@spectosh/node

Backend spans for Specto session replay — no dependencies. With the browser SDK's traces: true, each request your app makes carries a W3C traceparent header; this tracer continues that trace on your Node server and sends its spans to Specto over OTLP/HTTP. In the replay, the request shows what the server did: timings, child spans, the exception.

Already on OpenTelemetry? Point its OTLP HTTP/JSON exporter at Specto instead (see the backend traces guide).

npm install @spectosh/node

import { createTracer } from '@spectosh/node'

const tracer = createTracer({
  endpoint: 'https://your-specto-host/api/otlp/v1/traces',
  serverKey: process.env.SPECTO_SERVER_KEY, // Settings → Install → Backend traces
  service: 'api',
})

// Express, Connect or node:http
app.use(tracer.middleware())
// … your routes …
app.use(tracer.errorHandler())

// fetch-style handlers (Next.js route handlers, Remix, Hono, TanStack Start…)
export const POST = tracer.wrap(async (request) => Response.json(await checkout(request)))

// child spans
const user = await tracer.span('SELECT users', () => db.query(sql), { 'db.system': 'postgresql' })

• One SERVER span per request, named METHOD /path (Express: the matched route), with http.request.method, url.path and http.response.status_code. Query strings are never recorded.
• Errors thrown inside span() / wrap() (or passed to tracer.captureException(err)) become exception events and mark the span as an error; 5xx responses do too.
• Spans are exported in batches every 2 s; a failed export is retried with the next batch (up to 5,000 spans kept). Call await tracer.flush() before a serverless function returns and await tracer.shutdown() on exit.
• Calling another service: send tracer.current.traceparent as its traceparent header and its spans join the same trace.
• Without an endpoint and key the tracer does nothing — safe in development. Options can also come from SPECTO_OTLP_ENDPOINT, SPECTO_SERVER_KEY and SPECTO_SERVICE.

The server key is a secret: keep it in your server's environment, never in browser code. Specto stores only its hash, redacts attributes named like secrets and masks emails, tokens and card-like numbers on arrival.

MIT licensed.