`resolve.start` and `assertField` walk the same resolver data several
times per call. The following improvements are implemented:

1. `info.fieldNodes.find(...)` collapses to `info.fieldNodes[0]`; the
   executor only hands FieldNode siblings to the resolver.
2. `pathToArray` switches to a count-then-fill walk.
3. `getResolverInfo` allocates `resolverVars` lazily.
4. `shouldInstrument` short-circuits when `config.depth < 0` (the
   default).
5. `getPath` / `withCollapse` fold into a single walk.
6. `wrapExecute` reuses one `documentSources.get(document)` lookup.
7. `addVariableTags` returns early when there are no variables and no
   filter.

Drive-by fix:

* `finishResolvers` drops the `.reverse()` pass; `field.finishTime`
  already pins each span's wall-clock finish.
* `wrapFields` uses `Object.values(type._fields)` directly.

After merging master, #8309's perf wins target functions that either no
longer exist (wrapExecute / wrapFields / pathToArray / finishResolvers
moved out of instrumentations/graphql.js) or live in a deleted file
(resolve.js was folded into execute.js). Port the still-applicable
changes onto the migrated execute plugin:

  #1 _startResolveSpan uses info.fieldNodes[0] instead of .find(fn =>
     fn.kind === 'Field'). The executor only hands FieldNode siblings.
  #2 pathToArray switches to count-then-fill (drops the trailing
     .reverse() and the push-grow).
  #3 getResolverInfo lazy-allocates resolverVars: skips both the
     up-front {} and the directive-loop assignment when args is empty
     and no directives have arguments.
  #4 shouldInstrument early-returns on config.depth < 0 (no-limit, the
     default-enabled case) before walking the path.
  #5 buildCollapsedPathString builds the collapsed key in one walk;
     drops the intermediate collapsedPath array. iastResolveCh.publish
     now passes raw path / pathString, matching the contract the old
     resolve.js had with the IAST subscriber.
  drive-by  wrapFields iterates Object.values(type._fields) directly.

  #7 (addVariableTags early-return) already auto-merged during the
     master merge.
  #6 (single documentSources.get in wrapExecute) is already the shape
     of bindStart in the migrated plugin.

The reverted depth=0 bindStart short-circuit (156a557 / ca2d041)
sat at a different position — inside bindStart, gated on _depthDisabled
(config.depth === 0). It was rolled back because piling it on top of
the resolveAsync depth-flag fix didn't move plugin-graphql-long-with-
depth-off any further. This port stays inside shouldInstrument, fires
on config.depth < 0 (the *enabled* default), and targets the hot path
on plugin-graphql-long.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

After merging master, #8309's perf wins target functions that either no
longer exist (wrapExecute / wrapFields / pathToArray / finishResolvers
moved out of instrumentations/graphql.js) or live in a deleted file
(resolve.js was folded into execute.js). Port the still-applicable
changes onto the migrated execute plugin:

  #1 _startResolveSpan uses info.fieldNodes[0] instead of .find(fn =>
     fn.kind === 'Field'). The executor only hands FieldNode siblings.
  #2 pathToArray switches to count-then-fill (drops the trailing
     .reverse() and the push-grow).
  #3 getResolverInfo lazy-allocates resolverVars: skips both the
     up-front {} and the directive-loop assignment when args is empty
     and no directives have arguments.
  #4 shouldInstrument early-returns on config.depth < 0 (no-limit, the
     default-enabled case) before walking the path.
  #5 buildCollapsedPathString builds the collapsed key in one walk;
     drops the intermediate collapsedPath array. iastResolveCh.publish
     now passes raw path / pathString, matching the contract the old
     resolve.js had with the IAST subscriber.
  drive-by  wrapFields iterates Object.values(type._fields) directly.

  #7 (addVariableTags early-return) already auto-merged during the
     master merge.
  #6 (single documentSources.get in wrapExecute) is already the shape
     of bindStart in the migrated plugin.

The reverted depth=0 bindStart short-circuit (156a557 / ca2d041)
sat at a different position — inside bindStart, gated on _depthDisabled
(config.depth === 0). It was rolled back because piling it on top of
the resolveAsync depth-flag fix didn't move plugin-graphql-long-with-
depth-off any further. This port stays inside shouldInstrument, fires
on config.depth < 0 (the *enabled* default), and targets the hot path
on plugin-graphql-long.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Replaces the shimmer-based graphql instrumentation in
packages/datadog-instrumentations/src/graphql.js with orchestrion AST
rewriting for the top-level execute / parse / validate entry points
(both CJS and ESM in graphql >= 0.10 and @graphql-tools/executor).

