securenow 8.24.0 → 8.25.0

package/log-redaction.js

@@ -0,0 +1,135 @@
+'use strict';
+
+/**
+ * Exported log lines are redacted before they leave the process (the terminal still shows them as
+ * written). Two passes:
+ * - Credential fields, by exact name (case and separators ignored): in objects passed to console.*
+ *   (redactLogArgs, before formatting) and in JSON or key=value text inside the line. password,
+ *   token, apiKey, authorization, cookie, OTP codes, card numbers... `code` only when it holds a
+ *   4-8 digit OTP, so error codes stay readable.
+ * - Secret shapes anywhere in the line, as for captured request bodies: JWTs, Bearer/Basic
+ *   credentials, sk_/pk_/rk_/snk_ keys, card numbers (Luhn-checked), emails.
+ * The second pass runs as the first log processor, so console.*, getLogger().emit() and crash logs
+ * are all covered. Attributes set on getLogger().emit() are exported as set.
+ *
+ * config.logging.redact: false exports lines unchanged.
+ */
+
+// Lines longer than this skip the shape scan (the credential and OTP assignment scans still run).
+const MAX_LOG_SCAN_LENGTH = 262144;
+
+const CREDENTIAL_KEYS = new Set([
+  'password', 'passwd', 'pwd', 'passphrase', 'secret', 'clientsecret', 'privatekey',
+  'token', 'accesstoken', 'refreshtoken', 'idtoken', 'sessiontoken', 'authtoken', 'bearer',
+  'apikey', 'xapikey', 'authorization', 'cookie', 'setcookie', 'sessionid',
+  'otp', 'otpcode', 'onetimecode', 'onetimepassword', 'passcode', 'verificationcode',
+  'confirmationcode', 'mfacode', 'totpcode', '2facode', 'smscode', 'emailcode', 'logincode',
+  'securitycode', 'recoverycode', 'backupcode',
+  'cardnumber', 'cvv', 'cvc', 'ccv', 'ssn', 'pin',
+]);
+const canonical = (key) => String(key).replace(/[^a-z0-9]/gi, '').toLowerCase();
+const OTP_DIGITS = /^\d{4,8}$/;
+
+function isCredentialKey(key, value) {
+  const name = canonical(key);
+  if (CREDENTIAL_KEYS.has(name)) return true;
+  return name === 'code' && OTP_DIGITS.test(String(value));
+}
+
+let _enabled;
+function redactionEnabled() {
+  if (_enabled === undefined) {
+    try { _enabled = require('./app-config').boolConfig('logging.redact', true); } catch (_) { _enabled = true; }
+  }
+  return _enabled;
+}
+
+const MAX_DEPTH = 8;
+const MAX_NODES = 2000;
+
+function isPlainObject(v) {
+  if (!v || typeof v !== 'object') return false;
+  const proto = Object.getPrototypeOf(v);
+  return proto === Object.prototype || proto === null;
+}
+
+// Copies plain objects and arrays with credential values replaced. Class instances (Date, Map,
+// Buffer, Error...) are kept as they are; cycles stay cycles; work is bounded.
+function redactValue(value, state, depth) {
+  if (!(isPlainObject(value) || Array.isArray(value))) return value;
+  if (state.seen.has(value)) return state.seen.get(value);
+  if (depth > MAX_DEPTH || state.nodes > MAX_NODES) return value;
+  state.nodes += 1;
+  const out = Array.isArray(value) ? [] : {};
+  state.seen.set(value, out);
+  for (const key of Object.keys(value)) {
+    const v = value[key];
+    out[key] = !Array.isArray(value) && isCredentialKey(key, v) && v !== null && v !== undefined && v !== ''
+      ? '[REDACTED]'
+      : redactValue(v, state, depth + 1);
+  }
+  return out;
+}
+
+/** console.* arguments with credential fields redacted in objects (unchanged when redaction is off). */
+function redactLogArgs(args) {
+  if (!Array.isArray(args) || !redactionEnabled()) return args;
+  let changed = false;
+  const state = { seen: new Map(), nodes: 0 };
+  const out = args.map((a) => {
+    const r = redactValue(a, state, 0);
+    if (r !== a) changed = true;
+    return r;
+  });
+  return changed ? out : args;
+}
+
+// "password": "x" (JSON) and password=x (key=value) in the text. Starts only at a quote or at the
+// beginning of a word, so matching stays linear.
+const JSON_FIELD = /"([A-Za-z0-9_-]{1,40})"(\s*:\s*)"((?:[^"\\]|\\.)*)"/g;
+const KV_FIELD = /(^|[\s,;&?{(])([A-Za-z0-9_-]{1,40})=([^\s&,;)}]+)/g;
+
+function redactCredentialText(text) {
+  if (text.indexOf('"') !== -1) {
+    text = text.replace(JSON_FIELD, (m, key, sep, value) => (isCredentialKey(key, value) && value ? `"${key}"${sep}"[REDACTED]"` : m));
+  }
+  if (text.indexOf('=') !== -1) {
+    text = text.replace(KV_FIELD, (m, lead, key, value) => (isCredentialKey(key, value) ? `${lead}${key}=[REDACTED]` : m));
+  }
+  return text;
+}
+
+function redactLogText(body) {
+  const { redactSensitiveValue } = require('./request-capture');
+  return redactSensitiveValue(redactCredentialText(body), MAX_LOG_SCAN_LENGTH);
+}
+
+function createRedactingLogProcessor() {
+  return {
+    onEmit(record) {
+      try {
+        const body = record && record.body;
+        if (typeof body !== 'string' || !body) return;
+        const out = redactLogText(body);
+        if (out !== body) record.setBody(out);
+      } catch (_) { /* never break logging */ }
+    },
+    forceFlush() { return Promise.resolve(); },
+    shutdown() { return Promise.resolve(); },
+  };
+}
+
+// The processors a LoggerProvider gets: the redactor (unless config.logging.redact is false),
+// then the exporting processor.
+function logProcessors(appConfig, exportingProcessor) {
+  const redact = appConfig.boolConfig('logging.redact', true);
+  return redact ? [createRedactingLogProcessor(), exportingProcessor] : [exportingProcessor];
+}
+
+module.exports = {
+  createRedactingLogProcessor,
+  logProcessors,
+  redactLogArgs,
+  redactLogText,
+  MAX_LOG_SCAN_LENGTH,
+};

