securenow 8.23.0 → 8.25.0

package/nextjs-auto-capture.js

@@ -1,271 +1,129 @@
+'use strict';
+
 /**
- * SecureNow Next.js Automatic Body Capture
- * 
- * This module automatically patches Next.js request handling to capture bodies
- * WITHOUT requiring customers to wrap their handlers or change their code.
- * 
- * Usage in instrumentation.ts:
- * 
- * import { registerSecureNow } from 'securenow/nextjs';
- * import 'securenow/nextjs-auto-capture'; // Just import this line!
- * 
- * export function register() {
- *   registerSecureNow();
- * }
- * 
- * That's it! Bodies are now captured automatically.
+ * SecureNow Next.js body capture, fallback layer.
+ *
+ * registerSecureNow() (securenow/nextjs) captures request headers and bodies at the HTTP layer,
+ * on the request's server span, like every other SecureNow integration. This module covers hosts
+ * where that layer never sees the request: it records the body when a route handler calls
+ * request.text() or request.json(). Once the HTTP layer has captured a request in this process,
+ * it leaves bodies to it.
+ *
+ * The generated instrumentation file imports it; importing it is all it needs.
  */
 
-const { trace } = require('@opentelemetry/api');
 const appConfig = require('./app-config');
+const { DEFAULT_SENSITIVE_FIELDS, redactSensitiveData, redactBodyText } = require('./request-capture');
 
-const { OTP_SENSITIVE_FIELDS, matchesSensitiveField, redactOtpGraphQL, redactOtpQuery } = require('./otp-redaction');
-
-// Default sensitive fields to redact from request bodies.
-// OTP/code aliases use exact normalized matching; other fields are matched
-// substring-wise against lowercased keys (see redactSensitiveData),
-// so e.g. 'card' also catches 'creditCard' and 'account' also catches
-// 'accountNumber'. Over-redaction here is intentional: a falsely-redacted
-// telemetry value is always safer than a leaked secret. Entries are kept
-// specific enough to avoid nuking broad benign keys (e.g. we use
-// 'firstname'/'lastname'/'fullname', never bare 'name').
-const DEFAULT_SENSITIVE_FIELDS = [
-  ...OTP_SENSITIVE_FIELDS,
-  // credentials / auth
-  'password', 'passwd', 'pwd', 'secret', 'token', 'api_key', 'apikey',
-  'access_token', 'auth', 'authorization', 'bearer', 'credentials',
-  'mysql_pwd', 'otp', 'mfa', 'totp', 'sessionid', 'session_id',
-  'cookie', 'set-cookie',
-  // financial
-  'stripeToken', 'card', 'cardnumber', 'ccv', 'cvc', 'cvv',
-  'iban', 'account', 'accountnumber', 'routing', 'sortcode', 'taxid',
-  // PII
-  'ssn', 'pin', 'email', 'e_mail', 'phone', 'mobile', 'dob', 'birthdate',
-  'firstname', 'lastname', 'fullname', 'address', 'postcode', 'zip',
-  'passport', 'license',
-];
-
-// Conservative value-shape redactors. Key-name matching misses secrets that
-// land in free-form string values (GraphQL bodies, message fields, etc.), so
-// as a second layer we scrub string VALUES that *look like* a secret/PII.
-// These are intentionally precise/bounded so they don't garble normal prose,
-// and they only ever transform captured telemetry strings (read-only) — never
-// the actual request/response stream. Compiled once at module load.
-const VALUE_REDACTORS = [
-  // JWT: three base64url segments. Anchored to the eyJ header so it won't
-  // match arbitrary dotted tokens.
-  { name: 'jwt', re: /eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g },
-  // Bearer/Basic auth header value embedded in a body string.
-  { name: 'bearer', re: /\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi },
-  // Stripe-style / SecureNow live+test API keys.
-  { name: 'apikey', re: /\b(?:sk|pk|rk|snk)_(?:live|test)_[A-Za-z0-9]{8,}/g },
-  // Email addresses (bounded local/domain parts).
-  { name: 'email', re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,24}\b/g },
-  // Credit-card-like: 13–19 digit runs that pass a Luhn check, allowing
-  // space/dash grouping. Luhn-gated to avoid clobbering ordinary long numbers.
-  { name: 'card', re: /\b(?:\d[ -]?){13,19}\b/g, luhn: true },
-];
-
-// Skip the value-shape scan on very large strings to bound per-body cost.
-const MAX_VALUE_SCAN_LENGTH = 16384;
+const HTTP_CAPTURE_ACTIVE = Symbol.for('securenow.nextjs.httpCaptureActive');
+const PATCHED = Symbol.for('securenow.nextjs.autoCapturePatched');
 
