securenow 8.23.0 → 8.25.0

package/register-vite.js

@@ -1,5 +1,9 @@
 // node_modules/securenow/register-vite.js  (CommonJS, for -r)
 'use strict';
 
-// Trace the Node process (Vite dev/preview server) using your existing Node tracer
-module.exports = require('./web-vite.mjs');
+// Trace and protect the Node process that serves a Vite app (vite dev / vite preview, or a
+// Vite SSR server): the same runtime as securenow/register.
+//   node -r securenow/register-vite node_modules/vite/bin/vite.js preview
+// (It used to load the browser tracer from web-vite.mjs, which sends nothing since browser
+// ingestion was disabled in 8.0, so this preload captured nothing at all.)
+module.exports = require('./register');

package/register.d.ts

@@ -1,61 +1,54 @@
 /**
  * SecureNow Register Module TypeScript Declarations
- * 
- * Main entry point for Node.js/Express/Fastify/NestJS applications.
- * This module is automatically loaded when using NODE_OPTIONS="-r securenow/register"
+ *
+ * Preload for Node.js servers (Express, Fastify, NestJS, Koa, Hapi, Hono, Polka, Feathers, h3,
+ * raw node:http): `node -r securenow/register <entry>`. It starts tracing, logs, body capture,
+ * the firewall and (when configured) session revocation before the app loads.
  */
 
 /**
- * Configuration:
- *
- * Local development reads .securenow/credentials.json. Run
- * `npx securenow login` to choose/create an app, then `npx securenow init`
- * to ensure secure defaults and explanations are present.
- *
- * Production uses the same file shape. Run
- * `npx securenow credentials runtime --env production`, then mount/copy the
- * generated JSON to .securenow/credentials.json in the running app.
+ * Configuration: .securenow/runtime.json, written by `npx securenow login`; `npx securenow init`
+ * adds the secure defaults with explanations.
  *
- * Legacy env vars are fallback-only for existing installs.
+ * Production: `npx securenow credentials runtime --env production`, then mount/copy the file to
+ * .securenow/credentials.json in the running app, or store the `--format env` output
+ * (SECURENOW_CREDENTIALS) as a secret environment variable on hosts without file mounts.
+ * SECURENOW_DISABLED=1 turns the SDK off (tests).
  */
 
 // This module has side effects (initializes OpenTelemetry)
-// It's typically used via NODE_OPTIONS, not imported directly
+// It's typically preloaded with -r, not imported
 export {};
 
 /**
  * @example
  * ```bash
- * # Using with Node.js preload
- * NODE_OPTIONS="-r securenow/register" node app.js
+ * # Preload (CommonJS, ESM and TypeScript alike)
+ * node -r securenow/register app.js
+ * node -r securenow/register --import tsx src/index.ts
+ * NODE_OPTIONS="-r securenow/register" npm start
  * ```
- * 
- * @example
- * ```bash
- * # Using with PM2
- * pm2 start app.js --node-args="-r securenow/register"
- * ```
- * 
+ *
  * @example
  * ```javascript
- * // ecosystem.config.js
+ * // ecosystem.config.cjs (PM2, fork or cluster mode)
  * module.exports = {
  *   apps: [{
  *     name: 'my-app',
  *     script: './app.js',
- *     node_args: '-r securenow/register',
- *     // Local and production use .securenow/credentials.json.
+ *     // An absolute path: a bare '-r securenow/register' is resolved from the PM2 daemon's
+ *     // folder in cluster mode, and the workers crash-loop with "Cannot find module".
+ *     node_args: ['-r', require.resolve('securenow/register')],
+ *     instances: 'max',
+ *     exec_mode: 'cluster',
  *   }]
  * };
  * ```
- * 
+ *
  * @example
- * ```typescript
- * // Explicit import (optional, mainly for side effects)
- * import 'securenow/register';
- * 
- * import express from 'express';
- * const app = express();
- * // Your app code...
