securenow 7.7.13 → 7.7.15

package/nextjs.js

@@ -5,19 +5,24 @@
  * 
  * Usage in Next.js app:
  * 
- * 1. Add securenow to serverExternalPackages in next.config.js:
+ * 1. Add securenow to serverExternalPackages and standalone output tracing
+ *    includes in next.config.js:
  * 
  *    const nextConfig = {
  *      serverExternalPackages: ["securenow"],
+ *      outputFileTracingIncludes: {
+ *        "/*": ["<securenow package glob>"],
+ *      },
  *    };
  * 
  * 2. Create instrumentation.ts (or .js) in your project root:
  * 
  *    export async function register() {
  *      if (process.env.NEXT_RUNTIME !== "nodejs") return;
- *      const securenowNext = await import("securenow/nextjs");
- *      securenowNext.registerSecureNow({ captureBody: true });
- *      await import("securenow/nextjs-auto-capture");
+ *      const securenowNext = await import(/* webpackIgnore: true *\/ "securenow/nextjs");
+ *      const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
+ *      registerSecureNow({ captureBody: true });
+ *      await import(/* webpackIgnore: true *\/ "securenow/nextjs-auto-capture");
  *    }
  * 
  * 3. Run `npx securenow login` and `npx securenow init`.
@@ -30,8 +35,6 @@ const appConfig = require('./app-config');
 const { resolveClientIpWithDetails } = require('./resolve-ip');
 const otelResources = require('@opentelemetry/resources');
 
-const env = appConfig.env;
-
 let isRegistered = false;
 
 function requireRuntimeModule(name) {
@@ -121,7 +124,7 @@ function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
  * Register SecureNow OpenTelemetry for Next.js using @vercel/otel
  * @param {Object} options - Optional configuration
  * @param {string} options.serviceName - Service name (defaults to .securenow/credentials.json app.key/app.name)
- * @param {string} options.endpoint - Traces endpoint (defaults to .securenow/credentials.json app.instance)
+ * @param {string} options.endpoint - Advanced OTLP endpoint override (defaults to the SecureNow ingest gateway)
  * @param {string} options.environment - deployment.environment override (defaults to config.runtime.deploymentEnvironment)
  * @param {boolean} options.noUuid - Don't append UUID to service name
  */
@@ -139,24 +142,26 @@ function registerSecureNow(options = {}) {
   }
 
   // Detect environment outside try block for error handling
-  const isVercel = !!(env('VERCEL') || env('VERCEL_ENV') || env('VERCEL_URL'));
+  const isVercel = !!(process.env.VERCEL || process.env.VERCEL_ENV || process.env.VERCEL_URL);
   let deploymentEnvironment = appConfig.resolveDeploymentEnvironment();
 
   try {
     console.log('[securenow] Next.js integration loading (pid=%d)', process.pid);
 
     // -------- Configuration --------
-    // Resolution order: explicit options -> .securenow/credentials.json -> legacy env fallback -> package.json#name
+    // Resolution order: explicit options -> .securenow/credentials.json -> package.json#name.
+    // Telemetry goes to the stable ingest gateway by default; the API gateway
+    // routes by app.key to the dashboard-selected instance.
     const resolvedApp = appConfig.resolveAll();
 
     const rawBase = (options.serviceName || resolvedApp.appId || '').trim().replace(/^['"]|['"]$/g, '');
     const baseName = rawBase || null;
     // Default: auto-disable suffix when logged in (appId is the routing UUID
-    // and the dashboard does exact match). opts.noUuid or SECURENOW_NO_UUID
-    // override.
+    // and the dashboard does exact match). opts.noUuid or config.runtime.noUuid
+    // can still override.
     const noUuid = appConfig.resolveNoUuid({ noUuid: options.noUuid });
     deploymentEnvironment = appConfig.normalizeDeploymentEnvironment(
-      options.environment || resolvedApp.deploymentEnvironment || env('VERCEL_ENV')
+      options.environment || resolvedApp.deploymentEnvironment
     );
 
