securenow 8.11.2 → 8.11.3

package/register.d.ts

@@ -1,11 +1,11 @@
-/**
- * SecureNow Register Module TypeScript Declarations
- * 
- * Main entry point for Node.js/Express/Fastify/NestJS applications.
- * This module is automatically loaded when using NODE_OPTIONS="-r securenow/register"
- */
-
-/**
+/**
+ * SecureNow Register Module TypeScript Declarations
+ * 
+ * Main entry point for Node.js/Express/Fastify/NestJS applications.
+ * This module is automatically loaded when using NODE_OPTIONS="-r securenow/register"
+ */
+
+/**
  * Configuration:
  *
  * Local development reads .securenow/credentials.json. Run
@@ -17,28 +17,28 @@
  * generated JSON to .securenow/credentials.json in the running app.
  *
  * Legacy env vars are fallback-only for existing installs.
- */
-
-// This module has side effects (initializes OpenTelemetry)
-// It's typically used via NODE_OPTIONS, not imported directly
-export {};
-
-/**
- * @example
- * ```bash
- * # Using with Node.js preload
- * NODE_OPTIONS="-r securenow/register" node app.js
- * ```
- * 
- * @example
- * ```bash
- * # Using with PM2
- * pm2 start app.js --node-args="-r securenow/register"
- * ```
- * 
- * @example
- * ```javascript
- * // ecosystem.config.js
+ */
+
+// This module has side effects (initializes OpenTelemetry)
+// It's typically used via NODE_OPTIONS, not imported directly
+export {};
+
+/**
+ * @example
+ * ```bash
+ * # Using with Node.js preload
+ * NODE_OPTIONS="-r securenow/register" node app.js
+ * ```
+ * 
+ * @example
+ * ```bash
+ * # Using with PM2
+ * pm2 start app.js --node-args="-r securenow/register"
+ * ```
+ * 
+ * @example
+ * ```javascript
+ * // ecosystem.config.js
  * module.exports = {
  *   apps: [{
  *     name: 'my-app',
@@ -47,15 +47,15 @@ export {};
  *     // Local and production use .securenow/credentials.json.
  *   }]
  * };
- * ```
- * 
- * @example
- * ```typescript
- * // Explicit import (optional, mainly for side effects)
- * import 'securenow/register';
- * 
- * import express from 'express';
- * const app = express();
- * // Your app code...
- * ```
- */
+ * ```
+ * 
+ * @example
+ * ```typescript
+ * // Explicit import (optional, mainly for side effects)
+ * import 'securenow/register';
+ * 
+ * import express from 'express';
+ * const app = express();
+ * // Your app code...
+ * ```
+ */