+ * ```javascript
+ * // First line of a CommonJS entry (alternative to -r)
+ * require('securenow/register');
+ * const express = require('express');
  * ```
  */

package/request-capture.js

@@ -0,0 +1,492 @@
+'use strict';
+
+/**
+ * Request capture shared by every SecureNow HTTP integration: the Node preload
+ * (tracing.js), Next.js (nextjs.js) and Nuxt (through the preload). Detection rules
+ * read the same attributes whatever the framework: http.request.headers (redacted)
+ * and http.request.body (redacted, size-capped, multipart as metadata only).
+ *
+ * The body is observed, never consumed: the request's own emit('data') is wrapped,
+ * so the application reads its body exactly as it would without SecureNow.
+ */
+
+const { OTP_SENSITIVE_FIELDS, isOtpCodeField, matchesSensitiveField, redactOtpGraphQL, redactOtpQuery } = require('./otp-redaction');
+const { createHeaderNameRedactor } = require('./header-redaction');
+
+// Default sensitive fields to redact from request bodies.
+// OTP/code aliases use exact normalized matching; other fields are matched
+// substring-wise against lowercased keys (see redactSensitiveData),
+// so e.g. 'card' also catches 'creditCard' and 'account' also catches
+// 'accountNumber'. Over-redaction here is intentional: a falsely-redacted
+// telemetry value is always safer than a leaked secret. Entries are kept
+// specific enough to avoid nuking broad benign keys (e.g. we use
+// 'firstname'/'lastname'/'fullname', never bare 'name').
+const DEFAULT_SENSITIVE_FIELDS = [
+  ...OTP_SENSITIVE_FIELDS,
+  // credentials / auth
+  'password', 'passwd', 'pwd', 'secret', 'token', 'api_key', 'apikey',
+  'access_token', 'auth', 'authorization', 'bearer', 'credentials',
+  'mysql_pwd', 'otp', 'mfa', 'totp', 'sessionid', 'session_id',
+  'cookie', 'set-cookie',
+  // financial
+  'stripeToken', 'card', 'cardnumber', 'ccv', 'cvc', 'cvv',
+  'iban', 'account', 'accountnumber', 'routing', 'sortcode', 'taxid',
+  // PII
+  'ssn', 'pin', 'email', 'e_mail', 'phone', 'mobile', 'dob', 'birthdate',
+  'firstname', 'lastname', 'fullname', 'address', 'postcode', 'zip',
+  'passport', 'license',
+];
+
+// Conservative value-shape redactors. Key-name matching misses secrets that
+// land in free-form string values (GraphQL bodies, message fields, etc.), so
+// as a second layer we scrub string VALUES that *look like* a secret/PII.
+// These are intentionally precise/bounded so they don't garble normal prose,
+// and they only ever transform captured telemetry strings (read-only) — never
+// the actual request/response stream. Compiled once at module load.
+const VALUE_REDACTORS = [
+  // The JWT and email patterns only start where a run of their characters starts (the
+  // lookbehind), so a long run that holds no match is scanned once, not once per position:
+  // a crafted 10KB value costs microseconds, not 50ms+ of event loop.
+  // JWT: three base64url segments. Anchored to the eyJ header so it won't
+  // match arbitrary dotted tokens.
+  { name: 'jwt', hint: 'eyJ', re: /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g },
+  // Bearer/Basic auth header value embedded in a body string.
+  { name: 'bearer', re: /\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi },
+  // Stripe-style / SecureNow live+test API keys.
+  { name: 'apikey', re: /\b(?:sk|pk|rk|snk)_(?:live|test)_[A-Za-z0-9]{8,}/g },
+  // Email addresses (bounded local/domain parts: 64 and 253 characters at most).
+  { name: 'email', hint: '@', re: /(?<![\w.%+-])[\w.%+-]{1,64}@[A-Za-z0-9.-]{1,253}\.[A-Za-z]{2,24}\b/g },
+  // Credit-card-like: 13–19 digit runs that pass a Luhn check, allowing
+  // space/dash grouping. Luhn-gated to avoid clobbering ordinary long numbers.
+  { name: 'card', re: /\b(?:\d[ -]?){12,18}\d\b/g, luhn: true },
+];
+
+// Skip the value-shape scan on very large strings to bound per-body cost.
