@davidilie/telemetry-next 0.2.0 → 0.4.0

package/README.md

@@ -80,6 +80,25 @@ sampler strings. Either sampler is wrapped in a mutable provider-wide gate, so
 new automatic and client-created spans, including children of sampled parents.
 Already queued/exported work is not recalled.
 
+Resource detectors default to an empty list, so `OTEL_RESOURCE_ATTRIBUTES` and
+`OTEL_SERVICE_NAME` cannot override the configured identity or add unfiltered
+attributes. Explicit `otel.resourceDetectors` opt into upstream detection;
+review their output because it bypasses core redaction. Standard Vercel
+deployment metadata from `@vercel/otel` remains available.
+
+The default trace exporter sends OTLP/HTTP protobuf directly to Alloy. It
+redacts completed span names, attributes, events, links, and status messages,
+including automatic fetch spans and exceptions. URL paths are removed from
+span names. A custom `otel.traceExporter` receives the same redacted copies.
+Core attribute bounds apply; canonical service identity remains on the OTel
+resource. Resource and instrumentation-scope metadata are trusted configuration.
+
+Explicit `otel.spanProcessors` replace this default, so their exporters must
+apply their own privacy policy (or use Node's `RedactingSpanExporter`). The
+default does not use Vercel's hosted exporter or `VERCEL_OTEL_ENDPOINTS`.
+Choose custom processors deliberately if a Vercel tracing integration is
+required. Use a custom exporter for a protocol other than HTTP protobuf.
+
 Provider registration owns trace sampling and the Node adapter applies
 `sampleRate` once to logs; core does not make a second decision for those
 signals. OTel histogram measurements remain aggregated instead of randomly
@@ -168,7 +187,8 @@ reaches VictoriaLogs with active `trace_id`, `span_id`, service, and release.
 
 In long-running Next server processes the framework owns the provider
 lifecycle. Do not call `shutdown()` during an ordinary request. Use `flush()`
-only at a real lifecycle boundary; it drains core sends, not every private
-batch inside `@vercel/otel`.
+only when queued telemetry must leave before returning or exiting. It drains
+core sends and invokes public `forceFlush()` on registered trace, log, and
+metric providers when supported. It does not shut down the framework provider.
 
 See the [web adapter](https://www.npmjs.com/package/@davidilie/telemetry-web), [Node adapter](https://www.npmjs.com/package/@davidilie/telemetry-node), [project onboarding](https://github.com/DavidIlie/davidapps-telemetry/blob/main/docs/adding-a-project.md), and [troubleshooting](https://github.com/DavidIlie/davidapps-telemetry/blob/main/docs/troubleshooting.md).

package/dist/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_request_error = require("./request-error-CtYIz296.cjs");
+const require_request_error = require("./request-error-CEM6CkHw.cjs");
 exports.createNextRequestErrorHandler = require_request_error.createNextRequestErrorHandler;

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { t as createNextRequestErrorHandler } from "./request-error-6cvJ4jpq.mjs";
+import { t as createNextRequestErrorHandler } from "./request-error-DbUeEPob.mjs";
 export { createNextRequestErrorHandler };

package/dist/node.cjs

@@ -1,9 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_request_error = require("./request-error-CtYIz296.cjs");
-let _vercel_otel = require("@vercel/otel");
+const require_request_error = require("./request-error-CEM6CkHw.cjs");
 let _davidilie_telemetry_core = require("@davidilie/telemetry-core");
+let _vercel_otel = require("@vercel/otel");
 let _davidilie_telemetry_node = require("@davidilie/telemetry-node");
 let _opentelemetry_sdk_trace_base = require("@opentelemetry/sdk-trace-base");
+let _opentelemetry_exporter_trace_otlp_proto = require("@opentelemetry/exporter-trace-otlp-proto");
 //#region src/node.ts
 const REGISTRATION = Symbol.for("@davidilie/telemetry-next/registration");
 function traceSampler(config) {
@@ -24,8 +25,13 @@ function registerNextTelemetry(config) {
 		enabled: config.enabled ?? true,
 		consent: config.consent ?? "granted"
 	});
+	const { spanProcessors, traceExporter, ...otel } = config.otel ?? {};
+	const exporter = traceExporter && traceExporter !== "auto" ? traceExporter : void 0;
 	(0, _vercel_otel.registerOTel)({
-		...config.otel,
+		...otel,
+		spanProcessors: spanProcessors ?? [new _opentelemetry_sdk_trace_base.BatchSpanProcessor(new _davidilie_telemetry_node.RedactingSpanExporter(exporter ?? new _opentelemetry_exporter_trace_otlp_proto.OTLPTraceExporter()))],
+		...spanProcessors && exporter ? { traceExporter: new _davidilie_telemetry_node.RedactingSpanExporter(exporter) } : {},
+		resourceDetectors: config.otel?.resourceDetectors ?? [],
 		traceSampler: sampler,
 		serviceName: resource.serviceName,
 		attributes: (0, _davidilie_telemetry_node.telemetryResourceAttributes)(resource)

