securenow 8.22.0 → 8.24.0

package/nextjs-auto-capture.js

@@ -1,271 +1,129 @@
+'use strict';
+
 /**
- * SecureNow Next.js Automatic Body Capture
- * 
- * This module automatically patches Next.js request handling to capture bodies
- * WITHOUT requiring customers to wrap their handlers or change their code.
- * 
- * Usage in instrumentation.ts:
- * 
- * import { registerSecureNow } from 'securenow/nextjs';
- * import 'securenow/nextjs-auto-capture'; // Just import this line!
- * 
- * export function register() {
- *   registerSecureNow();
- * }
- * 
- * That's it! Bodies are now captured automatically.
+ * SecureNow Next.js body capture, fallback layer.
+ *
+ * registerSecureNow() (securenow/nextjs) captures request headers and bodies at the HTTP layer,
+ * on the request's server span, like every other SecureNow integration. This module covers hosts
+ * where that layer never sees the request: it records the body when a route handler calls
+ * request.text() or request.json(). Once the HTTP layer has captured a request in this process,
+ * it leaves bodies to it.
+ *
+ * The generated instrumentation file imports it; importing it is all it needs.
  */
 
-const { trace } = require('@opentelemetry/api');
 const appConfig = require('./app-config');
+const { DEFAULT_SENSITIVE_FIELDS, redactSensitiveData, redactBodyText } = require('./request-capture');
 
-const { OTP_SENSITIVE_FIELDS, matchesSensitiveField, redactOtpGraphQL, redactOtpQuery } = require('./otp-redaction');
-
-// Default sensitive fields to redact from request bodies.
-// OTP/code aliases use exact normalized matching; other fields are matched
-// substring-wise against lowercased keys (see redactSensitiveData),
-// so e.g. 'card' also catches 'creditCard' and 'account' also catches
-// 'accountNumber'. Over-redaction here is intentional: a falsely-redacted
-// telemetry value is always safer than a leaked secret. Entries are kept
-// specific enough to avoid nuking broad benign keys (e.g. we use
-// 'firstname'/'lastname'/'fullname', never bare 'name').
-const DEFAULT_SENSITIVE_FIELDS = [
-  ...OTP_SENSITIVE_FIELDS,
-  // credentials / auth
-  'password', 'passwd', 'pwd', 'secret', 'token', 'api_key', 'apikey',
-  'access_token', 'auth', 'authorization', 'bearer', 'credentials',
-  'mysql_pwd', 'otp', 'mfa', 'totp', 'sessionid', 'session_id',
-  'cookie', 'set-cookie',
-  // financial
-  'stripeToken', 'card', 'cardnumber', 'ccv', 'cvc', 'cvv',
-  'iban', 'account', 'accountnumber', 'routing', 'sortcode', 'taxid',
-  // PII
-  'ssn', 'pin', 'email', 'e_mail', 'phone', 'mobile', 'dob', 'birthdate',
-  'firstname', 'lastname', 'fullname', 'address', 'postcode', 'zip',
-  'passport', 'license',
-];
-
-// Conservative value-shape redactors. Key-name matching misses secrets that
-// land in free-form string values (GraphQL bodies, message fields, etc.), so
-// as a second layer we scrub string VALUES that *look like* a secret/PII.
-// These are intentionally precise/bounded so they don't garble normal prose,
-// and they only ever transform captured telemetry strings (read-only) — never
-// the actual request/response stream. Compiled once at module load.
-const VALUE_REDACTORS = [
-  // JWT: three base64url segments. Anchored to the eyJ header so it won't
-  // match arbitrary dotted tokens.
-  { name: 'jwt', re: /eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g },
-  // Bearer/Basic auth header value embedded in a body string.
-  { name: 'bearer', re: /\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi },
-  // Stripe-style / SecureNow live+test API keys.
-  { name: 'apikey', re: /\b(?:sk|pk|rk|snk)_(?:live|test)_[A-Za-z0-9]{8,}/g },
-  // Email addresses (bounded local/domain parts).
-  { name: 'email', re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,24}\b/g },
-  // Credit-card-like: 13–19 digit runs that pass a Luhn check, allowing
-  // space/dash grouping. Luhn-gated to avoid clobbering ordinary long numbers.
-  { name: 'card', re: /\b(?:\d[ -]?){13,19}\b/g, luhn: true },
-];
-
-// Skip the value-shape scan on very large strings to bound per-body cost.
-const MAX_VALUE_SCAN_LENGTH = 16384;
+const HTTP_CAPTURE_ACTIVE = Symbol.for('securenow.nextjs.httpCaptureActive');
+const PATCHED = Symbol.for('securenow.nextjs.autoCapturePatched');
 