+const MAX_VALUE_SCAN_LENGTH = 16384;
+
+function luhnValid(digits) {
+  let sum = 0;
+  let alt = false;
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let d = digits.charCodeAt(i) - 48;
+    if (d < 0 || d > 9) return false;
+    if (alt) { d *= 2; if (d > 9) d -= 9; }
+    sum += d;
+    alt = !alt;
+  }
+  return sum % 10 === 0;
+}
+
+/**
+ * Redact obvious secret/PII shapes inside a captured string VALUE.
+ * Returns the input unchanged when nothing matches (cheap common case).
+ * maxScanLength: longer values skip the shape scan (log lines pass a larger bound).
+ */
+function redactSensitiveValue(value, maxScanLength = MAX_VALUE_SCAN_LENGTH) {
+  if (typeof value !== 'string' || value.length === 0) return value;
+  // Credential assignments in GraphQL/query strings need field-aware
+  // redaction even though a short numeric OTP has no unique value shape.
+  value = redactOtpQuery(redactOtpGraphQL(value));
+  if (value.length > maxScanLength) return value; // bound shape scans
+  let out = value;
+  for (const r of VALUE_REDACTORS) {
+    if (r.hint && !out.includes(r.hint)) continue;
+    r.re.lastIndex = 0;
+    if (r.luhn) {
+      out = out.replace(r.re, (m) => {
+        const digits = m.replace(/[ -]/g, '');
+        if (digits.length < 13 || digits.length > 19) return m;
+        return luhnValid(digits) ? '[REDACTED]' : m;
+      });
+    } else {
+      out = out.replace(r.re, '[REDACTED]');
+    }
+  }
+  return out;
+}
+
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * Redact sensitive fields from an object
+ */
+function redactSensitiveData(obj, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
+  if (!obj || typeof obj !== 'object') return obj;
+
+  const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
+
+  for (const key of Object.keys(redacted)) {
+
+    if (matchesSensitiveField(key, sensitiveFields)) {
+      redacted[key] = '[REDACTED]';
+    } else if (typeof redacted[key] === 'object' && redacted[key] !== null) {
+      redacted[key] = redactSensitiveData(redacted[key], sensitiveFields);
+    } else if (typeof redacted[key] === 'string') {
+      // Second layer: even if the key name looks benign, scrub values that
+      // *look like* a secret/PII (JWT, bearer token, API key, email, card).
+      redacted[key] = redactSensitiveValue(redacted[key]);
+    }
+  }
+
+  return redacted;
+}
+
+/**
+ * Redact sensitive data from GraphQL query strings
+ */
+function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
+  if (!query || typeof query !== 'string') return query;
+
+  let redacted = query;
+
+  // Redact sensitive fields in GraphQL arguments and variables
+  sensitiveFields.filter(field => field === 'otp' || !isOtpCodeField(field)).forEach(field => {
+    const escaped = escapeRegex(field);
+    const patterns = [
+      // Quoted values: password: "..." keeps its quotes.
+      new RegExp(`(${escaped}\\s*:\\s*["'])([^"']+)(["'])`, 'gi'),
+      // Unquoted values (variables, numbers). A value starting with a quote was handled above.
+      new RegExp(`(${escaped}\\s*:\\s*)([^\\s,})\n"'][^\\s,})\n]*)`, 'gi'),
+    ];
+
+    patterns.forEach(pattern => {
+      // With two groups the third callback argument is the match offset, not a suffix: testing
+      // it for truthiness appended the offset to the redacted value ("[REDACTED]17").
+      redacted = redacted.replace(pattern, (match, prefix, value, suffix) => (
+        typeof suffix === 'string' ? `${prefix}[REDACTED]${suffix}` : `${prefix}[REDACTED]`
+      ));
+    });
+  });
+
+  // Second layer: scrub secret/PII *shapes* anywhere in the (free-form) query
+  // body — catches values the key-name pass above can't see.
+  redacted = redactOtpGraphQL(redactSensitiveValue(redacted));
+
+  return redacted;
+}
+
+/**
+ * Redact a captured body text by content type: the same rules as the HTTP-layer capture,
+ * for integrations that only see the body as text (Next.js Request.text()).
