securenow 7.7.10 → 7.7.12

package/NPM_README.md

@@ -157,7 +157,8 @@ npx securenow login --global
 # Check who you're logged in as (shows auth source)
 npx securenow whoami
 
-# Already have a firewall key? Store it without re-running login:
+# Need or already have a firewall key? Create or store it without re-running login:
+npx securenow api-key create --name "CLI firewall"
 npx securenow api-key set snk_live_abc123...   # --global for ~/.securenow/
 npx securenow api-key show                     # masked key + source
 npx securenow api-key clear                    # remove just the key
@@ -491,7 +492,8 @@ npx securenow logs --json --level error | jq '.logs'
 | | `apps info <id>` | Application details |
 | | `apps delete <id>` | Delete application |
 | | `apps default <key>` | Set default app |
-| **API Key** | `api-key set <snk_live_...> [--global]` | Save firewall key to `.securenow/credentials.json` |
+| **API Key** | `api-key create [--name "CLI firewall"] [--global]` | Mint and save a firewall key with your logged-in session |
+| | `api-key set <snk_live_...> [--global]` | Save firewall key to `.securenow/credentials.json` |
 | | `api-key show` | Show masked key + source |
 | | `api-key clear [--global]` | Remove stored key (leaves session/app) |
 | **Observe** | `traces` | List traces |

package/README.md

@@ -175,6 +175,7 @@ npx securenow login --global        # save to ~/.securenow/ instead
 npx securenow login --token <TOKEN> # headless (CI)
 npx securenow init --env local      # scaffold framework files + local env scope
 npx securenow credentials runtime --env production # write tokenless production credentials file
+npx securenow api-key create --name "CLI firewall" # mint + store firewall key
 npx securenow api-key set snk_live_... # store firewall key in .securenow/credentials.json
 
 # Apps
@@ -301,6 +302,7 @@ After install, the `securenow` CLI is available via `npx securenow` or globally
 | `securenow logout` | Clear project-local credentials |
 | `securenow logout --global` | Clear ~/.securenow/ instead |
 | `securenow whoami` | Show current session (email, app, expiry) |
+| `securenow api-key create [--name "CLI firewall"]` | Mint and store a firewall key using your session token |
 | `securenow api-key set <snk_live_...>` | Store firewall key in `.securenow/credentials.json` (`--global` for `~/.securenow/`) |
 | `securenow api-key show` | Print masked key + source file |
 | `securenow api-key clear` | Remove stored key (`--global` for `~/.securenow/`) |

package/SKILL-CLI.md

@@ -153,16 +153,17 @@ securenow apps scan [--yes]                  # scan all app domains for new subd
 
 Manage the firewall API key stored in the credentials file. Since v7.5.1 the login flow writes `snk_live_...` keys to `.securenow/credentials.json` by default, so no env var is required for local dev.
 
-```bash
-securenow api-key set snk_live_xxxxxxxxxx    # save to project ./.securenow/ (default)
-securenow api-key set snk_live_xxx --global  # save to ~/.securenow/ instead
+```bash
+securenow api-key create --name "CLI firewall" # mint + save a firewall key with your logged-in session
+securenow api-key set snk_live_xxxxxxxxxx    # save to project ./.securenow/ (default)
+securenow api-key set snk_live_xxx --global  # save to ~/.securenow/ instead
 securenow api-key show                       # print the masked current key + its source
 securenow api-key clear                      # remove just the API key (keeps session/app)
 securenow api-key clear --global             # same, but from the global file
 securenow credentials runtime --env production # write .securenow/credentials.production.json for production secret-file deploys
 ```
 
-The key must start with `snk_live_`. `securenow login` with firewall enabled writes the key automatically; use `api-key set` when you already have a key from the dashboard, or to rotate it later.
+The key must start with `snk_live_`. `securenow login` with firewall enabled writes the key automatically; use `api-key create` when you have an account session but no runtime key yet, or `api-key set` when you already have a key from the dashboard.
