securenow 8.22.0 → 8.24.0

package/cli/init.js

@@ -5,7 +5,26 @@ const path = require('path');
 const ui = require('./ui');
 const config = require('./config');
 
+// The import sits inside the nodejs block, without webpackIgnore: Next.js drops the block from the
+// Edge build and traces securenow and its dependencies into standalone output (webpackIgnore hid
+// them from tracing, so a standalone image shipped without OpenTelemetry and every request failed).
+// The try/catch keeps the app serving if SecureNow cannot start.
 const INSTRUMENTATION = `export async function register() {
+  if (process.env.NEXT_RUNTIME === 'nodejs') {
+    try {
+      const securenowNext = await import('securenow/nextjs');
+      const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
+      registerSecureNow({ captureBody: true });
+      await import('securenow/nextjs-auto-capture');
+    } catch (error) {
+      console.error('[securenow] SecureNow did not start; the app is running without it:', error);
+    }
+  }
+}
+`;
+
+// What init wrote before 8.24.0: replaced automatically when a file still holds exactly this.
+const LEGACY_INSTRUMENTATION = `export async function register() {
   if (process.env.NEXT_RUNTIME !== 'nodejs') return;
 
   const securenowNext = await import(/* webpackIgnore: true */ 'securenow/nextjs');
@@ -15,6 +34,10 @@ const INSTRUMENTATION = `export async function register() {
 }
 `;
 
+function isLegacyInstrumentation(content) {
+  return String(content || '').replace(/\r\n/g, '\n').trim() === LEGACY_INSTRUMENTATION.trim();
+}
+
 function detectProject(dir) {
   const pkgPath = path.join(dir, 'package.json');
   if (!fs.existsSync(pkgPath)) return { framework: 'unknown' };
@@ -78,6 +101,7 @@ async function init(_args, flags) {
   } else {
     initNode(project);
   }
+  checkPm2Ecosystem(dir);
 
   console.log('');
   ui.success('Setup complete.');
@@ -112,7 +136,10 @@ async function initNextJs(dir, project, flags) {
   const ext = useTs ? 'ts' : 'js';
 
   const existing = findInstrumentationFile(dir);
-  if (existing) {
+  if (existing && isLegacyInstrumentation(fs.readFileSync(existing, 'utf8'))) {
+    fs.writeFileSync(existing, INSTRUMENTATION, 'utf8');
+    ui.success(`Updated ${path.relative(dir, existing)}: standalone builds now include SecureNow's dependencies`);
+  } else if (existing) {
     ui.info(`instrumentation file already exists: ${path.relative(dir, existing)}`);
     printAgentPrompt('instrumentation', path.basename(existing), nextMajor(project), project);
   } else {
@@ -239,7 +266,7 @@ function printAgentPrompt(kind, filename, major, project) {
       ? `Use the project scripts for verification when appropriate: ${commands}. Ask before starting long-running dev/start servers, and ask which command to use if these scripts are not the right customer workflow.`
       : 'Ask the customer which command starts, builds, and tests this app because package.json does not expose an obvious script.',
     kind === 'instrumentation'
-      ? `Merge this into ${filename}: in register(), return unless process.env.NEXT_RUNTIME === "nodejs"; then dynamically import "securenow/nextjs" and "securenow/nextjs-auto-capture" with /* webpackIgnore: true */ so Next does not bundle OpenTelemetry internals. Preserve all existing instrumentation.`
+      ? `Merge this into ${filename}: inside register(), in an if (process.env.NEXT_RUNTIME === "nodejs") { ... } block, wrapped in try/catch so the app keeps running if SecureNow cannot start, dynamically import "securenow/nextjs" (call its registerSecureNow({ captureBody: true })) and then "securenow/nextjs-auto-capture". Do not add webpackIgnore comments and do not use an early return: keeping the imports inside the nodejs block lets Next.js drop them from the Edge build and trace securenow's dependencies into standalone output. Preserve all existing instrumentation.`
       : null,
     kind === 'next-config' && major >= 15
       ? `Update ${filename} while preserving existing config: add securenow to serverExternalPackages, e.g. serverExternalPackages: [...(existing || []), "securenow"], and include SecureNow runtime files for standalone output with outputFileTracingIncludes: { "/*": ["./node_modules/securenow/**/*"] }.`
@@ -267,6 +294,19 @@ function initNuxt(dir) {
   }
 }
 
