@iskra-bun/core 0.1.0 → 0.2.0

package/src/config/schema.ts

@@ -1,29 +1,84 @@
 import { z } from 'zod';
 
-export const AppConfigSchema = z.object({
-    name: z.string().default('IskraApp'),
-    debug: z.boolean().default(false),
-    logger: z.object({
-        level: z.string().default('info')
-    }).default({}),
-    otel: z.object({
-        enabled: z.boolean().default(true),
-        endpoint: z.string().default('http://localhost:4318'),
-        serviceName: z.string().optional(),
-        serviceVersion: z.string().default('0.1.0'),
-        environment: z.string().optional(),
-        metricIntervalMs: z.number().default(60_000),
-        resourceAttributes: z.record(z.string()).optional(),
-        instrumentations: z.record(z.object({ enabled: z.boolean().optional() })).optional(),
-    }).optional(),
-    processes: z.record(z.object({
-        command: z.string(),
-        args: z.array(z.string()).optional(),
-        mode: z.enum(['daemon', 'oneshot', 'stdio']).default('daemon'),
-        restartOnCrash: z.boolean().default(false),
-        env: z.record(z.string()).optional()
-    })).optional()
+const RestartBackoffSchema = z.object({
+    initialMs: z.number().positive().optional(),
+    maxMs: z.number().positive().optional(),
+    factor: z.number().positive().optional(),
 });
 
+// Sections owned by the kits are validated here for shape only, and every
+// object is `.passthrough()`: AppConfig promises `[key: string]: any`, and a
+// plain z.object() silently strips unknown keys — which used to drop `db`,
+// `kv` and `socket` from app.config.ts entirely.
+export const AppConfigSchema = z
+    .object({
+        name: z.string().default('IskraApp'),
+        debug: z.boolean().default(false),
+        logger: z
+            .object({
+                level: z.string().default('info'),
+            })
+            .passthrough()
+            .default({}),
+        otel: z
+            .object({
+                enabled: z.boolean().default(true),
+                endpoint: z.string().default('http://localhost:4318'),
+                serviceName: z.string().optional(),
+                serviceVersion: z.string().default('0.1.0'),
+                environment: z.string().optional(),
+                metricIntervalMs: z.number().default(60_000),
+                resourceAttributes: z.record(z.string()).optional(),
+                // passthrough: the instrumentations' own options (hooks, redactedQueryParams) were stripped.
+                instrumentations: z.record(z.object({ enabled: z.boolean().optional() }).passthrough()).optional(),
+            })
+            .passthrough()
+            .optional(),
+        shutdownSignals: z.union([z.array(z.string()), z.literal(false)]).optional(),
+        shutdownTimeoutMs: z.number().positive().optional(),
+        processes: z
+            .record(
+                z
+                    .object({
+                        command: z.string(),
+                        args: z.array(z.string()).optional(),
+                        mode: z.enum(['daemon', 'oneshot', 'stdio']).default('daemon'),
+                        restartOnCrash: z.boolean().default(false),
+                        maxRestarts: z.number().int().nonnegative().optional(),
+                        restartCooldown: z.number().nonnegative().optional(),
+                        restartBackoff: RestartBackoffSchema.optional(),
+                        env: z.record(z.string()).optional(),
+                        inheritEnv: z.union([z.boolean(), z.array(z.string())]).optional(),
+                        maxPendingStdinBytes: z.number().int().positive().optional(),
+                    })
+                    .passthrough(),
+            )
+            .optional(),
+        socket: z
+            .object({
+                enabled: z.boolean(),
+                port: z.number().optional(),
+                adapter: z.enum(['bun', 'socket.io']).optional(),
+            })
+            .passthrough()
+            .optional(),
+        kv: z
+            .object({
+                driver: z.enum(['memory', 'redis']),
+                connection: z.any().optional(),
+            })
+            .passthrough()
+            .optional(),
+        db: z
+            .object({
+                driver: z.enum(['postgres', 'mysql', 'sqlite', 'libsql']),
+                url: z.string(),
+                authToken: z.string().optional(),
+            })
+            .passthrough()
+            .optional(),
+    })
+    .passthrough();
+
 export type AppConfigInput = z.input<typeof AppConfigSchema>;
 export type AppConfigOutput = z.output<typeof AppConfigSchema>;