package/register.js

@@ -1,44 +1,44 @@
-// securenow/register.js — the only preload customers need:
-//   node --require securenow/register app.js
-//
-// For ESM apps ("type": "module"), this file auto-registers the
-// OpenTelemetry ESM loader hook via module.register() (Node >=20.6).
-// On older Node versions it falls back to a warning.
-'use strict';
-
-// Do nothing inside Node's internal ESM-hooks thread (see internal-thread.js).
-if (require('./internal-thread').inInternalThread()) return;
-
-// 1. Auto-register the ESM loader hook so customers never need --import
-(() => {
-  try {
-    const fs = require('fs');
-    const path = require('path');
-    const pkgPath = path.resolve(process.cwd(), 'package.json');
-    if (!fs.existsSync(pkgPath)) return;
-
-    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8').replace(/^\uFEFF/, ''));
-    if (pkg.type !== 'module') return;
-
-    // Already registered via --import?
-    const execArgv = process.execArgv.join(' ');
-    if (execArgv.includes('hook.mjs') || execArgv.includes('import-in-the-middle')) return;
-
-    // Node >=20.6 exposes module.register() for programmatic ESM hooks
-    const mod = require('node:module');
-    if (typeof mod.register !== 'function') {
-      console.warn('[securenow] ESM app detected but Node %s lacks module.register().', process.version);
-      console.warn('[securenow]    Upgrade to Node >=20.6 or add: --import @opentelemetry/instrumentation/hook.mjs');
-      return;
-    }
-
-    const { pathToFileURL } = require('node:url');
-    mod.register('@opentelemetry/instrumentation/hook.mjs', pathToFileURL(__filename));
-    console.log('[securenow] ESM loader hook auto-registered (module.register)');
-  } catch (_) {
-    // Non-fatal — tracing.js will show its own ESM warning if the hook is missing
-  }
-})();
-
-// 2. Run the OTel SDK setup
-require('./tracing');
+// securenow/register.js — the only preload customers need:
+//   node --require securenow/register app.js
+//
+// For ESM apps ("type": "module"), this file auto-registers the
+// OpenTelemetry ESM loader hook via module.register() (Node >=20.6).
+// On older Node versions it falls back to a warning.
+'use strict';
+
+// Do nothing inside Node's internal ESM-hooks thread (see internal-thread.js).
+if (require('./internal-thread').inInternalThread()) return;
+
+// 1. Auto-register the ESM loader hook so customers never need --import
+(() => {
+  try {
+    const fs = require('fs');
+    const path = require('path');
+    const pkgPath = path.resolve(process.cwd(), 'package.json');
+    if (!fs.existsSync(pkgPath)) return;
+
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8').replace(/^\uFEFF/, ''));
+    if (pkg.type !== 'module') return;
+
+    // Already registered via --import?
+    const execArgv = process.execArgv.join(' ');
+    if (execArgv.includes('hook.mjs') || execArgv.includes('import-in-the-middle')) return;
+
+    // Node >=20.6 exposes module.register() for programmatic ESM hooks
+    const mod = require('node:module');
+    if (typeof mod.register !== 'function') {
+      console.warn('[securenow] ESM app detected but Node %s lacks module.register().', process.version);
+      console.warn('[securenow]    Upgrade to Node >=20.6 or add: --import @opentelemetry/instrumentation/hook.mjs');
+      return;
+    }
+
+    const { pathToFileURL } = require('node:url');
+    mod.register('@opentelemetry/instrumentation/hook.mjs', pathToFileURL(__filename));
+    console.log('[securenow] ESM loader hook auto-registered (module.register)');
+  } catch (_) {
+    // Non-fatal — tracing.js will show its own ESM warning if the hook is missing
+  }
+})();
+
+// 2. Run the OTel SDK setup
+require('./tracing');

package/resolve-ip.js

@@ -1,5 +1,5 @@
-'use strict';
-
+'use strict';
+
 const os = require('os');
 const appConfig = require('./app-config');
 
@@ -121,20 +121,20 @@ function resolveClientIpWithDetails(request) {
 
   return details;
 }
-
-/**
- * Resolve the real client IP from an HTTP request, respecting trusted proxies.
- * Reads X-Forwarded-For / X-Real-IP only when the direct connection comes
- * from a private/trusted proxy IP. Prevents client-side IP spoofing.
- */
+
+/**
+ * Resolve the real client IP from an HTTP request, respecting trusted proxies.
+ * Reads X-Forwarded-For / X-Real-IP only when the direct connection comes
+ * from a private/trusted proxy IP. Prevents client-side IP spoofing.
+ */
 function resolveClientIp(request) {
   return resolveClientIpWithDetails(request).ip || '';
 }
-
-/**
- * Resolve IP from a raw TCP socket (no HTTP headers available).
- * Normalizes IPv6-mapped IPv4 addresses.
- */
+
+/**
+ * Resolve IP from a raw TCP socket (no HTTP headers available).
+ * Normalizes IPv6-mapped IPv4 addresses.
+ */
 function resolveSocketIp(socket) {
   const raw = socket?.remoteAddress || '';
   return normalizeIp(raw);

package/telemetry-schema.json

@@ -111,12 +111,14 @@
       "userId": "attributes_string['enduser.id']",
       "sessionId": "attributes_string['session.id']",
       "ip": "attributes_string['http.client_ip']",
-      "userAgent": "attributes_string['http.user_agent']",
+      "userAgent": "attributes_string['user_agent.original']",
       "severity": "severity_text",
       "attributes.string": "attributes_string['<custom-key>']",
       "attributes.number": "attributes_number['<custom-key>']",
       "attributes.boolean": "attributes_bool['<custom-key>']"
     },
+    "reservedAttributePrefixes": ["event.", "enduser.", "session.", "http.", "service.", "securenow.", "client."],
+    "reservedAttributeNote": "Custom attribute keys with a reserved prefix are stored as attr.<key>. Events keep the sender-supplied timestamp and carry no event ID. client.asn / client.as_org are added from ip only when the instance has ASN enrichment.",
     "recommendedAuthenticationEvents": [
       "auth.login.failure",
       "auth.login.success",