package/mcp/catalog.js

@@ -46,21 +46,26 @@ Runbook:
    - Confirm the runtime file has an app key/name/instance and a runtime API key after app selection. The app key only routes telemetry; the runtime API key is required to authenticate telemetry ingestion and firewall sync.
    - Confirm .securenow/admin.json exists only when admin CLI/MCP auth is needed.
    - Confirm .securenow/admin.json, .securenow/runtime.json, legacy .securenow/credentials.json, and any .securenow/credentials.*.json runtime files are ignored by git, without ignoring the entire .securenow/ directory.
-6. Run npx securenow init. If it fails with ui.header is not a function or another CLI bug, upgrade to securenow@latest, verify >=8.0.0, and retry. Do not silently ignore init failures.
-7. Configure the least invasive framework-specific integration:
-   - Next.js: preserve instrumentation.js/ts. Register securenow/nextjs only when NEXT_RUNTIME is nodejs. In ESM files, use createRequire before require("securenow/nextjs"). Include require("securenow/nextjs-auto-capture") for body capture. For Next 15+, add securenow to serverExternalPackages. For older Next.js, use experimental.serverComponentsExternalPackages. Preserve proxy.js/middleware.js.
-   - Nuxt/Nitro: use the documented securenow/nuxt module or Nitro server plugin.
-   - Express/Fastify/NestJS/Koa/Hapi/Hono/raw Node: preload securenow/register through existing scripts, NODE_OPTIONS, PM2 node_args, Docker CMD, or the process manager already used.
-   - Firewall-only: preload securenow/firewall-only or use the documented securenow run --firewall-only command. Do not add OTel/tracing/logging in this mode.
-   - Vite/browser-only: use only documented browser integration and state that server firewall protection requires a server runtime.
+6. Run npx securenow init. It detects the framework, writes the Next.js instrumentation file and next.config changes, prints the start-script change for plain Node, gitignores the credential files, and warns about a PM2 ecosystem file that uses a bare -r. If it fails, upgrade to securenow@latest and retry. Do not silently ignore init failures.
+7. Configure the least invasive framework-specific integration (help: npx securenow help init; full guide: node_modules/securenow/SKILL-API.md):
+   - Plain Node servers (Express, Fastify, NestJS, Koa, Hapi, Hono with @hono/node-server, Polka, Feathers, h3, raw node:http): preload securenow/register in the existing start command: node -r securenow/register <entry>. The same flag works for CommonJS, ESM and TypeScript (node -r securenow/register --import tsx src/index.ts). Alternatives: NODE_OPTIONS="-r securenow/register", npx securenow run <entry>, or require('securenow/register') as the first line of a CommonJS entry.
+   - PM2: node_args: ['-r', require.resolve('securenow/register')] in ecosystem.config.cjs (fork or cluster). Never a bare '-r securenow/register' in PM2: cluster workers resolve it from the daemon's folder and crash-loop.
+   - Docker: CMD ["node", "-r", "securenow/register", "<entry>"] with WORKDIR set to the app folder.
+   - Next.js 15 and 16: keep the instrumentation file npx securenow init writes (it imports securenow/nextjs and securenow/nextjs-auto-capture inside if (process.env.NEXT_RUNTIME === 'nodejs') with a try/catch) and its next.config changes: serverExternalPackages: ['securenow'] plus outputFileTracingIncludes: { '/*': ['./node_modules/securenow/**/*'] }. Next.js 14: experimental.instrumentationHook, experimental.serverComponentsExternalPackages and experimental.outputFileTracingIncludes instead. Works with next start and output: 'standalone' (put .securenow/credentials.json next to the standalone server.js). Preserve existing instrumentation, proxy.js and middleware.js code. The Edge runtime is not instrumented.