+ */
+function redactBodyText(bodyText, contentType, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
+  const ct = String(contentType || '').toLowerCase();
+  if (ct.includes('application/graphql')) {
+    return { body: redactGraphQLQuery(bodyText, sensitiveFields), type: 'graphql' };
+  }
+  if (ct.includes('application/json')) {
+    return { body: JSON.stringify(redactSensitiveData(JSON.parse(bodyText), sensitiveFields)), type: 'json' };
+  }
+  if (ct.includes('application/x-www-form-urlencoded')) {
+    return { body: JSON.stringify(redactSensitiveData(Object.fromEntries(new URLSearchParams(bodyText)), sensitiveFields)), type: 'form' };
+  }
+  return null;
+}
+
+// -------- Multipart streaming parser --------
+// Streams through the request without buffering file content.
+// Only part headers and text-field values are kept in memory,
+// so memory stays bounded (~few KB) regardless of upload size.
+
+function extractBoundary(contentType) {
+  const match = contentType.match(/boundary=(?:"([^"]+)"|([^\s;]+))/i);
+  return match ? (match[1] || match[2]) : null;
+}
+
+function createMultipartMetaCollector(contentType, sensitiveFields, maxTextFieldSize, onComplete) {
+  const boundary = extractBoundary(contentType);
+  if (!boundary) { onComplete({ error: 'BOUNDARY_NOT_FOUND' }); return null; }
+
+  const result = { fields: Object.create(null), files: [] };
+  let totalSize = 0;
+  let buf = Buffer.alloc(0);
+
+  const MAX_PARTS = 100;
+  let partCount = 0;
+
+  const FIRST_DELIM = Buffer.from('--' + boundary);
+  const DELIM       = Buffer.from('\r\n--' + boundary);
+  const HDR_END     = Buffer.from('\r\n\r\n');
+
+  let initialized = false;
+  let inHeaders = true;
+  let isFile = false;
+  let fldName = '';
+  let fName = '';
+  let pCT = '';
+  let bodyBytes = 0;
+  let textVal = '';
+
+  function flushPart() {
+    if (!fldName || fldName === '__proto__' || fldName === 'constructor' || fldName === 'prototype') return;
+    if (isFile) {
+      result.files.push({ field: fldName, filename: fName, contentType: pCT || 'unknown', size: bodyBytes });
+    } else {
+      const redact = matchesSensitiveField(fldName, sensitiveFields);
+      // Name-match redaction first; otherwise scrub secret/PII *shapes* in the value.
+      result.fields[fldName] = redact
+        ? '[REDACTED]'
+        : redactSensitiveValue(textVal.substring(0, maxTextFieldSize));
+    }
+    fldName = ''; bodyBytes = 0; textVal = ''; partCount++;
+  }
+
+  function drain() {
+    if (!initialized) {
+      const i = buf.indexOf(FIRST_DELIM);
+      if (i === -1) {
+        if (buf.length > FIRST_DELIM.length + 4) buf = buf.slice(buf.length - FIRST_DELIM.length - 4);
+        return;
+      }
+      buf = buf.slice(i + FIRST_DELIM.length);
+      initialized = true;
+      inHeaders = true;
+    }
+
+    let guard = 200;
+    while (buf.length > 0 && guard-- > 0 && partCount < MAX_PARTS) {
+      if (inHeaders) {
+        if (buf.length >= 2 && buf[0] === 0x2D && buf[1] === 0x2D) { buf = Buffer.alloc(0); return; }
+        if (buf.length >= 2 && buf[0] === 0x0D && buf[1] === 0x0A) { buf = buf.slice(2); continue; }
+
+        const hi = buf.indexOf(HDR_END);
+        if (hi === -1) return;
+
+        const hdr = buf.slice(0, hi).toString('latin1');
+        buf = buf.slice(hi + 4);
+
+        const nm = hdr.match(/name="([^"]+)"/);
+        const fn = hdr.match(/filename="([^"]*)"/);
+        const ct = hdr.match(/Content-Type:\s*(.+)/i);
+        fldName = nm ? nm[1] : '';
+        fName   = fn ? fn[1] : '';
+        pCT     = ct ? ct[1].trim() : '';
+        isFile  = !!fn;
+        bodyBytes = 0;
+        textVal = '';
+        inHeaders = false;
+      }
+
+      const di = buf.indexOf(DELIM);
+      if (di === -1) {
+        const safe = Math.max(0, buf.length - DELIM.length - 2);