-function luhnValid(digits) {
-  let sum = 0;
-  let alt = false;
-  for (let i = digits.length - 1; i >= 0; i--) {
-    let d = digits.charCodeAt(i) - 48;
-    if (d < 0 || d > 9) return false;
-    if (alt) { d *= 2; if (d > 9) d -= 9; }
-    sum += d;
-    alt = !alt;
+function activeSpan() {
+  try {
+    return require('@opentelemetry/api').trace.getActiveSpan() || null;
+  } catch (_) {
+    return null;
   }
-  return sum % 10 === 0;
 }
 
 /**
- * Redact obvious secret/PII shapes inside a captured string VALUE.
- * Returns the input unchanged when nothing matches (cheap common case).
+ * Check if body capture is enabled
  */
-function redactSensitiveValue(value) {
-  if (typeof value !== 'string' || value.length === 0) return value;
-  // Credential assignments in GraphQL/query strings need field-aware
-  // redaction even though a short numeric OTP has no unique value shape.
-  value = redactOtpQuery(redactOtpGraphQL(value));
-  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound shape scans
-  let out = value;
-  for (const r of VALUE_REDACTORS) {
-    r.re.lastIndex = 0;
-    if (r.luhn) {
-      out = out.replace(r.re, (m) => {
-        const digits = m.replace(/[ -]/g, '');
-        if (digits.length < 13 || digits.length > 19) return m;
-        return luhnValid(digits) ? '[REDACTED]' : m;
-      });
-    } else {
-      out = out.replace(r.re, '[REDACTED]');
-    }
-  }
-  return out;
+function isBodyCaptureEnabled() {
+  return appConfig.boolConfig('capture.body', true);
 }
 
-/**
- * Redact sensitive fields from an object
- */
-function redactSensitiveData(obj, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
-  if (!obj || typeof obj !== 'object') return obj;
-
-  const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
-
-  for (const key of Object.keys(redacted)) {
-
-    if (matchesSensitiveField(key, sensitiveFields)) {
-      redacted[key] = '[REDACTED]';
-    } else if (typeof redacted[key] === 'object' && redacted[key] !== null) {
-      redacted[key] = redactSensitiveData(redacted[key], sensitiveFields);
-    } else if (typeof redacted[key] === 'string') {
-      // Second layer: even if the key name looks benign, scrub values that
-      // *look like* a secret/PII (JWT, bearer token, API key, email, card).
-      redacted[key] = redactSensitiveValue(redacted[key]);
+// Attach the redacted body to the span right away, while the handler that is awaiting its body
+// still holds the span open. (Deferring this with setImmediate put it after the span had ended,
+// and an ended span drops new attributes, so no body was ever recorded.)
+function captureBodyText(span, bodyText, contentType) {
+  if (!span || typeof bodyText !== 'string') return;
+  try {
+    const maxBodySize = appConfig.numberConfig('capture.maxBodySize', 10240, 1024);
+    const sensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...appConfig.listConfig('capture.sensitiveFields')];
+    if (bodyText.length > maxBodySize) {
+      span.setAttribute('http.request.body', `[TOO LARGE: ${bodyText.length} bytes]`);
+      span.setAttribute('http.request.body.size', bodyText.length);
+      return;
     }
+    let redacted;
+    try {
+      redacted = redactBodyText(bodyText, contentType, sensitiveFields);
+    } catch (_) {
+      span.setAttribute('http.request.body', '[UNPARSEABLE - REDACTED FOR SAFETY]');
+      span.setAttribute('http.request.body.parse_error', true);
+      return;
+    }
+    if (!redacted) return;
+    span.setAttributes({
+      'http.request.body': redacted.body.substring(0, maxBodySize),
+      'http.request.body.type': redacted.type,
+      'http.request.body.size': bodyText.length,
+    });
+  } catch (_) {
+    // Never break the request.
   }
-
-  return redacted;
 }
 