+// In PM2 cluster mode Node resolves a bare `-r securenow/register` from the PM2 daemon's folder,
+// so workers started from elsewhere (pm2 resurrect at boot) crash with "Cannot find module".
+function checkPm2Ecosystem(dir) {
+  for (const name of ['ecosystem.config.cjs', 'ecosystem.config.js', 'ecosystem.config.mjs']) {
+    const file = path.join(dir, name);
+    if (!fs.existsSync(file)) continue;
+    const content = fs.readFileSync(file, 'utf8');
+    if (content.includes('securenow/register') && !/require\.resolve\(\s*['"]securenow\/register['"]\s*\)/.test(content)) {
+      ui.warn(`${name}: pass the preload as an absolute path, node_args: ['-r', require.resolve('securenow/register')]. A bare '-r securenow/register' is resolved from the PM2 daemon's folder in cluster mode, and the workers crash when the daemon starts elsewhere (pm2 resurrect at boot).`);
+    }
+  }
+}
+
 function initNode(project) {
   const scripts = project.pkg.scripts || {};
   const startScript = scripts.start || '';
@@ -293,4 +333,6 @@ function initNode(project) {
   }
 }
 
-module.exports = { init };
+module.exports = {
+  INSTRUMENTATION,
+  isLegacyInstrumentation, init };