package/src/env.ts

@@ -0,0 +1,31 @@
+/**
+ * The deployment environment, read when called: `NODE_ENV` through a computed
+ * key, because `bun build` replaces a literal `process.env.NODE_ENV` with its
+ * value at build time ("development" when unset), so a compiled binary ignored
+ * the NODE_ENV it ran with.
+ */
+const NODE_ENV = 'NODE_ENV';
+
+/** `NODE_ENV` as the process runs with it, or undefined when unset or empty. */
+export function nodeEnv(): string | undefined {
+    return process.env[NODE_ENV] || undefined;
+}
+
+/**
+ * Whether development conveniences apply (pretty logs, http auth URLs, sample
+ * secrets, `disableCSRFCheck`): only with `NODE_ENV` set to `development` or
+ * `test`.
+ */
+export function isDevelopmentEnv(env: string | undefined = nodeEnv()): boolean {
+    return env === 'development' || env === 'test';
+}
+
+/**
+ * Whether production safeguards apply: in every environment but `development`
+ * and `test`, including an unset NODE_ENV and names like `staging`. They used
+ * to apply only to NODE_ENV=production exactly, so a deploy that forgot it
+ * sent non-Secure cookies and accepted placeholder secrets.
+ */
+export function isProductionEnv(env: string | undefined = nodeEnv()): boolean {
+    return !isDevelopmentEnv(env);
+}

package/src/errors.ts

@@ -97,7 +97,11 @@ export class ConfigError extends IskraError {
 
 export class DriverError extends IskraError {
     constructor(message: string, options?: { code?: ErrorCode; cause?: Error; context?: Record<string, unknown> }) {
-        super(message, { code: options?.code ?? ErrorCodes.DRIVER_INIT_FAILED, cause: options?.cause, context: options?.context });
+        super(message, {
+            code: options?.code ?? ErrorCodes.DRIVER_INIT_FAILED,
+            cause: options?.cause,
+            context: options?.context,
+        });
         this.name = 'DriverError';
     }
 }
@@ -116,7 +120,10 @@ export class PluginError extends IskraError {
 export class LifecycleError extends IskraError {
     public readonly failures: PromiseRejectedResult[];
 
-    constructor(message: string, options: { failures?: PromiseRejectedResult[]; cause?: Error; context?: Record<string, unknown> }) {
+    constructor(
+        message: string,
+        options: { failures?: PromiseRejectedResult[]; cause?: Error; context?: Record<string, unknown> },
+    ) {
         super(message, { code: ErrorCodes.LIFECYCLE_STOP_FAILED, cause: options.cause, context: options.context });
         this.name = 'LifecycleError';
         this.failures = options.failures ?? [];

package/src/index.ts

@@ -3,5 +3,6 @@ export * from './types';
 export * from './logger';
 export * from './errors';
 export * from './otel';
+export * from './env';
 export * from './config/loader';
 export * from './config/schema';

