server-runtime-injection: ESM hook's vendored imports and @sentry/core ESM build are not traced on Next.js/Vercel, so registration fails on every cold start #26121

Environment

• @sentry/nextjs 11.10.0 (with @sentry/node, @sentry/server-runtime-injection and @sentry/core 11.10.0)
• Next.js 16.4.3, App Router, next build with Turbopack (the default)
• pnpm 9.15.0 (isolated node_modules/.pnpm store)
• Vercel, Node.js 22 functions (nodejs22.x)
• Sentry.init in sentry.server.config.ts with default options, tracesSampleRate: 0

What happens

Every cold start of a Node function logs:

[Sentry] Failed to register diagnostics-channel injection hooks (Cannot find module '/var/task/node_modules/.pnpm/@sentry+server-runtime-injection@11.10.0/node_modules/@sentry/server-runtime-injection/build/esm/vendored/@apm-js-collab/tracing-hooks/hook.js' imported from /var/task/node_modules/.pnpm/@sentry+server-runtime-injection@11.10.0/node_modules/@sentry/server-runtime-injection/build/esm/hook.js), so channel-based integrations will not record spans.

#23687 made build/esm/hook.js itself traceable, and #25480 added build/esm/package.json. Both fixes are in 11.10.0, and hook.js does reach the function. But hook.js imports from build/esm/vendored/**, which Next's file trace does not follow. My guess is that this is because register.js hands the hook to Module.register() by runtime path.

What we tried

We added the package's ESM build to every route's trace:

outputFileTracingIncludes: {
  "/**": ["./node_modules/.pnpm/@sentry+server-runtime-injection@*/node_modules/@sentry/server-runtime-injection/build/esm/**/*.{js,json}"],
}

After deploying, some functions still logged the missing vendored hook.js. Others got past it and failed on the next missing file:

[Sentry] Failed to register diagnostics-channel injection hooks (Cannot find module '/var/task/node_modules/.pnpm/@sentry+server-runtime-injection@11.10.0/node_modules/@sentry/core/build/esm/index.js' imported from /var/task/node_modules/.pnpm/@sentry+server-runtime-injection@11.10.0/node_modules/@sentry/server-runtime-injection/build/esm/debug.js
Did you mean to import "@sentry/core/build/cjs/index.js"?)

The rest of the app loads @sentry/core as CJS, so its ESM build is never traced. The ESM loader hook graph (the vendored tree, debug.js, and @sentry/core's ESM build) needs to be either self-contained in the package or reachable by the tracer.

Expected

With default options on Next.js + Vercel, either the hook registers, or the SDK skips it quietly when its files are absent, instead of warning on every cold start.

Workaround

enableRuntimeChannelInjection: false in the server Sentry.init. That's fine for us because tracing is off, but it silently turns off channel-based spans for anyone who has tracing on.