package/cli/today.js

@@ -0,0 +1,176 @@
+'use strict';
+
+// The dashboard's one view in the terminal (GET /overview): is every app covered, what happened, what needs you,
+// the top attackers and what SecureNow did. `securenow attacker <ip>` explains one address
+// (GET /overview/attackers/:ip). The same words as the dashboard.
+const { api, requireAuth } = require('./client');
+const ui = require('./ui');
+
+const OUTCOMES = {
+  stopped: 'Stopped',
+  not_a_threat: 'Not a threat',
+  no_action: 'No action needed',
+  needs_you: 'Needs you',
+  being_checked: 'Being checked',
+  watching: 'Watching',
+};
+const LEVELS = { malicious: 'Malicious', blocked: 'Known attacker', suspicious: 'Suspicious', low: 'Low risk', unknown: 'Not scored', benign: 'Looks benign', insufficient_data: 'Not enough data', never_block: 'Never blocked' };
+const MODES = { blocking: 'Blocking', monitoring: 'Monitoring', off: 'Off' };
+
+function count(n) {
+  if (n === null || n === undefined) return '—';
+  return Number(n).toLocaleString('en-US');
+}
+
+function when(value) {
+  if (!value) return '';
+  const date = new Date(value);
+  const sameDay = date.toDateString() === new Date().toDateString();
+  return sameDay
+    ? date.toLocaleTimeString('en-GB', { hour: '2-digit', minute: '2-digit' })
+    : date.toLocaleString('en-GB', { month: 'short', day: 'numeric', hour: '2-digit', minute: '2-digit' });
+}
+
+function level(item) {
+  const label = LEVELS[item.level] || item.level || '';
+  const text = item.score !== null && item.score !== undefined ? `${label} ${Math.round(item.score)}` : label;
+  return item.level === 'malicious' || item.level === 'blocked' ? ui.c.red(text) : item.level === 'suspicious' ? ui.c.yellow(text) : ui.c.dim(text);
+}
+
+function hoursFrom(flags) {
+  const since = String(flags.since || '24h');
+  const match = since.match(/^(\d+)\s*([hd])$/i);
+  if (!match) return 24;
+  const hours = Number(match[1]) * (match[2].toLowerCase() === 'd' ? 24 : 1);
+  return Math.min(168, Math.max(1, hours));
+}
+
+async function today(args, flags) {
+  requireAuth();
+  const hours = hoursFrom(flags);
+  const s = ui.spinner('Reading what happened');
+  let data;
+  try {
+    data = await api.get('/overview', { query: { hours, attackers: flags.attackers || 8 } });
+    s.stop('SecureNow');
+  } catch (err) {
+    s.fail('Could not read the overview');
+    throw err;
+  }
+  if (flags.json) { ui.json(data); return; }
+
+  const totals = data.totals || {};
+  console.log('');
+  console.log(`  ${ui.c.bold(data.headline || '')}  ${ui.c.dim(data.agent?.label || '')}`);
+  console.log(`  ${ui.c.dim(`Last ${hours >= 48 ? `${Math.round(hours / 24)} days` : `${hours} hours`}:`)} ${count(totals.attackRequests)} attack requests · ${count(totals.attackers)} attackers · ${ui.c.green(`${count(totals.stopped)} stopped`)} · got through: ${totals.gotThrough === null || totals.gotThrough === undefined ? '—' : count(totals.gotThrough)}`);
+
+  console.log('');
+  const cards = data.needsYou || [];
+  console.log(`  ${ui.c.bold(`Needs you (${data.needsYouTotal || 0})`)}`);
+  if (cards.length === 0) console.log(`    ${ui.c.green('Nothing needs you.')} ${ui.c.dim(`SecureNow handled ${count(totals.handled)} things.`)}`);
+  for (const card of cards) {
+    console.log(`    ${ui.c.yellow('!')} ${card.title}`);
+    if (card.detail) console.log(`      ${ui.c.dim(card.detail)}`);
+  }
+
+  const attackers = data.attackers || [];
+  if (attackers.length) {
+    console.log('');
+    console.log(`  ${ui.c.bold('Top attackers')}`);
+    for (const item of attackers) {
+      const status = item.blockedUntil ? (item.blockedUntil === 'permanent' ? 'Blocked' : `Blocked until ${when(item.blockedUntil)}`) : OUTCOMES[item.outcome] || '';
+      console.log(`    ${item.ip.padEnd(16)} ${level(item)}  ${ui.c.dim([item.what, (item.apps || []).map((app) => app.name).join(', '), `${count(item.requests)} req`].filter(Boolean).join(' · '))}  ${status}`);
+    }
+    console.log(`    ${ui.c.dim('Why an address was flagged: securenow attacker <ip>')}`);
+  }
+
+  const activity = (data.activity || []).slice(0, 8);
+  if (activity.length) {
+    console.log('');
+    console.log(`  ${ui.c.bold('What SecureNow did')}`);
+    for (const item of activity) {
