securenow 8.24.0 → 8.25.1

package/firewall-iptables.js

@@ -1,104 +1,162 @@
 'use strict';
 
 /**
- * Layer 3: OS-level firewall via iptables/nftables.
- * Manages a dedicated SECURENOW_BLOCK chain — never touches customer rules.
+ * Layer 3: OS-level firewall via iptables (IPv4), ip6tables (IPv6) or, where neither exists, nftables.
+ * Manages its own chain (SECURENOW_BLOCK), or with nft its own table: never touches customer rules.
  * Linux only, requires root or CAP_NET_ADMIN. Falls back gracefully otherwise.
+ *
+ * Blocklist entries arrive over the network, so each one must be a literal IP or CIDR before it reaches
+ * a firewall command, and the binaries run without a shell. (Entries used to be pasted into a shell
+ * command run as root, and one IPv6 entry stopped the rest of the sync.) A sync is one batch
+ * (iptables-restore / nft -f), not one process per address.
  */
 
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
+const net = require('net');
 const os = require('os');
 
 const CHAIN_NAME = 'SECURENOW_BLOCK';
+const NFT_TABLE = 'securenow';
 
 let _options = null;
 let _active = false;
-let _useNft = false;
+let _backend = null; // 'iptables' | 'nft'
+let _ip6 = false; // ip6tables available alongside iptables
 
-function exec(cmd) {
-  return execSync(cmd, { stdio: 'pipe', timeout: 10000 }).toString().trim();
+function run(cmd, args, input) {
+  return execFileSync(cmd, args, { stdio: ['pipe', 'pipe', 'pipe'], timeout: 15000, input }).toString().trim();
 }
 
-function canRun(cmd) {
-  try { exec(cmd); return true; } catch { return false; }
+function canRun(cmd, args) {
+  try { run(cmd, args); return true; } catch { return false; }
+}
+
+function log(method, ...args) {
+  if (_options && _options.log) console[method](...args);
+}
+
+// A literal IPv4/IPv6 address or CIDR, or null.
+function parseEntry(raw) {
+  const entry = String(raw == null ? '' : raw).trim();
+  const slash = entry.indexOf('/');
+  const addr = slash === -1 ? entry : entry.slice(0, slash);
+  const family = net.isIP(addr);
+  if (!family) return null;
+  if (slash !== -1) {
+    const bits = entry.slice(slash + 1);
+    if (!/^\d{1,3}$/.test(bits) || Number(bits) > (family === 4 ? 32 : 128)) return null;
+  }
+  return { family, value: entry };
+}
+
+function splitFamilies(ips) {
+  const v4 = [];
+  const v6 = [];
+  let rejected = 0;
+  for (const raw of ips || []) {
+    const parsed = parseEntry(raw);
+    if (!parsed) { rejected++; continue; }
+    (parsed.family === 4 ? v4 : v6).push(parsed.value);
+  }
+  return { v4, v6, rejected };
 }
 
 function detectBackend() {
-  if (canRun('nft --version')) return 'nft';
-  if (canRun('iptables --version')) return 'iptables';
+  // iptables first: iptables-legacy and iptables-nft both accept it, while bare nft rules depend on
+  // tables the host may not have.
+  if (canRun('iptables', ['--version'])) return 'iptables';
+  if (canRun('nft', ['--version'])) return 'nft';
   return null;
 }
 
-// ────── iptables backend ──────
+// ────── iptables / ip6tables backend ──────
 
-function iptablesSetup() {
-  try { exec(`iptables -N ${CHAIN_NAME}`); } catch (_) {} // chain may already exist
-  try { exec(`iptables -C INPUT -j ${CHAIN_NAME}`); } catch (_) {
-    exec(`iptables -I INPUT 1 -j ${CHAIN_NAME}`);
+function iptablesSetup(bin) {
+  try { run(bin, ['-N', CHAIN_NAME]); } catch (_) {} // chain may already exist
+  try { run(bin, ['-C', 'INPUT', '-j', CHAIN_NAME]); } catch (_) {
+    run(bin, ['-I', 'INPUT', '1', '-j', CHAIN_NAME]);
   }
 }
 
