securenow 8.10.0 → 8.11.1

package/cli/agent.js

@@ -0,0 +1,65 @@
+'use strict';
+
+// `securenow agent` — the SOC runbook prompts that SecureNow's retired built-in
+// AI Security Agent used to run on a cron. Print them here so customers can run
+// the same work externally with their own harness (Claude, Hermes, OpenClaw, or
+// any MCP-capable agent), e.g.:
+//
+//   claude -p "$(securenow agent prompt patrol --confirm-writes)"
+//
+// The same prompts are published over MCP via prompts/list (soc_patrol,
+// work_alert_review, work_human_actions, ...).
+
+const ui = require('./ui');
+const { PROMPTS, promptMessages } = require('../mcp/catalog.js');
+
+const PROMPT_ALIASES = {
+  patrol: 'soc_patrol',
+  soc_patrol: 'soc_patrol',
+  'alert-review': 'work_alert_review',
+  work_alert_review: 'work_alert_review',
+  'human-queue': 'work_human_actions',
+  human: 'work_human_actions',
+  work_human_actions: 'work_human_actions',
+};
+
+function promptText(name, args) {
+  const messages = promptMessages(name, args);
+  return messages
+    .map((message) => message?.content?.text || '')
+    .filter(Boolean)
+    .join('\n\n');
+}
+
+async function prompts(args, flags = {}) {
+  const rows = PROMPTS.map((p) => ({ name: p.name, title: p.title, description: p.description }));
+  if (flags.json) return ui.json({ prompts: rows, aliases: PROMPT_ALIASES });
+  ui.heading('SecureNow agent runbook prompts');
+  for (const row of rows) {
+    console.log(`- ${row.name}: ${row.description}`);
+  }
+  console.log('');
+  console.log('Print one with: securenow agent prompt <patrol|alert-review|human-queue|full name>');
+  console.log('Scheduled example: claude -p "$(securenow agent prompt patrol --confirm-writes)"');
+}
+
+async function prompt(args, flags = {}) {
+  const ref = String(args[0] || 'patrol').toLowerCase();
+  const name = PROMPT_ALIASES[ref] || ref;
+  if (!PROMPTS.some((p) => p.name === name)) {
+    throw new Error(`Unknown prompt "${args[0]}". Run \`securenow agent prompts\` to list them.`);
+  }
+  const promptArgs = {
+    confirmWrites: Boolean(flags['confirm-writes'] || flags.confirmWrites || flags.yes),
+  };
+  if (flags.limit) promptArgs.limit = flags.limit;
+  if (flags.search) promptArgs.search = flags.search;
+  if (flags['max-alert-review-groups']) promptArgs.maxAlertReviewGroups = flags['max-alert-review-groups'];
+  if (flags['max-human-rows']) promptArgs.maxHumanRows = flags['max-human-rows'];
+
+  const text = promptText(name, promptArgs);
+  if (flags.json) return ui.json({ name, prompt: text });
+  console.log(text);
+}
+
+module.exports = { prompt, prompts };