+        if (safe > 0) {
+          bodyBytes += safe;
+          if (!isFile && textVal.length < maxTextFieldSize) {
+            textVal += buf.slice(0, safe).toString('utf8').substring(0, maxTextFieldSize - textVal.length);
+          }
+          buf = buf.slice(safe);
+        }
+        return;
+      }
+
+      bodyBytes += di;
+      if (!isFile && textVal.length < maxTextFieldSize) {
+        textVal += buf.slice(0, di).toString('utf8').substring(0, maxTextFieldSize - textVal.length);
+      }
+      flushPart();
+      buf = buf.slice(di + DELIM.length);
+      inHeaders = true;
+    }
+  }
+
+  function onData(chunk) {
+    const data = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    totalSize += data.length;
+    buf = Buffer.concat([buf, data]);
+    drain();
+  }
+
+  function onEnd() {
+    try {
+      if (!inHeaders && fldName) {
+        bodyBytes += buf.length;
+        if (!isFile) textVal += buf.toString('utf8').substring(0, maxTextFieldSize - textVal.length);
+        flushPart();
+      }
+      onComplete({ parsed: result, totalSize });
+    } catch (e) {
+      onComplete({ error: 'PARSE_ERROR' });
+    }
+  }
+
+  return { onData, onEnd };
+}
+
+const BODY_CAPTURE_PATCH = Symbol.for('securenow.bodyCapture.emitPatch');
+
+/**
+ * @param {{ captureBody?: boolean, captureMultipart?: boolean, maxBodySize?: number, customSensitiveFields?: string[] }} options
+ */
+function createRequestCapture(options = {}) {
+  const captureBody = options.captureBody !== false;
+  const captureMultipart = options.captureMultipart !== false;
+  const maxBodySize = options.maxBodySize || 10240;
+  const customSensitiveFields = options.customSensitiveFields || [];
+  const allSensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...customSensitiveFields];
+
+  // Credential-bearing request headers (cookies, auth, CSRF/XSRF, session, API keys, and any
+  // configured capture.sensitiveFields) are redacted by name before capture.
+  const isSensitiveHeaderName = createHeaderNameRedactor(customSensitiveFields);
+
+  function captureHeaders(span, request) {
+    if (!request || !request.headers) return;
+    const safe = {};
+    for (const [k, v] of Object.entries(request.headers)) {
+      if (isSensitiveHeaderName(k)) { safe[k] = '[REDACTED]'; continue; }
+      safe[k] = redactSensitiveValue(redactOtpQuery(typeof v === 'string' ? v : String(v))).substring(0, 500);
+    }
+    const serialized = JSON.stringify(safe);
+    if (serialized.length <= 8192) {
+      span.setAttribute('http.request.headers', serialized);
+    }
+  }
+
+  function installRequestBodyObserver(span, request, contentType) {
+    if (!request || request[BODY_CAPTURE_PATCH]) return;
+
+    const normalizedContentType = String(contentType || '').toLowerCase();
+    const isStructuredBody = captureBody && (
+      normalizedContentType.includes('application/json') ||
+      normalizedContentType.includes('application/graphql') ||
+      normalizedContentType.includes('application/x-www-form-urlencoded')
+    );
+    const isMultipartBody = normalizedContentType.includes('multipart/form-data');
+
+    if (!isStructuredBody && !isMultipartBody) return;
+
+    if (isMultipartBody && !captureMultipart) {
+      span.setAttribute('http.request.body', '[MULTIPART - NOT CAPTURED]');
+      span.setAttribute('http.request.body.type', 'multipart');
+      span.setAttribute('http.request.body.note', 'Multipart capture disabled by config.capture.multipart=false');
+      return;
+    }
+
+    let chunks = [];
+    let size = 0;
+    let structuredDone = false;
+
+    // The boundary is case-sensitive: browsers send mixed-case ones (----WebKitFormBoundaryAbC...),
+    // so it is read from the header as sent, not from the lowercased copy (which found no part).