-function iptablesSync(ips) {
-  exec(`iptables -F ${CHAIN_NAME}`);
-  for (const ip of ips) {
-    exec(`iptables -A ${CHAIN_NAME} -s ${ip} -j DROP`);
-  }
+// Input for iptables-restore --noflush: replaces the chain's rules in one step, leaves everything else.
+function restoreScript(entries) {
+  return [
+    '*filter',
+    `:${CHAIN_NAME} - [0:0]`,
+    `-F ${CHAIN_NAME}`,
+    ...entries.map((entry) => `-A ${CHAIN_NAME} -s ${entry} -j DROP`),
+    'COMMIT',
+    '',
+  ].join('\n');
 }
 
-function iptablesCleanup() {
-  try { exec(`iptables -D INPUT -j ${CHAIN_NAME}`); } catch (_) {}
-  try { exec(`iptables -F ${CHAIN_NAME}`); } catch (_) {}
-  try { exec(`iptables -X ${CHAIN_NAME}`); } catch (_) {}
+function iptablesSync(v4, v6) {
+  run('iptables-restore', ['--noflush'], restoreScript(v4));
+  if (_ip6) run('ip6tables-restore', ['--noflush'], restoreScript(v6));
 }
 
-// ────── nftables backend ──────
+function iptablesCleanup(bin) {
+  try { run(bin, ['-D', 'INPUT', '-j', CHAIN_NAME]); } catch (_) {}
+  try { run(bin, ['-F', CHAIN_NAME]); } catch (_) {}
+  try { run(bin, ['-X', CHAIN_NAME]); } catch (_) {}
+}
 
-function nftSetup() {
-  try { exec(`nft list chain ip filter ${CHAIN_NAME}`); } catch (_) {
-    exec(`nft add chain ip filter ${CHAIN_NAME}`);
-  }
-  try { exec(`nft insert rule ip filter INPUT jump ${CHAIN_NAME}`); } catch (_) {}
+// ────── nftables backend (own table, own input hook) ──────
+
+// One nft -f transaction: make sure the table exists, drop it, add it back with the current rules.
+function nftScript(v4, v6) {
+  return [
+    `table inet ${NFT_TABLE}`,
+    `delete table inet ${NFT_TABLE}`,
+    `table inet ${NFT_TABLE} {`,
+    '  chain input {',
+    '    type filter hook input priority -10; policy accept;',
+    ...v4.map((entry) => `    ip saddr ${entry} drop`),
+    ...v6.map((entry) => `    ip6 saddr ${entry} drop`),
+    '  }',
+    '}',
+    '',
+  ].join('\n');
 }
 
-function nftSync(ips) {
-  exec(`nft flush chain ip filter ${CHAIN_NAME}`);
-  for (const ip of ips) {
-    exec(`nft add rule ip filter ${CHAIN_NAME} ip saddr ${ip} drop`);
-  }
+function nftSync(v4, v6) {
+  run('nft', ['-f', '-'], nftScript(v4, v6));
 }
 
 function nftCleanup() {
-  try { exec(`nft flush chain ip filter ${CHAIN_NAME}`); } catch (_) {}
-  try { exec(`nft delete chain ip filter ${CHAIN_NAME}`); } catch (_) {}
+  try { run('nft', ['delete', 'table', 'inet', NFT_TABLE]); } catch (_) {}
 }
 
 // ────── Public API ──────
 
-let _syncCallback = null;
-
 function init(options) {
   _options = options;
 
   if (os.platform() !== 'linux') {
-    if (_options.log) console.warn('[securenow] Firewall iptables: only supported on Linux, skipping');
+    log('warn', '[securenow] Firewall iptables: only supported on Linux, skipping');
     return;
   }
 
-  const backend = detectBackend();
-  if (!backend) {
-    if (_options.log) console.warn('[securenow] Firewall iptables: neither iptables nor nft found, skipping');
+  _backend = detectBackend();
+  if (!_backend) {
+    log('warn', '[securenow] Firewall iptables: neither iptables nor nft found, skipping');
     return;
   }
 
-  _useNft = backend === 'nft';
-  const label = _useNft ? 'nftables' : 'iptables';
-
   try {
-    if (_useNft) nftSetup(); else iptablesSetup();
+    if (_backend === 'nft') {
+      nftSync([], []);
+    } else {
+      iptablesSetup('iptables');
+      if (canRun('ip6tables', ['--version'])) {
+        try { iptablesSetup('ip6tables'); _ip6 = true; } catch (_) { _ip6 = false; }
+      }
+    }
     _active = true;
-    if (_options.log) console.log('[securenow] Firewall iptables: %s chain %s ready', label, CHAIN_NAME);
+    log('log', '[securenow] Firewall iptables: %s %s ready%s', _backend === 'nft' ? 'nftables table' : 'iptables chain',
+      _backend === 'nft' ? NFT_TABLE : CHAIN_NAME, _backend === 'iptables' && !_ip6 ? ' (IPv4 only: no ip6tables)' : '');
   } catch (e) {
-    if (_options.log) console.warn('[securenow] Firewall iptables: setup failed (need root or CAP_NET_ADMIN):', e.message);
+    log('warn', '[securenow] Firewall iptables: setup failed (need root or CAP_NET_ADMIN):', e.message);
   }
 }
 