+   - Nuxt 3/4: modules: ['securenow/nuxt'] in nuxt.config, no securenow options block (settings live in .securenow/runtime.json). Alternative: node -r securenow/register .output/server/index.mjs.
+   - Vite: browser telemetry is not sent to SecureNow. Instrument the Node process that serves the app: node -r securenow/register-vite node_modules/vite/bin/vite.js preview, or -r securenow/register for a Vite SSR server. Say that the firewall only protects a server runtime.
+   - Bun 1.3: bun --preload securenow/register <entry> for apps served through node:http. Bun.serve, Deno, Cloudflare Workers and other edge runtimes are not supported.
+   - Firewall-only: node -r securenow/firewall-only <entry>, or npx securenow run --firewall-only <entry>. Do not add OTel, tracing or logging in this mode.
+   - App-level features, when the app has authentication: send auth events with track() from securenow/events (auth.login.failure, auth.login.success, auth.otp.verify.failure, auth.password_reset.requested, ...) at the real login/OTP/reset code paths, and enable session revocation with "sessions": { "guard": true, "capture": true } under config in .securenow/runtime.json (add the app's session cookie names to sessions.cookieNames if they are not the defaults). Ask before changing auth code.
 8. Do not create or require a .env file for local development or production. The SDK reads defaults from .securenow/runtime.json, with legacy .securenow/credentials.json and generated runtime credential files still supported:
    - config.logging.enabled: true
    - config.capture.body: true
    - config.capture.multipart: true
-   - config.firewall.enabled: true
    - config.firewall.failMode: "open"
    - config.capture.maxBodySize: 10240
-   For production, run npx securenow credentials runtime --env production, store the resulting JSON as a deployment secret file, and mount/copy it to <app-root>/.securenow/credentials.json or <app-root>/.securenow/credentials.production.json. Do not recommend env vars unless the user explicitly asks for legacy fallbacks.
+   - config.logging.redact: true (credential fields and secret shapes in exported log lines become [REDACTED])
+   Firewall enforcement is the per-app toggle in SecureNow (npx securenow firewall enable --app <appKey>), not a local setting.
+   For production, run npx securenow credentials runtime --env production, store the resulting JSON as a deployment secret file, and mount/copy it to <app-root>/.securenow/credentials.json or <app-root>/.securenow/credentials.production.json. Hosts that cannot mount a file (Vercel, Railway, Render, Heroku, Fly): npx securenow credentials runtime --env production --format env prints SECURENOW_CREDENTIALS=<base64>; store it as a secret environment variable. No other SECURENOW_* variable is read (SECURENOW_DISABLED=1 turns the SDK off, for tests). Vercel, AWS Lambda and other serverless platforms are not tested end to end: say so, and do not promise firewall blocking there.
    Do not proceed with telemetry verification if the runtime API key is missing; run npx securenow app connect or npx securenow api-key create first. The v8 ingestion gateway rejects app-key-only telemetry.
    Local credentials should use config.runtime.deploymentEnvironment="local". Production runtime credentials should use "production". The app key stays the same; traces, logs, firewall status, forensics, and CLI/MCP queries are scoped by environment.
 9. Verify firewall and threshold:

package/next-route.js

@@ -0,0 +1,61 @@
+'use strict';
+
+/**
+ * http.route on the HTTP-layer span of a Next.js request.
+ *
+ * Next.js records the route on its own spans (next.route, often several levels below the request's HTTP
+ * span); detection and the dashboard read the HTTP span, which had none on Next.js 15 (16 sets http.route
+ * on its own span only). This span processor copies the first route Next.js reports in a trace onto that
+ * trace's HTTP server span, which is still open because Next.js finishes its spans before the response ends.
+ */
+
+const HTTP_SCOPE = '@opentelemetry/instrumentation-http';
+const SERVER = 1; // SpanKind.SERVER
+const MAX_OPEN = 10000;
+
+function scopeName(span) {
+  const scope = span && (span.instrumentationScope || span.instrumentationLibrary);
+  return scope && scope.name;
+}
+
+function createNextRouteProcessor() {
+  const open = new Map(); // traceId -> { span, routed }
+
+  return {
+    onStart(span) {
+      try {
+        if (span.kind !== SERVER || scopeName(span) !== HTTP_SCOPE) return;
+        const { traceId } = span.spanContext();
+        if (open.has(traceId)) return;
+        if (open.size >= MAX_OPEN) open.clear();
+        open.set(traceId, { span, spanId: span.spanContext().spanId, routed: false });
+      } catch (_) {}
+    },
+    onEnd(span) {
+      try {
+        const { traceId, spanId } = span.spanContext();
+        const entry = open.get(traceId);
+        if (!entry) return;
+        if (entry.spanId === spanId) {
+          open.delete(traceId);
+          return;
+        }
+        const route = span.attributes && span.attributes['next.route'];
+        // Next.js also reports module paths here ("\hello\route" on Windows): only URL routes count.
+        if (!entry.routed && typeof route === 'string' && route.startsWith('/')) {
+          entry.span.setAttribute('http.route', route);
+          entry.routed = true;
+        }
+      } catch (_) {}
+    },
+    forceFlush() {
+      return Promise.resolve();
+    },
+    shutdown() {
+      open.clear();
+      return Promise.resolve();
+    },
+  };
+}
+
+module.exports = { createNextRouteProcessor };