 /**
- * Safe body capture that doesn't interfere with Next.js
+ * Capture from a Request whose body was already read through the patch, or can still be cloned.
  */
 async function safeBodyCapture(request, span) {
-  if (!span) return;
-  
+  if (!span || !request) return;
   try {
-    const contentType = request.headers.get('content-type') || '';
-    const maxBodySize = appConfig.numberConfig('capture.maxBodySize', 10240, 1024);
-    const customSensitiveFields = appConfig.listConfig('capture.sensitiveFields');
-    const allSensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...customSensitiveFields];
-    
-    // Only for supported types
-    if (!contentType.includes('application/json') && 
-        !contentType.includes('application/graphql') &&
-        !contentType.includes('application/x-www-form-urlencoded')) {
-      return;
-    }
-    
-    // Try to read from cache if available (Next.js may have already read it)
-    let bodyText;
-    
-    // Attempt 1: Check if body was already cached by Next.js
-    if (request._bodyText) {
-      bodyText = request._bodyText;
-    } else {
-      // Attempt 2: Try to clone and read
+    const contentType = (request.headers && typeof request.headers.get === 'function' && request.headers.get('content-type')) || '';
+    let bodyText = request._bodyText;
+    if (bodyText === undefined) {
       try {
-        const cloned = request.clone();
-        bodyText = await cloned.text();
-        // Cache it for Next.js
-        request._bodyText = bodyText;
-      } catch (e) {
-        // If clone fails, body was already consumed - skip silently
+        bodyText = await request.clone().text();
+      } catch (_) {
         return;
       }
     }
-    
-    if (bodyText.length > maxBodySize) {
-      span.setAttribute('http.request.body', `[TOO LARGE: ${bodyText.length} bytes]`);
-      return;
-    }
-    
-    // Parse and redact
-    if (contentType.includes('application/json') || contentType.includes('application/graphql')) {
-      try {
-        const parsed = JSON.parse(bodyText);
-        const redacted = redactSensitiveData(parsed, allSensitiveFields);
-        span.setAttributes({
-          'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
-          'http.request.body.type': contentType.includes('graphql') ? 'graphql' : 'json',
-          'http.request.body.size': bodyText.length,
-        });
-      } catch (e) {
-        // Parse error - skip
-      }
-    } else if (contentType.includes('application/x-www-form-urlencoded')) {
-      try {
-        const params = new URLSearchParams(bodyText);
-        const parsed = Object.fromEntries(params);
-        const redacted = redactSensitiveData(parsed, allSensitiveFields);
-        span.setAttributes({
-          'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
-          'http.request.body.type': 'form',
-          'http.request.body.size': bodyText.length,
-        });
-      } catch (e) {
-        // Parse error - skip
-      }
-    }
-  } catch (error) {
+    captureBodyText(span, bodyText, contentType);
+  } catch (_) {
     // Silently fail - never break the request
   }
 }
 
