securenow 8.23.0 → 8.25.0

package/tracing.js

@@ -1,9 +1,12 @@
 'use strict';
 
+// When the SDK does not start, the module still exports its API: getLogger() returns null, as it
+// does with logging disabled, so app code that calls it keeps working under SECURENOW_DISABLED=1.
+const NOT_STARTED = { loggerProvider: null, getLogger: () => null, isLoggingEnabled: () => false };
 // Do nothing inside Node's internal ESM-hooks thread (see internal-thread.js).
-if (require('./internal-thread').inInternalThread()) return;
+if (require('./internal-thread').inInternalThread()) { module.exports = NOT_STARTED; return; }
 // SECURENOW_DISABLED=1 turns the SDK off for this process (test runs).
-if (require('./sdk-disabled').sdkDisabled('tracing')) return;
+if (require('./sdk-disabled').sdkDisabled('tracing')) { module.exports = NOT_STARTED; return; }
 
 /**
  * Preload with: node --require securenow/register app.js
@@ -44,293 +47,9 @@ function createResource(attributes) {
   throw new Error('Unsupported @opentelemetry/resources version');
 }
 
-const { OTP_SENSITIVE_FIELDS, isOtpCodeField, matchesSensitiveField, redactOtpGraphQL, redactOtpQuery, withOtpRedactionExporter } = require('./otp-redaction');
-
-// Default sensitive fields to redact from request bodies.
-// OTP/code aliases use exact normalized matching; other fields are matched
-// substring-wise against lowercased keys (see redactSensitiveData),
-// so e.g. 'card' also catches 'creditCard' and 'account' also catches
-// 'accountNumber'. Over-redaction here is intentional: a falsely-redacted
-// telemetry value is always safer than a leaked secret. Entries are kept
-// specific enough to avoid nuking broad benign keys (e.g. we use
-// 'firstname'/'lastname'/'fullname', never bare 'name').
-const DEFAULT_SENSITIVE_FIELDS = [
-  ...OTP_SENSITIVE_FIELDS,
-  // credentials / auth
-  'password', 'passwd', 'pwd', 'secret', 'token', 'api_key', 'apikey',
-  'access_token', 'auth', 'authorization', 'bearer', 'credentials',
-  'mysql_pwd', 'otp', 'mfa', 'totp', 'sessionid', 'session_id',
-  'cookie', 'set-cookie',
-  // financial
-  'stripeToken', 'card', 'cardnumber', 'ccv', 'cvc', 'cvv',
-  'iban', 'account', 'accountnumber', 'routing', 'sortcode', 'taxid',
-  // PII
-  'ssn', 'pin', 'email', 'e_mail', 'phone', 'mobile', 'dob', 'birthdate',
-  'firstname', 'lastname', 'fullname', 'address', 'postcode', 'zip',
-  'passport', 'license',
-];
-
-// Conservative value-shape redactors. Key-name matching misses secrets that
-// land in free-form string values (GraphQL bodies, message fields, etc.), so
-// as a second layer we scrub string VALUES that *look like* a secret/PII.
-// These are intentionally precise/bounded so they don't garble normal prose,
-// and they only ever transform captured telemetry strings (read-only) — never
-// the actual request/response stream. Compiled once at module load.
-const VALUE_REDACTORS = [
-  // JWT: three base64url segments. Anchored to the eyJ header so it won't
-  // match arbitrary dotted tokens.
-  { name: 'jwt', re: /eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g },
-  // Bearer/Basic auth header value embedded in a body string.
-  { name: 'bearer', re: /\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi },
-  // Stripe-style / SecureNow live+test API keys.
-  { name: 'apikey', re: /\b(?:sk|pk|rk|snk)_(?:live|test)_[A-Za-z0-9]{8,}/g },
-  // Email addresses (bounded local/domain parts).
-  { name: 'email', re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,24}\b/g },
-  // Credit-card-like: 13–19 digit runs that pass a Luhn check, allowing
-  // space/dash grouping. Luhn-gated to avoid clobbering ordinary long numbers.
-  { name: 'card', re: /\b(?:\d[ -]?){13,19}\b/g, luhn: true },
-];
-
-// Skip the value-shape scan on very large strings to bound per-body cost.
-const MAX_VALUE_SCAN_LENGTH = 16384;
-
-function luhnValid(digits) {
-  let sum = 0;
-  let alt = false;
-  for (let i = digits.length - 1; i >= 0; i--) {
-    let d = digits.charCodeAt(i) - 48;