-function luhnValid(digits) {
-  let sum = 0;
-  let alt = false;
-  for (let i = digits.length - 1; i >= 0; i--) {
-    let d = digits.charCodeAt(i) - 48;
-    if (d < 0 || d > 9) return false;
-    if (alt) { d *= 2; if (d > 9) d -= 9; }
-    sum += d;
-    alt = !alt;
+function activeSpan() {
+  try {
+    return require('@opentelemetry/api').trace.getActiveSpan() || null;
+  } catch (_) {
+    return null;
   }
-  return sum % 10 === 0;
 }
 
 /**
- * Redact obvious secret/PII shapes inside a captured string VALUE.
- * Returns the input unchanged when nothing matches (cheap common case).
+ * Check if body capture is enabled
  */
-function redactSensitiveValue(value) {
-  if (typeof value !== 'string' || value.length === 0) return value;
-  // Credential assignments in GraphQL/query strings need field-aware
-  // redaction even though a short numeric OTP has no unique value shape.
-  value = redactOtpQuery(redactOtpGraphQL(value));
-  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound shape scans
-  let out = value;
-  for (const r of VALUE_REDACTORS) {
-    r.re.lastIndex = 0;
-    if (r.luhn) {
-      out = out.replace(r.re, (m) => {
-        const digits = m.replace(/[ -]/g, '');
-        if (digits.length < 13 || digits.length > 19) return m;
-        return luhnValid(digits) ? '[REDACTED]' : m;
-      });
-    } else {
-      out = out.replace(r.re, '[REDACTED]');
-    }
-  }
-  return out;
+function isBodyCaptureEnabled() {
+  return appConfig.boolConfig('capture.body', true);
 }
 
-/**
- * Redact sensitive fields from an object
- */
-function redactSensitiveData(obj, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
-  if (!obj || typeof obj !== 'object') return obj;
-
-  const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
-
-  for (const key of Object.keys(redacted)) {
-
-    if (matchesSensitiveField(key, sensitiveFields)) {
-      redacted[key] = '[REDACTED]';
-    } else if (typeof redacted[key] === 'object' && redacted[key] !== null) {
-      redacted[key] = redactSensitiveData(redacted[key], sensitiveFields);
-    } else if (typeof redacted[key] === 'string') {
-      // Second layer: even if the key name looks benign, scrub values that
-      // *look like* a secret/PII (JWT, bearer token, API key, email, card).
-      redacted[key] = redactSensitiveValue(redacted[key]);
+// Attach the redacted body to the span right away, while the handler that is awaiting its body
+// still holds the span open. (Deferring this with setImmediate put it after the span had ended,
+// and an ended span drops new attributes, so no body was ever recorded.)
+function captureBodyText(span, bodyText, contentType) {
+  if (!span || typeof bodyText !== 'string') return;
+  try {
+    const maxBodySize = appConfig.numberConfig('capture.maxBodySize', 10240, 1024);
+    const sensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...appConfig.listConfig('capture.sensitiveFields')];
+    if (bodyText.length > maxBodySize) {
+      span.setAttribute('http.request.body', `[TOO LARGE: ${bodyText.length} bytes]`);
+      span.setAttribute('http.request.body.size', bodyText.length);
+      return;
     }
+    let redacted;
+    try {
+      redacted = redactBodyText(bodyText, contentType, sensitiveFields);
+    } catch (_) {
+      span.setAttribute('http.request.body', '[UNPARSEABLE - REDACTED FOR SAFETY]');
+      span.setAttribute('http.request.body.parse_error', true);
+      return;
+    }
+    if (!redacted) return;
+    span.setAttributes({
+      'http.request.body': redacted.body.substring(0, maxBodySize),
+      'http.request.body.type': redacted.type,
+      'http.request.body.size': bodyText.length,
+    });
+  } catch (_) {
+    // Never break the request.
   }
-
-  return redacted;
 }
 
