^2.2.2",
-        "protobufjs": "^8.6.4",
+        "protobufjs": "^8.6.5",
         "retry": "^0.13.1",
         "rfdc": "^1.4.1",
         "semifies": "^1.0.0",
-        "shell-quote": "^1.8.4",
+        "shell-quote": "^1.9.0",
         "source-map": "^0.7.4",
         "tlhunter-sorted-set": "^0.1.0",
         "ttl-set": "^1.0.0"
@@ -672,9 +672,9 @@
       "license": "MIT"
     },
     "node_modules/protobufjs": {
-      "version": "8.6.4",
-      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-8.6.4.tgz",
-      "integrity": "sha512-/+XMv9JalknuncEJSwsyEVlwcxVLKx2iaoSUXFZA86MJkdqyOdfrlB1sB7S6aKyUk9tl20YY+SgQe5J2sJHTcg==",
+      "version": "8.6.5",
+      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-8.6.5.tgz",
+      "integrity": "sha512-zeE5LPpencAGXvsxyOYmEgJhxzHY8IsmPAFzstZVhDSVT8QH03q6gMZwZRaQGApevZbAL6u28ugs4CC+YKB2jQ==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "long": "^5.3.2"
@@ -711,9 +711,9 @@
       "license": "Apache-2.0"
     },
     "node_modules/shell-quote": {
-      "version": "1.8.4",
-      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz",
-      "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==",
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.9.0.tgz",
+      "integrity": "sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWXgkfml7hjqA==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
diff --git a/vendor/package.json b/vendor/package.json
index 276749f582..2dc734b2cd 100644
--- a/vendor/package.json
+++ b/vendor/package.json
@@ -23,11 +23,11 @@
     "module-details-from-path": "^1.0.4",
     "mutexify": "^1.4.0",
     "pprof-format": "^2.2.2",
-    "protobufjs": "^8.6.4",
+    "protobufjs": "^8.6.5",
     "retry": "^0.13.1",
     "rfdc": "^1.4.1",
     "semifies": "^1.0.0",
-    "shell-quote": "^1.8.4",
+    "shell-quote": "^1.9.0",
     "source-map": "^0.7.4",
     "tlhunter-sorted-set": "^0.1.0",
     "ttl-set": "^1.0.0"

From e01ded4c688c15a34f201650bb989479a5afcabb Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Thu, 2 Jul 2026 00:10:43 +0200
Subject: [PATCH 38/51] test(oracledb): bound connect and query timeouts in the
 ESM integration fixture (#9105)

The ESM integration fixture connected with no client-side timeout, so a stalled
Oracle round-trip hung the subprocess until the 20s mocha per-test timeout fired
with no diagnosable error. CI hit this intermittently: five of six sibling ESM
subprocesses connected and ran the query in ~0.5s while one wedged for the full
window. connect_timeout bounds the connect phase and callTimeout bounds each
query round-trip, so a stalled session now throws (NJS-123 / a connect error)
well inside the budget and the test fails fast and attributable instead of as a
generic timeout.

Refs: https://github.com/oracle/node-oracledb/issues/1592
---
 .../datadog-plugin-oracledb/test/integration-test/server.mjs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/packages/datadog-plugin-oracledb/test/integration-test/server.mjs b/packages/datadog-plugin-oracledb/test/integration-test/server.mjs
index 8d2740708a..d67605a657 100644
--- a/packages/datadog-plugin-oracledb/test/integration-test/server.mjs
+++ b/packages/datadog-plugin-oracledb/test/integration-test/server.mjs
@@ -6,12 +6,15 @@ const hostname = 'localhost'
 const config = {
   user: 'test',
   password: 'Oracle18',
-  connectString: `${hostname}:1521/xepdb1`,
+  // connect_timeout bounds the connect phase; callTimeout below bounds each query round-trip.
+  connectString: `${hostname}:1521/xepdb1?connect_timeout=15`,
 }
 
 const dbQuery = 'select current_timestamp from dual'
 
 const connection = await oracledb.getConnection(config)
+// callTimeout bounds each query round-trip. No effect on IPC connections; this connects over TCP.
+connection.callTimeout = 10_000
 await connection.execute(dbQuery)
 
 if (connection) {

From 2c196581f02c8e4af80d7a1cb627c27a42989146 Mon Sep 17 00:00:00 2001
From: Thomas Watson <thomas.watson@datadoghq.com>
Date: Thu, 2 Jul 2026 02:14:49 +0200
Subject: [PATCH 39/51] test(debugger): cover breakpoint error paths (#8996)

Add focused unit coverage for existing debugger breakpoint behavior that was
previously untested. The new cases cover source map location translation
failures, inspector breakpoint operation failures, and async re-evaluation
error logging.
---
 .../devtools_client/breakpoints.spec.js       | 136 +++++++++++++++++-
 1 file changed, 134 insertions(+), 2 deletions(-)

diff --git a/packages/dd-trace/test/debugger/devtools_client/breakpoints.spec.js b/packages/dd-trace/test/debugger/devtools_client/breakpoints.spec.js
index 7f0df68390..f07a4563ef 100644
--- a/packages/dd-trace/test/debugger/devtools_client/breakpoints.spec.js
+++ b/packages/dd-trace/test/debugger/devtools_client/breakpoints.spec.js
@@ -23,6 +23,13 @@ describe('breakpoints', function () {
    * }}
    */
   let sessionMock
+  /**
+   * @type {{
+   *   getGeneratedPosition: sinon.SinonStub;
+   *   '@noCallThru': boolean;
+   * }}
+   */
+  let sourceMapsMock
   /**
    * @type {{
    *   debug: sinon.SinonStub;
@@ -31,6 +38,8 @@ describe('breakpoints', function () {
    * }}
    */
   let logMock
+  /** @type {() => void} */
+  let scriptLoadingStabilizedCallback
   /**
    * @type {{
    *   findScriptFromPartialPath: sinon.SinonStub;
@@ -77,14 +86,22 @@ describe('breakpoints', function () {
       }),
       /**
        * @param {string} event
-       * @param {Function} callback
+       * @param {() => void} callback
        */
       on (event, callback) {
-        if (event === 'scriptLoadingStabilized') callback()
+        if (event === 'scriptLoadingStabilized') {
+          scriptLoadingStabilizedCallback = callback
+          callback()
+        }
       },
       '@noCallThru': true,
     }
 
+    sourceMapsMock = {
+      getGeneratedPosition: sinon.stub(),
+      '@noCallThru': true,
+    }
+
     logMock = {
       debug: sinon.stub(),
       error: sinon.stub(),
@@ -108,6 +125,7 @@ describe('breakpoints', function () {
 
     breakpoints = proxyquire('../../../src/debugger/devtools_client/breakpoints', {
       './session': sessionMock,
+      './source-maps': sourceMapsMock,
       './state': stateMock,
       './log': logMock,
     })
@@ -176,6 +194,51 @@ describe('breakpoints', function () {
       )
     })
 
+    it('should translate source-mapped locations before setting the breakpoint', async function () {
+      stateMock.findScriptFromPartialPath.returns({
+        url: 'file:///path/to/test.js',
+        scriptId: 'script-1',
+        sourceMapURL: 'test.js.map',
+        source: 'source',
+      })
+      sourceMapsMock.getGeneratedPosition.resolves({ line: 12, column: 4 })
+
+      await addProbe()
+
+      sinon.assert.calledOnceWithExactly(
+        sourceMapsMock.getGeneratedPosition,
+        'file:///path/to/test.js',
+        'source',
+        10,
+        'test.js.map'
+      )
+      sinon.assert.calledWith(sessionMock.post.secondCall, 'Debugger.setBreakpoint', {
+        location: {
+          scriptId: 'script-1',
+          lineNumber: 11,
+          columnNumber: 4,
+        },
+        condition: compileBreakpointCondition([{ id: 'probe-1', samplingIndex: 0, nsBetweenSampling: 200000n }]),
+      })
+    })
+
+    it('should throw if a source map cannot resolve the generated location', async function () {
+      stateMock.findScriptFromPartialPath.returns({
+        url: 'file:///path/to/test.js',
+        scriptId: 'script-1',
+        sourceMapURL: 'test.js.map',
+        source: 'source',
+      })
+      sourceMapsMock.getGeneratedPosition.resolves({ line: null, column: null })
+
+      await assert.rejects(
+        addProbe(),
+        {
+          message: 'Could not find generated position for file:///path/to/test.js:10:0 (probe: probe-1, version: 1)',
+        }
+      )
+    })
+
     describe('capture limits', function () {
       it('should set default capture limits when captureSnapshot is true', async function () {
         await addProbe({ captureSnapshot: true })
@@ -468,6 +531,26 @@ describe('breakpoints', function () {
         })
     })
 
+    it('should wrap errors when setting a new breakpoint fails', async function () {
+      const cause = new Error('inspector failure')
+      sessionMock.post.callsFake((method, { location } = {}) => {
+        if (method === 'Debugger.setBreakpoint') {
+          return Promise.reject(cause)
+        }
+        return Promise.resolve({})
+      })
+
+      await assert.rejects(
+        addProbe(),
+        (err) => {
+          assert(err instanceof Error)
+          assert.strictEqual(err.message, 'Error setting breakpoint for probe probe-1 (version: 1)')
+          assert.strictEqual(err.cause, cause)
+          return true
+        }
+      )
+    })
+
     it('should wrap errors when replacing a breakpoint while adding a probe fails', async function () {
       await addProbe()
       sessionMock.post.resetHistory()
@@ -942,6 +1025,35 @@ describe('breakpoints', function () {
       })
     })
 
+    it('should wrap errors when removing a breakpoint fails', async function () {
+      await addProbe()
+      await addProbe({ id: 'probe-2', where: { sourceFile: 'test2.js', lines: ['20'] } })
+      sessionMock.post.resetHistory()
+
+      const cause = new Error('inspector failure')
+      sessionMock.post.callsFake((method, { location } = {}) => {
+        if (method === 'Debugger.removeBreakpoint') {
+          return Promise.reject(cause)
+        }
+        if (method === 'Debugger.setBreakpoint') {
+          return Promise.resolve({
+            breakpointId: `bp-${location.scriptId}:${location.lineNumber}:${location.columnNumber}`,
+          })
+        }
+        return Promise.resolve({})
+      })
+
+      await assert.rejects(
+        breakpoints.removeBreakpoint({ id: 'probe-1' }),
+        (err) => {
+          assert(err instanceof Error)
+          assert.strictEqual(err.message, 'Error removing breakpoint for probe probe-1')
+          assert.strictEqual(err.cause, cause)
+          return true
+        }
+      )
+    })
+
     it('should throw error if debugger not started', async function () {
       await breakpoints.removeBreakpoint({ id: 'probe-1' })
         .then(() => {
@@ -1032,6 +1144,26 @@ describe('breakpoints', function () {
     })
   })
 
+  describe('re-evaluation', function () {
+    it('should log errors from async probe re-evaluation', async function () {
+      await addProbe()
+      logMock.error.resetHistory()
+
+      const cause = new Error('script lookup failure')
+      stateMock.findScriptFromPartialPath.throws(cause)
+
+      scriptLoadingStabilizedCallback()
+      await Promise.resolve()
+
+      sinon.assert.calledWith(
+        logMock.error,
+        '[debugger:devtools_client] Error re-evaluating probe %s',
+        'probe-1',
+        cause
+      )
+    })
+  })
+
   /**
    * Add a generated probe.
    *

From 3868c386423ecbfbe7c369a82e5e204762b40671 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 2 Jul 2026 00:29:31 +0000
Subject: [PATCH 40/51] chore(deps-dev): bump the
 dev-minor-and-patch-dependencies group across 1 directory with 5 updates
 (#9165)

Bumps the dev-minor-and-patch-dependencies group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios) | `1.18.0` | `1.18.1` |
| [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) | `63.0.6` | `63.0.8` |
| [eslint-plugin-n](https://github.com/eslint-community/eslint-plugin-n) | `18.1.0` | `18.2.0` |
| [globals](https://github.com/sindresorhus/globals) | `17.6.0` | `17.7.0` |
| [semver](https://github.com/npm/node-semver) | `7.8.4` | `7.8.5` |



Updates `axios` from 1.18.0 to 1.18.1
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.18.0...v1.18.1)

Updates `eslint-plugin-jsdoc` from 63.0.6 to 63.0.8
- [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases)
- [Commits](https://github.com/gajus/eslint-plugin-jsdoc/compare/v63.0.6...v63.0.8)

Updates `eslint-plugin-n` from 18.1.0 to 18.2.0
- [Release notes](https://github.com/eslint-community/eslint-plugin-n/releases)
- [Changelog](https://github.com/eslint-community/eslint-plugin-n/blob/master/CHANGELOG.md)
- [Commits](https://github.com/eslint-community/eslint-plugin-n/compare/v18.1.0...v18.2.0)

Updates `globals` from 17.6.0 to 17.7.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v17.6.0...v17.7.0)

Updates `semver` from 7.8.4 to 7.8.5
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](https://github.com/npm/node-semver/compare/v7.8.4...v7.8.5)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.18.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-minor-and-patch-dependencies
- dependency-name: eslint-plugin-jsdoc
  dependency-version: 63.0.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-minor-and-patch-dependencies
- dependency-name: eslint-plugin-n
  dependency-version: 18.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-minor-and-patch-dependencies
- dependency-name: globals
  dependency-version: 17.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-minor-and-patch-dependencies
- dependency-name: semver
  dependency-version: 7.8.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-minor-and-patch-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>
---
 package.json | 10 +++++-----
 yarn.lock    | 40 ++++++++++++++++++++--------------------
 2 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/package.json b/package.json
index 80a44b2c5b..2c6279b5fc 100644
--- a/package.json
+++ b/package.json
@@ -192,7 +192,7 @@
     "@types/mocha": "^10.0.10",
     "@types/node": "^18.19.106",
     "@types/sinon": "^21.0.1",
-    "axios": "^1.18.0",
+    "axios": "^1.18.1",
     "benchmark": "^2.1.4",
     "body-parser": "^2.3.0",
     "bun": "1.3.14",
@@ -201,15 +201,15 @@
     "eslint": "^9.39.2",
     "eslint-plugin-cypress": "^6.4.1",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-jsdoc": "^63.0.6",
+    "eslint-plugin-jsdoc": "^63.0.8",
     "eslint-plugin-mocha": "^11.3.0",
-    "eslint-plugin-n": "^18.1.0",
+    "eslint-plugin-n": "^18.2.0",
     "eslint-plugin-promise": "^7.3.0",
     "eslint-plugin-sonarjs": "^4.1.0",
     "eslint-plugin-unicorn": "^64.0.0",
     "express": "^5.1.0",
     "glob": "^10.4.5",
-    "globals": "^17.2.0",
+    "globals": "^17.7.0",
     "graphql": "*",
     "husky": "^9.1.7",
     "istanbul-lib-report": "^3.0.0",
@@ -227,7 +227,7 @@
     "proxyquire": "^2.1.3",
     "retry": "^0.13.1",
     "semifies": "^1.0.0",
-    "semver": "^7.8.4",
+    "semver": "^7.8.5",
     "sinon": "^22.0.0",
     "tiktoken": "^1.0.21",
     "typescript": "^6.0.3",
diff --git a/yarn.lock b/yarn.lock
index 5773f4d2da..5eea56ddd6 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1260,10 +1260,10 @@ available-typed-arrays@^1.0.7:
   dependencies:
     possible-typed-array-names "^1.0.0"
 
-axios@^1.18.0:
-  version "1.18.0"
-  resolved "https://registry.yarnpkg.com/axios/-/axios-1.18.0.tgz#8a7f8854af280fcaae063272df2ed9f3837d2398"
-  integrity sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw==
+axios@^1.18.1:
+  version "1.18.1"
+  resolved "https://registry.yarnpkg.com/axios/-/axios-1.18.1.tgz#d63f9863bcd8938815c86f9e2abd380189d96dfe"
+  integrity sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==
   dependencies:
     follow-redirects "^1.16.0"
     form-data "^4.0.5"
@@ -1998,10 +1998,10 @@ eslint-plugin-import@^2.32.0:
     string.prototype.trimend "^1.0.9"
     tsconfig-paths "^3.15.0"
 
-eslint-plugin-jsdoc@^63.0.6:
-  version "63.0.6"
-  resolved "https://registry.yarnpkg.com/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-63.0.6.tgz#ae504659abf5e01fd1afb1051adb8e4309cd899a"
-  integrity sha512-qXMUdwQf+igjSLe/DZqyY1baVR0+snEJ3l/+2odJjeoAG43PrcpA0tSaLw2dC1iHvfKzo1YnZLGvgxrvAViyfQ==
+eslint-plugin-jsdoc@^63.0.8:
+  version "63.0.8"
+  resolved "https://registry.yarnpkg.com/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-63.0.8.tgz#d8838d0b23983e11030d7acc54d5e338db921f72"
+  integrity sha512-0rLBDD03N6aL+axOtkSSaUoqhHOPKe+I1gS6dLEwm9zjqAd1e78Z7cilTnkNRQ8wOiEvzR6mvl6IDu7jiTR8UA==
   dependencies:
     "@es-joy/jsdoccomment" "~0.87.0"
     "@es-joy/resolve.exports" "1.2.0"
@@ -2026,10 +2026,10 @@ eslint-plugin-mocha@^11.3.0:
     "@eslint-community/eslint-utils" "^4.4.1"
     globals "^15.14.0"
 
-eslint-plugin-n@^18.1.0:
-  version "18.1.0"
-  resolved "https://registry.yarnpkg.com/eslint-plugin-n/-/eslint-plugin-n-18.1.0.tgz#c1eadf2bc59704bf0078eca8d59743a7386b1081"
-  integrity sha512-hkUm9EtnFV2h2fE16jNVUfCVUqvPzI7fGLsFdun5lFt/pbmf2kCgDx6ymi9rx+NCUSggBmurJCZOfG20JBs/kg==
+eslint-plugin-n@^18.2.0:
+  version "18.2.0"
+  resolved "https://registry.yarnpkg.com/eslint-plugin-n/-/eslint-plugin-n-18.2.0.tgz#264530a08db399a2dc9b3d94d82a5181bb9c28ef"
+  integrity sha512-Hf7bfQ5qBC1U/E5jLM9s3pE5su4HHnPmPxVsYzHgS3X0Eg7/9cK7lf+JBx29YEyZ09DqJ34bS/bcb4Dyv3Th9w==
   dependencies:
     "@eslint-community/eslint-utils" "^4.5.0"
     enhanced-resolve "^5.17.1"
@@ -2511,10 +2511,10 @@ globals@^15.11.0, globals@^15.14.0:
   resolved "https://registry.yarnpkg.com/globals/-/globals-15.15.0.tgz#7c4761299d41c32b075715a4ce1ede7897ff72a8"
   integrity sha512-7ACyT3wmyp3I61S4fG682L0VA2RGD9otkqGJIwNUMF1SWUombIIk+af1unuDYgMm082aHYwD+mzJvv9Iu8dsgg==
 
-globals@^17.2.0, globals@^17.4.0, globals@^17.6.0:
-  version "17.6.0"
-  resolved "https://registry.yarnpkg.com/globals/-/globals-17.6.0.tgz#0f0be018d5cca8690e6375ead1f65c4bb96191fc"
-  integrity sha512-sepffkT8stwnIYbsMBpoCHJuJM5l98FUF2AnE07hfvE0m/qp3R586hw4jF4uadbhvg1ooIdzuu7CsfD2jzCaNA==
+globals@^17.4.0, globals@^17.6.0, globals@^17.7.0:
+  version "17.7.0"
+  resolved "https://registry.yarnpkg.com/globals/-/globals-17.7.0.tgz#553d55090b4dde8209ec2da42580d6e7e7d8b10d"
+  integrity sha512-Czmyns5dUsq4seFBR/Kdydhmo8y9kC79hiSkPn0YcGtNnYWnrgt0vjrSjx9tspoDGWm2CMarffRuLjM4xUz8xg==
 
 globalthis@^1.0.4:
   version "1.0.4"
@@ -4054,10 +4054,10 @@ semver@^6.0.0, semver@^6.3.1:
   resolved "https://registry.yarnpkg.com/semver/-/semver-6.3.1.tgz#556d2ef8689146e46dcea4bfdd095f3434dffcb4"
   integrity sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==
 
-semver@^7.5.0, semver@^7.5.3, semver@^7.5.4, semver@^7.6.3, semver@^7.7.4, semver@^7.8.2, semver@^7.8.4:
-  version "7.8.4"
-  resolved "https://registry.yarnpkg.com/semver/-/semver-7.8.4.tgz#c73eceebae0616934be8dff28a7fd70757c8e696"
-  integrity sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA==
+semver@^7.5.0, semver@^7.5.3, semver@^7.5.4, semver@^7.6.3, semver@^7.7.4, semver@^7.8.2, semver@^7.8.4, semver@^7.8.5:
+  version "7.8.5"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-7.8.5.tgz#39b646037dd50c14fb451e7e4cac58ed8b863f69"
+  integrity sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==
 
 send@^1.1.0, send@^1.2.0:
   version "1.2.1"

From b876859cdf7dcbe6a2d0e7fb450beb15a585bd1c Mon Sep 17 00:00:00 2001
From: Carles Capell <107924659+CarlesDD@users.noreply.github.com>
Date: Thu, 2 Jul 2026 02:47:01 +0200
Subject: [PATCH 41/51] docs(agents): clarify internal import ordering rule
 (#9172)

---
 AGENTS.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index 99ae9ce812..16b70a8836 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -173,7 +173,7 @@ Separate groups with empty line, sort alphabetically within each:
 
 1. Node.js core modules (with `node:` prefix)
 2. Third-party modules
-3. Internal imports (by path proximity, then alpha)
+3. Internal imports (by path proximity, furthest first, then alpha)
 
 ### ECMAScript and Node.js API Standards
 

From 596169b956186478b28be198ccccda43ab750507 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Antonio=20Fern=C3=A1ndez=20de=20Alba?=
 <juan.fernandezdealba@datadoghq.com>
Date: Thu, 2 Jul 2026 12:37:24 +0200
Subject: [PATCH 42/51] fix(vitest): report typecheck tests (#9176)

---
 .github/CODEOWNERS                            |   5 +
 .../vitest-tests/typecheck-fail.test-d.ts     |   5 +
 .../typecheck-test-management-fail.test-d.ts  |  15 +
 ...echeck-test-management-file-fail.test-d.ts |  13 +
 .../vitest-tests/typecheck.test-d.ts          |  31 +
 .../tsconfig.typecheck-fail.json              |   6 +
 ...config.typecheck-test-management-fail.json |   6 +
 ...g.typecheck-test-management-file-fail.json |   6 +
 integration-tests/tsconfig.typecheck.json     |  15 +
 integration-tests/vitest.typecheck.config.mjs |  42 ++
 integration-tests/vitest/vitest.core.spec.js  | 531 +++++++++++++++++-
 .../src/vitest-main.js                        | 342 +++++++++++
 12 files changed, 1016 insertions(+), 1 deletion(-)
 create mode 100644 integration-tests/ci-visibility/vitest-tests/typecheck-fail.test-d.ts
 create mode 100644 integration-tests/ci-visibility/vitest-tests/typecheck-test-management-fail.test-d.ts
 create mode 100644 integration-tests/ci-visibility/vitest-tests/typecheck-test-management-file-fail.test-d.ts
 create mode 100644 integration-tests/ci-visibility/vitest-tests/typecheck.test-d.ts
 create mode 100644 integration-tests/tsconfig.typecheck-fail.json
 create mode 100644 integration-tests/tsconfig.typecheck-test-management-fail.json
 create mode 100644 integration-tests/tsconfig.typecheck-test-management-file-fail.json
 create mode 100644 integration-tests/tsconfig.typecheck.json
 create mode 100644 integration-tests/vitest.typecheck.config.mjs

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index cae9183df9..20ea7c6a6e 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -146,6 +146,11 @@
 /integration-tests/vitest/ @DataDog/ci-app-libraries
 /integration-tests/vitest.config.mjs @DataDog/ci-app-libraries
 /integration-tests/vitest.second-project.config.mjs @DataDog/ci-app-libraries
+/integration-tests/vitest.typecheck.config.mjs @DataDog/ci-app-libraries
+/integration-tests/tsconfig.typecheck.json @DataDog/ci-app-libraries
+/integration-tests/tsconfig.typecheck-fail.json @DataDog/ci-app-libraries
+/integration-tests/tsconfig.typecheck-test-management-fail.json @DataDog/ci-app-libraries
+/integration-tests/tsconfig.typecheck-test-management-file-fail.json @DataDog/ci-app-libraries
 /integration-tests/ci-visibility-intake.js @DataDog/ci-app-libraries
 /integration-tests/ci-visibility-intake.spec.js @DataDog/ci-app-libraries
 /integration-tests/CODEOWNERS @DataDog/ci-app-libraries
diff --git a/integration-tests/ci-visibility/vitest-tests/typecheck-fail.test-d.ts b/integration-tests/ci-visibility/vitest-tests/typecheck-fail.test-d.ts
new file mode 100644
index 0000000000..174f0f1256
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/typecheck-fail.test-d.ts
@@ -0,0 +1,5 @@
+import { expectTypeOf, test } from 'vitest'
+
+test('typecheck can report failing assertion', () => {
+  expectTypeOf({ value: 'not ok' }).toEqualTypeOf<{ value: number }>()
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/typecheck-test-management-fail.test-d.ts b/integration-tests/ci-visibility/vitest-tests/typecheck-test-management-fail.test-d.ts
new file mode 100644
index 0000000000..cbf7bdc793
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/typecheck-test-management-fail.test-d.ts
@@ -0,0 +1,15 @@
+import { describe, expectTypeOf, test } from 'vitest'
+
+test('typecheck can report disabled failing assertion', () => {
+  expectTypeOf({ value: 'disabled fail' }).toEqualTypeOf<{ value: number }>()
+})
+
+test('typecheck can report quarantined failing assertion', () => {
+  expectTypeOf({ value: 'quarantined fail' }).toEqualTypeOf<{ value: number }>()
+})
+
+describe('typecheck nested failing suite', () => {
+  test('can report nested disabled failing assertion', () => {
+    expectTypeOf({ value: 'nested disabled fail' }).toEqualTypeOf<{ value: number }>()
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/typecheck-test-management-file-fail.test-d.ts b/integration-tests/ci-visibility/vitest-tests/typecheck-test-management-file-fail.test-d.ts
new file mode 100644
index 0000000000..3ed1a94e38
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/typecheck-test-management-file-fail.test-d.ts
@@ -0,0 +1,13 @@
+import { describe, expectTypeOf, test } from 'vitest'
+
+const fileLevelTypeError: number = 'file-level typecheck error'
+
+describe('typecheck container failing suite', () => {
+  test('can report disabled assertion with file-level error', () => {
+    expectTypeOf({ value: 'disabled pass' }).toEqualTypeOf<{ value: string }>()
+  })
+
+  test('can report quarantined assertion with file-level error', () => {
+    expectTypeOf({ value: 'quarantined pass' }).toEqualTypeOf<{ value: string }>()
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/typecheck.test-d.ts b/integration-tests/ci-visibility/vitest-tests/typecheck.test-d.ts
new file mode 100644
index 0000000000..e075e872ab
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/typecheck.test-d.ts
@@ -0,0 +1,31 @@
+import { describe, expectTypeOf, test } from 'vitest'
+
+test('typecheck can report type assertion', () => {
+  expectTypeOf({ value: 'ok' }).toEqualTypeOf<{ value: string }>()
+})
+
+test('typecheck can report disabled assertion', () => {
+  expectTypeOf({ value: 'disabled' }).toEqualTypeOf<{ value: string }>()
+})
+
+test('typecheck can report quarantined assertion', () => {
+  expectTypeOf({ value: 'quarantined' }).toEqualTypeOf<{ value: string }>()
+})
+
+test('typecheck can report attempt-to-fix assertion', () => {
+  expectTypeOf({ value: 'attempt-to-fix' }).toEqualTypeOf<{ value: string }>()
+})
+
+test.skip('typecheck can report skipped assertion', () => {
+  expectTypeOf({ value: 'skipped' }).toEqualTypeOf<{ value: string }>()
+})
+
+describe('typecheck nested suite', () => {
+  test('can report nested assertion', () => {
+    expectTypeOf({ value: 'nested' }).toEqualTypeOf<{ value: string }>()
+  })
+
+  test('can report nested disabled assertion', () => {
+    expectTypeOf({ value: 'nested disabled' }).toEqualTypeOf<{ value: string }>()
+  })
+})
diff --git a/integration-tests/tsconfig.typecheck-fail.json b/integration-tests/tsconfig.typecheck-fail.json
new file mode 100644
index 0000000000..fc4af06261
--- /dev/null
+++ b/integration-tests/tsconfig.typecheck-fail.json
@@ -0,0 +1,6 @@
+{
+  "extends": "./tsconfig.typecheck.json",
+  "include": [
+    "ci-visibility/vitest-tests/typecheck-fail.test-d.ts"
+  ]
+}
diff --git a/integration-tests/tsconfig.typecheck-test-management-fail.json b/integration-tests/tsconfig.typecheck-test-management-fail.json
new file mode 100644
index 0000000000..e50338f793
--- /dev/null
+++ b/integration-tests/tsconfig.typecheck-test-management-fail.json
@@ -0,0 +1,6 @@
+{
+  "extends": "./tsconfig.typecheck.json",
+  "include": [
+    "ci-visibility/vitest-tests/typecheck-test-management-fail.test-d.ts"
+  ]
+}
diff --git a/integration-tests/tsconfig.typecheck-test-management-file-fail.json b/integration-tests/tsconfig.typecheck-test-management-file-fail.json
new file mode 100644
index 0000000000..6953c19171
--- /dev/null
+++ b/integration-tests/tsconfig.typecheck-test-management-file-fail.json
@@ -0,0 +1,6 @@
+{
+  "extends": "./tsconfig.typecheck.json",
+  "include": [
+    "ci-visibility/vitest-tests/typecheck-test-management-file-fail.test-d.ts"
+  ]
+}
diff --git a/integration-tests/tsconfig.typecheck.json b/integration-tests/tsconfig.typecheck.json
new file mode 100644
index 0000000000..c425c4a75c
--- /dev/null
+++ b/integration-tests/tsconfig.typecheck.json
@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "skipLibCheck": true,
+    "strict": true,
+    "target": "ES2022",
+    "types": [
+      "vitest"
+    ]
+  },
+  "include": [
+    "ci-visibility/vitest-tests/typecheck.test-d.ts"
+  ]
+}
diff --git a/integration-tests/vitest.typecheck.config.mjs b/integration-tests/vitest.typecheck.config.mjs
new file mode 100644
index 0000000000..170be2cbfa
--- /dev/null
+++ b/integration-tests/vitest.typecheck.config.mjs
@@ -0,0 +1,42 @@
+import { defineConfig } from 'vite'
+
+const typecheckFixture = process.env.TYPECHECK_FAIL === 'true'
+  ? 'fail'
+  : process.env.TYPECHECK_TEST_MANAGEMENT_FAIL === 'true'
+    ? 'testManagementFail'
+    : process.env.TYPECHECK_TEST_MANAGEMENT_FILE_FAIL === 'true'
+      ? 'testManagementFileFail'
+      : 'default'
+
+const typecheckFixtures = {
+  default: {
+    typecheckFile: 'ci-visibility/vitest-tests/typecheck.test-d.ts',
+    tsconfig: 'tsconfig.typecheck.json',
+  },
+  fail: {
+    typecheckFile: 'ci-visibility/vitest-tests/typecheck-fail.test-d.ts',
+    tsconfig: 'tsconfig.typecheck-fail.json',
+  },
+  testManagementFail: {
+    typecheckFile: 'ci-visibility/vitest-tests/typecheck-test-management-fail.test-d.ts',
+    tsconfig: 'tsconfig.typecheck-test-management-fail.json',
+  },
+  testManagementFileFail: {
+    typecheckFile: 'ci-visibility/vitest-tests/typecheck-test-management-file-fail.test-d.ts',
+    tsconfig: 'tsconfig.typecheck-test-management-file-fail.json',
+  },
+}
+
+const { typecheckFile, tsconfig } = typecheckFixtures[typecheckFixture]
+
+export default defineConfig({
+  test: {
+    include: [],
+    typecheck: {
+      checker: 'tsc',
+      enabled: true,
+      include: [typecheckFile],
+      tsconfig,
+    },
+  },
+})
diff --git a/integration-tests/vitest/vitest.core.spec.js b/integration-tests/vitest/vitest.core.spec.js
index 6e09ddae53..27a597f10e 100644
--- a/integration-tests/vitest/vitest.core.spec.js
+++ b/integration-tests/vitest/vitest.core.spec.js
@@ -1,8 +1,10 @@
 'use strict'
 
 const assert = require('node:assert/strict')
+const { exec, execSync } = require('node:child_process')
 const { once } = require('node:events')
-const { exec } = require('child_process')
+const fs = require('node:fs')
+const path = require('node:path')
 const { inspect } = require('node:util')
 const { assertObjectContains } = require('../helpers')
 
@@ -28,6 +30,7 @@ const {
   TEST_COMMAND,
   TEST_SOURCE_FILE,
   TEST_SOURCE_START,
+  TEST_IS_MODIFIED,
   TEST_IS_NEW,
   TEST_NAME,
   TEST_EARLY_FLAKE_ENABLED,
@@ -43,6 +46,10 @@ const {
   TEST_HAS_FAILED_ALL_RETRIES,
   TEST_RETRY_REASON_TYPES,
   TEST_HAS_DYNAMIC_NAME,
+  TEST_FINAL_STATUS,
+  TEST_MANAGEMENT_IS_ATTEMPT_TO_FIX,
+  TEST_MANAGEMENT_IS_DISABLED,
+  TEST_MANAGEMENT_IS_QUARANTINED,
   VITEST_POOL,
   TEST_IS_TEST_FRAMEWORK_WORKER,
   DD_CI_LIBRARY_CONFIGURATION_ERROR_SETTINGS,
@@ -62,6 +69,43 @@ const FLAKY_UNNECESSARY_RETRY_RESOURCE =
   'ci-visibility/vitest-tests/flaky-test-retries.mjs.flaky test retries does not retry if unnecessary'
 const linePctMatchRegex = /Lines\s+:\s+([\d.]+)%/
 
+function assertCompleteEventHierarchy (events, testOutput) {
+  const testSessionEvent = events.find(event => event.type === 'test_session_end')
+  const testModuleEvent = events.find(event => event.type === 'test_module_end')
+  const testSuiteEvent = events.find(event => event.type === 'test_suite_end')
+  const testEvents = events.filter(event => event.type === 'test')
+
+  assert.ok(testSessionEvent, testOutput)
+  assert.ok(testModuleEvent, testOutput)
+  assert.ok(testSuiteEvent, testOutput)
+  assert.ok(testEvents.length, testOutput)
+
+  const testSession = testSessionEvent.content
+  const testModule = testModuleEvent.content
+  const testSuite = testSuiteEvent.content
+  const tests = testEvents.map(event => event.content)
+  const testSessionId = testSession.test_session_id.toString()
+  const testModuleId = testModule.test_module_id.toString()
+  const testSuiteId = testSuite.test_suite_id.toString()
+
+  assert.strictEqual(testModule.test_session_id.toString(), testSessionId)
+  assert.strictEqual(testSuite.test_session_id.toString(), testSessionId)
+  assert.strictEqual(testSuite.test_module_id.toString(), testModuleId)
+
+  for (const test of tests) {
+    assert.strictEqual(test.test_session_id.toString(), testSessionId)
+    assert.strictEqual(test.test_module_id.toString(), testModuleId)
+    assert.strictEqual(test.test_suite_id.toString(), testSuiteId)
+  }
+
+  return {
+    testSession,
+    testModule,
+    testSuite,
+    tests,
+  }
+}
+
 // vitest@4.x requires Node.js >= 20
 const versions = NODE_MAJOR <= 18 ? ['1.6.0', '3.2.6'] : ['1.6.0', 'latest']
 
@@ -69,12 +113,15 @@ versions.forEach((version) => {
   describe(`vitest@${version}`, () => {
     let cwd, receiver, childProcess, testOutput
     const newerVitestIt = version === '1.6.0' ? it.skip : it
+    const typecheckIt = version === '1.6.0' ? it.skip : it
 
     useSandbox([
       `vitest@${version}`,
       `@vitest/coverage-istanbul@${version}`,
       `@vitest/coverage-v8@${version}`,
+      '@types/node',
       'tinypool',
+      'typescript',
     ], true)
 
     before(function () {
@@ -319,6 +366,488 @@ versions.forEach((version) => {
       assert.strictEqual(code, 0)
     })
 