 
 ### Init — Project Setup
 

package/cli/apiKey.js

@@ -1,5 +1,6 @@
 'use strict';
 
+const { api, requireAuth } = require('./client');
 const config = require('./config');
 const ui = require('./ui');
 
@@ -8,6 +9,47 @@ function maskKey(key) {
   return `${key.slice(0, 12)}••••••${key.slice(-4)}`;
 }
 
+async function create(args, flags) {
+  requireAuth();
+
+  const name = flags.name || args.join(' ').trim() || 'CLI firewall';
+  const preset = flags.preset || 'firewall';
+  const local = flags.global ? false : true;
+
+  const s = ui.spinner(`Creating ${preset} API key`);
+  try {
+    const result = await api.post('/api-keys', { name, preset });
+    const key = result && result.key;
+    if (!key || !key.startsWith('snk_live_')) {
+      throw new Error('API did not return a valid firewall key');
+    }
+
+    config.setApiKey(key, { local });
+    if (local) config.ensureLocalGitignore();
+    s.stop('API key created and saved');
+
+    if (flags.json) {
+      ui.json({
+        id: result.apiKey?._id || result.apiKey?.id || null,
+        name: result.apiKey?.name || name,
+        preset,
+        key: maskKey(key),
+        savedTo: local ? 'project .securenow/credentials.json' : '~/.securenow/credentials.json',
+      });
+      return;
+    }
+
+    ui.success(`API key saved (${maskKey(key)})`);
+    ui.info(local
+      ? 'Stored in project .securenow/credentials.json (local)'
+      : 'Stored in ~/.securenow/credentials.json (global)');
+    ui.info('The plaintext key is not printed. The SDK will read it from the credentials file.');
+  } catch (err) {
+    s.fail('Failed to create API key');
+    throw err;
+  }
+}
+
 async function set(args, flags) {
   const key = args[0];
   if (!key) {
@@ -52,4 +94,4 @@ async function show() {
   ui.info(`Source: ${config.getAuthSource()}`);
 }
 
-module.exports = { set, clear, show };
+module.exports = { create, set, clear, show };

package/cli/config.js

@@ -47,6 +47,12 @@ function saveJSON(filepath, data) {
   }
 }
 
+function credentialsForWrite(targetFile) {
+  const inherited = loadCredentials() || {};
+  const existing = loadJSON(targetFile);
+  return appConfig.mergeCredentials(inherited, existing) || {};
+}
+
 function credentialsFileForLocal(local) {
   return local ? LOCAL_CREDENTIALS_FILE : CREDENTIALS_FILE;
 }
@@ -113,7 +119,7 @@ function withOnboardingFirewallEnabled(creds) {
 function ensureCredentialDefaults({ local, enableFirewall = false } = {}) {
   const useLocal = local === true || (local == null && hasLocalCredentials());
   const targetFile = credentialsFileForLocal(useLocal);
-  const existing = loadJSON(targetFile);
+  const existing = useLocal ? credentialsForWrite(targetFile) : loadJSON(targetFile);
   const payload = enableFirewall
     ? withOnboardingFirewallEnabled(existing || {})
     : appConfig.withCredentialDefaults(existing || {}) || {};
@@ -168,7 +174,7 @@ function getApp() {
 function setApiKey(apiKey, { local } = {}) {
   const useLocal = local === true || (local == null && hasLocalCredentials());
   const targetFile = credentialsFileForLocal(useLocal);
-  const existing = loadJSON(targetFile);
+  const existing = useLocal ? credentialsForWrite(targetFile) : loadJSON(targetFile);
   saveJSON(targetFile, withOnboardingFirewallEnabled({ ...existing, apiKey }));
 }
 
@@ -189,7 +195,7 @@ function getApiKey() {
 function setApp(app, { local } = {}) {
   const useLocal = local === true || (local == null && hasLocalCredentials());
   const targetFile = credentialsFileForLocal(useLocal);
-  const existing = loadJSON(targetFile);
+  const existing = useLocal ? credentialsForWrite(targetFile) : loadJSON(targetFile);
   saveJSON(targetFile, appConfig.withCredentialDefaults({
     ...existing,
     app: {

package/cli.js

@@ -77,11 +77,21 @@ const COMMANDS = {
   },
   'api-key': {