@@ -110,30 +168,33 @@ function sync(ips) {
   if (!_active) return;
 
   const maxRules = (_options && _options.iptablesMax) || 10000;
-  const limited = ips.length > maxRules ? ips.slice(0, maxRules) : ips;
-
-  if (ips.length > maxRules && _options.log) {
-    console.warn('[securenow] Firewall iptables: truncated to %d rules (max %d)', maxRules, maxRules);
-  }
+  const list = Array.isArray(ips) ? ips : [];
+  if (list.length > maxRules) log('warn', '[securenow] Firewall iptables: truncated to %d rules (max %d)', maxRules, maxRules);
+  const { v4, v6, rejected } = splitFamilies(list.slice(0, maxRules));
+  if (rejected) log('warn', '[securenow] Firewall iptables: ignored %d blocklist entries that are not IPs or CIDRs', rejected);
 
   try {
-    if (_useNft) nftSync(limited); else iptablesSync(limited);
+    if (_backend === 'nft') nftSync(v4, v6);
+    else iptablesSync(v4, v6);
   } catch (e) {
-    if (_options && _options.log) {
-      console.warn('[securenow] Firewall iptables: sync failed:', e.message);
-    }
+    log('warn', '[securenow] Firewall iptables: sync failed:', e.message);
   }
 }
 
 function shutdown() {
   if (!_active) return;
   try {
-    if (_useNft) nftCleanup(); else iptablesCleanup();
-    if (_options && _options.log) console.log('[securenow] Firewall iptables: chain %s cleaned up', CHAIN_NAME);
+    if (_backend === 'nft') {
+      nftCleanup();
+    } else {
+      iptablesCleanup('iptables');
+      if (_ip6) iptablesCleanup('ip6tables');
+    }
+    log('log', '[securenow] Firewall iptables: %s cleaned up', _backend === 'nft' ? `table ${NFT_TABLE}` : `chain ${CHAIN_NAME}`);
   } catch (e) {
-    if (_options && _options.log) console.warn('[securenow] Firewall iptables: cleanup failed:', e.message);
+    log('warn', '[securenow] Firewall iptables: cleanup failed:', e.message);
   }
   _active = false;
 }
 
-module.exports = { init, sync, shutdown };
+module.exports = { init, sync, shutdown, _test: { parseEntry, splitFamilies, restoreScript, nftScript } };

package/firewall-only.js

@@ -41,6 +41,8 @@ if (firewallOptions.apiKey) {
     aws: firewallOptions.aws,
     gcp: firewallOptions.gcp,
   });
+  // Zero-code session revocation / session-theft capture (config.sessions.guard / .capture).
+  require('./sessions').installHttpGuard(appConfig.resolveSessionsOptions());
 
   const shutdown = () => { try { require('./firewall').shutdown(); } catch (_) {} };
   process.on('SIGINT', shutdown);

package/firewall-tcp.js

@@ -18,12 +18,20 @@ let _options = null;
 let _patched = false;
 const _origListen = net.Server.prototype.listen;
 
+const TCP_CHECKED = Symbol('securenow.tcpChecked');
+
+// Returns true when it destroyed the socket. The firewall's emit guard calls it on every 'connection'
+// of an HTTP/HTTPS/HTTP2 server, including servers that were already listening when the firewall
+// started (the app usually calls listen() before the SDK's asynchronous start completes, so a listen()
+// patch alone never saw them); the listen() patch below covers other net servers created later.
 function onConnection(socket) {
+  if (!socket || socket[TCP_CHECKED] || !_getMatcher) return false;
+  socket[TCP_CHECKED] = true;
   const ip = resolveSocketIp(socket);
 
   // Skip if the connection is from a trusted proxy — Layer 1 will handle it
   // with proper X-Forwarded-For resolution
-  if (isFromTrustedProxy(ip) || isFromTrustedProxy('::ffff:' + ip)) return;
+  if (isFromTrustedProxy(ip) || isFromTrustedProxy('::ffff:' + ip)) return false;
 