-    if (d < 0 || d > 9) return false;
-    if (alt) { d *= 2; if (d > 9) d -= 9; }
-    sum += d;
-    alt = !alt;
-  }
-  return sum % 10 === 0;
-}
-
-/**
- * Redact obvious secret/PII shapes inside a captured string VALUE.
- * Returns the input unchanged when nothing matches (cheap common case).
- */
-function redactSensitiveValue(value) {
-  if (typeof value !== 'string' || value.length === 0) return value;
-  // Credential assignments in GraphQL/query strings need field-aware
-  // redaction even though a short numeric OTP has no unique value shape.
-  value = redactOtpQuery(redactOtpGraphQL(value));
-  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound shape scans
-  let out = value;
-  for (const r of VALUE_REDACTORS) {
-    r.re.lastIndex = 0;
-    if (r.luhn) {
-      out = out.replace(r.re, (m) => {
-        const digits = m.replace(/[ -]/g, '');
-        if (digits.length < 13 || digits.length > 19) return m;
-        return luhnValid(digits) ? '[REDACTED]' : m;
-      });
-    } else {
-      out = out.replace(r.re, '[REDACTED]');
-    }
-  }
-  return out;
-}
-
-function escapeRegex(str) {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-
-/**
- * Redact sensitive fields from an object
- */
-function redactSensitiveData(obj, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
-  if (!obj || typeof obj !== 'object') return obj;
-  
-  const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
-  
-  for (const key of Object.keys(redacted)) {
-
-    if (matchesSensitiveField(key, sensitiveFields)) {
-      redacted[key] = '[REDACTED]';
-    } else if (typeof redacted[key] === 'object' && redacted[key] !== null) {
-      redacted[key] = redactSensitiveData(redacted[key], sensitiveFields);
-    } else if (typeof redacted[key] === 'string') {
-      // Second layer: even if the key name looks benign, scrub values that
-      // *look like* a secret/PII (JWT, bearer token, API key, email, card).
-      redacted[key] = redactSensitiveValue(redacted[key]);
-    }
-  }
-
-  return redacted;
-}
-
-/**
- * Redact sensitive data from GraphQL query strings
- */
-function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
-  if (!query || typeof query !== 'string') return query;
-  
-  let redacted = query;
-  
-  // Redact sensitive fields in GraphQL arguments and variables
-  sensitiveFields.filter(field => field === 'otp' || !isOtpCodeField(field)).forEach(field => {
-    const escaped = escapeRegex(field);
-    const patterns = [
-      new RegExp(`(${escaped}\\s*:\\s*["'])([^"']+)(["'])`, 'gi'),
-      new RegExp(`(${escaped}\\s*:\\s*)([^\\s,})\n]+)`, 'gi'),
-    ];
-    
-    patterns.forEach(pattern => {
-      redacted = redacted.replace(pattern, (match, prefix, value, suffix) => {
-        if (suffix) {
-          return `${prefix}[REDACTED]${suffix}`;
-        } else {
-          return `${prefix}[REDACTED]`;
-        }
-      });
-    });
-  });
-
-  // Second layer: scrub secret/PII *shapes* anywhere in the (free-form) query
-  // body — catches values the key-name pass above can't see.
-  redacted = redactOtpGraphQL(redactSensitiveValue(redacted));
-
-  return redacted;
-}
-
-// -------- Multipart streaming parser --------
-// Streams through the request without buffering file content.
-// Only part headers and text-field values are kept in memory,
-// so memory stays bounded (~few KB) regardless of upload size.
-
-function extractBoundary(contentType) {
-  const match = contentType.match(/boundary=(?:"([^"]+)"|([^\s;]+))/i);
-  return match ? (match[1] || match[2]) : null;
-}
-
-function createMultipartMetaCollector(contentType, sensitiveFields, maxTextFieldSize, onComplete) {
-  const boundary = extractBoundary(contentType);
-  if (!boundary) { onComplete({ error: 'BOUNDARY_NOT_FOUND' }); return null; }
-
-  const result = { fields: Object.create(null), files: [] };
-  let totalSize = 0;
-  let buf = Buffer.alloc(0);
-
-  const MAX_PARTS = 100;
-  let partCount = 0;
-
-  const FIRST_DELIM = Buffer.from('--' + boundary);