     desc: 'Manage the firewall API key stored in .securenow/credentials.json',
-    usage: 'securenow api-key <subcommand> [options]',
-    sub: {
-      set: {
-        desc: 'Save an API key (snk_live_...) to the credentials file',
-        usage: 'securenow api-key set <snk_live_...> [--global]',
+    usage: 'securenow api-key <subcommand> [options]',
+    sub: {
+      create: {
+        desc: 'Create a firewall API key with your session token and save it',
+        usage: 'securenow api-key create [name] [--name <name>] [--preset firewall] [--global]',
+        flags: {
+          name: 'Human-readable key name',
+          preset: 'API key preset to create (default: firewall)',
+          global: 'Save to ~/.securenow/ instead of project-local',
+        },
+        run: (a, f) => require('./cli/apiKey').create(a, f),
+      },
+      set: {
+        desc: 'Save an API key (snk_live_...) to the credentials file',
+        usage: 'securenow api-key set <snk_live_...> [--global]',
         flags: { global: 'Save to ~/.securenow/ instead of project-local' },
         run: (a, f) => require('./cli/apiKey').set(a, f),
       },

package/free-trial-banner.js

@@ -97,7 +97,8 @@ var BANNER_SCRIPT =
  */
 function patchHttpForBanner() {
   try {
-    var http = require('http');
+    var nodeRequire = typeof __non_webpack_require__ === 'function' ? __non_webpack_require__ : eval('require');
+    var http = nodeRequire('node:http');
     var _origWrite = http.ServerResponse.prototype.write;
     var _origEnd   = http.ServerResponse.prototype.end;
 

package/nextjs.js

@@ -34,6 +34,15 @@ const env = appConfig.env;
 
 let isRegistered = false;
 
+function requireRuntimeModule(name) {
+  const nodeRequire = typeof __non_webpack_require__ === 'function' ? __non_webpack_require__ : eval('require');
+  return nodeRequire(name);
+}
+
+function requireNodeBuiltin(name) {
+  return requireRuntimeModule(name);
+}
+
 function createResource(attributes) {
   if (typeof otelResources.resourceFromAttributes === 'function') {
     return otelResources.resourceFromAttributes(attributes);
@@ -501,7 +510,7 @@ function registerSecureNow(options = {}) {
 
           // Auto-log every incoming HTTP request/response
           try {
-            const http = require('http');
+            const http = requireNodeBuiltin('node:http');
             const originalEmit = http.Server.prototype.emit;
             http.Server.prototype.emit = function (event, req, res) {
               if (event === 'request' && req && res) {
@@ -549,8 +558,8 @@ function registerSecureNow(options = {}) {
           } catch (_) {}
 
           // Graceful shutdown for logs
-          process.on('SIGTERM', async () => { try { await loggerProvider.shutdown(); } catch (_) {} try { require('./firewall').shutdown(); } catch (_) {} });
-          process.on('SIGINT', async () => { try { await loggerProvider.shutdown(); } catch (_) {} try { require('./firewall').shutdown(); } catch (_) {} });
+          process.on('SIGTERM', async () => { try { await loggerProvider.shutdown(); } catch (_) {} try { requireRuntimeModule('./firewall').shutdown(); } catch (_) {} });
+          process.on('SIGINT', async () => { try { await loggerProvider.shutdown(); } catch (_) {} try { requireRuntimeModule('./firewall').shutdown(); } catch (_) {} });
         } catch (e) {
           console.warn('[securenow] ⚠️  Logging setup failed (missing @opentelemetry/exporter-logs-otlp-http or @opentelemetry/sdk-logs):', e.message);
         }
@@ -563,7 +572,7 @@ function registerSecureNow(options = {}) {
 
     // Free trial banner (optional — may not be bundled in standalone builds)
     try {
-      const { isFreeTrial, patchHttpForBanner } = require('./free-trial-banner');
+      const { isFreeTrial, patchHttpForBanner } = requireRuntimeModule('./free-trial-banner');
       if (isFreeTrial(endpointBase) && String(env('SECURENOW_HIDE_BANNER')) !== '1') {