package/cli.js

@@ -188,54 +188,54 @@ const COMMANDS = {
     },
     defaultSub: 'list',
   },
-  logs: {
+  logs: {
     desc: 'View application logs',
     usage: 'securenow logs [options]',
     sub: {
       list: { desc: 'List recent logs', flags: { app: 'App key', env: 'Environment (production, staging, preview, local, or all)', environment: 'Alias for --env', limit: 'Max results (default 200)', since: 'Time window (e.g. 30m, 6h, 2d)', minutes: 'Time window in minutes (alias for --since Nm)', level: 'Filter by level (error, warn, info, debug)', start: 'Start time (ISO 8601)', end: 'End time (ISO 8601)' }, run: (a, f) => require('./cli/monitor').logsList(a, f) },
       trace: { desc: 'Show logs for a trace', usage: 'securenow logs trace <traceId>', flags: { app: 'App key', env: 'Environment', environment: 'Alias for --env' }, run: (a, f) => require('./cli/monitor').logsTrace(a, f) },
     },
-    defaultSub: 'list',
-  },
-  telemetry: {
-    desc: 'Inspect the alert-SQL telemetry contract and fields observed for an app',
-    usage: 'securenow telemetry <schema|fields> [options]',
-    flags: {
-      app: 'With fields: application key (defaults to connected/default app)',
-      env: 'With fields: environment or all (default: production)',
-      since: 'With fields: observation window such as 30m, 24h, or 7d (maximum 30d)',
-      source: 'Schema section or live signal source',
-      limit: 'With fields: maximum fields per signal (1-500, default 200)',
-      json: 'Machine-readable output',
-    },
-    sub: {
-      schema: {
-        desc: 'Print the packaged ClickHouse tables, fields, mappings, and SQL requirements',
-        usage: 'securenow telemetry schema [all|logs|traces|events] [--json]',
-        flags: {
-          source: 'Schema section: all, logs, traces, or events',
-          json: 'Output the machine-readable contract as JSON',
-        },
-        run: (a, f) => require('./cli/telemetry').schema(a, f),
-      },
-      fields: {
-        desc: 'Discover fields and custom event types actually emitted by an app',
-        usage: 'securenow telemetry fields [--app <key>] [--env production] [--since 24h] [--source all] [--limit 200] [--json]',
-        flags: {
-          app: 'Application key (defaults to connected/default app)',
-          env: 'Environment, comma-separated environments, or all (default: production)',
-          environment: 'Alias for --env',
-          since: 'Observation window such as 30m, 24h, or 7d (maximum 30d)',
-          source: 'Signal source: all, logs, or traces',
-          limit: 'Maximum fields per signal (1-500, default 200)',
-          json: 'Output JSON for agents and scripts',
-        },
-        run: (a, f) => require('./cli/telemetry').fields(a, f),
-      },
-    },
-    defaultSub: 'schema',
-  },
-  notifications: {
+    defaultSub: 'list',
+  },
+  telemetry: {
+    desc: 'Inspect the alert-SQL telemetry contract and fields observed for an app',
+    usage: 'securenow telemetry <schema|fields> [options]',
+    flags: {
+      app: 'With fields: application key (defaults to connected/default app)',
+      env: 'With fields: environment or all (default: production)',
+      since: 'With fields: observation window such as 30m, 24h, or 7d (maximum 30d)',
+      source: 'Schema section or live signal source',
+      limit: 'With fields: maximum fields per signal (1-500, default 200)',
+      json: 'Machine-readable output',
+    },
+    sub: {
+      schema: {
+        desc: 'Print the packaged ClickHouse tables, fields, mappings, and SQL requirements',
+        usage: 'securenow telemetry schema [all|logs|traces|events] [--json]',
+        flags: {
+          source: 'Schema section: all, logs, traces, or events',
+          json: 'Output the machine-readable contract as JSON',
+        },
+        run: (a, f) => require('./cli/telemetry').schema(a, f),
+      },
+      fields: {
+        desc: 'Discover fields and custom event types actually emitted by an app',
+        usage: 'securenow telemetry fields [--app <key>] [--env production] [--since 24h] [--source all] [--limit 200] [--json]',
+        flags: {
+          app: 'Application key (defaults to connected/default app)',
+          env: 'Environment, comma-separated environments, or all (default: production)',
+          environment: 'Alias for --env',
+          since: 'Observation window such as 30m, 24h, or 7d (maximum 30d)',
+          source: 'Signal source: all, logs, or traces',
+          limit: 'Maximum fields per signal (1-500, default 200)',
+          json: 'Output JSON for agents and scripts',
+        },
+        run: (a, f) => require('./cli/telemetry').fields(a, f),
+      },
+    },
+    defaultSub: 'schema',
+  },
+  notifications: {
     desc: 'Manage notifications',
     usage: 'securenow notifications <subcommand> [options]',
     sub: {
@@ -288,6 +288,23 @@ const COMMANDS = {
     },
     defaultSub: 'list',
   },
+  agent: {
+    desc: 'SOC runbook prompts for running the SecureNow agent work with your own harness (Claude, Hermes, OpenClaw, ...)',
+    usage: 'securenow agent <prompt|prompts> [patrol|alert-review|human-queue] [options]',
+    flags: {
+      json: 'Output as JSON',
+      'confirm-writes': 'Emit the prompt variant that allows the external agent to execute decisions',
+      limit: 'Row/group budget baked into the prompt',
+      search: 'Optional search filter baked into the prompt',
+      'max-alert-review-groups': 'SOC patrol: max alert-review root-cause groups per pass',
+      'max-human-rows': 'SOC patrol: max Requires Human rows per pass',
+    },
+    sub: {
+      prompt: { desc: 'Print one runbook prompt (pipe it into your harness or schedule it on a cron)', usage: 'securenow agent prompt <patrol|alert-review|human-queue> [--confirm-writes]', run: (a, f) => require('./cli/agent').prompt(a, f) },
+      prompts: { desc: 'List the available runbook prompts (same catalog as MCP prompts/list)', run: (a, f) => require('./cli/agent').prompts(a, f) },
+    },
+    defaultSub: 'prompts',
+  },
   alerts: {
     desc: 'Manage alerting',
     usage: 'securenow alerts <subcommand> [options]',
@@ -803,7 +820,7 @@ function showHelp(commandName) {
     'Investigate': ['ip', 'forensics'],
     'Firewall': ['firewall'],
     'Remediation': ['automation', 'ratelimit', 'challenge', 'blocklist', 'revoke', 'allowlist', 'trusted'],
-    'Telemetry': ['telemetry', 'log', 'event', 'test-span'],
+    'Telemetry': ['telemetry', 'log', 'event', 'test-span'],
     'Utilities': ['redact', 'cidr', 'doctor', 'env', 'mcp'],
     'Settings': ['instances', 'config', 'version'],
   };