package/src/logger/index.ts

@@ -1,16 +1,200 @@
 import pino from 'pino';
+import pretty from 'pino-pretty';
+import { isDevelopmentEnv } from '../env';
+
+/**
+ * Field names whose values are replaced with `[REDACTED]`, at any depth. Keys
+ * are compared lowercased and without `-` or `_`, so `apiKey`, `api_key` and
+ * `X-API-Key` are the same key.
+ */
+const REDACTED_KEYS = [
+    'password',
+    'pass',
+    'passwd',
+    'apiKey',
+    'apiSecret',
+    'token',
+    'authToken',
+    'accessToken',
+    'refreshToken',
+    'idToken',
+    'secret',
+    'clientSecret',
+    'secretKey',
+    'privateKey',
+    'authorization',
+    'proxyAuthorization',
+    'cookie',
+    'setCookie',
+    'sessionId',
+] as const;
+
+/**
+ * Keys ending in one of these are redacted too (normalized the same way):
+ * `dbPassword`, `x-api-key`, `x-auth-token`, `AWS_SECRET_ACCESS_KEY`,
+ * `webhookSecret`.
+ */
+const REDACTED_SUFFIXES = ['password', 'passwd', 'secret', 'token', 'apikey', 'secretkey', 'privatekey', 'accesskey'];
+
+const normalizeKey = (key: string): string => key.toLowerCase().replace(/[-_]/g, '');
+const SENSITIVE = new Set<string>(REDACTED_KEYS.map(normalizeKey));
+const isSensitive = (key: string): boolean => {
+    const normalized = normalizeKey(key);
+    return SENSITIVE.has(normalized) || REDACTED_SUFFIXES.some((suffix) => normalized.endsWith(suffix));
+};
+const CENSOR = '[REDACTED]';
+/** Objects deeper than this are logged as they are. */
+const MAX_DEPTH = 8;
+const IN_PROGRESS = Symbol('in progress');
+
+/** The prototype of what pino's err serializer returns (an error's fields, causes included). */
+const SERIALIZED_ERROR_PROTO = Object.getPrototypeOf(pino.stdSerializers.err(new Error()));
+
+const isPlainObject = (value: object): boolean => {
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null || proto === SERIALIZED_ERROR_PROTO;
+};
+
+/** Query parameter names whose values are masked in messages. */
+const SECRET_PARAM = /pass|secret|token|key|sig|auth/i;
+
+/**
+ * Passwords in `scheme://user:password@host` and secret-looking query
+ * parameters (`?authToken=`, `&X-Amz-Signature=`) of a message: drivers put
+ * the connection string in the errors they throw. Bounded quantifiers keep
+ * both patterns linear on long input.
+ */
+function maskCredentials(text: string): string {
+    return text
+        .replace(/\b([a-z][\w+.-]{0,30}:\/\/[^\s:@/]{0,256}):[^\s@/]{1,256}@/gi, '$1:[REDACTED]@')
+        .replace(/([?&])([\w.-]{1,100})=([^&\s'"#]+)/g, (match, sep: string, name: string) =>
+            SECRET_PARAM.test(name) ? `${sep}${name}=[REDACTED]` : match,
+        );
+}
+
+/**
+ * An Error as pino's err serializer writes it (type, message and stack with
+ * their causes, and its own fields), scrubbed. pino serializes errors after
+ * the log formatter runs, so an HTTP client's error (`config.headers
+ * .Authorization`) or a Redis error (`command.args` of AUTH) went out as is.
+ */
+function scrubError(err: Error, depth: number, done: WeakMap<object, unknown>): unknown {
+    const serialized = { ...pino.stdSerializers.err(err) } as Record<string, unknown>;
+    if (typeof serialized.message === 'string') serialized.message = maskCredentials(serialized.message);
+    if (typeof serialized.stack === 'string') serialized.stack = maskCredentials(serialized.stack);
+    // Deep: an error keeps the client's objects (axios's `request`, whose
+    // `_options.headers` hold the Authorization header), which are class
+    // instances that JSON.stringify writes out in full.
+    return scrubEntries(serialized, depth, done, true);
+}
+
+/**
+ * Replaces the value of every sensitive key, at any depth, in a copy of the
+ * objects that contain one (the caller's objects are not modified). pino's
+ * own `redact` has no recursive wildcard, and listing each key at every depth
+ * made logging 14 times slower. Errors are serialized and scrubbed here (see
+ * scrubError), and objects with a toJSON() are scrubbed as what it returns;
+ * other class instances are left to pino, except inside an error.
+ */
+function scrub(value: unknown, depth: number, done: WeakMap<object, unknown>, deep = false): unknown {
+    if (value === null || typeof value !== 'object' || depth > MAX_DEPTH) return value;
+    if (done.has(value)) {
+        const result = done.get(value);
+        // Still being walked: a cycle, which pino would print as [Circular].
+        return result === IN_PROGRESS ? '[Circular]' : result;
+    }
+    const isError = value instanceof Error;
+    const toJSON = (value as { toJSON?: unknown }).toJSON;
+    const walk = isError || Array.isArray(value) || isPlainObject(value) || typeof toJSON === 'function' || deep;
+    if (!walk) return value;
+    done.set(value, IN_PROGRESS);
+    let result: unknown;
+    if (isError) {
+        result = scrubError(value, depth, done);
+    } else if (Array.isArray(value)) {
+        let copy: unknown[] | undefined;
+        value.forEach((item, i) => {
+            const scrubbed = scrub(item, depth + 1, done, deep);
+            if (scrubbed !== item) (copy ??= value.slice())[i] = scrubbed;
+        });
+        result = copy ?? value;
+    } else if (isPlainObject(value)) {
+        result = scrubEntries(value as Record<string, unknown>, depth, done, deep);
+    } else if (typeof toJSON === 'function') {
+        // Written as its toJSON(), which is what JSON.stringify writes: an axios
+        // error's `config.headers` is an AxiosHeaders instance whose
+        // Authorization header went out as is.
+        result = scrub(toJSON.call(value), depth, done, deep);
+    } else {
+        // Inside an error: another class instance, as JSON.stringify writes it
+        // (its own enumerable fields).
+        result = scrubEntries({ ...(value as Record<string, unknown>) }, depth, done, deep);
+    }
+    done.set(value, result);
+    return result;
+}
+
+/** An object with its sensitive keys censored and its values scrubbed; a copy if anything changed. */
+function scrubEntries(
+    value: Record<string, unknown>,
+    depth: number,
+    done: WeakMap<object, unknown>,
+    deep = false,
+): Record<string, unknown> {
+    let copy: Record<string, unknown> | undefined;
+    for (const [key, item] of Object.entries(value)) {
+        const scrubbed = isSensitive(key) ? CENSOR : scrub(item, depth + 1, done, deep);
+        if (scrubbed !== item) (copy ??= { ...value })[key] = scrubbed;
+    }
+    // A nested serialized error (pino's prototype) becomes a plain object either way.
+    return copy ?? (Object.getPrototypeOf(value) === SERIALIZED_ERROR_PROTO ? { ...value } : value);
+}
 