         patchHttpForBanner();
       }
@@ -607,7 +616,7 @@ function registerSecureNow(options = {}) {
   const firewallOptions = appConfig.resolveFirewallOptions();
   if (firewallOptions.apiKey && firewallOptions.enabled) {
     try {
-      require('./firewall').init({
+      requireRuntimeModule('./firewall').init({
         apiKey: firewallOptions.apiKey,
         appKey: firewallOptions.appKey,
         environment: deploymentEnvironment || firewallOptions.environment,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "7.7.10",
+  "version": "7.7.12",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",

package/tracing.js

@@ -124,9 +124,9 @@ function extractBoundary(contentType) {
   return match ? (match[1] || match[2]) : null;
 }
 
-function collectMultipartMeta(request, contentType, sensitiveFields, maxTextFieldSize, onComplete) {
+function createMultipartMetaCollector(contentType, sensitiveFields, maxTextFieldSize, onComplete) {
   const boundary = extractBoundary(contentType);
-  if (!boundary) { onComplete({ error: 'BOUNDARY_NOT_FOUND' }); return; }
+  if (!boundary) { onComplete({ error: 'BOUNDARY_NOT_FOUND' }); return null; }
 
   const result = { fields: Object.create(null), files: [] };
   let totalSize = 0;
@@ -219,13 +219,14 @@ function collectMultipartMeta(request, contentType, sensitiveFields, maxTextFiel
     }
   }
 
-  request.on('data', (chunk) => {
-    totalSize += chunk.length;
-    buf = Buffer.concat([buf, chunk]);
+  function onData(chunk) {
+    const data = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    totalSize += data.length;
+    buf = Buffer.concat([buf, data]);
     drain();
-  });
+  }
 
-  request.on('end', () => {
+  function onEnd() {
     try {
       if (!inHeaders && fldName) {
         bodyBytes += buf.length;
@@ -236,7 +237,16 @@ function collectMultipartMeta(request, contentType, sensitiveFields, maxTextFiel
     } catch (e) {
       onComplete({ error: 'PARSE_ERROR' });
     }
-  });
+  }
+
+  return { onData, onEnd };
+}
+
+function collectMultipartMeta(request, contentType, sensitiveFields, maxTextFieldSize, onComplete) {
+  const collector = createMultipartMetaCollector(contentType, sensitiveFields, maxTextFieldSize, onComplete);
+  if (!collector) return;
+  request.on('data', collector.onData);
+  request.on('end', collector.onEnd);
 }
 
 // -------- ESM detection --------
@@ -342,6 +352,133 @@ const allSensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...customSensitiveField
 
 const captureMultipart = !/^(0|false)$/i.test(String(env('SECURENOW_CAPTURE_MULTIPART') ?? ''));
 
+const BODY_CAPTURE_PATCH = Symbol.for('securenow.bodyCapture.emitPatch');
+
+function installRequestBodyObserver(span, request, contentType) {
+  if (!request || request[BODY_CAPTURE_PATCH]) return;
+
+  const normalizedContentType = String(contentType || '').toLowerCase();
+  const isStructuredBody = captureBody && (
+    normalizedContentType.includes('application/json') ||
+    normalizedContentType.includes('application/graphql') ||
+    normalizedContentType.includes('application/x-www-form-urlencoded')
+  );
+  const isMultipartBody = normalizedContentType.includes('multipart/form-data');
+
+  if (!isStructuredBody && !isMultipartBody) return;
+
+  if (isMultipartBody && !captureMultipart) {
+    span.setAttribute('http.request.body', '[MULTIPART - NOT CAPTURED]');
+    span.setAttribute('http.request.body.type', 'multipart');
+    span.setAttribute('http.request.body.note', 'Multipart capture disabled (SECURENOW_CAPTURE_MULTIPART=0)');
+    return;
+  }
+
+  let chunks = [];
+  let size = 0;
+  let structuredDone = false;
+
+  const multipartCollector = isMultipartBody && captureMultipart
+    ? createMultipartMetaCollector(normalizedContentType, allSensitiveFields, 1000, ({ error, parsed, totalSize }) => {
+        try {