+      console.log(`    ${ui.c.dim(when(item.at).padEnd(13))} ${item.text}${item.by === 'agent' ? ui.c.dim(' (agent)') : ''}`);
+      if (item.note) console.log(`    ${' '.repeat(13)} ${ui.c.yellow(item.note)}`);
+    }
+  }
+
+  const apps = (data.apps || []).filter((app) => app.state === 'protected' || app.state === 'attention');
+  if (apps.length) {
+    console.log('');
+    console.log(`  ${ui.c.bold('Apps')}`);
+    for (const app of apps) {
+      const dot = app.state === 'attention' ? ui.c.yellow('●') : ui.c.green('●');
+      const issues = (app.issues || []).map((issue) => issue.text).join('; ');
+      console.log(`    ${dot} ${String(app.name).padEnd(30)} ${(MODES[app.mode] || app.mode).padEnd(11)} ${issues ? ui.c.yellow(issues) : ui.c.dim(`${count(app.stopped)} stopped`)}`);
+    }
+  }
+  console.log('');
+}
+
+async function attacker(args, flags) {
+  requireAuth();
+  const ip = String(args[0] || flags.ip || '').trim();
+  if (!ip) {
+    ui.error('Usage: securenow attacker <ip> [--json]');
+    process.exit(1);
+  }
+  const s = ui.spinner(`Reading ${ip}`);
+  let data;
+  try {
+    data = await api.get(`/overview/attackers/${encodeURIComponent(ip)}`);
+    s.stop(ip);
+  } catch (err) {
+    s.fail('Could not read this address');
+    throw err;
+  }
+  if (flags.json) { ui.json(data); return; }
+
+  const { verdict, reputation, state, summary } = data;
+  console.log('');
+  console.log(`  ${ui.c.bold(ip)}  ${level({ level: verdict.level, score: verdict.score })}  ${ui.c.dim([reputation?.country, reputation?.isp, reputation?.usageType].filter(Boolean).join(' · '))}`);
+  const blocked = state.blocked
+    ? ui.c.green(`Blocked ${state.blocks.map((block) => `on ${block.app?.name || 'every app'}${block.until ? ` until ${when(block.until)}` : ''}`).join(', ')}`)
+    : state.neverBlock ? 'Never blocked (trusted)' : 'Not blocked';
+  console.log(`  ${blocked}`);
+  console.log(`  ${ui.c.dim(`First seen ${when(summary.firstSeen) || '—'} · last seen ${when(summary.lastSeen) || '—'} · ${count(summary.alerts)} detection(s) · ${count(summary.stopped)} stopped by the firewall in 7 days`)}`);
+  if (summary.categories?.length) console.log(`  Tried: ${summary.categories.join(', ')}`);
+
+  console.log('');
+  console.log(`  ${ui.c.bold('Why')}${verdict.analyzedAt ? ui.c.dim(` (analyzed ${when(verdict.analyzedAt)})`) : ''}`);
+  const signals = [...(verdict.signals?.malicious || []).map((line) => ui.c.red(`+ ${line}`)), ...(verdict.signals?.benign || []).map((line) => ui.c.green(`- ${line}`))];
+  if (signals.length) for (const line of signals) console.log(`    ${line}`);
+  else console.log(`    ${ui.c.dim(`No analysis yet: securenow agent verify ${ip}`)}`);
+
+  if (data.traffic) {
+    console.log('');
+    console.log(`  ${ui.c.bold('Traffic, last 3 days')}  ${count(data.traffic.requests)} requests on ${data.traffic.activeDays} day(s)`);
+    for (const signal of data.traffic.signals) {
+      const value = signal.format === 'percent' ? (signal.value === null ? '—' : `${Math.round(signal.value * 1000) / 10}%`) : count(signal.value);
+      const normal = signal.normal !== null && signal.normal !== undefined ? ui.c.dim(` (normal ${Math.round(signal.normal * 1000) / 10}%)`) : '';
+      console.log(`    ${signal.label.padEnd(30)} ${signal.unusual ? ui.c.red(value) : value}${normal}${signal.unusual ? ui.c.red('  unusual') : ''}`);
+    }
+  }
+
+  if (data.alerts?.length) {
+    console.log('');
+    console.log(`  ${ui.c.bold('Detections')}`);
+    for (const alert of data.alerts.slice(0, 10)) {
+      console.log(`    ${ui.c.dim(when(alert.at).padEnd(13))} ${alert.title}  ${ui.c.dim([alert.app?.name, `${count(alert.requests)} req`].filter(Boolean).join(' · '))}  ${OUTCOMES[alert.outcome] || alert.status}`);
+    }
+  }
+
+  if (data.timeline?.length) {
+    console.log('');
+    console.log(`  ${ui.c.bold('Timeline')}`);
+    for (const event of data.timeline.slice(0, 12)) console.log(`    ${ui.c.dim(when(event.at).padEnd(13))} ${event.text}`);
+  }
+
+  if (data.questions?.length) {
+    console.log('');
+    console.log(`  ${ui.c.bold('Ask the forensics chat')}`);
+    for (const question of data.questions) console.log(`    ${ui.c.dim('securenow forensics chat')} "${question}"`);
+  }
+  console.log('');
+}
+
+module.exports = { today, attacker };