   // Allowlist check: if active, only listed IPs pass
   const allowlistMatcher = _getAllowlistMatcher ? _getAllowlistMatcher() : null;
@@ -33,21 +41,23 @@ function onConnection(socket) {
         console.log('[securenow] Firewall: blocked %s via TCP (not in allowlist)', ip);
       }
       socket.destroy();
-      return;
+      return true;
     }
-    return; // on allowlist — allow
+    return false; // on allowlist — allow
   }
 
   // Blocklist check
   const matcher = _getMatcher();
-  if (!matcher) return;
+  if (!matcher) return false;
 
   if (matcher.isBlocked(ip)) {
     if (_options && _options.log) {
       console.log('[securenow] Firewall: blocked %s via TCP (socket destroyed)', ip);
     }
     socket.destroy();
+    return true;
   }
+  return false;
 }
 
 function init(getMatcher, options, getAllowlistMatcher) {
@@ -71,4 +81,8 @@ function shutdown() {
   }
 }
 
-module.exports = { init, shutdown };
+function checkConnection(socket) {
+  return _patched ? onConnection(socket) : false;
+}
+
+module.exports = { init, shutdown, checkConnection };

package/firewall.js

@@ -1445,12 +1445,31 @@ const _origHttpsEmit = https.Server.prototype.emit;
 const FIREWALL_CHECKED = Symbol('securenow.firewallChecked');
 let _emitPatched = false;
 
+// Checks that run after the firewall lets a request through, independent of its remote toggle (the
+// zero-code session guard in sessions.js). Each returns true when it has answered the request itself.
+const _requestHooks = [];
+// Layer 2, when enabled: checked on each 'connection', before the server parses anything.
+let _tcpLayer = null;
+function addRequestHook(fn) {
+  if (typeof fn === 'function' && !_requestHooks.includes(fn)) _requestHooks.push(fn);
+}
+function runRequestHooks(req, res) {
+  for (const hook of _requestHooks) {
+    try {
+      if (hook(req, res)) return true;
+    } catch (_) {}
+  }
+  return false;
+}
+
 // One 'request' guard for every server kind: the firewall runs once per request, then the server's own emit.
 function guardedEmit(originalEmit) {
   return function securenowGuardedEmit(event, req, res, ...rest) {
+    if (event === 'connection' && _tcpLayer && req && _tcpLayer.checkConnection(req)) return true;
     if (event === 'request' && req && res && !res.headersSent && !req[FIREWALL_CHECKED]) {
       req[FIREWALL_CHECKED] = true;
       if (firewallRequestHandler(req, res)) return true;
+      if (_requestHooks.length && runRequestHooks(req, res)) return true;
     }
     return originalEmit.call(this, event, req, res, ...rest);
   };
@@ -1528,6 +1547,7 @@ function init(options) {
       const tcpLayer = require('./firewall-tcp');
       tcpLayer.init(() => _matcher, _options, () => _allowlistMatcher);
       _layers.push(tcpLayer);
+      _tcpLayer = tcpLayer;
       if (_options.log) fwLog('[securenow] Firewall: Layer 2 (TCP drop)       active');
     } catch (e) {
       if (_options.log) fwWarn('[securenow] Firewall: Layer 2 (TCP drop)       failed:', e.message);
@@ -1671,4 +1691,4 @@ const _test = {
   identity: () => ({ sdkVersion: SDK_VERSION, instanceId: INSTANCE_ID }),
 };
 
-module.exports = { init, shutdown, getStats, getMatcher, getAllowlistMatcher, getBlocklistRules, getRateLimitRules, getChallengeRules, isRemoteEnabled, _test };
+module.exports = { init, shutdown, addRequestHook, getStats, getMatcher, getAllowlistMatcher, getBlocklistRules, getRateLimitRules, getChallengeRules, isRemoteEnabled, _test };