 /**
- * Check if body capture is enabled
- */
-function isBodyCaptureEnabled() {
-  return appConfig.boolConfig('capture.body', true);
-}
-
-/**
- * Patch Next.js Request to cache body text
- * This allows us to read the body without consuming it
+ * Patch Request.text()/json() so the body a route handler reads is recorded on its span.
  */
 function patchNextRequest() {
-  if (typeof Request === 'undefined') return;
-  
+  if (typeof Request === 'undefined' || Request.prototype[PATCHED]) return;
+
   const originalText = Request.prototype.text;
-  const originalJson = Request.prototype.json;
-  
-  // Patch text() to cache result
-  Request.prototype.text = async function() {
+
+  Request.prototype.text = async function securenowText() {
     if (this._bodyText !== undefined) {
       return this._bodyText;
     }
+    const span = activeSpan();
     const text = await originalText.call(this);
     this._bodyText = text;
-    
-    // Capture for tracing if enabled
-    if (isBodyCaptureEnabled() && ['POST', 'PUT', 'PATCH'].includes(this.method)) {
-      const span = trace.getActiveSpan();
-      if (span) {
-        // Schedule capture after this call (non-blocking)
-        setImmediate(() => {
-          safeBodyCapture(this, span).catch(() => {});
-        });
-      }
+
+    if (!globalThis[HTTP_CAPTURE_ACTIVE] && isBodyCaptureEnabled() && ['POST', 'PUT', 'PATCH'].includes(this.method)) {
+      const contentType = (this.headers && typeof this.headers.get === 'function' && this.headers.get('content-type')) || '';
+      captureBodyText(span, text, contentType);
     }
-    
+
     return text;
   };
-  
-  // Patch json() to cache and capture
-  Request.prototype.json = async function() {
-    // First get text
-    const text = await this.text();
-    // Then parse
-    return JSON.parse(text);
+
+  Request.prototype.json = async function securenowJson() {
+    return JSON.parse(await this.text());
   };
-  
-  console.log('[securenow] ✅ Auto-capture: Patched Next.js Request for automatic body capture');
+
+  Object.defineProperty(Request.prototype, PATCHED, { value: true });
+  console.log('[securenow] Next.js body capture fallback installed (request.text() / request.json())');
 }
 
 // Auto-patch when module is imported
 if (isBodyCaptureEnabled()) {
   try {
     patchNextRequest();
-    console.log('[securenow] 📝 Automatic body capture: ENABLED');
-    console.log('[securenow] 💡 No code changes needed - bodies captured automatically!');
   } catch (error) {
-    console.warn('[securenow] ⚠️  Auto-capture patch failed:', error.message);
-    console.warn('[securenow] 💡 Body capture disabled. Use manual approach if needed.');
+    console.warn('[securenow] Next.js body capture fallback not installed:', error && error.message);
   }
 } else {
   console.log('[securenow] Automatic body capture: DISABLED (config.capture.body=false)');
@@ -277,4 +135,3 @@ module.exports = {
   redactSensitiveData,
   isBodyCaptureEnabled,
 };
-

package/nextjs-middleware.js

@@ -51,18 +51,21 @@ const DEFAULT_SENSITIVE_FIELDS = [
 // and they only ever transform captured telemetry strings (read-only) — never
 // the actual request/response stream. Compiled once at module load.
 const VALUE_REDACTORS = [
+  // The JWT and email patterns only start where a run of their characters starts (the
+  // lookbehind), so a long run that holds no match is scanned once, not once per position:
+  // a crafted 10KB value costs microseconds, not 50ms+ of event loop.
   // JWT: three base64url segments. Anchored to the eyJ header so it won't
   // match arbitrary dotted tokens.
-  { name: 'jwt', re: /eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g },
+  { name: 'jwt', hint: 'eyJ', re: /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g },
   // Bearer/Basic auth header value embedded in a body string.
   { name: 'bearer', re: /\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi },
   // Stripe-style / SecureNow live+test API keys.
   { name: 'apikey', re: /\b(?:sk|pk|rk|snk)_(?:live|test)_[A-Za-z0-9]{8,}/g },
-  // Email addresses (bounded local/domain parts).
-  { name: 'email', re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,24}\b/g },
+  // Email addresses (bounded local/domain parts: 64 and 253 characters at most).
+  { name: 'email', hint: '@', re: /(?<![\w.%+-])[\w.%+-]{1,64}@[A-Za-z0-9.-]{1,253}\.[A-Za-z]{2,24}\b/g },
   // Credit-card-like: 13–19 digit runs that pass a Luhn check, allowing
   // space/dash grouping. Luhn-gated to avoid clobbering ordinary long numbers.
-  { name: 'card', re: /\b(?:\d[ -]?){13,19}\b/g, luhn: true },
+  { name: 'card', re: /\b(?:\d[ -]?){12,18}\d\b/g, luhn: true },
 ];
 