+    typecheckIt('can report typecheck tests', async () => {
+      const eventsPromise = receiver
+        .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
+          const events = payloads.flatMap(({ payload }) => payload.events)
+          const {
+            testSession,
+            testModule,
+            testSuite,
+            tests,
+          } = assertCompleteEventHierarchy(events, testOutput)
+          const passedTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report type assertion'
+          )
+          const skippedTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report skipped assertion'
+          )
+          const nestedTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck nested suite can report nested assertion'
+          )
+
+          assert.ok(passedTest, testOutput)
+          assert.ok(skippedTest, testOutput)
+          assert.ok(nestedTest, testOutput)
+
+          assert.strictEqual(testSession.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(testModule.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(testSuite.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(testSuite.meta[TEST_SOURCE_FILE], 'ci-visibility/vitest-tests/typecheck.test-d.ts')
+          assert.strictEqual(passedTest.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(passedTest.meta[TEST_SOURCE_FILE], 'ci-visibility/vitest-tests/typecheck.test-d.ts')
+          assert.strictEqual(skippedTest.meta[TEST_STATUS], 'skip')
+          assert.strictEqual(skippedTest.meta[TEST_SOURCE_FILE], 'ci-visibility/vitest-tests/typecheck.test-d.ts')
+          assert.strictEqual(nestedTest.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(nestedTest.meta[TEST_SOURCE_FILE], 'ci-visibility/vitest-tests/typecheck.test-d.ts')
+        }, 25000)
+
+      childProcess = exec(
+        './node_modules/.bin/vitest run --config=./vitest.typecheck.config.mjs ' +
+          'ci-visibility/vitest-tests/typecheck.test-d.ts --reporter=verbose',
+        {
+          cwd,
+          env: {
+            ...getCiVisAgentlessConfig(receiver.port),
+            NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
+            DD_SERVICE: undefined,
+          },
+        }
+      )
+      childProcess.stdout?.on('data', chunk => { testOutput += chunk.toString() })
+      childProcess.stderr?.on('data', chunk => { testOutput += chunk.toString() })
+
+      const [[code]] = await Promise.all([
+        once(childProcess, 'exit'),
+        eventsPromise,
+      ])
+
+      assert.strictEqual(code, 0, testOutput)
+    })
+
+    typecheckIt('honors Known Tests metadata for typecheck tests', async () => {
+      receiver.setSettings({
+        early_flake_detection: {
+          enabled: true,
+          slow_test_retries: {
+            '5s': NUM_RETRIES_EFD,
+          },
+        },
+        known_tests_enabled: true,
+      })
+      receiver.setKnownTests({
+        vitest: {
+          'ci-visibility/vitest-tests/typecheck.test-d.ts': [
+            'typecheck can report type assertion',
+          ],
+        },
+      })
+
+      const eventsPromise = receiver
+        .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
+          const events = payloads.flatMap(({ payload }) => payload.events)
+          const tests = events.filter(event => event.type === 'test').map(event => event.content)
+          const knownTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report type assertion'
+          )
+          const newTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report disabled assertion'
+          )
+
+          assert.ok(knownTest, testOutput)
+          assert.ok(newTest, testOutput)
+          assert.ok(!(TEST_IS_NEW in knownTest.meta))
+          assert.strictEqual(newTest.meta[TEST_IS_NEW], 'true')
+        }, 25000)
+
+      childProcess = exec(
+        './node_modules/.bin/vitest run --config=./vitest.typecheck.config.mjs ' +
+          'ci-visibility/vitest-tests/typecheck.test-d.ts --reporter=verbose',
+        {
+          cwd,
+          env: {
+            ...getCiVisAgentlessConfig(receiver.port),
+            NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
+            DD_SERVICE: undefined,
+          },
+        }
+      )
+      childProcess.stdout?.on('data', chunk => { testOutput += chunk.toString() })
+      childProcess.stderr?.on('data', chunk => { testOutput += chunk.toString() })
+
+      const [[code]] = await Promise.all([
+        once(childProcess, 'exit'),
+        eventsPromise,
+      ])
+
+      assert.strictEqual(code, 0, testOutput)
+    })
+
+    typecheckIt('honors Impacted Tests metadata for typecheck tests', async () => {
+      receiver.setSettings({ impacted_tests_enabled: true })
+
+      const branchName = `typecheck-impacted-${process.pid}`
+      execSync(`git checkout -b ${branchName}`, { cwd, stdio: 'ignore' })
+
+      try {
+        const typecheckFile = 'ci-visibility/vitest-tests/typecheck.test-d.ts'
+        fs.appendFileSync(path.join(cwd, typecheckFile), '\n// impacted typecheck test\n')
+        execSync(`git add ${typecheckFile}`, { cwd, stdio: 'ignore' })
+        execSync('git commit -m "modify typecheck test"', { cwd, stdio: 'ignore' })
+
+        const eventsPromise = receiver
+          .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
+            const events = payloads.flatMap(({ payload }) => payload.events)
+            const tests = events.filter(event => event.type === 'test').map(event => event.content)
+            const impactedTest = tests.find(test =>
+              test.meta[TEST_NAME] === 'typecheck can report type assertion'
+            )
+
+            assert.ok(impactedTest, testOutput)
+            assert.strictEqual(impactedTest.meta[TEST_IS_MODIFIED], 'true')
+          }, 25000)
+
+        childProcess = exec(
+          './node_modules/.bin/vitest run --config=./vitest.typecheck.config.mjs ' +
+            'ci-visibility/vitest-tests/typecheck.test-d.ts --reporter=verbose',
+          {
+            cwd,
+            env: {
+              ...getCiVisAgentlessConfig(receiver.port),
+              NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
+              DD_SERVICE: undefined,
+              GITHUB_BASE_REF: '',
+            },
+          }
+        )
+        childProcess.stdout?.on('data', chunk => { testOutput += chunk.toString() })
+        childProcess.stderr?.on('data', chunk => { testOutput += chunk.toString() })
+
+        const [[code]] = await Promise.all([
+          once(childProcess, 'exit'),
+          eventsPromise,
+        ])
+
+        assert.strictEqual(code, 0, testOutput)
+      } finally {
+        execSync('git checkout -', { cwd, stdio: 'ignore' })
+        execSync(`git branch -D ${branchName}`, { cwd, stdio: 'ignore' })
+      }
+    })
+
+    typecheckIt('honors Test Management metadata for typecheck tests', async () => {
+      receiver.setSettings({ test_management: { enabled: true } })
+      receiver.setTestManagementTests({
+        vitest: {
+          suites: {
+            'ci-visibility/vitest-tests/typecheck.test-d.ts': {
+              tests: {
+                'typecheck can report disabled assertion': {
+                  properties: {
+                    disabled: true,
+                  },
+                },
+                'typecheck can report quarantined assertion': {
+                  properties: {
+                    quarantined: true,
+                  },
+                },
+                'typecheck can report attempt-to-fix assertion': {
+                  properties: {
+                    attempt_to_fix: true,
+                  },
+                },
+                'typecheck nested suite can report nested disabled assertion': {
+                  properties: {
+                    disabled: true,
+                  },
+                },
+              },
+            },
+          },
+        },
+      })
+
+      const eventsPromise = receiver
+        .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
+          const events = payloads.flatMap(({ payload }) => payload.events)
+          const tests = events.filter(event => event.type === 'test').map(event => event.content)
+          const disabledTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report disabled assertion'
+          )
+          const quarantinedTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report quarantined assertion'
+          )
+          const attemptToFixTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report attempt-to-fix assertion'
+          )
+          const nestedDisabledTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck nested suite can report nested disabled assertion'
+          )
+
+          assert.ok(disabledTest, testOutput)
+          assert.ok(quarantinedTest, testOutput)
+          assert.ok(attemptToFixTest, testOutput)
+          assert.ok(nestedDisabledTest, testOutput)
+
+          assert.strictEqual(disabledTest.meta[TEST_STATUS], 'skip')
+          assert.strictEqual(disabledTest.meta[TEST_FINAL_STATUS], 'skip')
+          assert.strictEqual(disabledTest.meta[TEST_MANAGEMENT_IS_DISABLED], 'true')
+
+          assert.strictEqual(quarantinedTest.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(quarantinedTest.meta[TEST_FINAL_STATUS], 'skip')
+          assert.strictEqual(quarantinedTest.meta[TEST_MANAGEMENT_IS_QUARANTINED], 'true')
+
+          assert.strictEqual(attemptToFixTest.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(attemptToFixTest.meta[TEST_MANAGEMENT_IS_ATTEMPT_TO_FIX], 'true')
+
+          assert.strictEqual(nestedDisabledTest.meta[TEST_STATUS], 'skip')
+          assert.strictEqual(nestedDisabledTest.meta[TEST_FINAL_STATUS], 'skip')
+          assert.strictEqual(nestedDisabledTest.meta[TEST_MANAGEMENT_IS_DISABLED], 'true')
+        }, 25000)
+
+      childProcess = exec(
+        './node_modules/.bin/vitest run --config=./vitest.typecheck.config.mjs ' +
+          'ci-visibility/vitest-tests/typecheck.test-d.ts --reporter=verbose',
+        {
+          cwd,
+          env: {
+            ...getCiVisAgentlessConfig(receiver.port),
+            NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
+            DD_SERVICE: undefined,
+          },
+        }
+      )
+      childProcess.stdout?.on('data', chunk => { testOutput += chunk.toString() })
+      childProcess.stderr?.on('data', chunk => { testOutput += chunk.toString() })
+
+      const [[code]] = await Promise.all([
+        once(childProcess, 'exit'),
+        eventsPromise,
+      ])
+
+      assert.strictEqual(code, 0, testOutput)
+    })
+
+    typecheckIt('does not fail the typecheck run for Test Management managed failures', async () => {
+      receiver.setSettings({ test_management: { enabled: true } })
+      receiver.setTestManagementTests({
+        vitest: {
+          suites: {
+            'ci-visibility/vitest-tests/typecheck-test-management-fail.test-d.ts': {
+              tests: {
+                'typecheck can report disabled failing assertion': {
+                  properties: {
+                    disabled: true,
+                  },
+                },
+                'typecheck can report quarantined failing assertion': {
+                  properties: {
+                    quarantined: true,
+                  },
+                },
+                'typecheck nested failing suite can report nested disabled failing assertion': {
+                  properties: {
+                    disabled: true,
+                  },
+                },
+              },
+            },
+          },
+        },
+      })
+
+      const eventsPromise = receiver
+        .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
+          const events = payloads.flatMap(({ payload }) => payload.events)
+          const testSession = events.find(event => event.type === 'test_session_end').content
+          const testModule = events.find(event => event.type === 'test_module_end').content
+          const testSuite = events.find(event => event.type === 'test_suite_end').content
+          const tests = events.filter(event => event.type === 'test').map(event => event.content)
+          const disabledTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report disabled failing assertion'
+          )
+          const quarantinedTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report quarantined failing assertion'
+          )
+          const nestedDisabledTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck nested failing suite can report nested disabled failing assertion'
+          )
+
+          assert.ok(disabledTest, testOutput)
+          assert.ok(quarantinedTest, testOutput)
+          assert.ok(nestedDisabledTest, testOutput)
+          assert.strictEqual(testSession.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(testModule.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(testSuite.meta[TEST_STATUS], 'pass')
+
+          assert.strictEqual(disabledTest.meta[TEST_STATUS], 'skip')
+          assert.strictEqual(disabledTest.meta[TEST_FINAL_STATUS], 'skip')
+          assert.strictEqual(disabledTest.meta[TEST_MANAGEMENT_IS_DISABLED], 'true')
+
+          assert.strictEqual(quarantinedTest.meta[TEST_STATUS], 'fail')
+          assert.strictEqual(quarantinedTest.meta[TEST_FINAL_STATUS], 'skip')
+          assert.strictEqual(quarantinedTest.meta[TEST_MANAGEMENT_IS_QUARANTINED], 'true')
+
+          assert.strictEqual(nestedDisabledTest.meta[TEST_STATUS], 'skip')
+          assert.strictEqual(nestedDisabledTest.meta[TEST_FINAL_STATUS], 'skip')
+          assert.strictEqual(nestedDisabledTest.meta[TEST_MANAGEMENT_IS_DISABLED], 'true')
+        }, 25000)
+
+      childProcess = exec(
+        './node_modules/.bin/vitest run --config=./vitest.typecheck.config.mjs ' +
+          'ci-visibility/vitest-tests/typecheck-test-management-fail.test-d.ts --reporter=verbose',
+        {
+          cwd,
+          env: {
+            ...getCiVisAgentlessConfig(receiver.port),
+            NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
+            DD_SERVICE: undefined,
+            TYPECHECK_TEST_MANAGEMENT_FAIL: 'true',
+          },
+        }
+      )
+      childProcess.stdout?.on('data', chunk => { testOutput += chunk.toString() })
+      childProcess.stderr?.on('data', chunk => { testOutput += chunk.toString() })
+
+      const [[code]] = await Promise.all([
+        once(childProcess, 'exit'),
+        eventsPromise,
+      ])
+
+      assert.strictEqual(code, 0, testOutput)
+    })
+
+    typecheckIt('preserves file-level typecheck failures with Test Management managed tests', async () => {
+      receiver.setSettings({ test_management: { enabled: true } })
+      receiver.setTestManagementTests({
+        vitest: {
+          suites: {
+            'ci-visibility/vitest-tests/typecheck-test-management-file-fail.test-d.ts': {
+              tests: {
+                'typecheck container failing suite can report disabled assertion with file-level error': {
+                  properties: {
+                    disabled: true,
+                  },
+                },
+                'typecheck container failing suite can report quarantined assertion with file-level error': {
+                  properties: {
+                    quarantined: true,
+                  },
+                },
+              },
+            },
+          },
+        },
+      })
+
+      const eventsPromise = receiver
+        .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
+          const events = payloads.flatMap(({ payload }) => payload.events)
+          const testSession = events.find(event => event.type === 'test_session_end').content
+          const testModule = events.find(event => event.type === 'test_module_end').content
+          const testSuite = events.find(event => event.type === 'test_suite_end').content
+          const tests = events.filter(event => event.type === 'test').map(event => event.content)
+          const disabledTest = tests.find(test =>
+            test.meta[TEST_NAME] ===
+              'typecheck container failing suite can report disabled assertion with file-level error'
+          )
+          const quarantinedTest = tests.find(test =>
+            test.meta[TEST_NAME] ===
+              'typecheck container failing suite can report quarantined assertion with file-level error'
+          )
+
+          assert.ok(disabledTest, testOutput)
+          assert.ok(quarantinedTest, testOutput)
+          assert.strictEqual(testSession.meta[TEST_STATUS], 'fail', testOutput)
+          assert.strictEqual(testModule.meta[TEST_STATUS], 'fail', testOutput)
+          assert.strictEqual(testSuite.meta[TEST_STATUS], 'fail', testOutput)
+          assert.strictEqual(testSuite.meta[ERROR_TYPE], 'TypeCheckError')
+          assert.ok(testSuite.meta[ERROR_MESSAGE])
+
+          assert.strictEqual(disabledTest.meta[TEST_STATUS], 'skip')
+          assert.strictEqual(disabledTest.meta[TEST_FINAL_STATUS], 'skip')
+          assert.strictEqual(disabledTest.meta[TEST_MANAGEMENT_IS_DISABLED], 'true')
+
+          assert.strictEqual(quarantinedTest.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(quarantinedTest.meta[TEST_FINAL_STATUS], 'skip')
+          assert.strictEqual(quarantinedTest.meta[TEST_MANAGEMENT_IS_QUARANTINED], 'true')
+        }, 25000)
+
+      childProcess = exec(
+        './node_modules/.bin/vitest run --config=./vitest.typecheck.config.mjs ' +
+          'ci-visibility/vitest-tests/typecheck-test-management-file-fail.test-d.ts --reporter=verbose',
+        {
+          cwd,
+          env: {
+            ...getCiVisAgentlessConfig(receiver.port),
+            NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
+            DD_SERVICE: undefined,
+            TYPECHECK_TEST_MANAGEMENT_FILE_FAIL: 'true',
+          },
+        }
+      )
+      childProcess.stdout?.on('data', chunk => { testOutput += chunk.toString() })
+      childProcess.stderr?.on('data', chunk => { testOutput += chunk.toString() })
+
+      const [[code]] = await Promise.all([
+        once(childProcess, 'exit'),
+        eventsPromise,
+      ])
+
+      assert.strictEqual(code, 1, testOutput)
+    })
+
+    typecheckIt('can report failed typecheck tests', async () => {
+      const eventsPromise = receiver
+        .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
+          const events = payloads.flatMap(({ payload }) => payload.events)
+          const {
+            testSession,
+            testModule,
+            testSuite,
+            tests,
+          } = assertCompleteEventHierarchy(events, testOutput)
+          const test = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report failing assertion'
+          )
+
+          assert.ok(test, testOutput)
+
+          assert.strictEqual(testSession.meta[TEST_STATUS], 'fail')
+          assert.strictEqual(testModule.meta[TEST_STATUS], 'fail')
+          assert.strictEqual(testSuite.meta[TEST_STATUS], 'fail')
+          assert.strictEqual(testSuite.meta[TEST_SOURCE_FILE], 'ci-visibility/vitest-tests/typecheck-fail.test-d.ts')
+          assert.strictEqual(test.meta[TEST_STATUS], 'fail')
+          assert.strictEqual(test.meta[TEST_SOURCE_FILE], 'ci-visibility/vitest-tests/typecheck-fail.test-d.ts')
+          assert.strictEqual(test.meta[ERROR_TYPE], 'TypeCheckError')
+          assert.ok(test.meta[ERROR_MESSAGE])
+        }, 25000)
+
+      childProcess = exec(
+        './node_modules/.bin/vitest run --config=./vitest.typecheck.config.mjs ' +
+          'ci-visibility/vitest-tests/typecheck-fail.test-d.ts --reporter=verbose',
+        {
+          cwd,
+          env: {
+            ...getCiVisAgentlessConfig(receiver.port),
+            NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
+            DD_SERVICE: undefined,
+            TYPECHECK_FAIL: 'true',
+          },
+        }
+      )
+      childProcess.stdout?.on('data', chunk => { testOutput += chunk.toString() })
+      childProcess.stderr?.on('data', chunk => { testOutput += chunk.toString() })
+
+      const [[code]] = await Promise.all([
+        once(childProcess, 'exit'),
+        eventsPromise,
+      ])
+
+      assert.strictEqual(code, 1, testOutput)
+    })
+
     it('propagates test span context to HTTP requests and hooks during test execution', async () => {
       const eventsPromise = receiver
         .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
diff --git a/packages/datadog-instrumentations/src/vitest-main.js b/packages/datadog-instrumentations/src/vitest-main.js
index 94f37a9c79..491b7d8b9e 100644
--- a/packages/datadog-instrumentations/src/vitest-main.js
+++ b/packages/datadog-instrumentations/src/vitest-main.js
@@ -18,6 +18,13 @@ const {
 } = require('../../dd-trace/src/plugins/util/test')
 const { addHook } = require('./helpers/instrument')
 const {
+  testStartCh,
+  testPassCh,
+  testErrorCh,
+  testSkipCh,
+  testSuiteStartCh,
+  testSuiteFinishCh,
+  testSuiteErrorCh,
   testSessionStartCh,
   testSessionFinishCh,
   testSessionConfigurationCh,
@@ -31,8 +38,10 @@ const {
   codeCoverageReportCh,
   findExportByName,
   getChannelPromise,
+  getTypeTasks,
   getWorkspaceProject,
   setProvidedContext,
+  getVitestTestProperties,
 } = require('./vitest-util')
 
 const newTestsWithDynamicNames = new Set()
@@ -98,6 +107,10 @@ function getVitestExport (vitestPackage) {
   return findExportByName(vitestPackage, 'Vitest')
 }
 
+function getTypecheckerExport (vitestPackage) {
+  return findExportByName(vitestPackage, 'Typechecker')
+}
+
 function getForksPoolWorkerExport (vitestPackage) {
   return findExportByName(vitestPackage, 'ForksPoolWorker')
 }
@@ -823,6 +836,323 @@ function wrapVitestRunFiles (Vitest, frameworkVersion) {
   }
 }
 
+function getTypecheckTaskStatus (task) {
+  const state = task.result?.state
+  if (state === 'fail') return 'fail'
+  if (state === 'skip' || task.mode === 'skip' || task.mode === 'todo') return 'skip'
+  return 'pass'
+}
+
+/**
+ * Return whether a typecheck suite name represents the synthetic file-level suite.
+ *
+ * @param {string|undefined} suiteName
+ * @param {string} testSuiteAbsolutePath
+ * @returns {boolean}
+ */
+function isTypecheckFileSuiteName (suiteName, testSuiteAbsolutePath) {
+  if (!suiteName || !testSuiteAbsolutePath) return false
+
+  const normalizedSuiteName = path.normalize(suiteName).replaceAll('\\', '/')
+  const normalizedSuitePath = path.normalize(testSuiteAbsolutePath).replaceAll('\\', '/')
+
+  return normalizedSuitePath === normalizedSuiteName || normalizedSuitePath.endsWith(`/${normalizedSuiteName}`)
+}
+
+/**
+ * Return a typecheck test name with describe/suite prefixes and without the file-level suite prefix.
+ *
+ * @param {object} task
+ * @param {string} testSuiteAbsolutePath
+ * @returns {string}
+ */
+function getTypecheckTestName (task, testSuiteAbsolutePath) {
+  let testName = task.name || task.fullTestName
+  let currentTask = task.suite
+
+  while (currentTask) {
+    if (currentTask.name && !isTypecheckFileSuiteName(currentTask.name, testSuiteAbsolutePath)) {
+      testName = `${currentTask.name} ${testName}`
+    }
+    currentTask = currentTask.suite
+  }
+
+  return testName
+}
+
+/**
+ * Return Test Optimization metadata prepared in Vitest's main process setup.
+ *
+ * @param {object|undefined} ctx
+ * @returns {{ testPropertiesByFilepath: object }}
+ */
+function getMainProcessProvidedContext (ctx) {
+  try {
+    const workspaceProject = getWorkspaceProject(ctx)
+    const providedContext = workspaceProject.getProvidedContext?.() || workspaceProject._provided || {}
+
+    return {
+      testPropertiesByFilepath: providedContext._ddTestPropertiesByFilepath || {},
+    }
+  } catch {
+    return {
+      testPropertiesByFilepath: {},
+    }
+  }
+}
+
+/**
+ * Return the Vitest context that owns a Typechecker instance.
+ *
+ * @param {object} typechecker
+ * @returns {object|undefined}
+ */
+function getTypecheckerVitestContext (typechecker) {
+  return typechecker.ctx || typechecker.project?.vitest
+}
+
+/**
+ * Apply Test Management result semantics to Vitest's returned typecheck task result.
+ *
+ * @param {object} task
+ * @param {string} status
+ * @param {{
+ *   isAttemptToFix: boolean,
+ *   isDisabled: boolean,
+ *   isQuarantined: boolean
+ * }} testManagement
+ */
+function updateTypecheckTaskResultForTestManagement (task, status, testManagement) {
+  const { isAttemptToFix, isDisabled, isQuarantined } = testManagement
+  if (isAttemptToFix || !task.result) return
+
+  if (isDisabled) {
+    task.mode = 'skip'
+    task.result.state = 'skip'
+    task.result.errors = []
+    return
+  }
+
+  if (isQuarantined && status === 'fail') {
+    task.result.state = 'pass'
+    task.result.errors = []
+  }
+}
+
+/**
+ * Recompute suite/file typecheck results after Test Management rewrites child test results.
+ *
+ * @param {object} task
+ * @returns {string}
+ */
+function updateTypecheckTaskTreeResult (task) {
+  if (!Array.isArray(task.tasks)) return getTypecheckTaskStatus(task)
+
+  let hasPassedTest = false
+  let hasSkippedTest = false
+  for (const childTask of task.tasks) {
+    const status = updateTypecheckTaskTreeResult(childTask)
+    if (status === 'fail') {
+      task.result = {
+        ...task.result,
+        state: 'fail',
+      }
+      return 'fail'
+    }
+    if (status === 'skip') {
+      hasSkippedTest = true
+    } else {
+      hasPassedTest = true
+    }
+  }
+
+  if (task.result?.errors?.length) return 'fail'
+  if (!hasPassedTest && !hasSkippedTest) return getTypecheckTaskStatus(task)
+
+  task.result = {
+    ...task.result,
+    state: hasPassedTest ? 'pass' : 'skip',
+    errors: [],
+  }
+  return task.result.state
+}
+
+/**
+ * Recompute the aggregate typecheck result after Test Management rewrites file results.
+ *
+ * @param {{
+ *   files?: object[],
+ *   errors?: object[],
+ *   diagnostics?: object[],
+ *   sourceErrors?: object[],
+ *   state?: string
+ * }} result
+ * @returns {boolean}
+ */
+function updateTypecheckResult (result) {
+  if (result.sourceErrors?.length) return false
+
+  let hasPassedFile = false
+  let hasSkippedFile = false
+  for (const file of result.files) {
+    const status = getTypecheckTaskStatus(file)
+    if (status === 'fail') return false
+    if (status === 'skip') {
+      hasSkippedFile = true
+    } else {
+      hasPassedFile = true
+    }
+  }
+
+  if (!hasPassedFile && !hasSkippedFile) return false
+
+  result.state = hasPassedFile ? 'pass' : 'skip'
+  result.errors = []
+  result.diagnostics = []
+  result.sourceErrors = []
+  return true
+}
+
+/**
+ * Clear Vitest's typechecker exit code after all typecheck failures were handled by Test Management.
+ *
+ * @param {{ process?: { exitCode?: number|null } }} typechecker
+ */
+function clearTypecheckerExitCode (typechecker) {
+  if (typechecker?.process?.exitCode == null) return
+
+  typechecker.process.exitCode = 0
+}
+
+function reportTypecheckTest (task, testSuiteAbsolutePath, providedContext) {
+  const testName = getTypecheckTestName(task, testSuiteAbsolutePath)
+  const testProperties = getVitestTestProperties(providedContext, testSuiteAbsolutePath, testName)
+  const isAttemptToFix = testProperties.isAttemptToFix === true
+  const isDisabled = testProperties.isDisabled === true
+  const isQuarantined = testProperties.isQuarantined === true
+  const isModified = testProperties.isModified === true
+  const isSkippedByTestManagement = !isAttemptToFix && isDisabled
+  const status = getTypecheckTaskStatus(task)
+
+  if (status === 'skip' || isSkippedByTestManagement) {
+    testSkipCh.publish({
+      testName,
+      testSuiteAbsolutePath,
+      isNew: testProperties.isNew,
+      isDisabled,
+    })
+    updateTypecheckTaskResultForTestManagement(task, status, { isAttemptToFix, isDisabled, isQuarantined })
+    return
+  }
+
+  const ctx = {
+    testName,
+    testSuiteAbsolutePath,
+    isRetry: false,
+    isNew: testProperties.isNew,
+    hasDynamicName: false,
+    mightHitProbe: false,
+    isAttemptToFix,
+    isDisabled,
+    isQuarantined,
+    isModified,
+  }
+  testStartCh.runStores(ctx, () => {})
+
+  const finalStatus = !isAttemptToFix && isQuarantined ? 'skip' : undefined
+  if (status === 'fail') {
+    testErrorCh.publish({
+      error: task.result?.errors?.[0],
+      finalStatus,
+      ...ctx.currentStore,
+    })
+  } else {
+    testPassCh.publish({
+      task,
+      finalStatus,
+      ...ctx.currentStore,
+    })
+  }
+  updateTypecheckTaskResultForTestManagement(task, status, { isAttemptToFix, isDisabled, isQuarantined })
+}
+
+async function reportTypecheckFile (file, sessionConfiguration, frameworkVersion, providedContext) {
+  const testSuiteAbsolutePath = file.filepath
+  const testSuiteCtx = {
+    testSuiteAbsolutePath,
+    frameworkVersion,
+    testSessionId: sessionConfiguration.testSessionId,
+    testModuleId: sessionConfiguration.testModuleId,
+    testCommand: sessionConfiguration.testCommand,
+    repositoryRoot: sessionConfiguration.repositoryRoot,
+    codeOwnersEntries: sessionConfiguration.codeOwnersEntries,
+  }
+  testSuiteStartCh.runStores(testSuiteCtx, () => {})
+
+  for (const task of getTypeTasks(file.tasks)) {
+    reportTypecheckTest(task, testSuiteAbsolutePath, providedContext)
+  }
+  updateTypecheckTaskTreeResult(file)
+
+  const testSuiteError = file.result?.errors?.[0]
+  if (testSuiteError) {
+    testSuiteCtx.error = testSuiteError
+    testSuiteErrorCh.runStores(testSuiteCtx, () => {})
+  }
+
+  let onFinish
+  const onFinishPromise = new Promise(resolve => {
+    onFinish = resolve
+  })
+  testSuiteFinishCh.publish({
+    status: getTypecheckTaskStatus(file),
+    onFinish,
+    ...testSuiteCtx.currentStore,
+  })
+  await onFinishPromise
+}
+
+async function reportTypecheckResults (result, frameworkVersion, ctx, typechecker) {
+  if (!testSuiteFinishCh.hasSubscribers) return
+  if (!Array.isArray(result?.files)) return
+
+  if (ctx) {
+    await ensureMainProcessSetup(ctx, frameworkVersion, result.files)
+  }
+  const providedContext = getMainProcessProvidedContext(ctx)
+  const sessionConfiguration = testSessionConfigurationCh.hasSubscribers
+    ? await getChannelPromise(testSessionConfigurationCh, frameworkVersion)
+    : {}
+
+  await Promise.all(result.files.map(file => reportTypecheckFile(
+    file,
+    sessionConfiguration,
+    frameworkVersion,
+    providedContext
+  )))
+  if (updateTypecheckResult(result)) {
+    clearTypecheckerExitCode(typechecker)
+  }
+}
+
+function wrapTypechecker (Typechecker, frameworkVersion) {
+  if (!Typechecker?.prototype?.prepareResults) return
+
+  shimmer.wrap(Typechecker.prototype, 'prepareResults', prepareResults => async function () {
+    const result = await prepareResults.apply(this, arguments)
+    await reportTypecheckResults(result, frameworkVersion, getTypecheckerVitestContext(this), this)
+    return result
+  })
+}
+
+function getTypecheckerWrapper (vitestPackage, frameworkVersion) {
+  const typechecker = getTypecheckerExport(vitestPackage)
+  if (typechecker) {
+    wrapTypechecker(typechecker.value, frameworkVersion)
+  }
+  return vitestPackage
+}
+
 function getCreateCliWrapper (vitestPackage, frameworkVersion) {
   const createCliExport = findExportByName(vitestPackage, 'createCLI')
   if (!createCliExport) {
@@ -1080,6 +1410,18 @@ addHook({
   return vitestPackage
 })
 
+addHook({
+  name: 'vitest',
+  versions: ['>=3.2.0 <4.0.0'],
+  filePattern: 'dist/chunks/typechecker.*',
+}, getTypecheckerWrapper)
+
+addHook({
+  name: 'vitest',
+  versions: ['>=4.0.0'],
+  filePattern: 'dist/chunks/index.*',
+}, getTypecheckerWrapper)
+
 addHook({
   name: 'vitest',
   versions: ['>=2.1.0 <3.0.0'],

From c6348746b9d8b47d676a3e063d7b912d8eb61426 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Antonio=20Fern=C3=A1ndez=20de=20Alba?=
 <juan.fernandezdealba@datadoghq.com>
Date: Thu, 2 Jul 2026 15:19:26 +0200
Subject: [PATCH 43/51] feat(test-optimization): add vitest no-worker init mode
 (#9173)

---
 .github/workflows/test-optimization.yml       |    1 +
 ci/init.js                                    |   23 +-
 ci/vitest-no-worker-init-setup.mjs            |  430 ++++++
 ...er-programmatic-api-collect-before-run.mjs |   34 +
 .../vitest-tests/failed-suite-hook.mjs        |   11 +
 .../no-worker-suite-context-a-slow.mjs        |    8 +
 .../no-worker-suite-context-b-fast.mjs        |    7 +
 .../vitest-tests/slow-failing-retry.mjs       |   16 +
 .../vitest-tests/string-setup-file.mjs        |    1 +
 .../vitest-tests/uses-string-setup-file.mjs   |    7 +
 .../vitest-tests/vitest-worker-env.mjs        |   30 +-
 integration-tests/vitest.config.mjs           |   32 +-
 .../vitest/vitest.no-worker-init.spec.js      | 1187 +++++++++++++++
 .../src/vitest-main-no-worker-init.js         | 1293 +++++++++++++++++
 .../src/vitest-main.js                        |  200 ++-
 .../src/vitest-util.js                        |    4 +-
 .../datadog-instrumentations/src/vitest.js    |    8 +
 packages/datadog-plugin-vitest/src/index.js   |   24 +-
 .../src/config/generated-config-types.d.ts    |    2 +
 .../src/config/supported-configurations.json  |    7 +
 packages/dd-trace/src/plugins/ci_plugin.js    |   15 +-
 packages/dd-trace/src/plugins/util/test.js    |   20 +-
 .../dd-trace/test/plugins/util/test.spec.js   |   10 +
 23 files changed, 3293 insertions(+), 77 deletions(-)
 create mode 100644 ci/vitest-no-worker-init-setup.mjs
 create mode 100644 integration-tests/ci-visibility/vitest-tests-programmatic-api/run-no-worker-programmatic-api-collect-before-run.mjs
 create mode 100644 integration-tests/ci-visibility/vitest-tests/failed-suite-hook.mjs
 create mode 100644 integration-tests/ci-visibility/vitest-tests/no-worker-suite-context-a-slow.mjs
 create mode 100644 integration-tests/ci-visibility/vitest-tests/no-worker-suite-context-b-fast.mjs
 create mode 100644 integration-tests/ci-visibility/vitest-tests/slow-failing-retry.mjs
 create mode 100644 integration-tests/ci-visibility/vitest-tests/string-setup-file.mjs
 create mode 100644 integration-tests/ci-visibility/vitest-tests/uses-string-setup-file.mjs
 create mode 100644 integration-tests/vitest/vitest.no-worker-init.spec.js
 create mode 100644 packages/datadog-instrumentations/src/vitest-main-no-worker-init.js

diff --git a/.github/workflows/test-optimization.yml b/.github/workflows/test-optimization.yml
index ec7bcb0bfe..fe2473ae25 100644
--- a/.github/workflows/test-optimization.yml
+++ b/.github/workflows/test-optimization.yml
@@ -442,6 +442,7 @@ jobs:
           - vitest.core
           - vitest.test-management
           - vitest.advanced
+          - vitest.no-worker-init
     name: integration-vitest (node-${{ matrix.version }}, ${{ matrix.spec }})
     env:
       DD_SERVICE: dd-trace-js-integration-tests
diff --git a/ci/init.js b/ci/init.js
index f34e44ddc8..a06a3687ba 100644
--- a/ci/init.js
+++ b/ci/init.js
@@ -1,13 +1,14 @@
 'use strict'
 
 /* eslint-disable no-console */
-const tracer = require('../packages/dd-trace')
 const log = require('../packages/dd-trace/src/log')
 const { getEnvironmentVariable, getValueFromEnvSources } = require('../packages/dd-trace/src/config/helper')
+const { isTrue } = require('../packages/dd-trace/src/util')
 
 const PACKAGE_MANAGERS = ['npm', 'yarn', 'pnpm']
 const DEFAULT_FLUSH_INTERVAL = 5000
 const JEST_FLUSH_INTERVAL = 0
+const VITEST_NO_WORKER_INIT_ACTIVE_ENV = 'DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE'
 const EXPORTER_MAP = {
   jest: 'jest_worker',
   cucumber: 'cucumber_worker',
@@ -78,10 +79,28 @@ if (isTestWorker) {
   }
 }
 
-if (shouldInit) {
+const skipVitestWorkerInit = shouldSkipVitestWorkerInit()
+const tracer = skipVitestWorkerInit
+  ? {
+      init () {},
+      use () {},
+    }
+  : require('../packages/dd-trace')
+
+if (shouldInit && !skipVitestWorkerInit) {
   tracer.init(baseOptions)
   tracer.use('fs', false)
   tracer.use('child_process', false)
 }
 
 module.exports = tracer
+
+function shouldSkipVitestWorkerInit () {
+  return getValueFromEnvSources('DD_VITEST_WORKER') &&
+    isVitestNoWorkerInitActive()
+}
+
+function isVitestNoWorkerInitActive () {
+  // eslint-disable-next-line eslint-rules/eslint-process-env
+  return isTrue(process.env[VITEST_NO_WORKER_INIT_ACTIVE_ENV])
+}
diff --git a/ci/vitest-no-worker-init-setup.mjs b/ci/vitest-no-worker-init-setup.mjs
new file mode 100644
index 0000000000..af24be1f37
--- /dev/null
+++ b/ci/vitest-no-worker-init-setup.mjs
@@ -0,0 +1,430 @@
+import { realpathSync } from 'node:fs'
+import { relative } from 'node:path'
+import { performance } from 'node:perf_hooks'
+
+import { afterEach, beforeAll, beforeEach } from 'vitest'
+
+// Instrumentation-less worker setup for DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT.
+// It applies Test Optimization execution changes without initializing dd-trace in Vitest workers.
+const VITEST_NO_WORKER_INIT_ACTIVE_ENV = 'DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE'
+const isNoWorkerInitActive = getIsNoWorkerInitActive()
+const providedContext = isNoWorkerInitActive ? getProvidedContext() : {}
+const attemptToFixTests = providedContext.attemptToFixTests || {}
+const attemptToFixRetries = providedContext.attemptToFixRetries || 0
+const disabledTests = providedContext.disabledTests || {}
+const earlyFlakeDetectionRetries = providedContext.earlyFlakeDetectionRetries || 0
+const earlyFlakeDetectionRetryThresholds = Array.isArray(providedContext.earlyFlakeDetectionRetryThresholds)
+  ? providedContext.earlyFlakeDetectionRetryThresholds
+  : []
+const earlyFlakeDetectionSlowRetries = providedContext.earlyFlakeDetectionSlowRetries || {}
+const hasEarlyFlakeDetectionSlowRetries = Object.keys(earlyFlakeDetectionSlowRetries).length > 0
+const isEarlyFlakeDetectionEnabled = providedContext.isEarlyFlakeDetectionEnabled === true
+const knownTests = providedContext.knownTests || {}
+const modifiedFiles = providedContext.modifiedFiles || {}
+const quarantinedTests = providedContext.quarantinedTests || {}
+const repositoryRoot = realpath(providedContext.repositoryRoot || process.cwd())
+let setVitestTaskFn
+if (isNoWorkerInitActive) {
+  try {
+    // Vitest does not expose setFn from the public setup API; keep this optional for strict installers.
+    const vitestRunner = await import('@vitest/runner')
+    setVitestTaskFn = vitestRunner.setFn
+  } catch {}
+}
+const earlyFlakeDetectionRetriesByTask = new WeakMap()
+const earlyFlakeDetectionSkippedResults = new WeakMap()
+const earlyFlakeDetectionStartByTask = new WeakMap()
+const nextAttemptIndexByTask = new WeakMap()
+const realpaths = new Map()
+
+if (isNoWorkerInitActive) {
+  // eslint-disable-next-line no-empty-pattern
+  beforeAll(function ({}, suite) {
+    suite ||= arguments[0]
+    applyExecutionChanges(suite)
+  })
+
+  beforeEach(function ({ onTestFinished, task, skip }) {
+    const testSuite = getTestSuite(task)
+    const testName = getTestName(task)
+    const isAttemptToFixTest = attemptToFixTests[testSuite]?.[testName]
+    const isEarlyFlakeDetectionTestAttempt = isEarlyFlakeDetectionTest(testSuite, testName)
+    const isQuarantinedTest = quarantinedTests[testSuite]?.[testName] && !isAttemptToFixTest
+    const attemptIndex = getNextAttemptIndex(task)
+    if (attemptIndex > 0) {
+      recordTestOptimizationStatus(task, attemptIndex - 1)
+    }
+
+    if (disabledTests[testSuite]?.[testName] && !isAttemptToFixTest) {
+      skip('Skipped by Datadog Test Optimization')
+    } else if (isAttemptToFixTest && attemptIndex > 0) {
+      task.result.state = 'run'
+    } else if (isEarlyFlakeDetectionTestAttempt) {
+      const isSkippedRepeat = prepareEarlyFlakeDetectionAttempt(task, attemptIndex)
+      if (!isSkippedRepeat && attemptIndex > 0) {
+        task.result.state = 'run'
+      }
+    }
+
+    if (isAttemptToFixTest || isEarlyFlakeDetectionTestAttempt || isQuarantinedTest) {
+      onTestFinished(() => {
+        if (attemptIndex === getFinalAttemptIndex(task)) {
+          if (isAttemptToFixTest || isEarlyFlakeDetectionTestAttempt) {
+            recordTestOptimizationStatus(task, attemptIndex, true)
+          }
+          switchQuarantinedFinalFailure(task, attemptIndex)
+        }
+      })
+    }
+  })
+
+  afterEach(function ({ task }) {
+    const attemptIndex = task.meta.__ddTestOptCurrentAttemptIndex
+    if (restoreEarlyFlakeDetectionSkippedResult(task)) {
+      return
+    }
+    if (attemptIndex === getFinalAttemptIndex(task)) {
+      recordTestOptimizationStatus(task, attemptIndex)
+    }
+    switchQuarantinedFinalFailure(task, attemptIndex)
+  })
+}
+
+function applyExecutionChanges (suite) {
+  for (const task of suite?.tasks || []) {
+    if (task.type === 'suite') {
+      applyExecutionChanges(task)
+      continue
+    }
+
+    const testSuite = getTestSuite(task)
+    const testName = getTestName(task)
+    if (attemptToFixTests[testSuite]?.[testName]) {
+      task.retry = 0
+      task.repeats = attemptToFixRetries
+      task.meta.__ddTestOptAtfRetries = attemptToFixRetries
+    } else if (disabledTests[testSuite]?.[testName]) {
+      task.mode = 'skip'
+    } else if (isEarlyFlakeDetectionTest(testSuite, testName)) {
+      task.retry = 0
+      task.repeats = earlyFlakeDetectionRetries
+      task.meta.__ddTestOptEfdRetries = earlyFlakeDetectionRetries
+    }
+  }
+}
+
+function getNextAttemptIndex (task) {
+  const attemptIndex = nextAttemptIndexByTask.get(task) || 0
+  nextAttemptIndexByTask.set(task, attemptIndex + 1)
+  task.meta.__ddTestOptCurrentAttemptIndex = attemptIndex
+  return attemptIndex
+}
+
+function recordTestOptimizationStatus (task, attemptIndex = task.result?.repeatCount || 0, onlyIfNewErrors = false) {
+  const testSuite = getTestSuite(task)
+  const testName = getTestName(task)
+
+  if (attemptToFixTests[testSuite]?.[testName]) {
+    recordAttemptToFixStatus(task, attemptIndex, onlyIfNewErrors)
+  } else if (isEarlyFlakeDetectionTest(testSuite, testName)) {
+    recordEarlyFlakeDetectionStatus(task, attemptIndex, onlyIfNewErrors)
+  } else if (task.repeats > 0) {
+    recordManualRepeatStatus(task, attemptIndex)
+  }
+}
+
+function recordAttemptToFixStatus (task, attemptIndex, onlyIfNewErrors) {
+  if (onlyIfNewErrors && !hasNewErrors(task.meta.__ddTestOptAtfErrorCounts, attemptIndex, task)) {
+    return
+  }
+
+  task.meta.__ddTestOptAtfStatuses ||= []
+  task.meta.__ddTestOptAtfErrorCounts ||= []
+  task.meta.__ddTestOptAtfStatuses[attemptIndex] = getAttemptStatus(
+    task,
+    task.meta.__ddTestOptAtfErrorCounts,
+    attemptIndex
+  )
+  task.meta.__ddTestOptAtfErrorCounts[attemptIndex] = task.result?.errors?.length || 0
+
+  if (
+    attemptIndex === getAttemptToFixRetryCount(task) &&
+    task.meta.__ddTestOptAtfStatuses.includes('fail') &&
+    task.result?.state === 'pass'
+  ) {
+    task.result.state = 'fail'
+  }
+}
+
+function recordEarlyFlakeDetectionStatus (task, attemptIndex, onlyIfNewErrors) {
+  if (restoreEarlyFlakeDetectionSkippedResult(task)) {
+    return
+  }
+
+  const retryCount = earlyFlakeDetectionRetriesByTask.get(task)
+  if (retryCount !== undefined && attemptIndex > retryCount) {
+    return
+  }
+
+  if (onlyIfNewErrors && !hasNewErrors(task.meta.__ddTestOptEfdErrorCounts, attemptIndex, task)) {
+    return
+  }
+
+  if (!earlyFlakeDetectionRetriesByTask.has(task)) {
+    const retryCount = getEarlyFlakeDetectionRetryCount(task)
+    earlyFlakeDetectionRetriesByTask.set(task, retryCount)
+    task.repeats = retryCount
+    task.meta.__ddTestOptEfdRetries = retryCount
+    if (retryCount === 0 && hasEarlyFlakeDetectionSlowRetries) {
+      task.meta.__ddTestOptEfdAbortReason = 'slow'
+    }
+  }
+
+  task.meta.__ddTestOptEfdStatuses ||= []
+  task.meta.__ddTestOptEfdErrorCounts ||= []
+  task.meta.__ddTestOptEfdStatuses[attemptIndex] = getAttemptStatus(
+    task,
+    task.meta.__ddTestOptEfdErrorCounts,
+    attemptIndex
+  )
+  task.meta.__ddTestOptEfdErrorCounts[attemptIndex] = task.result?.errors?.length || 0
+
+  if (attemptIndex === getEarlyFlakeDetectionRetryCountForTask(task) &&
+    task.meta.__ddTestOptEfdStatuses.includes('pass')) {
+    task.result.state = 'pass'
+  }
+}
+
+function recordManualRepeatStatus (task, attemptIndex) {
+  task.meta.__ddTestOptRepeatStatuses ||= []
+  task.meta.__ddTestOptRepeatErrorCounts ||= []
+  task.meta.__ddTestOptRepeatStatuses[attemptIndex] = getManualRepeatStatus(
+    task,
+    task.meta.__ddTestOptRepeatErrorCounts,
+    attemptIndex
+  )
+  task.meta.__ddTestOptRepeatErrorCounts[attemptIndex] = task.result?.errors?.length || 0
+}
+
+function restoreEarlyFlakeDetectionSkippedResult (task) {
+  if (!task.meta.__ddTestOptEfdSkipCurrentAttempt) {
+    return false
+  }
+
+  delete task.meta.__ddTestOptEfdSkipCurrentAttempt
+  const skippedResult = earlyFlakeDetectionSkippedResults.get(task)
+  if (skippedResult) {
+    task.result = skippedResult
+    earlyFlakeDetectionSkippedResults.delete(task)
+  }
+  return true
+}
+
+function hasNewErrors (errorCounts, attemptIndex, task) {
+  const recordedErrorCount = errorCounts?.[attemptIndex]
+  const previousErrorCount = recordedErrorCount ?? getPreviousErrorCount(errorCounts, attemptIndex)
+  return (task.result?.errors?.length || 0) > previousErrorCount
+}
+
+function getFinalAttemptIndex (task) {
+  const testSuite = getTestSuite(task)
+  const testName = getTestName(task)
+
+  if (attemptToFixTests[testSuite]?.[testName]) {
+    return getAttemptToFixRetryCount(task)
+  }
+  if (isEarlyFlakeDetectionTest(testSuite, testName)) {
+    return getEarlyFlakeDetectionRetryCountForTask(task)
+  }
+  return task.repeats
+}
+
+function switchQuarantinedFinalFailure (task, attemptIndex) {
+  const testSuite = getTestSuite(task)
+  const testName = getTestName(task)
+  if (
+    !quarantinedTests[testSuite]?.[testName] ||
+    attemptToFixTests[testSuite]?.[testName] ||
+    task.result?.state !== 'fail'
+  ) {
+    return
+  }
+
+  const retryCount = task.result?.retryCount || 0
+  const retryLimit = task.retry || 0
+  if (retryCount < retryLimit || attemptIndex < getFinalAttemptIndex(task)) {
+    return
+  }
+
+  task.meta.__ddTestOptQuarantinedFailed = true
+  task.result.state = 'pass'
+}
+
+function getAttemptToFixRetryCount (task) {
+  return task.meta.__ddTestOptAtfRetries ?? task.repeats
+}
+
+function getEarlyFlakeDetectionRetryCountForTask (task) {
+  return earlyFlakeDetectionRetriesByTask.get(task) ?? task.meta.__ddTestOptEfdRetries ?? task.repeats
+}
+
+function getAttemptStatus (task, errorCounts, repeatCount) {
+  const errorCount = task.result?.errors?.length || 0
+  if (errorCount > getPreviousErrorCount(errorCounts, repeatCount)) {
+    return 'fail'
+  }
+  return task.result?.state === 'fail' ? 'fail' : 'pass'
+}
+
+function getManualRepeatStatus (task, errorCounts, repeatCount) {
+  const errorCount = task.result?.errors?.length || 0
+  return errorCount > getPreviousErrorCount(errorCounts, repeatCount) ? 'fail' : 'pass'
+}
+
+function getPreviousErrorCount (errorCounts, repeatCount) {
+  for (let index = repeatCount - 1; index >= 0; index--) {
+    if (errorCounts[index] !== undefined) {
+      return errorCounts[index]
+    }
+  }
+  return 0
+}
+
+function prepareEarlyFlakeDetectionAttempt (task, attemptIndex) {
+  if (attemptIndex === 0) {
+    earlyFlakeDetectionStartByTask.set(task, performance.now())
+    return false
+  }
+
+  let retryCount = earlyFlakeDetectionRetriesByTask.get(task)
+  if (retryCount === undefined) {
+    retryCount = getEarlyFlakeDetectionRetryCount(task)
+    earlyFlakeDetectionRetriesByTask.set(task, retryCount)
+    task.repeats = retryCount
+    task.meta.__ddTestOptEfdRetries = retryCount
+    if (retryCount === 0 && hasEarlyFlakeDetectionSlowRetries) {
+      task.meta.__ddTestOptEfdAbortReason = 'slow'
+    }
+  }
+
+  if (attemptIndex <= retryCount) {
+    earlyFlakeDetectionStartByTask.set(task, performance.now())
+    return false
+  }
+
+  if (!canReplaceVitestTaskFn()) {
+    earlyFlakeDetectionStartByTask.set(task, performance.now())
+    return false
+  }
+
+  if (task.result) {
+    earlyFlakeDetectionSkippedResults.set(task, {
+      ...task.result,
+      errors: task.result.errors?.slice(),
+    })
+  }
+  task.meta.__ddTestOptEfdSkipCurrentAttempt = true
+  replaceVitestTaskFn(task, noopTest)
+  return true
+}
+
+function getEarlyFlakeDetectionRetryCount (task) {
+  if (!hasEarlyFlakeDetectionSlowRetries) {
+    return earlyFlakeDetectionRetries
+  }
+
+  const executionStart = earlyFlakeDetectionStartByTask.get(task)
+  const duration = executionStart === undefined ? task.result?.duration ?? 0 : performance.now() - executionStart
+  for (const { key, limitMs } of earlyFlakeDetectionRetryThresholds) {
+    if (duration < limitMs) {
+      return earlyFlakeDetectionSlowRetries[key] ?? 0
+    }
+  }
+  return 0
+}
+
+function noopTest () {}
+
+/**
+ * Returns whether Vitest's private task function setter is available.
+ *
+ * @returns {boolean}
+ */
+function canReplaceVitestTaskFn () {
+  return typeof setVitestTaskFn === 'function'
+}
+
+/**
+ * Replaces the function Vitest runs for a task.
+ *
+ * @param {object} task
+ * @param {(...args: unknown[]) => unknown} testFn
+ */
+function replaceVitestTaskFn (task, testFn) {
+  setVitestTaskFn(task, testFn)
+}
+
+function isEarlyFlakeDetectionTest (testSuite, testName) {
+  if (!isEarlyFlakeDetectionEnabled || earlyFlakeDetectionRetries <= 0) return false
+  if (isModifiedTest(testSuite)) return true
+  const testsForSuite = knownTests[testSuite] || []
+  return !testsForSuite.includes(testName)
+}
+
+function isModifiedTest (testSuite) {
+  return modifiedFiles[testSuite]?.length > 0
+}
+
+function getTestSuite (task) {
+  let filepath = realpaths.get(task.file.filepath)
+  if (filepath === undefined) {
+    filepath = realpath(task.file.filepath)
+    realpaths.set(task.file.filepath, filepath)
+  }
+
+  return normalizePath(relative(repositoryRoot, filepath))
+}
+
+function realpath (filepath) {
+  try {
+    return realpathSync(filepath)
+  } catch {
+    return filepath
+  }
+}
+
+function getTestName (task) {
+  let testName = task.name
+  let currentTask = task.suite
+
+  while (currentTask) {
+    if (currentTask.name) {
+      testName = `${currentTask.name} ${testName}`
+    }
+    currentTask = currentTask.suite
+  }
+
+  return testName
+}
+
+function normalizePath (filepath) {
+  return filepath.replaceAll('\\', '/')
+}
+
+function getIsNoWorkerInitActive () {
+  try {
+    // eslint-disable-next-line eslint-rules/eslint-process-env
+    const value = process.env[VITEST_NO_WORKER_INIT_ACTIVE_ENV]
+    return value === '1' || value === 'true'
+  } catch {
+    return false
+  }
+}
+
+function getProvidedContext () {
+  try {
+    return globalThis.__vitest_worker__.providedContext._ddVitestWorkerSetup || {}
+  } catch {
+    return {}
+  }
+}
diff --git a/integration-tests/ci-visibility/vitest-tests-programmatic-api/run-no-worker-programmatic-api-collect-before-run.mjs b/integration-tests/ci-visibility/vitest-tests-programmatic-api/run-no-worker-programmatic-api-collect-before-run.mjs
new file mode 100644
index 0000000000..ca3ff60a43
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests-programmatic-api/run-no-worker-programmatic-api-collect-before-run.mjs
@@ -0,0 +1,34 @@
+import { startVitest } from 'vitest/node'
+
+const testFile = process.env.TEST_DIR || 'ci-visibility/vitest-tests/vitest-worker-env.mjs'
+
+async function runProgrammaticTests () {
+  let vitest
+  let didCollectWithoutFailures = false
+  try {
+    vitest = await startVitest('test', [], {
+      run: false,
+      test: {
+        environment: 'node',
+        pool: process.env.POOL_CONFIG || 'forks',
+      },
+      watch: false,
+    })
+
+    const testSpecifications = await vitest.globTestSpecifications([testFile])
+    await vitest.collectTests(testSpecifications)
+    didCollectWithoutFailures = true
+  } catch (error) {
+    process.stderr.write(`${error?.stack || error}\n`)
+    process.exitCode = 1
+  } finally {
+    if (vitest) {
+      await vitest.close()
+    }
+    if (didCollectWithoutFailures) {
+      process.exit(0)
+    }
+  }
+}
+
+runProgrammaticTests()
diff --git a/integration-tests/ci-visibility/vitest-tests/failed-suite-hook.mjs b/integration-tests/ci-visibility/vitest-tests/failed-suite-hook.mjs
new file mode 100644
index 0000000000..10e933ca28
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/failed-suite-hook.mjs
@@ -0,0 +1,11 @@
+import { beforeAll, describe, expect, test } from 'vitest'
+
+describe('failed suite hook', () => {
+  beforeAll(() => {
+    throw new Error('failed before all')
+  })
+
+  test('does not run the test body', () => {
+    expect(1 + 2).toBe(3)
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/no-worker-suite-context-a-slow.mjs b/integration-tests/ci-visibility/vitest-tests/no-worker-suite-context-a-slow.mjs
new file mode 100644
index 0000000000..f58627ff84
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/no-worker-suite-context-a-slow.mjs
@@ -0,0 +1,8 @@
+import { describe, expect, test } from 'vitest'
+
+describe('no-worker suite context slow', () => {
+  test('reports the slow suite test', async () => {
+    await new Promise(resolve => setTimeout(resolve, 20))
+    expect(1 + 2).toBe(3)
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/no-worker-suite-context-b-fast.mjs b/integration-tests/ci-visibility/vitest-tests/no-worker-suite-context-b-fast.mjs
new file mode 100644
index 0000000000..7df12b6caf
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/no-worker-suite-context-b-fast.mjs
@@ -0,0 +1,7 @@
+import { describe, expect, test } from 'vitest'
+
+describe('no-worker suite context fast', () => {
+  test('reports the fast suite test', () => {
+    expect(1 + 2).toBe(3)
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/slow-failing-retry.mjs b/integration-tests/ci-visibility/vitest-tests/slow-failing-retry.mjs
new file mode 100644
index 0000000000..13eea975c6
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/slow-failing-retry.mjs
@@ -0,0 +1,16 @@
+import { describe, expect, test } from 'vitest'
+
+let attempt = 0
+
+function wait (ms) {
+  return new Promise(resolve => setTimeout(resolve, ms))
+}
+
+describe('slow failing retry', () => {
+  test('does not double report final failed retry', async () => {
+    if (attempt++ > 0) {
+      await wait(200)
+    }
+    expect(1).to.equal(2)
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/string-setup-file.mjs b/integration-tests/ci-visibility/vitest-tests/string-setup-file.mjs
new file mode 100644
index 0000000000..8d79db5043
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/string-setup-file.mjs
@@ -0,0 +1 @@
+globalThis.__ddStringSetupFileLoaded = true
diff --git a/integration-tests/ci-visibility/vitest-tests/uses-string-setup-file.mjs b/integration-tests/ci-visibility/vitest-tests/uses-string-setup-file.mjs
new file mode 100644
index 0000000000..e7c738096d
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/uses-string-setup-file.mjs
@@ -0,0 +1,7 @@
+import { describe, expect, test } from 'vitest'
+
+describe('string setup file', () => {
+  test('keeps the configured setup file', () => {
+    expect(globalThis.__ddStringSetupFileLoaded).toBe(true)
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/vitest-worker-env.mjs b/integration-tests/ci-visibility/vitest-tests/vitest-worker-env.mjs
index d8c1c4f97d..575603df34 100644
--- a/integration-tests/ci-visibility/vitest-tests/vitest-worker-env.mjs
+++ b/integration-tests/ci-visibility/vitest-tests/vitest-worker-env.mjs
@@ -1,7 +1,35 @@
 import { describe, expect, it } from 'vitest'
 
