securenow 7.7.11 → 7.7.13

package/cli/init.js

@@ -137,6 +137,9 @@ async function initNextJs(dir, project, flags) {
     fs.writeFileSync(newConfigPath, `/** @type {import('next').NextConfig} */
 const nextConfig = {
   serverExternalPackages: ['securenow'],
+  outputFileTracingIncludes: {
+    '/*': ['./node_modules/securenow/**/*'],
+  },
 };
 
 export default nextConfig;
@@ -149,21 +152,47 @@ function patchNextConfig(configPath, major) {
   const content = fs.readFileSync(configPath, 'utf8');
   const serverExternalWithSecureNow = /serverExternalPackages\s*:\s*\[[\s\S]*?['"]securenow['"][\s\S]*?\]/m.test(content);
   const serverComponentsWithSecureNow = /serverComponentsExternalPackages\s*:\s*\[[\s\S]*?['"]securenow['"][\s\S]*?\]/m.test(content);
-  if (serverExternalWithSecureNow || serverComponentsWithSecureNow || content.includes('withSecureNow(')) {
+  const traceIncludeWithSecureNow = /outputFileTracingIncludes\s*:\s*{[\s\S]*?node_modules\/securenow\/\*\*/m.test(content);
+  if ((serverExternalWithSecureNow || serverComponentsWithSecureNow || content.includes('withSecureNow(')) && traceIncludeWithSecureNow) {
     return 'already';
   }
 
   if (major < 15) return 'manual';
 
+  function addTraceInclude(nextContent) {
+    if (traceIncludeWithSecureNow || /outputFileTracingIncludes\s*:/.test(nextContent)) return nextContent;
+    const insert = `  outputFileTracingIncludes: {\n    '/*': ['./node_modules/securenow/**/*'],\n  },\n`;
+    const patterns = [
+      /(const\s+nextConfig\s*=\s*{\s*\r?\n)/,
+      /(export\s+default\s+{\s*\r?\n)/,
+      /(module\.exports\s*=\s*{\s*\r?\n)/,
+    ];
+    for (const pattern of patterns) {
+      if (pattern.test(nextContent)) return nextContent.replace(pattern, `$1${insert}`);
+    }
+    return null;
+  }
+
+  if (serverExternalWithSecureNow || serverComponentsWithSecureNow || content.includes('withSecureNow(')) {
+    const withTraceInclude = addTraceInclude(content);
+    if (withTraceInclude && withTraceInclude !== content) {
+      fs.writeFileSync(configPath, withTraceInclude, 'utf8');
+      return 'patched';
+    }
+    return 'manual';
+  }
+
   const existingServerExternal = content.match(/serverExternalPackages\s*:\s*\[([\s\S]*?)\]/m);
   if (existingServerExternal) {
     const current = existingServerExternal[1].trim().replace(/,\s*$/, '');
     const replacement = `serverExternalPackages: [${current ? `${current}, ` : ''}'securenow']`;
-    fs.writeFileSync(configPath, content.replace(existingServerExternal[0], replacement), 'utf8');
+    let nextContent = content.replace(existingServerExternal[0], replacement);
+    nextContent = addTraceInclude(nextContent) || nextContent;
+    fs.writeFileSync(configPath, nextContent, 'utf8');
     return 'patched';
   }
 