 /**
- * Safe body capture that doesn't interfere with Next.js
+ * Capture from a Request whose body was already read through the patch, or can still be cloned.
  */
 async function safeBodyCapture(request, span) {
-  if (!span) return;
-  
+  if (!span || !request) return;
   try {
-    const contentType = request.headers.get('content-type') || '';
-    const maxBodySize = appConfig.numberConfig('capture.maxBodySize', 10240, 1024);
-    const customSensitiveFields = appConfig.listConfig('capture.sensitiveFields');
-    const allSensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...customSensitiveFields];
-    
-    // Only for supported types
-    if (!contentType.includes('application/json') && 
-        !contentType.includes('application/graphql') &&
-        !contentType.includes('application/x-www-form-urlencoded')) {
-      return;
-    }
-    
-    // Try to read from cache if available (Next.js may have already read it)
-    let bodyText;
-    
-    // Attempt 1: Check if body was already cached by Next.js
-    if (request._bodyText) {
-      bodyText = request._bodyText;
-    } else {
-      // Attempt 2: Try to clone and read
+    const contentType = (request.headers && typeof request.headers.get === 'function' && request.headers.get('content-type')) || '';
+    let bodyText = request._bodyText;
+    if (bodyText === undefined) {
       try {
-        const cloned = request.clone();
-        bodyText = await cloned.text();
-        // Cache it for Next.js
-        request._bodyText = bodyText;
-      } catch (e) {
-        // If clone fails, body was already consumed - skip silently
+        bodyText = await request.clone().text();
+      } catch (_) {
         return;
       }
     }
-    
-    if (bodyText.length > maxBodySize) {
-      span.setAttribute('http.request.body', `[TOO LARGE: ${bodyText.length} bytes]`);
-      return;
-    }
-    
-    // Parse and redact
-    if (contentType.includes('application/json') || contentType.includes('application/graphql')) {
-      try {
-        const parsed = JSON.parse(bodyText);
-        const redacted = redactSensitiveData(parsed, allSensitiveFields);
-        span.setAttributes({
-          'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
-          'http.request.body.type': contentType.includes('graphql') ? 'graphql' : 'json',
-          'http.request.body.size': bodyText.length,
-        });
-      } catch (e) {
-        // Parse error - skip
-      }
-    } else if (contentType.includes('application/x-www-form-urlencoded')) {
-      try {
-        const params = new URLSearchParams(bodyText);
-        const parsed = Object.fromEntries(params);
-        const redacted = redactSensitiveData(parsed, allSensitiveFields);
-        span.setAttributes({
-          'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
-          'http.request.body.type': 'form',
-          'http.request.body.size': bodyText.length,
-        });
-      } catch (e) {
-        // Parse error - skip
-      }
-    }
-  } catch (error) {
+    captureBodyText(span, bodyText, contentType);
+  } catch (_) {
     // Silently fail - never break the request
   }
 }
 