package/nextjs-middleware.js

@@ -51,18 +51,21 @@ const DEFAULT_SENSITIVE_FIELDS = [
 // and they only ever transform captured telemetry strings (read-only) — never
 // the actual request/response stream. Compiled once at module load.
 const VALUE_REDACTORS = [
+  // The JWT and email patterns only start where a run of their characters starts (the
+  // lookbehind), so a long run that holds no match is scanned once, not once per position:
+  // a crafted 10KB value costs microseconds, not 50ms+ of event loop.
   // JWT: three base64url segments. Anchored to the eyJ header so it won't
   // match arbitrary dotted tokens.
-  { name: 'jwt', re: /eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g },
+  { name: 'jwt', hint: 'eyJ', re: /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g },
   // Bearer/Basic auth header value embedded in a body string.
   { name: 'bearer', re: /\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi },
   // Stripe-style / SecureNow live+test API keys.
   { name: 'apikey', re: /\b(?:sk|pk|rk|snk)_(?:live|test)_[A-Za-z0-9]{8,}/g },
-  // Email addresses (bounded local/domain parts).
-  { name: 'email', re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,24}\b/g },
+  // Email addresses (bounded local/domain parts: 64 and 253 characters at most).
+  { name: 'email', hint: '@', re: /(?<![\w.%+-])[\w.%+-]{1,64}@[A-Za-z0-9.-]{1,253}\.[A-Za-z]{2,24}\b/g },
   // Credit-card-like: 13–19 digit runs that pass a Luhn check, allowing
   // space/dash grouping. Luhn-gated to avoid clobbering ordinary long numbers.
-  { name: 'card', re: /\b(?:\d[ -]?){13,19}\b/g, luhn: true },
+  { name: 'card', re: /\b(?:\d[ -]?){12,18}\d\b/g, luhn: true },
 ];
 
 // Skip the value-shape scan on very large strings to bound per-body cost.
@@ -93,6 +96,7 @@ function redactSensitiveValue(value) {
   if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound shape scans
   let out = value;
   for (const r of VALUE_REDACTORS) {
+    if (r.hint && !out.includes(r.hint)) continue;
     r.re.lastIndex = 0;
     if (r.luhn) {
       out = out.replace(r.re, (m) => {

package/nextjs-wrapper.js

@@ -51,18 +51,21 @@ const DEFAULT_SENSITIVE_FIELDS = [
 // and they only ever transform captured telemetry strings (read-only) — never
 // the actual request/response stream. Compiled once at module load.
 const VALUE_REDACTORS = [
+  // The JWT and email patterns only start where a run of their characters starts (the
+  // lookbehind), so a long run that holds no match is scanned once, not once per position:
+  // a crafted 10KB value costs microseconds, not 50ms+ of event loop.
   // JWT: three base64url segments. Anchored to the eyJ header so it won't
   // match arbitrary dotted tokens.
-  { name: 'jwt', re: /eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g },
+  { name: 'jwt', hint: 'eyJ', re: /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g },
   // Bearer/Basic auth header value embedded in a body string.
   { name: 'bearer', re: /\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi },
   // Stripe-style / SecureNow live+test API keys.
   { name: 'apikey', re: /\b(?:sk|pk|rk|snk)_(?:live|test)_[A-Za-z0-9]{8,}/g },
-  // Email addresses (bounded local/domain parts).
-  { name: 'email', re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,24}\b/g },
+  // Email addresses (bounded local/domain parts: 64 and 253 characters at most).
+  { name: 'email', hint: '@', re: /(?<![\w.%+-])[\w.%+-]{1,64}@[A-Za-z0-9.-]{1,253}\.[A-Za-z]{2,24}\b/g },
   // Credit-card-like: 13–19 digit runs that pass a Luhn check, allowing
   // space/dash grouping. Luhn-gated to avoid clobbering ordinary long numbers.
-  { name: 'card', re: /\b(?:\d[ -]?){13,19}\b/g, luhn: true },
+  { name: 'card', re: /\b(?:\d[ -]?){12,18}\d\b/g, luhn: true },
 ];
 