package/firewall-only.js

@@ -1,5 +1,8 @@
 'use strict';
 
+// Do nothing inside Node's internal ESM-hooks thread (see internal-thread.js).
+if (require('./internal-thread').inInternalThread()) return;
+
 /**
  * Standalone firewall preload — no OpenTelemetry, no tracing.
  *
@@ -7,35 +10,35 @@
  *   node -r securenow/firewall-only app.js
  *   NODE_OPTIONS='-r securenow/firewall-only' next start
  *
- * Reads SecureNow runtime credentials from .securenow/*.json. Initialises the
- * HTTP-level firewall when a snk_live_ API key is resolvable.
- */
-
-const appConfig = require('./app-config');
-const firewallOptions = appConfig.resolveFirewallOptions();
+ * Reads SecureNow runtime credentials from .securenow/*.json. Initialises the
+ * HTTP-level firewall when a snk_live_ API key is resolvable.
+ */
+
+const appConfig = require('./app-config');
+const firewallOptions = appConfig.resolveFirewallOptions();
 
-// Runtime enable/disable is controlled by the dashboard/API toggle. If a
-// firewall key is present, start sync so the remote toggle can be applied.
-if (firewallOptions.apiKey) {
-  require('./firewall').init({
-    apiKey: firewallOptions.apiKey,
-    appKey: firewallOptions.appKey,
-    environment: firewallOptions.environment,
-    apiUrl: firewallOptions.apiUrl,
-    apiUrlFallbacks: firewallOptions.apiUrlFallbacks,
-    versionCheckInterval: firewallOptions.versionCheckInterval,
-    syncInterval: firewallOptions.syncInterval,
-    failMode: firewallOptions.failMode,
-    statusCode: firewallOptions.statusCode,
-    log: firewallOptions.log,
-    tcp: firewallOptions.tcp,
-    iptables: firewallOptions.iptables,
-    cloud: firewallOptions.cloud,
-    cloudDryRun: firewallOptions.cloudDryRun,
-    cloudflare: firewallOptions.cloudflare,
-    aws: firewallOptions.aws,
-    gcp: firewallOptions.gcp,
-  });
+// Runtime enable/disable is controlled by the dashboard/API toggle. If a
+// firewall key is present, start sync so the remote toggle can be applied.
+if (firewallOptions.apiKey) {
+  require('./firewall').init({
+    apiKey: firewallOptions.apiKey,
+    appKey: firewallOptions.appKey,
+    environment: firewallOptions.environment,
+    apiUrl: firewallOptions.apiUrl,
+    apiUrlFallbacks: firewallOptions.apiUrlFallbacks,
+    versionCheckInterval: firewallOptions.versionCheckInterval,
+    syncInterval: firewallOptions.syncInterval,
+    failMode: firewallOptions.failMode,
+    statusCode: firewallOptions.statusCode,
+    log: firewallOptions.log,
+    tcp: firewallOptions.tcp,
+    iptables: firewallOptions.iptables,
+    cloud: firewallOptions.cloud,
+    cloudDryRun: firewallOptions.cloudDryRun,
+    cloudflare: firewallOptions.cloudflare,
+    aws: firewallOptions.aws,
+    gcp: firewallOptions.gcp,
+  });
 