+function wait (ms) {
+  return new Promise(resolve => setTimeout(resolve, ms))
+}
+
 describe('vitest worker env', () => {
-  it('sets DD_VITEST_WORKER', () => {
+  it('sets DD_VITEST_WORKER', async () => {
+    if (process.env.WAIT_BEFORE_EXPECTATION_MS) {
+      await wait(Number(process.env.WAIT_BEFORE_EXPECTATION_MS))
+    }
+
     expect(process.env.DD_VITEST_WORKER).toBe('1')
+
+    if (process.env.EXPECT_DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE) {
+      expect(process.env.DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE).toBe('1')
+    }
+
+    if (process.env.EXPECT_DD_TEST_OPT_VITEST_NO_WORKER_INIT_INACTIVE) {
+      expect(process.env.DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE).toBeUndefined()
+    }
+
+    if (process.env.EXPECT_NO_DD_TRACE_INIT) {
+      expect(globalThis._ddtrace).toBeUndefined()
+    }
+
+    if (process.env.EXPECT_DD_NODE_OPTIONS_STRIPPED) {
+      expect(process.env.NODE_OPTIONS || '').not.toMatch(/dd-trace\/(?:register\.js|ci\/init(?:\.js)?)/)
+    }
+
+    if (process.env.EXPECT_DD_NODE_OPTIONS_PRESERVED) {
+      expect(process.env.NODE_OPTIONS || '').toContain(process.env.EXPECT_DD_NODE_OPTIONS_PRESERVED)
+    }
   })
 })
diff --git a/integration-tests/vitest.config.mjs b/integration-tests/vitest.config.mjs
index 6606fce124..1916d61b77 100644
--- a/integration-tests/vitest.config.mjs
+++ b/integration-tests/vitest.config.mjs
@@ -19,11 +19,31 @@ const config = {
     include: [
       process.env.TEST_DIR || 'ci-visibility/vitest-tests/test-visibility*',
     ],
-    pool: process.env.POOL_CONFIG || 'forks',
     reporters: ['default'],
   },
 }
 
+const poolConfig = process.env.POOL_CONFIG || 'forks'
+if (!process.env.USE_VITEST_DEFAULT_POOL) {
+  config.test.pool = poolConfig
+}
+
+if (process.env.NO_ISOLATE) {
+  config.test.isolate = false
+}
+
+if (process.env.POOL_NO_ISOLATE) {
+  config.test.poolOptions = {
+    [poolConfig]: {
+      isolate: false,
+    },
+  }
+}
+
+if (process.env.VITEST_SETUP_FILE) {
+  config.test.setupFiles = process.env.VITEST_SETUP_FILE
+}
+
 if (process.env.CUSTOM_SEQUENCER) {
   config.test.sequence = {
     sequencer: CustomSequencer,
@@ -44,6 +64,16 @@ if (process.env.PROJECT_POOL_CONFIG) {
   if (process.env.PROJECT_RETRY_CONFIG) {
     firstProjectConfig.retry = Number(process.env.PROJECT_RETRY_CONFIG)
   }
+  if (process.env.PROJECT_NO_ISOLATE) {
+    firstProjectConfig.isolate = false
+  }
+  if (process.env.PROJECT_POOL_NO_ISOLATE) {
+    firstProjectConfig.poolOptions = {
+      [firstProjectConfig.pool]: {
+        isolate: false,
+      },
+    }
+  }
   projectConfigs.push({ test: firstProjectConfig })
 