 // Skip the value-shape scan on very large strings to bound per-body cost.
@@ -93,6 +96,7 @@ function redactSensitiveValue(value) {
   if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound shape scans
   let out = value;
   for (const r of VALUE_REDACTORS) {
+    if (r.hint && !out.includes(r.hint)) continue;
     r.re.lastIndex = 0;
     if (r.luhn) {
       out = out.replace(r.re, (m) => {

package/nextjs.d.ts

@@ -1,102 +1,70 @@
 /**
  * SecureNow Next.js Integration TypeScript Declarations
+ *
+ * Settings live in .securenow/runtime.json (or SECURENOW_CREDENTIALS on hosts without file
+ * mounts); the options below only override them.
  */
 
 export interface RegisterOptions {
   /**
-   * Service name for OpenTelemetry traces
-   * @default .securenow/credentials.json app.key/app.name
+   * Service name for OpenTelemetry traces.
+   * Leave unset: SecureNow routes telemetry by the app key, and another name hides the data
+   * from the app's dashboard. Only for a self-hosted collector.
+   * @default the app key from .securenow/runtime.json
    */
   serviceName?: string;
 
   /**
-   * OTLP endpoint for traces
+   * Advanced OTLP endpoint override, for a self-hosted collector. Leave unset for SecureNow.
    * @default https://ingest.securenow.ai
-   *
-   * Advanced OTLP endpoint override. Normal SecureNow apps should leave this
-   * unset so the ingest gateway can route by app.key to the dashboard-selected
-   * instance.
    */
   endpoint?: string;
 
   /**
    * Deployment environment sent as OpenTelemetry deployment.environment.
-   * @default .securenow/credentials.json config.runtime.deploymentEnvironment
+   * @default config.runtime.deploymentEnvironment from .securenow/runtime.json
    */
   environment?: string;
 
   /**
-   * Don't append UUID to service name
-   * @default false
+   * Don't append a UUID to the service name.
+   * @default true when an app key is configured
    */
   noUuid?: boolean;
 
-   /**
-   * Enable request body capture
-   * @default true from .securenow/credentials.json secure defaults
+  /**
+   * Capture request bodies (redacted, size-capped, multipart as metadata only).
+   * @default config.capture.body from .securenow/runtime.json (true)
    */
   captureBody?: boolean;
 }
 
 /**
- * Register SecureNow OpenTelemetry instrumentation for Next.js
- * 
- * @param options - Optional configuration options
- * 
- * @example
- * ```typescript
- * // instrumentation.ts
- * import { createRequire } from 'node:module';
- * 
- * const require = createRequire(import.meta.url);
+ * Register SecureNow (tracing, logs, body capture, firewall, sessions) for the Next.js Node.js runtime.
+ * `npx securenow init` writes this file for you.
+ *
+ * @param options - Optional overrides
  *
- * export async function register() {
- *   if (process.env.NEXT_RUNTIME !== 'nodejs') return;
- *   const { registerSecureNow } = require('securenow/nextjs');
- *   registerSecureNow({ captureBody: true });
- *   require('securenow/nextjs-auto-capture');
- * }
- * ```
- * 
  * @example
  * ```typescript
- * // With custom options
- * import { registerSecureNow } from 'securenow/nextjs';
- * 
- * export function register() {
- *   registerSecureNow({
- *     serviceName: 'my-nextjs-app',
- *     endpoint: 'http://your-otlp-backend.example.com:4318',
- *     noUuid: true,
- *   });
+ * // instrumentation.ts (what `npx securenow init` writes)
+ * export async function register() {
+ *   if (process.env.NEXT_RUNTIME === 'nodejs') {
+ *     try {
+ *       const securenowNext = await import('securenow/nextjs');
+ *       const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
+ *       registerSecureNow({ captureBody: true });
+ *       await import('securenow/nextjs-auto-capture');
+ *     } catch (error) {
+ *       console.error('[securenow] SecureNow did not start; the app is running without it:', error);
+ *     }
+ *   }
  * }
  * ```
+ *
+ * next.config: `serverExternalPackages: ['securenow']` and
+ * `outputFileTracingIncludes: { '/*': ['./node_modules/securenow/**\/*'] }` (Next.js 15+);
+ * Next.js 14 uses `experimental.instrumentationHook`, `experimental.serverComponentsExternalPackages`
+ * and `experimental.outputFileTracingIncludes`.
  */
 export function registerSecureNow(options?: RegisterOptions): void;
-
-/**
- * Default sensitive fields that are automatically redacted from traces
- */
-export const DEFAULT_SENSITIVE_FIELDS: readonly string[];
-
-/**
- * Redact sensitive fields from an object
- * @param obj - Object to redact
- * @param sensitiveFields - Array of field names to redact (case-insensitive substring match)
- * @returns Redacted copy of the object
- */
-export function redactSensitiveData<T = any>(
-  obj: T,
-  sensitiveFields?: string[]
-): T;
-
-/**
- * Redact sensitive data from GraphQL query strings
- * @param query - GraphQL query string
- * @param sensitiveFields - Array of field names to redact
- * @returns Redacted query string
- */
-export function redactGraphQLQuery(
-  query: string,
-  sensitiveFields?: string[]
-): string;