 /**
- * Check if body capture is enabled
- */
-function isBodyCaptureEnabled() {
-  return appConfig.boolConfig('capture.body', true);
-}
-
-/**
- * Patch Next.js Request to cache body text
- * This allows us to read the body without consuming it
+ * Patch Request.text()/json() so the body a route handler reads is recorded on its span.
  */
 function patchNextRequest() {
-  if (typeof Request === 'undefined') return;
-  
+  if (typeof Request === 'undefined' || Request.prototype[PATCHED]) return;
+
   const originalText = Request.prototype.text;
-  const originalJson = Request.prototype.json;
-  
-  // Patch text() to cache result
-  Request.prototype.text = async function() {
+
+  Request.prototype.text = async function securenowText() {
     if (this._bodyText !== undefined) {
       return this._bodyText;
     }
+    const span = activeSpan();
     const text = await originalText.call(this);
     this._bodyText = text;
-    
-    // Capture for tracing if enabled
-    if (isBodyCaptureEnabled() && ['POST', 'PUT', 'PATCH'].includes(this.method)) {
-      const span = trace.getActiveSpan();
-      if (span) {
-        // Schedule capture after this call (non-blocking)
-        setImmediate(() => {
-          safeBodyCapture(this, span).catch(() => {});
-        });
-      }
+
+    if (!globalThis[HTTP_CAPTURE_ACTIVE] && isBodyCaptureEnabled() && ['POST', 'PUT', 'PATCH'].includes(this.method)) {
+      const contentType = (this.headers && typeof this.headers.get === 'function' && this.headers.get('content-type')) || '';
+      captureBodyText(span, text, contentType);
     }
-    
+
     return text;
   };
-  
-  // Patch json() to cache and capture
-  Request.prototype.json = async function() {
-    // First get text
-    const text = await this.text();
-    // Then parse
-    return JSON.parse(text);
+
+  Request.prototype.json = async function securenowJson() {
+    return JSON.parse(await this.text());
   };
-  
-  console.log('[securenow] ✅ Auto-capture: Patched Next.js Request for automatic body capture');
+
+  Object.defineProperty(Request.prototype, PATCHED, { value: true });
+  console.log('[securenow] Next.js body capture fallback installed (request.text() / request.json())');
 }
 
 // Auto-patch when module is imported
 if (isBodyCaptureEnabled()) {
   try {
     patchNextRequest();
-    console.log('[securenow] 📝 Automatic body capture: ENABLED');
-    console.log('[securenow] 💡 No code changes needed - bodies captured automatically!');
   } catch (error) {
-    console.warn('[securenow] ⚠️  Auto-capture patch failed:', error.message);
-    console.warn('[securenow] 💡 Body capture disabled. Use manual approach if needed.');
+    console.warn('[securenow] Next.js body capture fallback not installed:', error && error.message);
   }
 } else {
   console.log('[securenow] Automatic body capture: DISABLED (config.capture.body=false)');
@@ -277,4 +135,3 @@ module.exports = {
   redactSensitiveData,
   isBodyCaptureEnabled,
 };
-

package/nextjs.js

@@ -7,24 +7,32 @@
  * 
  * 1. Add securenow to serverExternalPackages and standalone output tracing
  *    includes in next.config.js:
- * 
+ *
  *    const nextConfig = {
  *      serverExternalPackages: ["securenow"],
  *      outputFileTracingIncludes: {
  *        "/*": ["<securenow package glob>"],
  *      },
  *    };
- * 
- * 2. Create instrumentation.ts (or .js) in your project root:
- * 
+ *
+ * 2. Create instrumentation.ts (or .js) in your project root (`npx securenow init` writes it):
+ *
  *    export async function register() {
- *      if (process.env.NEXT_RUNTIME !== "nodejs") return;
- *      const securenowNext = await import(/* webpackIgnore: true *\/ "securenow/nextjs");
- *      const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
- *      registerSecureNow({ captureBody: true });
- *      await import(/* webpackIgnore: true *\/ "securenow/nextjs-auto-capture");
+ *      if (process.env.NEXT_RUNTIME === "nodejs") {
+ *        try {
+ *          const securenowNext = await import("securenow/nextjs");
+ *          const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
+ *          registerSecureNow({ captureBody: true });
+ *          await import("securenow/nextjs-auto-capture");
+ *        } catch (error) {
+ *          console.error("[securenow] SecureNow did not start; the app is running without it:", error);
+ *        }
+ *      }
  *    }
- * 
+ *
+ *    The import stays inside the nodejs block, without webpackIgnore, so Next.js leaves it out
+ *    of the Edge build and traces securenow and its dependencies into standalone output.
+ *
  * 3. Run `npx securenow login` and `npx securenow init`.
  *    The SDK reads app identity, collector, firewall, capture, and
  *    deploymentEnvironment from .securenow/credentials.json.
@@ -34,7 +42,6 @@ const { randomUUID } = require('crypto');
 const { nodeSdkDefaultTelemetryOptions } = require('./otel-defaults');
 const appConfig = require('./app-config');
 const { resolveClientIpWithDetails } = require('./resolve-ip');
-const otelResources = require('@opentelemetry/resources');
 