   const shutdown = () => { try { require('./firewall').shutdown(); } catch (_) {} };
   process.on('SIGINT', shutdown);

package/internal-thread.js

@@ -0,0 +1,22 @@
+'use strict';
+
+/**
+ * Node runs --require preloads inside its internal module-customization-hooks
+ * thread too (the worker module.register() starts for ESM loader hooks). The
+ * SecureNow preloads must only initialize in application threads: in that
+ * internal thread they started a second OpenTelemetry SDK and a second firewall
+ * poller, and registered the ESM hook twice ("The 'import-in-the-middle' hook
+ * has already been initialized").
+ *
+ * worker_threads.isInternalThread exists on Node >= 22.14 / 23.7. Older Node has
+ * no reliable way to tell that thread from a user Worker, so nothing changes there.
+ */
+function inInternalThread() {
+  try {
+    return require('node:worker_threads').isInternalThread === true;
+  } catch (_) {
+    return false;
+  }
+}
+
+module.exports = { inInternalThread };

package/legacy-semconv.js

@@ -0,0 +1,349 @@
+'use strict';
+
+/**
+ * Legacy semantic-convention attributes for the OpenTelemetry 0.221+ /
+ * contrib 0.74+ instrumentations, which emit ONLY the stable conventions.
+ * OTEL_SEMCONV_STABILITY_OPT_IN no longer brings the old names back.
+ *
+ * The SecureNow telemetry contract (telemetry-schema.json "automaticTraceFields"),
+ * dashboard queries, alert-rule SQL, block/impact reports and false-positive
+ * conditions filter on the legacy names. This module restores them next to the
+ * stable ones:
+ *
+ *  - HTTP (withLegacyHttpSemconv): http.method, http.target, http.url,
+ *    http.status_code, http.host, http.scheme, http.user_agent, net.peer.ip, ...
+ *    via the HttpInstrumentation's public hooks, reproducing what
+ *    instrumentation-http <= 0.220 emitted by default.
+ *  - Databases (withLegacyDbSemconvExporter): db.statement, db.system, db.name,
+ *    db.operation, db.mongodb.collection / db.sql.table, net.peer.name/port,
+ *    derived at export time from db.query.text, db.system.name, db.namespace,
+ *    db.operation.name, db.collection.name, server.address/port. The values are
+ *    the same ones the old instrumentations wrote under both names.
+ *
+ * Deliberate HTTP differences from <= 0.220:
+ *  - http.client_ip is NOT derived from the first X-Forwarded-For entry (that
+ *    value is spoofable). SecureNow's requestHook sets http.client_ip from the
+ *    trusted-proxy resolver (resolve-ip.js).
+ *  - Signature-style query parameters (same list upstream now redacts on
+ *    url.query / url.full) are replaced with REDACTED in http.target / http.url.
+ *    Every other byte of the target is kept exactly as received, so detection
+ *    rules that match encoded payloads keep working.
+ */
+
+// Mirrors DEFAULT_QUERY_STRINGS_TO_REDACT in @opentelemetry/instrumentation-http.
+const DEFAULT_REDACTED_QUERY_PARAMS = Object.freeze([
+  'sig',
+  'Signature',
+  'AWSAccessKeyId',
+  'X-Goog-Signature',
+  'X-Amz-Signature',
+  'X-Amz-Credential',
+  'X-Amz-Security-Token',
+]);
+const REDACTED = 'REDACTED';
+
+function isServerResponse(value) {
+  return !!value && typeof value.setHeader === 'function' && typeof value.writeHead === 'function';
+}
+
+function defined(attributes) {
+  const out = {};
+  for (const key of Object.keys(attributes)) {
+    if (attributes[key] !== undefined && attributes[key] !== null) out[key] = attributes[key];
+  }
+  return out;
+}
+
+/**
+ * Redact the values of sensitive query parameters in a `?query` string while
+ * leaving every other byte untouched (no re-encoding). Returns the input when
+ * nothing matched.
+ */
+function redactSearch(search, paramsToRedact = DEFAULT_REDACTED_QUERY_PARAMS) {