-  const insert = `  serverExternalPackages: ['securenow'],\n`;
+  const insert = `  serverExternalPackages: ['securenow'],\n  outputFileTracingIncludes: {\n    '/*': ['./node_modules/securenow/**/*'],\n  },\n`;
   const patterns = [
     /(const\s+nextConfig\s*=\s*{\s*\r?\n)/,
     /(export\s+default\s+{\s*\r?\n)/,
@@ -212,7 +241,7 @@ function printAgentPrompt(kind, filename, major, project) {
       ? `Merge this into ${filename}: in register(), return unless process.env.NEXT_RUNTIME === "nodejs"; then dynamically import "securenow/nextjs" and "securenow/nextjs-auto-capture" with /* webpackIgnore: true */ so Next does not bundle OpenTelemetry internals. Preserve all existing instrumentation.`
       : null,
     kind === 'next-config' && major >= 15
-      ? `Update ${filename} while preserving existing config: add securenow to serverExternalPackages, e.g. serverExternalPackages: [...(existing || []), "securenow"].`
+      ? `Update ${filename} while preserving existing config: add securenow to serverExternalPackages, e.g. serverExternalPackages: [...(existing || []), "securenow"], and include SecureNow runtime files for standalone output with outputFileTracingIncludes: { "/*": ["./node_modules/securenow/**/*"] }.`
       : null,
     kind === 'next-config' && major < 15
       ? `Update ${filename} while preserving existing config: enable experimental.instrumentationHook and add securenow to experimental.serverComponentsExternalPackages.`

package/free-trial-banner.js

@@ -97,7 +97,8 @@ var BANNER_SCRIPT =
  */
 function patchHttpForBanner() {
   try {
-    var http = require('http');
+    var nodeRequire = typeof __non_webpack_require__ === 'function' ? __non_webpack_require__ : eval('require');
+    var http = nodeRequire('node:http');
     var _origWrite = http.ServerResponse.prototype.write;
     var _origEnd   = http.ServerResponse.prototype.end;
 

package/nextjs.js

@@ -34,6 +34,15 @@ const env = appConfig.env;
 
 let isRegistered = false;
 
+function requireRuntimeModule(name) {
+  const nodeRequire = typeof __non_webpack_require__ === 'function' ? __non_webpack_require__ : eval('require');
+  return nodeRequire(name);
+}
+
+function requireNodeBuiltin(name) {
+  return requireRuntimeModule(name);
+}
+
 function createResource(attributes) {
   if (typeof otelResources.resourceFromAttributes === 'function') {
     return otelResources.resourceFromAttributes(attributes);
@@ -501,7 +510,7 @@ function registerSecureNow(options = {}) {
 
           // Auto-log every incoming HTTP request/response
           try {
-            const http = require('http');
+            const http = requireNodeBuiltin('node:http');
             const originalEmit = http.Server.prototype.emit;
             http.Server.prototype.emit = function (event, req, res) {
               if (event === 'request' && req && res) {
@@ -549,8 +558,8 @@ function registerSecureNow(options = {}) {
           } catch (_) {}
 
           // Graceful shutdown for logs
-          process.on('SIGTERM', async () => { try { await loggerProvider.shutdown(); } catch (_) {} try { require('./firewall').shutdown(); } catch (_) {} });
-          process.on('SIGINT', async () => { try { await loggerProvider.shutdown(); } catch (_) {} try { require('./firewall').shutdown(); } catch (_) {} });
+          process.on('SIGTERM', async () => { try { await loggerProvider.shutdown(); } catch (_) {} try { requireRuntimeModule('./firewall').shutdown(); } catch (_) {} });
+          process.on('SIGINT', async () => { try { await loggerProvider.shutdown(); } catch (_) {} try { requireRuntimeModule('./firewall').shutdown(); } catch (_) {} });
         } catch (e) {
           console.warn('[securenow] ⚠️  Logging setup failed (missing @opentelemetry/exporter-logs-otlp-http or @opentelemetry/sdk-logs):', e.message);
         }
@@ -563,7 +572,7 @@ function registerSecureNow(options = {}) {
 
     // Free trial banner (optional — may not be bundled in standalone builds)
     try {
-      const { isFreeTrial, patchHttpForBanner } = require('./free-trial-banner');
+      const { isFreeTrial, patchHttpForBanner } = requireRuntimeModule('./free-trial-banner');
       if (isFreeTrial(endpointBase) && String(env('SECURENOW_HIDE_BANNER')) !== '1') {
         patchHttpForBanner();
       }
@@ -607,7 +616,7 @@ function registerSecureNow(options = {}) {
   const firewallOptions = appConfig.resolveFirewallOptions();
   if (firewallOptions.apiKey && firewallOptions.enabled) {
     try {
-      require('./firewall').init({
+      requireRuntimeModule('./firewall').init({
         apiKey: firewallOptions.apiKey,
         appKey: firewallOptions.appKey,
         environment: deploymentEnvironment || firewallOptions.environment,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "7.7.11",
+  "version": "7.7.13",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",

package/tracing.js

@@ -124,9 +124,9 @@ function extractBoundary(contentType) {
   return match ? (match[1] || match[2]) : null;
 }
 