 const nodeSdkTelemetryOptions = nodeSdkDefaultTelemetryOptions();
 
@@ -50,6 +57,10 @@ function requireNodeBuiltin(name) {
 }
 
 function createResource(attributes) {
+  // Required here, not at the top of the file: a bundle that lacks the OpenTelemetry packages
+  // (an incomplete standalone image) must still load this module, so the firewall starts and
+  // the app keeps serving.
+  const otelResources = require('@opentelemetry/resources');
   if (typeof otelResources.resourceFromAttributes === 'function') {
     return otelResources.resourceFromAttributes(attributes);
   }
@@ -59,158 +70,12 @@ function createResource(attributes) {
   throw new Error('Unsupported @opentelemetry/resources version');
 }
 
-const { OTP_SENSITIVE_FIELDS, isOtpCodeField, matchesSensitiveField, redactOtpGraphQL, redactOtpQuery, withOtpRedactionExporter } = require('./otp-redaction');
-
-// Default sensitive fields to redact from request bodies.
-// OTP/code aliases use exact normalized matching; other fields are matched
-// substring-wise against lowercased keys (see redactSensitiveData),
-// so e.g. 'card' also catches 'creditCard' and 'account' also catches
-// 'accountNumber'. Over-redaction here is intentional: a falsely-redacted
-// telemetry value is always safer than a leaked secret. Entries are kept
-// specific enough to avoid nuking broad benign keys (e.g. we use
-// 'firstname'/'lastname'/'fullname', never bare 'name').
-const DEFAULT_SENSITIVE_FIELDS = [
-  ...OTP_SENSITIVE_FIELDS,
-  // credentials / auth
-  'password', 'passwd', 'pwd', 'secret', 'token', 'api_key', 'apikey',
-  'access_token', 'auth', 'authorization', 'bearer', 'credentials',
-  'mysql_pwd', 'otp', 'mfa', 'totp', 'sessionid', 'session_id',
-  'cookie', 'set-cookie',
-  // financial
-  'stripeToken', 'card', 'cardnumber', 'ccv', 'cvc', 'cvv',
-  'iban', 'account', 'accountnumber', 'routing', 'sortcode', 'taxid',
-  // PII
-  'ssn', 'pin', 'email', 'e_mail', 'phone', 'mobile', 'dob', 'birthdate',
-  'firstname', 'lastname', 'fullname', 'address', 'postcode', 'zip',
-  'passport', 'license',
-];
-
-// Conservative value-shape redactors. Key-name matching misses secrets that
-// land in free-form string values (GraphQL bodies, message fields, etc.), so
-// as a second layer we scrub string VALUES that *look like* a secret/PII.
-// These are intentionally precise/bounded so they don't garble normal prose,
-// and they only ever transform captured telemetry strings (read-only) — never
-// the actual request/response stream. Compiled once at module load.
-const VALUE_REDACTORS = [
-  // JWT: three base64url segments. Anchored to the eyJ header so it won't
-  // match arbitrary dotted tokens.
-  { name: 'jwt', re: /eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g },
-  // Bearer/Basic auth header value embedded in a body string.
-  { name: 'bearer', re: /\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi },
-  // Stripe-style / SecureNow live+test API keys.
-  { name: 'apikey', re: /\b(?:sk|pk|rk|snk)_(?:live|test)_[A-Za-z0-9]{8,}/g },
-  // Email addresses (bounded local/domain parts).
-  { name: 'email', re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,24}\b/g },
-  // Credit-card-like: 13–19 digit runs that pass a Luhn check, allowing
-  // space/dash grouping. Luhn-gated to avoid clobbering ordinary long numbers.
-  { name: 'card', re: /\b(?:\d[ -]?){13,19}\b/g, luhn: true },
-];
-
-// Skip the value-shape scan on very large strings to bound per-body cost.
-const MAX_VALUE_SCAN_LENGTH = 16384;
-
-function luhnValid(digits) {
-  let sum = 0;
-  let alt = false;
-  for (let i = digits.length - 1; i >= 0; i--) {
-    let d = digits.charCodeAt(i) - 48;
-    if (d < 0 || d > 9) return false;
-    if (alt) { d *= 2; if (d > 9) d -= 9; }
-    sum += d;
-    alt = !alt;
-  }
-  return sum % 10 === 0;
-}
+const { redactOtpQuery, withOtpRedactionExporter } = require('./otp-redaction');
+const { createRequestCapture } = require('./request-capture');
 