package/cli.js

@@ -152,13 +152,14 @@ const COMMANDS = {
     sub: {
       runtime: {
         desc: 'Write tokenless runtime credentials for production file-based deploys',
-        usage: 'securenow credentials runtime [--env production] [--out .securenow/credentials.production.json] [--stdout]',
+        usage: 'securenow credentials runtime [--env production] [--out .securenow/credentials.production.json] [--stdout] [--format env]',
         flags: {
           env: 'Deployment environment for this runtime file (default: production)',
           environment: 'Alias for --env',
           out: 'Output path (default: .securenow/credentials.<env>.json)',
           output: 'Alias for --out',
           stdout: 'Print JSON to stdout instead of writing a file',
+          format: 'env: print SECURENOW_CREDENTIALS=<base64> for hosts without file mounts (Vercel, Railway, Render, Heroku, Fly)',
         },
         run: (a, f) => require('./cli/credentials').runtime(a, f),
       },
@@ -457,6 +458,18 @@ const COMMANDS = {
     },
     defaultSub: 'status',
   },
+  today: {
+    desc: 'What happened, what SecureNow did and what needs you (the dashboard Overview)',
+    usage: 'securenow today [--since 24h|7d] [--attackers <n>] [--json]',
+    flags: { since: 'Look-back window, 1h to 7d (default 24h)', attackers: 'How many top attackers to list (default 8)', json: 'Output as JSON' },
+    run: (a, f) => require('./cli/today').today(a, f),
+  },
+  attacker: {
+    desc: 'Why SecureNow flagged an address: verdict, signals, traffic, detections, timeline, questions to ask',
+    usage: 'securenow attacker <ip> [--json]',
+    flags: { json: 'Output as JSON' },
+    run: (a, f) => require('./cli/today').attacker(a, f),
+  },
   protect: {
     desc: 'Starter protection per app: the rules every app gets, monitor or block mode',
     usage: 'securenow protect <status|enable|disable|block|monitor|learn> [--app <key>] [--json]',
@@ -911,7 +924,7 @@ function showHelp(commandName) {
     'Authentication': ['login', 'logout', 'whoami', 'credentials', 'admin', 'api-key'],
     'Applications': ['apps', 'app', 'init', 'status'],
     'Observe': ['traces', 'logs', 'analytics'],
-    'Detect & Respond': ['protect', 'agent', 'human', 'review', 'notifications', 'alerts', 'fp'],
+    'Detect & Respond': ['today', 'attacker', 'protect', 'agent', 'human', 'review', 'notifications', 'alerts', 'fp'],
     'Investigate': ['ip', 'forensics'],
     'Firewall': ['firewall'],
     'Remediation': ['automation', 'ratelimit', 'challenge', 'blocklist', 'revoke', 'allowlist', 'trusted'],

package/crash-capture.js

@@ -122,4 +122,16 @@ function installCrashCapture({ getLogger, flush, isSdkError, onSdkError, write }
   });
 }
 
-module.exports = { installCrashCapture, describeError, unhandledRejectionMode };
+// Force-flush the global tracer provider. A crash used to ship the FATAL log but drop every
+// span still waiting in the batch processor, which are usually the requests that led to it.
+function flushTracerProvider() {
+  try {
+    const { trace } = require('@opentelemetry/api');
+    const provider = trace.getTracerProvider();
+    const target = provider && typeof provider.getDelegate === 'function' ? provider.getDelegate() : provider;
+    if (target && typeof target.forceFlush === 'function') return Promise.resolve(target.forceFlush()).catch(() => {});
+  } catch (_) {}
+  return Promise.resolve();
+}
+
+module.exports = { installCrashCapture, describeError, unhandledRejectionMode, flushTracerProvider };

package/esm-detect.js

@@ -38,7 +38,11 @@ function nearestPackageJson(startDir) {
 
 /** @returns {{ esm: boolean, reason: string|null }} */
 function detectEsmApp({ argv = process.argv, cwd = process.cwd(), env = process.env } = {}) {
-  const entries = [argv && argv[1], env && env.pm_exec_path]
+  // A pm2 cluster worker only has pm2_env (JSON) at preload time, and its working directory is
+  // still the pm2 daemon's: take the app's folder and script from pm2 (see pm2-env.js).
+  const pm2 = require('./pm2-env').readPm2Env(env);
+  if (pm2 && pm2.cwd) cwd = pm2.cwd;
+  const entries = [argv && argv[1], pm2 && pm2.execPath]
     .filter((p) => typeof p === 'string' && p && !p.startsWith('-'))
     .map((p) => path.resolve(cwd, p));
 