 export const createLogger = (name: string, level: string = 'info') => {
-    return pino({
+    // Pretty output only in development/test: JSON otherwise, NODE_ENV unset included.
+    const isDev = isDevelopmentEnv();
+    const options: pino.LoggerOptions = {
         name,
         level,
-        transport: {
-            target: 'pino-pretty',
-            options: {
-                colorize: true
-            }
-        }
-    });
+        formatters: {
+            log: (object) => scrub(object, 0, new WeakMap()) as Record<string, unknown>,
+        },
+        // The formatter above already serialized errors (scrubbed): pino's own
+        // err serializer would take that plain object for an error again and
+        // rewrite its `type` as "Object".
+        serializers: {
+            err: (value: unknown) => (value instanceof Error ? scrub(value, 0, new WeakMap()) : value),
+        },
+        hooks: {
+            // Messages are strings the formatter never sees: mask connection
+            // string passwords there too, including the message pino takes
+            // from an error logged on its own (`logger.error(err)`).
+            logMethod(args, method) {
+                const masked: unknown[] = args.map((arg) => (typeof arg === 'string' ? maskCredentials(arg) : arg));
+                if (masked[0] instanceof Error && typeof masked[1] !== 'string') {
+                    masked.splice(1, 0, maskCredentials(masked[0].message));
+                }
+                return method.apply(this, masked as Parameters<typeof method>);
+            },
+        },
+        redact: {
+            paths: ['config.env', '*.data'],
+            censor: CENSOR,
+        },
+    };
+    // pino-pretty as an in-process stream, not a `transport`: a transport runs
+    // in a worker thread that loads the module by name at runtime, which fails
+    // in a `bun build --compile` binary and crashed it at startup.
+    const logger = isDev ? pino(options, pretty({ colorize: true })) : pino(options);
+
+    // Bindings (`logger.child({ ... })`) do not go through formatters.log:
+    // scrub them here. A child's own children inherit this child().
+    type Child = (this: pino.Logger, bindings: pino.Bindings, options?: object) => pino.Logger;
+    const child = logger.child as unknown as Child;
+    logger.child = function (this: pino.Logger, bindings: pino.Bindings, childOptions?: object) {
+        return child.call(this, scrub(bindings, 0, new WeakMap()) as pino.Bindings, childOptions);
+    } as unknown as typeof logger.child;
+    return logger;
 };
 
 export type Logger = pino.Logger;

package/src/otel.ts

@@ -12,8 +12,9 @@
  * actionable error instead of an unhandled module-resolution failure.
  */
 import type { OtelConfig } from './types';
+import { nodeEnv } from './env';
 
-let sdkInstance: any = null;
+let sdkInstance: { shutdown(): Promise<void> } | null = null;
 