-  const DELIM       = Buffer.from('\r\n--' + boundary);
-  const HDR_END     = Buffer.from('\r\n\r\n');
-
-  let initialized = false;
-  let inHeaders = true;
-  let isFile = false;
-  let fldName = '';
-  let fName = '';
-  let pCT = '';
-  let bodyBytes = 0;
-  let textVal = '';
-
-  function flushPart() {
-    if (!fldName || fldName === '__proto__' || fldName === 'constructor' || fldName === 'prototype') return;
-    if (isFile) {
-      result.files.push({ field: fldName, filename: fName, contentType: pCT || 'unknown', size: bodyBytes });
-    } else {
-      const redact = matchesSensitiveField(fldName, sensitiveFields);
-      // Name-match redaction first; otherwise scrub secret/PII *shapes* in the value.
-      result.fields[fldName] = redact
-        ? '[REDACTED]'
-        : redactSensitiveValue(textVal.substring(0, maxTextFieldSize));
-    }
-    fldName = ''; bodyBytes = 0; textVal = ''; partCount++;
-  }
-
-  function drain() {
-    if (!initialized) {
-      const i = buf.indexOf(FIRST_DELIM);
-      if (i === -1) {
-        if (buf.length > FIRST_DELIM.length + 4) buf = buf.slice(buf.length - FIRST_DELIM.length - 4);
-        return;
-      }
-      buf = buf.slice(i + FIRST_DELIM.length);
-      initialized = true;
-      inHeaders = true;
-    }
-
-    let guard = 200;
-    while (buf.length > 0 && guard-- > 0 && partCount < MAX_PARTS) {
-      if (inHeaders) {
-        if (buf.length >= 2 && buf[0] === 0x2D && buf[1] === 0x2D) { buf = Buffer.alloc(0); return; }
-        if (buf.length >= 2 && buf[0] === 0x0D && buf[1] === 0x0A) { buf = buf.slice(2); continue; }
-
-        const hi = buf.indexOf(HDR_END);
-        if (hi === -1) return;
-
-        const hdr = buf.slice(0, hi).toString('latin1');
-        buf = buf.slice(hi + 4);
-
-        const nm = hdr.match(/name="([^"]+)"/);
-        const fn = hdr.match(/filename="([^"]*)"/);
-        const ct = hdr.match(/Content-Type:\s*(.+)/i);
-        fldName = nm ? nm[1] : '';
-        fName   = fn ? fn[1] : '';
-        pCT     = ct ? ct[1].trim() : '';
-        isFile  = !!fn;
-        bodyBytes = 0;
-        textVal = '';
-        inHeaders = false;
-      }
-
-      const di = buf.indexOf(DELIM);
-      if (di === -1) {
-        const safe = Math.max(0, buf.length - DELIM.length - 2);
-        if (safe > 0) {
-          bodyBytes += safe;
-          if (!isFile && textVal.length < maxTextFieldSize) {
-            textVal += buf.slice(0, safe).toString('utf8').substring(0, maxTextFieldSize - textVal.length);
-          }
-          buf = buf.slice(safe);
-        }
-        return;
-      }
-
-      bodyBytes += di;
-      if (!isFile && textVal.length < maxTextFieldSize) {
-        textVal += buf.slice(0, di).toString('utf8').substring(0, maxTextFieldSize - textVal.length);
-      }
-      flushPart();
-      buf = buf.slice(di + DELIM.length);
-      inHeaders = true;
-    }
-  }
-
-  function onData(chunk) {
-    const data = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-    totalSize += data.length;
-    buf = Buffer.concat([buf, data]);
-    drain();
-  }
-
-  function onEnd() {
-    try {
-      if (!inHeaders && fldName) {
-        bodyBytes += buf.length;
-        if (!isFile) textVal += buf.toString('utf8').substring(0, maxTextFieldSize - textVal.length);
-        flushPart();
-      }
-      onComplete({ parsed: result, totalSize });
-    } catch (e) {
-      onComplete({ error: 'PARSE_ERROR' });
-    }
-  }
-
-  return { onData, onEnd };
-}
-
-function collectMultipartMeta(request, contentType, sensitiveFields, maxTextFieldSize, onComplete) {
-  const collector = createMultipartMetaCollector(contentType, sensitiveFields, maxTextFieldSize, onComplete);
-  if (!collector) return;
-  request.on('data', collector.onData);
-  request.on('end', collector.onEnd);
-}
+const { withOtpRedactionExporter } = require('./otp-redaction');
+// Header and body capture with redaction, shared with the Next.js integration.
+const { createRequestCapture } = require('./request-capture');
 
 // -------- ESM detection --------
 // register.js auto-registers the hook via module.register() on Node >=20.6.
@@ -382,7 +101,9 @@ const baseName = rawBase || null;
 // suffix breaks routing. config.runtime.noUuid can override.
 const noUuid   = appConfig.resolveNoUuid();
 const strict   = appConfig.boolConfig('runtime.strict', false);
-const inPm2Cluster = !!(process.env.NODE_APP_INSTANCE || process.env.pm_id);
+// Fork and cluster workers both count: in cluster mode PM2's details are only in pm2_env at preload time.
+const pm2Process = require('./pm2-env').readPm2Env();
+const inPm2Cluster = !!pm2Process;
 
 // Fail fast in cluster if base is missing (no more "free" names)
 if (!baseName && inPm2Cluster && strict) {
@@ -405,16 +126,25 @@ const instancePrefix   = baseName || 'securenow';
 const serviceInstanceId = `${instancePrefix}-${randomUUID()}`;
 
 // Loud line per worker to prove what was used
-console.log('[securenow] pid=%d appId=%s instance=%s apiKey=%s → service.name=%s instance.id=%s',
+console.log('[securenow] pid=%d appId=%s instance=%s apiKey=%s credentials=%s → service.name=%s instance.id=%s',
   process.pid,
   JSON.stringify(baseName),
   JSON.stringify(endpointBase),
-  resolvedApp.appKey ? 'set' : 'none',
+  appConfig.resolveApiKey() ? 'set' : 'missing',
+  appConfig.describeCredentialsSource(),
   serviceName,
   serviceInstanceId
 );
+if (pm2Process && !resolvedApp.appKey) {
+  console.warn('[securenow] PM2 process %s: no .securenow/runtime.json in %s and no SECURENOW_CREDENTIALS. SecureNow sends nothing and blocks nothing in this process.',
+    pm2Process.name || pm2Process.id || process.pid, pm2Process.cwd || '(unknown app folder)');
+}
 
 // -------- instrumentations --------
+// The OpenTelemetry bundle no longer ships a Fastify instrumentation: without these hooks a
+// Fastify request span had no http.route and a failing handler left no exception event.
+require('./fastify-hooks').installFastifyHooks();
+
 const disabledMap = {};
 for (const n of appConfig.listConfig('otel.disableInstrumentations')) {
   disabledMap[n] = { enabled: false };
@@ -432,143 +162,13 @@ const frameworkInstrumentationConfig = appConfig.boolConfig('otel.middlewareSpan
 