package/dist/node.mjs

@@ -1,8 +1,9 @@
-import { t as createNextRequestErrorHandler } from "./request-error-6cvJ4jpq.mjs";
-import { registerOTel } from "@vercel/otel";
+import { t as createNextRequestErrorHandler } from "./request-error-DbUeEPob.mjs";
 import { sanitizeResource } from "@davidilie/telemetry-core";
-import { DynamicTelemetrySampler, NodeTelemetryClient, telemetryResourceAttributes } from "@davidilie/telemetry-node";
-import { ParentBasedSampler, TraceIdRatioBasedSampler } from "@opentelemetry/sdk-trace-base";
+import { registerOTel } from "@vercel/otel";
+import { DynamicTelemetrySampler, NodeTelemetryClient, RedactingSpanExporter, telemetryResourceAttributes } from "@davidilie/telemetry-node";
+import { BatchSpanProcessor, ParentBasedSampler, TraceIdRatioBasedSampler } from "@opentelemetry/sdk-trace-base";
+import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-proto";
 //#region src/node.ts
 const REGISTRATION = Symbol.for("@davidilie/telemetry-next/registration");
 function traceSampler(config) {
@@ -23,8 +24,13 @@ function registerNextTelemetry(config) {
 		enabled: config.enabled ?? true,
 		consent: config.consent ?? "granted"
 	});
+	const { spanProcessors, traceExporter, ...otel } = config.otel ?? {};
+	const exporter = traceExporter && traceExporter !== "auto" ? traceExporter : void 0;
 	registerOTel({
-		...config.otel,
+		...otel,
+		spanProcessors: spanProcessors ?? [new BatchSpanProcessor(new RedactingSpanExporter(exporter ?? new OTLPTraceExporter()))],
+		...spanProcessors && exporter ? { traceExporter: new RedactingSpanExporter(exporter) } : {},
+		resourceDetectors: config.otel?.resourceDetectors ?? [],
 		traceSampler: sampler,
 		serviceName: resource.serviceName,
 		attributes: telemetryResourceAttributes(resource)

package/dist/{request-error-CtYIz296.cjs → request-error-CEM6CkHw.cjs}

@@ -1,3 +1,4 @@
+let _davidilie_telemetry_core = require("@davidilie/telemetry-core");
 //#region src/request-error.ts
 async function reportFailure(config, error, stage) {
 	try {
@@ -8,6 +9,22 @@ function errorDigest(error) {
 	if (typeof error === "object" && error !== null && "digest" in error && typeof error.digest === "string") return error.digest;
 }
 function createNextRequestErrorHandler(config) {
+	let pendingFlush;
+	let needsFlush = false;
+	function flushCaptured() {
+		needsFlush = true;
+		pendingFlush ??= Promise.resolve().then(async () => {
+			try {
+				do {
+					needsFlush = false;
+					await config.telemetry.flush?.();
+				} while (needsFlush);
+			} finally {
+				pendingFlush = void 0;
+			}
+		});
+		return pendingFlush;
+	}
 	return async (error, request, context) => {
 		if (config.beforeCapture) try {
 			if (!await config.beforeCapture(error, request, context)) return;
@@ -15,26 +32,26 @@ function createNextRequestErrorHandler(config) {
 			await reportFailure(config, hookError, "beforeCapture");
 			return;
 		}
-		const digest = errorDigest(error);
 		try {
-			config.telemetry.captureException(error, {
+			const digest = errorDigest(error);
+			config.telemetry.captureException(error, (0, _davidilie_telemetry_core.sanitizeAttributes)({
 				...config.attributes,
 				"http.request.method": request.method,
-				"url.path": request.path,
+				"url.path": (0, _davidilie_telemetry_core.sanitizeUrl)(request.path),
 				"next.router.kind": context.routerKind,
-				"next.route.path": context.routePath,
+				"next.route.path": (0, _davidilie_telemetry_core.sanitizeUrl)(context.routePath),
 				"next.route.type": context.routeType,
 				...context.renderSource ? { "next.render.source": context.renderSource } : {},
 				...context.revalidateReason ? { "next.revalidate.reason": context.revalidateReason } : {},
 				...context.renderType ? { "next.render.type": context.renderType } : {},
 				...digest ? { "next.error.digest": digest } : {}
-			});
+			}));
 		} catch (captureError) {
 			await reportFailure(config, captureError, "capture");
 			return;
 		}
 		try {
-			await config.telemetry.flush?.();
+			await flushCaptured();
 		} catch (flushError) {
 			await reportFailure(config, flushError, "flush");
 		}