   if (process.env.SECOND_PROJECT_CONFIG_FILE) {
diff --git a/integration-tests/vitest/vitest.no-worker-init.spec.js b/integration-tests/vitest/vitest.no-worker-init.spec.js
new file mode 100644
index 0000000000..85d19d093d
--- /dev/null
+++ b/integration-tests/vitest/vitest.no-worker-init.spec.js
@@ -0,0 +1,1187 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const path = require('node:path')
+const { exec, execSync } = require('node:child_process')
+const { once } = require('node:events')
+const { inspect } = require('node:util')
+
+const {
+  sandboxCwd,
+  useSandbox,
+  getCiVisAgentlessConfig,
+  assertObjectContains,
+} = require('../helpers')
+const { FakeCiVisIntake } = require('../ci-visibility-intake')
+const noWorkerInit = require('../../packages/datadog-instrumentations/src/vitest-main-no-worker-init')
+const { testSuiteStartCh } = require('../../packages/datadog-instrumentations/src/vitest-util')
+const {
+  ERROR_MESSAGE,
+} = require('../../packages/dd-trace/src/constants')
+const {
+  DD_CAPABILITIES_AUTO_TEST_RETRIES,
+  DD_CAPABILITIES_EARLY_FLAKE_DETECTION,
+  DD_CAPABILITIES_FAILED_TEST_REPLAY,
+  DD_CAPABILITIES_IMPACTED_TESTS,
+  DD_CAPABILITIES_TEST_MANAGEMENT_ATTEMPT_TO_FIX,
+  DD_CAPABILITIES_TEST_MANAGEMENT_DISABLE,
+  DD_CAPABILITIES_TEST_MANAGEMENT_QUARANTINE,
+  EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS,
+  TEST_EARLY_FLAKE_ABORT_REASON,
+  TEST_EARLY_FLAKE_ENABLED,
+  TEST_FINAL_STATUS,
+  TEST_HAS_FAILED_ALL_RETRIES,
+  TEST_IS_MODIFIED,
+  TEST_IS_NEW,
+  TEST_IS_RETRY,
+  TEST_IS_TEST_FRAMEWORK_WORKER,
+  TEST_MANAGEMENT_ATTEMPT_TO_FIX_PASSED,
+  TEST_MANAGEMENT_ENABLED,
+  TEST_MANAGEMENT_IS_ATTEMPT_TO_FIX,
+  TEST_MANAGEMENT_IS_DISABLED,
+  TEST_MANAGEMENT_IS_QUARANTINED,
+  TEST_NAME,
+  TEST_RETRY_REASON,
+  TEST_RETRY_REASON_TYPES,
+  TEST_SOURCE_FILE,
+  TEST_STATUS,
+  TEST_SUITE,
+} = require('../../packages/dd-trace/src/plugins/util/test')
+const { NODE_MAJOR } = require('../../version')
+
+const DEFAULT_NODE_OPTIONS = '--no-warnings --import dd-trace/register.js -r dd-trace/ci/init'
+const VITEST_NO_WORKER_INIT_REQUEST_ENV = 'DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT'
+const SUPPORTED_VERSIONS = NODE_MAJOR <= 18 ? ['3.2.6'] : ['3.2.6', 'latest']
+const UNSUPPORTED_VERSION = '1.6.0'
+const UNSUPPORTED_VERSION_WARNING =
+  'DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT is only supported for vitest >=3.2.6'
+const DISABLED_ISOLATE_WARNING =
+  'DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT is ignored because Vitest isolate is disabled'
+
+function getEvents (payloads) {
+  return payloads.flatMap(({ payload }) => payload.events)
+}
+
+function getEventContents (events, type) {
+  return events.filter(event => event.type === type).map(event => event.content)
+}
+
+function assertEventCounts (events, expectedCounts) {
+  const eventTypes = events.map(event => event.type)
+  for (const [type, expectedCount] of Object.entries(expectedCounts)) {
+    assert.strictEqual(
+      getEventContents(events, type).length,
+      expectedCount,
+      inspect(eventTypes)
+    )
+  }
+}
+
+function sortStrings (strings) {
+  return strings.slice().sort((a, b) => a.localeCompare(b))
+}
+
+function getTestByName (tests, name) {
+  const test = tests.find(test => test.meta[TEST_NAME] === name)
+  assert.ok(test, `Could not find test ${name}. Found: ${inspect(tests.map(test => test.meta[TEST_NAME]))}`)
+  return test
+}
+
+function getTestsByName (tests, name) {
+  return tests
+    .filter(test => test.meta[TEST_NAME] === name)
+    .sort((a, b) => (a.start < b.start ? -1 : a.start > b.start ? 1 : 0))
+}
+
+function getNoWorkerInitEnv (receiver, extraEnv = {}) {
+  return {
+    ...getCiVisAgentlessConfig(receiver.port),
+    NODE_OPTIONS: DEFAULT_NODE_OPTIONS,
+    [VITEST_NO_WORKER_INIT_REQUEST_ENV]: 'true',
+    DD_SERVICE: undefined,
+    ...extraEnv,
+  }
+}
+
+function gatherCitestcyclePayloads (receiver, assertions) {
+  return receiver.gatherPayloadsMaxTimeout(
+    ({ url }) => url === '/api/v2/citestcycle',
+    payloads => assertions(getEvents(payloads))
+  )
+}
+
+describe('vitest no-worker init instrumentation selection', () => {
+  const workerPools = new Set(['forks', 'threads', 'vmForks', 'vmThreads'])
+  const options = {
+    isVitestWorkerPool: pool => workerPools.has(pool),
+  }
+  let originalRequested
+
+  beforeEach(() => {
+    originalRequested = process.env[VITEST_NO_WORKER_INIT_REQUEST_ENV]
+    process.env[VITEST_NO_WORKER_INIT_REQUEST_ENV] = 'true'
+  })
+
+  afterEach(() => {
+    if (originalRequested === undefined) {
+      delete process.env[VITEST_NO_WORKER_INIT_REQUEST_ENV]
+    } else {
+      process.env[VITEST_NO_WORKER_INIT_REQUEST_ENV] = originalRequested
+    }
+  })
+
+  describe('shouldUse', () => {
+    it('rejects runs when the feature was not requested', () => {
+      delete process.env[VITEST_NO_WORKER_INIT_REQUEST_ENV]
+
+      assert.strictEqual(noWorkerInit.shouldUse({ config: { pool: 'forks' } }, '3.2.6', undefined, options), false)
+    })
+
+    it('rejects vitest versions older than 3.2.6', () => {
+      assert.strictEqual(noWorkerInit.shouldUse({ config: { pool: 'forks' } }, '3.2.5', undefined, options), false)
+    })
+
+    for (const pool of ['forks', 'threads']) {
+      it(`accepts isolated ${pool} runs`, () => {
+        assert.strictEqual(noWorkerInit.shouldUse({ config: { pool } }, '3.2.6', undefined, options), true)
+      })
+    }
+
+    it('rejects root projects with isolate disabled', () => {
+      assert.strictEqual(
+        noWorkerInit.shouldUse({ config: { isolate: false, pool: 'forks' } }, '3.2.6', undefined, options),
+        false
+      )
+    })
+
+    it('rejects pool-specific isolate disabled configuration', () => {
+      assert.strictEqual(
+        noWorkerInit.shouldUse({
+          config: {
+            pool: 'threads',
+            poolOptions: {
+              threads: {
+                isolate: false,
+              },
+            },
+          },
+        }, '3.2.6', undefined, options),
+        false
+      )
+    })
+
+    it('rejects default pool-specific isolate disabled configuration', () => {
+      assert.strictEqual(
+        noWorkerInit.shouldUse({
+          config: {
+            poolOptions: {
+              forks: {
+                isolate: false,
+              },
+            },
+          },
+        }, '3.2.6', undefined, options),
+        false
+      )
+    })
+
+    it('rejects selected test specifications with isolate disabled', () => {
+      const project = {
+        config: {
+          isolate: false,
+          pool: 'forks',
+        },
+      }
+
+      assert.strictEqual(
+        noWorkerInit.shouldUse({ config: { pool: 'forks' } }, '3.2.6', [[project, { pool: 'forks' }]], options),
+        false
+      )
+    })
+
+    it('rejects selected test specifications with default pool-specific isolate disabled', () => {
+      const project = {
+        config: {},
+      }
+
+      assert.strictEqual(
+        noWorkerInit.shouldUse({
+          config: {
+            poolOptions: {
+              forks: {
+                isolate: false,
+              },
+            },
+          },
+        }, '3.2.6', [[project, {}]], options),
+        false
+      )
+    })
+
+    it('rejects mixed worker and non-worker selected test specifications', () => {
+      const workerProject = {
+        config: {
+          pool: 'forks',
+        },
+      }
+      const nonWorkerProject = {
+        config: {
+          pool: 'browser',
+        },
+      }
+
+      assert.strictEqual(
+        noWorkerInit.shouldUse({
+          config: {
+            pool: 'forks',
+          },
+        }, '3.2.6', [
+          [workerProject, { pool: 'forks' }],
+          [nonWorkerProject, { pool: 'browser' }],
+        ], options),
+        false
+      )
+    })
+
+    it('rejects selected test specifications with non-worker tuple pool overrides', () => {
+      const project = {
+        config: {
+          pool: 'forks',
+        },
+      }
+
+      assert.strictEqual(
+        noWorkerInit.shouldUse({ config: { pool: 'forks' } }, '3.2.6', [
+          [project, {}, { pool: 'browser' }],
+        ], options),
+        false
+      )
+    })
+  })
+
+  describe('configure', () => {
+    function getNoWorkerReporterContext () {
+      const rootProject = { _provided: {} }
+      return {
+        config: {},
+        reporters: [],
+        getRootProject () {
+          return rootProject
+        },
+      }
+    }
+
+    function configureNoWorkerReporter (ctx) {
+      noWorkerInit.configure(ctx, '3.2.6', undefined, {
+        knownTestsBySuite: {},
+        modifiedFiles: {},
+        repositoryRoot: '/repo',
+        testManagementTestsBySuite: {},
+        testSessionConfiguration: {},
+      }, {
+        getConfiguredEfdRetryCount: () => 2,
+        state: {
+          earlyFlakeDetectionNumRetries: 1,
+          earlyFlakeDetectionSlowTestRetries: { '5s': 2 },
+          isEarlyFlakeDetectionEnabled: true,
+          isEarlyFlakeDetectionFaulty: false,
+          testManagementAttemptToFixRetries: 0,
+        },
+      })
+    }
+
+    it('sends EFD retry thresholds to the no-worker setup context', () => {
+      const ctx = getNoWorkerReporterContext()
+
+      configureNoWorkerReporter(ctx)
+
+      assert.deepStrictEqual(
+        ctx.getRootProject()._provided._ddVitestWorkerSetup.earlyFlakeDetectionRetryThresholds,
+        EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS
+      )
+    })
+
+    it('deactivates the no-worker reporter for reused contexts that fall back', () => {
+      const ctx = getNoWorkerReporterContext()
+      const testSuiteStarts = []
+      const onTestSuiteStart = context => testSuiteStarts.push(context.testSuiteAbsolutePath)
+      testSuiteStartCh.subscribe(onTestSuiteStart)
+
+      try {
+        configureNoWorkerReporter(ctx)
+        assert.strictEqual(ctx.reporters.length, 1)
+
+        ctx.reporters[0].onTestModuleStart({
+          id: 'first',
+          moduleId: '/repo/first.test.mjs',
+        })
+        noWorkerInit.deactivate(ctx)
+        ctx.reporters[0].onTestModuleStart({
+          id: 'second',
+          moduleId: '/repo/second.test.mjs',
+        })
+      } finally {
+        testSuiteStartCh.unsubscribe(onTestSuiteStart)
+      }
+
+      assert.deepStrictEqual(testSuiteStarts, ['/repo/first.test.mjs'])
+    })
+  })
+
+  describe('configureWorkerEnv', () => {
+    it('restores Datadog NODE_OPTIONS when no-worker mode falls back', () => {
+      const noWorkerEnv = noWorkerInit.configureWorkerEnv({
+        NODE_OPTIONS: DEFAULT_NODE_OPTIONS,
+      }, true)
+
+      assert.strictEqual(noWorkerEnv.NODE_OPTIONS, '--no-warnings')
+      assert.strictEqual(noWorkerEnv.DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE, '1')
+
+      const workerEnv = noWorkerInit.configureWorkerEnv({
+        NODE_OPTIONS: noWorkerEnv.NODE_OPTIONS,
+      })
+
+      assert.strictEqual(workerEnv.NODE_OPTIONS, DEFAULT_NODE_OPTIONS)
+      assert.ok(!('DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE' in workerEnv))
+    })
+  })
+})
+
+SUPPORTED_VERSIONS.forEach((version) => {
+  describe(`vitest@${version} no-worker init`, () => {
+    let cwd, receiver, childProcess, testOutput
+
+    useSandbox([
+      `vitest@${version}`,
+      'tinypool',
+    ], true)
+
+    before(function () {
+      cwd = sandboxCwd()
+    })
+
+    beforeEach(async function () {
+      childProcess = undefined
+      testOutput = ''
+      receiver = await new FakeCiVisIntake().start()
+    })
+
+    afterEach(async () => {
+      childProcess?.kill()
+      await receiver.stop()
+    })
+
+    async function runVitest (extraEnv = {}, command = './node_modules/.bin/vitest run') {
+      childProcess = exec(
+        command,
+        {
+          cwd,
+          env: getNoWorkerInitEnv(receiver, extraEnv),
+        }
+      )
+
+      childProcess.stdout.on('data', data => { testOutput += data })
+      childProcess.stderr.on('data', data => { testOutput += data })
+
+      const [exitCode] = await once(childProcess, 'exit')
+      return exitCode
+    }
+
+    for (const poolConfig of ['forks', 'threads']) {
+      it(`runs and reports tests without initializing dd-trace in ${poolConfig} workers`, async () => {
+        const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+          assertEventCounts(events, {
+            test_session_end: 1,
+            test_module_end: 1,
+            test_suite_end: 1,
+            test: 1,
+          })
+
+          const [test] = getEventContents(events, 'test')
+          assert.strictEqual(test.meta[TEST_NAME], 'vitest worker env sets DD_VITEST_WORKER')
+          assert.strictEqual(test.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(test.meta[TEST_IS_TEST_FRAMEWORK_WORKER], 'true')
+          assert.ok(
+            Number(test.duration) >= 100 * 1e6,
+            `Expected test duration to include Vitest execution time, got ${Number(test.duration) / 1e6}ms`
+          )
+        })
+
+        const exitCode = await Promise.all([
+          runVitest({
+            TEST_DIR: 'ci-visibility/vitest-tests/vitest-worker-env.mjs',
+            POOL_CONFIG: poolConfig,
+            EXPECT_DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE: '1',
+            EXPECT_DD_NODE_OPTIONS_PRESERVED: '--no-warnings',
+            EXPECT_DD_NODE_OPTIONS_STRIPPED: '1',
+            EXPECT_NO_DD_TRACE_INIT: '1',
+            WAIT_BEFORE_EXPECTATION_MS: '100',
+          }),
+          payloadsPromise,
+        ]).then(([exitCode]) => exitCode)
+
+        assert.strictEqual(exitCode, 0, testOutput)
+      })
+    }
+
+    it('does not advertise Failed Test Replay capability in no-worker mode', async () => {
+      receiver.setSettings({
+        di_enabled: true,
+      })
+
+      const metadataPromise = receiver
+        .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', payloads => {
+          const metadataDicts = payloads.flatMap(({ payload }) => payload.metadata)
+
+          assert.ok(metadataDicts.length > 0, `Expected ${metadataDicts.length} > 0`)
+          metadataDicts.forEach(metadata => {
+            assertObjectContains(metadata.test, {
+              [DD_CAPABILITIES_EARLY_FLAKE_DETECTION]: '1',
+              [DD_CAPABILITIES_AUTO_TEST_RETRIES]: '1',
+              [DD_CAPABILITIES_IMPACTED_TESTS]: '1',
+              [DD_CAPABILITIES_TEST_MANAGEMENT_QUARANTINE]: '1',
+              [DD_CAPABILITIES_TEST_MANAGEMENT_DISABLE]: '1',
+              [DD_CAPABILITIES_TEST_MANAGEMENT_ATTEMPT_TO_FIX]: '5',
+            })
+            assert.ok(
+              !Object.hasOwn(metadata.test, DD_CAPABILITIES_FAILED_TEST_REPLAY),
+              `Available keys: ${inspect(Object.keys(metadata.test))}`
+            )
+          })
+        })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          TEST_DIR: 'ci-visibility/vitest-tests/vitest-worker-env.mjs',
+          POOL_CONFIG: 'forks',
+          EXPECT_DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE: '1',
+          EXPECT_NO_DD_TRACE_INIT: '1',
+        }),
+        metadataPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 0, testOutput)
+    })
+
+    it('preserves no-worker env when the programmatic API collects tests', async () => {
+      const exitCode = await runVitest({
+        TEST_DIR: 'ci-visibility/vitest-tests/vitest-worker-env.mjs',
+        POOL_CONFIG: 'forks',
+        EXPECT_DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE: '1',
+        EXPECT_DD_NODE_OPTIONS_STRIPPED: '1',
+        EXPECT_NO_DD_TRACE_INIT: '1',
+      }, 'node ci-visibility/vitest-tests-programmatic-api/run-no-worker-programmatic-api-collect-before-run.mjs')
+
+      assert.strictEqual(exitCode, 0, testOutput)
+      assert.match(testOutput, /1 passed/, testOutput)
+    })
+
+    it('reports multiple suites with the same parentage as worker instrumentation', async () => {
+      const expectedSuites = [
+        'ci-visibility/vitest-tests/no-worker-suite-context-a-slow.mjs',
+        'ci-visibility/vitest-tests/no-worker-suite-context-b-fast.mjs',
+      ]
+      const expectedTests = [
+        'no-worker suite context fast reports the fast suite test',
+        'no-worker suite context slow reports the slow suite test',
+      ]
+
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 2,
+          test: 2,
+        })
+
+        const suites = getEventContents(events, 'test_suite_end')
+        const tests = getEventContents(events, 'test')
+        assert.deepStrictEqual(sortStrings(suites.map(suite => suite.meta[TEST_SOURCE_FILE])), expectedSuites)
+        assert.deepStrictEqual(sortStrings(tests.map(test => test.meta[TEST_NAME])), expectedTests)
+
+        const suitesBySourceFile = new Map(suites.map(suite => [suite.meta[TEST_SOURCE_FILE], suite]))
+        for (const test of tests) {
+          const suite = suitesBySourceFile.get(test.meta[TEST_SOURCE_FILE])
+          assert.ok(suite, `Could not find suite for ${test.meta[TEST_SOURCE_FILE]}`)
+          assert.strictEqual(test.meta[TEST_SUITE], test.meta[TEST_SOURCE_FILE])
+          assert.strictEqual(test.test_session_id.toString(), suite.test_session_id.toString())
+          assert.strictEqual(test.test_module_id.toString(), suite.test_module_id.toString())
+        }
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          TEST_DIR: 'ci-visibility/vitest-tests/no-worker-suite-context-*.mjs',
+          POOL_CONFIG: 'forks',
+        }),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 0, testOutput)
+    })
+
+    it('reports suite hook failures from the main-process reporter', async () => {
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 1,
+        })
+
+        const [suite] = getEventContents(events, 'test_suite_end')
+        assert.strictEqual(suite.meta[TEST_STATUS], 'fail')
+        assert.match(suite.meta[ERROR_MESSAGE], /failed before all/)
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          TEST_DIR: 'ci-visibility/vitest-tests/failed-suite-hook.mjs',
+          POOL_CONFIG: 'forks',
+        }),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 1, testOutput)
+    })
+
+    it('preserves existing string setup files when injecting the no-worker setup file', async () => {
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 1,
+          test: 1,
+        })
+
+        const [test] = getEventContents(events, 'test')
+        assert.strictEqual(test.meta[TEST_NAME], 'string setup file keeps the configured setup file')
+        assert.strictEqual(test.meta[TEST_STATUS], 'pass')
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          TEST_DIR: 'ci-visibility/vitest-tests/uses-string-setup-file.mjs',
+          POOL_CONFIG: 'forks',
+          VITEST_SETUP_FILE: 'ci-visibility/vitest-tests/string-setup-file.mjs',
+        }),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 0, testOutput)
+    })
+
+    for (const { name, env } of [
+      {
+        name: 'root isolate disabled',
+        env: {
+          NO_ISOLATE: '1',
+          POOL_CONFIG: 'forks',
+        },
+      },
+      {
+        name: 'root pool isolate disabled',
+        env: {
+          POOL_CONFIG: 'forks',
+          POOL_NO_ISOLATE: '1',
+        },
+      },
+      {
+        name: 'default pool isolate disabled',
+        env: {
+          USE_VITEST_DEFAULT_POOL: '1',
+          POOL_NO_ISOLATE: '1',
+        },
+      },
+      {
+        name: 'project isolate disabled',
+        env: {
+          PROJECT_NO_ISOLATE: '1',
+          PROJECT_POOL_CONFIG: 'forks',
+        },
+      },
+      {
+        name: 'project pool isolate disabled',
+        env: {
+          PROJECT_POOL_CONFIG: 'forks',
+          PROJECT_POOL_NO_ISOLATE: '1',
+        },
+      },
+    ]) {
+      it(`warns and falls back to worker instrumentation when ${name}`, async () => {
+        const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+          assertEventCounts(events, {
+            test_session_end: 1,
+            test_module_end: 1,
+            test_suite_end: 1,
+            test: 1,
+          })
+
+          const [test] = getEventContents(events, 'test')
+          assert.strictEqual(test.meta[TEST_NAME], 'vitest worker env sets DD_VITEST_WORKER')
+          assert.strictEqual(test.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(test.meta[TEST_IS_TEST_FRAMEWORK_WORKER], 'true')
+        })
+
+        const exitCode = await Promise.all([
+          runVitest({
+            TEST_DIR: 'ci-visibility/vitest-tests/vitest-worker-env.mjs',
+            DD_TRACE_DEBUG: 'true',
+            DD_TRACE_LOG_LEVEL: 'warn',
+            EXPECT_DD_TEST_OPT_VITEST_NO_WORKER_INIT_INACTIVE: '1',
+            ...env,
+          }),
+          payloadsPromise,
+        ]).then(([exitCode]) => exitCode)
+
+        assert.strictEqual(exitCode, 0, testOutput)
+        assert.match(testOutput, new RegExp(DISABLED_ISOLATE_WARNING), testOutput)
+      })
+    }
+
+    it('applies no-worker setup data for Test Management', async () => {
+      receiver.setSettings({
+        test_management: {
+          enabled: true,
+          attempt_to_fix_retries: 2,
+        },
+      })
+      receiver.setTestManagementTests({
+        vitest: {
+          suites: {
+            'ci-visibility/vitest-tests/test-disabled.mjs': {
+              tests: {
+                'disable tests can disable a test': {
+                  properties: {
+                    disabled: true,
+                  },
+                },
+              },
+            },
+            'ci-visibility/vitest-tests/test-quarantine.mjs': {
+              tests: {
+                'quarantine tests can quarantine a test': {
+                  properties: {
+                    quarantined: true,
+                  },
+                },
+              },
+            },
+            'ci-visibility/vitest-tests/test-attempt-to-fix.mjs': {
+              tests: {
+                'attempt to fix tests can attempt to fix a test': {
+                  properties: {
+                    attempt_to_fix: true,
+                  },
+                },
+              },
+            },
+          },
+        },
+      })
+
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 3,
+          test: 7,
+        })
+
+        const tests = getEventContents(events, 'test')
+        const suites = getEventContents(events, 'test_suite_end')
+        const [testSession] = getEventContents(events, 'test_session_end')
+        assert.strictEqual(testSession.meta[TEST_MANAGEMENT_ENABLED], 'true')
+
+        const disabledTest = getTestByName(tests, 'disable tests can disable a test')
+        assert.strictEqual(disabledTest.meta[TEST_STATUS], 'skip')
+        assert.strictEqual(disabledTest.meta[TEST_MANAGEMENT_IS_DISABLED], 'true')
+
+        const quarantinedTest = getTestByName(tests, 'quarantine tests can quarantine a test')
+        assert.strictEqual(quarantinedTest.meta[TEST_STATUS], 'fail')
+        assert.strictEqual(quarantinedTest.meta[TEST_FINAL_STATUS], 'skip')
+        assert.strictEqual(quarantinedTest.meta[TEST_MANAGEMENT_IS_QUARANTINED], 'true')
+
+        const quarantinedSuite = suites.find(suite =>
+          suite.meta[TEST_SOURCE_FILE] === 'ci-visibility/vitest-tests/test-quarantine.mjs'
+        )
+        assert.ok(quarantinedSuite, inspect(suites.map(suite => suite.meta[TEST_SOURCE_FILE])))
+        assert.strictEqual(quarantinedSuite.meta[TEST_STATUS], 'pass')
+        assert.ok(!(ERROR_MESSAGE in quarantinedSuite.meta), inspect(quarantinedSuite.meta))
+
+        const attemptedToFixTests = getTestsByName(tests, 'attempt to fix tests can attempt to fix a test')
+        assert.strictEqual(attemptedToFixTests.length, 3)
+
+        attemptedToFixTests.forEach((test, index) => {
+          assert.strictEqual(test.meta[TEST_MANAGEMENT_IS_ATTEMPT_TO_FIX], 'true')
+          if (index === 0) {
+            assert.ok(!(TEST_IS_RETRY in test.meta))
+            return
+          }
+          assert.strictEqual(test.meta[TEST_IS_RETRY], 'true')
+          assert.strictEqual(test.meta[TEST_RETRY_REASON], TEST_RETRY_REASON_TYPES.atf)
+        })
+
+        const finalAttempt = attemptedToFixTests[attemptedToFixTests.length - 1]
+        assert.strictEqual(finalAttempt.meta[TEST_STATUS], 'fail')
+        assert.strictEqual(finalAttempt.meta[TEST_FINAL_STATUS], 'fail')
+        assert.strictEqual(finalAttempt.meta[TEST_HAS_FAILED_ALL_RETRIES], 'true')
+        assert.strictEqual(finalAttempt.meta[TEST_MANAGEMENT_ATTEMPT_TO_FIX_PASSED], 'false')
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          POOL_CONFIG: 'forks',
+          TEST_DIR: 'ci-visibility/vitest-tests/test-{disabled,quarantine,attempt-to-fix}.mjs',
+        }),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 1, testOutput)
+    })
+
+    it('does not skip disabled attempt-to-fix tests in no-worker mode', async () => {
+      receiver.setSettings({
+        test_management: {
+          enabled: true,
+          attempt_to_fix_retries: 2,
+        },
+      })
+      receiver.setTestManagementTests({
+        vitest: {
+          suites: {
+            'ci-visibility/vitest-tests/test-attempt-to-fix.mjs': {
+              tests: {
+                'attempt to fix tests can attempt to fix a test': {
+                  properties: {
+                    attempt_to_fix: true,
+                    disabled: true,
+                  },
+                },
+              },
+            },
+          },
+        },
+      })
+
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 1,
+          test: 3,
+        })
+
+        const attemptedToFixTests = getTestsByName(
+          getEventContents(events, 'test'),
+          'attempt to fix tests can attempt to fix a test'
+        )
+        assert.strictEqual(attemptedToFixTests.length, 3)
+
+        attemptedToFixTests.forEach((test, index) => {
+          assert.strictEqual(test.meta[TEST_STATUS], 'fail')
+          assert.strictEqual(test.meta[TEST_MANAGEMENT_IS_ATTEMPT_TO_FIX], 'true')
+          assert.strictEqual(test.meta[TEST_MANAGEMENT_IS_DISABLED], 'true')
+          if (index === 0) {
+            assert.ok(!(TEST_IS_RETRY in test.meta))
+            return
+          }
+          assert.strictEqual(test.meta[TEST_IS_RETRY], 'true')
+          assert.strictEqual(test.meta[TEST_RETRY_REASON], TEST_RETRY_REASON_TYPES.atf)
+        })
+
+        const finalAttempt = attemptedToFixTests[attemptedToFixTests.length - 1]
+        assert.strictEqual(finalAttempt.meta[TEST_FINAL_STATUS], 'fail')
+        assert.strictEqual(finalAttempt.meta[TEST_HAS_FAILED_ALL_RETRIES], 'true')
+        assert.strictEqual(finalAttempt.meta[TEST_MANAGEMENT_ATTEMPT_TO_FIX_PASSED], 'false')
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          POOL_CONFIG: 'forks',
+          TEST_DIR: 'ci-visibility/vitest-tests/test-attempt-to-fix.mjs',
+        }),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 1, testOutput)
+    })
+
+    it('applies no-worker setup data for auto test retries', async () => {
+      receiver.setSettings({
+        itr_enabled: false,
+        code_coverage: false,
+        tests_skipping: false,
+        flaky_test_retries_enabled: true,
+        early_flake_detection: {
+          enabled: false,
+        },
+      })
+
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 1,
+          test: 9,
+        })
+
+        const tests = getEventContents(events, 'test')
+        const eventuallyPassingTests = getTestsByName(
+          tests,
+          'flaky test retries can retry tests that eventually pass'
+        )
+        assert.strictEqual(eventuallyPassingTests.length, 4)
+        assert.ok(!(TEST_IS_RETRY in eventuallyPassingTests[0].meta), inspect(eventuallyPassingTests[0].meta))
+        for (const retryTest of eventuallyPassingTests.slice(1)) {
+          assert.strictEqual(retryTest.meta[TEST_IS_RETRY], 'true')
+          assert.strictEqual(retryTest.meta[TEST_RETRY_REASON], TEST_RETRY_REASON_TYPES.atr)
+        }
+        assert.strictEqual(eventuallyPassingTests[3].meta[TEST_STATUS], 'pass')
+        assert.strictEqual(eventuallyPassingTests[3].meta[TEST_FINAL_STATUS], 'pass')
+
+        const neverPassingTests = getTestsByName(tests, 'flaky test retries can retry tests that never pass')
+        assert.strictEqual(neverPassingTests.length, 4)
+        assert.ok(!(TEST_IS_RETRY in neverPassingTests[0].meta), inspect(neverPassingTests[0].meta))
+        for (const retryTest of neverPassingTests.slice(1)) {
+          assert.strictEqual(retryTest.meta[TEST_IS_RETRY], 'true')
+          assert.strictEqual(retryTest.meta[TEST_RETRY_REASON], TEST_RETRY_REASON_TYPES.atr)
+        }
+        assert.strictEqual(neverPassingTests[3].meta[TEST_STATUS], 'fail')
+        assert.strictEqual(neverPassingTests[3].meta[TEST_FINAL_STATUS], 'fail')
+        assert.strictEqual(neverPassingTests[3].meta[TEST_HAS_FAILED_ALL_RETRIES], 'true')
+
+        const unnecessaryRetryTest = getTestByName(tests, 'flaky test retries does not retry if unnecessary')
+        assert.ok(!(TEST_IS_RETRY in unnecessaryRetryTest.meta), inspect(unnecessaryRetryTest.meta))
+        assert.ok(!(TEST_RETRY_REASON in unnecessaryRetryTest.meta), inspect(unnecessaryRetryTest.meta))
+        assert.strictEqual(unnecessaryRetryTest.meta[TEST_FINAL_STATUS], 'pass')
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          DD_CIVISIBILITY_FLAKY_RETRY_COUNT: '3',
+          POOL_CONFIG: 'forks',
+          TEST_DIR: 'ci-visibility/vitest-tests/flaky-test-retries.mjs',
+        }),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 1, testOutput)
+    })
+
+    it('reports user configured Vitest retries as external retries in no-worker mode', async () => {
+      receiver.setSettings({
+        itr_enabled: false,
+        code_coverage: false,
+        tests_skipping: false,
+        flaky_test_retries_enabled: true,
+        early_flake_detection: {
+          enabled: false,
+        },
+      })
+
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 1,
+          test: 5,
+        })
+
+        const tests = getEventContents(events, 'test')
+        const retriedTests = getTestsByName(tests, 'flaky test retries can retry tests that eventually pass')
+        assert.strictEqual(retriedTests.length, 2)
+        assert.ok(!(TEST_IS_RETRY in retriedTests[0].meta), inspect(retriedTests[0].meta))
+        assert.ok(!(TEST_RETRY_REASON in retriedTests[0].meta), inspect(retriedTests[0].meta))
+        assert.strictEqual(retriedTests[1].meta[TEST_IS_RETRY], 'true')
+        assert.strictEqual(retriedTests[1].meta[TEST_RETRY_REASON], TEST_RETRY_REASON_TYPES.ext)
+        assert.strictEqual(retriedTests[1].meta[TEST_FINAL_STATUS], 'fail')
+        assert.ok(!(TEST_HAS_FAILED_ALL_RETRIES in retriedTests[1].meta), inspect(retriedTests[1].meta))
+
+        const atrTaggedTests = tests.filter(test => test.meta[TEST_RETRY_REASON] === TEST_RETRY_REASON_TYPES.atr)
+        assert.strictEqual(atrTaggedTests.length, 0, inspect(atrTaggedTests.map(test => test.meta)))
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          DD_CIVISIBILITY_FLAKY_RETRY_COUNT: '3',
+          PROJECT_POOL_CONFIG: 'forks',
+          PROJECT_RETRY_CONFIG: '1',
+          TEST_DIR: 'ci-visibility/vitest-tests/flaky-test-retries.mjs',
+        }, './node_modules/.bin/vitest run --project project-pool'),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 1, testOutput)
+    })
+
+    it('does not double report delayed final failed Vitest retries in no-worker mode', async () => {
+      receiver.setSettings({
+        itr_enabled: false,
+        code_coverage: false,
+        tests_skipping: false,
+        flaky_test_retries_enabled: false,
+        early_flake_detection: {
+          enabled: false,
+        },
+      })
+
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 1,
+          test: 2,
+        })
+
+        const retriedTests = getTestsByName(
+          getEventContents(events, 'test'),
+          'slow failing retry does not double report final failed retry'
+        )
+        assert.strictEqual(retriedTests.length, 2)
+        assert.ok(!(TEST_IS_RETRY in retriedTests[0].meta), inspect(retriedTests[0].meta))
+        assert.strictEqual(retriedTests[0].meta[TEST_STATUS], 'fail')
+        assert.ok(
+          Number(retriedTests[0].duration) < 100 * 1e6,
+          'Expected first attempt duration to exclude the delayed final retry, got ' +
+            `${Number(retriedTests[0].duration) / 1e6}ms`
+        )
+        assert.strictEqual(retriedTests[1].meta[TEST_IS_RETRY], 'true')
+        assert.strictEqual(retriedTests[1].meta[TEST_RETRY_REASON], TEST_RETRY_REASON_TYPES.ext)
+        assert.strictEqual(retriedTests[1].meta[TEST_STATUS], 'fail')
+        assert.strictEqual(retriedTests[1].meta[TEST_FINAL_STATUS], 'fail')
+        assert.ok(!(TEST_HAS_FAILED_ALL_RETRIES in retriedTests[1].meta), inspect(retriedTests[1].meta))
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          PROJECT_POOL_CONFIG: 'forks',
+          PROJECT_RETRY_CONFIG: '1',
+          TEST_DIR: 'ci-visibility/vitest-tests/slow-failing-retry.mjs',
+        }, './node_modules/.bin/vitest run --project project-pool'),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 1, testOutput)
+    })
+
+    it('applies no-worker setup data for impacted tests', async () => {
+      receiver.setSettings({
+        impacted_tests_enabled: true,
+        early_flake_detection: {
+          enabled: false,
+        },
+      })
+
+      execSync('git checkout -b no-worker-impacted-test', { cwd, stdio: 'ignore' })
+      fs.writeFileSync(
+        path.join(cwd, 'ci-visibility/vitest-tests/impacted-test.mjs'),
+        `import { describe, test, expect } from 'vitest'
+
+describe('impacted test', () => {
+  test('can impacted test', () => {
+    expect(2 + 2).to.equal(4)
+  })
+})
+`
+      )
+      execSync('git add ci-visibility/vitest-tests/impacted-test.mjs', { cwd, stdio: 'ignore' })
+      execSync('git commit -m "modify impacted test"', { cwd, stdio: 'ignore' })
+
+      try {
+        const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+          assertEventCounts(events, {
+            test_session_end: 1,
+            test_module_end: 1,
+            test_suite_end: 1,
+            test: 1,
+          })
+
+          const tests = getEventContents(events, 'test')
+          const impactedTest = getTestByName(tests, 'impacted test can impacted test')
+          assert.strictEqual(impactedTest.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(impactedTest.meta[TEST_IS_MODIFIED], 'true')
+          assert.ok(!(TEST_IS_NEW in impactedTest.meta), inspect(impactedTest.meta))
+          assert.ok(!(TEST_IS_RETRY in impactedTest.meta), inspect(impactedTest.meta))
+        })
+
+        const exitCode = await Promise.all([
+          runVitest({
+            GITHUB_BASE_REF: '',
+            POOL_CONFIG: 'forks',
+            TEST_DIR: 'ci-visibility/vitest-tests/impacted-test.mjs',
+          }),
+          payloadsPromise,
+        ]).then(([exitCode]) => exitCode)
+
+        assert.strictEqual(exitCode, 0, testOutput)
+      } finally {
+        execSync('git checkout -', { cwd, stdio: 'ignore' })
+        execSync('git branch -D no-worker-impacted-test', { cwd, stdio: 'ignore' })
+      }
+    })
+
+    it('applies no-worker setup data for early flake detection', async () => {
+      receiver.setSettings({
+        early_flake_detection: {
+          enabled: true,
+          slow_test_retries: {
+            '5s': 2,
+          },
+          faulty_session_threshold: 100,
+        },
+        known_tests_enabled: true,
+      })
+      receiver.setKnownTests({
+        vitest: {
+          'ci-visibility/vitest-tests/early-flake-detection.mjs': [
+            'early flake detection does not retry if it is not new',
+          ],
+        },
+      })
+
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        const tests = getEventContents(events, 'test')
+        const [testSession] = getEventContents(events, 'test_session_end')
+        assert.strictEqual(testSession.meta[TEST_EARLY_FLAKE_ENABLED], 'true')
+
+        const alwaysPassTests = getTestsByName(tests, 'early flake detection can retry tests that always pass')
+        assert.strictEqual(alwaysPassTests.length, 3)
+        assert.strictEqual(alwaysPassTests[0].meta[TEST_IS_NEW], 'true')
+        assert.ok(!(TEST_IS_RETRY in alwaysPassTests[0].meta))
+        for (const retryTest of alwaysPassTests.slice(1)) {
+          assert.strictEqual(retryTest.meta[TEST_IS_NEW], 'true')
+          assert.strictEqual(retryTest.meta[TEST_IS_RETRY], 'true')
+          assert.strictEqual(retryTest.meta[TEST_RETRY_REASON], TEST_RETRY_REASON_TYPES.efd)
+        }
+
+        const knownTest = getTestByName(tests, 'early flake detection does not retry if it is not new')
+        assert.ok(!(TEST_IS_NEW in knownTest.meta))
+        assert.ok(!(TEST_IS_RETRY in knownTest.meta))
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          TEST_DIR: 'ci-visibility/vitest-tests/early-flake-detection.mjs',
+          POOL_CONFIG: 'forks',
+        }),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 0, testOutput)
+    })
+
+    it('keeps a failed slow EFD test failed when remaining repeats are no-ops', async () => {
+      receiver.setSettings({
+        early_flake_detection: {
+          enabled: true,
+          slow_test_retries: {
+            '5s': 0,
+            '10s': 2,
+          },
+          faulty_session_threshold: 100,
+        },
+        known_tests_enabled: true,
+      })
+      receiver.setKnownTests({ vitest: {} })
+
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        const tests = getEventContents(events, 'test')
+        const [testSession] = getEventContents(events, 'test_session_end')
+        const retriedTests = getTestsByName(tests, 'early flake detection can retry tests that always pass')
+        assert.ok(retriedTests.length > 0, inspect(tests.map(test => test.meta[TEST_NAME])))
+        retriedTests.forEach(test => {
+          assert.strictEqual(test.meta[TEST_STATUS], 'fail', inspect(test.meta))
+        })
+        const finalTest = retriedTests[retriedTests.length - 1]
+        assert.strictEqual(finalTest.meta[TEST_FINAL_STATUS], 'fail')
+        assert.strictEqual(finalTest.meta[TEST_EARLY_FLAKE_ABORT_REASON], 'slow')
+        assert.ok(!(TEST_IS_RETRY in finalTest.meta), inspect(finalTest.meta))
+        assert.strictEqual(testSession.meta[TEST_STATUS], 'fail')
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          ALWAYS_FAIL: '1',
+          TEST_DIR: 'ci-visibility/vitest-tests/early-flake-detection.mjs',
+          POOL_CONFIG: 'forks',
+        }, './node_modules/.bin/vitest run -t "can retry tests that always pass"'),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 1, testOutput)
+    })
+  })
+})
+
+describe(`vitest@${UNSUPPORTED_VERSION} no-worker init`, () => {
+  let cwd, receiver, childProcess, testOutput
+
+  useSandbox([
+    `vitest@${UNSUPPORTED_VERSION}`,
+    'tinypool',
+  ], true)
+
+  before(function () {
+    cwd = sandboxCwd()
+  })
+
+  beforeEach(async function () {
+    childProcess = undefined
+    testOutput = ''
+    receiver = await new FakeCiVisIntake().start()
+  })
+
+  afterEach(async () => {
+    childProcess?.kill()
+    await receiver.stop()
+  })
+
+  async function runVitest (extraEnv = {}) {
+    childProcess = exec(
+      './node_modules/.bin/vitest run',
+      {
+        cwd,
+        env: getNoWorkerInitEnv(receiver, extraEnv),
+      }
+    )
+
+    childProcess.stdout.on('data', data => { testOutput += data })
+    childProcess.stderr.on('data', data => { testOutput += data })
+
+    const [exitCode] = await once(childProcess, 'exit')
+    return exitCode
+  }
+
+  for (const poolConfig of ['forks', 'threads']) {
+    it(`warns and falls back to worker instrumentation with pool=${poolConfig}`, async () => {
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 1,
+          test: 1,
+        })
+
+        const [test] = getEventContents(events, 'test')
+        assert.strictEqual(test.meta[TEST_NAME], 'vitest worker env sets DD_VITEST_WORKER')
+        assert.strictEqual(test.meta[TEST_STATUS], 'pass')
+        assert.strictEqual(test.meta[TEST_IS_TEST_FRAMEWORK_WORKER], 'true')
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          TEST_DIR: 'ci-visibility/vitest-tests/vitest-worker-env.mjs',
+          POOL_CONFIG: poolConfig,
+          DD_TRACE_DEBUG: 'true',
+          DD_TRACE_LOG_LEVEL: 'warn',
+          EXPECT_DD_TEST_OPT_VITEST_NO_WORKER_INIT_INACTIVE: '1',
+        }),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 0, testOutput)
+      assert.match(testOutput, new RegExp(UNSUPPORTED_VERSION_WARNING), testOutput)
+    })
+  }
+})
diff --git a/packages/datadog-instrumentations/src/vitest-main-no-worker-init.js b/packages/datadog-instrumentations/src/vitest-main-no-worker-init.js
new file mode 100644
index 0000000000..a0277c783f
--- /dev/null
+++ b/packages/datadog-instrumentations/src/vitest-main-no-worker-init.js
@@ -0,0 +1,1293 @@
+'use strict'
+
+const path = require('node:path')
+
+const satisfies = require('../../../vendor/dist/semifies')
+
+const { getValueFromEnvSources } = require('../../dd-trace/src/config/helper')
+const log = require('../../dd-trace/src/log')
+const {
+  DYNAMIC_NAME_RE,
+  EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS,
+  getTestSuitePath,
+  logAttemptToFixTestExecution,
+  recordAttemptToFixExecution,
+} = require('../../dd-trace/src/plugins/util/test')
+const {
+  getTestName,
+  getTypeTasks,
+  getWorkspaceProject,
+  isFlakyTestRetriesEnabledForTask,
+  setProvidedContext,
+  testErrorCh,
+  testFinishTimeCh,
+  testPassCh,
+  testSkipCh,
+  testStartCh,
+  testSuiteErrorCh,
+  testSuiteFinishCh,
+  testSuiteStartCh,
+} = require('./vitest-util')
+
+// No-worker-init instrumentation for DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT.
+// When enabled, Vitest workers do not initialize dd-trace, so this main-process instrumentation
+// takes over some worker responsibilities, including test span creation and lifecycle reporting.
+const mainProcessReporterStates = new WeakMap()
+const loggedAttemptToFixTests = new Set()
+
+const DATADOG_TEST_OPTIMIZATION_BOOTSTRAPS = new Set([
+  'dd-trace/register.js',
+  'dd-trace/ci/init',
+  'dd-trace/ci/init.js',
+])
+const DATADOG_TEST_OPTIMIZATION_NODE_OPTION_FLAGS = new Set(['--import', '--require', '-r'])
+const VITEST_NO_WORKER_INIT_ACTIVE_ENV = 'DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE'
+const VITEST_NO_WORKER_INIT_REQUEST_ENV = 'DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT'
+const VITEST_NO_WORKER_INIT_MINIMUM_VERSION = '3.2.6'
+const VITEST_DEFAULT_POOL = 'forks'
+const VITEST_NO_WORKER_INIT_SETUP_FILE = path.join(
+  __dirname,
+  '..',
+  '..',
+  '..',
+  'ci',
+  'vitest-no-worker-init-setup.mjs'
+)
+const VITEST_NO_WORKER_INIT_ISOLATE_WARNING =
+  `${VITEST_NO_WORKER_INIT_REQUEST_ENV} is ignored because Vitest isolate is disabled. ` +
+  'The lighter Vitest worker path only works when each test file runs in an isolated worker.'
+const NODE_OPTIONS_QUOTE_RE = /[\s"\\]/
+let hasWarnedDisabledIsolate = false
+let hasWarnedUnsupportedVersion = false
+let nodeOptionsBeforeNoWorkerInit
+
+function noop () {}
+
+function isRequested () {
+  return getValueFromEnvSources(VITEST_NO_WORKER_INIT_REQUEST_ENV) === true
+}
+
+function shouldUse (ctx, frameworkVersion, testSpecifications, options) {
+  if (!isRequested()) return false
+  if (!isSupportedVersion(frameworkVersion)) {
+    warnUnsupportedVersion(frameworkVersion)
+    return false
+  }
+
+  const config = ctx?.config
+  if (!config) return false
+
+  const { isVitestWorkerPool } = options
+  if (Array.isArray(testSpecifications)) {
+    return shouldUseForTestSpecifications(config, testSpecifications, isVitestWorkerPool)
+  }
+
+  const pool = getEffectiveConfigPool(config)
+  if (!isNoWorkerInitPool(pool, isVitestWorkerPool)) return false
+  if (getEffectiveConfigIsolate(config, pool) === false) {
+    warnDisabledIsolate()
+    return false
+  }
+
+  return true
+}
+
+function isSupportedVersion (frameworkVersion) {
+  return !!frameworkVersion && satisfies(frameworkVersion, `>=${VITEST_NO_WORKER_INIT_MINIMUM_VERSION}`)
+}
+
+function warnUnsupportedVersion (frameworkVersion) {
+  if (hasWarnedUnsupportedVersion) return
+
+  hasWarnedUnsupportedVersion = true
+  log.warn(
+    '%s is only supported for vitest >=%s. Falling back to normal Vitest worker instrumentation for vitest %s.',
+    VITEST_NO_WORKER_INIT_REQUEST_ENV,
+    VITEST_NO_WORKER_INIT_MINIMUM_VERSION,
+    frameworkVersion || 'unknown'
+  )
+}
+
+function warnDisabledIsolate () {
+  if (hasWarnedDisabledIsolate) return
+
+  hasWarnedDisabledIsolate = true
+  log.warn(VITEST_NO_WORKER_INIT_ISOLATE_WARNING)
+}
+
+function shouldUseForTestSpecifications (config, testSpecifications, isVitestWorkerPool) {
+  const defaultPool = getEffectiveConfigPool(config)
+  let hasNoWorkerInitSpecification = false
+  let hasNonWorkerSpecification = false
+
+  for (const testSpecification of testSpecifications) {
+    const pool = getEffectiveTestSpecificationPool(testSpecification, defaultPool)
+    if (!isNoWorkerInitPool(pool, isVitestWorkerPool)) {
+      hasNonWorkerSpecification = true
+      continue
+    }
+
+    const defaultIsolate = getEffectiveConfigIsolate(config, pool)
+    if (getEffectiveTestSpecificationIsolate(testSpecification, pool, defaultIsolate) === false) {
+      warnDisabledIsolate()
+      return false
+    }
+
+    hasNoWorkerInitSpecification = true
+  }
+
+  return hasNoWorkerInitSpecification && !hasNonWorkerSpecification
+}
+
+function isNoWorkerInitPool (pool, isVitestWorkerPool) {
+  return pool === undefined || isVitestWorkerPool(pool)
+}
+
+function configure (ctx, frameworkVersion, testSpecifications, setupData, options) {
+  const { getConfiguredEfdRetryCount, state } = options
+  addSetupFileToVitestConfigs(ctx, VITEST_NO_WORKER_INIT_SETUP_FILE, testSpecifications)
+
+  const {
+    knownTestsBySuite,
+    modifiedFiles,
+    repositoryRoot,
+    testManagementTestsBySuite,
+    testSessionConfiguration,
+  } = setupData
+
+  setProvidedContext(ctx, {
+    _ddVitestWorkerSetup: {
+      attemptToFixRetries: state.testManagementAttemptToFixRetries,
+      attemptToFixTests: getSelectedTestManagementTests(testManagementTestsBySuite, 'isAttemptToFix'),
+      disabledTests: getSelectedTestManagementTests(testManagementTestsBySuite, 'isDisabled'),
+      earlyFlakeDetectionRetries: getConfiguredEfdRetryCount(
+        state.earlyFlakeDetectionSlowTestRetries,
+        state.earlyFlakeDetectionNumRetries
+      ),
+      earlyFlakeDetectionRetryThresholds: EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS,
+      earlyFlakeDetectionSlowRetries: state.earlyFlakeDetectionSlowTestRetries,
+      isEarlyFlakeDetectionEnabled: state.isEarlyFlakeDetectionEnabled && !state.isEarlyFlakeDetectionFaulty,
+      knownTests: knownTestsBySuite || {},
+      modifiedFiles: modifiedFiles || {},
+      quarantinedTests: getSelectedTestManagementTests(testManagementTestsBySuite, 'isQuarantined'),
+      repositoryRoot: repositoryRoot || process.cwd(),
+    },
+  }, 'Could not send Vitest worker setup context, so no-worker execution changes will not work.')
+
+  installMainProcessReporter(ctx, frameworkVersion, testSessionConfiguration || {}, setupData, state)
+}
+
+function deactivate (ctx) {
+  const installedReporterState = mainProcessReporterStates.get(ctx)
+  if (installedReporterState) {
+    installedReporterState.isActive = false
+  }
+}
+
+function configureWorkerEnv (workerEnv, shouldSkipWorkerInit = false) {
+  if (!shouldSkipWorkerInit) {
+    delete workerEnv[VITEST_NO_WORKER_INIT_ACTIVE_ENV]
+    restoreDatadogTestOptimizationNodeOptions(workerEnv)
+    return workerEnv
+  }
+
+  workerEnv[VITEST_NO_WORKER_INIT_ACTIVE_ENV] = '1'
+  rememberDatadogTestOptimizationNodeOptions(workerEnv.NODE_OPTIONS)
+
+  const nodeOptions = removeDatadogTestOptimizationNodeOptions(workerEnv.NODE_OPTIONS)
+  if (nodeOptions) {
+    workerEnv.NODE_OPTIONS = nodeOptions
+  } else {
+    delete workerEnv.NODE_OPTIONS
+  }
+  return workerEnv
+}
+
+function rememberDatadogTestOptimizationNodeOptions (nodeOptions) {
+  if (hasDatadogTestOptimizationNodeOptions(nodeOptions)) {
+    nodeOptionsBeforeNoWorkerInit = nodeOptions
+  }
+}
+
+function restoreDatadogTestOptimizationNodeOptions (workerEnv) {
+  if (!nodeOptionsBeforeNoWorkerInit || hasDatadogTestOptimizationNodeOptions(workerEnv.NODE_OPTIONS)) return
+
+  const strippedNodeOptions = removeDatadogTestOptimizationNodeOptions(nodeOptionsBeforeNoWorkerInit)
+  if (workerEnv.NODE_OPTIONS === strippedNodeOptions || (!workerEnv.NODE_OPTIONS && !strippedNodeOptions)) {
+    workerEnv.NODE_OPTIONS = nodeOptionsBeforeNoWorkerInit
+  }
+}
+
+function addSetupFileToVitestConfigs (ctx, setupFile, testSpecifications) {
+  const configs = getNoWorkerInitVitestConfigs(ctx, testSpecifications)
+
+  for (const config of configs) {
+    if (!config) continue
+
+    if (config.setupFiles === undefined) {
+      config.setupFiles = []
+    } else if (typeof config.setupFiles === 'string') {
+      config.setupFiles = [config.setupFiles]
+    }
+
+    if (!config.setupFiles.includes(setupFile)) {
+      config.setupFiles.push(setupFile)
+    }
+  }
+}
+
+function getNoWorkerInitVitestConfigs (ctx, testSpecifications) {
+  const configs = new Set()
+  if (Array.isArray(testSpecifications)) {
+    let shouldAddRootConfig = false
+    for (const testSpecification of testSpecifications) {
+      const project = getTestSpecificationProject(testSpecification)
+      const config = safeConfig(project)
+      if (config) {
+        addNoWorkerInitConfig(configs, config)
+      } else {
+        shouldAddRootConfig = true
+      }
+    }
+
+    if (!shouldAddRootConfig && configs.size > 0) {
+      return configs
+    }
+  }
+
+  addNoWorkerInitConfig(configs, safeConfig(ctx))
+  addNoWorkerInitConfig(configs, safeConfig(safeWorkspaceProject(ctx)))
+  return configs
+}
+
+function addNoWorkerInitConfig (configs, config) {
+  if (config) configs.add(config)
+}
+
+function getSelectedTestManagementTests (testManagementTestsBySuite, propertyName) {
+  if (!testManagementTestsBySuite) return {}
+
+  const selectedTests = {}
+  for (const [testSuite, tests] of Object.entries(testManagementTestsBySuite)) {
+    for (const [testName, properties] of Object.entries(tests)) {
+      if (properties?.[propertyName]) {
+        selectedTests[testSuite] ||= {}
+        selectedTests[testSuite][testName] = true
+      }
+    }
+  }
+  return selectedTests
+}
+
+function installMainProcessReporter (ctx, frameworkVersion, testSessionConfiguration, testOptimizationData, state) {
+  if (!ctx?.reporters) return
+
+  const reporterState = {
+    frameworkVersion,
+    isActive: true,
+    state,
+    testSessionConfiguration,
+    testOptimizationData,
+  }
+  const installedReporterState = mainProcessReporterStates.get(ctx)
+  if (installedReporterState) {
+    Object.assign(installedReporterState, reporterState)
+    return
+  }
+
+  mainProcessReporterStates.set(ctx, reporterState)
+  ctx.reporters.push(createMainProcessReporter(reporterState))
+}
+
+function createMainProcessReporter (reporterState) {
+  const testSuiteContexts = new Map()
+  const finishedTestModules = new Set()
+  const taskAttemptStatuses = new Map()
+  const tasksWithRecordedFinalAttempt = new Set()
+
+  return {
+    onTestModuleStart (testModule) {
+      if (!isActive()) return
+
+      startTestSuite(testModule)
+    },
+
+    onTestModuleEnd (testModule) {
+      if (!isActive()) return
+
+      return reportTestModule(testModule)
+    },
+
+    onTestCaseResult (testCase) {
+      if (!isActive()) return
+
+      const task = getTestCaseTask(testCase)
+      recordFinalTaskAttemptResult(task)
+    },
+
+    onTaskUpdate (packs, events) {
+      if (!isActive()) return
+      if (!events) return
+
+      for (const event of events) {
+        if (event[1] === 'test-retried') {
+          recordTaskAttemptStatus(event[0], 'fail', getTaskUpdateAttemptCount(event[0], packs))
+        }
+      }
+    },
+
+    onFinished (files) {
+      if (!isActive()) return
+      if (!files) return
+
+      for (const file of files) {
+        const testModule = createTestModuleFromFile(file)
+        if (!finishedTestModules.has(file.id)) {
+          reportTestModule(testModule)
+        }
+      }
+    },
+  }
+
+  function isActive () {
+    return reporterState.isActive === true
+  }
+
+  function recordTaskAttemptStatus (taskId, status, attemptCount) {
+    let statuses = taskAttemptStatuses.get(taskId)
+    if (!statuses) {
+      statuses = []
+      taskAttemptStatuses.set(taskId, statuses)
+    }
+    if (attemptCount !== undefined && statuses.length >= attemptCount) return
+
+    if (tasksWithRecordedFinalAttempt.has(taskId)) {
+      statuses.splice(-1, 0, status)
+      return
+    }
+    statuses.push(status)
+  }
+
+  function recordFinalTaskAttemptResult (task) {
+    const statuses = taskAttemptStatuses.get(task.id)
+    if (!statuses) return
+
+    const attemptCount = getRepeatedAttemptCount(task, statuses)
+    if (statuses.length < attemptCount) {
+      statuses.push(getFinalRepeatedTaskStatus(task))
+      tasksWithRecordedFinalAttempt.add(task.id)
+    }
+  }
+
+  function reportTestModule (testModule) {
+    const testModuleId = getTestModuleId(testModule)
+    const testModuleTask = getTestModuleTask(testModule)
+    finishedTestModules.add(testModuleId)
+    const testSuiteCtx = testSuiteContexts.get(testModuleId) || startTestSuite(testModule)
+    const testTasks = getTypeTasks(testModuleTask.tasks)
+    const testReports = []
+    let testSuiteError
+
+    for (const task of testTasks) {
+      const testReport = getTestReport(task, testSuiteCtx.currentStore)
+      testReports.push(testReport)
+
+      for (const attempt of testReport.nonFinalAttempts) {
+        reportTestAttempt(testReport, attempt)
+      }
+    }
+
+    for (const testReport of testReports) {
+      const error = reportFinalTestAttempt(testReport)
+      testSuiteError ||= error
+    }
+
+    const suiteTaskError = getSuiteTaskError(testModuleTask)
+    recomputeTaskState(testModuleTask)
+    const testSuiteResult = testModuleTask.result
+    if (testSuiteResult?.errors?.length) {
+      testSuiteError = testSuiteResult.errors[0]
+    } else if (suiteTaskError) {
+      testSuiteError = suiteTaskError
+    }
+
+    if (testSuiteError) {
+      testSuiteCtx.error = testSuiteError
+      testSuiteErrorCh.runStores(testSuiteCtx, () => {})
+    }
+
+    testSuiteFinishCh.publish({
+      status: getDatadogStatus(testSuiteResult),
+      deferFlush: true,
+      onFinish: noop,
+      ...testSuiteCtx.currentStore,
+    })
+    testSuiteContexts.delete(testModuleId)
+  }
+
+  function startTestSuite (testModule) {
+    const { frameworkVersion, testSessionConfiguration } = reporterState
+    const testModuleId = getTestModuleId(testModule)
+    const testSuiteCtx = {
+      testSuiteAbsolutePath: getTestModuleFilepath(testModule),
+      frameworkVersion,
+      testSessionId: testSessionConfiguration.testSessionId,
+      testModuleId: testSessionConfiguration.testModuleId,
+      testCommand: testSessionConfiguration.testCommand,
+      repositoryRoot: testSessionConfiguration.repositoryRoot,
+      codeOwnersEntries: testSessionConfiguration.codeOwnersEntries,
+      isTestFrameworkWorker: true,
+      isVitestNoWorkerInitActive: true,
+    }
+    testSuiteStartCh.runStores(testSuiteCtx, () => {})
+    testSuiteContexts.set(testModuleId, testSuiteCtx)
+    return testSuiteCtx
+  }
+
+  function getTestReport (task, testSuiteStore) {
+    const result = task.result
+    const testSuiteAbsolutePath = task.file?.filepath
+    const testName = getTestName(task)
+    const testProperties = getMainProcessTestProperties(task, testSuiteAbsolutePath, testName)
+    const { state } = reporterState
+    let status = getDatadogStatus(result)
+
+    if (task.meta?.__ddTestOptQuarantinedFailed && testProperties.isQuarantined && !testProperties.isAttemptToFix) {
+      status = 'fail'
+    }
+
+    if (testProperties.isAttemptToFix && task.meta?.__ddTestOptAtfStatuses?.length) {
+      return getRepeatedTestReport(task, testName, testSuiteAbsolutePath, testProperties, status, {
+        errorCounts: task.meta.__ddTestOptAtfErrorCounts,
+        finalStatus: getAttemptToFixFinalStatus,
+        state,
+        statuses: task.meta.__ddTestOptAtfStatuses,
+        testSuiteStore,
+        type: 'attempt_to_fix',
+      })
+    }
+
+    if (testProperties.isEarlyFlakeDetection && task.meta?.__ddTestOptEfdStatuses?.length) {
+      return getRepeatedTestReport(task, testName, testSuiteAbsolutePath, testProperties, status, {
+        errorCounts: task.meta.__ddTestOptEfdErrorCounts,
+        finalStatus: getEarlyFlakeDetectionFinalStatus,
+        state,
+        statuses: task.meta.__ddTestOptEfdStatuses,
+        testSuiteStore,
+        type: 'early_flake_detection',
+      })
+    }
+
+    if (!testProperties.isAttemptToFix && task.meta?.__ddTestOptRepeatStatuses?.length) {
+      return getRepeatedTestReport(task, testName, testSuiteAbsolutePath, testProperties, status, {
+        errorCounts: task.meta.__ddTestOptRepeatErrorCounts,
+        finalStatus: () => status,
+        state,
+        statuses: task.meta.__ddTestOptRepeatStatuses,
+        testSuiteStore,
+        type: 'external',
+      })
+    }
+
+    const attemptStatuses = taskAttemptStatuses.get(task.id)
+    if (!testProperties.isAttemptToFix && !testProperties.isEarlyFlakeDetection && attemptStatuses?.length > 1) {
+      return getRepeatedTestReport(task, testName, testSuiteAbsolutePath, testProperties, status, {
+        finalStatus: () => status,
+        state,
+        statuses: attemptStatuses,
+        testSuiteStore,
+        type: 'external',
+      })
+    }
+
+    if (!testProperties.isAttemptToFix && task.result?.repeatCount > 0) {
+      return getRepeatedTestReport(task, testName, testSuiteAbsolutePath, testProperties, status, {
+        finalStatus: () => status,
+        state,
+        statuses: getRepeatedTaskStatuses(task, status),
+        testSuiteStore,
+        type: 'external',
+      })
+    }
+
+    if (testProperties.isAttemptToFix) {
+      logAttemptToFixTestExecution(testProperties.testSuite, testName, loggedAttemptToFixTests)
+    }
+
+    if (testProperties.isDisabled && !testProperties.isAttemptToFix) {
+      status = 'skip'
+      if (result) result.state = 'skip'
+    } else if (testProperties.isQuarantined && status === 'fail' && !testProperties.isAttemptToFix) {
+      result.state = 'pass'
+    }
+
+    const errors = result?.errors || []
+    const finalErrorIndex = status === 'fail' ? errors.length - 1 : -1
+    const nonFinalAttempts = []
+
+    if (status !== 'skip') {
+      for (let index = 0; index < errors.length; index++) {
+        if (index === finalErrorIndex) continue
+        nonFinalAttempts.push({
+          error: errors[index],
+          isRetry: index > 0,
+          status: 'fail',
+        })
+      }
+    }
+
+    return {
+      errors,
+      nonFinalAttempts,
+      state,
+      status,
+      task,
+      testName,
+      testProperties,
+      testSuiteAbsolutePath,
+      testSuiteStore,
+    }
+  }
+
+  function getMainProcessTestProperties (task, testSuiteAbsolutePath, testName) {
+    const { state, testOptimizationData, testSessionConfiguration } = reporterState
+    const testProperties = testOptimizationData.testPropertiesByFilepath?.[testSuiteAbsolutePath]
+    const testSuite = testProperties?.testSuite || getTestSuitePath(
+      testSuiteAbsolutePath,
+      testSessionConfiguration.repositoryRoot || process.cwd()
+    )
+    const knownTests = testProperties?.knownTests
+    const testManagementProperties = testProperties?.testManagementTests?.[testName] || {}
+    const isAttemptToFix = testManagementProperties.isAttemptToFix
+    const isNew = !!(
+      !isAttemptToFix &&
+      state.isKnownTestsEnabled &&
+      knownTests &&
+      !state.isEarlyFlakeDetectionFaulty &&
+      !knownTests.includes(testName)
+    )
+    const isModified = testProperties?.isModified === true
+    const { flakyTestRetriesConfiguration } = testOptimizationData
+    const isFlakyTestRetries = !!flakyTestRetriesConfiguration && isFlakyTestRetriesEnabledForTask({
+      isFlakyTestRetriesEnabled: state.isFlakyTestRetriesEnabled,
+      flakyTestRetriesIncludesUnnamedProject: flakyTestRetriesConfiguration.includesUnnamedProject,
+      flakyTestRetriesProjectNames: flakyTestRetriesConfiguration.projectNames,
+    }, task)
+
+    return {
+      isAttemptToFix,
+      isDisabled: testManagementProperties.isDisabled,
+      isEarlyFlakeDetection: (isNew || isModified) && state.isEarlyFlakeDetectionEnabled,
+      isFlakyTestRetries,
+      isQuarantined: testManagementProperties.isQuarantined,
+      isModified,
+      isNew,
+      testSuite,
+      hasDynamicName: isNew && DYNAMIC_NAME_RE.test(testName),
+    }
+  }
+}
+
+function getTaskUpdateAttemptCount (taskId, packs) {
+  if (!packs) return
+
+  for (const pack of packs) {
+    if (pack[0] === taskId) {
+      return getRepeatedAttemptCount({
+        id: taskId,
+        result: pack[1],
+        meta: pack[2],
+      }, [])
+    }
+  }
+}
+
+function createTestModuleFromFile (file) {
+  return {
+    id: file.id,
+    moduleId: file.filepath,
+    project: file.project,
+    projectName: file.projectName,
+    task: file,
+  }
+}
+
+function getTestModuleId (testModule) {
+  return testModule.id || getTestModuleFilepath(testModule)
+}
+
+function getTestModuleTask (testModule) {
+  if (testModule.task?.tasks) {
+    return testModule.task
+  }
+
+  const task = createTaskFromReportedTask(testModule)
+  task.file = task
+  return task
+}
+
+function getTestCaseTask (testCase) {
+  if (testCase.task) {
+    return testCase.task
+  }
+
+  return createTaskFromReportedTask(testCase, {
+    filepath: getTestModuleFilepath(testCase.module),
+    projectName: getTestModuleProjectName(testCase.module),
+  })
+}
+
+function createTaskFromReportedTask (reportedTask, file, suite) {
+  const task = {
+    id: reportedTask.id,
+    type: reportedTask.type,
+    name: reportedTask.name || reportedTask.relativeModuleId || reportedTask.moduleId,
+    mode: reportedTask.options?.mode,
+    meta: getReportedTaskMeta(reportedTask),
+    result: getReportedTaskResult(reportedTask),
+    file,
+    suite,
+  }
+
+  if (reportedTask.type === 'module') {
+    task.filepath = reportedTask.moduleId
+    task.projectName = getTestModuleProjectName(reportedTask)
+  }
+
+  const children = getReportedTaskChildren(reportedTask)
+  if (children) {
+    task.tasks = []
+    const taskFile = file || task
+    const childSuite = task.type === 'suite' ? task : undefined
+    for (const child of children) {
+      task.tasks.push(createTaskFromReportedTask(child, taskFile, childSuite))
+    }
+  }
+
+  return task
+}
+
+function getReportedTaskChildren (reportedTask) {
+  const children = reportedTask.children
+  if (!children) return
+
+  if (typeof children.array === 'function') {
+    return children.array()
+  }
+
+  if (Array.isArray(children)) {
+    return children
+  }
+
+  return [...children]
+}
+
+function getReportedTaskMeta (reportedTask) {
+  if (typeof reportedTask.meta === 'function') {
+    return reportedTask.meta()
+  }
+
+  return reportedTask.meta || {}
+}
+
+function getReportedTaskResult (reportedTask) {
+  let result
+  if (typeof reportedTask.result === 'function') {
+    result = reportedTask.result()
+  } else if (typeof reportedTask.state === 'function') {
+    result = {
+      errors: typeof reportedTask.errors === 'function' ? reportedTask.errors() : undefined,
+      state: reportedTask.state(),
+    }
+  } else {
+    result = reportedTask.result
+  }
+
+  const diagnostic = typeof reportedTask.diagnostic === 'function'
+    ? reportedTask.diagnostic()
+    : undefined
+
+  return {
+    duration: diagnostic?.duration,
+    errors: result?.errors,
+    note: result?.note,
+    repeatCount: diagnostic?.repeatCount,
+    retryCount: diagnostic?.retryCount,
+    state: result?.state,
+  }
+}
+
+function getTestModuleFilepath (testModule) {
+  return testModule.moduleId || testModule.task?.filepath || testModule.filepath
+}
+
+function getTestModuleProjectName (testModule) {
+  return normalizeProjectName(
+    testModule.projectName || getProjectName(testModule.project) || testModule.task?.projectName ||
+      testModule.task?.file?.projectName
+  )
+}
+
+function getRepeatedTestReport (task, testName, testSuiteAbsolutePath, testProperties, status, options) {
+  const result = task.result
+  const errors = result?.errors || []
+  const { errorCounts, finalStatus, state, statuses, testSuiteStore, type } = options
+  const finalAttemptStatus = finalStatus(statuses)
+  const hasFailure = finalAttemptStatus === 'fail'
+  const attempts = []
+  const attemptCount = getRepeatedAttemptCount(task, statuses)
+  let errorIndex = 0
+  let previousErrorCount = 0
+
+  if (type === 'attempt_to_fix') {
+    logAttemptToFixTestExecution(testProperties.testSuite, testName, loggedAttemptToFixTests)
+  }
+
+  for (let index = 0; index < attemptCount; index++) {
+    const isFinalAttempt = index === attemptCount - 1
+    const attemptStatus = statuses[index] || 'pass'
+    const nextErrorCount = errorCounts?.[index]
+    const error = attemptStatus === 'fail'
+      ? errors[nextErrorCount === undefined ? errorIndex : previousErrorCount] || errors[errorIndex] || errors[0]
+      : undefined
+    if (nextErrorCount !== undefined) {
+      previousErrorCount = nextErrorCount
+    } else if (attemptStatus === 'fail') {
+      errorIndex++
+    }
+    const attempt = {
+      attemptToFixFailed: type === 'attempt_to_fix' && isFinalAttempt && hasFailure,
+      earlyFlakeAbortReason: type === 'early_flake_detection' && isFinalAttempt
+        ? task.meta?.__ddTestOptEfdAbortReason
+        : undefined,
+      error,
+      finalStatus: isFinalAttempt ? finalAttemptStatus : undefined,
+      hasFailedAllRetries: hasFailedAllManagedRetries(
+        task,
+        testProperties,
+        type,
+        statuses,
+        isFinalAttempt,
+        hasFailure
+      ),
+      isRetry: index > 0,
+      status: attemptStatus,
+    }
+    if (type === 'attempt_to_fix') {
+      attempt.attemptToFixPassed = isFinalAttempt && !hasFailure
+    } else if (type === 'early_flake_detection') {
+      attempt.isRetryReasonEfd = index > 0
+    }
+    attempts.push(attempt)
+  }
+
+  return {
+    errors,
+    finalAttempt: attempts[attempts.length - 1],
+    nonFinalAttempts: attempts.slice(0, -1),
+    state,
+    status,
+    task,
+    testName,
+    testProperties,
+    testSuiteAbsolutePath,
+    testSuiteStore,
+  }
+}
+
+/**
+ * Returns whether a final failed attempt exhausted Datadog-managed retries.
+ *
+ * @param {{
+ *   meta?: { __ddTestOptEfdRetries?: number },
+ *   repeats?: number,
+ *   result?: { retryCount?: number }
+ * }} task
+ * @param {{ isFlakyTestRetries?: boolean }} testProperties
+ * @param {'attempt_to_fix'|'early_flake_detection'|'external'} type
+ * @param {string[]} statuses
+ * @param {boolean} isFinalAttempt
+ * @param {boolean} hasFailure
+ * @returns {boolean}
+ */
+function hasFailedAllManagedRetries (task, testProperties, type, statuses, isFinalAttempt, hasFailure) {
+  if (!isFinalAttempt || !hasFailure || statuses.length === 0 || !statuses.every(status => status === 'fail')) {
+    return false
+  }
+
+  if (type === 'attempt_to_fix') {
+    return true
+  }
+
+  if (type === 'early_flake_detection') {
+    return (task.meta?.__ddTestOptEfdRetries || 0) > 0
+  }
+
+  return testProperties.isFlakyTestRetries === true && (task.result?.retryCount || 0) > 0
+}
+
+function getRepeatedAttemptCount (task, statuses) {
+  const retries = task.meta?.__ddTestOptAtfRetries ?? task.meta?.__ddTestOptEfdRetries ??
+    Math.max(task.result?.retryCount || 0, task.repeats || 0)
+  return Math.max(statuses.length, retries + 1)
+}
+
+function getAttemptToFixFinalStatus (statuses) {
+  return statuses.includes('fail') ? 'fail' : 'pass'
+}
+
+function getEarlyFlakeDetectionFinalStatus (statuses) {
+  return statuses.includes('pass') ? 'pass' : 'fail'
+}
+
+function getRepeatedTaskStatuses (task, status) {
+  const repeatedStatuses = []
+  const repeatCount = task.result?.repeatCount || 0
+  for (let index = 0; index <= repeatCount; index++) {
+    repeatedStatuses.push(status)
+  }
+  return repeatedStatuses
+}
+
+function reportFinalTestAttempt (testReport) {
+  const {
+    errors,
+    status,
+    task,
+    testName,
+    testProperties,
+    testSuiteAbsolutePath,
+    testSuiteStore,
+  } = testReport
+
+  if (status === 'skip') {
+    testSkipCh.publish({
+      testName,
+      testSuiteAbsolutePath,
+      isNew: testProperties.isNew,
+      isDisabled: testProperties.isDisabled,
+      isTestFrameworkWorker: true,
+      ...testSuiteStore,
+    })
+    return
+  }
+
+  const result = task.result
+  const finalStatus = getFinalTestStatus(testReport)
+  const finalAttempt = testReport.finalAttempt
+
+  if (status === 'fail') {
+    const error = errors[errors.length - 1] || errors[0]
+    reportTestAttempt(testReport, finalAttempt || {
+      error,
+      finalStatus,
+      hasFailedAllRetries: hasFailedAllManagedRetries(
+        task,
+        testProperties,
+        'external',
+        ['fail'],
+        true,
+        true
+      ),
+      isRetry: errors.length > 1 || (result?.retryCount || 0) > 0 || (result?.repeatCount || 0) > 0,
+      status: 'fail',
+    })
+    return finalStatus === 'skip' ? undefined : error
+  }
+
+  reportTestAttempt(testReport, finalAttempt || {
+    finalStatus,
+    isRetry: errors.length > 0 || (result?.retryCount || 0) > 0 || (result?.repeatCount || 0) > 0,
+    status: 'pass',
+  })
+}
+
+function reportTestAttempt (testReport, attempt) {
+  const {
+    state,
+    task,
+    testName,
+    testProperties,
+    testSuiteAbsolutePath,
+    testSuiteStore,
+  } = testReport
+  const result = task.result
+  const status = attempt.status
+  const testCtx = {
+    currentStore: testSuiteStore,
+    testName,
+    testSuiteAbsolutePath,
+    isRetry: attempt.isRetry,
+    isNew: testProperties.isNew,
+    hasDynamicName: testProperties.hasDynamicName,
+    isAttemptToFix: testProperties.isAttemptToFix,
+    isDisabled: testProperties.isDisabled,
+    isQuarantined: testProperties.isQuarantined,
+    isModified: testProperties.isModified,
+    isRetryReasonEfd: attempt.isRetryReasonEfd,
+    isRetryReasonAttemptToFix: testProperties.isAttemptToFix && attempt.isRetry,
+    isRetryReasonAtr: !testProperties.isAttemptToFix && !testProperties.isEarlyFlakeDetection &&
+      testProperties.isFlakyTestRetries,
+    isTestFrameworkWorker: true,
+  }
+  if (testProperties.isAttemptToFix) {
+    recordAttemptToFixExecution(state.attemptToFixExecutions, {
+      testSuite: testProperties.testSuite,
+      testName,
+      status,
+      isDisabled: testProperties.isDisabled,
+      isQuarantined: testProperties.isQuarantined,
+    })
+  }
+  if (testProperties.hasDynamicName) {
+    state.newTestsWithDynamicNames.add(`${testProperties.testSuite} › ${testName}`)
+  }
+  if (attempt.attemptToFixPassed) {
+    testCtx.attemptToFixPassed = true
+  } else if (attempt.attemptToFixFailed) {
+    testCtx.attemptToFixFailed = true
+  }
+  testStartCh.runStores(testCtx, () => {})
+  testCtx.status = status
+  testCtx.task = task
+  if (
+    status === 'pass' &&
+    !attempt.isRetry &&
+    isFinalTestAttempt(testReport, attempt) &&
+    result?.duration !== undefined
+  ) {
+    testCtx.duration = result.duration
+  }
+  testFinishTimeCh.runStores(testCtx, () => {})
+
+  if (status === 'pass') {
+    testPassCh.publish({
+      task,
+      earlyFlakeAbortReason: attempt.earlyFlakeAbortReason,
+      finalStatus: attempt.finalStatus,
+      ...testCtx.currentStore,
+    })
+    return
+  }
+
+  testErrorCh.publish({
+    duration: shouldUseTaskDurationForFailure(testReport, attempt) ? result?.duration : undefined,
+    error: attempt.error,
+    earlyFlakeAbortReason: attempt.earlyFlakeAbortReason,
+    finalStatus: attempt.finalStatus,
+    hasFailedAllRetries: attempt.hasFailedAllRetries,
+    attemptToFixFailed: attempt.attemptToFixFailed,
+    ...testCtx.currentStore,
+  })
+}
+
+function isFinalTestAttempt (testReport, attempt) {
+  return attempt.finalStatus !== undefined || testReport.finalAttempt === undefined
+}
+
+function shouldUseTaskDurationForFailure (testReport, attempt) {
+  return !attempt.isRetry && attempt.finalStatus !== undefined && testReport.finalAttempt === undefined
+}
+
+function getFinalTestStatus (testReport) {
+  const testProperties = testReport.testProperties
+  if (testProperties.isAttemptToFix) {
+    return testReport.finalAttempt?.finalStatus
+  }
+  if (testProperties.isDisabled || testProperties.isQuarantined) {
+    return 'skip'
+  }
+  return testReport.status
+}
+
+function getDatadogStatus (result) {
+  const state = result?.state
+  if (state === 'pass' || state === 'passed') return 'pass'
+  if (state === 'fail' || state === 'failed') return 'fail'
+  return 'skip'
+}
+
+function getFinalRepeatedTaskStatus (task) {
+  return task.meta?.__ddTestOptQuarantinedFailed ? 'fail' : getDatadogStatus(task.result)
+}
+
+function getSuiteTaskError (task) {
+  const suiteTasks = getTypeTasks(task.tasks || [], 'suite')
+  for (const suiteTask of suiteTasks) {
+    if (suiteTask.result?.state === 'fail' && suiteTask.result?.errors?.length) {
+      return suiteTask.result.errors[0]
+    }
+  }
+}
+
+function recomputeTaskState (task) {
+  if (!task.tasks) {
+    return getDatadogStatus(task.result)
+  }
+
+  const hasErrors = task.result?.errors?.length > 0
+  let hasFailed = false
+  let hasPassed = false
+
+  for (const child of task.tasks) {
+    const childStatus = recomputeTaskState(child)
+    hasFailed ||= childStatus === 'fail'
+    hasPassed ||= childStatus === 'pass'
+  }
+
+  const status = hasErrors || hasFailed ? 'fail' : hasPassed ? 'pass' : 'skip'
+  task.result ||= {}
+  task.result.state = status
+  return status
+}
+
+function removeDatadogTestOptimizationNodeOptions (nodeOptions) {
+  if (!nodeOptions) return nodeOptions
+
+  const tokens = splitNodeOptions(nodeOptions)
+  const filteredTokens = []
+  for (let index = 0; index < tokens.length; index++) {
+    const token = tokens[index]
+    const valueSeparator = token.indexOf('=')
+    if (valueSeparator !== -1) {
+      const flag = token.slice(0, valueSeparator)
+      const value = token.slice(valueSeparator + 1)
+      if (shouldRemoveNodeOption(flag, value)) {
+        continue
+      }
+    }
+
+    if (token.startsWith('-r') && token.length > 2 && isDatadogTestOptimizationBootstrap(token.slice(2))) {
+      continue
+    }
+
+    if (
+      DATADOG_TEST_OPTIMIZATION_NODE_OPTION_FLAGS.has(token) &&
+      isDatadogTestOptimizationBootstrap(tokens[index + 1])
+    ) {
+      index++
+      continue
+    }
+
+    filteredTokens.push(token)
+  }
+
+  return serializeNodeOptions(filteredTokens)
+}
+
+function hasDatadogTestOptimizationNodeOptions (nodeOptions) {
+  if (!nodeOptions) return false
+
+  const tokens = splitNodeOptions(nodeOptions)
+  for (let index = 0; index < tokens.length; index++) {
+    const token = tokens[index]
+    const valueSeparator = token.indexOf('=')
+    if (valueSeparator !== -1) {
+      const flag = token.slice(0, valueSeparator)
+      const value = token.slice(valueSeparator + 1)
+      if (shouldRemoveNodeOption(flag, value)) {
+        return true
+      }
+    }
+
+    if (token.startsWith('-r') && token.length > 2 && isDatadogTestOptimizationBootstrap(token.slice(2))) {
+      return true
+    }
+
+    if (
+      DATADOG_TEST_OPTIMIZATION_NODE_OPTION_FLAGS.has(token) &&
+      isDatadogTestOptimizationBootstrap(tokens[index + 1])
+    ) {
+      return true
+    }
+  }
+  return false
+}
+
+function shouldRemoveNodeOption (flag, value) {
+  return DATADOG_TEST_OPTIMIZATION_NODE_OPTION_FLAGS.has(flag) &&
+    isDatadogTestOptimizationBootstrap(value)
+}
+
+function isDatadogTestOptimizationBootstrap (value) {
+  if (!value) return false
+
+  const normalizedValue = value.replaceAll('\\', '/')
+  if (DATADOG_TEST_OPTIMIZATION_BOOTSTRAPS.has(normalizedValue)) return true
+
+  for (const bootstrap of DATADOG_TEST_OPTIMIZATION_BOOTSTRAPS) {
+    if (normalizedValue.endsWith(`/node_modules/${bootstrap}`)) return true
+  }
+  return false
+}
+
+function splitNodeOptions (nodeOptions) {
+  const tokens = []
+  let token = ''
+  let quote
+
+  for (let index = 0; index < nodeOptions.length; index++) {
+    const char = nodeOptions[index]
+
+    if (quote) {
+      if (char === '\\' && nodeOptions[index + 1] === quote) {
+        token += quote
+        index++
+        continue
+      }
+
+      if (char === quote) {
+        quote = undefined
+      } else {
+        token += char
+      }
+      continue
+    }
+
+    if (char === '"' || char === "'") {
+      quote = char
+      continue
+    }
+
+    if (char === ' ' || char === '\n' || char === '\t') {
+      if (token) {
+        tokens.push(token)
+        token = ''
+      }
+      continue
+    }
+
+    token += char
+  }
+
+  if (token) {
+    tokens.push(token)
+  }
+  return tokens
+}
+
+function serializeNodeOptions (tokens) {
+  const serializedTokens = []
+  for (const token of tokens) {
+    if (NODE_OPTIONS_QUOTE_RE.test(token)) {
+      serializedTokens.push(JSON.stringify(token))
+    } else {
+      serializedTokens.push(token)
+    }
+  }
+  return serializedTokens.join(' ')
+}
+
+function getTestSpecificationProject (testSpecification) {
+  if (Array.isArray(testSpecification)) {
+    return testSpecification[0]
+  }
+  return testSpecification?.project
+}
+
+function getTestSpecificationFile (testSpecification) {
+  if (Array.isArray(testSpecification)) {
+    return testSpecification[1]
+  }
+  return testSpecification
+}
+
+function getTestSpecificationOptions (testSpecification) {
+  if (Array.isArray(testSpecification)) {
+    return testSpecification[2]
+  }
+  return testSpecification
+}
+
+function getTestSpecificationPool (testSpecification) {
+  const options = getTestSpecificationOptions(testSpecification)
+  const file = getTestSpecificationFile(testSpecification)
+  const project = getTestSpecificationProject(testSpecification)
+  return options?.pool ||
+    file?.pool ||
+    testSpecification?.pool ||
+    project?.config?.pool ||
+    project?.serializedConfig?.pool ||
+    project?.pool
+}
+
+function getEffectiveTestSpecificationPool (testSpecification, defaultPool) {
+  return getTestSpecificationPool(testSpecification) || defaultPool
+}
+
+/**
+ * Resolves Vitest's default worker pool when the user did not configure one.
+ *
+ * @param {{ pool?: string }|undefined} config
+ * @returns {string}
+ */
+function getEffectiveConfigPool (config) {
+  return config?.pool || VITEST_DEFAULT_POOL
+}
+
+function getPoolOptionsIsolate (config, pool) {
+  if (!pool) return
+
+  return config?.poolOptions?.[pool]?.isolate
+}
+
+function getEffectiveConfigIsolate (config, pool) {
+  return getPoolOptionsIsolate(config, pool) ?? config?.isolate
+}
+
+function getTestSpecificationIsolate (testSpecification, pool) {
+  const options = getTestSpecificationOptions(testSpecification)
+  const file = getTestSpecificationFile(testSpecification)
+  const project = getTestSpecificationProject(testSpecification)
+  return getPoolOptionsIsolate(options, pool) ??
+    getPoolOptionsIsolate(file, pool) ??
+    getPoolOptionsIsolate(project?.config, pool) ??
+    getPoolOptionsIsolate(project?.serializedConfig, pool) ??
+    getPoolOptionsIsolate(project, pool) ??
+    getPoolOptionsIsolate(testSpecification, pool) ??
+    options?.isolate ??
+    file?.isolate ??
+    project?.config?.isolate ??
+    project?.serializedConfig?.isolate ??
+    project?.isolate ??
+    testSpecification?.isolate
+}
+
+function getEffectiveTestSpecificationIsolate (testSpecification, pool, defaultIsolate) {
+  const isolate = getTestSpecificationIsolate(testSpecification, pool)
+  return isolate === undefined ? defaultIsolate : isolate
+}
+
+function getProjectName (project) {
+  return normalizeProjectName(project?.name || project?.config?.name || project?.test?.name)
+}
+
+function normalizeProjectName (name) {
+  if (typeof name === 'string') return name
+
+  const label = name?.label
+  return typeof label === 'string' ? label : undefined
+}
+
+function safeConfig (project) {
+  let config
+  try {
+    config = project?.config
+  } catch {}
+  return config
+}
+
+function safeWorkspaceProject (ctx) {
+  let project
+  try {
+    project = getWorkspaceProject(ctx)
+  } catch {}
+  return project
+}
+
+module.exports = {
+  configure,
+  deactivate,
+  configureWorkerEnv,
+  shouldUse,
+}
diff --git a/packages/datadog-instrumentations/src/vitest-main.js b/packages/datadog-instrumentations/src/vitest-main.js
index 491b7d8b9e..588ce66f86 100644
--- a/packages/datadog-instrumentations/src/vitest-main.js
+++ b/packages/datadog-instrumentations/src/vitest-main.js
@@ -17,6 +17,7 @@ const {
   isModifiedTest,
 } = require('../../dd-trace/src/plugins/util/test')
 const { addHook } = require('./helpers/instrument')
+const noWorkerInit = require('./vitest-main-no-worker-init')
 const {
   testStartCh,
   testPassCh,
@@ -64,6 +65,7 @@ let isDiEnabled = false
 let testCodeCoverageLinesTotal
 let coverageRootDir
 let isSessionStarted = false
+let isVitestNoWorkerInitActive = false
 let vitestPool = null
 let isMessagePortWrapped = false
 const tinyPoolClassWrappers = new WeakMap()
@@ -388,16 +390,21 @@ function resetMainProcessProvidedContext (ctx) {
   }, 'Could not reset Test Optimization context for workers.')
 }
 
