securenow 7.6.0 → 7.6.2

package/SKILL-API.md

@@ -151,15 +151,13 @@ For Next.js < 15, add `securenow` to `experimental.serverComponentsExternalPacka
 **2. `instrumentation.ts`** (or `.js`, can be in `src/`):
 
 ```typescript
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-
 export async function register() {
   if (process.env.NEXT_RUNTIME !== 'nodejs') return;
-  const { registerSecureNow } = require('securenow/nextjs');
+
+  const securenowNext = await import(/* webpackIgnore: true */ 'securenow/nextjs');
+  const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
   registerSecureNow({ captureBody: true });
-  require('securenow/nextjs-auto-capture');
+  await import(/* webpackIgnore: true */ 'securenow/nextjs-auto-capture');
 }
 ```
 
@@ -202,15 +200,13 @@ Local development and production do not need `.env.local`; `npx securenow login`
 Add to your `instrumentation.ts`:
 
 ```typescript
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-
 export async function register() {
   if (process.env.NEXT_RUNTIME !== 'nodejs') return;
-  const { registerSecureNow } = require('securenow/nextjs');
+
+  const securenowNext = await import(/* webpackIgnore: true */ 'securenow/nextjs');
+  const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
   registerSecureNow({ captureBody: true });
-  require('securenow/nextjs-auto-capture');
+  await import(/* webpackIgnore: true */ 'securenow/nextjs-auto-capture');
 }
 ```
 

package/app-config.js

@@ -164,10 +164,84 @@ function readJsonSafe(filepath) {
   }
 }
 
+function fileIfReadable(filepath) {
+  if (!filepath) return null;
+  try {
+    return fs.existsSync(filepath) && fs.statSync(filepath).isFile() ? filepath : null;
+  } catch {
+    return null;
+  }
+}
+
+function findUpFile(startDir, relativePath) {
+  if (!startDir) return null;
+  let dir;
+  try {
+    dir = path.resolve(startDir);
+  } catch {
+    return null;
+  }
+
+  while (true) {
+    const found = fileIfReadable(path.join(dir, relativePath));
+    if (found) return found;
+
+    const parent = path.dirname(dir);
+    if (!parent || parent === dir) return null;
+    dir = parent;
+  }
+}
+
+function uniq(values) {
+  const seen = new Set();
+  const out = [];
+  for (const value of values) {
+    if (!value || seen.has(value)) continue;
+    seen.add(value);
+    out.push(value);
+  }
+  return out;
+}
+
+function resolveLocalCredentialsFile() {
+  const starts = [];
+  try {
+    if (typeof process !== 'undefined' && process.cwd) starts.push(process.cwd());
+  } catch {}
+
+  if (process.env.INIT_CWD) starts.push(process.env.INIT_CWD);
+  if (process.argv && process.argv[1]) starts.push(path.dirname(process.argv[1]));
+  if (require.main && require.main.filename) starts.push(path.dirname(require.main.filename));
+
+  for (const start of uniq(starts)) {
+    const found = findUpFile(start, path.join('.securenow', 'credentials.json'));
+    if (found) return found;
+  }
+
+  return null;
+}
+
+function resolvePackageJsonFile() {
+  const starts = [];
+  try {
+    if (typeof process !== 'undefined' && process.cwd) starts.push(process.cwd());
+  } catch {}
+
+  if (process.env.INIT_CWD) starts.push(process.env.INIT_CWD);
+  if (process.argv && process.argv[1]) starts.push(path.dirname(process.argv[1]));
+  if (require.main && require.main.filename) starts.push(path.dirname(require.main.filename));
+
+  for (const start of uniq(starts)) {
+    const found = findUpFile(start, 'package.json');
+    if (found) return found;
+  }
+
+  return null;
+}
+
 function loadLocalCredentials() {
   try {
-    const cwd = typeof process !== 'undefined' && process.cwd ? process.cwd() : '.';
-    return withCredentialDefaults(readJsonSafe(path.join(cwd, '.securenow', 'credentials.json')));
+    return withCredentialDefaults(readJsonSafe(resolveLocalCredentialsFile()));
   } catch {
     return null;
   }
@@ -183,8 +257,7 @@ function loadGlobalCredentials() {
 