+  if (typeof search !== 'string' || search.length < 2 || search[0] !== '?') return search;
+  const sensitive = new Set(paramsToRedact || []);
+  if (sensitive.size === 0) return search;
+  let changed = false;
+  const parts = search.slice(1).split('&').map((part) => {
+    const eq = part.indexOf('=');
+    const rawKey = eq === -1 ? part : part.slice(0, eq);
+    let key = rawKey;
+    try {
+      key = decodeURIComponent(rawKey.replace(/\+/g, ' '));
+    } catch (_) {}
+    if (!sensitive.has(key)) return part;
+    changed = true;
+    return `${rawKey}=${REDACTED}`;
+  });
+  return changed ? `?${parts.join('&')}` : search;
+}
+
+function contentLengthAttributes(headers, direction) {
+  const raw = headers && headers['content-length'];
+  if (raw === undefined) return {};
+  const length = parseInt(raw, 10);
+  if (Number.isNaN(length)) return {};
+  const encoding = headers['content-encoding'];
+  const compressed = !!encoding && encoding !== 'identity';
+  return compressed
+    ? { [`http.${direction}_content_length`]: length }
+    : { [`http.${direction}_content_length_uncompressed`]: length };
+}
+
+function httpKindAttributes(httpVersion) {
+  if (!httpVersion) return {};
+  return {
+    'http.flavor': httpVersion,
+    'net.transport': String(httpVersion).toUpperCase() !== 'QUIC' ? 'ip_tcp' : 'ip_udp',
+  };
+}
+
+// ---- incoming (SERVER spans) ----
+
+function incomingRequestAttributes(request, paramsToRedact) {
+  const headers = request.headers || {};
+  const component = request.socket && request.socket.encrypted ? 'https' : 'http';
+  const host = headers.host;
+  const hostname = (typeof host === 'string' && host.replace(/^(.*)(:[0-9]{1,5})/, '$1')) || 'localhost';
+  const userAgent = headers['user-agent'];
+
+  let pathname;
+  let search = '';
+  let fullUrl;
+  try {
+    if (host) {
+      const parsed = new URL(request.url || '/', `${component}://${host}`);
+      pathname = parsed.pathname;
+      const redacted = redactSearch(parsed.search, paramsToRedact);
+      if (redacted !== parsed.search) parsed.search = redacted;
+      search = parsed.search;
+      fullUrl = parsed.toString();
+    } else {
+      const parsed = new URL(request.url || '/', `${component}://localhost`);
+      pathname = parsed.pathname;
+      search = redactSearch(parsed.search, paramsToRedact);
+      fullUrl = pathname + search;
+    }
+  } catch (_) {}
+
+  const attributes = {
+    'http.url': fullUrl,
+    'http.host': host,
+    'net.host.name': hostname,
+    'http.method': request.method,
+    'http.scheme': component,
+    ...contentLengthAttributes(headers, 'request'),
+    ...httpKindAttributes(request.httpVersion),
+  };
+  if (pathname) attributes['http.target'] = pathname + search || '/';
+  if (userAgent !== undefined) attributes['http.user_agent'] = userAgent;
+  return defined(attributes);
+}
+
+function incomingResponseAttributes(request, response) {
+  const socket = request && request.socket;
+  const attributes = {
+    'http.status_code': response.statusCode,
+    'http.status_text': String(response.statusMessage || '').toUpperCase(),
+  };
+  if (socket) {
+    attributes['net.host.ip'] = socket.localAddress;
+    attributes['net.host.port'] = socket.localPort;
+    attributes['net.peer.ip'] = socket.remoteAddress;
+    attributes['net.peer.port'] = socket.remotePort;
+  }
+  return defined(attributes);
+}
+
+// ---- outgoing (CLIENT spans) ----
+
+function hostnameAndPort(options) {
+  if (options.hostname && options.port) return { hostname: options.hostname, port: options.port };
+  const matches = (typeof options.host === 'string' && options.host.match(/^([^:/ ]+)(:\d{1,5})?/)) || null;
+  const hostname = options.hostname || (matches === null ? 'localhost' : matches[1]);