package/nextjs.js

@@ -140,7 +140,8 @@ function registerSecureNow(options = {}) {
     const otelLogLevel = String(appConfig.configValue('otel.logLevel', '') || '').toLowerCase();
     const isDevelopmentRuntime = process.env.NODE_ENV === 'development';
 
-    console.log('[securenow] Next.js App -> service.name=%s', serviceName);
+    console.log('[securenow] Next.js App -> service.name=%s apiKey=%s credentials=%s', serviceName,
+      appConfig.resolveApiKey() ? 'set' : 'missing', appConfig.describeCredentialsSource());
     console.log('[securenow] Environment: %s', deploymentEnvironment);
 
     // -------- Body Capture Configuration --------
@@ -438,10 +439,16 @@ function registerSecureNow(options = {}) {
         headers
       }));
       
+      // The batch exporter NodeSDK would build from traceExporter, plus the processor that puts Next.js's
+      // route on the request's HTTP span (see next-route.js).
+      const { BatchSpanProcessor } = require('@opentelemetry/sdk-trace-base');
       const sdk = new NodeSDK({
         ...nodeSdkTelemetryOptions,
         serviceName: serviceName,
-        traceExporter: traceExporter,
+        spanProcessors: [
+          new BatchSpanProcessor(traceExporter),
+          require('./next-route').createNextRouteProcessor(),
+        ],
         instrumentations: [httpInstrumentation],
         resource: createResource({
           [SemanticResourceAttributes.SERVICE_NAME]: serviceName,
@@ -472,16 +479,21 @@ function registerSecureNow(options = {}) {
               [SemanticResourceAttributes.DEPLOYMENT_ENVIRONMENT]: deploymentEnvironment,
             }),
             // sdk-logs >= 0.220 takes a single options object ({ exporter }).
-            processors: [new BatchLogRecordProcessor({ exporter: logExporter })],
+            // Secret shapes in log lines are redacted before export (log-redaction.js).
+            processors: require('./log-redaction').logProcessors(appConfig, new BatchLogRecordProcessor({ exporter: logExporter })),
           });
           _crashLoggerProvider = loggerProvider;
 
