securenow 8.11.0 → 8.11.1

package/firewall-only.js

@@ -1,5 +1,8 @@
 'use strict';
 
+// Do nothing inside Node's internal ESM-hooks thread (see internal-thread.js).
+if (require('./internal-thread').inInternalThread()) return;
+
 /**
  * Standalone firewall preload — no OpenTelemetry, no tracing.
  *
@@ -7,35 +10,35 @@
  *   node -r securenow/firewall-only app.js
  *   NODE_OPTIONS='-r securenow/firewall-only' next start
  *
- * Reads SecureNow runtime credentials from .securenow/*.json. Initialises the
- * HTTP-level firewall when a snk_live_ API key is resolvable.
- */
-
-const appConfig = require('./app-config');
-const firewallOptions = appConfig.resolveFirewallOptions();
+ * Reads SecureNow runtime credentials from .securenow/*.json. Initialises the
+ * HTTP-level firewall when a snk_live_ API key is resolvable.
+ */
+
+const appConfig = require('./app-config');
+const firewallOptions = appConfig.resolveFirewallOptions();
 
-// Runtime enable/disable is controlled by the dashboard/API toggle. If a
-// firewall key is present, start sync so the remote toggle can be applied.
-if (firewallOptions.apiKey) {
-  require('./firewall').init({
-    apiKey: firewallOptions.apiKey,
-    appKey: firewallOptions.appKey,
-    environment: firewallOptions.environment,
-    apiUrl: firewallOptions.apiUrl,
-    apiUrlFallbacks: firewallOptions.apiUrlFallbacks,
-    versionCheckInterval: firewallOptions.versionCheckInterval,
-    syncInterval: firewallOptions.syncInterval,
-    failMode: firewallOptions.failMode,
-    statusCode: firewallOptions.statusCode,
-    log: firewallOptions.log,
-    tcp: firewallOptions.tcp,
-    iptables: firewallOptions.iptables,
-    cloud: firewallOptions.cloud,
-    cloudDryRun: firewallOptions.cloudDryRun,
-    cloudflare: firewallOptions.cloudflare,
-    aws: firewallOptions.aws,
-    gcp: firewallOptions.gcp,
-  });
+// Runtime enable/disable is controlled by the dashboard/API toggle. If a
+// firewall key is present, start sync so the remote toggle can be applied.
+if (firewallOptions.apiKey) {
+  require('./firewall').init({
+    apiKey: firewallOptions.apiKey,
+    appKey: firewallOptions.appKey,
+    environment: firewallOptions.environment,
+    apiUrl: firewallOptions.apiUrl,
+    apiUrlFallbacks: firewallOptions.apiUrlFallbacks,
+    versionCheckInterval: firewallOptions.versionCheckInterval,
+    syncInterval: firewallOptions.syncInterval,
+    failMode: firewallOptions.failMode,
+    statusCode: firewallOptions.statusCode,
+    log: firewallOptions.log,
+    tcp: firewallOptions.tcp,
+    iptables: firewallOptions.iptables,
+    cloud: firewallOptions.cloud,
+    cloudDryRun: firewallOptions.cloudDryRun,
+    cloudflare: firewallOptions.cloudflare,
+    aws: firewallOptions.aws,
+    gcp: firewallOptions.gcp,
+  });
 
   const shutdown = () => { try { require('./firewall').shutdown(); } catch (_) {} };
   process.on('SIGINT', shutdown);

package/internal-thread.js

@@ -0,0 +1,22 @@
+'use strict';
+
+/**
+ * Node runs --require preloads inside its internal module-customization-hooks
+ * thread too (the worker module.register() starts for ESM loader hooks). The
+ * SecureNow preloads must only initialize in application threads: in that
+ * internal thread they started a second OpenTelemetry SDK and a second firewall
+ * poller, and registered the ESM hook twice ("The 'import-in-the-middle' hook
+ * has already been initialized").
+ *
+ * worker_threads.isInternalThread exists on Node >= 22.14 / 23.7. Older Node has
+ * no reliable way to tell that thread from a user Worker, so nothing changes there.
+ */
+function inInternalThread() {
+  try {
+    return require('node:worker_threads').isInternalThread === true;
+  } catch (_) {
+    return false;
+  }
+}
+
+module.exports = { inInternalThread };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.11.0",
+  "version": "8.11.1",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",
@@ -10,7 +10,7 @@
     "securenow-mcp": "mcp/server.js"
   },
   "scripts": {
-    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-package-contents.js"
+    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-internal-thread.js && node test-package-contents.js"
   },
   "keywords": [
     "opentelemetry",
@@ -159,6 +159,7 @@
     "firewall.js",
     "challenge.js",
     "otel-defaults.js",
+    "internal-thread.js",
     "legacy-semconv.js",
     "rate-limits.js",
     "rate-limits.d.ts",

package/register.js

@@ -4,9 +4,12 @@
 // For ESM apps ("type": "module"), this file auto-registers the
 // OpenTelemetry ESM loader hook via module.register() (Node >=20.6).
 // On older Node versions it falls back to a warning.
-'use strict';
-
-// 1. Auto-register the ESM loader hook so customers never need --import
+'use strict';
+
+// Do nothing inside Node's internal ESM-hooks thread (see internal-thread.js).
+if (require('./internal-thread').inInternalThread()) return;
+
+// 1. Auto-register the ESM loader hook so customers never need --import
 (() => {
   try {
     const fs = require('fs');
@@ -14,7 +17,7 @@
     const pkgPath = path.resolve(process.cwd(), 'package.json');
     if (!fs.existsSync(pkgPath)) return;
 
-    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8').replace(/^\uFEFF/, ''));
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8').replace(/^\uFEFF/, ''));
     if (pkg.type !== 'module') return;
 
     // Already registered via --import?
@@ -37,5 +40,5 @@
   }
 })();
 
-// 2. Run the OTel SDK setup
-require('./tracing');
+// 2. Run the OTel SDK setup
+require('./tracing');