-function collectMultipartMeta(request, contentType, sensitiveFields, maxTextFieldSize, onComplete) {
+function createMultipartMetaCollector(contentType, sensitiveFields, maxTextFieldSize, onComplete) {
   const boundary = extractBoundary(contentType);
-  if (!boundary) { onComplete({ error: 'BOUNDARY_NOT_FOUND' }); return; }
+  if (!boundary) { onComplete({ error: 'BOUNDARY_NOT_FOUND' }); return null; }
 
   const result = { fields: Object.create(null), files: [] };
   let totalSize = 0;
@@ -219,13 +219,14 @@ function collectMultipartMeta(request, contentType, sensitiveFields, maxTextFiel
     }
   }
 
-  request.on('data', (chunk) => {
-    totalSize += chunk.length;
-    buf = Buffer.concat([buf, chunk]);
+  function onData(chunk) {
+    const data = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    totalSize += data.length;
+    buf = Buffer.concat([buf, data]);
     drain();
-  });
+  }
 
-  request.on('end', () => {
+  function onEnd() {
     try {
       if (!inHeaders && fldName) {
         bodyBytes += buf.length;
@@ -236,7 +237,16 @@ function collectMultipartMeta(request, contentType, sensitiveFields, maxTextFiel
     } catch (e) {
       onComplete({ error: 'PARSE_ERROR' });
     }
-  });
+  }
+
+  return { onData, onEnd };
+}
+
+function collectMultipartMeta(request, contentType, sensitiveFields, maxTextFieldSize, onComplete) {
+  const collector = createMultipartMetaCollector(contentType, sensitiveFields, maxTextFieldSize, onComplete);
+  if (!collector) return;
+  request.on('data', collector.onData);
+  request.on('end', collector.onEnd);
 }
 
 // -------- ESM detection --------
@@ -342,6 +352,133 @@ const allSensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...customSensitiveField
 
 const captureMultipart = !/^(0|false)$/i.test(String(env('SECURENOW_CAPTURE_MULTIPART') ?? ''));
 