+          if (error === 'BOUNDARY_NOT_FOUND') {
+            span.setAttribute('http.request.body', '[MULTIPART - BOUNDARY NOT FOUND]');
+            span.setAttribute('http.request.body.type', 'multipart');
+            return;
+          }
+          if (error) {
+            span.setAttribute('http.request.body', '[MULTIPART - PARSE ERROR]');
+            span.setAttribute('http.request.body.type', 'multipart');
+            span.setAttribute('http.request.body.parse_error', true);
+            return;
+          }
+          span.setAttributes({
+            'http.request.body': JSON.stringify(parsed).substring(0, maxBodySize),
+            'http.request.body.type': 'multipart',
+            'http.request.body.size': totalSize,
+            'http.request.body.fields_count': Object.keys(parsed.fields).length,
+            'http.request.body.files_count': parsed.files.length,
+          });
+        } catch (e) {
+          span.setAttribute('http.request.body', '[MULTIPART - PARSE ERROR]');
+          span.setAttribute('http.request.body.type', 'multipart');
+          span.setAttribute('http.request.body.parse_error', true);
+        }
+      })
+    : null;
+
+  if (isMultipartBody && captureMultipart && !multipartCollector) return;
+
+  function finishStructuredCapture() {
+    if (!isStructuredBody || structuredDone) return;
+    structuredDone = true;
+
+    if (size > maxBodySize) {
+      span.setAttribute('http.request.body', `[TOO LARGE: ${size} bytes]`);
+      span.setAttribute('http.request.body.size', size);
+      chunks = [];
+      return;
+    }
+
+    if (chunks.length === 0) return;
+
+    const body = Buffer.concat(chunks).toString('utf8');
+    chunks = [];
+
+    try {
+      if (normalizedContentType.includes('application/graphql')) {
+        const redacted = redactGraphQLQuery(body, allSensitiveFields);
+        span.setAttributes({
+          'http.request.body': redacted.substring(0, maxBodySize),
+          'http.request.body.type': 'graphql',
+          'http.request.body.size': size,
+        });
+      } else if (normalizedContentType.includes('application/json')) {
+        const parsed = JSON.parse(body);
+        const redacted = redactSensitiveData(parsed, allSensitiveFields);
+        span.setAttributes({
+          'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
+          'http.request.body.type': 'json',
+          'http.request.body.size': size,
+        });
+      } else if (normalizedContentType.includes('application/x-www-form-urlencoded')) {
+        const parsed = Object.fromEntries(new URLSearchParams(body));
+        const redacted = redactSensitiveData(parsed, allSensitiveFields);
+        span.setAttributes({
+          'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
+          'http.request.body.type': 'form',
+          'http.request.body.size': size,
+        });
+      }
+    } catch (e) {
+      span.setAttribute('http.request.body', '[UNPARSEABLE - REDACTED FOR SAFETY]');
+      span.setAttribute('http.request.body.parse_error', true);
+      span.setAttribute('http.request.body.size', size);
+    }
+  }
+
+  const originalEmit = request.emit;
+  request[BODY_CAPTURE_PATCH] = true;
+  request.emit = function securenowObservedEmit(event, ...args) {
+    try {
+      if (event === 'data' && args.length > 0) {
+        const chunk = Buffer.isBuffer(args[0]) ? args[0] : Buffer.from(args[0]);
+        if (isStructuredBody) {
+          size += chunk.length;
+          if (size <= maxBodySize) chunks.push(chunk);
+        }
+        if (multipartCollector) multipartCollector.onData(chunk);
+      } else if (event === 'end') {
+        finishStructuredCapture();
+        if (multipartCollector) multipartCollector.onEnd();
+      }
+    } catch (_) {
+      // Body capture must never interfere with the application request stream.