+  let port = options.port;
+  if (!port) {
+    if (matches && matches[2]) port = matches[2].substring(1);
+    else port = options.protocol === 'https:' ? '443' : '80';
+  }
+  return { hostname, port };
+}
+
+function absoluteUrl(options, headers, paramsToRedact) {
+  const protocol = options.protocol || 'http:';
+  const port = String(options.port || '');
+  let path = options.path || '/';
+  let host = options.host || options.hostname || headers.host || 'localhost';
+  if (String(host).indexOf(':') === -1 && port && port !== '80' && port !== '443') host += `:${port}`;
+  if (path.includes('?')) {
+    // Same WHATWG normalization as instrumentation-http <= 0.220.
+    try {
+      const parsed = new URL(path, 'http://localhost');
+      path = `${parsed.pathname}${redactSearch(parsed.search, paramsToRedact)}`;
+    } catch (_) {}
+  }
+  const auth = options.auth ? `${REDACTED}:${REDACTED}@` : '';
+  return `${protocol}//${auth}${host}${path}`;
+}
+
+function outgoingRequestAttributes(options, paramsToRedact) {
+  const headers = options.headers || {};
+  const { hostname, port } = hostnameAndPort(options);
+  const rawPath = options.path || '/';
+  const q = rawPath.indexOf('?');
+  const target = q === -1 ? rawPath : rawPath.slice(0, q) + redactSearch(rawPath.slice(q), paramsToRedact);
+  const attributes = {
+    'http.url': absoluteUrl(options, headers, paramsToRedact),
+    'http.method': options.method || 'GET',
+    'http.target': target,
+    'net.peer.name': hostname,
+    'http.host': headers.host !== undefined ? headers.host : `${hostname}:${port}`,
+  };
+  if (headers['user-agent'] !== undefined) attributes['http.user_agent'] = headers['user-agent'];
+  return defined(attributes);
+}
+
+function outgoingResponseAttributes(response) {
+  const { statusCode, statusMessage, httpVersion, socket } = response;
+  const attributes = {
+    ...contentLengthAttributes(response.headers || {}, 'response'),
+    ...httpKindAttributes(httpVersion),
+  };
+  if (socket) {
+    attributes['net.peer.ip'] = socket.remoteAddress;
+    attributes['net.peer.port'] = socket.remotePort;
+  }
+  if (statusCode) {
+    attributes['http.status_code'] = statusCode;
+    attributes['http.status_text'] = String(statusMessage || '').toUpperCase();
+  }
+  return defined(attributes);
+}
+
+function safe(fn, fallback) {
+  try {
+    return fn();
+  } catch (_) {
+    return fallback;
+  }
+}
+
+/**
+ * Returns a copy of an HttpInstrumentation config whose hooks also emit the
+ * legacy attributes. Existing hooks are preserved and run after the legacy
+ * attributes are set (same ordering as instrumentation-http <= 0.220, so a
+ * caller hook can still override a legacy value), except for the final
+ * server-side status which, like <= 0.220, is written when the response ends.
+ */
+function withLegacyHttpSemconv(config = {}) {
+  const serverParams = config.redactedQueryParamsServer || DEFAULT_REDACTED_QUERY_PARAMS;
+  const clientParams = config.redactedQueryParams || DEFAULT_REDACTED_QUERY_PARAMS;
+  const {
+    startIncomingSpanHook,
+    startOutgoingSpanHook,
+    responseHook,
+    applyCustomAttributesOnSpan,
+  } = config;
+
+  return {
+    ...config,
+    startIncomingSpanHook(request) {
+      const legacy = safe(() => incomingRequestAttributes(request, serverParams), {});
+      const custom = typeof startIncomingSpanHook === 'function' ? startIncomingSpanHook(request) : undefined;
+      return { ...legacy, ...(custom || {}) };
+    },
+    startOutgoingSpanHook(options) {
+      const legacy = safe(() => outgoingRequestAttributes(options, clientParams), {});
+      const custom = typeof startOutgoingSpanHook === 'function' ? startOutgoingSpanHook(options) : undefined;