-async function runMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
+async function runMainProcessSetup (ctx, frameworkVersion, testSpecifications, shouldInstallNoWorkerInit) {
   if (!testSessionFinishCh.hasSubscribers) {
     return
   }
 
   let repositoryRoot = process.cwd()
+  let testSessionConfiguration
   let testFilepaths
   let shouldSendTestProperties = false
+  let testPropertiesByFilepath
+  let knownTests
   let knownTestsBySuite
+  let testManagementTests
   let testManagementTestsBySuite
+  let modifiedFiles
   let impactedTestSuites
   const getCurrentTestFilepaths = async () => {
     if (testFilepaths === undefined) {
@@ -407,7 +414,9 @@ async function runMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
   }
 
   try {
-    const { err, libraryConfig } = await getChannelPromise(libraryConfigurationCh, frameworkVersion)
+    const { err, libraryConfig } = await getChannelPromise(libraryConfigurationCh, frameworkVersion, {
+      isVitestNoWorkerInitActive: shouldInstallNoWorkerInit,
+    })
     if (err) {
       resetLibraryConfig()
     } else {
@@ -420,21 +429,24 @@ async function runMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
   resetMainProcessProvidedContext(ctx)
 
   if (testSessionConfigurationCh.hasSubscribers) {
+    testSessionConfiguration = await getChannelPromise(testSessionConfigurationCh, frameworkVersion)
     const {
       testSessionId,
       testModuleId,
       testCommand,
       repositoryRoot: receivedRepositoryRoot,
       codeOwnersEntries,
-    } = await getChannelPromise(testSessionConfigurationCh, frameworkVersion)
+    } = testSessionConfiguration
     repositoryRoot = receivedRepositoryRoot || repositoryRoot
-    setProvidedContext(ctx, {
-      _ddTestSessionId: testSessionId,
-      _ddTestModuleId: testModuleId,
-      _ddTestCommand: testCommand,
-      _ddRepositoryRoot: repositoryRoot,
-      _ddCodeOwnersEntries: codeOwnersEntries,
-    }, 'Could not send test session configuration to workers.')
+    if (!shouldInstallNoWorkerInit) {
+      setProvidedContext(ctx, {
+        _ddTestSessionId: testSessionId,
+        _ddTestModuleId: testModuleId,
+        _ddTestCommand: testCommand,
+        _ddRepositoryRoot: repositoryRoot,
+        _ddCodeOwnersEntries: codeOwnersEntries,
+      }, 'Could not send test session configuration to workers.')
+    }
   }
 
   const {
@@ -462,7 +474,7 @@ async function runMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
     if (currentKnownTestsResponse.err) {
       isEarlyFlakeDetectionEnabled = false
     } else {
-      const knownTests = currentKnownTestsResponse.knownTests
+      knownTests = currentKnownTestsResponse.knownTests
       const currentTestFilepaths = await getCurrentTestFilepaths()
 
       if (isValidKnownTests(knownTests)) {
@@ -479,13 +491,15 @@ async function runMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
         } else {
           knownTestsBySuite = knownTests.vitest
           shouldSendTestProperties = true
-          setProvidedContext(ctx, {
-            _ddIsKnownTestsEnabled: isKnownTestsEnabled,
-            _ddIsEarlyFlakeDetectionEnabled: isEarlyFlakeDetectionEnabled,
-            _ddEarlyFlakeDetectionNumRetries:
-              getConfiguredEfdRetryCount(earlyFlakeDetectionSlowTestRetries, earlyFlakeDetectionNumRetries),
-            _ddEarlyFlakeDetectionSlowTestRetries: earlyFlakeDetectionSlowTestRetries,
-          }, 'Could not send known tests to workers so Early Flake Detection will not work.')
+          if (!shouldInstallNoWorkerInit) {
+            setProvidedContext(ctx, {
+              _ddIsKnownTestsEnabled: isKnownTestsEnabled,
+              _ddIsEarlyFlakeDetectionEnabled: isEarlyFlakeDetectionEnabled,
+              _ddEarlyFlakeDetectionNumRetries:
+                getConfiguredEfdRetryCount(earlyFlakeDetectionSlowTestRetries, earlyFlakeDetectionNumRetries),
+              _ddEarlyFlakeDetectionSlowTestRetries: earlyFlakeDetectionSlowTestRetries,
+            }, 'Could not send known tests to workers so Early Flake Detection will not work.')
+          }
         }
       } else {
         isEarlyFlakeDetectionFaulty = true
@@ -494,7 +508,7 @@ async function runMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
     }
   }
 
-  if (isDiEnabled) {
+  if (!shouldInstallNoWorkerInit && isDiEnabled) {
     setProvidedContext(ctx, {
       _ddIsDiEnabled: isDiEnabled,
     }, 'Could not send Dynamic Instrumentation configuration to workers.')
@@ -507,50 +521,101 @@ async function runMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
       isTestManagementTestsEnabled = false
       log.error('Could not get test management tests.')
     } else {
+      testManagementTests = receivedTestManagementTests
       testManagementTestsBySuite = getTestManagementTestsBySuite(receivedTestManagementTests)
       shouldSendTestProperties = true
-      setProvidedContext(ctx, {
-        _ddIsTestManagementTestsEnabled: isTestManagementTestsEnabled,
-        _ddTestManagementAttemptToFixRetries: testManagementAttemptToFixRetries,
-      }, 'Could not send test management tests to workers so Test Management will not work.')
+      if (!shouldInstallNoWorkerInit) {
+        setProvidedContext(ctx, {
+          _ddIsTestManagementTestsEnabled: isTestManagementTestsEnabled,
+          _ddTestManagementAttemptToFixRetries: testManagementAttemptToFixRetries,
+        }, 'Could not send test management tests to workers so Test Management will not work.')
+      }
     }
   }
 
   if (isImpactedTestsEnabled) {
-    const { err, modifiedFiles } = await getChannelPromise(modifiedFilesCh)
+    const modifiedFilesResponse = await getChannelPromise(modifiedFilesCh)
+    const { err } = modifiedFilesResponse
     if (err) {
       log.error('Could not get modified tests.')
     } else {
+      modifiedFiles = modifiedFilesResponse.modifiedFiles
       impactedTestSuites = getImpactedTestSuites(modifiedFiles)
       shouldSendTestProperties = true
-      setProvidedContext(ctx, {
-        _ddIsImpactedTestsEnabled: isImpactedTestsEnabled,
-      }, 'Could not send modified tests to workers so Impacted Tests will not work.')
+      if (!shouldInstallNoWorkerInit) {
+        setProvidedContext(ctx, {
+          _ddIsImpactedTestsEnabled: isImpactedTestsEnabled,
+        }, 'Could not send modified tests to workers so Impacted Tests will not work.')
+      }
     }
   }
 
   if (shouldSendTestProperties) {
-    setProvidedContext(ctx, {
-      _ddTestPropertiesByFilepath: getTestPropertiesByFilepath(
-        await getCurrentTestFilepaths(),
-        repositoryRoot,
-        knownTestsBySuite,
-        testManagementTestsBySuite,
-        impactedTestSuites
-      ),
-    }, 'Could not send test properties to workers so some Test Optimization features will not work.')
+    testPropertiesByFilepath = getTestPropertiesByFilepath(
+      await getCurrentTestFilepaths(),
+      repositoryRoot,
+      knownTestsBySuite,
+      testManagementTestsBySuite,
+      impactedTestSuites
+    )
+    if (!shouldInstallNoWorkerInit) {
+      setProvidedContext(ctx, {
+        _ddTestPropertiesByFilepath: testPropertiesByFilepath,
+      }, 'Could not send test properties to workers so some Test Optimization features will not work.')
+    }
+  }
+
+  if (shouldInstallNoWorkerInit) {
+    noWorkerInit.configure(ctx, frameworkVersion, testSpecifications, {
+      knownTests,
+      knownTestsBySuite,
+      modifiedFiles,
+      repositoryRoot,
+      flakyTestRetriesConfiguration,
+      testManagementTests,
+      testManagementTestsBySuite,
+      testPropertiesByFilepath: testPropertiesByFilepath || {},
+      testSessionConfiguration,
+    }, {
+      getConfiguredEfdRetryCount,
+      state: getNoWorkerInitState(),
+    })
   }
 
   wrapCoverageProvider(ctx)
   wrapSessionFinish(ctx)
+  return shouldInstallNoWorkerInit
+}
+
+function getNoWorkerInitState () {
+  return {
+    attemptToFixExecutions,
+    earlyFlakeDetectionNumRetries,
+    earlyFlakeDetectionSlowTestRetries,
+    isEarlyFlakeDetectionEnabled,
+    isEarlyFlakeDetectionFaulty,
+    isFlakyTestRetriesEnabled,
+    isKnownTestsEnabled,
+    newTestsWithDynamicNames,
+    testManagementAttemptToFixRetries,
+  }
 }
 
-function ensureMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
+function ensureMainProcessSetup (ctx, frameworkVersion, testSpecifications, shouldDeactivateOnFallback = false) {
+  const shouldInstallNoWorkerInit = shouldUseNoWorkerInit(ctx, frameworkVersion, testSpecifications)
   const specificationsKey = getTestSpecificationsKey(testSpecifications)
   let setupState = mainProcessSetupStates.get(ctx)
-  if (!setupState || setupState.specificationsKey !== specificationsKey) {
+  if (shouldDeactivateOnFallback && setupState?.shouldInstallNoWorkerInit && !shouldInstallNoWorkerInit) {
+    noWorkerInit.deactivate(ctx)
+  }
+  if (
+    !setupState ||
+    setupState.specificationsKey !== specificationsKey ||
+    setupState.shouldInstallNoWorkerInit !== shouldInstallNoWorkerInit
+  ) {
     setupState = {
-      setupPromise: runMainProcessSetup(ctx, frameworkVersion, testSpecifications),
+      setupPromise: runMainProcessSetup(ctx, frameworkVersion, testSpecifications, shouldInstallNoWorkerInit),
+      shouldInstallNoWorkerInit,
       specificationsKey,
     }
     mainProcessSetupStates.set(ctx, setupState)
@@ -558,6 +623,13 @@ function ensureMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
   return setupState.setupPromise
 }
 
+function shouldUseNoWorkerInit (ctx, frameworkVersion, testSpecifications) {
+  return noWorkerInit.shouldUse(ctx, frameworkVersion, testSpecifications, {
+    hasVitestWorkerPoolTestSpecification,
+    isVitestWorkerPool,
+  })
+}
+
 function configureFlakyTestRetries (ctx, testSpecifications) {
   if (!isFlakyTestRetriesEnabled || flakyTestRetriesCount <= 0) return
 
@@ -735,6 +807,7 @@ function getFinishWrapper (exitOrClose) {
       isEarlyFlakeDetectionFaulty,
       isTestManagementTestsEnabled,
       vitestPool,
+      isVitestNoWorkerInitActive,
       onFinish,
     })
 
@@ -785,9 +858,18 @@ function getTestSpecificationProject (testSpecification) {
   return testSpecification?.project
 }
 
+function getTestSpecificationOptions (testSpecification) {
+  if (Array.isArray(testSpecification)) {
+    return testSpecification[2]
+  }
+  return testSpecification
+}
+
 function getTestSpecificationPool (testSpecification) {
+  const options = getTestSpecificationOptions(testSpecification)
   const project = getTestSpecificationProject(testSpecification)
-  return project?.config?.pool || project?.serializedConfig?.pool || project?.pool || testSpecification?.pool
+  return options?.pool || project?.config?.pool || project?.serializedConfig?.pool || project?.pool ||
+    testSpecification?.pool
 }
 
 function hasVitestWorkerPoolTestSpecification (testSpecifications) {
@@ -804,17 +886,22 @@ function hasVitestWorkerPoolTestSpecification (testSpecifications) {
   return false
 }
 
-function shouldMarkVitestWorkerEnv (pool, testSpecifications) {
-  return isVitestWorkerPool(pool) || hasVitestWorkerPoolTestSpecification(testSpecifications) ||
-    (!testSpecifications && pool === undefined)
+function shouldMarkVitestWorkerEnv (pool, testSpecifications, shouldSkipWorkerInit) {
+  if (!shouldSkipWorkerInit) {
+    return isVitestWorkerPool(pool) || hasVitestWorkerPoolTestSpecification(testSpecifications) ||
+      (!testSpecifications && pool === undefined)
+  }
+
+  return isVitestWorkerPool(pool) || pool === undefined || hasVitestWorkerPoolTestSpecification(testSpecifications)
 }
 
-function markVitestWorkerEnv (ctx, testSpecifications) {
+function markVitestWorkerEnv (ctx, testSpecifications, shouldSkipWorkerInit = false) {
   const config = ctx?.config
-  if (!config || !shouldMarkVitestWorkerEnv(config.pool, testSpecifications)) {
+  isVitestNoWorkerInitActive = shouldSkipWorkerInit
+  if (!config || !shouldMarkVitestWorkerEnv(config.pool, testSpecifications, shouldSkipWorkerInit)) {
     return
   }
-  config.env = getVitestWorkerEnv(config.env)
+  config.env = getVitestWorkerEnv(config.env, shouldSkipWorkerInit)
 }
 
 function wrapVitestRunFiles (Vitest, frameworkVersion) {
@@ -823,14 +910,15 @@ function wrapVitestRunFiles (Vitest, frameworkVersion) {
   }
 
   shimmer.wrap(Vitest.prototype, 'runFiles', runFiles => async function (testSpecifications) {
-    markVitestWorkerEnv(this, testSpecifications)
-    await ensureMainProcessSetup(this, frameworkVersion, testSpecifications)
+    const shouldSkipWorkerInit = await ensureMainProcessSetup(this, frameworkVersion, testSpecifications, true)
+    markVitestWorkerEnv(this, testSpecifications, shouldSkipWorkerInit)
     return runFiles.apply(this, arguments)
   })
 
   if (Vitest.prototype.collectTests) {
-    shimmer.wrap(Vitest.prototype, 'collectTests', collectTests => function () {
-      markVitestWorkerEnv(this)
+    shimmer.wrap(Vitest.prototype, 'collectTests', collectTests => function (testSpecifications) {
+      const shouldSkipWorkerInit = shouldUseNoWorkerInit(this, frameworkVersion, testSpecifications)
+      markVitestWorkerEnv(this, testSpecifications, shouldSkipWorkerInit)
       return collectTests.apply(this, arguments)
     })
   }
@@ -1215,14 +1303,14 @@ function isVitestTinypoolOptions (options) {
 function markVitestTinypoolOptions (options) {
   if (!isVitestTinypoolOptions(options)) return
 
-  options.env = getVitestWorkerEnv(options.env)
+  options.env = getVitestWorkerEnv(options.env, isVitestNoWorkerInitActive)
 }
 
-function getVitestWorkerEnv (env = {}) {
-  return {
+function getVitestWorkerEnv (env = {}, shouldSkipWorkerInit = false) {
+  return noWorkerInit.configureWorkerEnv({
     ...env,
     DD_VITEST_WORKER: '1',
-  }
+  }, shouldSkipWorkerInit)
 }
 
 function wrapTinyPoolRun (TinyPool) {
@@ -1344,7 +1432,7 @@ function getStartVitestWrapper (cliApiPackage, frameworkVersion) {
     // function is async
     shimmer.wrap(forksPoolWorker.value.prototype, 'start', start => function (...args) {
       vitestPool = 'child_process'
-      this.env = getVitestWorkerEnv(this.env)
+      this.env = getVitestWorkerEnv(this.env, isVitestNoWorkerInitActive)
 
       return start.apply(this, args)
     })
@@ -1356,7 +1444,7 @@ function getStartVitestWrapper (cliApiPackage, frameworkVersion) {
     // function is async
     shimmer.wrap(threadsPoolWorker.value.prototype, 'start', start => function (...args) {
       vitestPool = 'worker_threads'
-      this.env = getVitestWorkerEnv(this.env)
+      this.env = getVitestWorkerEnv(this.env, isVitestNoWorkerInitActive)
       return start.apply(this, args)
     })
     shimmer.wrap(threadsPoolWorker.value.prototype, 'on', getWrappedOn)
diff --git a/packages/datadog-instrumentations/src/vitest-util.js b/packages/datadog-instrumentations/src/vitest-util.js
index 379f2faf2e..d061703d8e 100644
--- a/packages/datadog-instrumentations/src/vitest-util.js
+++ b/packages/datadog-instrumentations/src/vitest-util.js
@@ -38,9 +38,9 @@ function findExportByName (pkg, name) {
   }
 }
 
-function getChannelPromise (channelToPublishTo, frameworkVersion) {
+function getChannelPromise (channelToPublishTo, frameworkVersion, payload) {
   return new Promise(resolve => {
-    channelToPublishTo.publish({ onDone: resolve, frameworkVersion })
+    channelToPublishTo.publish({ ...payload, onDone: resolve, frameworkVersion })
   })
 }
 
diff --git a/packages/datadog-instrumentations/src/vitest.js b/packages/datadog-instrumentations/src/vitest.js
index ca32789bf1..157773d3b4 100644
--- a/packages/datadog-instrumentations/src/vitest.js
+++ b/packages/datadog-instrumentations/src/vitest.js
@@ -1,8 +1,16 @@
 'use strict'
 
 const { getEnvironmentVariable } = require('../../dd-trace/src/config/helper')
+const { isTrue } = require('../../dd-trace/src/util')
+
+const VITEST_NO_WORKER_INIT_ACTIVE_ENV = 'DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE'
 
 if (getEnvironmentVariable('DD_VITEST_WORKER') === '1') {
+  // In no-worker-init mode the main process reports Vitest events from reporter hooks.
+  // Loading worker instrumentation here would reintroduce the worker tracer path.
+  // eslint-disable-next-line eslint-rules/eslint-process-env
+  if (isTrue(process.env[VITEST_NO_WORKER_INIT_ACTIVE_ENV])) return
+
   require('./vitest-worker')
 } else {
   require('./vitest-main')
diff --git a/packages/datadog-plugin-vitest/src/index.js b/packages/datadog-plugin-vitest/src/index.js
index b4a5e9943a..1d20d399ef 100644
--- a/packages/datadog-plugin-vitest/src/index.js
+++ b/packages/datadog-plugin-vitest/src/index.js
@@ -30,7 +30,7 @@ const {
   TEST_MANAGEMENT_IS_ATTEMPT_TO_FIX,
   TEST_MANAGEMENT_ATTEMPT_TO_FIX_PASSED,
   TEST_HAS_FAILED_ALL_RETRIES,
-  getLibraryCapabilitiesTags,
+  getLibraryCapabilitiesTags: getDefaultLibraryCapabilitiesTags,
   TEST_RETRY_REASON_TYPES,
   TEST_IS_MODIFIED,
   TEST_HAS_DYNAMIC_NAME,
@@ -293,6 +293,7 @@ class VitestPlugin extends CiPlugin {
         testSuiteAbsolutePath,
         frameworkVersion,
         isTestFrameworkWorker,
+        isVitestNoWorkerInitActive,
       } = ctx
 
       const testCommand = ctx.testCommand || 'vitest run'
@@ -311,13 +312,16 @@ class VitestPlugin extends CiPlugin {
       // test suites run in a different process, so they also need to init the metadata dictionary
       const testSessionName = getTestSessionName(this.config, trimmedCommand, this.testEnvironmentMetadata)
       if (this.tracer._exporter.addMetadataTags) {
+        const libraryCapabilitiesTags = this.getLibraryCapabilitiesTags(frameworkVersion, {
+          isVitestNoWorkerInitActive,
+        })
         this.tracer._exporter.addMetadataTags({
           [TEST_LEVELS_METADATA]: {
             [TEST_COMMAND]: testCommand,
             [TEST_SESSION_NAME]: testSessionName,
             ...getTestLevelsMetadataTags(this.testEnvironmentMetadata),
           },
-          test: getLibraryCapabilitiesTags(this.constructor.id),
+          test: libraryCapabilitiesTags,
         })
       }
 
@@ -401,6 +405,7 @@ class VitestPlugin extends CiPlugin {
       isTestManagementTestsEnabled,
       requestErrorTags,
       vitestPool,
+      isVitestNoWorkerInitActive,
       onFinish,
     }) => {
       for (const [tag, value] of Object.entries(requestErrorTags || {})) {
@@ -433,7 +438,7 @@ class VitestPlugin extends CiPlugin {
       this.telemetry.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'module')
       this.testSessionSpan.finish()
       this.telemetry.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'session', {
-        hasFailedTestReplay: this.libraryConfig?.isDiEnabled || undefined,
+        hasFailedTestReplay: this.libraryConfig?.isDiEnabled && !isVitestNoWorkerInitActive ? true : undefined,
       })
       finishAllTraceSpans(this.testSessionSpan)
       this.telemetry.count(TELEMETRY_TEST_SESSION, {
@@ -448,6 +453,19 @@ class VitestPlugin extends CiPlugin {
     })
   }
 
+  /**
+   * Returns Vitest library capability metadata tags.
+   * @param {string} frameworkVersion - The Vitest version.
+   * @param {object} [ctx] - Diagnostic channel context.
+   * @param {boolean} [ctx.isVitestNoWorkerInitActive] - Whether no-worker init is active for this run.
+   * @returns {Record<string, string|undefined>}
+   */
+  getLibraryCapabilitiesTags (frameworkVersion, ctx = {}) {
+    return getDefaultLibraryCapabilitiesTags(this.constructor.id, frameworkVersion, {
+      omitFailedTestReplay: ctx.isVitestNoWorkerInitActive,
+    })
+  }
+
   /**
    * Handles the coverage report by discovering and uploading it if enabled.
    * @param {string} rootDir - The root directory where coverage reports are located.
diff --git a/packages/dd-trace/src/config/generated-config-types.d.ts b/packages/dd-trace/src/config/generated-config-types.d.ts
index fab4329069..4ec85e2635 100644
--- a/packages/dd-trace/src/config/generated-config-types.d.ts
+++ b/packages/dd-trace/src/config/generated-config-types.d.ts
@@ -79,6 +79,7 @@ export interface GeneratedConfig {
   DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_DIR: string | undefined;
   DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_ENABLED: boolean;
   DD_EXPERIMENTAL_TEST_OPT_SETTINGS_CACHE: string;
+  DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT: boolean | undefined;
   DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE: boolean;
   DD_EXTERNAL_ENV: string | undefined;
   DD_GIT_BRANCH: string | undefined;
@@ -673,6 +674,7 @@ export interface GeneratedEnvVarConfig {
   DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_DIR: string | undefined;
   DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_ENABLED: boolean;
   DD_EXPERIMENTAL_TEST_OPT_SETTINGS_CACHE: string;
+  DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT: boolean | undefined;
   DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE: boolean;
   DD_EXTERNAL_ENV: string | undefined;
   DD_GIT_BRANCH: string | undefined;
diff --git a/packages/dd-trace/src/config/supported-configurations.json b/packages/dd-trace/src/config/supported-configurations.json
index e729af8582..7956b8dcd2 100644
--- a/packages/dd-trace/src/config/supported-configurations.json
+++ b/packages/dd-trace/src/config/supported-configurations.json
@@ -838,6 +838,13 @@
         "default": "false"
       }
     ],
+    "DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT": [
+      {
+        "implementation": "A",
+        "type": "boolean",
+        "default": null
+      }
+    ],
     "DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE": [
       {
         "implementation": "A",
diff --git a/packages/dd-trace/src/plugins/ci_plugin.js b/packages/dd-trace/src/plugins/ci_plugin.js
index d2589a0306..3e49eb53f5 100644
--- a/packages/dd-trace/src/plugins/ci_plugin.js
+++ b/packages/dd-trace/src/plugins/ci_plugin.js
@@ -61,7 +61,7 @@ const {
   DI_DEBUG_ERROR_SNAPSHOT_ID_SUFFIX,
   DI_DEBUG_ERROR_FILE_SUFFIX,
   DI_DEBUG_ERROR_LINE_SUFFIX,
-  getLibraryCapabilitiesTags,
+  getLibraryCapabilitiesTags: getDefaultLibraryCapabilitiesTags,
   getPullRequestDiff,
   getModifiedFilesFromDiff,
   getPullRequestBaseBranch,
@@ -109,7 +109,7 @@ const TEST_FRAMEWORKS_TO_SKIP_GIT_METADATA_EXTRACTION = new Set([
 ])
 
 function setItrSkippingEnabledTagFromLibraryConfig (plugin, frameworkVersion) {
-  const libraryCapabilitiesTags = getLibraryCapabilitiesTags(plugin.constructor.id, frameworkVersion)
+  const libraryCapabilitiesTags = getDefaultLibraryCapabilitiesTags(plugin.constructor.id, frameworkVersion)
 
   if (!libraryCapabilitiesTags[DD_CAPABILITIES_TEST_IMPACT_ANALYSIS] ||
     !plugin.libraryConfig ||
@@ -168,7 +168,7 @@ module.exports = class CiPlugin extends Plugin {
           ? getSessionRequestErrorTags(this.testSessionSpan)
           : Object.fromEntries(this._pendingRequestErrorTags.map(({ tag, value }) => [tag, value]))
 
-        const libraryCapabilitiesTags = getLibraryCapabilitiesTags(this.constructor.id, frameworkVersion)
+        const libraryCapabilitiesTags = this.getLibraryCapabilitiesTags(frameworkVersion, ctx)
         const metadataTags = {
           test: {
             ...libraryCapabilitiesTags,
@@ -431,6 +431,15 @@ module.exports = class CiPlugin extends Plugin {
     }
   }
 
+  /**
+   * Returns library capability metadata tags for this test framework.
+   * @param {string} frameworkVersion - The test framework version.
+   * @returns {Record<string, string|undefined>}
+   */
+  getLibraryCapabilitiesTags (frameworkVersion) {
+    return getDefaultLibraryCapabilitiesTags(this.constructor.id, frameworkVersion)
+  }
+
   /**
    * Adds a hidden _dd tag to the test session span when a test-optimization request fails.
    * If the session span does not exist yet (e.g. library-configuration failed before session:start),
diff --git a/packages/dd-trace/src/plugins/util/test.js b/packages/dd-trace/src/plugins/util/test.js
index ea33e63cc7..a8e883e29f 100644
--- a/packages/dd-trace/src/plugins/util/test.js
+++ b/packages/dd-trace/src/plugins/util/test.js
@@ -112,6 +112,12 @@ const TEST_RETRY_REASON = 'test.retry_reason'
 const TEST_HAS_FAILED_ALL_RETRIES = 'test.has_failed_all_retries'
 const TEST_IS_MODIFIED = 'test.is_modified'
 const TEST_HAS_DYNAMIC_NAME = '_dd.has_dynamic_name'
+const EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS = [
+  { limitMs: 5 * 1000, key: '5s' },
+  { limitMs: 10 * 1000, key: '10s' },
+  { limitMs: 30 * 1000, key: '30s' },
+  { limitMs: 5 * 60 * 1000, key: '5m' },
+]
 const CI_APP_ORIGIN = 'ciapp-test'
 
 // Matches patterns that are almost certainly runtime-generated values in test names:
@@ -493,6 +499,7 @@ module.exports = {
   removeInvalidMetadata,
   parseAnnotations,
   getIsFaultyEarlyFlakeDetection,
+  EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS,
   getEfdRetryCount,
   getMaxEfdRetryCount,
   TEST_BROWSER_DRIVER,
@@ -1447,13 +1454,7 @@ function parseAnnotations (annotations) {
  * @returns {number}
  */
 function getEfdRetryCount (durationMs, slowTestRetries) {
-  const thresholds = [
-    { limitMs: 5 * 1000, key: '5s' },
-    { limitMs: 10 * 1000, key: '10s' },
-    { limitMs: 30 * 1000, key: '30s' },
-    { limitMs: 5 * 60 * 1000, key: '5m' },
-  ]
-  for (const { limitMs, key } of thresholds) {
+  for (const { limitMs, key } of EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS) {
     if (durationMs < limitMs) {
       return slowTestRetries[key] ?? 0
     }
@@ -1616,7 +1617,7 @@ function isFailedTestReplaySupported (testFramework, frameworkVersion) {
     : true
 }
 
-function getLibraryCapabilitiesTags (testFramework, frameworkVersion) {
+function getLibraryCapabilitiesTags (testFramework, frameworkVersion, options = {}) {
   return {
     [DD_CAPABILITIES_TEST_IMPACT_ANALYSIS]: isTiaSupported(testFramework)
       ? '1'
@@ -1638,7 +1639,8 @@ function getLibraryCapabilitiesTags (testFramework, frameworkVersion) {
       isAttemptToFixSupported(testFramework, frameworkVersion)
         ? '5'
         : undefined,
-    [DD_CAPABILITIES_FAILED_TEST_REPLAY]: isFailedTestReplaySupported(testFramework, frameworkVersion)
+    [DD_CAPABILITIES_FAILED_TEST_REPLAY]: !options.omitFailedTestReplay &&
+      isFailedTestReplaySupported(testFramework, frameworkVersion)
       ? '1'
       : undefined,
   }
diff --git a/packages/dd-trace/test/plugins/util/test.spec.js b/packages/dd-trace/test/plugins/util/test.spec.js
index 1e5e47ba90..49b459de4c 100644
--- a/packages/dd-trace/test/plugins/util/test.spec.js
+++ b/packages/dd-trace/test/plugins/util/test.spec.js
@@ -13,6 +13,7 @@ const istanbul = require('../../../../../vendor/dist/istanbul-lib-coverage')
 require('../../setup/core')
 
 const {
+  EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS,
   getTestParametersString,
   getTestLevelsMetadataTags,
   getTestSuitePath,
@@ -1252,6 +1253,15 @@ describe('getIsFaultyEarlyFlakeDetection', () => {
 describe('getEfdRetryCount', () => {
   const slowTestRetries = { '5s': 10, '10s': 5, '30s': 3, '5m': 2 }
 
+  it('exports the retry thresholds used to select slow test retry buckets', () => {
+    assert.deepStrictEqual(EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS, [
+      { limitMs: 5_000, key: '5s' },
+      { limitMs: 10_000, key: '10s' },
+      { limitMs: 30_000, key: '30s' },
+      { limitMs: 300_000, key: '5m' },
+    ])
+  })
+
   it('returns retries for the matching duration bucket', () => {
     assert.strictEqual(getEfdRetryCount(0, slowTestRetries), 10)
     assert.strictEqual(getEfdRetryCount(4_999, slowTestRetries), 10)

From f2275bfe66ee9de3732631fc79259fdd5a82c367 Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Thu, 2 Jul 2026 15:27:59 +0200
Subject: [PATCH 44/51] perf(http): load the GCP pubsub push plugin lazily
 (#9178)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The http plugin requires datadog-plugin-google-cloud-pubsub's
pubsub-push-subscription module at the top of its own file, so every process
that instruments http pulls in that plugin graph even though it is only used
on GCP Cloud Run (K_SERVICE set and DD_TRACE_GCP_PUBSUB_PUSH_ENABLED not
opted out). Moving the require inside the existing gate keeps the module — and
its transitive graph — out of the startup path for every other deployment.

Drive-by fix:

* Drop the try/catch around the require: the pubsub plugin ships with the
  tracer, so this require cannot fail independently of the tracer's own load.
---
 packages/datadog-plugin-http/src/index.js     | 14 ++---
 .../datadog-plugin-http/test/index.spec.js    | 62 +++++++++++++++++++
 2 files changed, 68 insertions(+), 8 deletions(-)
 create mode 100644 packages/datadog-plugin-http/test/index.spec.js

diff --git a/packages/datadog-plugin-http/src/index.js b/packages/datadog-plugin-http/src/index.js
index dcf0abed05..d57f5e404b 100644
--- a/packages/datadog-plugin-http/src/index.js
+++ b/packages/datadog-plugin-http/src/index.js
@@ -1,6 +1,5 @@
 'use strict'
 
-const PushSubscriptionPlugin = require('../../datadog-plugin-google-cloud-pubsub/src/pubsub-push-subscription')
 const CompositePlugin = require('../../dd-trace/src/plugins/composite')
 const { enableGCPPubSubPushSubscription } = require('../../dd-trace/src/serverless')
 const log = require('../../dd-trace/src/log')
@@ -17,14 +16,13 @@ class HttpPlugin extends CompositePlugin {
   static get plugins () {
     const plugins = {}
 
-    // Load push subscription plugin first (if enabled) for GCP Cloud Run
+    // Load the push subscription plugin first (if enabled) for GCP Cloud Run.
+    // The require stays inside the gate so the pubsub plugin graph is not pulled
+    // into every process that instruments http — only GCP Cloud Run reaches it.
     if (enableGCPPubSubPushSubscription()) {
-      try {
-        plugins['pubsub-push-subscription'] = PushSubscriptionPlugin
-        log.debug('Loaded GCP Pub/Sub Push Subscription plugin for HTTP requests')
-      } catch (e) {
-        log.debug('Failed to load GCP Pub/Sub Push Subscription plugin:', e)
-      }
+      plugins['pubsub-push-subscription'] =
+        require('../../datadog-plugin-google-cloud-pubsub/src/pubsub-push-subscription')
+      log.debug('Loaded GCP Pub/Sub Push Subscription plugin for HTTP requests')
     }
 
     plugins.server = HttpServerPlugin
diff --git a/packages/datadog-plugin-http/test/index.spec.js b/packages/datadog-plugin-http/test/index.spec.js
new file mode 100644
index 0000000000..34f4bddc6a
--- /dev/null
+++ b/packages/datadog-plugin-http/test/index.spec.js
@@ -0,0 +1,62 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const path = require('node:path')
+
+const { describe, it, beforeEach, afterEach } = require('mocha')
+
+require('../../dd-trace/test/setup/core')
+
+const pubsubPluginPath = require.resolve(
+  '../../datadog-plugin-google-cloud-pubsub/src/pubsub-push-subscription'
+)
+const httpPluginPath = require.resolve('../src')
+
+function freshHttpPlugin () {
+  delete require.cache[httpPluginPath]
+  delete require.cache[pubsubPluginPath]
+  return require('../src')
+}
+
+describe('HttpPlugin composite plugins', () => {
+  const originalKService = process.env.K_SERVICE
+  const originalGcpPubsubPush = process.env.DD_TRACE_GCP_PUBSUB_PUSH_ENABLED
+
+  beforeEach(() => {
+    delete require.cache[pubsubPluginPath]
+  })
+
+  afterEach(() => {
+    if (originalKService === undefined) delete process.env.K_SERVICE
+    else process.env.K_SERVICE = originalKService
+    if (originalGcpPubsubPush === undefined) delete process.env.DD_TRACE_GCP_PUBSUB_PUSH_ENABLED
+    else process.env.DD_TRACE_GCP_PUBSUB_PUSH_ENABLED = originalGcpPubsubPush
+  })
+
+  it('does not load the pubsub push-subscription plugin when GCP push is disabled', () => {
+    delete process.env.K_SERVICE
+    const HttpPlugin = freshHttpPlugin()
+
+    const names = Object.keys(HttpPlugin.plugins)
+
+    assert.deepStrictEqual(names, ['server', 'client'])
+    assert.strictEqual(
+      require.cache[pubsubPluginPath],
+      undefined,
+      'the pubsub push-subscription module must not be required when the GCP push gate is off'
+    )
+  })
+
+  it('loads the pubsub push-subscription plugin first when GCP push is enabled', () => {
+    process.env.K_SERVICE = 'svc'
+    process.env.DD_TRACE_GCP_PUBSUB_PUSH_ENABLED = 'true'
+    const HttpPlugin = freshHttpPlugin()
+
+    const names = Object.keys(HttpPlugin.plugins)
+
+    assert.strictEqual(names[0], 'pubsub-push-subscription')
+    assert.deepStrictEqual(names, ['pubsub-push-subscription', 'server', 'client'])
+    assert.strictEqual(path.isAbsolute(pubsubPluginPath), true)
+    assert.notStrictEqual(require.cache[pubsubPluginPath], undefined)
+  })
+})

From 96acc89b9f6564a0a657de0f39ab836a6b266cd9 Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Thu, 2 Jul 2026 15:28:52 +0200
Subject: [PATCH 45/51] test(child_process): fix Bluebird flake that cascades
 to every later spec (#9078)

The Bluebird specs set global.Promise = Bluebird in beforeEach and restored it
only in afterEach, holding the mutation across the awaited span round-trip. Under
load the subprocess span arrives late, and the shared assertion helper only
rejects once a payload has already errored, so the spec hangs to mocha's 5 s
timeout while leftover async keeps global.Promise flipped, corrupting context for
every later spec in the file.

