Instrument the OpenAI client, and stop shipping raw prompts in span events

[brentrager]

The gap, corrected

The brief was "TypeScript has no GenAI support." That premise is wrong, and worth stating plainly: packages/core/src/gen-ai-attributes.ts has shipped since SMOODEV-1155, exports setGenAIAttributes / recordGenAIMessage from the package index, and is the file the other four SDKs were ported from (Rust, Go and Python all say so in their headers).

What TypeScript actually lacked:

	before	after
gen_ai.* attribute helper	✅ already shipped	unchanged
tests	none — zero	34
framework integration	none	wrapOpenAI
PII scrub on recorded content	none	routed through scrubString

What this adds

wrapOpenAI(client, options) — proxies chat.completions.create and emits a GenAI-semconv span (chat {model}, SpanKind.CLIENT). Request model / temperature / top_p / max_tokens / seed / tool names go out with the call; response model, id, finish reason, truncation and token usage come back off the response. Errors mark the span ERROR, record the exception, and rethrow — request attributes still land, so a failed call stays attributable.

Streaming is handled, not skipped. A stream: true call hands span ownership to the iterator: the span stays open until the stream drains, ends when a consumer breaks out early, and collects the usage chunk that only appears under stream_options.include_usage. The Stream object is proxied rather than replaced, so .controller / .tee() keep working.

Why the OpenAI client over the Vercel AI SDK. The OpenAI wire shape is the lingua franca: Groq, Together, Fireworks, DeepSeek, Azure OpenAI and our own LiteLLM gateway at llm.smoo.ai are all reachable through this same client, so one wrapper instruments all of them ({ system: 'groq' } attributes the span to the real provider). It also needs no dependency — the client is duck-typed structurally, so @smooai/observability never imports openai. The Vercel AI SDK would have meant a peer dep on a fast-moving package and its own LanguageModelV* middleware types for strictly less coverage. grep across the smooai monorepo agrees: openai is a dependency of three packages, ai / @ai-sdk/* of none.

A cost seam. Nothing anywhere emits gen_ai.usage.cost_usd — which is exactly why the product's cost column is empty. Providers don't return a price, so a caller has to supply one:

wrapOpenAI(new OpenAI(), {
    costUsd: ({ inputTokens = 0, outputTokens = 0 }) => inputTokens * 2.5e-6 + outputTokens * 1e-5,
});

PII discipline. recordGenAIMessage now scrubs content before it leaves the process, and wrapOpenAI records no prompt or completion content unless you pass { recordContent: true }. Prompts and tool arguments are the most PII-dense payload this SDK can touch.

Dependency note: the TS scrubString is credentials-only today (Bearer tokens, api keys, password=). Keyed per-org hashing of names / emails / phones exists in Rust (rust/observability/src/pii.rs) and is being ported to TS in a parallel PR. This wires through whatever pii exposes rather than duplicating it, so that PR is inherited here for free with no change to this file.

Verification

Attribute keys are asserted literally, not derived from the source — a typo'd key silently produces an unroutable span. Two tests pin the contract with rust/api-prime/src/handlers/observability/ingest_traces.rs: gen_ai.system is the sole routing trigger into gen_ai_events, and gen_ai.operation.name is a straight passthrough with no fallback, so the wrapper always sets it (unset ⇒ NULL column).

Every key was mutation-checked — broken one at a time, the specific failing test recorded, then restored and verified byte-identical by sha256:

32 mutations applied, 32 killed, 0 survivors. Every one of the 19 attribute keys, all 4 message-event keys, the gen_ai.{role}.message event name, the PII scrub itself, and 8 wrapper-level behaviours (operation.name always set, default system, each usage-field mapping, the cost seam, streaming span lifetime, truncation).

Judged by exit code, not by reported text:

gen_ai tests   EXIT=0   (34 passed)
pnpm typecheck EXIT=0
pnpm lint      EXIT=0
pnpm test      EXIT=0   (295 passed, 16 files)
pnpm build     EXIT=0
pnpm format:check EXIT=0   (oxfmt, not prettier)

Docs

README gains a GenAI parity table across all five SDKs, honest about the two divergences it surfaced — Rust emits gen_ai.tool.names as a comma-joined string where the other four emit a string array, and TypeScript is the only SDK that scrubs recorded message content.

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 42ef343

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@smooai/observability	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR