securenow 8.24.0 → 8.25.0

package/app-config.js

@@ -44,6 +44,7 @@ const ADMIN_CREDENTIALS_FILENAME = 'admin.json';
 const DEFAULT_CONFIG = Object.freeze({
   logging: {
     enabled: true,
+    redact: true,
   },
   capture: {
     body: true,
@@ -96,6 +97,11 @@ const DEFAULT_CONFIG = Object.freeze({
   networking: {
     trustedProxies: [],
   },
+  sessions: {
+    guard: false,
+    capture: false,
+    cookieNames: [],
+  },
 });
 
 const CONFIG_EXPLANATIONS = Object.freeze({
@@ -105,6 +111,7 @@ const CONFIG_EXPLANATIONS = Object.freeze({
   'app.name': 'Human-readable app label shown in CLI output.',
   'app.routing': 'Telemetry uses the default SecureNow ingestion gateway and routes by app.key; runtime credentials do not expose per-instance collector URLs.',
   'config.logging.enabled': 'Secure default: console log forwarding is on. Set false to disable OTLP logs.',
+  'config.logging.redact': 'Secure default: exported log lines are redacted. Credential fields (password, token, apiKey, authorization, cookie, OTP codes, card numbers...) in logged objects, JSON and key=value text, and secret shapes anywhere (JWTs, Bearer/Basic credentials, sk_/pk_/rk_/snk_ keys, card numbers, emails) become [REDACTED]; the terminal still shows the line as written. Set false to export lines as written.',
   'config.capture.body': 'Secure default: JSON, GraphQL, and form request bodies are captured with redaction.',
   'config.capture.multipart': 'Secure default: multipart text fields and file metadata are captured. File content is never buffered.',
   'config.capture.maxBodySize': 'Maximum body bytes captured per request. Default 10KB limits memory and sensitive data exposure.',
@@ -135,7 +142,10 @@ const CONFIG_EXPLANATIONS = Object.freeze({
   'config.firewall.cloudflare': 'Cloudflare API token/account id for Layer 4 WAF. Secrets: do not commit.',
   'config.firewall.aws': 'AWS WAF IP set configuration for Layer 4 WAF.',
   'config.firewall.gcp': 'GCP Cloud Armor policy configuration for Layer 4 WAF.',
-  'config.networking.trustedProxies': 'Additional proxies whose X-Forwarded-For headers should be trusted: IPs, IPv4 ranges (CIDR) or "cloudflare".',
+  'config.networking.trustedProxies': 'Additional proxies whose X-Forwarded-For headers should be trusted: IPs, IPv4 ranges (CIDR) or "cloudflare". Private, loopback and Unix-socket connections are trusted by default.',
+  'config.sessions.guard': 'If true, every request whose session or user was revoked gets a 401, in any framework, with no code (session = SHA-256 of the Bearer token or session cookie; user = JWT sub).',
+  'config.sessions.capture': 'If true, requests with a session send session.seen (deduplicated per session and IP every 5 minutes) so SecureNow can detect a stolen session.',
+  'config.sessions.cookieNames': 'Session cookie names to read besides next-auth, connect.sid, session and sid.',
 });
 
 function clone(value) {
@@ -745,6 +755,13 @@ function resolveEndpoints(options = {}) {
   };
 }
 
+function resolveSessionsOptions() {
+  return {
+    guard: boolConfig('sessions.guard', false),
+    capture: boolConfig('sessions.capture', false),
+  };
+}
+
 function resolveFirewallEnabled() {
   return true;
 }
@@ -817,6 +834,7 @@ module.exports = {
   resolveOtlpHeaderString,
   resolveEndpoints,
   resolveFirewallEnabled,
+  resolveSessionsOptions,
   normalizeFirewallApiUrl,
   resolveFirewallApiUrl,
   resolveFirewallApiFallbacks,

package/cidr.js

@@ -2,7 +2,8 @@
 
 /**
  * Bitmask-based CIDR matching. No regex on user input — prevents ReDoS.
- * All operations use unsigned 32-bit integers for IPv4 addresses.
+ * IPv4 addresses are unsigned 32-bit integers; IPv6 addresses are 128-bit BigInts.
+ * An IPv4-mapped IPv6 address (::ffff:1.2.3.4) is treated as the IPv4 address it carries.
  */
 
 function ipToInt(ip) {
@@ -10,13 +11,99 @@ function ipToInt(ip) {
   if (parts.length !== 4) return null;
   let result = 0;
   for (let i = 0; i < 4; i++) {
+    if (!/^\d{1,3}$/.test(parts[i])) return null;
     const n = parseInt(parts[i], 10);
-    if (isNaN(n) || n < 0 || n > 255) return null;
+    if (n > 255) return null;
     result = (result << 8) + n;
   }
   return result >>> 0;
 }
 
+function intToIp(n) {
+  return [(n >>> 24) & 0xff, (n >>> 16) & 0xff, (n >>> 8) & 0xff, n & 0xff].join('.');
+}
+
+const V6_BITS = 128n;
+const V6_ALL = (1n << V6_BITS) - 1n;
+
+// '2001:db8::1' -> BigInt. Accepts '::' compression, an IPv4 tail ('::ffff:1.2.3.4'),
+// brackets and a zone id ('fe80::1%eth0'). Returns null for anything else.
+function ipv6ToBigInt(ip) {
+  let s = String(ip || '').trim();
+  if (s.startsWith('[') && s.endsWith(']')) s = s.slice(1, -1);
+  const zone = s.indexOf('%');
+  if (zone !== -1) s = s.slice(0, zone);
+  if (!s.includes(':') || s.length > 45) return null;
+
+  // An IPv4 tail ('::ffff:1.2.3.4') is the last two groups.
+  let tail = [];
+  const lastColon = s.lastIndexOf(':');
+  if (s.indexOf('.', lastColon) !== -1) {
+    const v4 = ipToInt(s.slice(lastColon + 1));
+    if (v4 === null) return null;
+    tail = [(v4 >>> 16) & 0xffff, v4 & 0xffff];
+    s = s.slice(0, lastColon + 1);
+    if (!s.endsWith('::')) s = s.slice(0, -1);
+  }
+
+  const halves = s.split('::');
+  if (halves.length > 2) return null;
+  const groupsOf = (part) => {
+    if (part === '') return [];
+    const out = [];
+    for (const g of part.split(':')) {
+      if (!/^[0-9a-f]{1,4}$/i.test(g)) return null;
+      out.push(parseInt(g, 16));
+    }
+    return out;
+  };
+  const head = groupsOf(halves[0]);
+  const rest = halves.length === 2 ? groupsOf(halves[1]) : [];
+  if (!head || !rest) return null;
+  const total = head.length + rest.length + tail.length;
+  // '::' stands for at least one zero group.
+  if (halves.length === 2 ? total > 7 : total !== 8) return null;
+
+  const all = head.concat(new Array(8 - total).fill(0), rest, tail);
+  let n = 0n;
+  for (const g of all) n = (n << 16n) | BigInt(g);
+  return n;
+}
+
+function bigIntToIpv6(n) {
+  const groups = [];
+  for (let i = 7; i >= 0; i--) groups.push(Number((n >> BigInt(i * 16)) & 0xffffn).toString(16));
+  // Compress the longest run of zero groups (RFC 5952).
+  let best = -1; let bestLen = 0;
+  for (let i = 0; i < 8;) {
+    if (groups[i] !== '0') { i++; continue; }
+    let j = i;
+    while (j < 8 && groups[j] === '0') j++;
+    if (j - i > bestLen && j - i > 1) { best = i; bestLen = j - i; }
+    i = j;
+  }
+  if (best === -1) return groups.join(':');
+  return `${groups.slice(0, best).join(':')}::${groups.slice(best + bestLen).join(':')}`;
+}
+
+/**
+ * Classifies an address: { family: 4, int } or { family: 6, big }, with a canonical `key`
+ * for exact lookups. An IPv4-mapped IPv6 address comes back as family 4. Null if not an IP.
+ */
+function parseIp(ip) {
+  const s = String(ip || '').trim();
+  if (!s) return null;
+  const v4 = ipToInt(s);
+  if (v4 !== null) return { family: 4, int: v4, key: intToIp(v4) };
+  const big = ipv6ToBigInt(s);
+  if (big === null) return null;
+  if ((big >> 32n) === 0xffffn) {
+    const int = Number(big & 0xffffffffn) >>> 0;
+    return { family: 4, int, key: intToIp(int) };
+  }
+  return { family: 6, big, key: bigIntToIpv6(big) };
+}
+
 function parseCidr(cidr) {
   const slash = cidr.indexOf('/');
   if (slash === -1) return null;
@@ -29,44 +116,72 @@ function parseCidr(cidr) {
   return { network: (network & mask) >>> 0, mask };
 }
 
+/** '2001:db8::/32' -> { network, mask, bits } as BigInts. Null if not an IPv6 CIDR. */
+function parseCidr6(cidr) {
+  const slash = String(cidr || '').indexOf('/');
+  if (slash === -1) return null;
+  const suffix = cidr.slice(slash + 1).trim();
+  if (!/^\d{1,3}$/.test(suffix)) return null;
+  const bits = parseInt(suffix, 10);
+  if (bits > 128) return null;
+  const big = ipv6ToBigInt(cidr.slice(0, slash));
+  if (big === null) return null;
+  const mask = bits === 0 ? 0n : (V6_ALL << (V6_BITS - BigInt(bits))) & V6_ALL;
+  return { network: big & mask, mask, bits };
+}
+
 function matchesCidr(ipInt, cidrEntry) {
   return ((ipInt & cidrEntry.mask) >>> 0) === cidrEntry.network;
 }
 
 /**
- * Create a matcher from a list of IPs and CIDRs.
+ * Create a matcher from a list of IPv4/IPv6 addresses and CIDRs.
  * Returns { isBlocked(ip), stats() }.
- * Exact IPs use a Set for O(1) lookup; CIDRs use array scan (typically < 100 entries).
+ * Exact IPs use a Set of canonical forms for O(1) lookup ('2001:DB8:0::1' and '2001:db8::1'
+ * are the same entry); CIDRs use an array scan (typically < 100 entries).
  */
 function createMatcher(ipList) {
   const exactSet = new Set();
-  const cidrRanges = [];
+  const cidr4 = [];
+  const cidr6 = [];
 
-  for (const entry of ipList) {
+  for (const entry of ipList || []) {
     const trimmed = (entry || '').trim();
     if (!trimmed) continue;
 
     if (trimmed.includes('/')) {
-      const parsed = parseCidr(trimmed);
-      if (parsed) cidrRanges.push(parsed);
+      const v4 = parseCidr(trimmed);
+      if (v4) { cidr4.push(v4); continue; }
+      const v6 = parseCidr6(trimmed);
+      if (!v6) continue;
+      // ::ffff:0:0/96 and narrower are IPv4 ranges written in IPv6 form.
+      if (v6.bits >= 96 && (v6.network >> 32n) === 0xffffn) {
+        const bits = v6.bits - 96;
+        const mask = bits === 0 ? 0 : (~((1 << (32 - bits)) - 1)) >>> 0;
+        cidr4.push({ network: (Number(v6.network & 0xffffffffn) & mask) >>> 0, mask });
+      } else {
+        cidr6.push(v6);
+      }
     } else {
-      const normalized = trimmed.replace(/^::ffff:/, '');
-      exactSet.add(normalized);
+      const parsed = parseIp(trimmed);
+      exactSet.add(parsed ? parsed.key : trimmed);
     }
   }
 
   function isBlocked(ip) {
     if (!ip) return false;
-    const normalized = ip.replace(/^::ffff:/, '');
+    const parsed = parseIp(ip);
+    if (!parsed) return exactSet.has(String(ip).trim());
 
-    if (exactSet.has(normalized)) return true;
+    if (exactSet.has(parsed.key)) return true;
 
-    if (cidrRanges.length > 0) {
-      const ipInt = ipToInt(normalized);
-      if (ipInt !== null) {
-        for (const cidr of cidrRanges) {
-          if (matchesCidr(ipInt, cidr)) return true;
-        }
+    if (parsed.family === 4) {
+      for (const cidr of cidr4) {
+        if (matchesCidr(parsed.int, cidr)) return true;
+      }
+    } else {
+      for (const cidr of cidr6) {
+        if ((parsed.big & cidr.mask) === cidr.network) return true;
       }
     }
 
@@ -74,10 +189,14 @@ function createMatcher(ipList) {
   }
 
   function stats() {
-    return { exact: exactSet.size, cidr: cidrRanges.length, total: exactSet.size + cidrRanges.length };
+    const cidr = cidr4.length + cidr6.length;
+    return { exact: exactSet.size, cidr, total: exactSet.size + cidr };
   }
 
   return { isBlocked, stats };
 }
 
-module.exports = { ipToInt, parseCidr, matchesCidr, createMatcher };
+module.exports = {
+  ipToInt, intToIp, parseCidr, matchesCidr, createMatcher,
+  ipv6ToBigInt, bigIntToIpv6, parseCidr6, parseIp,
+};

package/cli/init.js

@@ -62,6 +62,22 @@ function findInstrumentationFile(dir) {
   return null;
 }
 
+// Next.js loads instrumentation.* from the folder that holds app/ or pages/: src/ in a src layout,
+// where a file at the project root is never loaded.
+function usesSrcDir(dir) {
+  const inSrc = ['src/app', 'src/pages'].some((d) => fs.existsSync(path.join(dir, d)));
+  const inRoot = ['app', 'pages'].some((d) => fs.existsSync(path.join(dir, d)));
+  return inSrc && !inRoot;
+}
+
+function instrumentationIn(folder) {
+  for (const name of ['instrumentation.ts', 'instrumentation.js']) {
+    const p = path.join(folder, name);
+    if (fs.existsSync(p)) return p;
+  }
+  return null;
+}
+
 function findNextConfig(dir) {
   for (const name of ['next.config.js', 'next.config.mjs', 'next.config.ts']) {
     const p = path.join(dir, name);
@@ -132,20 +148,49 @@ function initCredentials(flags) {
 }
 
 async function initNextJs(dir, project, flags) {
-  const useTs = flags.javascript ? false : flags.typescript ? true : hasTypeScript(dir);
+  const useTs = (flags.javascript || flags.js) ? false : (flags.typescript || flags.ts) ? true : hasTypeScript(dir);
   const ext = useTs ? 'ts' : 'js';
-
-  const existing = findInstrumentationFile(dir);
+  const inSrc = flags.root ? false : flags.src ? true : usesSrcDir(dir);
+  const folder = inSrc ? path.join(dir, 'src') : dir;
+  const otherFolder = inSrc ? dir : path.join(dir, 'src');
+  const rel = (p) => path.relative(dir, p).split(path.sep).join('/');
+
+  // In a src/ layout, Next.js 14 and 15 load only src/instrumentation.*; 16 also loads a root file.
+  const major = nextMajor(project);
+  const existing = instrumentationIn(folder) || (inSrc && major >= 16 ? instrumentationIn(otherFolder) : null);
+  const misplaced = existing ? null : instrumentationIn(otherFolder);
   if (existing && isLegacyInstrumentation(fs.readFileSync(existing, 'utf8'))) {
     fs.writeFileSync(existing, INSTRUMENTATION, 'utf8');
-    ui.success(`Updated ${path.relative(dir, existing)}: standalone builds now include SecureNow's dependencies`);
+    ui.success(`Updated ${rel(existing)}: standalone builds now include SecureNow's dependencies`);
+  } else if (existing && flags.force) {
+    fs.copyFileSync(existing, `${existing}.bak`);
+    fs.writeFileSync(existing, INSTRUMENTATION, 'utf8');
+    ui.success(`Replaced ${rel(existing)} (--force); the previous file is in ${rel(existing)}.bak`);
   } else if (existing) {
-    ui.info(`instrumentation file already exists: ${path.relative(dir, existing)}`);
-    printAgentPrompt('instrumentation', path.basename(existing), nextMajor(project), project);
+    ui.info(`instrumentation file already exists: ${rel(existing)}`);
+    printAgentPrompt('instrumentation', rel(existing), nextMajor(project), project);
   } else {
-    const filePath = path.join(dir, `instrumentation.${ext}`);
-    fs.writeFileSync(filePath, INSTRUMENTATION, 'utf8');
-    ui.success(`Created instrumentation.${ext}`);
+    const filePath = path.join(folder, `instrumentation.${ext}`);
+    if (misplaced) {
+      // Next.js never loads a file in the other folder, so SecureNow would not start.
+      const ours = isLegacyInstrumentation(fs.readFileSync(misplaced, 'utf8'))
+        || fs.readFileSync(misplaced, 'utf8') === INSTRUMENTATION;
+      if (ours || flags.force) {
+        if (!ours) fs.copyFileSync(misplaced, `${misplaced}.bak`);
+        fs.mkdirSync(folder, { recursive: true });
+        fs.writeFileSync(filePath, INSTRUMENTATION, 'utf8');
+        fs.unlinkSync(misplaced);
+        ui.success(`Moved ${rel(misplaced)} to ${rel(filePath)}: Next.js loads instrumentation from ${inSrc ? 'src/' : 'the project root'} in this project${ours ? '' : ` (the previous file is in ${rel(misplaced)}.bak)`}`);
+      } else {
+        ui.warn(`${rel(misplaced)} is in the wrong folder: this project keeps app/ or pages/ ${inSrc ? 'in src/' : 'at the root'}, and Next.js loads instrumentation from there (${rel(filePath)}), so SecureNow would not start.`);
+        ui.info('Move it there (or rerun with --force to write SecureNow\'s file there and keep yours as .bak).');
+        printAgentPrompt('instrumentation', rel(filePath), major, project);
+      }
+    } else {
+      fs.mkdirSync(folder, { recursive: true });
+      fs.writeFileSync(filePath, INSTRUMENTATION, 'utf8');
+      ui.success(`Created ${rel(filePath)}`);
+    }
   }
 
   const configPath = findNextConfig(dir);
@@ -161,7 +206,12 @@ async function initNextJs(dir, project, flags) {
     }
   } else {
     const newConfigPath = path.join(dir, 'next.config.mjs');
-    fs.writeFileSync(newConfigPath, `/** @type {import('next').NextConfig} */
+    fs.writeFileSync(newConfigPath, nextMajor(project) < 15 ? NEXT14_CONFIG : NEXT_CONFIG, 'utf8');
+    ui.success('Created next.config.mjs');
+  }
+}
+
+const NEXT_CONFIG = `/** @type {import('next').NextConfig} */
 const nextConfig = {
   serverExternalPackages: ['securenow'],
   outputFileTracingIncludes: {
@@ -170,10 +220,22 @@ const nextConfig = {
 };
 
 export default nextConfig;
-`, 'utf8');
-    ui.success('Created next.config.mjs');
-  }
-}
+`;
+
+// Next.js 14 keeps these under experimental and needs the instrumentation hook switched on.
+const NEXT14_CONFIG = `/** @type {import('next').NextConfig} */
+const nextConfig = {
+  experimental: {
+    instrumentationHook: true,
+    serverComponentsExternalPackages: ['securenow'],
+    outputFileTracingIncludes: {
+      '/*': ['./node_modules/securenow/**/*'],
+    },
+  },
+};
+
+export default nextConfig;
+`;
 
 function patchNextConfig(configPath, major) {
   const content = fs.readFileSync(configPath, 'utf8');
@@ -272,7 +334,7 @@ function printAgentPrompt(kind, filename, major, project) {
       ? `Update ${filename} while preserving existing config: add securenow to serverExternalPackages, e.g. serverExternalPackages: [...(existing || []), "securenow"], and include SecureNow runtime files for standalone output with outputFileTracingIncludes: { "/*": ["./node_modules/securenow/**/*"] }.`
       : null,
     kind === 'next-config' && major < 15
-      ? `Update ${filename} while preserving existing config: enable experimental.instrumentationHook and add securenow to experimental.serverComponentsExternalPackages.`
+      ? `Update ${filename} while preserving existing config (Next.js 14): set experimental.instrumentationHook to true, add securenow to experimental.serverComponentsExternalPackages, and add experimental.outputFileTracingIncludes: { "/*": ["./node_modules/securenow/**/*"] } for standalone output.`
       : null,
     'Verify with: npx securenow env, npx securenow test-span, npx securenow status, plus the selected build/test command when available.',
     'Only smoke-test an HTTP URL when the user provides a local or production URL, the running app prints one, or project config clearly defines one. Do not invent localhost ports or production domains; ask for the URL and skip URL probes if none is available.',

package/cli/utils.js

@@ -89,24 +89,36 @@ function cidrParse(args, flags) {
   }
 
   const parsed = cidrLib.parseCidr(cidr);
-  if (!parsed) {
+  const parsed6 = parsed ? null : cidrLib.parseCidr6(cidr);
+  if (!parsed && !parsed6) {
     ui.error(`Invalid CIDR: ${cidr}`);
     process.exit(1);
   }
 
-  const intToIp = (n) => [
-    (n >>> 24) & 0xff, (n >>> 16) & 0xff, (n >>> 8) & 0xff, n & 0xff,
-  ].join('.');
-  const broadcast = (parsed.network | (~parsed.mask >>> 0)) >>> 0;
-  const size = (~parsed.mask >>> 0) + 1;
-
-  const out = {
-    cidr,
-    network: intToIp(parsed.network),
-    broadcast: intToIp(broadcast),
-    mask: intToIp(parsed.mask),
-    size,
-  };
+  let out;
+  if (parsed) {
+    const { intToIp } = cidrLib;
+    const broadcast = (parsed.network | (~parsed.mask >>> 0)) >>> 0;
+    const size = (~parsed.mask >>> 0) + 1;
+    out = {
+      cidr,
+      network: intToIp(parsed.network),
+      broadcast: intToIp(broadcast),
+      mask: intToIp(parsed.mask),
+      size,
+    };
+  } else {
+    // IPv6 has no broadcast address: "broadcast" is the last address of the range.
+    const hostBits = 128n - BigInt(parsed6.bits);
+    const last = parsed6.network | ((1n << hostBits) - 1n);
+    out = {
+      cidr,
+      network: cidrLib.bigIntToIpv6(parsed6.network),
+      broadcast: cidrLib.bigIntToIpv6(last),
+      mask: `/${parsed6.bits}`,
+      size: (1n << hostBits).toString(),
+    };
+  }
 
   if (flags.json) {
     ui.json(out);

package/cli.js

@@ -48,11 +48,13 @@ const COMMANDS = {
       environment: 'Alias for --env',
       key: 'Firewall API key to write to .securenow/runtime.json',
       'api-key': 'Alias for --key',
-      typescript: 'Force TypeScript',
-      javascript: 'Force JavaScript',
-      src: 'Create in src/',
-      root: 'Create in root',
-      force: 'Overwrite existing',
+      ts: 'Next.js: write instrumentation.ts (default: TypeScript when tsconfig.json exists)',
+      typescript: 'Alias for --ts',
+      js: 'Next.js: write instrumentation.js',
+      javascript: 'Alias for --js',
+      src: 'Next.js: write the instrumentation file in src/ (default when app/ or pages/ is in src/)',
+      root: 'Next.js: write the instrumentation file at the project root',
+      force: 'Next.js: replace an existing instrumentation file (the old one is kept as .bak)',
     },
     run: (a, f) => require('./cli/init').init(a, f),
   },

package/console-instrumentation.js

@@ -21,6 +21,12 @@
  *   console.error('An error occurred');
  */
 
+// SECURENOW_DISABLED=1: nothing to forward to, and no warnings about it.
+if (require('./sdk-disabled').sdkDisabled('console instrumentation')) {
+  module.exports = {};
+  return;
+}
+
 const tracing = require('./tracing');
 
 if (!tracing.isLoggingEnabled()) {

package/firewall-cloud.js

@@ -11,14 +11,44 @@
  */
 
 const https = require('https');
+const net = require('net');
 
 let _options = null;
 let _active = false;
 let _provider = null;
 let _lastPushTime = 0;
+let _gcpRuleCount = 0;
+const GCP_BASE_PRIORITY = 2000;
+const GCP_RANGES_PER_RULE = 10;
+const GCP_MAX_RULES = 100;
 
 const MIN_PUSH_INTERVAL_MS = 30000;
 
+// Blocklist entries as CIDRs, per address family: an exact address becomes /32 (IPv4) or /128 (IPv6).
+// (Appending "/32" to everything turned one IPv6 address into a /32 covering billions of addresses.)
+function toCidrs(ips) {
+  const v4 = [];
+  const v6 = [];
+  for (const raw of ips || []) {
+    const entry = String(raw || '').trim();
+    if (!entry) continue;
+    const slash = entry.indexOf('/');
+    const addr = slash === -1 ? entry : entry.slice(0, slash);
+    const family = net.isIP(addr);
+    if (family === 4) v4.push(slash === -1 ? `${addr}/32` : entry);
+    else if (family === 6) v6.push(slash === -1 ? `${addr}/128` : entry);
+  }
+  return { v4, v6 };
+}
+
+function prefixLength(cidr) {
+  return Number(String(cidr).split('/')[1]);
+}
+
+function logCloud(...args) {
+  if (_options && _options.log) console.log(...args);
+}
+
 // ────── Cloudflare ──────
 
 async function cloudflareSync(ips) {
@@ -40,7 +70,14 @@ async function cloudflareSync(ips) {
     list = created.result;
   }
 
-  const items = ips.map(ip => ({ ip: ip.includes('/') ? ip : ip + '/32' }));
+  // Cloudflare lists take IPv6 ranges of /64 or wider, not single IPv6 addresses: those stay blocked by
+  // layer 1 in the app.
+  const { v4, v6 } = toCidrs(ips);
+  const v6Ranges = v6.filter((c) => prefixLength(c) <= 64);
+  if (v6Ranges.length < v6.length) {
+    logCloud('[securenow] Firewall cloud: %d IPv6 entries narrower than /64 not pushed to Cloudflare (blocked in the app)', v6.length - v6Ranges.length);
+  }
+  const items = [...v4, ...v6Ranges].map((ip) => ({ ip }));
 
   await cfApi('PUT', `/accounts/${accountId}/rules/lists/${list.id}/items`, token, items);
 }
@@ -95,7 +132,12 @@ async function awsSync(ips) {
     Id: ipSetId,
   }));
 
-  const addresses = ips.map(ip => ip.includes('/') ? ip : ip + '/32');
+  // An IP set holds one address family: push the entries of the set's family.
+  const { v4, v6 } = toCidrs(ips);
+  const ipv6Set = IPSet && IPSet.IPAddressVersion === 'IPV6';
+  const addresses = ipv6Set ? v6 : v4;
+  const other = ipv6Set ? v4.length : v6.length;
+  if (other) logCloud('[securenow] Firewall cloud: %d %s entries not pushed to this %s IP set (blocked in the app)', other, ipv6Set ? 'IPv4' : 'IPv6', ipv6Set ? 'IPv6' : 'IPv4');
 
   await client.send(new WAFV2.UpdateIPSetCommand({
     Name: ipSetName,
@@ -122,38 +164,45 @@ async function gcpSync(ips) {
   if (!project || !policyName) throw new Error('Missing GCP_PROJECT_ID or GCP_SECURITY_POLICY');
 
   const client = new compute.SecurityPoliciesClient();
-  const rulePriority = 2000;
-
-  const srcRanges = ips.map(ip => ip.includes('/') ? ip : ip + '/32');
+  // A Cloud Armor rule matches at most 10 IP ranges, so the blocklist is spread over consecutive
+  // rules from priority 2000, and rules left over from a longer blocklist are removed. (One rule with
+  // every address was refused as soon as the blocklist passed 10 entries.)
+  const { v4, v6 } = toCidrs(ips);
+  const ranges = [...v4, ...v6].slice(0, GCP_MAX_RULES * GCP_RANGES_PER_RULE);
+  if (ranges.length < v4.length + v6.length) {
+    logCloud('[securenow] Firewall cloud: Cloud Armor gets the first %d blocklist entries (%d rules of %d); the rest are blocked in the app', ranges.length, GCP_MAX_RULES, GCP_RANGES_PER_RULE);
+  }
+  const chunks = [];
+  for (let i = 0; i < ranges.length; i += GCP_RANGES_PER_RULE) chunks.push(ranges.slice(i, i + GCP_RANGES_PER_RULE));
+
+  for (let i = 0; i < chunks.length; i++) {
+    const priority = GCP_BASE_PRIORITY + i;
+    const securityPolicyRuleResource = {
+      priority,
+      action: 'deny(403)',
+      match: { versionedExpr: 'SRC_IPS_V1', config: { srcIpRanges: chunks[i] } },
+      description: 'Managed by SecureNow firewall SDK',
+    };
+    try {
+      await client.patchRule({ project, securityPolicy: policyName, priority: String(priority), securityPolicyRuleResource });
+    } catch (e) {
+      if (e.code === 404 || e.code === 5 || /not found|does not exist/i.test(e.message || '')) {
+        await client.addRule({ project, securityPolicy: policyName, securityPolicyRuleResource });
+      } else {
+        throw e;
+      }
+    }
+  }
 
-  try {
-    await client.patchRule({
-      project,
-      securityPolicy: policyName,
-      priority: String(rulePriority),
-      securityPolicyRuleResource: {
-        priority: rulePriority,
-        action: 'deny(403)',
-        match: { versionedExpr: 'SRC_IPS_V1', config: { srcIpRanges: srcRanges } },
-        description: 'Managed by SecureNow firewall SDK',
-      },
-    });
-  } catch (e) {
-    if (e.code === 404 || e.message?.includes('not found')) {
-      await client.addRule({
-        project,
-        securityPolicy: policyName,
-        securityPolicyRuleResource: {
-          priority: rulePriority,
-          action: 'deny(403)',
-          match: { versionedExpr: 'SRC_IPS_V1', config: { srcIpRanges: srcRanges } },
-          description: 'Managed by SecureNow firewall SDK',
-        },
-      });
-    } else {
-      throw e;
+  const previous = Math.max(_gcpRuleCount, 1);
+  for (let i = chunks.length; i < previous; i++) {
+    try {
+      await client.removeRule({ project, securityPolicy: policyName, priority: String(GCP_BASE_PRIORITY + i) });
+    } catch (e) {
+      if (!(e.code === 404 || e.code === 5 || /not found|does not exist/i.test(e.message || ''))) throw e;
     }
   }
+  _gcpRuleCount = chunks.length;
 }
 
 // ────── Provider dispatch ──────
@@ -209,4 +258,4 @@ function shutdown() {
   _active = false;
 }
 
-module.exports = { init, sync, shutdown };
+module.exports = { init, sync, shutdown, _test: { toCidrs, pushNow: (ips) => PROVIDERS[_provider](ips) } };