 /** Optional OTel package specifiers, indirected so tsc does not resolve them statically. */
 const OTEL_MODULES = {
@@ -26,9 +27,202 @@ const OTEL_MODULES = {
     semconv: '@opentelemetry/semantic-conventions',
 } as const;
 
+// The optional OTel packages are loaded by specifier, untyped; these are the
+// parts of them used here.
+type Ctor<T = unknown> = new (options: Record<string, unknown>) => T;
+interface OtelSdkNode {
+    NodeSDK: Ctor<{ start(): void; shutdown(): Promise<void> }>;
+}
+interface OtelAutoInstrumentations {
+    getNodeAutoInstrumentations(overrides: Record<string, unknown>): unknown;
+}
+interface OtelTraceExporter {
+    OTLPTraceExporter: Ctor;
+}
+interface OtelMetricExporter {
+    OTLPMetricExporter: Ctor;
+}
+interface OtelSdkMetrics {
+    PeriodicExportingMetricReader: Ctor;
+}
+interface OtelSemconv {
+    ATTR_SERVICE_NAME?: string;
+    ATTR_SERVICE_VERSION?: string;
+}
+/** `@opentelemetry/resources`: 2.x exports resourceFromAttributes(), 1.x the Resource class. */
+export interface OtelResourcesModule {
+    resourceFromAttributes?: (attributes: Record<string, string>) => unknown;
+    Resource?: new (attributes: Record<string, string>) => unknown;
+}
+
 /** Import an optional module by specifier; the indirection keeps tsc from resolving it. */
-function importOptional(specifier: string): Promise<any> {
-    return import(specifier);
+function importOptional<T>(specifier: string): Promise<T> {
+    return import(specifier) as Promise<T>;
+}
+
+const DEFAULT_ENDPOINT = 'http://localhost:4318';
+const HTTP_INSTRUMENTATION = '@opentelemetry/instrumentation-http';
+
+/**
+ * Query parameters whose values are exported as REDACTED in span URLs (see
+ * redactUrl). Names are compared without case, `-` or `_`.
+ */
+export const SECRET_QUERY_PARAMS: readonly string[] = [
+    'token',
+    'access_token',
+    'refresh_token',
+    'id_token',
+    'auth_token',
+    'session_token',
+    'api_key',
+    'key',
+    'secret',
+    'client_secret',
+    'password',
+    'passwd',
+    'code',
+    'state',
+    'ticket',
+    'otp',
+    'jwt',
+    'signature',
+    'sig',
+    'X-Amz-Signature',
+    'X-Amz-Credential',
+    'X-Amz-Security-Token',
+    'AWSAccessKeyId',
+    'X-Goog-Signature',
+    'X-Goog-Credential',
+];
+
+const normalizeParam = (name: string): string => name.toLowerCase().replace(/[-_]/g, '');
+
+function decodeParam(name: string): string {
+    try {
+        return decodeURIComponent(name.replace(/\+/g, ' '));
+    } catch {
+        return name;
+    }
+}
+
+/**
+ * `url` (absolute, or a path) with the value of each query parameter named in
+ * `params` replaced by REDACTED, the rest kept as it was. Telemetry exported
+ * URLs as they were requested: `?api_key=`, `?access_token=`, a presigned
+ * URL's signature.
+ */
+export function redactUrl(url: string, params: readonly string[] = SECRET_QUERY_PARAMS): string {
+    const start = url.indexOf('?');
+    if (start === -1 || params.length === 0) return url;
+    const names = new Set(params.map(normalizeParam));
+    const hash = url.indexOf('#', start);
+    const end = hash === -1 ? url.length : hash;
+    let redacted = false;
+    const query = url
+        .slice(start + 1, end)
+        .split('&')
+        .map((pair) => {
+            const eq = pair.indexOf('=');
+            if (eq === -1 || !names.has(normalizeParam(decodeParam(pair.slice(0, eq))))) return pair;
+            redacted = true;
+            return `${pair.slice(0, eq)}=REDACTED`;
+        })
+        .join('&');
+    return redacted ? url.slice(0, start + 1) + query + url.slice(end) : url;
+}
+
+/** The URL attributes of an HTTP span, in the stable and the older semantic conventions. */
+const URL_ATTRIBUTES = ['url.full', 'url.query', 'http.url', 'http.target'];
+
+/** Rewrites the URL attributes of a recording SDK span (it has `attributes`). */
+function redactSpanUrls(span: unknown, params: readonly string[]): void {
+    const { attributes, setAttribute } = (span ?? {}) as {
+        attributes?: Record<string, unknown>;