+    }
+    return originalEmit.apply(this, [event, ...args]);
+  };
+}
+
 // -------- Trusted proxy IP resolution --------
 const { resolveClientIpWithDetails } = require('./resolve-ip');
 
@@ -391,100 +528,7 @@ const httpInstrumentation = new HttpInstrumentation({
 
       if ((captureBody || captureMultipart) && request.method && ['POST', 'PUT', 'PATCH'].includes(request.method)) {
         const contentType = request.headers['content-type'] || '';
-        
-        if (captureBody && (contentType.includes('application/json') || 
-            contentType.includes('application/graphql') ||
-            contentType.includes('application/x-www-form-urlencoded'))) {
-          
-          let body = '';
-          const chunks = [];
-          let size = 0;
-          
-          request.on('data', (chunk) => {
-            size += chunk.length;
-            if (size <= maxBodySize) {
-              chunks.push(chunk);
-            }
-          });
-          
-          request.on('end', () => {
-            if (size <= maxBodySize && chunks.length > 0) {
-              body = Buffer.concat(chunks).toString('utf8');
-              
-              try {
-                let redacted;
-                
-                if (contentType.includes('application/graphql')) {
-                  // GraphQL: redact query string
-                  redacted = redactGraphQLQuery(body, allSensitiveFields);
-                  span.setAttributes({
-                    'http.request.body': redacted.substring(0, maxBodySize),
-                    'http.request.body.type': 'graphql',
-                    'http.request.body.size': size,
-                  });
-                } else if (contentType.includes('application/json')) {
-                  // JSON: parse and redact object
-                  const parsed = JSON.parse(body);
-                  redacted = redactSensitiveData(parsed, allSensitiveFields);
-                  span.setAttributes({
-                    'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
-                    'http.request.body.type': 'json',
-                    'http.request.body.size': size,
-                  });
-                } else if (contentType.includes('application/x-www-form-urlencoded')) {
-                  // Form: parse and redact
-                  const parsed = Object.fromEntries(new URLSearchParams(body));
-                  redacted = redactSensitiveData(parsed, allSensitiveFields);
-                  span.setAttributes({
-                    'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
-                    'http.request.body.type': 'form',
-                    'http.request.body.size': size,
-                  });
-                }
-              } catch (e) {
-                span.setAttribute('http.request.body', '[UNPARSEABLE - REDACTED FOR SAFETY]');
-                span.setAttribute('http.request.body.parse_error', true);
-                span.setAttribute('http.request.body.size', size);
-              }
-            } else if (size > maxBodySize) {
-              span.setAttribute('http.request.body', `[TOO LARGE: ${size} bytes]`);
-              span.setAttribute('http.request.body.size', size);
-            }
-          });
-        } else if (contentType.includes('multipart/form-data')) {
-          if (captureMultipart) {
-            collectMultipartMeta(request, contentType, allSensitiveFields, 1000, ({ error, parsed, totalSize }) => {
-              try {
-                if (error === 'BOUNDARY_NOT_FOUND') {
-                  span.setAttribute('http.request.body', '[MULTIPART - BOUNDARY NOT FOUND]');
-                  span.setAttribute('http.request.body.type', 'multipart');
-                  return;
-                }
-                if (error) {
-                  span.setAttribute('http.request.body', '[MULTIPART - PARSE ERROR]');
-                  span.setAttribute('http.request.body.type', 'multipart');
-                  span.setAttribute('http.request.body.parse_error', true);
-                  return;
-                }
-                span.setAttributes({
-                  'http.request.body': JSON.stringify(parsed).substring(0, maxBodySize),
-                  'http.request.body.type': 'multipart',
-                  'http.request.body.size': totalSize,
-                  'http.request.body.fields_count': Object.keys(parsed.fields).length,
-                  'http.request.body.files_count': parsed.files.length,
-                });
-              } catch (e) {
-                span.setAttribute('http.request.body', '[MULTIPART - PARSE ERROR]');
-                span.setAttribute('http.request.body.type', 'multipart');
-                span.setAttribute('http.request.body.parse_error', true);
-              }
-            });
-          } else {
-            span.setAttribute('http.request.body', '[MULTIPART - NOT CAPTURED]');
-            span.setAttribute('http.request.body.type', 'multipart');
-            span.setAttribute('http.request.body.note', 'Multipart capture disabled (SECURENOW_CAPTURE_MULTIPART=0)');
-          }
-        }
+        installRequestBodyObserver(span, request, contentType);
       }
     } catch (error) {
       // Silently fail