package/framework-routes.js

@@ -0,0 +1,222 @@
+'use strict';
+
+/**
+ * Route templates (http.route) for frameworks the OpenTelemetry bundle does not instrument: Hono, h3,
+ * Feathers and Polka. Without these their request spans carried only the raw path (/users/42), not the
+ * route (/users/:id). Each hook reads the framework's own routing result and writes it to the request's
+ * server span; nothing changes how the app routes or responds.
+ *
+ * The same hooks record a handler's server error (5xx) as an exception event, with its stack, on that
+ * span: these frameworks catch the error and answer 500 themselves, so it never reached the HTTP layer.
+ *
+ * One OpenTelemetry instrumentation, so CommonJS and ESM (through the preload's ESM hook) are both patched.
+ */
+
+const { InstrumentationBase, InstrumentationNodeModuleDefinition } = require('@opentelemetry/instrumentation');
+
+const PATCHED = Symbol.for('securenow.routePatched');
+
+// The route goes on the request's server span twice: through the RPC metadata the HTTP instrumentation
+// reads when the response finishes (it then names the span "GET /users/:id"), and as an attribute now.
+function setRoute(route) {
+  if (!route || typeof route !== 'string') return;
+  try {
+    const api = require('@opentelemetry/api');
+    const core = require('@opentelemetry/core');
+    const meta = core.getRPCMetadata(api.context.active());
+    if (meta && meta.type === core.RPCType.HTTP) meta.route = route;
+    const span = api.trace.getActiveSpan();
+    if (span) span.setAttribute('http.route', route);
+  } catch (_) {}
+}
+
+function markPatched(fn) {
+  try { Object.defineProperty(fn, PATCHED, { value: true }); } catch (_) {}
+  return fn;
+}
+
+// The HTTP status an error stands for: statusCode (h3), status (Hono HTTPException, http-errors), or a
+// numeric code (Feathers errors). Anything else is a 500.
+function errorStatus(err) {
+  if (!err || typeof err !== 'object') return 500;
+  const status = Number(err.statusCode || err.status || (typeof err.code === 'number' ? err.code : 0));
+  return Number.isInteger(status) && status >= 100 && status < 600 ? status : 500;
+}
+
+// A 4xx is the client's doing (not found, unauthorized...) and stays off the span, as in OpenTelemetry's
+// HTTP conventions; the status code itself still records it.
+function recordServerError(err, status = errorStatus(err)) {
+  if (!err || status < 500) return;
+  try {
+    const span = require('@opentelemetry/api').trace.getActiveSpan();
+    if (span) span.recordException(err instanceof Error ? err : String(err && err.message ? err.message : err));
+  } catch (_) {}
+}
+
+// ---- Hono 4: a '*' middleware added to every app reads the route that answered, after the handler ran.
+function honoRouteOf(c) {
+  const req = c && c.req;
+  if (!req) return null;
+  try {
+    if (typeof req.routePath === 'string') return req.routePath;
+  } catch (_) {}
+  try {
+    const routes = req.matchedRoutes;
+    if (Array.isArray(routes) && routes[req.routeIndex]) return routes[req.routeIndex].path;
+  } catch (_) {}
+  return null;
+}
+
+function patchHono(exports) {
+  const Original = exports && exports.Hono;
+  if (typeof Original !== 'function' || Original[PATCHED]) return exports;
+  class Hono extends Original {
+    constructor(...args) {
+      super(...args);
+      try {
+        this.use('*', async function securenowRoute(c, next) {
+          try {
+            await next();
+          } finally {
+            const route = honoRouteOf(c);
+            if (route && route !== '*' && route !== '/*') setRoute(route);
+            // Hono's compose catches a handler's error, sets c.error and answers with app.onError.
+            if (c && c.error) recordServerError(c.error);
+          }
+        });
+      } catch (_) {}
+    }
+  }
+  try { Object.defineProperty(Hono, 'name', { value: 'Hono' }); } catch (_) {}
+  markPatched(Hono);
+  try { exports.Hono = Hono; } catch (_) {}
+  return exports;
+}
+
+// ---- h3 1: the router records event.context.matchedRoute; an onBeforeResponse hook reads it.
+function patchH3(exports) {
+  const original = exports && exports.createApp;
+  if (typeof original !== 'function' || original[PATCHED]) return exports;
+  const createApp = markPatched(function createApp(options) {
+    const opts = options || {};
+    const userHook = opts.onBeforeResponse;
+    const userOnError = opts.onError;
+    return original.call(this, {
+      ...opts,
+      onBeforeResponse(event, response) {
+        try {
+          const matched = event && event.context && event.context.matchedRoute;
+          if (matched && matched.path) setRoute(matched.path);
+        } catch (_) {}
+        return typeof userHook === 'function' ? userHook.call(this, event, response) : undefined;