+      return { ...legacy, ...(custom || {}) };
+    },
+    responseHook(span, response) {
+      // CLIENT spans receive the IncomingMessage here once the response
+      // arrives. SERVER spans receive the ServerResponse before the handler
+      // runs; their legacy status is set in applyCustomAttributesOnSpan.
+      if (!isServerResponse(response)) {
+        safe(() => span.setAttributes(outgoingResponseAttributes(response)));
+      }
+      if (typeof responseHook === 'function') responseHook(span, response);
+    },
+    applyCustomAttributesOnSpan(span, request, response) {
+      if (isServerResponse(response)) {
+        safe(() => span.setAttributes(incomingResponseAttributes(request, response)));
+      }
+      if (typeof applyCustomAttributesOnSpan === 'function') applyCustomAttributesOnSpan(span, request, response);
+    },
+  };
+}
+
+// ---- databases (contrib instrumentations >= 0.74) ----
+
+// Stable db.system.name values that differ from the legacy db.system values.
+const LEGACY_DB_SYSTEM = Object.freeze({
+  'microsoft.sql_server': 'mssql',
+  'oracle.db': 'oracle',
+});
+const SQL_SYSTEMS = new Set(['mssql', 'microsoft.sql_server']);
+// instrumentation-mongoose 0.64/0.66 (securenow 8.9/8.10) wrote db.system="mongoose";
+// 0.68 only reports db.system.name="mongodb". Keep "mongoose" so `db.system = 'mongodb'` queries don't
+// start double-counting each operation (mongoose span + driver span).
+const LEGACY_DB_SYSTEM_BY_SCOPE = Object.freeze({
+  '@opentelemetry/instrumentation-mongoose': 'mongoose',
+});
+
+function legacyDbAttributes(attributes, scopeName) {
+  if (!attributes || attributes['db.system.name'] === undefined) return null;
+  const system = attributes['db.system.name'];
+  const legacy = {};
+  const alias = (from, to, map) => {
+    if (attributes[from] === undefined || attributes[to] !== undefined) return;
+    legacy[to] = map ? map(attributes[from]) : attributes[from];
+  };
+  alias('db.system.name', 'db.system', (v) => LEGACY_DB_SYSTEM_BY_SCOPE[scopeName] || LEGACY_DB_SYSTEM[v] || v);
+  alias('db.query.text', 'db.statement');
+  alias('db.namespace', 'db.name');
+  alias('db.operation.name', 'db.operation');
+  alias('server.address', 'net.peer.name');
+  alias('server.port', 'net.peer.port');
+  if (system === 'mongodb') alias('db.collection.name', 'db.mongodb.collection');
+  else if (SQL_SYSTEMS.has(system)) alias('db.collection.name', 'db.sql.table');
+  return Object.keys(legacy).length ? legacy : null;
+}
+
+/**
+ * Wraps a SpanExporter so database client spans are exported with the legacy
+ * db.* aliases as well. The finished span is not mutated: the exporter gets a
+ * view that delegates to it and only overrides `attributes`.
+ */
+function withLegacyDbSemconvExporter(exporter) {
+  const view = (span) => {
+    const legacy = safe(() => legacyDbAttributes(span.attributes, span.instrumentationScope && span.instrumentationScope.name), null);
+    if (!legacy) return span;
+    return Object.create(span, {
+      attributes: { value: { ...span.attributes, ...legacy }, enumerable: true },
+    });
+  };
+  return {
+    export(spans, resultCallback) {
+      const mapped = safe(() => spans.map(view), spans);
+      return exporter.export(mapped, resultCallback);
+    },
+    shutdown() {
+      return exporter.shutdown();
+    },
+    forceFlush() {
+      return typeof exporter.forceFlush === 'function' ? exporter.forceFlush() : Promise.resolve();
+    },
+  };
+}
+
+module.exports = {
+  DEFAULT_REDACTED_QUERY_PARAMS,
+  withLegacyHttpSemconv,
+  withLegacyDbSemconvExporter,
+  legacyDbAttributes,
+  redactSearch,
+  incomingRequestAttributes,
+  incomingResponseAttributes,
+  outgoingRequestAttributes,
+  outgoingResponseAttributes,
+};