+const BODY_CAPTURE_PATCH = Symbol.for('securenow.bodyCapture.emitPatch');
+
+function installRequestBodyObserver(span, request, contentType) {
+  if (!request || request[BODY_CAPTURE_PATCH]) return;
+
+  const normalizedContentType = String(contentType || '').toLowerCase();
+  const isStructuredBody = captureBody && (
+    normalizedContentType.includes('application/json') ||
+    normalizedContentType.includes('application/graphql') ||
+    normalizedContentType.includes('application/x-www-form-urlencoded')
+  );
+  const isMultipartBody = normalizedContentType.includes('multipart/form-data');
+
+  if (!isStructuredBody && !isMultipartBody) return;
+
+  if (isMultipartBody && !captureMultipart) {
+    span.setAttribute('http.request.body', '[MULTIPART - NOT CAPTURED]');
+    span.setAttribute('http.request.body.type', 'multipart');
+    span.setAttribute('http.request.body.note', 'Multipart capture disabled (SECURENOW_CAPTURE_MULTIPART=0)');
+    return;
+  }
+
+  let chunks = [];
+  let size = 0;
+  let structuredDone = false;
+
+  const multipartCollector = isMultipartBody && captureMultipart
+    ? createMultipartMetaCollector(normalizedContentType, allSensitiveFields, 1000, ({ error, parsed, totalSize }) => {
+        try {
+          if (error === 'BOUNDARY_NOT_FOUND') {
+            span.setAttribute('http.request.body', '[MULTIPART - BOUNDARY NOT FOUND]');
+            span.setAttribute('http.request.body.type', 'multipart');
+            return;
+          }
+          if (error) {
+            span.setAttribute('http.request.body', '[MULTIPART - PARSE ERROR]');
+            span.setAttribute('http.request.body.type', 'multipart');
+            span.setAttribute('http.request.body.parse_error', true);
+            return;
+          }
+          span.setAttributes({
+            'http.request.body': JSON.stringify(parsed).substring(0, maxBodySize),
+            'http.request.body.type': 'multipart',
+            'http.request.body.size': totalSize,
+            'http.request.body.fields_count': Object.keys(parsed.fields).length,
+            'http.request.body.files_count': parsed.files.length,
+          });
+        } catch (e) {
+          span.setAttribute('http.request.body', '[MULTIPART - PARSE ERROR]');
+          span.setAttribute('http.request.body.type', 'multipart');
+          span.setAttribute('http.request.body.parse_error', true);
+        }
+      })
+    : null;
+
+  if (isMultipartBody && captureMultipart && !multipartCollector) return;
+
+  function finishStructuredCapture() {
+    if (!isStructuredBody || structuredDone) return;
+    structuredDone = true;
+
+    if (size > maxBodySize) {
+      span.setAttribute('http.request.body', `[TOO LARGE: ${size} bytes]`);
+      span.setAttribute('http.request.body.size', size);
+      chunks = [];
+      return;
+    }
+
+    if (chunks.length === 0) return;
+
+    const body = Buffer.concat(chunks).toString('utf8');
+    chunks = [];
+
+    try {
+      if (normalizedContentType.includes('application/graphql')) {
+        const redacted = redactGraphQLQuery(body, allSensitiveFields);
+        span.setAttributes({
+          'http.request.body': redacted.substring(0, maxBodySize),
+          'http.request.body.type': 'graphql',
+          'http.request.body.size': size,
+        });
+      } else if (normalizedContentType.includes('application/json')) {
+        const parsed = JSON.parse(body);
+        const redacted = redactSensitiveData(parsed, allSensitiveFields);
+        span.setAttributes({
+          'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
+          'http.request.body.type': 'json',
+          'http.request.body.size': size,
+        });
+      } else if (normalizedContentType.includes('application/x-www-form-urlencoded')) {
+        const parsed = Object.fromEntries(new URLSearchParams(body));
+        const redacted = redactSensitiveData(parsed, allSensitiveFields);
+        span.setAttributes({
+          'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
+          'http.request.body.type': 'form',
+          'http.request.body.size': size,
+        });
+      }
+    } catch (e) {
+      span.setAttribute('http.request.body', '[UNPARSEABLE - REDACTED FOR SAFETY]');
+      span.setAttribute('http.request.body.parse_error', true);
+      span.setAttribute('http.request.body.size', size);
+    }
+  }
+
+  const originalEmit = request.emit;
+  request[BODY_CAPTURE_PATCH] = true;
+  request.emit = function securenowObservedEmit(event, ...args) {
+    try {
+      if (event === 'data' && args.length > 0) {
+        const chunk = Buffer.isBuffer(args[0]) ? args[0] : Buffer.from(args[0]);
+        if (isStructuredBody) {
+          size += chunk.length;
+          if (size <= maxBodySize) chunks.push(chunk);
+        }
+        if (multipartCollector) multipartCollector.onData(chunk);
+      } else if (event === 'end') {
+        finishStructuredCapture();
+        if (multipartCollector) multipartCollector.onEnd();
+      }
+    } catch (_) {
+      // Body capture must never interfere with the application request stream.
+    }
+    return originalEmit.apply(this, [event, ...args]);
+  };
+}
+
 // -------- Trusted proxy IP resolution --------
 const { resolveClientIpWithDetails } = require('./resolve-ip');
 