     // service.name
@@ -165,7 +170,7 @@ function registerSecureNow(options = {}) {
       serviceName = noUuid ? baseName : `${baseName}-${randomUUID()}`;
     } else {
       serviceName = `nextjs-app-${randomUUID()}`;
-      console.warn('[securenow] ⚠️  No app identity resolved. Using fallback: %s', serviceName);
+      console.warn('[securenow] No app identity resolved. Using fallback: %s', serviceName);
       console.warn('[securenow] Run `npx securenow login` and `npx securenow init` to write .securenow/credentials.json');
     }
 
@@ -175,24 +180,30 @@ function registerSecureNow(options = {}) {
     const tracesUrl = resolvedEndpoints.tracesUrl;
     const logsUrl = resolvedEndpoints.logsUrl;
     const headers = resolvedEndpoints.headers;
+    const otelLogLevel = String(appConfig.configValue('otel.logLevel', '') || '').toLowerCase();
+    const isDevelopmentRuntime = process.env.NODE_ENV === 'development';
 
-    if (!process.env.OTEL_SERVICE_NAME) process.env.OTEL_SERVICE_NAME = serviceName;
-    if (!process.env.OTEL_EXPORTER_OTLP_ENDPOINT) process.env.OTEL_EXPORTER_OTLP_ENDPOINT = endpointBase;
-    if (!process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT) process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT = tracesUrl;
+    // @vercel/otel still reads OTel process variables internally. These are
+    // derived from credentials JSON; customers do not set them.
+    if (isVercel) {
+      if (!process.env.OTEL_SERVICE_NAME) process.env.OTEL_SERVICE_NAME = serviceName;
+      if (!process.env.OTEL_EXPORTER_OTLP_ENDPOINT) process.env.OTEL_EXPORTER_OTLP_ENDPOINT = endpointBase;
+      if (!process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT) process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT = tracesUrl;
+    }
 
     console.log('[securenow] Next.js App -> service.name=%s', serviceName);
     console.log('[securenow] Environment: %s', deploymentEnvironment);
 
     // -------- Body Capture Configuration --------
     // Opt-out default: set config.capture.body=false (or options.captureBody=false) to disable.
-    const captureBody = options.captureBody ?? !/^(0|false)$/i.test(String(env('SECURENOW_CAPTURE_BODY') ?? ''));
-    const maxBodySize = Math.max(1024, parseInt(env('SECURENOW_MAX_BODY_SIZE'), 10) || 10240);
-    const customSensitiveFields = (env('SECURENOW_SENSITIVE_FIELDS') || '').split(',').map(s => s.trim()).filter(Boolean);
+    const captureBody = options.captureBody ?? appConfig.boolConfig('capture.body', true);
+    const maxBodySize = appConfig.numberConfig('capture.maxBodySize', 10240, 1024);
+    const customSensitiveFields = appConfig.listConfig('capture.sensitiveFields');
     const allSensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...customSensitiveFields];
 
     // -------- Log environment detection --------
     if (!isVercel) {
-      console.log('[securenow] 🖥️  Self-hosted environment detected (EC2/PM2) - using vanilla SDK');
+      console.log('[securenow] Self-hosted environment detected (EC2/PM2) - using vanilla SDK');
     }
 
     // -------- Use different initialization based on environment --------
@@ -326,8 +337,8 @@ function registerSecureNow(options = {}) {
           }
 
           // Debug log in development
-          if (env('NODE_ENV') === 'development' || env('OTEL_LOG_LEVEL') === 'debug') {
-            console.log('[securenow] 📡 Captured IP: %s (from: %s)', 
+          if (isDevelopmentRuntime || otelLogLevel === 'debug') {
+            console.log('[securenow] Captured IP: %s (from: %s)',
               primaryIp, 
               ipDetails.source || 'unknown'
             );
@@ -340,8 +351,8 @@ function registerSecureNow(options = {}) {
           