package/fastify-hooks.js

@@ -0,0 +1,67 @@
+'use strict';
+
+/**
+ * Fastify route and error capture.
+ *
+ * The OpenTelemetry bundle dropped its Fastify instrumentation (moved to @fastify/otel), so a
+ * Fastify request span had no http.route and a failing handler left no exception event. Every
+ * Fastify instance (4.x and 5.x) is announced on the 'fastify.initialization' diagnostics
+ * channel; these hooks give it what the Express, Koa and Hapi instrumentations give theirs:
+ *  - http.route on the request's server span, and the "GET /users/:id" span name, through the
+ *    request's RPC metadata (the HTTP instrumentation reads it when the response finishes);
+ *  - the handler's error recorded as an exception event on that span.
+ */
+
+let installed = false;
+
+function routeOf(request) {
+  try {
+    return (request.routeOptions && request.routeOptions.url) || request.routerPath || null;
+  } catch (_) {
+    return null;
+  }
+}
+
+function onInstance(message) {
+  const fastify = message && message.fastify;
+  if (!fastify || typeof fastify.addHook !== 'function') return;
+  let api;
+  let core;
+  try {
+    api = require('@opentelemetry/api');
+    core = require('@opentelemetry/core');
+  } catch (_) {
+    return;
+  }
+
+  fastify.addHook('onRequest', function securenowRoute(request, reply, done) {
+    try {
+      const route = routeOf(request);
+      if (route) {
+        const meta = core.getRPCMetadata(api.context.active());
+        if (meta && meta.type === core.RPCType.HTTP) meta.route = route;
+        const span = api.trace.getActiveSpan();
+        if (span) span.setAttribute('http.route', route);
+      }
+    } catch (_) {}
+    done();
+  });
+
+  fastify.addHook('onError', function securenowError(request, reply, error, done) {
+    try {
+      const span = api.trace.getActiveSpan();
+      if (span && error) span.recordException(error);
+    } catch (_) {}
+    done();
+  });
+}
+
+function installFastifyHooks() {
+  if (installed) return;
+  installed = true;
+  try {
+    require('node:diagnostics_channel').subscribe('fastify.initialization', onInstance);
+  } catch (_) {}
+}
+
+module.exports = { installFastifyHooks, routeOf };

package/mcp/catalog.js

@@ -1315,6 +1315,34 @@ const TOOLS = [
       app: string('Optional application key; every app the caller can see when left out.'),
     }),
   },
+  {
+    name: 'securenow_overview',
+    title: 'Overview: What Happened and What Needs You',
+    description: 'The dashboard Overview for the last hours (default 24, at most 168, or since an ISO time). Whether each app is covered (data flowing, firewall on, detection monitoring or blocking, with what is missing); attack requests, attackers, requests the firewall stopped, and attacks that got through (whose impact check found possible or confirmed impact; null when none was checked), with attacks per hour; the decisions waiting for a person (block recommendations, coverage problems, apps ready to block, detection promotions); the top attackers (verdict, score, what they tried, apps, requests, whether blocked); and what SecureNow did (the agent\'s actions, automatic blocks, failed probes and rule-fix closes, learned exclusions).',
+    scope: 'notifications:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/overview',
+    queryFields: ['hours', 'since', 'attackers'],
+    inputSchema: objectSchema({
+      hours: number('Look-back window in hours (default 24).', { minimum: 1, maximum: 168 }),
+      since: string('Start of the window as an ISO time, at most 7 days ago; used instead of hours.'),
+      attackers: number('How many top attackers to list (default 8).', { minimum: 1, maximum: 200 }),
+    }),
+  },
+  {
+    name: 'securenow_attacker',
+    title: 'Attacker: Why an Address Was Flagged',
+    description: 'One address across the caller\'s apps: the verdict and risk score with the signals behind them (from the latest verification), reputation, whether it is blocked (where and until when) or never blocked, first and last seen, what it tried, the detections it triggered in 30 days with their outcomes, its block history, a timeline of its events, its traffic over the last 3 days against the apps\' normal (error rate, share of traffic, distinct paths, scanner-path requests, attack payloads answered 2xx), and suggested questions for the forensics chat.',
+    scope: 'notifications:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/overview/attackers/:ip',
+    pathParams: ['ip'],
+    inputSchema: objectSchema({
+      ip: string('IPv4 or IPv6 address.'),
+    }, ['ip']),
+  },
   {
     name: 'securenow_protection_enable',
     title: 'Turn Starter Protection On',

package/nextjs-auto-capture.d.ts

@@ -20,8 +20,11 @@
  * - config.capture.maxBodySize=10240 - Max body size in bytes (default: 10KB)
  * - config.capture.sensitiveFields=["field"] - Additional sensitive fields to redact
  *
- * The SDK reads these from .securenow/credentials.json in local development
- * and production. Legacy env vars are fallback-only for existing installs.
+ * The SDK reads these from .securenow/runtime.json (or SECURENOW_CREDENTIALS)
+ * in local development and production.
+ *
+ * Since 8.24.0 securenow/nextjs captures bodies at the HTTP layer; this module
+ * is the fallback for hosts where that layer does not see the request.
  * 
  * Features:
  * - Zero code changes required in API routes