-          // Patch console to forward logs as OTLP log records
+          // Patch console to forward logs as OTLP log records, formatted like the Node preload's
+          // (printf placeholders, JSON objects, errors with their stack).
           const logger = loggerProvider.getLogger('console', '1.0.0');
-          const SeverityNumber = { INFO: 9, WARN: 13, ERROR: 17 };
+          const SeverityNumber = { DEBUG: 5, INFO: 9, WARN: 13, ERROR: 17 };
           const origLog = console.log;
+          const origInfo = console.info;
           const origWarn = console.warn;
           const origError = console.error;
+          const origDebug = console.debug;
+          const { formatLogArgs } = require('./log-format');
 
           const { context: otelContext, trace: otelTrace } = require('@opentelemetry/api');
           function _emitLog(sn, st, args) {
@@ -491,7 +503,8 @@ function registerSecureNow(options = {}) {
               logger.emit({
                 severityNumber: sn,
                 severityText: st,
-                body: args.map(String).join(' '),
+                body: formatLogArgs(args),
+                attributes: { 'log.source': 'console', 'log.method': st.toLowerCase() },
                 ...(spanCtx && { context: activeCtx }),
               });
             } catch (_) {}
@@ -500,6 +513,10 @@ function registerSecureNow(options = {}) {
             origLog.apply(console, args);
             _emitLog(SeverityNumber.INFO, 'INFO', args);
           };
+          console.info = (...args) => {
+            origInfo.apply(console, args);
+            _emitLog(SeverityNumber.INFO, 'INFO', args);
+          };
           console.warn = (...args) => {
             origWarn.apply(console, args);
             _emitLog(SeverityNumber.WARN, 'WARN', args);
@@ -508,6 +525,10 @@ function registerSecureNow(options = {}) {
             origError.apply(console, args);
             _emitLog(SeverityNumber.ERROR, 'ERROR', args);
           };
+          console.debug = (...args) => {
+            origDebug.apply(console, args);
+            _emitLog(SeverityNumber.DEBUG, 'DEBUG', args);
+          };
 
           console.log('[securenow] Logging: ENABLED -> %s', logsUrl);
 
@@ -627,6 +648,8 @@ function registerSecureNow(options = {}) {
         aws: firewallOptions.aws,
         gcp: firewallOptions.gcp,
       });
+      // Zero-code session revocation / session-theft capture (config.sessions.guard / .capture).
+      requireRuntimeModule('./sessions').installHttpGuard(appConfig.resolveSessionsOptions());
     } catch (e) {
       console.warn('[securenow] Firewall init failed:', e.message);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.24.0",
+  "version": "8.25.0",
   "mcpName": "ai.securenow/securenow",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
@@ -11,7 +11,7 @@
     "securenow-mcp": "mcp/server.js"
   },
   "scripts": {
-    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-header-redaction.js && node test-firewall-paths.js && node test-firewall-guards.js && node test-rate-limits.js && node test-rate-limit-redis.js && node test-log-format.js && node test-crash-capture.js && node test-crash-flush.js && node test-request-capture.js && node test-fastify-hooks.js && node test-pm2-credentials.js && node test-env-credentials.js && node test-framework-wiring.js && node test-sdk-disabled.js && node test-internal-thread.js && node test-esm-detect.js && node test-package-contents.js"
+    "test": "node test-app-config.js && node test-resolve-ip.js && node test-cidr.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-header-redaction.js && node test-firewall-paths.js && node test-firewall-guards.js && node test-rate-limits.js && node test-rate-limit-redis.js && node test-log-format.js && node test-log-redaction.js && node test-crash-capture.js && node test-crash-flush.js && node test-request-capture.js && node test-fastify-hooks.js && node test-pm2-credentials.js && node test-env-credentials.js && node test-framework-wiring.js && node test-framework-routes.js && node test-sessions-everywhere.js && node test-local-socket.js && node test-firewall-cloud.js && node test-firewall-layers.js && node test-sdk-disabled.js && node test-internal-thread.js && node test-esm-detect.js && node test-package-contents.js"
   },
   "keywords": [
     "opentelemetry",
@@ -167,10 +167,13 @@
     "firewall-paths.js",
     "rate-limit-store.js",
     "log-format.js",
+    "log-redaction.js",
     "crash-capture.js",
     "request-capture.js",
     "pm2-env.js",
     "fastify-hooks.js",
+    "framework-routes.js",
+    "next-route.js",
     "sdk-disabled.js",
     "rate-limits.js",
     "rate-limits.d.ts",