 // Skip the value-shape scan on very large strings to bound per-body cost.
@@ -93,6 +96,7 @@ function redactSensitiveValue(value) {
   if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound shape scans
   let out = value;
   for (const r of VALUE_REDACTORS) {
+    if (r.hint && !out.includes(r.hint)) continue;
     r.re.lastIndex = 0;
     if (r.luhn) {
       out = out.replace(r.re, (m) => {

package/nextjs-wrapper.js

@@ -51,18 +51,21 @@ const DEFAULT_SENSITIVE_FIELDS = [
 // and they only ever transform captured telemetry strings (read-only) — never
 // the actual request/response stream. Compiled once at module load.
 const VALUE_REDACTORS = [
+  // The JWT and email patterns only start where a run of their characters starts (the
+  // lookbehind), so a long run that holds no match is scanned once, not once per position:
+  // a crafted 10KB value costs microseconds, not 50ms+ of event loop.
   // JWT: three base64url segments. Anchored to the eyJ header so it won't
   // match arbitrary dotted tokens.
-  { name: 'jwt', re: /eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g },
+  { name: 'jwt', hint: 'eyJ', re: /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g },
   // Bearer/Basic auth header value embedded in a body string.
   { name: 'bearer', re: /\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi },
   // Stripe-style / SecureNow live+test API keys.
   { name: 'apikey', re: /\b(?:sk|pk|rk|snk)_(?:live|test)_[A-Za-z0-9]{8,}/g },
-  // Email addresses (bounded local/domain parts).
-  { name: 'email', re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,24}\b/g },
+  // Email addresses (bounded local/domain parts: 64 and 253 characters at most).
+  { name: 'email', hint: '@', re: /(?<![\w.%+-])[\w.%+-]{1,64}@[A-Za-z0-9.-]{1,253}\.[A-Za-z]{2,24}\b/g },
   // Credit-card-like: 13–19 digit runs that pass a Luhn check, allowing
   // space/dash grouping. Luhn-gated to avoid clobbering ordinary long numbers.
-  { name: 'card', re: /\b(?:\d[ -]?){13,19}\b/g, luhn: true },
+  { name: 'card', re: /\b(?:\d[ -]?){12,18}\d\b/g, luhn: true },
 ];
 
 // Skip the value-shape scan on very large strings to bound per-body cost.
@@ -93,6 +96,7 @@ function redactSensitiveValue(value) {
   if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound shape scans
   let out = value;
   for (const r of VALUE_REDACTORS) {
+    if (r.hint && !out.includes(r.hint)) continue;
     r.re.lastIndex = 0;
     if (r.luhn) {
       out = out.replace(r.re, (m) => {

package/nextjs.d.ts

@@ -1,102 +1,70 @@
 /**
  * SecureNow Next.js Integration TypeScript Declarations
+ *
+ * Settings live in .securenow/runtime.json (or SECURENOW_CREDENTIALS on hosts without file
+ * mounts); the options below only override them.
  */
 
 export interface RegisterOptions {
   /**
-   * Service name for OpenTelemetry traces
-   * @default .securenow/credentials.json app.key/app.name
+   * Service name for OpenTelemetry traces.
+   * Leave unset: SecureNow routes telemetry by the app key, and another name hides the data
+   * from the app's dashboard. Only for a self-hosted collector.
+   * @default the app key from .securenow/runtime.json
    */
   serviceName?: string;
 