1. The instrumentation only reads global.Promise synchronously, when the wrapped
   method runs. Scope the swap to that window via withBluebird() and restore it in
   a finally before any await.
2. assert.strictEqual(promise.constructor, Bluebird) asserts a property that
   depends on module-load order and the call-time global, not on any contract the
   instrumentation makes; it held locally and on Node 18 but saw the native
   constructor on Node 20. Assert the real contract instead: the promisified call
   resolves with the expected stdout and still produces the span.
3. Await the span expectation and the subprocess completion together in one
   Promise.all per spec, so a late or failed span cannot float onto the shared
   agent and match a later spec's expectation.

Drive-by fix:

* Drop the dead `delete require.cache[require.resolve('util')]` (util is a builtin).
* Replace the try/catch rejection check with assert.rejects.
---
 .../test/index.spec.js                        | 114 ++++++++++--------
 1 file changed, 61 insertions(+), 53 deletions(-)

diff --git a/packages/datadog-plugin-child_process/test/index.spec.js b/packages/datadog-plugin-child_process/test/index.spec.js
index 6b1076e764..567adbad93 100644
--- a/packages/datadog-plugin-child_process/test/index.spec.js
+++ b/packages/datadog-plugin-child_process/test/index.spec.js
@@ -387,9 +387,25 @@ describe('Child process plugin', () => {
     // BLUEBIRD REGRESSION TEST - Prevents "this._then is not a function" bug
 
     let childProcess, tracer, util
-    let originalPromise
     let Bluebird
 
+    // The regression only needs Bluebird to be the global `Promise` at the
+    // moment `util.promisify`/the wrapped child_process method runs, since that
+    // is when the instrumentation does `Promise.resolve(...).then(...)`. Holding
+    // the mutation across the awaited span round-trip leaks it into the shared
+    // mock agent and tracer, flip-flopping the process-wide `Promise` while the
+    // next test runs. Scope the mutation to the synchronous call and restore it
+    // before awaiting.
+    function withBluebird (fn) {
+      const original = global.Promise
+      global.Promise = Bluebird
+      try {
+        return fn()
+      } finally {
+        global.Promise = original
+      }
+    }
+
     before(async () => {
       tracer = await agent.load('child_process', undefined, { flushInterval: 1 })
       childProcess = require('child_process')
@@ -400,21 +416,7 @@ describe('Child process plugin', () => {
 
     after(() => agent.close())
 
-    beforeEach(() => {
-      originalPromise = global.Promise
-      global.Promise = Bluebird
-    })
-
-    afterEach(() => {
-      global.Promise = originalPromise
-    })
-
     it('should not crash with "this._then is not a function" when using Bluebird promises', async () => {
-      const execFileAsync = util.promisify(childProcess.execFile)
-
-      assert.strictEqual(global.Promise, Bluebird)
-      assert.ok(global.Promise.version)
-
       const expectedPromise = expectSomeSpan(agent, {
         type: 'system',
         name: 'command_execution',
@@ -425,36 +427,40 @@ describe('Child process plugin', () => {
         },
       })
 
-      const result = await execFileAsync('echo', ['bluebird-test'])
-      assert.ok(result)
-      assert.strictEqual(result.stdout, 'bluebird-test\n')
+      const callPromise = withBluebird(() => {
+        assert.strictEqual(global.Promise, Bluebird)
+        assert.ok(/** @type {{ version?: string }} */ (global.Promise).version)
+        return util.promisify(childProcess.execFile)('echo', ['bluebird-test'])
+      })
 
-      return expectedPromise
+      await Promise.all([expectedPromise, (async () => {
+        const result = await callPromise
+        assert.ok(result)
+        assert.strictEqual(result.stdout, 'bluebird-test\n')
+      })()])
     })
 
     it('should work with concurrent Bluebird promise calls', async () => {
-      const execFileAsync = util.promisify(childProcess.execFile)
-
-      const promises = []
-      for (let i = 0; i < 5; i++) {
-        promises.push(
-          execFileAsync('echo', [`concurrent-test-${i}`])
-            .then(result => {
-              assert.strictEqual(result.stdout, `concurrent-test-${i}\n`)
-              return result
-            })
-        )
-      }
+      const promises = withBluebird(() => {
+        const execFileAsync = util.promisify(childProcess.execFile)
+        const calls = []
+        for (let i = 0; i < 5; i++) {
+          calls.push(
+            execFileAsync('echo', [`concurrent-test-${i}`])
+              .then(result => {
+                assert.strictEqual(result.stdout, `concurrent-test-${i}\n`)
+                return result
+              })
+          )
+        }
+        return calls
+      })
 
       const results = await Promise.all(promises)
       assert.strictEqual(results.length, 5)
     })
 
     it('should handle Bluebird promise rejection properly', async () => {
-      global.Promise = Bluebird
-
-      const execFileAsync = util.promisify(childProcess.execFile)
-
       const expectedPromise = expectSomeSpan(agent, {
         type: 'system',
         name: 'command_execution',
@@ -465,30 +471,32 @@ describe('Child process plugin', () => {
         },
       })
 
-      try {
-        await execFileAsync('node', ['-invalidFlag'], { stdio: 'pipe' })
-        throw new Error('Expected command to fail')
-      } catch (error) {
-        assert.ok(error)
-        assert.ok(error.code)
-      }
+      const callPromise = withBluebird(() =>
+        util.promisify(childProcess.execFile)('node', ['-invalidFlag'], { stdio: 'pipe' }))
 
-      return expectedPromise
+      await Promise.all([expectedPromise, assert.rejects(callPromise, error => {
+        assert.ok(error.code)
+        return true
+      })])
     })
 
     it('should work with util.promisify when global Promise is Bluebird', async () => {
-      // Re-require util to get Bluebird-aware promisify
-      delete require.cache[require.resolve('util')]
-      const utilWithBluebird = require('util')
-
-      const execFileAsync = utilWithBluebird.promisify(childProcess.execFile)
+      const expectedPromise = expectSomeSpan(agent, {
+        type: 'system',
+        name: 'command_execution',
+        error: 0,
+        meta: {
+          component: 'subprocess',
+          'cmd.exec': '["echo","util-promisify-test"]',
+        },
+      })
 
-      const promise = execFileAsync('echo', ['util-promisify-test'])
-      assert.strictEqual(promise.constructor, Bluebird)
-      assert.ok(promise.constructor.version)
+      const callPromise = withBluebird(() => util.promisify(childProcess.execFile)('echo', ['util-promisify-test']))
 
-      const result = await promise
-      assert.strictEqual(result.stdout, 'util-promisify-test\n')
+      await Promise.all([expectedPromise, (async () => {
+        const result = await callPromise
+        assert.strictEqual(result.stdout, 'util-promisify-test\n')
+      })()])
     })
   })
 

From 34f3091faee655124a543f94c8b2edcc2e4c47f6 Mon Sep 17 00:00:00 2001
From: Ida Liu <119438987+ida613@users.noreply.github.com>
Date: Thu, 2 Jul 2026 10:51:17 -0400
Subject: [PATCH 46/51] feat(opentelemetry): OTLP trace metrics support (#8206)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(span-stats): add OTLP metrics export for span stats

Export client-computed span stats as OTLP metrics (dd.trace.span.hits,
dd.trace.span.errors, dd.trace.span.top_level_hits, dd.trace.span.duration)
via a new OtlpStatsExporter alongside the existing Datadog /v0.6/stats
exporter.

Enabled via DD_TRACE_OTEL_METRICS_ENABLED=true, or auto-enabled when both
OTEL_TRACES_EXPORTER=otlp and OTEL_METRICS_EXPORTER=otlp are set. URL and
protocol are derived from the OTLP trace export configuration.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* test(config): register traceMetrics as internal runtime property

traceMetrics is a computed aggregate derived from OTEL_TRACES_EXPORTER,
OTEL_METRICS_EXPORTER, and DD_TRACE_OTEL_METRICS_ENABLED — not a raw
user-facing key — so it belongs in INTERNAL_RUNTIME_PROPERTIES alongside
sampler and stableConfig.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(config): guard traceMetrics URL derivation against invalid OTLP endpoint

When hostname is an unbracketed IPv6 address (e.g. ::1), the defaultOtlpBase
is http://::1:4318 which is not a valid URL. The new URL() call in the
traceMetrics block was the first code path to actually parse the string,
causing a TypeError that crashed config construction.

Wrap the URL derivation in a try/catch so that a malformed traces endpoint
falls back to the localhost default without throwing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(config): regenerate config types for DD_TRACE_OTEL_METRICS_ENABLED

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(config): add configurationNames to DD_TRACE_OTEL_METRICS_ENABLED entry

The eslint-config-names-sync rule verifies that every leaf property in
TracerOptions (index.d.ts) has a matching configurationNames entry in
supported-configurations.json. The entry for DD_TRACE_OTEL_METRICS_ENABLED
only had internalPropertyName, which is not checked by the rule.

Adding configurationNames: ["traceMetricsEnabled"] ties the two files
together and satisfies the lint check. Regenerated config types to match.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* bug fix

* update post RFC discussion

* bring implementation bug fix

* clean how cinfgs are set

* feat(otlp-trace-metrics): align span-stats export with the trace-metrics contract

Update the OTLP trace-metrics export to match the agreed RFC/system-test contract:

- Rename the enablement env var to OTEL_CLIENT_STATS_COMPUTATION_ENABLED and add
  DD_TRACE_OTEL_SEMANTICS_ENABLED (OTel-semantics mode: emit only OTel attributes, no dd.*).
- Emit a single histogram named traces.span.sdk.metrics.duration.
- Map dimensions to OTel attributes (span.name, span.kind, http.*, rpc.* from grpc tags) and
  convey errors via OTel status.code; default mode also adds dd.operation.name, dd.span.type,
  dd.origin and dd.span.top_level.
- Add telemetry.sdk.{name,language,version} resource attributes and emit process tags as dd.<key>
  (default mode only); gate all dd.* resource attributes behind default mode.
- Drive the flush/export cadence from OTEL_METRIC_EXPORT_INTERVAL and drop the
  _DD_TRACE_STATS_WRITER_INTERVAL override.
- Read grpc.status.code from span.metrics (numeric) with a meta fallback.

Update unit tests accordingly and regenerate config types.

Co-authored-by: Cursor <cursoragent@cursor.com>

* feat(otlp-trace-metrics): report service identity per InstrumentationScope

Partition span-stats data points by service so one OTLP payload can carry
multiple services, each as its own InstrumentationScope with service.name,
service.version and deployment.environment.name. These move off the resource,
which now only carries SDK identity, host.name and dd.* attributes.

Fix the trace-metrics flush cadence at 10s (no longer driven by
OTEL_METRIC_EXPORT_INTERVAL); the internal _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL
overrides it in tests only.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(otlp-trace-metrics): apply internal flush interval override

The generic env applier only reads DD_/OTEL_ prefixed vars, so the
internal _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL (which starts with _DD_)
was never wired into config. Read it explicitly so the test-only flush
cadence override takes effect.

Co-authored-by: Cursor <cursoragent@cursor.com>

* feat(otlp-span-stats): emit fixed explicit-bounds histogram from the DDSketch

Derive the OTLP duration histogram from each group's DDSketch into the
spanmetrics-connector default bounds (in seconds), and drop the duplicate
exact-cell accumulator in span_stats. Each group now emits at most two data
points (ok/error) with a per-group dd.span.top_level heuristic, mirroring
libdatadog.

Co-authored-by: Cursor <cursoragent@cursor.com>

* refactor(span-stats): carry service identity as resource attributes

Move service.name/service.version/deployment.environment.name onto the OTLP
resource (the configured default service), emit a single InstrumentationScope,
and add service.name as a data-point attribute only when a span's service
differs from the configured default. Thread DD_SERVICE through the processor so
the transformer can compare against it.

Co-authored-by: Cursor <cursoragent@cursor.com>

* refactor(span-stats): drop redundant dd-trace InstrumentationScope

The exported OTLP metrics no longer carry an InstrumentationScope: a `dd-trace`
scope (name/version) is redundant with the resource's telemetry.sdk.* attributes.
The single scopeMetrics omits the scope field.

Co-authored-by: Cursor <cursoragent@cursor.com>

* refactor(span-stats): datadog.* attribute prefix and OTEL_TRACES_SPAN_METRICS_ENABLED

Rename the OTLP trace-metric attributes from dd.* to datadog.* (operation.name,
span.type, span.top_level, origin, runtime_id, datadog.<process tags>) and rename
the enablement env var OTEL_CLIENT_STATS_COMPUTATION_ENABLED ->
OTEL_TRACES_SPAN_METRICS_ENABLED.

Co-authored-by: Cursor <cursoragent@cursor.com>

* feat(otlp): set _dd.stats_computed resource attribute on OTLP traces when trace metrics enabled

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(span-stats): use timer.unref?.() for Electron compatibility

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(rebase): restore extractRootTags; rename traceMetricsEnabled; add otelSemanticsEnabled to types

span_format.js: rebase conflict resolved to branch's addTag refactor which no longer exists in
master — revert to explicit typeof checks while keeping the FR06.3 BUG comment.

index.d.ts: rename traceMetricsEnabled -> otlpTraceMetricsEnabled to match supported-configurations.json;
add otelSemanticsEnabled (DD_TRACE_OTEL_SEMANTICS_ENABLED). Fixes eslint-config-names-sync errors.

Regenerate generated-config-types.d.ts from updated inputs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(span-stats): wire OTLP metrics endpoint/protocol and trim dead code

The crash fix: SpanStatsProcessor read config.otelMetricsUrl/otelMetricsProtocol,
which Config never set (dropped in 40014aee5), so `new URL(undefined)` threw
ERR_INVALID_URL and crashed tracer init whenever OTLP trace metrics were enabled.
Read the canonical OTEL_EXPORTER_OTLP_METRICS_ENDPOINT/OTEL_EXPORTER_OTLP_METRICS_PROTOCOL
directly instead of introducing redundant alias properties.

Also fix the dead auto-enable check: `this.otelMetricsEnabled` does not exist
(the property is DD_METRICS_OTEL_ENABLED), so `undefined === true` made the
"auto-enable when OTLP traces + OTEL metrics are on" path never trigger.

Minimize the diff vs master without changing behavior:
- drop 4 unused SpanAggStats fields (errorDuration/topLevel*) and their test
- collapse the duplicate JSON/protobuf transformer methods into transform()
- remove two `// BUG` WIP narration comments (reverts the comment-only
  span_format.js hunk; tracked separately)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

* refactor(span-stats): privatize internals, trim telemetry, simplify transformer

- Make _drainBuckets / _toLegacyPayload true private (#) — neither
  crosses the class boundary; _ prefix implied false publicness
- Guard SpanStatsExporter construction behind !otlpTraceMetricsEnabled
  so it is never instantiated when the OTLP path is active
- Replace #errorStatus() / #boolAttr() one-shot methods with inline
  literals and a module-level ERROR_STATUS_ATTR constant to avoid
  per-call allocations
- sketchToFixedHistogram now returns number[] directly; #pushPoint
  references EXPLICIT_BOUNDS_SECONDS from the module constant
- Remove this.recordTelemetry calls from OtlpStatsExporter.export —
  not part of the OTLP trace-metrics spec
- Rewrite whitebox _drainBuckets test as blackbox: assert buckets are
  empty after onInterval() instead of calling the private method

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix configs

Co-authored-by: Munir Abdinur <munir.abdinur@datadoghq.com>

* chore: regenerate config types after supported-configurations.json update

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(opentelemetry): use otelSemanticsEnabled config key instead of DD_TRACE_OTEL_SEMANTICS_ENABLED

Our branch maps DD_TRACE_OTEL_SEMANTICS_ENABLED to the internal property
otelSemanticsEnabled via supported-configurations.json internalPropertyName.
The merged master code was reading config.DD_TRACE_OTEL_SEMANTICS_ENABLED
directly, which was undefined in our config layout.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(test): update span.spec.js to use otelSemanticsEnabled config key

The test was setting config.DD_TRACE_OTEL_SEMANTICS_ENABLED but span.js
now reads config.otelSemanticsEnabled (the internal property name mapped
from DD_TRACE_OTEL_SEMANTICS_ENABLED via supported-configurations.json).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(config): use string default for _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL

Schema requires default to be a string or null, not a number literal.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(config): update description for _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL to match registry

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(config): use short description for _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL

The description field maps to Short Description in the config registry.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(config): remove description field from _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL

No other int entry with allowed field uses description; may be mutually exclusive in schema.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(otlp-span-stats): address Codex review comments

- Use dd-trace VERSION (not app version) for telemetry.sdk.version resource attribute
- Pass OTEL_EXPORTER_OTLP_METRICS_HEADERS and OTEL_EXPORTER_OTLP_METRICS_TIMEOUT
  to OtlpStatsExporter so authenticated/custom endpoints work correctly
- Fix index.d.ts doc: env var is OTEL_TRACES_SPAN_METRICS_ENABLED and
  auto-enable condition is DD_METRICS_OTEL_ENABLED (not OTEL_METRICS_EXPORTER=otlp)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(lint): fix import order and no-useless-undefined in span_stats and otlp-span-stats

- Move ../../../version import before ./constants to satisfy import/order rule
- Remove explicit = undefined default for headers param (unicorn/no-useless-undefined)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* test(config): cover _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL override branch

Adds test that exercises the setAndTrack call inside the conditional
that reads the internal flush interval override from the environment.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(config): align DD_TRACE_OTEL_SEMANTICS_ENABLED with registry definition

The config registry has this entry as a plain boolean with default "false"
and no internalPropertyName. Revert our custom mapping so the entry matches
the registry exactly — the validator compares against the registered definition.

All code that previously accessed config.otelSemanticsEnabled now reads
config.DD_TRACE_OTEL_SEMANTICS_ENABLED directly; the destructuring alias
in span_stats.js preserves the otelSemanticsEnabled local variable name.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(lint): add configurationNames for otelSemanticsEnabled to satisfy eslint-config-names-sync

The rule requires that every option name in index.d.ts has a corresponding
entry in supported-configurations.json (as a key, configurationNames value,
or internalPropertyName). Adding configurationNames: ["otelSemanticsEnabled"]
to DD_TRACE_OTEL_SEMANTICS_ENABLED satisfies this while keeping default: "false"
to match the registry. The generator uses configurationNames[0] as the config
key, so code reverts to config.otelSemanticsEnabled.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(config): remove internalPropertyName and unnecessary configurationNames

Per reviewer feedback:
- Remove internalPropertyName from _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL; the flush
  interval is read directly via getEnvironmentVariable() in #applyCalculated
- Remove configurationNames/internalPropertyName from OTEL_TRACES_SPAN_METRICS_ENABLED
  and drop otlpTraceMetricsEnabled as a programmatic option from index.d.ts; use
  this.OTEL_TRACES_SPAN_METRICS_ENABLED directly in #applyCalculated instead
- Remove configurationNames from DD_TRACE_OTEL_SEMANTICS_ENABLED and drop
  otelSemanticsEnabled as a programmatic option from index.d.ts; all callers
  now read config.DD_TRACE_OTEL_SEMANTICS_ENABLED directly

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(config): resolve Unknown Config properties for otlpTraceMetricsEnabled/ddTraceMetricsOtelFlushInterval

- Map setAndTrack to OTEL_TRACES_SPAN_METRICS_ENABLED (a declared config key)
  instead of the undeclared otlpTraceMetricsEnabled alias; all call sites
  updated to read config.OTEL_TRACES_SPAN_METRICS_ENABLED directly
- Move _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL reading from #applyCalculated
  into span_stats.js; import getEnvironmentVariable there directly — removes
  the undeclared ddTraceMetricsOtelFlushInterval setAndTrack write
- Update tests to use the env-var key names and remove the now-irrelevant
  config override test

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(lint): remove blank line before closing brace in config spec

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(config): generate GeneratedEnvVarConfig interface for env var types

- Extract getBaseType helper from getTypeForEntry to share base type computation
- Add getEnvVarType that only adds undefined when there is no registered default
- Add generateEnvVarConfigTypes to map every env var name (canonical + aliases) to its resolved type
- Append GeneratedEnvVarConfig interface to generated-config-types.d.ts

Rationale: Callers of getValueFromEnvSources need per-env-var typed return values instead of the full config property union, enabling type-safe lookups by literal env var name.

This commit made by [/dd:git:commit:quick](https://github.com/DataDog/claude-marketplace/tree/main/dd/commands/git/commit/quick.md)

* fix(span-stats): address PR review comments

- Gate OTLP-only SpanAggKey dimensions (origin, spanKind, rpcMethod,
  rpcStatusCode) on otlpTraceMetricsEnabled to avoid inflating legacy
  span stats aggregation key cardinality
- Thread _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL through the typed config
  system (via setAndTrack/getValueFromEnvSources) instead of reading
  the raw env var directly in SpanStatsProcessor
- Add config tests covering OTEL_TRACES_SPAN_METRICS_ENABLED auto-enable
  logic (both conditions, explicit override)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(span-stats): pass otlpEnabled=true in transformer test bucket helper

makeBucket is used exclusively by OtlpStatsTransformer tests, so spans
must be keyed with otlpEnabled=true to populate the OTLP-gated fields
(origin, spanKind, rpcMethod, rpcStatusCode).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* style(span-stats): minor style and readability cleanups

- Extract flush interval to variable before setAndTrack call
- Remove unnecessary quotes on property key
- Tighten test description wording

Rationale: Small consistency and readability improvements from PR review

This commit made by [/dd:git:commit:quick](https://github.com/DataDog/claude-marketplace/tree/main/dd/commands/git/commit/quick.md)

* fix(span-stats): remove rpc.method from otlp span stats aggregation key

- Drop grpc.method.name from SpanAggKey and OtlpStatsTransformer
- rpc.method inflates aggregation key cardinality without sufficient benefit
- Update all affected test assertions

This commit made by [/dd:git:commit:quick](https://github.com/DataDog/claude-marketplace/tree/main/dd/commands/git/commit/quick.md)

* refactor(span-stats): remove stale comments and clarify TODO

- Remove redundant inline comments in otlp-span-stats transformer
- Replace misleading comment about OTLP-only dimensions with a TODO
  noting origin and spanKind should eventually be included in legacy
  client stats aggregation

This commit made by [/dd:git:commit:quick](https://github.com/DataDog/claude-marketplace/tree/main/dd/commands/git/commit/quick.md)

* Apply suggestion from @mabdinur

* refactor(span-stats): remove redundant inline comments

- Drop comments that restate what the code already shows
- Keep code self-documenting per project style guidelines

This commit made by [/dd:git:commit:quick](https://github.com/DataDog/claude-marketplace/tree/main/dd/commands/git/commit/quick.md)

* fix(opentelemetry): fix max-len lint violation in span_processor.js

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(opentelemetry): fix max-len lint violation in span_processor.js

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: add otlp-span-stats exporter to CODEOWNERS

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(opentelemetry): encapsulate OTLP span stats in opentelemetry/metrics

Move OtlpStatsExporter and OtlpStatsTransformer into opentelemetry/metrics/
so the opentelemetry package is self-contained ahead of potential extraction
into its own npm package.

Key changes:
- Move exporters/otlp-span-stats/{index,transformer}.js to
  opentelemetry/metrics/otlp_span_stats_{exporter,transformer}.js
- Move buildResourceAttributes from span_stats.js to opentelemetry/metrics/index.js;
  add createOtlpSpanStatsExporter factory there
- Wire OtlpStatsExporter via DI: opentracing/tracer.js creates it when
  OTEL_TRACES_SPAN_METRICS_ENABLED and passes it through SpanProcessor to
  SpanStatsProcessor — span_stats.js no longer imports from opentelemetry/
- config/index.js mirrors OTEL_TRACES_SPAN_METRICS_ENABLED into
  stats.DD_TRACE_STATS_COMPUTATION_ENABLED so downstream checks are unified
- Remove otlpEnabled flag from SpanAggKey/SpanBuckets — origin, spanKind,
  rpcStatusCode are always populated
- Remove OTEL-specific check from AgentExporter (relies on mirrored flag)
- Remove CODEOWNERS entry for deleted exporters/otlp-span-stats/ path
- Move tests to test/opentelemetry/metrics/

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(opentelemetry): align grpc stats with libdatadog and enforce mutual exclusion

- Move GRPC_STATUS_CODE constant to ext/tags.js
- Emit rpc.response.status_code as string (aligns with libdatadog kv_str)
- Use else if in onInterval to make native and OTLP export mutually exclusive

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(opentelemetry): trim JSDoc, privatize transformer, drop empty description

- Make OtlpStatsExporter#transformer a private field (#transformer)
- Remove empty description field from histogram metric
- Trim redundant @param prose in exporter and transformer JSDoc
- Use GRPC_STATUS_CODE import in transformer spec instead of string literal

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(opentelemetry): suppress self-instrumentation spans from OTLP exporter requests

Wrap sendPayload's HTTP request in legacyStorage.run({ noop: true }) so the
tracer does not instrument its own outbound connections to the OTLP collector.
Without this, tcp.connect client spans for /v1/metrics requests were fed into
the traces.span.sdk.metrics.duration histogram, displacing real span data points
and inflating counts in the system-tests parametric suite.

Same pattern used by exporters/common/request.js and exporters/common/agents.js.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* test(opentelemetry): improve patch coverage for span stats OTLP export

- Inline URL parsing into OtlpHttpExporterBase constructor; remove setUrl
  (the if(telemetryTags !== undefined) branch was dead — telemetryTags is
  always undefined when setUrl was called from the constructor, and no
  external caller ever invoked it post-construction)
- Add tests for buildResourceAttributes (sdk identity, runtime-id, OTel-
  semantics mode) and createOtlpSpanStatsExporter
- Add tests for HTTP error response and request error paths in sendPayload

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(opentelemetry): emit raw grpc.status.code name for rpc.response.status_code

Prefer the meta status NAME string over the numeric metrics tag and emit it
upper-cased to rpc.response.status_code, aligning with the OTel gRPC semantic
conventions (canonical status name) without any code<->name mapping.

* fix(opentelemetry): restore setUrl method removed by dead-code cleanup

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(opentelemetry): trim redundant comments in grpc status mapping

Co-authored-by: Cursor <cursoragent@cursor.com>

* refactor(opentelemetry): read grpc.status.code from meta only

Drop the numeric metrics fallback; the gRPC status code is the canonical status
NAME and is read from span meta.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(opentelemetry): translate numeric grpc.status.code from metrics to status name

The dd gRPC plugin sets grpc.status.code as a numeric integer via
span.setTag, which span_format.js routes into span.metrics rather than
span.meta. SpanAggKey was reading meta only, so rpcStatusCode was always
empty for real gRPC spans.

Now falls back to span.metrics[GRPC_STATUS_CODE] and translates the
integer to the canonical status name (OK, NOT_FOUND, etc.) using the
gRPC status code table. Meta string takes priority when both are present.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(opentelemetry): split agg key by top-level to fix mixed-bucket OTLP metrics

When a bucket contained both top-level and measured non-top-level spans,
the heuristic (topLevelHits === hits) always resolved to false, causing
the OTLP histogram to be emitted as datadog.span.top_level=false and
dropping top-level traffic from APM metrics.

Adding topLevel as a dimension to SpanAggKey causes top-level and
non-top-level spans to bucket separately. Each bucket is now always
purely top-level or purely non-top-level, so the attribute is always
accurate. The native stats path is unaffected because toJSON() omits
topLevel; the Agent merges groups with identical key fields, preserving
the same Hits/TopLevelHits totals.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(opentelemetry): track per-top-level distributions to fix native stats regression

The previous fix added topLevel to SpanAggKey to separate top-level and
non-top-level spans into distinct buckets. This created a real regression
in the native /v0.6/stats path: the Agent's mergeDuplicates() correctly
sums Hits/Errors/Duration from duplicate rows but silently drops
TopLevelHits from the merged-away entry. If the non-top-level row is
processed first and becomes the canonical, TopLevelHits from the
top-level row is lost.

Fix: revert topLevel from SpanAggKey (no more duplicate rows). Instead,
split SpanAggStats into four distributions (topLevelOk, topLevelError,
nonTopLevelOk, nonTopLevelError). The native stats path merges them at
export time so toJSON() produces the same combined OkSummary/ErrorSummary
as before. The OTLP path emits separate data points per top-level status
with the correct datadog.span.top_level attribute. OTel-semantics mode
merges the distributions (no top-level attribute to distinguish them).

Also adds SpanKind, Origin, and RpcStatusCode to the native stats
toJSON() payload so the Agent receives these new dimensions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(opentelemetry): split native stats rows by top-level status; use GRPCStatusCode key

toJSON() now returns an array of up to 2 rows (top-level row first, non-top-level
row second). #toLegacyPayload uses flatMap to flatten them. This eliminates the
merge-time DDSketch allocation and ensures TopLevelHits is always non-zero on
the top-level row, so the Agent's mergeDuplicates retains it as the canonical entry.

Duration and Errors are derived from distribution .sum/.count, removing the
redundant this.duration and this.errors accumulators.

GRPCStatusCode matches the agent's msgpack decoder key (confirmed from
pkg/proto/pbgo/trace/stats_gen.go).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(opentelemetry): minimize comments, move GRPC_STATUS_NAMES to constants

- Remove descriptive/narrating comments throughout; keep only non-obvious constraints
- Move GRPC_STATUS_NAMES from span_stats.js into constants.js
- Rename #toLegacyPayload -> #v06Payload
- Remove section comment from ext/tags.js

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(opentelemetry): restrict ORIGIN_KEY to synthetics boolean; remove origin from aggregation key

ORIGIN_KEY now only populates SpanAggKey.synthetics. The origin string field
is removed from SpanAggKey, toString(), and the v0.6 payload (Origin is not
a field the agent decodes). In the OTLP path, datadog.origin='synthetics' is
emitted when aggKey.synthetics is true.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: remove pr_description.md

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Munir <munir.abdinur@datadoghq.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
---
 ext/tags.js                                   |   2 +
 .../src/config/generated-config-types.d.ts    |   4 +
 packages/dd-trace/src/config/index.js         |  11 +
 .../src/config/supported-configurations.json  |  19 +-
 packages/dd-trace/src/constants.js            |   7 +
 .../src/opentelemetry/metrics/index.js        |  59 +++-
 .../metrics/otlp_span_stats_exporter.js       |  40 +++
 .../metrics/otlp_span_stats_transformer.js    | 169 +++++++++
 .../otlp/otlp_http_exporter_base.js           |  77 +++--
 .../dd-trace/src/opentelemetry/trace/index.js |   4 +
 .../src/opentelemetry/tracer_provider.js      |   2 +-
 packages/dd-trace/src/opentracing/tracer.js   |   7 +-
 packages/dd-trace/src/span_processor.js       |   7 +-
 packages/dd-trace/src/span_stats.js           | 172 +++++-----
 packages/dd-trace/test/config/index.spec.js   |  27 ++
 .../metrics/otlp_span_stats_exporter.spec.js  | 182 ++++++++++
 .../otlp_span_stats_transformer.spec.js       | 323 ++++++++++++++++++
 packages/dd-trace/test/span_stats.spec.js     | 119 ++++++-
 18 files changed, 1086 insertions(+), 145 deletions(-)
 create mode 100644 packages/dd-trace/src/opentelemetry/metrics/otlp_span_stats_exporter.js
 create mode 100644 packages/dd-trace/src/opentelemetry/metrics/otlp_span_stats_transformer.js
 create mode 100644 packages/dd-trace/test/opentelemetry/metrics/otlp_span_stats_exporter.spec.js
 create mode 100644 packages/dd-trace/test/opentelemetry/metrics/otlp_span_stats_transformer.spec.js

diff --git a/ext/tags.js b/ext/tags.js
index f4a8545f89..bba8933c5a 100644
--- a/ext/tags.js
+++ b/ext/tags.js
@@ -27,6 +27,8 @@ const tags = {
   HTTP_CLIENT_IP: 'http.client_ip',
   NETWORK_CLIENT_IP: 'network.client.ip',
 
+  GRPC_STATUS_CODE: 'grpc.status.code',
+
   // Messaging
 
   // DSM Specific
diff --git a/packages/dd-trace/src/config/generated-config-types.d.ts b/packages/dd-trace/src/config/generated-config-types.d.ts
index 4ec85e2635..0941f2e2ce 100644
--- a/packages/dd-trace/src/config/generated-config-types.d.ts
+++ b/packages/dd-trace/src/config/generated-config-types.d.ts
@@ -3,6 +3,7 @@
 
 export interface GeneratedConfig {
   _DD_APM_TRACING_AGENTLESS_ENABLED: boolean;
+  _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL: number;
   apmTracingEnabled: boolean;
   appsec: {
     blockedTemplateGraphql: string | undefined;
@@ -494,6 +495,7 @@ export interface GeneratedConfig {
   OTEL_TRACES_EXPORTER: "none" | "otlp" | undefined;
   OTEL_TRACES_SAMPLER: "always_on" | "always_off" | "traceidratio" | "parentbased_always_on" | "parentbased_always_off" | "parentbased_traceidratio";
   OTEL_TRACES_SAMPLER_ARG: number | undefined;
+  OTEL_TRACES_SPAN_METRICS_ENABLED: boolean | undefined;
   peerServiceMapping: Record<string, string>;
   port: string | number;
   profiling: {
@@ -580,6 +582,7 @@ export interface GeneratedConfig {
 
 export interface GeneratedEnvVarConfig {
   _DD_APM_TRACING_AGENTLESS_ENABLED: boolean;
+  _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL: number;
   DATADOG_API_KEY: string | undefined;
   DD_ACTION_EXECUTION_ID: string | undefined;
   DD_AGENT_HOST: string;
@@ -1109,4 +1112,5 @@ export interface GeneratedEnvVarConfig {
   OTEL_TRACES_EXPORTER: "none" | "otlp" | undefined;
   OTEL_TRACES_SAMPLER: "always_on" | "always_off" | "traceidratio" | "parentbased_always_on" | "parentbased_always_off" | "parentbased_traceidratio";
   OTEL_TRACES_SAMPLER_ARG: number | undefined;
+  OTEL_TRACES_SPAN_METRICS_ENABLED: boolean | undefined;
 }
diff --git a/packages/dd-trace/src/config/index.js b/packages/dd-trace/src/config/index.js
index c15862bbea..3b2d667f73 100644
--- a/packages/dd-trace/src/config/index.js
+++ b/packages/dd-trace/src/config/index.js
@@ -25,6 +25,7 @@ const {
   getEnvironmentVariable,
   getEnvironmentVariables,
   getStableConfigSources,
+  getValueFromEnvSources,
 } = require('./helper')
 const {
   defaults,
@@ -604,6 +605,16 @@ class Config extends ConfigBase {
       setAndTrack(this, 'OTEL_EXPORTER_OTLP_TRACES_ENDPOINT', `${defaultOtlpBase}/v1/traces`)
     }
 
+    const autoTraceMetrics = this.OTEL_TRACES_EXPORTER === 'otlp' && this.DD_METRICS_OTEL_ENABLED === true
+    setAndTrack(this, 'OTEL_TRACES_SPAN_METRICS_ENABLED', this.OTEL_TRACES_SPAN_METRICS_ENABLED ?? autoTraceMetrics)
+
+    if (this.OTEL_TRACES_SPAN_METRICS_ENABLED) {
+      this.stats = { ...this.stats, DD_TRACE_STATS_COMPUTATION_ENABLED: true }
+    }
+
+    const flushInterval = getValueFromEnvSources('_DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL')
+    setAndTrack(this, '_DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL', flushInterval)
+
     if (process.platform === 'win32') {
       // OOM monitoring does not work properly on Windows, so it will be disabled.
       deactivateIfEnabledAndWarnOnWindows(this, 'DD_PROFILING_EXPERIMENTAL_OOM_MONITORING_ENABLED')
diff --git a/packages/dd-trace/src/config/supported-configurations.json b/packages/dd-trace/src/config/supported-configurations.json
index 7956b8dcd2..7dde20bd19 100644
--- a/packages/dd-trace/src/config/supported-configurations.json
+++ b/packages/dd-trace/src/config/supported-configurations.json
@@ -3137,6 +3137,14 @@
         "default": "true"
       }
     ],
+    "_DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL": [
+      {
+        "implementation": "A",
+        "type": "int",
+        "default": "10000",
+        "allowed": "[1-9]\\d*"
+      }
+    ],
     "DD_TRACE_MICROGATEWAY_CORE_ENABLED": [
       {
         "implementation": "A",
@@ -3352,14 +3360,14 @@
         "default": "true"
       }
     ],
-    "DD_TRACE_OTEL_SEMANTICS_ENABLED": [
+    "DD_TRACE_OTEL_ENABLED": [
       {
         "implementation": "A",
         "type": "boolean",
         "default": "false"
       }
     ],
-    "DD_TRACE_OTEL_ENABLED": [
+    "DD_TRACE_OTEL_SEMANTICS_ENABLED": [
       {
         "implementation": "A",
         "type": "boolean",
@@ -4201,6 +4209,13 @@
         "default": null,
         "allowed": "\\d+(\\.\\d+)?"
       }
+    ],
+    "OTEL_TRACES_SPAN_METRICS_ENABLED": [
+      {
+        "implementation": "A",
+        "type": "boolean",
+        "default": null
+      }
     ]
   }
 }
diff --git a/packages/dd-trace/src/constants.js b/packages/dd-trace/src/constants.js
index 903da8c659..1ddd8c7fb0 100644
--- a/packages/dd-trace/src/constants.js
+++ b/packages/dd-trace/src/constants.js
@@ -61,4 +61,11 @@ module.exports = {
     UPSTREAM: 'span-pointer-up',
     DOWNSTREAM: 'span-pointer-down',
   }),
+  // https://github.com/grpc/grpc/blob/master/doc/statuscodes.md
+  GRPC_STATUS_NAMES: [
+    'OK', 'CANCELLED', 'UNKNOWN', 'INVALID_ARGUMENT', 'DEADLINE_EXCEEDED',
+    'NOT_FOUND', 'ALREADY_EXISTS', 'PERMISSION_DENIED', 'RESOURCE_EXHAUSTED',
+    'FAILED_PRECONDITION', 'ABORTED', 'OUT_OF_RANGE', 'UNIMPLEMENTED',
+    'INTERNAL', 'UNAVAILABLE', 'DATA_LOSS', 'UNAUTHENTICATED',
+  ],
 }
diff --git a/packages/dd-trace/src/opentelemetry/metrics/index.js b/packages/dd-trace/src/opentelemetry/metrics/index.js
index 4e2c82b11a..e9e16910bc 100644
--- a/packages/dd-trace/src/opentelemetry/metrics/index.js
+++ b/packages/dd-trace/src/opentelemetry/metrics/index.js
@@ -2,6 +2,14 @@
 
 const os = require('os')
 
+const { metrics } = require('@opentelemetry/api')
+
+const { VERSION } = require('../../../../../version')
+const processTags = require('../../process-tags')
+const MeterProvider = require('./meter_provider')
+const PeriodicMetricReader = require('./periodic_metric_reader')
+const OtlpHttpMetricExporter = require('./otlp_http_metric_exporter')
+
 /**
  * @typedef {import('../../config')} Config
  */
@@ -28,11 +36,6 @@ const os = require('os')
  * @package
  */
 
-const { metrics } = require('@opentelemetry/api')
-const MeterProvider = require('./meter_provider')
-const PeriodicMetricReader = require('./periodic_metric_reader')
-const OtlpHttpMetricExporter = require('./otlp_http_metric_exporter')
-
 /**
  * Initializes OpenTelemetry Metrics support
  * @param {import('../../config/config-base')} config - Tracer configuration instance
@@ -75,7 +78,53 @@ function initializeOpenTelemetryMetrics (config) {
   metrics.setGlobalMeterProvider(meterProvider)
 }
 