+    const multipartCollector = isMultipartBody && captureMultipart
+      ? createMultipartMetaCollector(String(contentType || ''), allSensitiveFields, 1000, ({ error, parsed, totalSize }) => {
+          try {
+            if (error === 'BOUNDARY_NOT_FOUND') {
+              span.setAttribute('http.request.body', '[MULTIPART - BOUNDARY NOT FOUND]');
+              span.setAttribute('http.request.body.type', 'multipart');
+              return;
+            }
+            if (error) {
+              span.setAttribute('http.request.body', '[MULTIPART - PARSE ERROR]');
+              span.setAttribute('http.request.body.type', 'multipart');
+              span.setAttribute('http.request.body.parse_error', true);
+              return;
+            }
+            span.setAttributes({
+              'http.request.body': JSON.stringify(parsed).substring(0, maxBodySize),
+              'http.request.body.type': 'multipart',
+              'http.request.body.size': totalSize,
+              'http.request.body.fields_count': Object.keys(parsed.fields).length,
+              'http.request.body.files_count': parsed.files.length,
+            });
+          } catch (e) {
+            span.setAttribute('http.request.body', '[MULTIPART - PARSE ERROR]');
+            span.setAttribute('http.request.body.type', 'multipart');
+            span.setAttribute('http.request.body.parse_error', true);
+          }
+        })
+      : null;
+
+    if (isMultipartBody && captureMultipart && !multipartCollector) return;
+
+    function finishStructuredCapture() {
+      if (!isStructuredBody || structuredDone) return;
+      structuredDone = true;
+
+      if (size > maxBodySize) {
+        span.setAttribute('http.request.body', `[TOO LARGE: ${size} bytes]`);
+        span.setAttribute('http.request.body.size', size);
+        chunks = [];
+        return;
+      }
+
+      if (chunks.length === 0) return;
+
+      const body = Buffer.concat(chunks).toString('utf8');
+      chunks = [];
+
+      try {
+        if (normalizedContentType.includes('application/graphql')) {
+          const redacted = redactGraphQLQuery(body, allSensitiveFields);
+          span.setAttributes({
+            'http.request.body': redacted.substring(0, maxBodySize),
+            'http.request.body.type': 'graphql',
+            'http.request.body.size': size,
+          });
+        } else if (normalizedContentType.includes('application/json')) {
+          const parsed = JSON.parse(body);
+          const redacted = redactSensitiveData(parsed, allSensitiveFields);
+          span.setAttributes({
+            'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
+            'http.request.body.type': 'json',
+            'http.request.body.size': size,
+          });
+        } else if (normalizedContentType.includes('application/x-www-form-urlencoded')) {
+          const parsed = Object.fromEntries(new URLSearchParams(body));
+          const redacted = redactSensitiveData(parsed, allSensitiveFields);
+          span.setAttributes({
+            'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
+            'http.request.body.type': 'form',
+            'http.request.body.size': size,
+          });
+        }
+      } catch (e) {
+        span.setAttribute('http.request.body', '[UNPARSEABLE - REDACTED FOR SAFETY]');
+        span.setAttribute('http.request.body.parse_error', true);
+        span.setAttribute('http.request.body.size', size);
+      }
+    }
+
+    const originalEmit = request.emit;
+    request[BODY_CAPTURE_PATCH] = true;
+    request.emit = function securenowObservedEmit(event, ...args) {
+      try {
+        if (event === 'data' && args.length > 0) {
+          const chunk = Buffer.isBuffer(args[0]) ? args[0] : Buffer.from(args[0]);
+          if (isStructuredBody) {
+            size += chunk.length;
+            if (size <= maxBodySize) chunks.push(chunk);
+          }
+          if (multipartCollector) multipartCollector.onData(chunk);
+        } else if (event === 'end') {
+          finishStructuredCapture();
+          if (multipartCollector) multipartCollector.onEnd();
+        }
+      } catch (_) {
+        // Body capture must never interfere with the application request stream.