+        setAttribute?: (key: string, value: string) => unknown;
+    };
+    if (!attributes || typeof setAttribute !== 'function') return;
+    for (const key of URL_ATTRIBUTES) {
+        const value = attributes[key];
+        if (typeof value !== 'string') continue;
+        // url.query is the query string alone, without its "?".
+        const redacted = key === 'url.query' ? redactUrl(`?${value}`, params).slice(1) : redactUrl(value, params);
+        if (redacted !== value) setAttribute.call(span, key, redacted);
+    }
+}
+
+/**
+ * The options initOtel() passes to getNodeAutoInstrumentations(): the app's
+ * `instrumentations` over Iskra's defaults. The HTTP instrumentation redacts
+ * SECRET_QUERY_PARAMS unless `redactedQueryParams` / `redactedQueryParamsServer`
+ * are set (instrumentation-http 0.204 / 0.222 and later apply them itself;
+ * for older releases a requestHook rewrites the span's URL attributes, before
+ * the app's own requestHook runs).
+ */
+export function autoInstrumentationOptions(config: OtelConfig): Record<string, unknown> {
+    const http: Record<string, unknown> = { ...config.instrumentations?.[HTTP_INSTRUMENTATION] };
+    const list = (value: unknown) => (Array.isArray(value) ? (value as string[]) : undefined);
+    const client = list(http.redactedQueryParams) ?? SECRET_QUERY_PARAMS;
+    const server = list(http.redactedQueryParamsServer) ?? SECRET_QUERY_PARAMS;
+    const appHook = http.requestHook;
+    return {
+        '@opentelemetry/instrumentation-fs': { enabled: false },
+        ...config.instrumentations,
+        [HTTP_INSTRUMENTATION]: {
+            ...http,
+            redactedQueryParams: client,
+            redactedQueryParamsServer: server,
+            requestHook: (span: unknown, request: unknown) => {
+                // A ClientRequest (outgoing) has setHeader(); an IncomingMessage does not.
+                const outgoing = typeof (request as { setHeader?: unknown } | null)?.setHeader === 'function';
+                redactSpanUrls(span, outgoing ? client : server);
+                if (typeof appHook === 'function') appHook(span, request);
+            },
+        },
+    };
+}
+
+/** Hosts spans may reach in clear text: this machine, a private network, or a name that only resolves inside one. */
+function isPrivateHost(hostname: string): boolean {
+    const host = hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    if (host.includes(':')) return host === '::1' || /^f[cd]/.test(host);
+    return (
+        !host.includes('.') ||
+        /\.(localhost|local|internal)$/.test(host) ||
+        /^(127|10)\./.test(host) ||
+        /^192\.168\./.test(host) ||
+        /^172\.(1[6-9]|2\d|3[01])\./.test(host)
+    );
+}
+
+/**
+ * The OTLP endpoint as it is safe to log, its origin (the path, query or
+ * userinfo can carry an API key), and whether spans travel to it in clear
+ * text beyond this machine and its private network.
+ */
+export function describeOtelEndpoint(config: OtelConfig): { origin: string; plaintext: boolean } {
+    try {
+        const url = new URL(config.endpoint || DEFAULT_ENDPOINT);
+        return { origin: url.origin, plaintext: url.protocol === 'http:' && !isPrivateHost(url.hostname) };
+    } catch {
+        return { origin: '(invalid URL)', plaintext: false };
+    }
+}
+
+/**
+ * Builds a Resource with whichever API the installed `@opentelemetry/resources`
+ * provides: 2.x only exports `resourceFromAttributes()` (`Resource` is a type
+ * there, so `new Resource()` throws), 1.x exports the `Resource` class.
+ */
+export function createResource(resources: OtelResourcesModule, attributes: Record<string, string>): unknown {
+    if (typeof resources?.resourceFromAttributes === 'function') {
+        return resources.resourceFromAttributes(attributes);
+    }
+    if (typeof resources?.Resource === 'function') {
+        return new resources.Resource(attributes);
+    }
+    throw new Error(
+        '[iskra/otel] Unsupported @opentelemetry/resources: it exports neither resourceFromAttributes() nor Resource',
+    );
 }
 
