securenow 5.4.0 → 5.5.0

package/nextjs.js

@@ -5,18 +5,36 @@
  * 
  * Usage in Next.js app:
  * 
- * 1. Create instrumentation.ts (or .js) in your project root:
+ * 1. Add serverExternalPackages to next.config.js (REQUIRED to avoid webpack bundling issues):
+ * 
+ *    const nextConfig = {
+ *      serverExternalPackages: [
+ *        "securenow",
+ *        "@opentelemetry/sdk-node",
+ *        "@opentelemetry/auto-instrumentations-node",
+ *        "@opentelemetry/instrumentation-http",
+ *        "@opentelemetry/exporter-trace-otlp-http",
+ *        "@opentelemetry/exporter-logs-otlp-http",
+ *        "@opentelemetry/sdk-logs",
+ *        "@opentelemetry/instrumentation",
+ *        "@opentelemetry/resources",
+ *        "@opentelemetry/semantic-conventions",
+ *        "@opentelemetry/api",
+ *        "@opentelemetry/api-logs",
+ *        "@vercel/otel",
+ *      ],
+ *    };
+ * 
+ * 2. Create instrumentation.ts (or .js) in your project root:
  * 
  *    import { registerSecureNow } from 'securenow/nextjs';
  *    export function register() {
  *      registerSecureNow();
  *    }
  * 
- * 2. Set environment variables:
+ * 3. Set environment variables:
  *    SECURENOW_APPID=my-nextjs-app
  *    SECURENOW_INSTANCE=http://your-otlp-backend:4318
- * 
- * That's it! 🎉 No webpack warnings!
  */
 
 const { v4: uuidv4 } = require('uuid');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "5.4.0",
+  "version": "5.5.0",
   "description": "OpenTelemetry instrumentation for Node.js and Next.js - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",
@@ -64,6 +64,7 @@
       "default": "./nextjs-wrapper.js"
     },
     "./nextjs-webpack-config": "./nextjs-webpack-config.js",
+    "./package.json": "./package.json",
     "./register-vite": "./register-vite.js",
     "./web-vite": {
       "import": "./web-vite.mjs",
@@ -105,7 +106,7 @@
     "@opentelemetry/instrumentation": "0.47.0",
     "@opentelemetry/instrumentation-document-load": "0.47.0",
     "@opentelemetry/instrumentation-fetch": "0.47.0",
-    "@opentelemetry/instrumentation-http": "^0.208.0",
+    "@opentelemetry/instrumentation-http": "0.47.0",
     "@opentelemetry/instrumentation-user-interaction": "0.47.0",
     "@opentelemetry/instrumentation-xml-http-request": "0.47.0",
     "@opentelemetry/resources": "1.20.0",

package/tracing.js

@@ -1,7 +1,10 @@
 'use strict';
 
 /**
- * Preload with: NODE_OPTIONS="-r securenow/register"
+ * Preload with: node --require securenow/register app.js
+ *
+ * For ESM apps ("type": "module" in package.json), you MUST also add the ESM loader hook:
+ *   node --import @opentelemetry/instrumentation/hook.mjs --require securenow/register app.js
  *
  * Env:
  *   SECURENOW_APPID=logical-name              # or OTEL_SERVICE_NAME=logical-name
@@ -97,6 +100,27 @@ function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
   return redacted;
 }
 
+// -------- ESM detection --------
+(() => {
+  try {
+    const fs = require('fs');
+    const path = require('path');
+    const pkgPath = path.resolve(process.cwd(), 'package.json');
+    if (fs.existsSync(pkgPath)) {
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+      if (pkg.type === 'module') {
+        const execArgv = process.execArgv.join(' ');
+        const hasEsmHook = execArgv.includes('hook.mjs') || execArgv.includes('import-in-the-middle');
+        if (!hasEsmHook) {
+          console.warn('[securenow] ⚠️  ESM app detected ("type": "module") but no ESM loader hook found.');
+          console.warn('[securenow]    Instrumentations will NOT work without the ESM hook.');
+          console.warn('[securenow]    Fix: node --import @opentelemetry/instrumentation/hook.mjs --require securenow/register app.js');
+        }
+      }
+    }
+  } catch (_) {}
+})();
+
 // -------- diagnostics --------
 (() => {
   const L = (env('OTEL_LOG_LEVEL') || '').toLowerCase();