+function buildResourceAttributes (tags, { reportHostname, otelSemanticsEnabled, service, env, serviceVersion } = {}) {
+  const attrs = {
+    'telemetry.sdk.name': 'datadog',
+    'telemetry.sdk.language': 'nodejs',
+    'telemetry.sdk.version': VERSION,
+  }
+  if (service) attrs['service.name'] = service
+  if (serviceVersion) attrs['service.version'] = serviceVersion
+  if (env) attrs['deployment.environment.name'] = env
+  if (reportHostname) attrs['host.name'] = os.hostname()
+
+  if (!otelSemanticsEnabled) {
+    if (tags?.['runtime-id']) attrs['datadog.runtime_id'] = tags['runtime-id']
+    const processTagsObject = processTags.tagsObject
+    if (processTagsObject) {
+      for (const key of Object.keys(processTagsObject)) {
+        attrs[`datadog.${key}`] = processTagsObject[key]
+      }
+    }
+  }
+  return attrs
+}
+
+function createOtlpSpanStatsExporter (config) {
+  const { OtlpStatsExporter } = require('./otlp_span_stats_exporter')
+  const protocol = config.OTEL_EXPORTER_OTLP_METRICS_PROTOCOL || 'http/json'
+  const resourceAttributes = buildResourceAttributes(config.tags, {
+    reportHostname: config.reportHostname,
+    otelSemanticsEnabled: config.DD_TRACE_OTEL_SEMANTICS_ENABLED,
+    service: config.service,
+    env: config.env,
+    serviceVersion: config.version,
+  })
+  return new OtlpStatsExporter(
+    config.OTEL_EXPORTER_OTLP_METRICS_ENDPOINT,
+    protocol,
+    resourceAttributes,
+    config.DD_TRACE_OTEL_SEMANTICS_ENABLED,
+    config.service,
+    config.OTEL_EXPORTER_OTLP_METRICS_HEADERS,
+    config.OTEL_EXPORTER_OTLP_METRICS_TIMEOUT
+  )
+}
+
 module.exports = {
   MeterProvider,
   initializeOpenTelemetryMetrics,
+  buildResourceAttributes,
+  createOtlpSpanStatsExporter,
 }
diff --git a/packages/dd-trace/src/opentelemetry/metrics/otlp_span_stats_exporter.js b/packages/dd-trace/src/opentelemetry/metrics/otlp_span_stats_exporter.js
new file mode 100644
index 0000000000..018493dbf5
--- /dev/null
+++ b/packages/dd-trace/src/opentelemetry/metrics/otlp_span_stats_exporter.js
@@ -0,0 +1,40 @@
+'use strict'
+
+const log = require('../../log')
+const OtlpHttpExporterBase = require('../otlp/otlp_http_exporter_base')
+const OtlpStatsTransformer = require('./otlp_span_stats_transformer')
+
+class OtlpStatsExporter extends OtlpHttpExporterBase {
+  #transformer
+
+  /**
+   * @param {string} url
+   * @param {string} protocol
+   * @param {import('@opentelemetry/api').Attributes} resourceAttributes
+   * @param {boolean} [otelSemanticsEnabled]
+   * @param {string} [defaultService]
+   * @param {Record<string, string>} [headers]
+   * @param {number} [timeout]
+   */
+  constructor (url, protocol, resourceAttributes, otelSemanticsEnabled = false, defaultService = '',
+    headers, timeout = 10_000) {
+    super(url, headers, timeout, protocol, 'span-stats')
+    this.#transformer = new OtlpStatsTransformer(resourceAttributes, protocol, otelSemanticsEnabled, defaultService)
+  }
+
+  /**
+   * @param {Array<{timeNs: number, bucket: import('../../span_stats').SpanBuckets}>} drained
+   * @param {number} bucketSizeNs
+   */
+  export (drained, bucketSizeNs) {
+    if (drained.length === 0) return
+    const payload = this.#transformer.transform(drained, bucketSizeNs)
+    this.sendPayload(payload, (result) => {
+      if (result.code !== 0) {
+        log.error('Failed to export span stats: %s', result.error?.message)
+      }
+    })
+  }
+}
+
+module.exports = { OtlpStatsExporter }
diff --git a/packages/dd-trace/src/opentelemetry/metrics/otlp_span_stats_transformer.js b/packages/dd-trace/src/opentelemetry/metrics/otlp_span_stats_transformer.js
new file mode 100644
index 0000000000..ca4d23a747
--- /dev/null
+++ b/packages/dd-trace/src/opentelemetry/metrics/otlp_span_stats_transformer.js
@@ -0,0 +1,169 @@
+'use strict'
+
+const { LogCollapsingLowestDenseDDSketch } = require('../../../../../vendor/dist/@datadog/sketches-js')
+const OtlpTransformerBase = require('../otlp/otlp_transformer_base')
+const { getProtobufTypes } = require('../otlp/protobuf_loader')
+
+const NS_PER_S = 1e9
+
+// Must match libdatadog's EXPLICIT_BOUNDS_SECONDS and OTel spanmetrics connector defaults.
+const EXPLICIT_BOUNDS_SECONDS = [
+  0.002, 0.004, 0.006, 0.008, 0.01, 0.05, 0.1, 0.2, 0.4, 0.8, 1, 1.4, 2, 5, 10, 15,
+]
+
+/**
+ * @param {object} sketch
+ * @returns {number[]}
+ */
+function sketchToFixedHistogram (sketch) {
+  const bucketCounts = new Array(EXPLICIT_BOUNDS_SECONDS.length + 1).fill(0)
+  if (sketch.zeroCount > 0) bucketCounts[0] += sketch.zeroCount
+  const { store, mapping } = sketch
+  for (let key = store.minKey; key <= store.maxKey; key++) {
+    const weight = store.bins[key - store.offset]
+    if (!weight) continue
+    const seconds = mapping.value(key) / NS_PER_S
+    let idx = EXPLICIT_BOUNDS_SECONDS.findIndex((bound) => seconds <= bound)
+    if (idx === -1) idx = EXPLICIT_BOUNDS_SECONDS.length
+    bucketCounts[idx] += weight
+  }
+  return bucketCounts.map((weight) => Math.round(weight))
+}
+
+let _deltaTemporality
+
+function getDeltaTemporality () {
+  if (_deltaTemporality === undefined) {
+    const { protoAggregationTemporality } = getProtobufTypes()
+    _deltaTemporality = protoAggregationTemporality.values.AGGREGATION_TEMPORALITY_DELTA
+  }
+  return _deltaTemporality
+}
+
+const ERROR_STATUS_ATTR = { key: 'status.code', value: { intValue: 2 } }
+
+class OtlpStatsTransformer extends OtlpTransformerBase {
+  #otelSemanticsEnabled
+  #defaultService
+
+  /**
+   * @param {import('@opentelemetry/api').Attributes} resourceAttributes
+   * @param {string} protocol
+   * @param {boolean} [otelSemanticsEnabled]
+   * @param {string} [defaultService]
+   */
+  constructor (resourceAttributes, protocol, otelSemanticsEnabled = false, defaultService = '') {
+    super(resourceAttributes, protocol, 'span-stats')
+    this.#otelSemanticsEnabled = otelSemanticsEnabled
+    this.#defaultService = defaultService
+  }
+
+  /**
+   * @param {Array<{timeNs: number, bucket: import('../../span_stats').SpanBuckets}>} drained
+   * @param {number} bucketSizeNs
+   */
+  transform (drained, bucketSizeNs) {
+    const isJson = this.protocol === 'http/json'
+    const data = {
+      resourceMetrics: [{
+        resource: this.transformResource(),
+        scopeMetrics: this.#buildScopeMetrics(drained, bucketSizeNs, isJson),
+      }],
+    }
+    return isJson
+      ? this.serializeToJson(data)
+      : this.serializeToProtobuf(getProtobufTypes().protoMetricsService, data)
+  }
+
+  #buildScopeMetrics (drained, bucketSizeNs, isJson) {
+    const temporality = isJson ? 'AGGREGATION_TEMPORALITY_DELTA' : getDeltaTemporality()
+
+    const dataPoints = []
+
+    for (const { timeNs, bucket } of drained) {
+      const endTimeNs = timeNs + bucketSizeNs
+      const startNano = isJson ? String(timeNs) : timeNs
+      const endNano = isJson ? String(endTimeNs) : endTimeNs
+
+      for (const aggStats of bucket.values()) {
+        const baseAttrs = this.#buildAttributes(aggStats.aggKey)
+
+        if (this.#otelSemanticsEnabled) {
+          const okDist = new LogCollapsingLowestDenseDDSketch()
+          okDist.merge(aggStats.topLevelOkDistribution)
+          okDist.merge(aggStats.nonTopLevelOkDistribution)
+          const errDist = new LogCollapsingLowestDenseDDSketch()
+          errDist.merge(aggStats.topLevelErrorDistribution)
+          errDist.merge(aggStats.nonTopLevelErrorDistribution)
+          this.#pushPoint(dataPoints, okDist, startNano, endNano, baseAttrs)
+          this.#pushPoint(dataPoints, errDist, startNano, endNano, [...baseAttrs, ERROR_STATUS_ATTR])
+        } else {
+          const tlAttrs = [...baseAttrs, { key: 'datadog.span.top_level', value: { boolValue: true } }]
+          const ntlAttrs = [...baseAttrs, { key: 'datadog.span.top_level', value: { boolValue: false } }]
+          this.#pushPoint(dataPoints, aggStats.topLevelOkDistribution, startNano, endNano, tlAttrs)
+          this.#pushPoint(dataPoints, aggStats.topLevelErrorDistribution, startNano, endNano,
+            [...tlAttrs, ERROR_STATUS_ATTR])
+          this.#pushPoint(dataPoints, aggStats.nonTopLevelOkDistribution, startNano, endNano, ntlAttrs)
+          this.#pushPoint(dataPoints, aggStats.nonTopLevelErrorDistribution, startNano, endNano,
+            [...ntlAttrs, ERROR_STATUS_ATTR])
+        }
+      }
+    }
+
+    if (dataPoints.length === 0) return []
+    return [{
+      metrics: [
+        {
+          name: 'traces.span.sdk.metrics.duration',
+          unit: 's',
+          histogram: { dataPoints, aggregationTemporality: temporality },
+        },
+      ],
+    }]
+  }
+
+  #pushPoint (points, sketch, startNano, endNano, attributes) {
+    if (!sketch || sketch.count === 0) return
+    points.push({
+      attributes,
+      startTimeUnixNano: startNano,
+      timeUnixNano: endNano,
+      count: sketch.count,
+      sum: sketch.sum / NS_PER_S,
+      min: sketch.min / NS_PER_S,
+      max: sketch.max / NS_PER_S,
+      bucketCounts: sketchToFixedHistogram(sketch),
+      explicitBounds: EXPLICIT_BOUNDS_SECONDS,
+    })
+  }
+
+  /**
+   * @param {import('../../span_stats').SpanAggKey} aggKey
+   */
+  #buildAttributes (aggKey) {
+    const raw = { 'span.name': aggKey.resource }
+
+    if (aggKey.service && aggKey.service !== this.#defaultService) {
+      raw['service.name'] = aggKey.service
+    }
+
+    if (aggKey.spanKind) raw['span.kind'] = aggKey.spanKind
+    if (aggKey.statusCode) raw['http.response.status_code'] = Number(aggKey.statusCode)
+    if (aggKey.method) raw['http.request.method'] = aggKey.method
+    if (aggKey.endpoint) raw['http.route'] = aggKey.endpoint
+    if (aggKey.rpcStatusCode !== '') {
+      raw['rpc.response.status_code'] = String(aggKey.rpcStatusCode).toUpperCase()
+    }
+
+    if (!this.#otelSemanticsEnabled) {
+      raw['datadog.operation.name'] = aggKey.name
+      if (aggKey.type) raw['datadog.span.type'] = aggKey.type
+      if (aggKey.synthetics) raw['datadog.origin'] = 'synthetics'
+    }
+
+    return this.transformAttributes(raw)
+  }
+}
+
+module.exports = OtlpStatsTransformer
+module.exports.EXPLICIT_BOUNDS_SECONDS = EXPLICIT_BOUNDS_SECONDS
diff --git a/packages/dd-trace/src/opentelemetry/otlp/otlp_http_exporter_base.js b/packages/dd-trace/src/opentelemetry/otlp/otlp_http_exporter_base.js
index 55afb34c61..fe27cb643d 100644
--- a/packages/dd-trace/src/opentelemetry/otlp/otlp_http_exporter_base.js
+++ b/packages/dd-trace/src/opentelemetry/otlp/otlp_http_exporter_base.js
@@ -3,10 +3,12 @@
 const http = require('node:http')
 const https = require('node:https')
 const { URL } = require('node:url')
+const { storage } = require('../../../../datadog-core')
 const log = require('../../log')
 const telemetryMetrics = require('../../telemetry/metrics')
 
 const tracerMetrics = telemetryMetrics.manager.namespace('tracers')
+const legacyStorage = storage('legacy')
 
 /**
  * Base class for OTLP HTTP exporters.
@@ -35,18 +37,20 @@ class OtlpHttpExporterBase {
 
     const isJson = protocol === 'http/json'
 
-    // Initialize fields setUrl doesn't touch; it fills in hostname/port/path below.
+    const parsedUrl = new URL(url)
+    this.#transport = parsedUrl.protocol === 'http:' ? http : https
     this.options = {
       method: 'POST',
       timeout,
+      hostname: parsedUrl.hostname,
+      port: parsedUrl.port,
+      path: parsedUrl.pathname + parsedUrl.search,
       headers: {
         'Content-Type': isJson ? 'application/json' : 'application/x-protobuf',
         ...headers,
       },
     }
 
-    this.setUrl(url)
-
     this.telemetryTags = [
       `protocol:${this.#transport === https ? 'https' : 'http'}`,
       `encoding:${isJson ? 'json' : 'protobuf'}`,
@@ -84,59 +88,54 @@ class OtlpHttpExporterBase {
       },
     }
 
-    const req = this.#transport.request(options, (res) => {
-      let data = ''
-
-      res.on('data', (chunk) => {
-        data += chunk
+    legacyStorage.run({ noop: true }, () => {
+      const req = this.#transport.request(options, (res) => {
+        let data = ''
+
+        res.on('data', (chunk) => {
+          data += chunk
+        })
+
+        res.once('end', () => {
+          // @ts-expect-error - res.statusCode can be undefined
+          if (res.statusCode >= 200 && res.statusCode < 300) {
+            resultCallback({ code: 0 })
+          } else {
+            const error = new Error(`HTTP ${res.statusCode}: ${data}`)
+            resultCallback({ code: 1, error })
+          }
+        })
       })
 
-      res.once('end', () => {
-        // @ts-expect-error - res.statusCode can be undefined
-        if (res.statusCode >= 200 && res.statusCode < 300) {
-          resultCallback({ code: 0 })
-        } else {
-          const error = new Error(`HTTP ${res.statusCode}: ${data}`)
-          resultCallback({ code: 1, error })
-        }
+      req.on('error', (error) => {
+        log.error('Error sending OTLP %s:', this.signalType, error)
+        resultCallback({ code: 1, error })
       })
-    })
 
-    req.on('error', (error) => {
-      log.error('Error sending OTLP %s:', this.signalType, error)
-      resultCallback({ code: 1, error })
-    })
+      req.once('timeout', () => {
+        req.destroy()
+        const error = new Error('Request timeout')
+        resultCallback({ code: 1, error })
+      })
 
-    req.once('timeout', () => {
-      req.destroy()
-      const error = new Error('Request timeout')
-      resultCallback({ code: 1, error })
+      req.write(payload)
+      req.end()
     })
-
-    req.write(payload)
-    req.end()
   }
 
   /**
-   * Updates the target URL used by this exporter. The URL is used as-is per the OTel spec: the
-   * caller is responsible for including the signal-specific path (`/v1/traces` etc.).
-   * @param {string} url - New OTLP endpoint URL
+   * Re-targets the exporter to a different URL, updating transport, hostname, port, and path.
+   * @param {string} url
    */
   setUrl (url) {
     const parsedUrl = new URL(url)
+    this.#transport = parsedUrl.protocol === 'http:' ? http : https
     this.options.hostname = parsedUrl.hostname
     this.options.port = parsedUrl.port
     this.options.path = parsedUrl.pathname + parsedUrl.search
-    this.#transport = parsedUrl.protocol === 'http:' ? http : https
-    if (this.telemetryTags !== undefined) {
-      this.telemetryTags[0] = `protocol:${this.#transport === https ? 'https' : 'http'}`
-    }
+    this.telemetryTags[0] = `protocol:${this.#transport === https ? 'https' : 'http'}`
   }
 
-  /**
-   * Shuts down the exporter.
-   * Subclasses can override to add cleanup logic.
-   */
   shutdown () {}
 }
 
diff --git a/packages/dd-trace/src/opentelemetry/trace/index.js b/packages/dd-trace/src/opentelemetry/trace/index.js
index 12c7e95db6..e3013cd2c5 100644
--- a/packages/dd-trace/src/opentelemetry/trace/index.js
+++ b/packages/dd-trace/src/opentelemetry/trace/index.js
@@ -45,6 +45,10 @@ function buildResourceAttributes (config) {
   const { service, version, env, ...filteredTags } = config.tags
   Object.assign(resourceAttributes, filteredTags)
 
+  if (config.OTEL_TRACES_SPAN_METRICS_ENABLED) {
+    resourceAttributes['_dd.stats_computed'] = 'true'
+  }
+
   return resourceAttributes
 }
 
diff --git a/packages/dd-trace/src/opentelemetry/tracer_provider.js b/packages/dd-trace/src/opentelemetry/tracer_provider.js
index 4baf9d1210..32e20b76c6 100644
--- a/packages/dd-trace/src/opentelemetry/tracer_provider.js
+++ b/packages/dd-trace/src/opentelemetry/tracer_provider.js
@@ -68,7 +68,7 @@ class TracerProvider {
       return Promise.reject(new Error('Not started'))
     }
 
-    exporter._writer.flush()
+    exporter._writer?.flush()
     return this._activeProcessor.forceFlush()
   }
 
diff --git a/packages/dd-trace/src/opentracing/tracer.js b/packages/dd-trace/src/opentracing/tracer.js
index 7dd3ce9c52..e52a783ee7 100644
--- a/packages/dd-trace/src/opentracing/tracer.js
+++ b/packages/dd-trace/src/opentracing/tracer.js
@@ -45,7 +45,12 @@ class DatadogTracer {
       this._exporter = new Exporter(config, this._prioritySampler)
     }
 
-    this._processor = new SpanProcessor(this._exporter, this._prioritySampler, config)
+    let otlpStatsExporter
+    if (config.OTEL_TRACES_SPAN_METRICS_ENABLED) {
+      const { createOtlpSpanStatsExporter } = require('../opentelemetry/metrics')
+      otlpStatsExporter = createOtlpSpanStatsExporter(config)
+    }
+    this._processor = new SpanProcessor(this._exporter, this._prioritySampler, config, otlpStatsExporter)
     this._url = this._exporter._url
     this._enableGetRumData = config.experimental.enableGetRumData
     this._traceId128BitGenerationEnabled = config.traceId128BitGenerationEnabled
diff --git a/packages/dd-trace/src/span_processor.js b/packages/dd-trace/src/span_processor.js
index aa6c9a5df8..ab2f8106e0 100644
--- a/packages/dd-trace/src/span_processor.js
+++ b/packages/dd-trace/src/span_processor.js
@@ -11,16 +11,15 @@ const startedSpans = new WeakSet()
 const finishedSpans = new WeakSet()
 
 class SpanProcessor {
-  constructor (exporter, prioritySampler, config) {
+  constructor (exporter, prioritySampler, config, otlpStatsExporter) {
     this._exporter = exporter
     this._prioritySampler = prioritySampler
     this._config = config
     this._killAll = false
 
-    // TODO: This should already have been calculated in `config.js`.
-    if (config.stats.DD_TRACE_STATS_COMPUTATION_ENABLED && !config.appsec.standalone?.enabled) {
+    if (config.stats?.DD_TRACE_STATS_COMPUTATION_ENABLED && !config.appsec?.standalone?.enabled) {
       const { SpanStatsProcessor } = require('./span_stats')
-      this._stats = new SpanStatsProcessor(config)
+      this._stats = new SpanStatsProcessor(config, otlpStatsExporter)
     }
 
     this._spanSampler = new SpanSampler(config.sampler)
diff --git a/packages/dd-trace/src/span_stats.js b/packages/dd-trace/src/span_stats.js
index fdcd98bf39..7bdd8c3f04 100644
--- a/packages/dd-trace/src/span_stats.js
+++ b/packages/dd-trace/src/span_stats.js
@@ -10,8 +10,10 @@ const {
   HTTP_ENDPOINT,
   HTTP_ROUTE,
   HTTP_METHOD,
+  SPAN_KIND,
+  GRPC_STATUS_CODE,
 } = require('../../../ext/tags')
-const { ORIGIN_KEY, TOP_LEVEL_KEY, SVC_SRC_KEY } = require('./constants')
+const { ORIGIN_KEY, TOP_LEVEL_KEY, SVC_SRC_KEY, GRPC_STATUS_NAMES } = require('./constants')
 const { version } = require('./pkg')
 const processTags = require('./process-tags')
 
@@ -27,43 +29,32 @@ class SpanAggStats {
     this.aggKey = aggKey
     this.hits = 0
     this.topLevelHits = 0
-    this.errors = 0
-    this.duration = 0
-    this.okDistribution = new LogCollapsingLowestDenseDDSketch()
-    this.errorDistribution = new LogCollapsingLowestDenseDDSketch()
+    this.topLevelOkDistribution = new LogCollapsingLowestDenseDDSketch()
+    this.topLevelErrorDistribution = new LogCollapsingLowestDenseDDSketch()
+    this.nonTopLevelOkDistribution = new LogCollapsingLowestDenseDDSketch()
+    this.nonTopLevelErrorDistribution = new LogCollapsingLowestDenseDDSketch()
   }
 
   record (span) {
     const durationNs = span.duration
     this.hits++
-    this.duration += durationNs
-
-    if (span.metrics[TOP_LEVEL_KEY]) {
-      this.topLevelHits++
-    }
-
+    const isTopLevel = Boolean(span.metrics[TOP_LEVEL_KEY])
+    if (isTopLevel) this.topLevelHits++
     if (span.error) {
-      this.errors++
-      this.errorDistribution.accept(durationNs)
+      if (isTopLevel) this.topLevelErrorDistribution.accept(durationNs)
+      else this.nonTopLevelErrorDistribution.accept(durationNs)
     } else {
-      this.okDistribution.accept(durationNs)
+      if (isTopLevel) this.topLevelOkDistribution.accept(durationNs)
+      else this.nonTopLevelOkDistribution.accept(durationNs)
     }
   }
 
   toJSON () {
     const {
-      name,
-      service,
-      resource,
-      type,
-      statusCode,
-      synthetics,
-      method,
-      endpoint,
-      srvSrc,
+      name, service, resource, type, statusCode, synthetics, method, endpoint, srvSrc,
+      spanKind, rpcStatusCode,
     } = this.aggKey
-
-    return {
+    const base = {
       Name: name,
       Service: service,
       Resource: resource,
@@ -73,13 +64,34 @@ class SpanAggStats {
       HTTPMethod: method,
       HTTPEndpoint: endpoint,
       srv_src: srvSrc,
-      Hits: this.hits,
-      TopLevelHits: this.topLevelHits,
-      Errors: this.errors,
-      Duration: this.duration,
-      OkSummary: this.okDistribution.toProto(), // TODO: custom proto encoding
-      ErrorSummary: this.errorDistribution.toProto(), // TODO: custom proto encoding
+      SpanKind: spanKind,
+      GRPCStatusCode: rpcStatusCode,
+    }
+    const rows = []
+    if (this.topLevelHits > 0) {
+      rows.push({
+        ...base,
+        Hits: this.topLevelHits,
+        TopLevelHits: this.topLevelHits,
+        Errors: this.topLevelErrorDistribution.count,
+        Duration: this.topLevelOkDistribution.sum + this.topLevelErrorDistribution.sum,
+        OkSummary: this.topLevelOkDistribution.toProto(),
+        ErrorSummary: this.topLevelErrorDistribution.toProto(),
+      })
+    }
+    const nonTopLevelHits = this.hits - this.topLevelHits
+    if (nonTopLevelHits > 0) {
+      rows.push({
+        ...base,
+        Hits: nonTopLevelHits,
+        TopLevelHits: 0,
+        Errors: this.nonTopLevelErrorDistribution.count,
+        Duration: this.nonTopLevelOkDistribution.sum + this.nonTopLevelErrorDistribution.sum,
+        OkSummary: this.nonTopLevelOkDistribution.toProto(), // TODO: custom proto encoding
+        ErrorSummary: this.nonTopLevelErrorDistribution.toProto(), // TODO: custom proto encoding
+      })
     }
+    return rows
   }
 }
 
@@ -94,6 +106,12 @@ class SpanAggKey {
     this.endpoint = span.meta[HTTP_ROUTE] || span.meta[HTTP_ENDPOINT] || ''
     this.method = span.meta[HTTP_METHOD] || ''
     this.srvSrc = span.meta[SVC_SRC_KEY] || ''
+    this.spanKind = span.meta[SPAN_KIND] || ''
+    // dd gRPC plugin sets a numeric code via setTag; OTel/manual sets a string name via meta.
+    const grpcCode = span.meta[GRPC_STATUS_CODE] ?? span.metrics?.[GRPC_STATUS_CODE]
+    this.rpcStatusCode = typeof grpcCode === 'number'
+      ? (GRPC_STATUS_NAMES[grpcCode] ?? String(grpcCode))
+      : (grpcCode ?? '')
   }
 
   toString () {
@@ -107,6 +125,8 @@ class SpanAggKey {
       this.method,
       this.endpoint,
       this.srvSrc,
+      this.spanKind,
+      this.rpcStatusCode,
     ].join(',')
   }
 }
@@ -139,55 +159,58 @@ class SpanStatsProcessor {
     stats: {
       DD_TRACE_STATS_COMPUTATION_ENABLED: enabled = false,
       interval = 10,
-    },
+    } = {},
     hostname,
     port,
     url,
     env,
     tags,
-    version,
-  } = {}) {
-    this.exporter = new SpanStatsExporter({
-      hostname,
-      port,
-      tags,
-      url,
-    })
-    this.interval = interval
-    this.bucketSizeNs = interval * 1e9
+    version: appVersion,
+    _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL: flushIntervalMs,
+  } = {}, otlpExporter) {
+    if (!otlpExporter) {
+      this.exporter = new SpanStatsExporter({ hostname, port, tags, url })
+    }
+    const intervalMs = otlpExporter ? (flushIntervalMs ?? 10_000) : interval * 1e3
+    this.interval = intervalMs / 1e3
+    this.bucketSizeNs = intervalMs * 1e6
     this.buckets = new TimeBuckets()
     this.hostname = os.hostname()
     this.enabled = enabled
+    this.otlpExporter = otlpExporter || null
     this.env = env
     this.tags = tags || {}
     this.sequence = 0
-    this.version = version
+    this.version = appVersion
 
-    if (this.enabled) {
-      this.timer = setInterval(this.onInterval.bind(this), interval * 1e3)
+    if (this.enabled || this.otlpExporter) {
+      this.timer = setInterval(this.onInterval.bind(this), intervalMs)
       this.timer.unref?.()
     }
   }
 
   onInterval () {
-    const serialized = this._serializeBuckets()
-    if (!serialized) return
-
-    this.exporter.export({
-      Hostname: this.hostname,
-      Env: this.env,
-      Version: this.version || version,
-      Stats: serialized,
-      Lang: 'javascript',
-      TracerVersion: pkg.version,
-      RuntimeID: this.tags['runtime-id'],
-      Sequence: ++this.sequence,
-      ProcessTags: processTags.serialized,
-    })
+    const drained = this.#drainBuckets()
+
+    if (this.enabled && !this.otlpExporter) {
+      this.exporter.export({
+        Hostname: this.hostname,
+        Env: this.env,
+        Version: this.version || version,
+        Stats: this.#toV06Payload(drained),
+        Lang: 'javascript',
+        TracerVersion: pkg.version,
+        RuntimeID: this.tags['runtime-id'],
+        Sequence: ++this.sequence,
+        ProcessTags: processTags.serialized,
+      })
+    } else if (this.otlpExporter && drained.length > 0) {
+      this.otlpExporter.export(drained, this.bucketSizeNs)
+    }
   }
 
   onSpanFinished (span) {
-    if (!this.enabled) return
+    if (!this.enabled && !this.otlpExporter) return
     if (!span.metrics[TOP_LEVEL_KEY] && !span.metrics[MEASURED]) return
 
     const spanEndNs = span.start + span.duration
@@ -198,27 +221,22 @@ class SpanStatsProcessor {
       .record(span)
   }
 
-  _serializeBuckets () {
-    const { bucketSizeNs } = this
-    const serializedBuckets = []
-
+  #drainBuckets () {
+    const drained = []
     for (const [timeNs, bucket] of this.buckets.entries()) {
-      const bucketAggStats = []
-
-      for (const stats of bucket.values()) {
-        bucketAggStats.push(stats.toJSON())
-      }
-
-      serializedBuckets.push({
-        Start: timeNs,
-        Duration: bucketSizeNs,
-        Stats: bucketAggStats,
-      })
+      drained.push({ timeNs, bucket })
     }
-
     this.buckets.clear()
+    return drained
+  }
 
-    return serializedBuckets
+  #toV06Payload (drained) {
+    const { bucketSizeNs } = this
+    return drained.map(({ timeNs, bucket }) => ({
+      Start: timeNs,
+      Duration: bucketSizeNs,
+      Stats: [...bucket.values()].flatMap(stats => stats.toJSON()),
+    }))
   }
 }
 
diff --git a/packages/dd-trace/test/config/index.spec.js b/packages/dd-trace/test/config/index.spec.js
index d77ecb0005..ef333b5a47 100644
--- a/packages/dd-trace/test/config/index.spec.js
+++ b/packages/dd-trace/test/config/index.spec.js
@@ -782,6 +782,33 @@ describe('Config', () => {
     assert.strictEqual(config.sampleRate, 0.5)
   })
 
+  it('auto-enables OTEL_TRACES_SPAN_METRICS_ENABLED when OTEL_TRACES_EXPORTER=otlp and DD_METRICS_OTEL_ENABLED', () => {
+    process.env.OTEL_TRACES_EXPORTER = 'otlp'
+    process.env.DD_METRICS_OTEL_ENABLED = 'true'
+    const config = getConfig()
+    assert.strictEqual(config.OTEL_TRACES_SPAN_METRICS_ENABLED, true)
+  })
+
+  it('should not auto-enable OTEL_TRACES_SPAN_METRICS_ENABLED when OTEL_TRACES_EXPORTER is not otlp', () => {
+    process.env.DD_METRICS_OTEL_ENABLED = 'true'
+    const config = getConfig()
+    assert.strictEqual(config.OTEL_TRACES_SPAN_METRICS_ENABLED, false)
+  })
+
+  it('should not auto-enable OTEL_TRACES_SPAN_METRICS_ENABLED when DD_METRICS_OTEL_ENABLED is false', () => {
+    process.env.OTEL_TRACES_EXPORTER = 'otlp'
+    const config = getConfig()
+    assert.strictEqual(config.OTEL_TRACES_SPAN_METRICS_ENABLED, false)
+  })
+
+  it('should respect explicit OTEL_TRACES_SPAN_METRICS_ENABLED over auto-enable', () => {
+    process.env.OTEL_TRACES_EXPORTER = 'otlp'
+    process.env.DD_METRICS_OTEL_ENABLED = 'true'
+    process.env.OTEL_TRACES_SPAN_METRICS_ENABLED = 'false'
+    const config = getConfig()
+    assert.strictEqual(config.OTEL_TRACES_SPAN_METRICS_ENABLED, false)
+  })
+
   it('should initialize with the correct defaults', () => {
     const config = getConfig()
 
diff --git a/packages/dd-trace/test/opentelemetry/metrics/otlp_span_stats_exporter.spec.js b/packages/dd-trace/test/opentelemetry/metrics/otlp_span_stats_exporter.spec.js
new file mode 100644
index 0000000000..c1fae32129
--- /dev/null
+++ b/packages/dd-trace/test/opentelemetry/metrics/otlp_span_stats_exporter.spec.js
@@ -0,0 +1,182 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const http = require('node:http')
+const { describe, it, beforeEach, afterEach } = require('mocha')
+const sinon = require('sinon')
+
+require('../../setup/core')
+
+const { OtlpStatsExporter } = require('../../../src/opentelemetry/metrics/otlp_span_stats_exporter')
+const { buildResourceAttributes, createOtlpSpanStatsExporter } = require('../../../src/opentelemetry/metrics')
+const { SpanBuckets } = require('../../../src/span_stats')
+const { HTTP_STATUS_CODE } = require('../../../../../ext/tags')
+
+const RESOURCE_ATTRS = { 'service.name': 'svc' }
+const BUCKET_SIZE_NS = 10 * 1e9
+
+function makeSpan (overrides = {}) {
+  return {
+    startTime: 12345 * 1e9,
+    duration: 1000,
+    error: 0,
+    name: 'op',
+    service: 'svc',
+    resource: 'res',
+    type: 'web',
+    meta: { [HTTP_STATUS_CODE]: 200 },
+    metrics: {},
+    ...overrides,
+  }
+}
+
+function makeDrained (spans) {
+  const bucket = new SpanBuckets()
+  for (const span of spans) {
+    bucket.forSpan(span).record(span)
+  }
+  return [{ timeNs: 12340000000000, bucket }]
+}
+
+describe('buildResourceAttributes', () => {
+  it('includes sdk identity and maps service/env/version to OTel attributes', () => {
+    const attrs = buildResourceAttributes({}, { service: 'my-svc', env: 'prod', serviceVersion: '1.0.0' })
+
+    assert.strictEqual(attrs['telemetry.sdk.name'], 'datadog')
+    assert.strictEqual(attrs['telemetry.sdk.language'], 'nodejs')
+    assert.strictEqual(typeof attrs['telemetry.sdk.version'], 'string')
+    assert.strictEqual(attrs['service.name'], 'my-svc')
+    assert.strictEqual(attrs['deployment.environment.name'], 'prod')
+    assert.strictEqual(attrs['service.version'], '1.0.0')
+  })
+
+  it('includes datadog.runtime_id from tags when otelSemanticsEnabled is false', () => {
+    const attrs = buildResourceAttributes({ 'runtime-id': 'abc-123' }, { otelSemanticsEnabled: false })
+    assert.strictEqual(attrs['datadog.runtime_id'], 'abc-123')
+  })
+
+  it('omits dd.* attributes when otelSemanticsEnabled is true', () => {
+    const attrs = buildResourceAttributes({ 'runtime-id': 'abc-123' }, { otelSemanticsEnabled: true })
+    assert.ok(!Object.keys(attrs).some(k => k.startsWith('datadog.')))
+  })
+})
+
+describe('createOtlpSpanStatsExporter', () => {
+  let httpStub
+
+  beforeEach(() => {
+    httpStub = sinon.stub(http, 'request').returns({
+      write: sinon.stub(), end: sinon.stub(), on: sinon.stub(), once: sinon.stub(),
+    })
+  })
+
+  afterEach(() => httpStub.restore())
+
+  it('returns an OtlpStatsExporter configured from config', () => {
+    const exporter = createOtlpSpanStatsExporter({
+      OTEL_EXPORTER_OTLP_METRICS_ENDPOINT: 'http://localhost:4318/v1/metrics',
+      service: 'svc',
+    })
+    assert.ok(exporter instanceof OtlpStatsExporter)
+  })
+})
+
+describe('OtlpStatsExporter', () => {
+  let exporter
+  let httpStub
+  let mockReq
+
+  beforeEach(() => {
+    mockReq = {
+      write: sinon.stub(),
+      end: sinon.stub(),
+      on: sinon.stub(),
+      once: sinon.stub(),
+    }
+
+    httpStub = sinon.stub(http, 'request').callsFake((options, callback) => {
+      const mockRes = {
+        statusCode: 200,
+        on: sinon.stub(),
+        once: (event, handler) => {
+          if (event === 'end') handler()
+          return mockRes
+        },
+      }
+      if (callback) callback(mockRes)
+      return mockReq
+    })
+
+    exporter = new OtlpStatsExporter('http://localhost:4318/v1/metrics', 'http/json', RESOURCE_ATTRS)
+  })
+
+  afterEach(() => {
+    httpStub.restore()
+  })
+
+  it('sends a POST to /v1/metrics', () => {
+    const drained = makeDrained([makeSpan()])
+    exporter.export(drained, BUCKET_SIZE_NS)
+
+    assert.ok(httpStub.calledOnce)
+    const options = httpStub.firstCall.args[0]
+    assert.strictEqual(options.method, 'POST')
+    assert.strictEqual(options.path, '/v1/metrics')
+  })
+
+  it('sends a JSON payload containing the single duration histogram metric', () => {
+    const drained = makeDrained([makeSpan()])
+    exporter.export(drained, BUCKET_SIZE_NS)
+
+    const payload = JSON.parse(mockReq.write.firstCall.args[0].toString())
+    const { metrics } = payload.resourceMetrics[0].scopeMetrics[0]
+    assert.strictEqual(metrics.length, 1)
+    assert.strictEqual(metrics[0].name, 'traces.span.sdk.metrics.duration')
+  })
+
+  it('returns early when drained is empty', () => {
+    exporter.export([], BUCKET_SIZE_NS)
+    assert.ok(httpStub.notCalled)
+  })
+
+  it('uses http/json Content-Type', () => {
+    const drained = makeDrained([makeSpan()])
+    exporter.export(drained, BUCKET_SIZE_NS)
+
+    const options = httpStub.firstCall.args[0]
+    assert.strictEqual(options.headers['Content-Type'], 'application/json')
+  })
+
+  it('uses http/protobuf Content-Type when protocol is http/protobuf', () => {
+    const protoExporter = new OtlpStatsExporter('http://localhost:4318/v1/metrics', 'http/protobuf', RESOURCE_ATTRS)
+    const drained = makeDrained([makeSpan()])
+    protoExporter.export(drained, BUCKET_SIZE_NS)
+
+    const options = httpStub.firstCall.args[0]
+    assert.strictEqual(options.headers['Content-Type'], 'application/x-protobuf')
+  })
+
+  it('logs an error on non-2xx HTTP response', () => {
+    httpStub.callsFake((options, callback) => {
+      const mockRes = {
+        statusCode: 500,
+        on: (event, handler) => { if (event === 'data') handler('err body') },
+        once: (event, handler) => { if (event === 'end') handler() },
+      }
+      if (callback) callback(mockRes)
+      return mockReq
+    })
+
+    const drained = makeDrained([makeSpan()])
+    exporter.export(drained, BUCKET_SIZE_NS)
+    assert.ok(httpStub.calledOnce)
+  })
+
+  it('handles request error without throwing', () => {
+    mockReq.on = (event, handler) => { if (event === 'error') handler(new Error('connection refused')) }
+
+    const drained = makeDrained([makeSpan()])
+    exporter.export(drained, BUCKET_SIZE_NS)
+    assert.ok(httpStub.calledOnce)
+  })
+})
diff --git a/packages/dd-trace/test/opentelemetry/metrics/otlp_span_stats_transformer.spec.js b/packages/dd-trace/test/opentelemetry/metrics/otlp_span_stats_transformer.spec.js
new file mode 100644
index 0000000000..7fcb44e324
--- /dev/null
+++ b/packages/dd-trace/test/opentelemetry/metrics/otlp_span_stats_transformer.spec.js
@@ -0,0 +1,323 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const { describe, it, before } = require('mocha')
+
+require('../../setup/core')
+
+const OtlpStatsTransformer = require('../../../src/opentelemetry/metrics/otlp_span_stats_transformer')
+const { EXPLICIT_BOUNDS_SECONDS } = OtlpStatsTransformer
+const { SpanBuckets } = require('../../../src/span_stats')
+const { getProtobufTypes } = require('../../../src/opentelemetry/otlp/protobuf_loader')
+const { HTTP_STATUS_CODE, HTTP_METHOD, HTTP_ROUTE, SPAN_KIND, GRPC_STATUS_CODE } = require('../../../../../ext/tags')
+const { ORIGIN_KEY, TOP_LEVEL_KEY } = require('../../../src/constants')
+
+const METRIC_NAME = 'traces.span.sdk.metrics.duration'
+const RESOURCE_ATTRS = {
+  'telemetry.sdk.name': 'datadog',
+  'telemetry.sdk.language': 'nodejs',
+  'service.name': 'svc',
+  'service.version': '1.2.3',
+  'deployment.environment.name': 'test',
+}
+const DEFAULT_SERVICE = 'svc'
+const BUCKET_SIZE_NS = 10 * 1e9
+
+function makeSpan (overrides = {}) {
+  return {
+    startTime: 12345 * 1e9,
+    duration: 1000,
+    error: 0,
+    name: 'test.op',
+    service: 'svc',
+    resource: 'GET /foo',
+    type: 'web',
+    meta: { [HTTP_STATUS_CODE]: 200 },
+    metrics: {},
+    ...overrides,
+  }
+}
+
+function makeTopLevelSpan (overrides = {}) {
+  return makeSpan({ metrics: { [TOP_LEVEL_KEY]: 1 }, ...overrides })
+}
+
+function makeBucket (spans) {
+  const bucket = new SpanBuckets()
+  for (const span of spans) {
+    bucket.forSpan(span).record(span)
+  }
+  return bucket
+}
+
+function makeDrained (timeNs, spans) {
+  return [{ timeNs, bucket: makeBucket(spans) }]
+}
+
+/**
+ * @param {object} dataPoint
+ * @returns {Record<string, string | number | boolean>}
+ */
+function attrMapOf (dataPoint) {
+  return Object.fromEntries(dataPoint.attributes.map(a => {
+    const v = a.value
+    return [a.key, v.stringValue ?? v.boolValue ?? v.intValue ?? v.doubleValue]
+  }))
+}
+
+function dataPointsOf (payload) {
+  return payload.resourceMetrics[0].scopeMetrics[0].metrics[0].histogram.dataPoints
+}
+
+describe('OtlpStatsTransformer', () => {
+  let protoMetricsService
+  let protoAggregationTemporality
+
+  before(() => {
+    ({ protoMetricsService, protoAggregationTemporality } = getProtobufTypes())
+  })
+
+  describe('JSON format (default mode)', () => {
+    let transformer
+
+    before(() => {
+      transformer = new OtlpStatsTransformer(RESOURCE_ATTRS, 'http/json', false, DEFAULT_SERVICE)
+    })
+
+    it('emits a single histogram metric with the correct name, unit and temporality', () => {
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, [makeSpan()]), BUCKET_SIZE_NS))
+      const { metrics } = payload.resourceMetrics[0].scopeMetrics[0]
+
+      assert.strictEqual(metrics.length, 1)
+      assert.deepStrictEqual(
+        { name: metrics[0].name, unit: metrics[0].unit, temporality: metrics[0].histogram.aggregationTemporality },
+        { name: METRIC_NAME, unit: 's', temporality: 'AGGREGATION_TEMPORALITY_DELTA' }
+      )
+    })
+
+    it('maps span dimensions to OTel and dd.* data-point attributes', () => {
+      const span = makeSpan({
+        meta: {
+          [HTTP_STATUS_CODE]: 404,
+          [HTTP_METHOD]: 'POST',
+          [HTTP_ROUTE]: '/users/:id',
+          [SPAN_KIND]: 'server',
+          [GRPC_STATUS_CODE]: 'OK',
+          [ORIGIN_KEY]: 'synthetics',
+        },
+      })
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, [span]), BUCKET_SIZE_NS))
+
+      assert.deepStrictEqual(attrMapOf(dataPointsOf(payload)[0]), {
+        'span.name': 'GET /foo',
+        'span.kind': 'server',
+        'http.response.status_code': 404,
+        'http.request.method': 'POST',
+        'http.route': '/users/:id',
+        'rpc.response.status_code': 'OK',
+        'datadog.operation.name': 'test.op',
+        'datadog.span.type': 'web',
+        'datadog.origin': 'synthetics',
+        'datadog.span.top_level': false,
+      })
+    })
+
+    it('emits the raw grpc.status.code name upper-cased as rpc.response.status_code', () => {
+      const span = makeSpan({ meta: { [GRPC_STATUS_CODE]: 'not_found' }, metrics: {} })
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, [span]), BUCKET_SIZE_NS))
+
+      assert.strictEqual(attrMapOf(dataPointsOf(payload)[0])['rpc.response.status_code'], 'NOT_FOUND')
+    })
+
+    it('translates numeric grpc.status.code from metrics to the canonical status name', () => {
+      const span = makeSpan({ meta: {}, metrics: { [GRPC_STATUS_CODE]: 14 } })
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, [span]), BUCKET_SIZE_NS))
+
+      assert.strictEqual(attrMapOf(dataPointsOf(payload)[0])['rpc.response.status_code'], 'UNAVAILABLE')
+    })
+
+    it('omits optional attributes when not present on the span', () => {
+      const payload = JSON.parse(
+        transformer.transform(makeDrained(12340000000000, [makeSpan({ meta: {} })]), BUCKET_SIZE_NS)
+      )
+      const keys = dataPointsOf(payload)[0].attributes.map(a => a.key)
+
+      for (const key of ['http.response.status_code', 'http.request.method', 'http.route', 'span.kind']) {
+        assert.ok(!keys.includes(key), `${key} should be omitted`)
+      }
+    })
+
+    it('converts duration to seconds with fixed bounds and a sketch-derived distribution', () => {
+      const spans = [makeSpan({ duration: 1e9 }), makeSpan({ duration: 3e9 })]
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, spans), BUCKET_SIZE_NS))
+      const dp = dataPointsOf(payload)[0]
+
+      assert.strictEqual(dp.count, 2)
+      assert.strictEqual(dp.min, 1)
+      assert.strictEqual(dp.max, 3)
+      assert.strictEqual(dp.sum, 4)
+      assert.deepStrictEqual(dp.explicitBounds, EXPLICIT_BOUNDS_SECONDS)
+      assert.strictEqual(dp.bucketCounts.length, EXPLICIT_BOUNDS_SECONDS.length + 1)
+      assert.strictEqual(dp.bucketCounts.reduce((a, b) => a + b, 0), 2)
+      assert.strictEqual(dp.bucketCounts.filter(c => c > 0).length, 2)
+    })
+
+    it('marks error data points with status.code=ERROR and ok data points without it', () => {
+      const spans = [makeTopLevelSpan(), makeTopLevelSpan({ error: 1 })]
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, spans), BUCKET_SIZE_NS))
+      const points = dataPointsOf(payload)
+
+      const ok = points.find(dp => attrMapOf(dp)['datadog.span.top_level'] === true && !attrMapOf(dp)['status.code'])
+      const err = points.find(dp => attrMapOf(dp)['status.code'] === 2)
+      assert.ok(ok, 'ok data point should carry no status.code')
+      assert.strictEqual(attrMapOf(err)['datadog.span.top_level'], true)
+    })
+
+    it('emits at most two data points per group (ok + error) tagged top-level when all hits are top-level', () => {
+      const spans = [makeTopLevelSpan(), makeTopLevelSpan(), makeTopLevelSpan({ error: 1 })]
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, spans), BUCKET_SIZE_NS))
+      const points = dataPointsOf(payload)
+
+      assert.strictEqual(points.length, 2)
+      const ok = points.find(dp => !attrMapOf(dp)['status.code'])
+      const err = points.find(dp => attrMapOf(dp)['status.code'] === 2)
+      assert.strictEqual(ok.count, 2)
+      assert.strictEqual(err.count, 1)
+      assert.strictEqual(attrMapOf(ok)['datadog.span.top_level'], true)
+      assert.strictEqual(attrMapOf(err)['datadog.span.top_level'], true)
+    })
+
+    it('emits separate data points for top-level and non-top-level spans sharing the same dimensions', () => {
+      const spans = [makeSpan(), makeTopLevelSpan()]
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, spans), BUCKET_SIZE_NS))
+      const points = dataPointsOf(payload)
+
+      assert.strictEqual(points.length, 2)
+      const topLevelPoint = points.find(dp => attrMapOf(dp)['datadog.span.top_level'] === true)
+      const nonTopLevelPoint = points.find(dp => attrMapOf(dp)['datadog.span.top_level'] === false)
+      assert.ok(topLevelPoint, 'top-level data point should exist')
+      assert.ok(nonTopLevelPoint, 'non-top-level data point should exist')
+      assert.strictEqual(topLevelPoint.count, 1)
+      assert.strictEqual(nonTopLevelPoint.count, 1)
+    })
+
+    it('omits data points with zero count', () => {
+      const payload = JSON.parse(
+        transformer.transform(makeDrained(12340000000000, [makeTopLevelSpan({ error: 1 })]), BUCKET_SIZE_NS)
+      )
+      assert.strictEqual(dataPointsOf(payload).length, 1)
+    })
+
+    it('reports service identity on the resource and emits no InstrumentationScope', () => {
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, [makeSpan()]), BUCKET_SIZE_NS))
+      const resourceAttrs = Object.fromEntries(
+        payload.resourceMetrics[0].resource.attributes.map(a => [a.key, a.value.stringValue])
+      )
+      const scopeMetrics = payload.resourceMetrics[0].scopeMetrics[0]
+
+      assert.ok(!('scope' in scopeMetrics), 'no InstrumentationScope should be emitted')
+      assert.strictEqual(resourceAttrs['service.name'], 'svc')
+      assert.strictEqual(resourceAttrs['service.version'], '1.2.3')
+      assert.strictEqual(resourceAttrs['deployment.environment.name'], 'test')
+    })
+
+    it('emits a single scopeMetrics and tags data points whose service differs from the default', () => {
+      const drained = makeDrained(12340000000000, [
+        makeSpan({ service: 'svc', resource: 'GET /foo' }),
+        makeSpan({ service: 'svc-other', resource: 'GET /bar' }),
+      ])
+      const payload = JSON.parse(transformer.transform(drained, BUCKET_SIZE_NS))
+      const scopeMetrics = payload.resourceMetrics[0].scopeMetrics
+
+      assert.strictEqual(scopeMetrics.length, 1)
+      assert.ok(!('scope' in scopeMetrics[0]), 'no InstrumentationScope should be emitted')
+      const serviceByResource = Object.fromEntries(
+        dataPointsOf(payload).map(dp => [attrMapOf(dp)['span.name'], attrMapOf(dp)['service.name']])
+      )
+      assert.strictEqual(serviceByResource['GET /foo'], undefined)
+      assert.strictEqual(serviceByResource['GET /bar'], 'svc-other')
+    })
+
+    it('sets timestamps from the bucket time and size', () => {
+      const timeNs = 12340000000000
+      const dp = dataPointsOf(JSON.parse(transformer.transform(makeDrained(timeNs, [makeSpan()]), BUCKET_SIZE_NS)))[0]
+
+      assert.deepStrictEqual(
+        { start: dp.startTimeUnixNano, end: dp.timeUnixNano },
+        { start: String(timeNs), end: String(timeNs + BUCKET_SIZE_NS) }
+      )
+    })
+
+    it('handles multiple time buckets', () => {
+      const drained = [
+        { timeNs: 12340000000000, bucket: makeBucket([makeSpan()]) },
+        { timeNs: 12350000000000, bucket: makeBucket([makeSpan()]) },
+      ]
+      const payload = JSON.parse(transformer.transform(drained, BUCKET_SIZE_NS))
+      assert.strictEqual(dataPointsOf(payload).length, 2)
+    })
+  })
+
+  describe('JSON format (OTel-semantics mode)', () => {
+    let transformer
+
+    before(() => {
+      transformer = new OtlpStatsTransformer(RESOURCE_ATTRS, 'http/json', true, DEFAULT_SERVICE)
+    })
+
+    it('emits only OTel attributes (no dd.*) while keeping status.code on errors', () => {
+      const span = makeTopLevelSpan({
+        error: 1,
+        meta: { [HTTP_STATUS_CODE]: 500, [HTTP_METHOD]: 'GET' },
+      })
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, [span]), BUCKET_SIZE_NS))
+      const attrs = attrMapOf(dataPointsOf(payload)[0])
+
+      assert.ok(
+        !Object.keys(attrs).some(k => k.startsWith('datadog.')),
+        'no datadog.* attributes in OTel-semantics mode'
+      )
+      assert.deepStrictEqual(
+        { name: attrs['span.name'], method: attrs['http.request.method'], status: attrs['status.code'] },
+        { name: 'GET /foo', method: 'GET', status: 2 }
+      )
+    })
+  })
+
+  describe('protobuf format', () => {
+    let transformer
+
+    before(() => {
+      transformer = new OtlpStatsTransformer(RESOURCE_ATTRS, 'http/protobuf', false, DEFAULT_SERVICE)
+    })
+
+    it('emits a valid ExportMetricsServiceRequest with a single duration metric', () => {
+      const buf = transformer.transform(makeDrained(12340000000000, [makeSpan()]), BUCKET_SIZE_NS)
+      assert.ok(Buffer.isBuffer(buf))
+
+      const metrics = protoMetricsService.decode(buf).resourceMetrics[0].scopeMetrics[0].metrics
+      assert.strictEqual(metrics.length, 1)
+      assert.strictEqual(metrics[0].name, METRIC_NAME)
+    })
+
+    it('uses delta temporality and native typed attribute values', () => {
+      const delta = protoAggregationTemporality.values.AGGREGATION_TEMPORALITY_DELTA
+      const spans = [makeSpan({ resource: 'GET /a' }), makeTopLevelSpan({ error: 1, resource: 'GET /b' })]
+      const buf = transformer.transform(makeDrained(12340000000000, spans), BUCKET_SIZE_NS)
+      const decoded = protoMetricsService.decode(buf)
+      const metric = decoded.resourceMetrics[0].scopeMetrics[0].metrics[0]
+
+      assert.strictEqual(metric.histogram.aggregationTemporality, delta)
+      const okNotTopLevel = metric.histogram.dataPoints.find(dp =>
+        dp.attributes.some(a => a.key === 'datadog.span.top_level' && a.value.boolValue === false) &&
+        !dp.attributes.some(a => a.key === 'status.code')
+      )
+      const errTopLevel = metric.histogram.dataPoints.find(dp =>
+        dp.attributes.some(a => a.key === 'status.code' && Number(a.value.intValue) === 2) &&
+        dp.attributes.some(a => a.key === 'datadog.span.top_level' && a.value.boolValue === true)
+      )
+      assert.ok(okNotTopLevel, 'should have ok not-top-level data point')
+      assert.ok(errTopLevel, 'should have error top-level data point')
+    })
+  })
+})
diff --git a/packages/dd-trace/test/span_stats.spec.js b/packages/dd-trace/test/span_stats.spec.js
index 166fd68873..8ba57d5142 100644
--- a/packages/dd-trace/test/span_stats.spec.js
+++ b/packages/dd-trace/test/span_stats.spec.js
@@ -83,6 +83,10 @@ const exporter = {
 
 const SpanStatsExporter = sinon.stub().returns(exporter)
 