-/**
- * Redact obvious secret/PII shapes inside a captured string VALUE.
- * Returns the input unchanged when nothing matches (cheap common case).
- */
-function redactSensitiveValue(value) {
-  if (typeof value !== 'string' || value.length === 0) return value;
-  // Credential assignments in GraphQL/query strings need field-aware
-  // redaction even though a short numeric OTP has no unique value shape.
-  value = redactOtpQuery(redactOtpGraphQL(value));
-  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound shape scans
-  let out = value;
-  for (const r of VALUE_REDACTORS) {
-    r.re.lastIndex = 0;
-    if (r.luhn) {
-      out = out.replace(r.re, (m) => {
-        const digits = m.replace(/[ -]/g, '');
-        if (digits.length < 13 || digits.length > 19) return m;
-        return luhnValid(digits) ? '[REDACTED]' : m;
-      });
-    } else {
-      out = out.replace(r.re, '[REDACTED]');
-    }
-  }
-  return out;
-}
-
-/**
- * Redact sensitive fields from an object
- */
-function redactSensitiveData(obj, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
-  if (!obj || typeof obj !== 'object') return obj;
-
-  const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
-
-  for (const key of Object.keys(redacted)) {
-
-    if (matchesSensitiveField(key, sensitiveFields)) {
-      redacted[key] = '[REDACTED]';
-    } else if (typeof redacted[key] === 'object' && redacted[key] !== null) {
-      // Recursively redact nested objects
-      redacted[key] = redactSensitiveData(redacted[key], sensitiveFields);
-    } else if (typeof redacted[key] === 'string') {
-      // Second layer: even if the key name looks benign, scrub values that
-      // *look like* a secret/PII (JWT, bearer token, API key, email, card).
-      redacted[key] = redactSensitiveValue(redacted[key]);
-    }
-  }
-
-  return redacted;
-}
-
-function escapeRegex(str) {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-
-/**
- * Redact sensitive data from GraphQL query strings
- */
-function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
-  if (!query || typeof query !== 'string') return query;
-  
-  let redacted = query;
-  
-  // Redact sensitive fields in GraphQL arguments and variables
-  // Matches patterns like: password: "value" or password:"value" or password:'value'
-  sensitiveFields.filter(field => field === 'otp' || !isOtpCodeField(field)).forEach(field => {
-    const escaped = escapeRegex(field);
-    const patterns = [
-      new RegExp(`(${escaped}\\s*:\\s*["'])([^"']+)(["'])`, 'gi'),
-      new RegExp(`(${escaped}\\s*:\\s*)([^\\s,})\n]+)`, 'gi'),
-    ];
-    
-    patterns.forEach(pattern => {
-      redacted = redacted.replace(pattern, (match, prefix, value, suffix) => {
-        if (suffix) {
-          return `${prefix}[REDACTED]${suffix}`;
-        } else {
-          return `${prefix}[REDACTED]`;
-        }
-      });
-    });
-  });
-
-  // Second layer: scrub secret/PII *shapes* anywhere in the (free-form) query
-  // body — catches values the key-name pass above can't see.
-  redacted = redactOtpGraphQL(redactSensitiveValue(redacted));
-
-  return redacted;
-}
+// Set once the HTTP layer has captured a request in this process: nextjs-auto-capture then
+// leaves bodies to it instead of attaching a second copy to Next.js's own span.
+const HTTP_CAPTURE_ACTIVE = Symbol.for('securenow.nextjs.httpCaptureActive');
 