package/dist/{request-error-6cvJ4jpq.mjs → request-error-DbUeEPob.mjs}

@@ -1,3 +1,4 @@
+import { sanitizeAttributes, sanitizeUrl } from "@davidilie/telemetry-core";
 //#region src/request-error.ts
 async function reportFailure(config, error, stage) {
 	try {
@@ -8,6 +9,22 @@ function errorDigest(error) {
 	if (typeof error === "object" && error !== null && "digest" in error && typeof error.digest === "string") return error.digest;
 }
 function createNextRequestErrorHandler(config) {
+	let pendingFlush;
+	let needsFlush = false;
+	function flushCaptured() {
+		needsFlush = true;
+		pendingFlush ??= Promise.resolve().then(async () => {
+			try {
+				do {
+					needsFlush = false;
+					await config.telemetry.flush?.();
+				} while (needsFlush);
+			} finally {
+				pendingFlush = void 0;
+			}
+		});
+		return pendingFlush;
+	}
 	return async (error, request, context) => {
 		if (config.beforeCapture) try {
 			if (!await config.beforeCapture(error, request, context)) return;
@@ -15,26 +32,26 @@ function createNextRequestErrorHandler(config) {
 			await reportFailure(config, hookError, "beforeCapture");
 			return;
 		}
-		const digest = errorDigest(error);
 		try {
-			config.telemetry.captureException(error, {
+			const digest = errorDigest(error);
+			config.telemetry.captureException(error, sanitizeAttributes({
 				...config.attributes,
 				"http.request.method": request.method,
-				"url.path": request.path,
+				"url.path": sanitizeUrl(request.path),
 				"next.router.kind": context.routerKind,
-				"next.route.path": context.routePath,
+				"next.route.path": sanitizeUrl(context.routePath),
 				"next.route.type": context.routeType,
 				...context.renderSource ? { "next.render.source": context.renderSource } : {},
 				...context.revalidateReason ? { "next.revalidate.reason": context.revalidateReason } : {},
 				...context.renderType ? { "next.render.type": context.renderType } : {},
 				...digest ? { "next.error.digest": digest } : {}
-			});
+			}));
 		} catch (captureError) {
 			await reportFailure(config, captureError, "capture");
 			return;
 		}
 		try {
-			await config.telemetry.flush?.();
+			await flushCaptured();
 		} catch (flushError) {
 			await reportFailure(config, flushError, "flush");
 		}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidilie/telemetry-next",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Runtime-safe Next.js telemetry backed by @vercel/otel.",
   "keywords": [
     "analytics",
@@ -66,8 +66,9 @@
     "clean": "rm -rf dist coverage"
   },
   "dependencies": {
-    "@davidilie/telemetry-core": "0.2.0",
-    "@davidilie/telemetry-node": "0.2.0",
+    "@davidilie/telemetry-core": "0.4.0",
+    "@davidilie/telemetry-node": "0.4.0",
+    "@opentelemetry/exporter-trace-otlp-proto": "0.221.0",
     "@opentelemetry/sdk-trace-base": "2.10.0",
     "@vercel/otel": "2.1.3"
   },
@@ -83,7 +84,7 @@
   "devDependencies": {
     "@opentelemetry/api": "1.9.0",
     "@types/node": "25.0.10",
-    "next": "16.3.1"
+    "next": "16.3.5"
   },
   "publishConfig": {
     "access": "public",