         } catch (error) {
           // Silently fail to not break the request
-          if (env('OTEL_LOG_LEVEL') === 'debug') {
-            console.error('[securenow] ⚠️  Error in requestHook:', error.message);
+          if (otelLogLevel === 'debug') {
+            console.error('[securenow] Error in requestHook:', error.message);
           }
         }
       },
@@ -378,7 +389,7 @@ function registerSecureNow(options = {}) {
       return /OTLPTraceExporter|OTLPLogExporter|otlp|exporter.*http|BatchSpanProcessor|BatchLogRecordProcessor/i.test(s)
         || /node:_http_client|ClientRequest|TLSSocket/i.test(s);
     }
-    const _diagDebug = (env('OTEL_LOG_LEVEL') || '').toLowerCase() === 'debug';
+    const _diagDebug = otelLogLevel === 'debug';
     process.on('uncaughtException', (err, origin) => {
       if (_isOtlpTransientError(err) && _looksLikeOtlpStack(err)) {
         if (_diagDebug) {
@@ -450,11 +461,11 @@ function registerSecureNow(options = {}) {
       });
       
       sdk.start();
-      console.log('[securenow] 🎯 Vanilla SDK initialized for self-hosted environment');
+      console.log('[securenow] Vanilla SDK initialized for self-hosted environment');
 
       // -------- Logging (self-hosted only) --------
       // Opt-out default: set config.logging.enabled=false to disable.
-      const loggingEnabled = !/^(0|false)$/i.test(String(env('SECURENOW_LOGGING_ENABLED') ?? ''));
+      const loggingEnabled = appConfig.boolConfig('logging.enabled', true);
       if (loggingEnabled) {
         try {
           const { OTLPLogExporter } = require('@opentelemetry/exporter-logs-otlp-http');
@@ -506,7 +517,7 @@ function registerSecureNow(options = {}) {
             _emitLog(SeverityNumber.ERROR, 'ERROR', args);
           };
 
-          console.log('[securenow] 📋 Logging: ENABLED → %s', logsUrl);
+          console.log('[securenow] Logging: ENABLED -> %s', logsUrl);
 
           // Auto-log every incoming HTTP request/response
           try {
@@ -554,51 +565,51 @@ function registerSecureNow(options = {}) {
               }
               return originalEmit.apply(this, arguments);
             };
-            console.log('[securenow] 📋 HTTP request logging: ENABLED');
+            console.log('[securenow] HTTP request logging: ENABLED');
           } catch (_) {}
 
           // Graceful shutdown for logs
           process.on('SIGTERM', async () => { try { await loggerProvider.shutdown(); } catch (_) {} try { requireRuntimeModule('./firewall').shutdown(); } catch (_) {} });
           process.on('SIGINT', async () => { try { await loggerProvider.shutdown(); } catch (_) {} try { requireRuntimeModule('./firewall').shutdown(); } catch (_) {} });
         } catch (e) {
-          console.warn('[securenow] ⚠️  Logging setup failed (missing @opentelemetry/exporter-logs-otlp-http or @opentelemetry/sdk-logs):', e.message);
+          console.warn('[securenow] Logging setup failed (missing @opentelemetry/exporter-logs-otlp-http or @opentelemetry/sdk-logs):', e.message);
         }
       } else {
-        console.log('[securenow] 📋 Logging: DISABLED (SECURENOW_LOGGING_ENABLED=0)');
+        console.log('[securenow] Logging: DISABLED (config.logging.enabled=false)');
       }
     }
 
     isRegistered = true;
 
-    // Free trial banner (optional — may not be bundled in standalone builds)
+    // Free trial banner (optional - may not be bundled in standalone builds)
     try {
       const { isFreeTrial, patchHttpForBanner } = requireRuntimeModule('./free-trial-banner');
-      if (isFreeTrial(endpointBase) && String(env('SECURENOW_HIDE_BANNER')) !== '1') {
+      if (isFreeTrial(endpointBase) && !appConfig.boolConfig('runtime.hideBanner', false)) {
         patchHttpForBanner();
       }
     } catch (_) {}
 