   /**
-   * OTLP endpoint for traces
+   * Advanced OTLP endpoint override, for a self-hosted collector. Leave unset for SecureNow.
    * @default https://ingest.securenow.ai
-   *
-   * Advanced OTLP endpoint override. Normal SecureNow apps should leave this
-   * unset so the ingest gateway can route by app.key to the dashboard-selected
-   * instance.
    */
   endpoint?: string;
 
   /**
    * Deployment environment sent as OpenTelemetry deployment.environment.
-   * @default .securenow/credentials.json config.runtime.deploymentEnvironment
+   * @default config.runtime.deploymentEnvironment from .securenow/runtime.json
    */
   environment?: string;
 
   /**
-   * Don't append UUID to service name
-   * @default false
+   * Don't append a UUID to the service name.
+   * @default true when an app key is configured
    */
   noUuid?: boolean;
 
-   /**
-   * Enable request body capture
-   * @default true from .securenow/credentials.json secure defaults
+  /**
+   * Capture request bodies (redacted, size-capped, multipart as metadata only).
+   * @default config.capture.body from .securenow/runtime.json (true)
    */
   captureBody?: boolean;
 }
 
 /**
- * Register SecureNow OpenTelemetry instrumentation for Next.js
- * 
- * @param options - Optional configuration options
- * 
- * @example
- * ```typescript
- * // instrumentation.ts
- * import { createRequire } from 'node:module';
- * 
- * const require = createRequire(import.meta.url);
+ * Register SecureNow (tracing, logs, body capture, firewall, sessions) for the Next.js Node.js runtime.
+ * `npx securenow init` writes this file for you.
+ *
+ * @param options - Optional overrides
  *
- * export async function register() {
- *   if (process.env.NEXT_RUNTIME !== 'nodejs') return;
- *   const { registerSecureNow } = require('securenow/nextjs');
- *   registerSecureNow({ captureBody: true });
- *   require('securenow/nextjs-auto-capture');
- * }
- * ```
- * 
  * @example
  * ```typescript
- * // With custom options
- * import { registerSecureNow } from 'securenow/nextjs';
- * 
- * export function register() {
- *   registerSecureNow({
- *     serviceName: 'my-nextjs-app',
- *     endpoint: 'http://your-otlp-backend.example.com:4318',
- *     noUuid: true,
- *   });
+ * // instrumentation.ts (what `npx securenow init` writes)
+ * export async function register() {
+ *   if (process.env.NEXT_RUNTIME === 'nodejs') {
+ *     try {
+ *       const securenowNext = await import('securenow/nextjs');
+ *       const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
+ *       registerSecureNow({ captureBody: true });
+ *       await import('securenow/nextjs-auto-capture');
+ *     } catch (error) {
+ *       console.error('[securenow] SecureNow did not start; the app is running without it:', error);
+ *     }
+ *   }
  * }
  * ```
+ *
+ * next.config: `serverExternalPackages: ['securenow']` and
+ * `outputFileTracingIncludes: { '/*': ['./node_modules/securenow/**\/*'] }` (Next.js 15+);
+ * Next.js 14 uses `experimental.instrumentationHook`, `experimental.serverComponentsExternalPackages`
+ * and `experimental.outputFileTracingIncludes`.
  */
 export function registerSecureNow(options?: RegisterOptions): void;
-
-/**
- * Default sensitive fields that are automatically redacted from traces
- */
-export const DEFAULT_SENSITIVE_FIELDS: readonly string[];
-
-/**
- * Redact sensitive fields from an object
- * @param obj - Object to redact
- * @param sensitiveFields - Array of field names to redact (case-insensitive substring match)
- * @returns Redacted copy of the object
- */
-export function redactSensitiveData<T = any>(
-  obj: T,
-  sensitiveFields?: string[]
-): T;
-
-/**
- * Redact sensitive data from GraphQL query strings
- * @param query - GraphQL query string
- * @param sensitiveFields - Array of field names to redact
- * @returns Redacted query string
- */
-export function redactGraphQLQuery(
-  query: string,
-  sensitiveFields?: string[]
-): string;