 function loadCredentials() {
   try {
-    const cwd = typeof process !== 'undefined' && process.cwd ? process.cwd() : '.';
-    const local = readJsonSafe(path.join(cwd, '.securenow', 'credentials.json'));
+    const local = readJsonSafe(resolveLocalCredentialsFile());
     const global = readJsonSafe(path.join(os.homedir(), '.securenow', 'credentials.json'));
     return withCredentialDefaults(mergeCredentials(global, local));
   } catch {
@@ -194,8 +267,7 @@ function loadCredentials() {
 
 function loadPackageJsonName() {
   try {
-    const cwd = typeof process !== 'undefined' && process.cwd ? process.cwd() : '.';
-    const pkg = readJsonSafe(path.join(cwd, 'package.json'));
+    const pkg = readJsonSafe(resolvePackageJsonFile());
     if (pkg && typeof pkg.name === 'string' && pkg.name.trim()) {
       return pkg.name.trim().replace(/^@[^/]+\//, '');
     }

package/cli/init.js

@@ -5,16 +5,13 @@ const path = require('path');
 const ui = require('./ui');
 const config = require('./config');
 
-const INSTRUMENTATION = `import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-
-export async function register() {
+const INSTRUMENTATION = `export async function register() {
   if (process.env.NEXT_RUNTIME !== 'nodejs') return;
 
-  const { registerSecureNow } = require('securenow/nextjs');
+  const securenowNext = await import(/* webpackIgnore: true */ 'securenow/nextjs');
+  const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
   registerSecureNow({ captureBody: true });
-  require('securenow/nextjs-auto-capture');
+  await import(/* webpackIgnore: true */ 'securenow/nextjs-auto-capture');
 }
 `;
 
@@ -190,7 +187,7 @@ function printAgentPrompt(kind, filename, major) {
     'Set up SecureNow in this existing Next.js project without using .env files.',
     'Use .securenow/credentials.json for local and production configuration; do not add .env files.',
     kind === 'instrumentation'
-      ? `Merge this into ${filename}: in register(), return unless process.env.NEXT_RUNTIME === "nodejs"; use createRequire(import.meta.url); require("securenow/nextjs").registerSecureNow({ captureBody: true }); then require("securenow/nextjs-auto-capture"). Preserve all existing instrumentation.`
+      ? `Merge this into ${filename}: in register(), return unless process.env.NEXT_RUNTIME === "nodejs"; then dynamically import "securenow/nextjs" and "securenow/nextjs-auto-capture" with /* webpackIgnore: true */ so Next does not bundle OpenTelemetry internals. Preserve all existing instrumentation.`
       : null,
     kind === 'next-config' && major >= 15
       ? `Update ${filename} while preserving existing config: add securenow to serverExternalPackages, e.g. serverExternalPackages: [...(existing || []), "securenow"].`

package/cli.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 'use strict';
 
 const ui = require('./cli/ui');

package/docs/NEXTJS-QUICKSTART.md

@@ -25,15 +25,13 @@ No `.env.local` edits. No API key copy-paste. The app you picked in step 2 is wh
 **`instrumentation.ts`** (or `.js`, auto-detected):
 
 ```typescript
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-
 export async function register() {
   if (process.env.NEXT_RUNTIME !== 'nodejs') return;
-  const { registerSecureNow } = require('securenow/nextjs');
+
+  const securenowNext = await import(/* webpackIgnore: true */ 'securenow/nextjs');
+  const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
   registerSecureNow({ captureBody: true });
-  require('securenow/nextjs-auto-capture');
+  await import(/* webpackIgnore: true */ 'securenow/nextjs-auto-capture');
 }
 ```
 

package/nextjs.js

@@ -131,6 +131,7 @@ function registerSecureNow(options = {}) {
 
   // Detect environment outside try block for error handling
   const isVercel = !!(env('VERCEL') || env('VERCEL_ENV') || env('VERCEL_URL'));
+  let deploymentEnvironment = appConfig.resolveDeploymentEnvironment();
 
   try {
     console.log('[securenow] Next.js integration loading (pid=%d)', process.pid);
@@ -145,7 +146,7 @@ function registerSecureNow(options = {}) {
     // and the dashboard does exact match). opts.noUuid or SECURENOW_NO_UUID
     // override.
     const noUuid = appConfig.resolveNoUuid({ noUuid: options.noUuid });
-    const deploymentEnvironment = appConfig.normalizeDeploymentEnvironment(
+    deploymentEnvironment = appConfig.normalizeDeploymentEnvironment(
       options.environment || resolvedApp.deploymentEnvironment || env('VERCEL_ENV')
     );
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "7.6.0",
+  "version": "7.6.2",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",