-    console.log('[securenow] ✅ OpenTelemetry started for Next.js → %s', tracesUrl);
-    console.log('[securenow] 📊 Auto-capturing comprehensive request metadata:');
-    console.log('[securenow]    • IP addresses (x-forwarded-for, x-real-ip, socket)');
-    console.log('[securenow]    • User-Agent, Referer, Origin, Accept headers');
-    console.log('[securenow]    • Protocol, Host, Port (proxy-aware)');
-    console.log('[securenow]    • Geographic data (Vercel/Cloudflare)');
-    console.log('[securenow]    • Request IDs, CSRF tokens, Auth presence');
-    console.log('[securenow]    • Response status, content-type, content-length');
-    console.log('[securenow] ⚠️  Body capture DISABLED at HTTP instrumentation level (prevents Next.js conflicts)');
+    console.log('[securenow] OpenTelemetry started for Next.js -> %s', tracesUrl);
+    console.log('[securenow] Auto-capturing comprehensive request metadata:');
+    console.log('[securenow]    - IP addresses (x-forwarded-for, x-real-ip, socket)');
+    console.log('[securenow]    - User-Agent, Referer, Origin, Accept headers');
+    console.log('[securenow]    - Protocol, Host, Port (proxy-aware)');
+    console.log('[securenow]    - Geographic data (Vercel/Cloudflare)');
+    console.log('[securenow]    - Request IDs, CSRF tokens, Auth presence');
+    console.log('[securenow]    - Response status, content-type, content-length');
+    console.log('[securenow] Body capture DISABLED at HTTP instrumentation level (prevents Next.js conflicts)');
     if (captureBody) {
-      console.log('[securenow] 💡 For body capture in Next.js, use: import "securenow/nextjs-auto-capture"');
+      console.log('[securenow] For body capture in Next.js, use: import "securenow/nextjs-auto-capture"');
     }
 
     // Optional test span
-    if (String(env('SECURENOW_TEST_SPAN')) === '1') {
+    if (appConfig.boolConfig('runtime.testSpan', false)) {
       const api = require('@opentelemetry/api');
       const tracer = api.trace.getTracer('securenow-nextjs');
       const span = tracer.startSpan('securenow.nextjs.startup');
       span.setAttribute('next.runtime', process.env.NEXT_RUNTIME || 'nodejs');
       span.end();
-      console.log('[securenow] 🧪 Test span created');
+      console.log('[securenow] Test span created');
     }
 
   } catch (error) {
@@ -610,7 +621,7 @@ function registerSecureNow(options = {}) {
     }
   }
 
-  // Firewall — runs independently from OTel so it works even if tracing fails.
+  // Firewall - runs independently from OTel so it works even if tracing fails.
   // Key and environment come from .securenow/credentials.json (written by
   // login/init or credentials runtime), so no .env entry is needed.
   const firewallOptions = appConfig.resolveFirewallOptions();

package/nuxt-server-plugin.mjs

@@ -26,8 +26,6 @@ const { resolveClientIpWithDetails } = nodeRequire('./resolve-ip');
 
 // ── Helpers ──
 
-const env = appConfig.env;
-
 function createResource(attributes) {
   if (typeof otelResources.resourceFromAttributes === 'function') {
     return otelResources.resourceFromAttributes(attributes);
@@ -74,7 +72,7 @@ function getRuntimeOptions() {
 export default defineNitroPlugin(async (nitroApp) => {
   const opts = getRuntimeOptions();
 
-  // Resolution order: opts -> .securenow/credentials.json -> legacy env fallback -> package.json#name
+  // Resolution order: opts -> .securenow/credentials.json -> package.json#name
   const resolvedApp = appConfig.resolveAll();
 