Plugin architecture changes:
  - packages/datadog-plugin-graphql/src/execute.js: takes over resolver
    wrapping that used to live in instrumentations; uses a single
    rootCtx per execute() call to coordinate execute-span creation and
    per-resolver bookkeeping. Resolve spans are recorded inline at
    first-encounter and finished from the resolver callback so encoder
    state stays hot across span finalization.
  - packages/datadog-plugin-graphql/src/resolve.js: deleted. The
    resolve-plugin sub-class was needed only because the old shimmer
    architecture published per-field events through a separate
    plugin; the orchestrion-based design folds that work into the
    execute plugin and uses a module-level _depthDisabled flag to
    short-circuit when tracer.use('graphql', { depth: 0 }).
  - packages/datadog-plugin-graphql/src/parse.js,validate.js: hooked
    via orchestrion publishes; documentSources mapping moved onto the
    parse plugin so the execute plugin can read raw query source for
    graphql.source tags + IAST taint tracking.

Correctness fixes wired up alongside the migration:
  - IAST taint tracking: orchestrion's bindStart now fires the same
    apm:graphql:resolve:start payload the old shimmer wrapper produced,
    using the actual args object graphql constructs internally rather
    than an AST-rebuilt copy. Restores taint propagation for hardcoded
    literal resolver arguments (e.g. books(title: "ls")) which the
    initial orchestrion port broke.
  - AppSec resolver blocking: passes the abort controller directly to
    the channel payload so AppSec subscribers can abort the resolver
    synchronously. packages/dd-trace/src/appsec/graphql.js updated to
    read req via getActiveRequest() (the storage('legacy') call only
    worked under the old shimmer setup).
  - Channel payload shape change in packages/dd-trace/src/appsec/
    channels.js to match the new bindStart contract.

Performance work folded in (per-execute and per-resolver):
  - Lazy-build info object and resolver args; only construct when the
    plugin actually needs them.
  - Eliminate per-field channel publishing — the per-execute rootCtx
    holds field records and we publish nothing per resolver in the
    APM-only path.
  - Collapse redundant path walks in the resolve bindStart so
    pathToArray runs once per resolver call.
  - Consolidate per-field stash + finish handler into one shared
    object; avoids reallocating ctx objects per resolver.
  - Short-circuit re-entrant execute() on the same contextValue
    (covers yoga's normalizedExecutor pattern that would otherwise
    double-span).
  - Hot fast-path when depth=0: cache the disabled state on a
    module-level flag in configure() so resolveAsync bails on a single
    property read, matching master's startResolveCh.hasSubscribers
    cost.
  - Port of #8309's signature-pipeline optimization onto the migrated
    execute plugin.

All 231 plugin-graphql tests pass.

Local sirun on plugin-graphql-long (100q × 5 iters per Node version)
shows per-process user-CPU vs master:
  with-depth-on-max:                   -340 ms  (-31%)
  with-depth-and-collapse-off:           tied
  with-tracer-graphql-disabled:         -50 ms  (-7%)
  with-depth-off:                       +130 ms (+21%)

The depth=0 regression is the only configuration where PR is slower
than master. It traces to orchestrion's publish format carrying raw
function args (master's shimmer wrapper pre-computed
{operation, args, docSource} before publishing). For variants with any
per-resolver work, PR's structural wins overtake this cost many times
over.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Replaces the shimmer-based graphql instrumentation in
packages/datadog-instrumentations/src/graphql.js with orchestrion AST
rewriting for the top-level execute / parse / validate entry points
(both CJS and ESM in graphql >= 0.10 and @graphql-tools/executor).

Plugin architecture changes:
  - packages/datadog-plugin-graphql/src/execute.js: takes over resolver
    wrapping that used to live in instrumentations; uses a single
    rootCtx per execute() call to coordinate execute-span creation and
    per-resolver bookkeeping. Resolve spans are recorded inline at
    first-encounter and finished from the resolver callback so encoder
    state stays hot across span finalization.
  - packages/datadog-plugin-graphql/src/resolve.js: deleted. The
    resolve-plugin sub-class was needed only because the old shimmer
    architecture published per-field events through a separate
    plugin; the orchestrion-based design folds that work into the
    execute plugin and uses a module-level _depthDisabled flag to
    short-circuit when tracer.use('graphql', { depth: 0 }).
  - packages/datadog-plugin-graphql/src/parse.js,validate.js: hooked
    via orchestrion publishes; documentSources mapping moved onto the
    parse plugin so the execute plugin can read raw query source for
    graphql.source tags + IAST taint tracking.

Correctness fixes wired up alongside the migration:
  - IAST taint tracking: orchestrion's bindStart now fires the same
    apm:graphql:resolve:start payload the old shimmer wrapper produced,
    using the actual args object graphql constructs internally rather
    than an AST-rebuilt copy. Restores taint propagation for hardcoded
    literal resolver arguments (e.g. books(title: "ls")) which the
    initial orchestrion port broke.
  - AppSec resolver blocking: passes the abort controller directly to
    the channel payload so AppSec subscribers can abort the resolver
    synchronously. packages/dd-trace/src/appsec/graphql.js updated to
    read req via getActiveRequest() (the storage('legacy') call only
    worked under the old shimmer setup).
  - Channel payload shape change in packages/dd-trace/src/appsec/
    channels.js to match the new bindStart contract.

