IAST ESM support for iitm 2

[CarlesDD]

What does this PR do?

Fixes ESM loader detection for IAST rewriter to support import-in-the-middle v2.0.0+.

Key changes:

• Sets a global flag (globalThis.__DD_ESM_LOADER_ACTIVE__) in loader-hook.mjs / initialize.mjs to indicate when the ESM loader is active
• Updates isEsmConfigured() in rewriter.js to check for this flag

Detection logic (in order):

1. Check for --loader or --experimental-loader flags
2. Check for global flag set by loader-hook.mjs
3. Return false if neither condition is met

Motivation

import-in-the-middle v2.0.0 converted all modules running in loader thread to ESM, breaking the existing detection mechanism.

The problem:

• Before (< v2.0.0): hook.js was loaded via require(), so it appeared in require.cache
• After (v2.0.0+): hook.mjs is loaded via ESM imports, so it does NOT appear in require.cache
• The existing isEsmConfigured() function relied on checking require.cache for hook.js, which failed with v2.0.0+

The solution:
Set an explicit global flag when loader-hook.mjs is loaded. This works because:

• All ESM loader scenarios (regardless of Node.js version or entry point) eventually load loader-hook.mjs
• When using --loader/--experimental-loader flags, we can detect them directly from process arguments
• The global flag catches cases where the loader is registered programmatically

Supported scenarios:

Scenario	Node.js Version	Detection Method
--loader dd-trace/loader-hook.mjs	< v20.6	--loader flag
--import dd-trace/register.js	≥ v20.6	Global flag
--import dd-trace/initialize.mjs	≥ v20.6	Global flag

Plugin Checklist

• Unit tests.
• Integration tests.
• Benchmarks.
• TypeScript definitions.
• TypeScript tests.
• API documentation.
• CI jobs/workflows.

Additional Notes

ESM applications only: Import the loader

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.13%. Comparing base (191e908) to head (0b9807b).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #6712   +/-   ##
=======================================
  Coverage   84.13%   84.13%           
=======================================
  Files         505      505           
  Lines       21038    21039    +1     
=======================================
+ Hits        17701    17702    +1     
  Misses       3337     3337           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Overall package size

Self size: 12.85 MB
Deduped: 115.5 MB
No deduping: 117.71 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | @datadog/libdatadog | 0.7.0 | 35.02 MB | 35.02 MB | | @datadog/native-appsec | 10.3.0 | 20.73 MB | 20.74 MB | | @datadog/native-iast-taint-tracking | 4.0.0 | 11.72 MB | 11.73 MB | | @datadog/pprof | 5.11.1 | 9.96 MB | 10.34 MB | | @opentelemetry/core | 1.30.1 | 908.66 kB | 7.16 MB | | protobufjs | 7.5.4 | 2.95 MB | 5.73 MB | | @datadog/wasm-js-rewriter | 4.0.1 | 2.85 MB | 3.58 MB | | @opentelemetry/resources | 1.9.1 | 306.54 kB | 1.74 MB | | @datadog/native-metrics | 3.1.1 | 1.02 MB | 1.43 MB | | @opentelemetry/api-logs | 0.206.0 | 201.39 kB | 1.42 MB | | @opentelemetry/api | 1.9.0 | 1.22 MB | 1.22 MB | | jsonpath-plus | 10.3.0 | 617.18 kB | 1.08 MB | | lru-cache | 10.4.3 | 804.3 kB | 804.3 kB | | import-in-the-middle | 2.0.0 | 68.46 kB | 797.03 kB | | @datadog/openfeature-node-server | 0.1.0-preview.12 | 95.11 kB | 401.68 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | source-map | 0.7.6 | 185.63 kB | 185.63 kB | | pprof-format | 2.2.1 | 163.06 kB | 163.06 kB | | @datadog/sketches-js | 2.1.1 | 109.9 kB | 109.9 kB | | lodash.sortby | 4.7.0 | 75.76 kB | 75.76 kB | | ignore | 7.0.5 | 63.38 kB | 63.38 kB | | istanbul-lib-coverage | 3.2.2 | 34.37 kB | 34.37 kB | | rfdc | 1.4.1 | 27.15 kB | 27.15 kB | | dc-polyfill | 0.1.10 | 26.73 kB | 26.73 kB | | @isaacs/ttlcache | 1.4.1 | 25.2 kB | 25.2 kB | | tlhunter-sorted-set | 0.1.0 | 24.94 kB | 24.94 kB | | shell-quote | 1.8.3 | 23.74 kB | 23.74 kB | | limiter | 1.1.5 | 23.17 kB | 23.17 kB | | retry | 0.13.1 | 18.85 kB | 18.85 kB | | semifies | 1.0.0 | 15.84 kB | 15.84 kB | | jest-docblock | 29.7.0 | 8.99 kB | 12.76 kB | | crypto-randomuuid | 1.0.0 | 11.18 kB | 11.18 kB | | ttl-set | 1.0.0 | 4.61 kB | 9.69 kB | | mutexify | 1.4.0 | 5.71 kB | 8.74 kB | | path-to-regexp | 0.1.12 | 6.6 kB | 6.6 kB | | module-details-from-path | 1.0.4 | 3.96 kB | 3.96 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

[pr-commenter]

Benchmarks

Benchmark execution time: 2025-10-21 15:29:31

Comparing candidate commit 0b9807b in PR branch ccapell/iast-esm-iitm-2 with baseline commit 191e908 in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 1608 metrics, 62 unstable metrics.

[BridgeAR]

We start to pollute the global space quite a bit. What about using a single symbol that is an object for all dd-trace-js related things we want to add to the global space? That way we limit it to that single symbol and it is actually also less visible.

To make it even less visible, I would not make it enumerable either.