   // ── Naming ──
@@ -125,12 +123,9 @@ export default defineNitroPlugin(async (nitroApp) => {
   // Opt-out default: set config.capture.body=false (or opts.captureBody=false) to disable.
   const captureBody =
     opts.captureBody ??
-    !/^(0|false)$/i.test(String(env('SECURENOW_CAPTURE_BODY') ?? ''));
-  const maxBodySize = Math.max(1024, parseInt(env('SECURENOW_MAX_BODY_SIZE'), 10) || 10240);
-  const customSensitiveFields = (env('SECURENOW_SENSITIVE_FIELDS') || '')
-    .split(',')
-    .map((s) => s.trim())
-    .filter(Boolean);
+    appConfig.boolConfig('capture.body', true);
+  const maxBodySize = appConfig.numberConfig('capture.maxBodySize', 10240, 1024);
+  const customSensitiveFields = appConfig.listConfig('capture.sensitiveFields');
   const allSensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...customSensitiveFields];
 
   // ── HTTP instrumentation ──
@@ -238,7 +233,7 @@ export default defineNitroPlugin(async (nitroApp) => {
   // Opt-out default: set config.logging.enabled=false (or opts.logging=false) to disable.
   const loggingEnabled =
     opts.logging ??
-    !/^(0|false)$/i.test(String(env('SECURENOW_LOGGING_ENABLED') ?? ''));
+    appConfig.boolConfig('logging.enabled', true);
 
   let loggerProvider = null;
 
@@ -314,7 +309,7 @@ export default defineNitroPlugin(async (nitroApp) => {
   // ── Free trial banner ──
   try {
     const { isFreeTrial, patchHttpForBanner } = await import('./free-trial-banner.js');
-    if (isFreeTrial(endpointBase) && String(env('SECURENOW_HIDE_BANNER')) !== '1') {
+    if (isFreeTrial(endpointBase) && !appConfig.boolConfig('runtime.hideBanner', false)) {
       patchHttpForBanner();
     }
   } catch {

package/nuxt.d.ts

@@ -1,8 +1,8 @@
-/**
- * SecureNow Nuxt 3 Module TypeScript Declarations
- */
-
-export interface SecureNowNuxtOptions {
+/**
+ * SecureNow Nuxt 3 Module TypeScript Declarations
+ */
+
+export interface SecureNowNuxtOptions {
   /**
    * Service name for OpenTelemetry traces.
    * @default .securenow/credentials.json app.key/app.name
@@ -11,7 +11,11 @@ export interface SecureNowNuxtOptions {
 
   /**
    * OTLP endpoint base URL.
-   * @default .securenow/credentials.json app.instance, or https://freetrial.securenow.ai:4318
+   * @default https://ingest.securenow.ai
+   *
+   * Advanced OTLP endpoint override. Normal SecureNow apps should leave this
+   * unset so the ingest gateway can route by app.key to the dashboard-selected
+   * instance.
    */
   endpoint?: string;
 
@@ -20,14 +24,14 @@ export interface SecureNowNuxtOptions {
    * @default .securenow/credentials.json config.runtime.deploymentEnvironment
    */
   environment?: string;
-
-  /**
-   * Don't append UUID to service name (useful when running a single instance).
-   * @default false
-   */
-  noUuid?: boolean;
-
-  /**
+
+  /**
+   * Don't append UUID to service name (useful when running a single instance).
+   * @default false
+   */
+  noUuid?: boolean;
+
+  /**
    * Capture request bodies (POST/PUT/PATCH) on traced spans.
    * Sensitive fields are automatically redacted.
    * @default true from .securenow/credentials.json secure defaults
@@ -40,27 +44,27 @@ export interface SecureNowNuxtOptions {
    */
   logging?: boolean;
 }
-
-declare module 'nuxt/schema' {
-  interface NuxtConfig {
-    securenow?: SecureNowNuxtOptions;
-  }
-  interface NuxtOptions {
-    securenow?: SecureNowNuxtOptions;
-  }
-  interface RuntimeConfig {
-    securenow?: SecureNowNuxtOptions;
-  }
-}
-
-declare module '@nuxt/schema' {
-  interface NuxtConfig {
-    securenow?: SecureNowNuxtOptions;
-  }
-  interface NuxtOptions {
-    securenow?: SecureNowNuxtOptions;
-  }
-  interface RuntimeConfig {
-    securenow?: SecureNowNuxtOptions;
-  }
-}
+
+declare module 'nuxt/schema' {
+  interface NuxtConfig {
+    securenow?: SecureNowNuxtOptions;
+  }
+  interface NuxtOptions {
+    securenow?: SecureNowNuxtOptions;
+  }
+  interface RuntimeConfig {
+    securenow?: SecureNowNuxtOptions;
+  }
+}
+
+declare module '@nuxt/schema' {
+  interface NuxtConfig {
+    securenow?: SecureNowNuxtOptions;
+  }
+  interface NuxtOptions {
+    securenow?: SecureNowNuxtOptions;
+  }
+  interface RuntimeConfig {
+    securenow?: SecureNowNuxtOptions;
+  }
+}