 /**
@@ -45,32 +239,29 @@ export async function initOtel(config: OtelConfig, appName: string): Promise<voi
             { OTLPTraceExporter },
             { OTLPMetricExporter },
             { PeriodicExportingMetricReader },
-            { Resource },
+            resources,
             semconv,
         ] = await Promise.all([
-            importOptional(OTEL_MODULES.sdkNode),
-            importOptional(OTEL_MODULES.autoInstrumentations),
-            importOptional(OTEL_MODULES.traceExporter),
-            importOptional(OTEL_MODULES.metricExporter),
-            importOptional(OTEL_MODULES.sdkMetrics),
-            importOptional(OTEL_MODULES.resources),
-            importOptional(OTEL_MODULES.semconv),
+            importOptional<OtelSdkNode>(OTEL_MODULES.sdkNode),
+            importOptional<OtelAutoInstrumentations>(OTEL_MODULES.autoInstrumentations),
+            importOptional<OtelTraceExporter>(OTEL_MODULES.traceExporter),
+            importOptional<OtelMetricExporter>(OTEL_MODULES.metricExporter),
+            importOptional<OtelSdkMetrics>(OTEL_MODULES.sdkMetrics),
+            importOptional<OtelResourcesModule>(OTEL_MODULES.resources),
+            importOptional<OtelSemconv>(OTEL_MODULES.semconv),
         ]);
 
         const serviceName = config.serviceName || appName;
-        const endpoint = config.endpoint || 'http://localhost:4318';
+        const endpoint = config.endpoint || DEFAULT_ENDPOINT;
 
-        const resource = new Resource({
-            [semconv.ATTR_SERVICE_NAME]: serviceName,
-            [semconv.ATTR_SERVICE_VERSION]: config.serviceVersion || '0.1.0',
-            'deployment.environment': config.environment || process.env.NODE_ENV || 'development',
+        const resource = createResource(resources, {
+            [semconv.ATTR_SERVICE_NAME ?? 'service.name']: serviceName,
+            [semconv.ATTR_SERVICE_VERSION ?? 'service.version']: config.serviceVersion || '0.1.0',
+            'deployment.environment': config.environment || nodeEnv() || 'development',
             ...config.resourceAttributes,
         });
 
-        const instrumentationOverrides: Record<string, any> = {
-            '@opentelemetry/instrumentation-fs': { enabled: false },
-            ...config.instrumentations,
-        };
+        const instrumentationOverrides = autoInstrumentationOptions(config);
 
         const sdk = new NodeSDK({
             resource,
@@ -84,14 +275,19 @@ export async function initOtel(config: OtelConfig, appName: string): Promise<voi
 
         sdk.start();
         sdkInstance = sdk;
-    } catch (err: any) {
+    } catch (err) {
         // Provide a clear error when OTel packages are not installed
-        if (err?.code === 'ERR_MODULE_NOT_FOUND' || err?.code === 'MODULE_NOT_FOUND' || err?.message?.includes('Cannot find')) {
+        const e = err as { code?: string; message?: string } | null;
+        if (
+            e?.code === 'ERR_MODULE_NOT_FOUND' ||
+            e?.code === 'MODULE_NOT_FOUND' ||
+            e?.message?.includes('Cannot find')
+        ) {
             throw new Error(
                 `[iskra/otel] OpenTelemetry packages are not installed. ` +
-                `Install them with: bun add @opentelemetry/sdk-node @opentelemetry/auto-instrumentations-node ` +
-                `@opentelemetry/exporter-trace-otlp-http @opentelemetry/exporter-metrics-otlp-http ` +
-                `@opentelemetry/sdk-metrics @opentelemetry/resources @opentelemetry/semantic-conventions`,
+                    `Install them with: bun add @opentelemetry/sdk-node @opentelemetry/auto-instrumentations-node ` +
+                    `@opentelemetry/exporter-trace-otlp-http @opentelemetry/exporter-metrics-otlp-http ` +
+                    `@opentelemetry/sdk-metrics @opentelemetry/resources @opentelemetry/semantic-conventions`,
             );
         }
         throw err;