 // -------- Body Capture Configuration --------
 // Opt-out defaults: set config.capture.body=false to disable.
-const captureBody = appConfig.boolConfig('capture.body', true);
-const maxBodySize = appConfig.numberConfig('capture.maxBodySize', 10240, 1024);
-const customSensitiveFields = appConfig.listConfig('capture.sensitiveFields');
-const allSensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...customSensitiveFields];
-
-const captureMultipart = appConfig.boolConfig('capture.multipart', true);
-
-// Credential-bearing request headers (cookies, auth, CSRF/XSRF, session, API keys, and any
-// configured capture.sensitiveFields) are redacted by name before capture.
-const isSensitiveHeaderName = require('./header-redaction').createHeaderNameRedactor(customSensitiveFields);
-
-const BODY_CAPTURE_PATCH = Symbol.for('securenow.bodyCapture.emitPatch');
-
-function installRequestBodyObserver(span, request, contentType) {
-  if (!request || request[BODY_CAPTURE_PATCH]) return;
-
-  const normalizedContentType = String(contentType || '').toLowerCase();
-  const isStructuredBody = captureBody && (
-    normalizedContentType.includes('application/json') ||
-    normalizedContentType.includes('application/graphql') ||
-    normalizedContentType.includes('application/x-www-form-urlencoded')
-  );
-  const isMultipartBody = normalizedContentType.includes('multipart/form-data');
-
-  if (!isStructuredBody && !isMultipartBody) return;
-
-  if (isMultipartBody && !captureMultipart) {
-    span.setAttribute('http.request.body', '[MULTIPART - NOT CAPTURED]');
-    span.setAttribute('http.request.body.type', 'multipart');
-    span.setAttribute('http.request.body.note', 'Multipart capture disabled by config.capture.multipart=false');
-    return;
-  }
-
-  let chunks = [];
-  let size = 0;
-  let structuredDone = false;
-
-  const multipartCollector = isMultipartBody && captureMultipart
-    ? createMultipartMetaCollector(normalizedContentType, allSensitiveFields, 1000, ({ error, parsed, totalSize }) => {
-        try {
-          if (error === 'BOUNDARY_NOT_FOUND') {
-            span.setAttribute('http.request.body', '[MULTIPART - BOUNDARY NOT FOUND]');
-            span.setAttribute('http.request.body.type', 'multipart');
-            return;
-          }
-          if (error) {
-            span.setAttribute('http.request.body', '[MULTIPART - PARSE ERROR]');
-            span.setAttribute('http.request.body.type', 'multipart');
-            span.setAttribute('http.request.body.parse_error', true);
-            return;
-          }
-          span.setAttributes({
-            'http.request.body': JSON.stringify(parsed).substring(0, maxBodySize),
-            'http.request.body.type': 'multipart',
-            'http.request.body.size': totalSize,
-            'http.request.body.fields_count': Object.keys(parsed.fields).length,
-            'http.request.body.files_count': parsed.files.length,
-          });
-        } catch (e) {
-          span.setAttribute('http.request.body', '[MULTIPART - PARSE ERROR]');
-          span.setAttribute('http.request.body.type', 'multipart');
-          span.setAttribute('http.request.body.parse_error', true);
-        }
-      })
-    : null;
-
-  if (isMultipartBody && captureMultipart && !multipartCollector) return;
-
-  function finishStructuredCapture() {
-    if (!isStructuredBody || structuredDone) return;
-    structuredDone = true;
-
-    if (size > maxBodySize) {
-      span.setAttribute('http.request.body', `[TOO LARGE: ${size} bytes]`);
-      span.setAttribute('http.request.body.size', size);
-      chunks = [];
-      return;
-    }
-
-    if (chunks.length === 0) return;
-
-    const body = Buffer.concat(chunks).toString('utf8');
-    chunks = [];
-
-    try {
-      if (normalizedContentType.includes('application/graphql')) {
-        const redacted = redactGraphQLQuery(body, allSensitiveFields);
-        span.setAttributes({
-          'http.request.body': redacted.substring(0, maxBodySize),
-          'http.request.body.type': 'graphql',
-          'http.request.body.size': size,
-        });
-      } else if (normalizedContentType.includes('application/json')) {
-        const parsed = JSON.parse(body);
-        const redacted = redactSensitiveData(parsed, allSensitiveFields);
-        span.setAttributes({
-          'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
-          'http.request.body.type': 'json',
-          'http.request.body.size': size,
-        });
-      } else if (normalizedContentType.includes('application/x-www-form-urlencoded')) {
-        const parsed = Object.fromEntries(new URLSearchParams(body));
-        const redacted = redactSensitiveData(parsed, allSensitiveFields);
-        span.setAttributes({
-          'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
-          'http.request.body.type': 'form',
-          'http.request.body.size': size,
-        });
-      }
-    } catch (e) {
-      span.setAttribute('http.request.body', '[UNPARSEABLE - REDACTED FOR SAFETY]');
-      span.setAttribute('http.request.body.parse_error', true);
-      span.setAttribute('http.request.body.size', size);
-    }
-  }
-
-  const originalEmit = request.emit;
-  request[BODY_CAPTURE_PATCH] = true;
-  request.emit = function securenowObservedEmit(event, ...args) {
-    try {
-      if (event === 'data' && args.length > 0) {
-        const chunk = Buffer.isBuffer(args[0]) ? args[0] : Buffer.from(args[0]);
-        if (isStructuredBody) {
-          size += chunk.length;
-          if (size <= maxBodySize) chunks.push(chunk);
-        }
-        if (multipartCollector) multipartCollector.onData(chunk);
-      } else if (event === 'end') {
-        finishStructuredCapture();
-        if (multipartCollector) multipartCollector.onEnd();
-      }
-    } catch (_) {
-      // Body capture must never interfere with the application request stream.
-    }
-    return originalEmit.apply(this, [event, ...args]);
-  };
-}
+const requestCapture = createRequestCapture({
+  captureBody: appConfig.boolConfig('capture.body', true),
+  captureMultipart: appConfig.boolConfig('capture.multipart', true),
+  maxBodySize: appConfig.numberConfig('capture.maxBodySize', 10240, 1024),
+  customSensitiveFields: appConfig.listConfig('capture.sensitiveFields'),
+});
+const { captureBody, captureMultipart, maxBodySize, allSensitiveFields } = requestCapture;
 