package/nuxt.mjs

@@ -11,7 +11,7 @@
  *   });
  *
  * Environment variables (same as all SecureNow integrations):
- *   SECURENOW_APPID, SECURENOW_INSTANCE, SECURENOW_LOGGING_ENABLED, etc.
+ *   Configuration is read from .securenow/credentials.json.
  */
 
 import { defineNuxtModule, createResolver, addServerPlugin } from '@nuxt/kit';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "7.7.13",
+  "version": "7.7.15",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",

package/tracing.d.ts

@@ -173,7 +173,8 @@ export const loggerProvider: LoggerProvider | null;
  * generated JSON to .securenow/credentials.json in the running app.
  *
  * Main config fields:
- * - app.key / app.name / app.instance
+ * - app.key / app.name
+ * - config.otel.endpoint only for advanced/self-hosted collector overrides
  * - apiKey
  * - config.runtime.deploymentEnvironment
  * - config.logging.enabled

package/tracing.js

@@ -1,31 +1,17 @@
-'use strict';
+'use strict';
 
 /**
  * Preload with: node --require securenow/register app.js
  *
  * Works for both CJS and ESM apps. On Node >=20.6 the ESM loader hook is
- * auto-registered via module.register() — no --import flag needed.
+ * auto-registered via module.register() — no --import flag needed.
  * On Node 18 with "type": "module", add the hook manually:
  *   node --import @opentelemetry/instrumentation/hook.mjs --require securenow/register app.js
  *
- * Env:
- *   SECURENOW_APPID=logical-name              # or OTEL_SERVICE_NAME=logical-name
- *   SECURENOW_NO_UUID=1|0                     # override. Default: auto — 1 when
- *                                              logged in (appId is routing UUID,
- *                                              dashboard does exact match),
- *                                              0 pre-login (use suffix to
- *                                              distinguish PM2 cluster workers).
- *   SECURENOW_INSTANCE=http://host:4318       # OTLP/HTTP base (default https://freetrial.securenow.ai:4318)
- *   OTEL_EXPORTER_OTLP_ENDPOINT=...           # alternative base
- *   OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=...    # full traces URL
- *   OTEL_EXPORTER_OTLP_HEADERS="k=v,k2=v2"
- *   SECURENOW_DISABLE_INSTRUMENTATIONS="pkg1,pkg2"
- *   SECURENOW_CAPTURE_MULTIPART=1                # capture multipart/form-data fields & file metadata (streaming, no file content buffered)
- *   OTEL_LOG_LEVEL=error|warn|info|debug|none
- *   SECURENOW_TEST_SPAN=1
- *
- * Safety:
- *   SECURENOW_STRICT=1  -> if no appid/name is provided in cluster, exit(1) so PM2 restarts the worker
+ * Config:
+ *   Runtime config is read from .securenow/credentials.json.
+ *   Run `npx securenow login` and `npx securenow init` to create it.
+ *   Production should mount/copy tokenless runtime credentials to the same path.
  */
 
 const { diag, DiagConsoleLogger, DiagLogLevel, context, trace } = require('@opentelemetry/api');
@@ -40,8 +26,6 @@ const { MongoDBInstrumentation } = require('@opentelemetry/instrumentation-mongo
 const { randomUUID } = require('crypto');
 const appConfig = require('./app-config');
 