@@ -391,100 +528,7 @@ const httpInstrumentation = new HttpInstrumentation({
 
       if ((captureBody || captureMultipart) && request.method && ['POST', 'PUT', 'PATCH'].includes(request.method)) {
         const contentType = request.headers['content-type'] || '';
-        
-        if (captureBody && (contentType.includes('application/json') || 
-            contentType.includes('application/graphql') ||
-            contentType.includes('application/x-www-form-urlencoded'))) {
-          
-          let body = '';
-          const chunks = [];
-          let size = 0;
-          
-          request.on('data', (chunk) => {
-            size += chunk.length;
-            if (size <= maxBodySize) {
-              chunks.push(chunk);
-            }
-          });
-          
-          request.on('end', () => {
-            if (size <= maxBodySize && chunks.length > 0) {
-              body = Buffer.concat(chunks).toString('utf8');
-              
-              try {
-                let redacted;
-                
-                if (contentType.includes('application/graphql')) {
-                  // GraphQL: redact query string
-                  redacted = redactGraphQLQuery(body, allSensitiveFields);
-                  span.setAttributes({
-                    'http.request.body': redacted.substring(0, maxBodySize),
-                    'http.request.body.type': 'graphql',
-                    'http.request.body.size': size,
-                  });
-                } else if (contentType.includes('application/json')) {
-                  // JSON: parse and redact object
-                  const parsed = JSON.parse(body);
-                  redacted = redactSensitiveData(parsed, allSensitiveFields);
-                  span.setAttributes({
-                    'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
-                    'http.request.body.type': 'json',
-                    'http.request.body.size': size,
-                  });
-                } else if (contentType.includes('application/x-www-form-urlencoded')) {
-                  // Form: parse and redact
-                  const parsed = Object.fromEntries(new URLSearchParams(body));
-                  redacted = redactSensitiveData(parsed, allSensitiveFields);
-                  span.setAttributes({
-                    'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
-                    'http.request.body.type': 'form',
-                    'http.request.body.size': size,
-                  });
-                }
-              } catch (e) {
-                span.setAttribute('http.request.body', '[UNPARSEABLE - REDACTED FOR SAFETY]');
-                span.setAttribute('http.request.body.parse_error', true);
-                span.setAttribute('http.request.body.size', size);
-              }
-            } else if (size > maxBodySize) {
-              span.setAttribute('http.request.body', `[TOO LARGE: ${size} bytes]`);
-              span.setAttribute('http.request.body.size', size);
-            }
-          });
-        } else if (contentType.includes('multipart/form-data')) {
-          if (captureMultipart) {
-            collectMultipartMeta(request, contentType, allSensitiveFields, 1000, ({ error, parsed, totalSize }) => {
-              try {
-                if (error === 'BOUNDARY_NOT_FOUND') {
-                  span.setAttribute('http.request.body', '[MULTIPART - BOUNDARY NOT FOUND]');
-                  span.setAttribute('http.request.body.type', 'multipart');
-                  return;
-                }
-                if (error) {
-                  span.setAttribute('http.request.body', '[MULTIPART - PARSE ERROR]');
-                  span.setAttribute('http.request.body.type', 'multipart');
-                  span.setAttribute('http.request.body.parse_error', true);
-                  return;
-                }
-                span.setAttributes({
-                  'http.request.body': JSON.stringify(parsed).substring(0, maxBodySize),
-                  'http.request.body.type': 'multipart',
-                  'http.request.body.size': totalSize,
-                  'http.request.body.fields_count': Object.keys(parsed.fields).length,
-                  'http.request.body.files_count': parsed.files.length,
-                });
-              } catch (e) {
-                span.setAttribute('http.request.body', '[MULTIPART - PARSE ERROR]');
-                span.setAttribute('http.request.body.type', 'multipart');
-                span.setAttribute('http.request.body.parse_error', true);
-              }
-            });
-          } else {
-            span.setAttribute('http.request.body', '[MULTIPART - NOT CAPTURED]');
-            span.setAttribute('http.request.body.type', 'multipart');
-            span.setAttribute('http.request.body.note', 'Multipart capture disabled (SECURENOW_CAPTURE_MULTIPART=0)');
-          }
-        }
+        installRequestBodyObserver(span, request, contentType);
       }
     } catch (error) {
       // Silently fail