 // -------- Trusted proxy IP resolution --------
 const { resolveClientIpWithDetails } = require('./resolve-ip');
@@ -608,22 +208,8 @@ const httpInstrumentation = new HttpInstrumentation(withLegacyHttpSemconv({
         }
       }
 
-      if (request.headers) {
-        const safe = {};
-        for (const [k, v] of Object.entries(request.headers)) {
-          if (isSensitiveHeaderName(k)) { safe[k] = '[REDACTED]'; continue; }
-          safe[k] = redactSensitiveValue(redactOtpQuery(typeof v === 'string' ? v : String(v))).substring(0, 500);
-        }
-        const serialized = JSON.stringify(safe);
-        if (serialized.length <= 8192) {
-          span.setAttribute('http.request.headers', serialized);
-        }
-      }
-
-      if ((captureBody || captureMultipart) && request.method && ['POST', 'PUT', 'PATCH'].includes(request.method)) {
-        const contentType = request.headers['content-type'] || '';
-        installRequestBodyObserver(span, request, contentType);
-      }
+      requestCapture.captureHeaders(span, request);
+      requestCapture.observeBody(span, request);
     } catch (error) {
       // Silently fail
     }
@@ -656,7 +242,8 @@ if (loggingEnabled) {
   const batchLogProcessor = new BatchLogRecordProcessor({ exporter: logExporter });
   loggerProvider = new LoggerProvider({
     resource: sharedResource,
-    processors: [batchLogProcessor],
+    // Secret shapes in log lines are redacted before export (log-redaction.js).
+    processors: require('./log-redaction').logProcessors(appConfig, batchLogProcessor),
   });
 
   // Auto-patch console.* so every log/warn/error becomes an OTel log record
@@ -749,7 +336,8 @@ function _reportSuppressedOtlpError(kind, err, origin) {
 // app has its own handler, the error is recorded and that handler decides.
 require('./crash-capture').installCrashCapture({
   getLogger: () => (loggerProvider ? loggerProvider.getLogger('securenow.crash', '1.0.0') : null),
-  flush: () => (loggerProvider ? loggerProvider.forceFlush() : undefined),
+  // Spans still in the batch processor are usually the requests that led to the crash.
+  flush: () => Promise.all([loggerProvider ? loggerProvider.forceFlush() : undefined, require('./crash-capture').flushTracerProvider()]),
   isSdkError: (e) => _isOtlpTransientError(e) && (_looksLikeOtlpStack(e) || _looksLikeConfiguredOtlpEndpoint(e)),
   onSdkError: _reportSuppressedOtlpError,
 });
@@ -764,6 +352,8 @@ const sdk = new NodeSDK({
   instrumentations: [
     httpInstrumentation,
     ...(disabledMap['@opentelemetry/instrumentation-mongodb'] ? [] : [new MongoDBInstrumentation()]),
+    // http.route for Hono, h3, Feathers and Polka (no instrumentation in the OpenTelemetry bundle).
+    ...(disabledMap['securenow-framework-routes'] ? [] : [new (require('./framework-routes').SecureNowRouteInstrumentation)()]),
     ...getNodeAutoInstrumentations({
       ...frameworkInstrumentationConfig,
       ...disabledMap,
@@ -820,6 +410,8 @@ const sdk = new NodeSDK({
         aws: firewallOptions.aws,
         gcp: firewallOptions.gcp,
       });
+      // Zero-code session revocation / session-theft capture (config.sessions.guard / .capture).
+      require('./sessions').installHttpGuard(appConfig.resolveSessionsOptions());
     }
   } catch (e) {
     console.error('[securenow] OTel start failed:', e && e.stack || e);