-const env = appConfig.env;
-
 function createResource(attributes) {
   if (typeof otelResources.resourceFromAttributes === 'function') {
     return otelResources.resourceFromAttributes(attributes);
@@ -265,7 +249,7 @@ function collectMultipartMeta(request, contentType, sensitiveFields, maxTextFiel
         const hasCliHook = execArgv.includes('hook.mjs') || execArgv.includes('import-in-the-middle');
         const hasModuleRegister = typeof require('node:module').register === 'function';
         if (!hasCliHook && !hasModuleRegister) {
-          console.warn('[securenow] ⚠️  ESM app detected ("type": "module") but no ESM loader hook available.');
+          console.warn('[securenow] ⚠️  ESM app detected ("type": "module") but no ESM loader hook available.');
           console.warn('[securenow]    Upgrade to Node >=20.6 (recommended) or add: --import @opentelemetry/instrumentation/hook.mjs');
         }
       }
@@ -274,7 +258,7 @@ function collectMultipartMeta(request, contentType, sensitiveFields, maxTextFiel
 })();
 
 // -------- diagnostics --------
-const diagLevel = ((process.env.OTEL_LOG_LEVEL != null ? process.env.OTEL_LOG_LEVEL : env('OTEL_LOG_LEVEL')) || '').toLowerCase();
+const diagLevel = String(appConfig.configValue('otel.logLevel', '') || '').toLowerCase();
 (() => {
   const level = diagLevel === 'debug' ? DiagLogLevel.DEBUG :
                 diagLevel === 'info'  ? DiagLogLevel.INFO  :
@@ -285,7 +269,7 @@ const diagLevel = ((process.env.OTEL_LOG_LEVEL != null ? process.env.OTEL_LOG_LE
 })();
 
 // -------- endpoints & app resolution --------
-// Resolution order for endpoint/appId/apiKey: .securenow/credentials.json -> legacy env fallback -> package.json#name -> defaults.
+// Resolution order for endpoint/appId/apiKey: .securenow/credentials.json -> package.json#name -> defaults.
 const resolvedApp = appConfig.resolveAll();
 const resolvedEndpoints = appConfig.resolveEndpoints();
 
@@ -301,10 +285,10 @@ const headers = resolvedEndpoints.headers;
 const rawBase = (resolvedApp.appId || '').trim().replace(/^['"]|['"]$/g, '');
 const baseName = rawBase || null;
 // Auto-disables the per-worker suffix when we resolved a routing UUID from
-// credentials — the dashboard does exact-match IN on service.name, so any
+// credentials — the dashboard does exact-match IN on service.name, so any
 // suffix breaks routing. config.runtime.noUuid can override.
 const noUuid   = appConfig.resolveNoUuid();
-const strict   = String(env('SECURENOW_STRICT')) === '1' || String(env('SECURENOW_STRICT')).toLowerCase() === 'true';
+const strict   = appConfig.boolConfig('runtime.strict', false);
 const inPm2Cluster = !!(process.env.NODE_APP_INSTANCE || process.env.pm_id);
 
 // Fail fast in cluster if base is missing (no more "free" names)
@@ -328,7 +312,7 @@ const instancePrefix   = baseName || 'securenow';
 const serviceInstanceId = `${instancePrefix}-${randomUUID()}`;
 
 // Loud line per worker to prove what was used
-console.log('[securenow] pid=%d appId=%s instance=%s apiKey=%s → service.name=%s instance.id=%s',
+console.log('[securenow] pid=%d appId=%s instance=%s apiKey=%s → service.name=%s instance.id=%s',
   process.pid,
   JSON.stringify(baseName),
   JSON.stringify(endpointBase),
@@ -339,18 +323,18 @@ console.log('[securenow] pid=%d appId=%s instance=%s apiKey=%s → service.name=
 