+      }
+      return originalEmit.apply(this, [event, ...args]);
+    };
+  }
+
+  function observeBody(span, request) {
+    if (!(captureBody || captureMultipart) || !request || !request.method) return;
+    if (!['POST', 'PUT', 'PATCH'].includes(request.method)) return;
+    const contentType = (request.headers && request.headers['content-type']) || '';
+    installRequestBodyObserver(span, request, contentType);
+  }
+
+  return { captureBody, captureMultipart, maxBodySize, allSensitiveFields, captureHeaders, observeBody };
+}
+
+module.exports = {
+  DEFAULT_SENSITIVE_FIELDS,
+  redactSensitiveValue,
+  redactSensitiveData,
+  redactGraphQLQuery,
+  redactBodyText,
+  createMultipartMetaCollector,
+  createRequestCapture,
+};

package/resolve-ip.js

@@ -7,17 +7,19 @@ const { createMatcher } = require('./cidr');
 const LOOPBACK_RE = /^(127\.|::1$|::ffff:127\.)/;
 const PRIVATE_IP_RE = /^(127\.|::1$|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.|100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.|f[cd][0-9a-f]{2}:)/i;
 
-// Named proxy presets for config.networking.trustedProxies. Cloudflare's published IPv4 edge ranges
-// (https://www.cloudflare.com/ips-v4): an app behind Cloudflare trusts them with "cloudflare".
+// Named proxy presets for config.networking.trustedProxies. Cloudflare's published edge ranges
+// (https://www.cloudflare.com/ips-v4 and /ips-v6): an app behind Cloudflare trusts them with "cloudflare".
 const PROXY_PRESETS = {
   cloudflare: [
     '173.245.48.0/20', '103.21.244.0/22', '103.22.200.0/22', '103.31.4.0/22', '141.101.64.0/18',
     '108.162.192.0/18', '190.93.240.0/20', '188.114.96.0/20', '197.234.240.0/22', '198.41.128.0/17',
     '162.158.0.0/15', '104.16.0.0/13', '104.24.0.0/14', '172.64.0.0/13', '131.0.72.0/22',
+    '2400:cb00::/32', '2606:4700::/32', '2803:f800::/32', '2405:b500::/32', '2405:8100::/32',
+    '2a06:98c0::/29', '2c0f:f248::/32',
   ],
 };
 
-// Exact addresses (IPv4 or IPv6), IPv4 CIDR ranges and presets.
+// Exact addresses and CIDR ranges (IPv4 or IPv6), and presets.
 function trustedProxyMatcher(entries) {
   const expanded = [];
   for (const entry of entries) {
@@ -93,14 +95,30 @@ function getHeader(headers, name) {
   return firstHeaderValue(headers[name] || headers[name.toLowerCase()] || headers[name.toUpperCase()]);
 }
 
+// A request that came over a Unix domain socket or a Windows named pipe has no remote address, and only a
+// process on this machine can connect to one: nginx `proxy_pass http://unix:/run/app.sock`, Nuxt's dev
+// proxy, a local sidecar. Such a connection is a trusted local proxy, so its forwarding headers count
+// (before this, requests over a socket had no client IP at all and IP blocking never applied to them).
+function arrivedOverLocalSocket(request) {
+  const socket = request && request.socket;
+  if (!socket || socket.remoteAddress) return false;
+  try {
+    const server = socket.server || socket._server;
+    return !!server && typeof server.address === 'function' && typeof server.address() === 'string';
+  } catch (_) {
+    return false;
+  }
+}
+
 function resolveClientIpWithDetails(request) {
   const socketIp = normalizeIp(request.socket?.remoteAddress || '');
   const headers = request.headers || {};
-  const trustedProxy = isFromTrustedProxy(socketIp);
+  const viaLocalSocket = !socketIp && arrivedOverLocalSocket(request);
+  const trustedProxy = viaLocalSocket || isFromTrustedProxy(socketIp);
 
   const details = {
     ip: socketIp,
-    source: socketIp ? 'socket' : 'unknown',
+    source: socketIp ? 'socket' : (viaLocalSocket ? 'unix-socket' : 'unknown'),
     socketIp,
     trustedProxy,
     forwardedFor: String(getHeader(headers, 'x-forwarded-for') || ''),