+      },
+      // h3 wraps a thrown error in an H3Error (cause = the original, with its stack), calls onError, then
+      // still sends its default error response unless this hook handled the event.
+      onError(error, event) {
+        try {
+          recordServerError(error && error.cause instanceof Error ? error.cause : error, errorStatus(error));
+        } catch (_) {}
+        return typeof userOnError === 'function' ? userOnError.call(this, error, event) : undefined;
+      },
+    });
+  });
+  try { exports.createApp = createApp; } catch (_) {}
+  return exports;
+}
+
+// ---- Feathers 5: an app-wide around hook names external service calls (/users, /users/:id).
+function feathersRoute(context) {
+  if (!context || typeof context.path !== 'string') return null;
+  const base = `/${context.path.replace(/^\/+/, '')}`;
+  return context.id !== undefined && context.id !== null ? `${base}/:id` : base;
+}
+
+function patchFeathers(exports) {
+  const original = exports && exports.feathers;
+  if (typeof original !== 'function' || original[PATCHED]) return exports;
+  const feathers = markPatched(function feathers(...args) {
+    const app = original.apply(this, args);
+    try {
+      app.hooks({
+        around: {
+          all: [async function securenowRoute(context, next) {
+            try {
+              await next();
+            } catch (err) {
+              if (context && context.params && context.params.provider) recordServerError(err);
+              throw err;
+            } finally {
+              // Only calls that came in through a transport (REST, sockets), not service-to-service calls.
+              if (context && context.params && context.params.provider) {
+                const route = feathersRoute(context);
+                if (route) setRoute(route);
+              }
+            }
+          }],
+        },
+      });
+    } catch (_) {}
+    return app;
+  });
+  try { exports.feathers = feathers; } catch (_) {}
+  return exports;
+}
+
+// ---- Polka (trouter 2): find() returns the matched route's handlers; their registered pattern is the route.
+// Polka passes next(err) errors to the app's own onError, which find() wraps the first time it runs.
+function wrapPolkaOnError(app) {
+  const userOnError = app && app.onError;
+  if (typeof userOnError !== 'function' || userOnError[PATCHED]) return;
+  app.onError = markPatched(function onError(err, ...rest) {
+    recordServerError(err);
+    return userOnError.call(this, err, ...rest);
+  });
+}
+
+function patchTrouter(exports) {
+  const Trouter = exports && (typeof exports === 'function' ? exports : exports.default);
+  const proto = Trouter && Trouter.prototype;
+  if (!proto || typeof proto.find !== 'function' || proto.find[PATCHED]) return exports;
+  const original = proto.find;
+  proto.find = markPatched(function find(method, url) {
+    const result = original.call(this, method, url);
+    try { wrapPolkaOnError(this); } catch (_) {}
+    try {
+      if (result && result.handlers && this.handlers) {
+        for (const m of [method, '*']) {
+          const table = this.handlers[m];
+          if (!table) continue;
+          for (const pattern of Object.keys(table)) {
+            if (table[pattern] === result.handlers) {
+              setRoute(pattern);
+              return result;
+            }
+          }
+        }
+      }
+    } catch (_) {}
+    return result;
+  });
+  return exports;
+}
+
+class SecureNowRouteInstrumentation extends InstrumentationBase {
+  constructor(config = {}) {
+    super('securenow-framework-routes', '1.0.0', config);
+  }
+
+  init() {
+    return [
+      new InstrumentationNodeModuleDefinition('hono', ['>=4.0.0 <5'], patchHono),
+      new InstrumentationNodeModuleDefinition('h3', ['>=1.0.0 <2'], patchH3),
+      new InstrumentationNodeModuleDefinition('@feathersjs/feathers', ['>=5.0.0 <6'], patchFeathers),
+      new InstrumentationNodeModuleDefinition('trouter', ['>=2.0.0 <3'], patchTrouter),
+    ];
+  }
+}
+
+module.exports = {
+  SecureNowRouteInstrumentation,
+  // For tests.
+  _test: { setRoute, patchHono, patchH3, patchFeathers, patchTrouter, honoRouteOf, feathersRoute, errorStatus, recordServerError },
+};

package/log-format.js

@@ -19,6 +19,8 @@ function renderArg(arg) {
 
 function formatLogArgs(args) {
   if (!Array.isArray(args) || args.length === 0) return '';
+  // Credential fields in logged objects are redacted first (config.logging.redact, log-redaction.js).
+  try { args = require('./log-redaction').redactLogArgs(args); } catch (_) { /* format as is */ }
   if (typeof args[0] === 'string' && PLACEHOLDER.test(args[0])) {
     try { return util.format(...args); } catch (_) { /* fall through */ }
   }