+const otlpExporter = {
+  export: sinon.stub(),
+}
+
 const {
   SpanAggStats,
   SpanAggKey,
@@ -98,22 +102,25 @@ const {
 describe('SpanAggKey', () => {
   it('should make aggregation key for a basic span', () => {
     const key = new SpanAggKey(basicSpan)
-    assert.strictEqual(key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,,,integration')
+    assert.strictEqual(
+      key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,,,integration,,')
   })
 
   it('should make aggregation key for a synthetic span', () => {
     const key = new SpanAggKey(syntheticSpan)
-    assert.strictEqual(key.toString(), 'synthetic-span,service-name,resource-name,span-type,200,true,,,integration')
+    assert.strictEqual(
+      key.toString(), 'synthetic-span,service-name,resource-name,span-type,200,true,,,integration,,')
   })
 
   it('should make aggregation key for an error span', () => {
     const key = new SpanAggKey(errorSpan)
-    assert.strictEqual(key.toString(), 'error-span,service-name,resource-name,span-type,500,false,,,integration')
+    assert.strictEqual(
+      key.toString(), 'error-span,service-name,resource-name,span-type,500,false,,,integration,,')
   })
 
   it('should use sensible defaults', () => {
     const key = new SpanAggKey({ meta: {}, metrics: {} })
-    assert.strictEqual(key.toString(), `${DEFAULT_SPAN_NAME},${DEFAULT_SERVICE_NAME},,,0,false,,,`)
+    assert.strictEqual(key.toString(), `${DEFAULT_SPAN_NAME},${DEFAULT_SERVICE_NAME},,,0,false,,,,,`)
   })
 
   it('should include HTTP method and route in aggregation key', () => {
@@ -127,7 +134,7 @@ describe('SpanAggKey', () => {
     }
     const key = new SpanAggKey(span)
     assert.strictEqual(
-      key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,GET,/users/:id,integration')
+      key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,GET,/users/:id,integration,,')
   })
 
   it('should include HTTP method and endpoint in aggregation key', () => {
@@ -141,7 +148,8 @@ describe('SpanAggKey', () => {
     }
     const key = new SpanAggKey(span)
     assert.strictEqual(
-      key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,POST,/users/{param:int},integration')
+      key.toString(),
+      'basic-span,service-name,resource-name,span-type,200,false,POST,/users/{param:int},integration,,')
   })
 
   it('should prioritize http.route over http.endpoint', () => {
@@ -156,7 +164,7 @@ describe('SpanAggKey', () => {
     }
     const key = new SpanAggKey(span)
     assert.strictEqual(
-      key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,GET,/users/:id,integration')
+      key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,GET,/users/:id,integration,,')
   })
 
   it('should include service source in aggregation key', () => {
@@ -169,7 +177,7 @@ describe('SpanAggKey', () => {
     }
     const key = new SpanAggKey(span)
     assert.strictEqual(
-      key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,,,opt.plugin')
+      key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,,,opt.plugin,,')
   })
 })
 
@@ -183,7 +191,7 @@ describe('SpanAggStats', () => {
     const errorDistribution = new LogCollapsingLowestDenseDDSketch(0.00775)
     okDistribution.accept(basicSpan.duration)
 
-    assert.deepStrictEqual(aggStats.toJSON(), {
+    assert.deepStrictEqual(aggStats.toJSON(), [{
       Name: aggKey.name,
       Type: aggKey.type,
       Resource: aggKey.resource,
@@ -193,13 +201,16 @@ describe('SpanAggStats', () => {
       HTTPMethod: aggKey.method,
       HTTPEndpoint: aggKey.endpoint,
       srv_src: aggKey.srvSrc,
+      SpanKind: aggKey.spanKind,
+
+      GRPCStatusCode: aggKey.rpcStatusCode,
       Hits: 1,
       TopLevelHits: 0,
       Errors: 0,
       Duration: basicSpan.duration,
       OkSummary: okDistribution.toProto(),
       ErrorSummary: errorDistribution.toProto(),
-    })
+    }])
   })
 
   it('should record a top-level span', () => {
@@ -211,7 +222,7 @@ describe('SpanAggStats', () => {
     const errorDistribution = new LogCollapsingLowestDenseDDSketch(0.00775)
     okDistribution.accept(topLevelSpan.duration)
 
-    assert.deepStrictEqual(aggStats.toJSON(), {
+    assert.deepStrictEqual(aggStats.toJSON(), [{
       Name: aggKey.name,
       Type: aggKey.type,
       Resource: aggKey.resource,
@@ -221,13 +232,16 @@ describe('SpanAggStats', () => {
       HTTPMethod: aggKey.method,
       HTTPEndpoint: aggKey.endpoint,
       srv_src: aggKey.srvSrc,
+      SpanKind: aggKey.spanKind,
+
+      GRPCStatusCode: aggKey.rpcStatusCode,
       Hits: 1,
       TopLevelHits: 1,
       Errors: 0,
       Duration: topLevelSpan.duration,
       OkSummary: okDistribution.toProto(),
       ErrorSummary: errorDistribution.toProto(),
-    })
+    }])
   })
 
   it('should record an error span', () => {
@@ -239,7 +253,7 @@ describe('SpanAggStats', () => {
     const errorDistribution = new LogCollapsingLowestDenseDDSketch(0.00775)
     errorDistribution.accept(errorSpan.duration)
 
-    assert.deepStrictEqual(aggStats.toJSON(), {
+    assert.deepStrictEqual(aggStats.toJSON(), [{
       Name: aggKey.name,
       Type: aggKey.type,
       Resource: aggKey.resource,
@@ -249,13 +263,16 @@ describe('SpanAggStats', () => {
       HTTPMethod: aggKey.method,
       HTTPEndpoint: aggKey.endpoint,
       srv_src: aggKey.srvSrc,
+      SpanKind: aggKey.spanKind,
+
+      GRPCStatusCode: aggKey.rpcStatusCode,
       Hits: 1,
       TopLevelHits: 0,
       Errors: 1,
       Duration: errorSpan.duration,
       OkSummary: okDistribution.toProto(),
       ErrorSummary: errorDistribution.toProto(),
-    })
+    }])
   })
 })
 
@@ -363,7 +380,7 @@ describe('SpanStatsProcessor', () => {
       okDistribution.accept(topLevelSpan.duration)
     }
 
-    assert.deepStrictEqual(spanBucket.toJSON(), {
+    assert.deepStrictEqual(spanBucket.toJSON(), [{
       Name: 'top-level-span',
       Service: 'service-name',
       Resource: 'resource-name',
@@ -373,13 +390,15 @@ describe('SpanStatsProcessor', () => {
       HTTPMethod: '',
       HTTPEndpoint: '',
       srv_src: 'integration',
+      SpanKind: '',
+      GRPCStatusCode: '',
       Hits: n,
       TopLevelHits: n,
       Errors: 0,
       Duration: (topLevelSpan.duration) * n,
       OkSummary: okDistribution.toProto(),
       ErrorSummary: errorDistribution.toProto(),
-    })
+    }])
   })
 
   it('should bucket by the formatted span start, not the missing startTime field', () => {
@@ -429,6 +448,8 @@ describe('SpanStatsProcessor', () => {
           HTTPMethod: '',
           HTTPEndpoint: '',
           srv_src: 'integration',
+          SpanKind: '',
+          GRPCStatusCode: '',
           Hits: n,
           TopLevelHits: n,
           Errors: 0,
@@ -463,4 +484,70 @@ describe('SpanStatsProcessor', () => {
       ProcessTags: processTags.serialized,
     })
   })
+
+  it('should clear buckets after each interval flush', () => {
+    const p = new SpanStatsProcessor(config)
+    clearTimeout(p.timer)
+    p.onSpanFinished(topLevelSpan)
+
+    assert.strictEqual(p.buckets.size, 1)
+    p.onInterval()
+    assert.strictEqual(p.buckets.size, 0)
+  })
+
+  it('creates and stores the injected otlp exporter', () => {
+    const p = new SpanStatsProcessor(config, otlpExporter)
+    clearTimeout(p.timer)
+    assert.strictEqual(p.otlpExporter, otlpExporter)
+  })
+
+  it('should call OTLP exporter on interval when traceMetrics enabled', () => {
+    otlpExporter.export.resetHistory()
+    const p = new SpanStatsProcessor(config, otlpExporter)
+    clearTimeout(p.timer)
+    p.onSpanFinished(topLevelSpan)
+    p.onInterval()
+
+    assert.ok(otlpExporter.export.calledOnce)
+    const [drained, bucketSizeNs] = otlpExporter.export.firstCall.args
+    assert.strictEqual(drained.length, 1)
+    assert.strictEqual(bucketSizeNs, p.bucketSizeNs)
+  })
+
+  it('should not call OTLP exporter on interval when drained is empty', () => {
+    otlpExporter.export.resetHistory()
+    const p = new SpanStatsProcessor(config, otlpExporter)
+    clearTimeout(p.timer)
+    p.onInterval()
+
+    assert.ok(otlpExporter.export.notCalled)
+  })
+
+  it('should not call the legacy /v0.6/stats exporter when OTLP is enabled (mutual exclusion)', () => {
+    exporter.export.resetHistory()
+    otlpExporter.export.resetHistory()
+    const p = new SpanStatsProcessor(config, otlpExporter)
+    clearTimeout(p.timer)
+    p.onSpanFinished(topLevelSpan)
+    p.onInterval()
+
+    assert.ok(exporter.export.notCalled)
+    assert.ok(otlpExporter.export.calledOnce)
+  })
+
+  it('should record spans when only OTLP is enabled', () => {
+    otlpExporter.export.resetHistory()
+    const p = new SpanStatsProcessor({
+      stats: { DD_TRACE_STATS_COMPUTATION_ENABLED: false, interval: 10 },
+      hostname: '127.0.0.1',
+      port: 8126,
+      url: new URL('http://127.0.0.1:8126'),
+      env: 'test',
+      tags: {},
+    }, otlpExporter)
+    clearTimeout(p.timer)
+
+    p.onSpanFinished(topLevelSpan)
+    assert.strictEqual(p.buckets.size, 1)
+  })
 })

From 9392529282e588fed46318b4168e0c35bce8f39e Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Thu, 2 Jul 2026 17:29:11 +0200
Subject: [PATCH 47/51] fix(datastreams): flush on write when flushInterval is
 0 (#9120)

With `flushInterval: 0` (the test-agent config and the AWS Lambda config) the
processor armed `setInterval(onInterval, 0)`, which fires on every event-loop
tick instead of when a checkpoint is recorded. A tick landing in the window
between the test agent tearing its listener down and bringing it back up posts
to a dead port; the bucket is cleared on serialize, so that single payload is
lost. A producer-only DSM test waiting on exactly one payload then times out.

Honor `flushInterval === 0` as the flush-on-write sentinel the agent and
agentless trace exporters already use: skip the timer and push each checkpoint,
offset, and transaction the moment it is recorded, while the writer URL is live.
---
 .../dd-trace/src/datastreams/processor.js     | 14 ++-
 .../test/datastreams/flush_on_write.spec.js   | 99 +++++++++++++++++++
 2 files changed, 110 insertions(+), 3 deletions(-)
 create mode 100644 packages/dd-trace/test/datastreams/flush_on_write.spec.js

diff --git a/packages/dd-trace/src/datastreams/processor.js b/packages/dd-trace/src/datastreams/processor.js
index ac458bb322..f086efefa8 100644
--- a/packages/dd-trace/src/datastreams/processor.js
+++ b/packages/dd-trace/src/datastreams/processor.js
@@ -235,7 +235,11 @@ class DataStreamsProcessor {
     this._schemaSamplers = {}
     this._checkpointRegistry = new CheckpointRegistry()
 
-    if (this.enabled) {
+    // `flushInterval === 0` is the "flush on write" sentinel the trace exporter already honors
+    // (agent exporter `export()`); a background timer of `0` would instead fire on every event-loop
+    // tick, decoupled from when checkpoints are recorded, and a single tick landing while the agent
+    // is unreachable drops the bucket for good (it is cleared on serialize). Push on record instead.
+    if (this.enabled && flushInterval !== 0) {
       this.timer = setInterval(this.onInterval.bind(this), flushInterval)
       this.timer.unref?.()
     }
@@ -282,6 +286,7 @@ class DataStreamsProcessor {
       // StatsPoint already converted the 8-byte Buffer hash to a uint64 BigInt.
       span.setTag(PATHWAY_HASH, statsPoint.hash.toString())
     }
+    if (this.flushInterval === 0) this.onInterval()
   }
 
   setCheckpoint (edgeTags, span, ctx, payloadSize = 0) {
@@ -356,8 +361,9 @@ class DataStreamsProcessor {
 
   recordOffset ({ timestamp, ...backlogData }) {
     if (!this.enabled) return
-    return this.bucketFromTimestamp(timestamp)
-      .forBacklog(backlogData)
+    const backlog = this.bucketFromTimestamp(timestamp).forBacklog(backlogData)
+    if (this.flushInterval === 0) this.onInterval()
+    return backlog
   }
 
   setOffset (offsetObj) {
@@ -401,6 +407,8 @@ class DataStreamsProcessor {
     // Number() cast is safe here: 10s bucket granularity tolerates ~0.5ns precision loss
     this.bucketFromTimestamp(Number(timestampNs)).addTransaction(entry)
 
+    if (this.flushInterval === 0) this.onInterval()
+
     if (span) {
       span.setTag(DSM_TRANSACTION_ID, transactionId)
       span.setTag(DSM_TRANSACTION_CHECKPOINT, checkpointName)
diff --git a/packages/dd-trace/test/datastreams/flush_on_write.spec.js b/packages/dd-trace/test/datastreams/flush_on_write.spec.js
new file mode 100644
index 0000000000..c701402dc8
--- /dev/null
+++ b/packages/dd-trace/test/datastreams/flush_on_write.spec.js
@@ -0,0 +1,99 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+
+const { describe, it, beforeEach, afterEach } = require('mocha')
+const sinon = require('sinon')
+const proxyquire = require('proxyquire')
+
+require('../setup/core')
+
+const writer = {
+  flush: sinon.stub(),
+}
+const DataStreamsWriter = sinon.stub().returns(writer)
+const { DataStreamsProcessor } = proxyquire('../../src/datastreams/processor', {
+  './writer': { DataStreamsWriter },
+})
+
+const DEFAULT_TIMESTAMP = Number(new Date('2023-04-20T16:20:00.000Z'))
+
+const baseConfig = {
+  dsmEnabled: true,
+  hostname: '127.0.0.1',
+  port: 8126,
+  url: new URL('http://127.0.0.1:8126'),
+  env: 'test',
+  version: 'v1',
+  service: 'service1',
+  tags: { foo: 'foovalue', bar: 'barvalue' },
+}
+
+const checkpoint = {
+  currentTimestamp: DEFAULT_TIMESTAMP,
+  hash: Buffer.from('e858212fd11a41e5', 'hex'),
+  parentHash: Buffer.from('e858292fd15a41e4', 'hex'),
+  edgeTags: ['service:service-name', 'env:env-name', 'topic:test-topic'],
+  edgeLatencyNs: 100000000,
+  pathwayLatencyNs: 100000000,
+  payloadSize: 100,
+}
+
+// `flushInterval: 0` is the "flush on write" sentinel the agent/agentless trace exporters already
+// honor. The processor must push each recorded checkpoint immediately, while the writer URL is known
+// live. The previous `setInterval(onInterval, 0)` fired on every event-loop tick instead, decoupled
+// from the recording, so a tick landing after the agent listener was torn down posted to a dead port
+// and lost the bucket (it is cleared on serialize) — dropping the single payload a producer-only DSM
+// test waits for and timing it out.
+describe('DataStreamsProcessor flush-on-write', () => {
+  let processor
+
+  afterEach(() => {
+    clearTimeout(processor?.timer)
+    writer.flush.resetHistory()
+  })
+
+  describe('with flushInterval 0', () => {
+    beforeEach(() => {
+      processor = new DataStreamsProcessor({ ...baseConfig, flushInterval: 0 })
+    })
+
+    it('does not arm an interval timer', () => {
+      assert.strictEqual(processor.timer, undefined)
+    })
+
+    it('flushes synchronously while recording a checkpoint', () => {
+      processor.recordCheckpoint(checkpoint)
+
+      sinon.assert.calledOnce(writer.flush)
+    })
+
+    it('flushes synchronously while recording an offset', () => {
+      processor.recordOffset({ timestamp: DEFAULT_TIMESTAMP, partition: 0, topic: 'test-topic' })
+
+      sinon.assert.calledOnce(writer.flush)
+    })
+
+    it('flushes synchronously while tracking a transaction', () => {
+      processor.trackTransaction('msg-id-001', 'ingested')
+
+      sinon.assert.calledOnce(writer.flush)
+    })
+  })
+
+  describe('with a non-zero flushInterval', () => {
+    beforeEach(() => {
+      processor = new DataStreamsProcessor({ ...baseConfig, flushInterval: 1000 })
+    })
+
+    it('arms an interval timer', () => {
+      assert.notStrictEqual(processor.timer, undefined)
+    })
+
+    it('does not flush while recording a checkpoint', () => {
+      processor.recordCheckpoint(checkpoint)
+
+      sinon.assert.notCalled(writer.flush)
+    })
+  })
+})

From 5b0fc6f836eb4bd1b9f627ba00289c6dd8b60b2e Mon Sep 17 00:00:00 2001
From: Pablo Erhard <104538390+pabloerhard@users.noreply.github.com>
Date: Thu, 2 Jul 2026 10:29:20 -0600
Subject: [PATCH 48/51] chore(engines): bump engines field for v6 (#9104)

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 2c6279b5fc..f588125b7c 100644
--- a/package.json
+++ b/package.json
@@ -131,7 +131,7 @@
   },
   "homepage": "https://github.com/DataDog/dd-trace-js#readme",
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "nodeMaxMajor": 27,
   "files": [

From 55d286df3ec33727a9363c28f3f29375eac8990c Mon Sep 17 00:00:00 2001
From: Pablo Erhard <104538390+pabloerhard@users.noreply.github.com>
Date: Thu, 2 Jul 2026 12:25:32 -0600
Subject: [PATCH 49/51] feat(release): add breaking changes to release proposal
 (#9196)

* add breaking changes to release proposal

* fetch from master instead

* removes stable path fallback

* fix wrong look up
---
 scripts/release/changelog.js      | 35 +++++++++++---
 scripts/release/changelog.spec.js | 78 ++++++++++++++++++++++++++++++
 scripts/release/proposal.js       | 79 +++++++++++++++++++++++++++++--
 3 files changed, 181 insertions(+), 11 deletions(-)

diff --git a/scripts/release/changelog.js b/scripts/release/changelog.js
index eef658905f..c541ae6373 100644
--- a/scripts/release/changelog.js
+++ b/scripts/release/changelog.js
@@ -143,18 +143,31 @@ for (const [product, scopes] of PRODUCTS) {
 
 /**
  * @param {CommitEntry[]} entries
+ * @param {CommitEntry[]} [breakingEntries]
  * @returns {ReleaseChangelog}
  */
-function createReleaseChangelog (entries) {
+function createReleaseChangelog (entries, breakingEntries = []) {
   const sections = new Map()
+  const breakingChanges = []
+  const breakingPullRequests = new Set()
   const contributors = new Set()
   const warnings = []
   let isMinor = false
 
+  for (const entry of breakingEntries) {
+    const change = parseChange(entry, { dropOtherDependencies: false })
+
+    if (change.warning) warnings.push(change.warning)
+    if (entry.author) contributors.add(entry.author)
+    if (change.pr) breakingPullRequests.add(change.pr)
+    breakingChanges.push(change)
+  }
+
   for (const entry of entries) {
     const change = parseChange(entry)
 
     if (change.drop) continue
+    if (change.pr && breakingPullRequests.has(change.pr)) continue
     if (change.warning) warnings.push(change.warning)
     if (change.category === 'Features' && !change.revert) isMinor = true
     if (entry.author) contributors.add(entry.author)
@@ -168,7 +181,7 @@ function createReleaseChangelog (entries) {
   }
 
   return {
-    markdown: renderMarkdown(sections, contributors),
+    markdown: renderMarkdown(sections, contributors, breakingChanges),
     isMinor,
     warnings,
   }
@@ -176,9 +189,10 @@ function createReleaseChangelog (entries) {
 
 /**
  * @param {CommitEntry} entry
+ * @param {{ dropOtherDependencies?: boolean }} [options]
  * @returns {Change}
  */
-function parseChange (entry) {
+function parseChange (entry, options = {}) {
   const subjectWithPullRequest = parsePullRequest(entry.subject)
   const parsed = parseConventionalSubject(subjectWithPullRequest.subject)
 
@@ -194,13 +208,13 @@ function parseChange (entry) {
   }
 
   const dependency = classifyDependencyBump(parsed.scopes, parsed.subject)
-  if (dependency === 'other') {
+  if (dependency === 'other' && options.dropOtherDependencies !== false) {
     return { drop: true }
   }
 
   return {
     category: CATEGORY_BY_TYPE[parsed.type] || INTERNAL_CATEGORY,
-    product: dependency === 'production' ? DEPENDENCY_PRODUCT : selectProduct(parsed.scopes),
+    product: dependency ? DEPENDENCY_PRODUCT : selectProduct(parsed.scopes),
     subject: parsed.subject,
     pr: subjectWithPullRequest.pr,
     revert: parsed.isRevert,
@@ -321,10 +335,19 @@ function sentenceCase (subject) {
 /**
  * @param {Map<string, Change[]>} sections
  * @param {Set<string>} contributors
+ * @param {Change[]} breakingChanges
  */
-function renderMarkdown (sections, contributors) {
+function renderMarkdown (sections, contributors, breakingChanges) {
   const lines = []
 
+  if (breakingChanges.length > 0) {
+    lines.push('### Breaking Changes')
+    for (const change of breakingChanges.sort(compareChanges)) {
+      lines.push(renderChange(change))
+    }
+    lines.push('')
+  }
+
   for (const category of CATEGORY_ORDER) {
     const changes = sections.get(category)
     if (!changes?.length) continue
diff --git a/scripts/release/changelog.spec.js b/scripts/release/changelog.spec.js
index a57399a1c1..75934f7b6e 100644
--- a/scripts/release/changelog.spec.js
+++ b/scripts/release/changelog.spec.js
@@ -144,6 +144,84 @@ describe('release changelog', () => {
     ].join('\n'))
   })
 
+  it('renders breaking changes at the top of the release changelog', () => {
+    const changelog = createReleaseChangelog([
+      {
+        sha: 'abc001',
+        subject: 'fix(core): keep existing behavior stable (#9001)',
+        author: '@alice',
+      },
+    ], [
+      {
+        sha: 'abc002',
+        subject: 'feat(opentelemetry)!: remove legacy propagation mode (#9002)',
+        author: '@bob',
+      },
+      {
+        sha: 'abc003',
+        subject: 'chore(deps-dev): bump eslint from 9.0.0 to 10.0.0 (#9003)',
+      },
+    ])
+
+    assert.strictEqual(changelog.markdown, [
+      '### Breaking Changes',
+      `- **Dependencies:** Bump eslint from 9.0.0 to 10.0.0 ${prLink(9003)}`,
+      `- **OpenTelemetry:** Remove legacy propagation mode ${prLink(9002)}`,
+      '',
+      '### Fixes',
+      `- **General:** Keep existing behavior stable ${prLink(9001)}`,
+      '',
+      '### Contributors',
+      '',
+      `${avatar('alice')} ${avatar('bob')}`,
+      '',
+    ].join('\n'))
+  })
+
+  it('does not promote the release to minor for breaking-only features', () => {
+    const changelog = createReleaseChangelog([
+      {
+        sha: 'abc001',
+        subject: 'fix(core): keep existing behavior stable (#9001)',
+      },
+    ], [
+      {
+        sha: 'abc002',
+        subject: 'feat(opentelemetry)!: remove legacy propagation mode (#9002)',
+      },
+    ])
+
+    assert.strictEqual(changelog.isMinor, false)
+  })
+
+  it('drops regular release note entries already listed as breaking changes', () => {
+    const changelog = createReleaseChangelog([
+      {
+        sha: 'abc001',
+        subject: 'feat(opentelemetry)!: remove legacy propagation mode (#9002)',
+      },
+      {
+        sha: 'abc002',
+        subject: 'fix(core): keep existing behavior stable (#9001)',
+      },
+    ], [
+      {
+        sha: 'abc003',
+        subject: 'feat(opentelemetry)!: remove legacy propagation mode (#9002)',
+      },
+    ])
+
+    assert.strictEqual(changelog.markdown, [
+      '### Breaking Changes',
+      `- **OpenTelemetry:** Remove legacy propagation mode ${prLink(9002)}`,
+      '',
+      '### Fixes',
+      `- **General:** Keep existing behavior stable ${prLink(9001)}`,
+      '',
+    ].join('\n'))
+    assert.strictEqual(changelog.isMinor, false)
+  })
+
   it('handles breaking markers and subjects without pull request numbers', () => {
     const changelog = createReleaseChangelog([
       {
diff --git a/scripts/release/proposal.js b/scripts/release/proposal.js
index fa359b1d2d..6cef054ca9 100644
--- a/scripts/release/proposal.js
+++ b/scripts/release/proposal.js
@@ -23,6 +23,8 @@ const { checkAll } = require('./helpers/requirements')
 const tmpdir = process.env.RUNNER_TEMP || os.tmpdir()
 const main = 'master'
 const releaseLine = params[0]
+const breakingLabels = ['semver-major', 'only-land-on-next']
+const pullRequestNumberPattern = /\(#([0-9]+)\)$/
 
 // Validate release line argument.
 if (!releaseLine || releaseLine === 'help' || flags.help) {
@@ -71,11 +73,11 @@ try {
   const stableVersion = `${DD_MAJOR}.${DD_MINOR}.${DD_PATCH}`
   const isPreRelease = VERSION !== stableVersion
 
-  // Notes exclude semver-major (gated behind a flag, not user-visible).
+  // Notes list semver-major and only-land-on-next separately as breaking changes.
   // Cherry-pick includes semver-major; only only-land-on-next is fully excluded,
   // except when promoting a pre-release to stable (that's what "next" means).
   const notesDiffCmd = 'branch-diff --user DataDog --repo dd-trace-js' +
-    (isPreRelease ? '' : ' --exclude-label=semver-major --exclude-label=only-land-on-next')
+    ' --exclude-label=semver-major --exclude-label=only-land-on-next'
   const cherryPickDiffCmd = 'branch-diff --user DataDog --repo dd-trace-js' +
     (isPreRelease ? '' : ' --exclude-label=only-land-on-next')
 
@@ -94,7 +96,8 @@ try {
   // runs. It equals allMainShas[min(length, MAX_CHERRY_PICKS) - 1] regardless of
   // how many commits are already on the branch (proven by:
   // existingCherryPicked + shasToApply.length = min(allMainShas.length, MAX_CHERRY_PICKS)).
-  const upperBoundSha = allMainShas.at(Math.min(allMainShas.length, MAX_CHERRY_PICKS) - 1)
+  const upperBoundSha = allMainShas.at(Math.min(allMainShas.length, MAX_CHERRY_PICKS) - 1) ||
+    (isPreRelease ? capture(`git rev-parse v${releaseLine}.x`) : undefined)
 
   if (!upperBoundSha) {
     pass('none (already up to date)')
@@ -107,7 +110,7 @@ try {
 
   // notesShas is scoped to upperBoundSha so isMinor and release notes only reflect
   // the capped commits actually included in the proposal, not deferred ones.
-  // Excludes semver-major (gated behind a flag, not user-visible).
+  // Excludes changes that are listed in the dedicated breaking changes section.
   const notesShas = capture(`${notesDiffCmd} --format=sha --reverse v${releaseLine}.x ${upperBoundRef}`)
     .split('\n').filter(Boolean)
   const contributorBySha = getContributorsBySha(`v${releaseLine}.x`, upperBoundSha)
@@ -119,7 +122,10 @@ try {
       author: contributorBySha.get(sha),
     })
   }
-  const notes = createReleaseChangelog(notesEntries)
+  const breakingEntries = isPreRelease
+    ? getBreakingPullRequestEntries(releaseLine, upperBoundRef)
+    : []
+  const notes = createReleaseChangelog(notesEntries, breakingEntries)
   const isMinor = notes.isMinor
   const newPatch = `${releaseLine}.${DD_MINOR}.${DD_PATCH + 1}`
   const newMinor = `${releaseLine}.${DD_MINOR + 1}.0`
@@ -329,3 +335,66 @@ function getContributorsBySha (base, head) {
 
   return contributors
 }
+
+/**
+ * Semver-major changes are commonly guarded by version checks and backported to
+ * stable branches. Branch comparisons can miss them because the commits exist
+ * on both the previous and next release lines, so the vN.0.0 promotion lists
+ * merged PRs by label across the previous major cycle instead.
+ *
+ * @param {string} releaseLine
+ * @param {string} upperBoundRef
+ */
+function getBreakingPullRequestEntries (releaseLine, upperBoundRef) {
+  const previousReleaseLine = Number.parseInt(releaseLine, 10) - 1
+  const previousMajorTag = `v${previousReleaseLine}.0.0`
+  const mergedAfter = capture(`git log -1 --format=%cs ${previousMajorTag}`)
+  const mergedBefore = capture(`git show -s --format=%cs ${upperBoundRef}`)
+  const pullRequestsByNumber = new Map()
+  const includedPullRequests = getIncludedPullRequests(previousMajorTag, [`v${releaseLine}.x`, upperBoundRef])
+
+  for (const label of breakingLabels) {
+    const pullRequests = JSON.parse(capture(
+      'gh pr list --repo DataDog/dd-trace-js --state merged --limit 1000' +
+      ` --label=${label}` +
+      ` --search "base:${main} merged:>=${mergedAfter} merged:<=${mergedBefore}"` +
+      ' --json number,title,mergeCommit,author'
+    ))
+
+    for (const pullRequest of pullRequests) {
+      if (!includedPullRequests.has(pullRequest.number)) continue
+
+      pullRequestsByNumber.set(pullRequest.number, pullRequest)
+    }
+  }
+
+  return [...pullRequestsByNumber.values()].map(pullRequest => {
+    return {
+      sha: pullRequest.mergeCommit?.oid || `pull-request-${pullRequest.number}`,
+      subject: `${pullRequest.title} (#${pullRequest.number})`,
+      author: pullRequest.author?.login ? `@${pullRequest.author.login}` : undefined,
+    }
+  })
+}
+
+/**
+ * Release proposal branches are built with cherry-picks, so PR merge commits
+ * often are not ancestors of the release branch even when their changes are
+ * present. Match by the PR number preserved in the commit subject instead.
+ *
+ * @param {string} base
+ * @param {string[]} refs
+ */
+function getIncludedPullRequests (base, refs) {
+  const pullRequests = new Set()
+
+  for (const ref of refs) {
+    const subjects = capture(`git log --format=%s ${base}..${ref}`).split('\n')
+    for (const subject of subjects) {
+      const match = subject.match(pullRequestNumberPattern)
+      if (match) pullRequests.add(Number.parseInt(match[1], 10))
+    }
+  }
+
+  return pullRequests
+}

From 35bc30e67b1c99336a006f9bd25a78e6117d1f00 Mon Sep 17 00:00:00 2001
From: Pablo Erhard <104538390+pabloerhard@users.noreply.github.com>
Date: Thu, 2 Jul 2026 12:36:07 -0600
Subject: [PATCH 50/51] docs(v6): updated documentation for v6 (#9159)

* docs(v6): updated documentation for v6

* update release date

* fix CI test session migratin doc

* Fix for test-opt concerns
---
 MIGRATING.md | 51 ++++++++++++++++++++++++++++++++++++++++++++++++++-
 README.md    | 21 +++++++++++++--------
 2 files changed, 63 insertions(+), 9 deletions(-)

diff --git a/MIGRATING.md b/MIGRATING.md
index a6e55ccc99..089c8db9fb 100644
--- a/MIGRATING.md
+++ b/MIGRATING.md
@@ -4,7 +4,56 @@ This guide describes the steps to upgrade dd-trace from a major version to the
 next. If you are having any issues related to migrating, please feel free to
 open an issue or contact our [support](https://www.datadoghq.com/support/) team.
 
-## 5.0 to 6.0 (unreleased)
+## 5.0 to 6.0
+
+### Node 18 and 20 are no longer supported
+
+Node.js 18 reached EOL in April 2025 and Node.js 20 reached EOL in April 2026;
+neither is supported in v6. We highly recommend always keeping Node.js up to
+date regardless of our support policy.
+
+### Minimum versions bumped for test framework integrations
+
+Make sure to update any of the below frameworks to a v6 supported minimum version.
+
+| Framework  | v5 minimum | v6 minimum |
+| :---:      | :---:      | :---:      |
+| Jest       | 24.8.0     | 28.0.0     |
+| Mocha      | 5.2.0      | 8.0.0      |
+| Cypress    | 6.7.0      | 12.0.0     |
+| Playwright | 1.18.0     | 1.38.0     |
+
+### Nx service name default value
+
+The `NX_TASK_TARGET_PROJECT` environment variable set automatically by `nx`
+is now used as the default test service name `test.service` unless
+`DD_SERVICE` is explicitly set. On v5 this behavior required
+`DD_ENABLE_NX_SERVICE_NAME` to opt in. Remove the opt-in variable if you had
+it set; the behavior is now unconditional.
+
+### Lage test session name default value
+
+The `LAGE_PACKAGE_NAME` environment variable set automatically by `lage` is
+now used as the default test session name `test_session.name` unless
+`DD_TEST_SESSION_NAME` is explicitly set. On v5 this behavior required
+`DD_ENABLE_LAGE_PACKAGE_NAME=true` to opt in. Remove the opt-in variable if
+you had it set; the behavior is now unconditional.
+
+### CI test session `test_session.name` is now the trimmed command
+
+The `test_session.name` tag on test session spans now defaults to only the
+framework invocation (e.g. `jest`, `mocha`, `playwright test`, `cucumber-js`)
+rather than the full command line, when no explicit name is otherwise
+configured. The `test.command` tag is unaffected and still
+contains the full command. Update any monitors or dashboards that matched on
+`test_session.name` with the full command string.
+
+### OpenAI span resource name is now the normalized method name
+
+The `resource.name` on `openai.request` spans now uses a normalized,
+SDK-version-independent name (e.g. `createChatCompletion`) instead of the raw
+SDK method name (e.g. `chat.completions.create`). Update any monitors or
+dashboards that matched on the dotted v4 SDK method names.
 
 ### IAST security controls is env-only
 
diff --git a/README.md b/README.md
index c434aeb846..067628e023 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # `dd-trace`: Node.js APM Tracer Library
 
-[![npm v5](https://img.shields.io/npm/v/dd-trace/latest?color=blue&label=dd-trace%40v5&logo=npm)](https://www.npmjs.com/package/dd-trace)
+[![npm v6](https://img.shields.io/npm/v/dd-trace/latest?color=blue&label=dd-trace%40v6&logo=npm)](https://www.npmjs.com/package/dd-trace)
 [![codecov](https://codecov.io/gh/DataDog/dd-trace-js/branch/master/graph/badge.svg)](https://codecov.io/gh/DataDog/dd-trace-js)
 
 <img align="right" src="https://user-images.githubusercontent.com/551402/208212084-1d0c07e2-4135-4c61-b2da-8f2fddbc66ed.png" alt="Bits the dog  JavaScript" width="200px"/>
@@ -28,30 +28,35 @@ Most of the documentation for `dd-trace` is available on these webpages:
 | [`v2`](https://github.com/DataDog/dd-trace-js/tree/v2.x) | ![npm v2](https://img.shields.io/npm/v/dd-trace/latest-node12?color=white&label=%20&style=flat-square) | `>= v12` | NO | NO | **EOL** | 2022-01-28     | 2023-08-15  |
 | [`v3`](https://github.com/DataDog/dd-trace-js/tree/v3.x) | ![npm v3](https://img.shields.io/npm/v/dd-trace/latest-node14?color=white&label=%20&style=flat-square) | `>= v14` | NO | YES | **EOL** | 2022-08-15     | 2024-05-15  |
 | [`v4`](https://github.com/DataDog/dd-trace-js/tree/v4.x) | ![npm v4](https://img.shields.io/npm/v/dd-trace/latest-node16?color=white&label=%20&style=flat-square) | `>= v16` | YES | YES | **EOL**     | 2023-05-12     | 2025-01-11     |
-| [`v5`](https://github.com/DataDog/dd-trace-js/tree/v5.x) | ![npm v5](https://img.shields.io/npm/v/dd-trace/latest?color=white&label=%20&style=flat-square)        | `>= v18` | YES | YES | **Current**     | 2024-01-11     | Unknown     |
+| [`v5`](https://github.com/DataDog/dd-trace-js/tree/v5.x) | ![npm v5](https://img.shields.io/npm/v/dd-trace/latest-node18?color=white&label=%20&style=flat-square)  | `>= v18` | YES | YES | **Maintenance** | 2024-01-11     | Unknown     |
+| [`v6`](https://github.com/DataDog/dd-trace-js/tree/v6.x) | ![npm v6](https://img.shields.io/npm/v/dd-trace/latest?color=white&label=%20&style=flat-square)         | `>= v22` | YES | YES | **Current**     | 2026-07-02     | Unknown     |
 
 * EOL = End-of-life
 * SSI = Single-Step Install
 
-We currently maintain one release line, namely `v5`.
+We currently maintain two release lines: `v6` (current) and `v5` (maintenance).
 
-For any new projects it is recommended to use the `v5` release line:
+For any new projects it is recommended to use the `v6` release line:
 
 ```sh
 $ npm install dd-trace
 $ yarn add dd-trace
 ```
 
-Existing projects that need to use EOL versions of Node.js may continue to use these older release lines.
-This is done by specifying the version when installing the package.
+Existing projects on `v5` may continue to use it during its maintenance window by pinning the major version:
+
+```sh
+$ npm install dd-trace@5
+$ yarn add dd-trace@5
+```
+
+Older EOL release lines are no longer maintained, but can still be pinned if needed:
 
 ```sh
 $ npm install dd-trace@4 # or whatever version you need
 $ yarn add dd-trace@4 # or whatever version you need
 ```
 
-Note, however, that the end-of-life release lines are no longer maintained and will not receive updates.
-
 Any backwards-breaking functionality that is introduced into the library will result in an increase of the major version of the library and therefore a new release line.
 Such releases are kept to a minimum to reduce the pain of upgrading the library.
 

From c723e0972b22dfa26fa866b3f5b54db9458b92df Mon Sep 17 00:00:00 2001
From: pabloerhard <pabloerhard@users.noreply.github.com>
Date: Thu, 2 Jul 2026 18:37:20 +0000
Subject: [PATCH 51/51] v6.0.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f588125b7c..ce87b8a91d 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "dd-trace",
-  "version": "6.0.0-pre",
+  "version": "6.0.0",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",