Performance work folded in (per-execute and per-resolver):
  - Lazy-build info object and resolver args; only construct when the
    plugin actually needs them.
  - Eliminate per-field channel publishing — the per-execute rootCtx
    holds field records and we publish nothing per resolver in the
    APM-only path.
  - Collapse redundant path walks in the resolve bindStart so
    pathToArray runs once per resolver call.
  - Consolidate per-field stash + finish handler into one shared
    object; avoids reallocating ctx objects per resolver.
  - Short-circuit re-entrant execute() on the same contextValue
    (covers yoga's normalizedExecutor pattern that would otherwise
    double-span).
  - Hot fast-path when depth=0: cache the disabled state on a
    module-level flag in configure() so resolveAsync bails on a single
    property read, matching master's startResolveCh.hasSubscribers
    cost.
  - Port of #8309's signature-pipeline optimization onto the migrated
    execute plugin.

All 231 plugin-graphql tests pass.

Local sirun on plugin-graphql-long (100q × 5 iters per Node version)
shows per-process user-CPU vs master:
  with-depth-on-max:                   -340 ms  (-31%)
  with-depth-and-collapse-off:           tied
  with-tracer-graphql-disabled:         -50 ms  (-7%)
  with-depth-off:                       +130 ms (+21%)

The depth=0 regression is the only configuration where PR is slower
than master. It traces to orchestrion's publish format carrying raw
function args (master's shimmer wrapper pre-computed
{operation, args, docSource} before publishing). For variants with any
per-resolver work, PR's structural wins overtake this cost many times
over.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Replaces the shimmer-based graphql instrumentation in
packages/datadog-instrumentations/src/graphql.js with orchestrion AST
rewriting for the top-level execute / parse / validate entry points
(both CJS and ESM in graphql >= 0.10 and @graphql-tools/executor).

Plugin architecture changes:
  - packages/datadog-plugin-graphql/src/execute.js: takes over resolver
    wrapping that used to live in instrumentations; uses a single
    rootCtx per execute() call to coordinate execute-span creation and
    per-resolver bookkeeping. Resolve spans are recorded inline at
    first-encounter and finished from the resolver callback so encoder
    state stays hot across span finalization.
  - packages/datadog-plugin-graphql/src/resolve.js: deleted. The
    resolve-plugin sub-class was needed only because the old shimmer
    architecture published per-field events through a separate
    plugin; the orchestrion-based design folds that work into the
    execute plugin and uses a module-level _depthDisabled flag to
    short-circuit when tracer.use('graphql', { depth: 0 }).
  - packages/datadog-plugin-graphql/src/parse.js,validate.js: hooked
    via orchestrion publishes; documentSources mapping moved onto the
    parse plugin so the execute plugin can read raw query source for
    graphql.source tags + IAST taint tracking.

Correctness fixes wired up alongside the migration:
  - IAST taint tracking: orchestrion's bindStart now fires the same
    apm:graphql:resolve:start payload the old shimmer wrapper produced,
    using the actual args object graphql constructs internally rather
    than an AST-rebuilt copy. Restores taint propagation for hardcoded
    literal resolver arguments (e.g. books(title: "ls")) which the
    initial orchestrion port broke.
  - AppSec resolver blocking: passes the abort controller directly to
    the channel payload so AppSec subscribers can abort the resolver
    synchronously. packages/dd-trace/src/appsec/graphql.js updated to
    read req via getActiveRequest() (the storage('legacy') call only
    worked under the old shimmer setup).
  - Channel payload shape change in packages/dd-trace/src/appsec/
    channels.js to match the new bindStart contract.

Performance work folded in (per-execute and per-resolver):
  - Lazy-build info object and resolver args; only construct when the
    plugin actually needs them.
  - Eliminate per-field channel publishing — the per-execute rootCtx
    holds field records and we publish nothing per resolver in the
    APM-only path.
  - Collapse redundant path walks in the resolve bindStart so
    pathToArray runs once per resolver call.
  - Consolidate per-field stash + finish handler into one shared
    object; avoids reallocating ctx objects per resolver.
  - Short-circuit re-entrant execute() on the same contextValue
    (covers yoga's normalizedExecutor pattern that would otherwise
    double-span).
  - Hot fast-path when depth=0: cache the disabled state on a
    module-level flag in configure() so resolveAsync bails on a single
    property read, matching master's startResolveCh.hasSubscribers
    cost.
  - Port of #8309's signature-pipeline optimization onto the migrated
    execute plugin.

All 231 plugin-graphql tests pass.

Local sirun on plugin-graphql-long (100q × 5 iters per Node version)
shows per-process user-CPU vs master:
  with-depth-on-max:                   -340 ms  (-31%)
  with-depth-and-collapse-off:           tied
  with-tracer-graphql-disabled:         -50 ms  (-7%)
  with-depth-off:                       +130 ms (+21%)

The depth=0 regression is the only configuration where PR is slower
than master. It traces to orchestrion's publish format carrying raw
function args (master's shimmer wrapper pre-computed
{operation, args, docSource} before publishing). For variants with any
per-resolver work, PR's structural wins overtake this cost many times
over.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>