 /**
  * Register SecureNow OpenTelemetry for Next.js using @vercel/otel
@@ -280,10 +145,13 @@ function registerSecureNow(options = {}) {
 
     // -------- Body Capture Configuration --------
     // Opt-out default: set config.capture.body=false (or options.captureBody=false) to disable.
-    const captureBody = options.captureBody ?? appConfig.boolConfig('capture.body', true);
-    const maxBodySize = appConfig.numberConfig('capture.maxBodySize', 10240, 1024);
-    const customSensitiveFields = appConfig.listConfig('capture.sensitiveFields');
-    const allSensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...customSensitiveFields];
+    const requestCapture = createRequestCapture({
+      captureBody: options.captureBody ?? appConfig.boolConfig('capture.body', true),
+      captureMultipart: appConfig.boolConfig('capture.multipart', true),
+      maxBodySize: appConfig.numberConfig('capture.maxBodySize', 10240, 1024),
+      customSensitiveFields: appConfig.listConfig('capture.sensitiveFields'),
+    });
+    const { captureBody } = requestCapture;
 
     // -------- Log environment detection --------
     if (!isVercel) {
@@ -432,11 +300,13 @@ function registerSecureNow(options = {}) {
             );
           }
 
-          // -------- Request Body NOT captured at HTTP instrumentation level --------
-          // IMPORTANT: Do NOT attempt to read request.body or listen to 'data' events
-          // Next.js manages request streams internally and reading them here causes conflicts
-          // Body capture must be done in Next.js middleware using request.clone()
-          
+          // Headers (redacted) and body, the same attributes as every other SecureNow integration.
+          // The body is observed through the request's own emit('data') while Next.js reads it:
+          // no listener is added and nothing is read on Next.js's behalf.
+          requestCapture.captureHeaders(span, request);
+          requestCapture.observeBody(span, request);
+          globalThis[HTTP_CAPTURE_ACTIVE] = true;
+
         } catch (error) {
           // Silently fail to not break the request
           if (otelLogLevel === 'debug') {
@@ -519,7 +389,10 @@ function registerSecureNow(options = {}) {
     let _crashLoggerProvider = null;
     require('./crash-capture').installCrashCapture({
       getLogger: () => (_crashLoggerProvider ? _crashLoggerProvider.getLogger('securenow.crash', '1.0.0') : null),
-      flush: () => (_crashLoggerProvider ? _crashLoggerProvider.forceFlush() : undefined),
+      flush: () => Promise.all([
+        _crashLoggerProvider ? _crashLoggerProvider.forceFlush() : undefined,
+        require('./crash-capture').flushTracerProvider(),
+      ]),
       isSdkError: (e) => _isOtlpTransientError(e) && (_looksLikeOtlpStack(e) || _looksLikeConfiguredOtlpEndpoint(e)),
       onSdkError: _reportSuppressedOtlpError,
     });
@@ -708,10 +581,7 @@ function registerSecureNow(options = {}) {
     console.log('[securenow]    - Geographic data (Vercel/Cloudflare)');
     console.log('[securenow]    - Request IDs, CSRF tokens, Auth presence');
     console.log('[securenow]    - Response status, content-type, content-length');
-    console.log('[securenow] Body capture DISABLED at HTTP instrumentation level (prevents Next.js conflicts)');
-    if (captureBody) {
-      console.log('[securenow] For body capture in Next.js, use: import "securenow/nextjs-auto-capture"');
-    }
+    console.log('[securenow]    - Request headers (redacted)%s', captureBody ? ' and JSON/form/GraphQL bodies (redacted)' : '');
 
     // Optional test span
     if (appConfig.boolConfig('runtime.testSpan', false)) {