 // -------- instrumentations --------
 const disabledMap = {};
-for (const n of (env('SECURENOW_DISABLE_INSTRUMENTATIONS') || '').split(',').map(s => s.trim()).filter(Boolean)) {
+for (const n of appConfig.listConfig('otel.disableInstrumentations')) {
   disabledMap[n] = { enabled: false };
 }
 
 // -------- Body Capture Configuration --------
 // Opt-out defaults: set config.capture.body=false to disable.
-const captureBody = !/^(0|false)$/i.test(String(env('SECURENOW_CAPTURE_BODY') ?? ''));
-const maxBodySize = Math.max(1024, parseInt(env('SECURENOW_MAX_BODY_SIZE'), 10) || 10240);
-const customSensitiveFields = (env('SECURENOW_SENSITIVE_FIELDS') || '').split(',').map(s => s.trim()).filter(Boolean);
+const captureBody = appConfig.boolConfig('capture.body', true);
+const maxBodySize = appConfig.numberConfig('capture.maxBodySize', 10240, 1024);
+const customSensitiveFields = appConfig.listConfig('capture.sensitiveFields');
 const allSensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...customSensitiveFields];
 
-const captureMultipart = !/^(0|false)$/i.test(String(env('SECURENOW_CAPTURE_MULTIPART') ?? ''));
+const captureMultipart = appConfig.boolConfig('capture.multipart', true);
 
 const BODY_CAPTURE_PATCH = Symbol.for('securenow.bodyCapture.emitPatch');
 
@@ -370,7 +354,7 @@ function installRequestBodyObserver(span, request, contentType) {
   if (isMultipartBody && !captureMultipart) {
     span.setAttribute('http.request.body', '[MULTIPART - NOT CAPTURED]');
     span.setAttribute('http.request.body.type', 'multipart');
-    span.setAttribute('http.request.body.note', 'Multipart capture disabled (SECURENOW_CAPTURE_MULTIPART=0)');
+    span.setAttribute('http.request.body.note', 'Multipart capture disabled by config.capture.multipart=false');
     return;
   }
 
@@ -537,8 +521,8 @@ const httpInstrumentation = new HttpInstrumentation({
 });
 
 // -------- Logging Configuration --------
-// Opt-out default: set =0 or =false to disable.
-const loggingEnabled = !/^(0|false)$/i.test(String(env('SECURENOW_LOGGING_ENABLED') ?? ''));
+// Opt-out default: set config.logging.enabled=false to disable.
+const loggingEnabled = appConfig.boolConfig('logging.enabled', true);
 
 // Create shared resource for both traces and logs
 const sharedResource = createResource({
@@ -615,9 +599,9 @@ process.on('uncaughtException', (err, origin) => {
     if (diagLevel === 'debug') {
       console.debug('[securenow] Suppressed transient OTLP exporter error (%s): %s', origin, err.message);
     }
-    return; // swallow — do not crash
+    return; // swallow — do not crash
   }
-  // Not ours — re-throw so the default handler (or the app's own handler) fires
+  // Not ours — re-throw so the default handler (or the app's own handler) fires
   throw err;
 });
 process.on('unhandledRejection', (reason) => {
@@ -627,7 +611,7 @@ process.on('unhandledRejection', (reason) => {
     }
     return; // swallow
   }
-  // Not ours — re-throw as unhandled so Node's default behaviour applies
+  // Not ours — re-throw as unhandled so Node's default behaviour applies
   throw reason;
 });
 
@@ -651,19 +635,19 @@ const sdk = new NodeSDK({
 (async () => {
   try {
     await Promise.resolve(sdk.start?.());
-    console.log('[securenow] OTel SDK started → %s', tracesUrl);
+    console.log('[securenow] OTel SDK started → %s', tracesUrl);
     if (loggingEnabled) {
-      console.log('[securenow] 📋 Logging: ENABLED → %s', logsUrl);
+      console.log('[securenow] 📋 Logging: ENABLED → %s', logsUrl);
     } else {
       console.log('[securenow] Logging: DISABLED (config.logging.enabled=false)');
     }
     if (captureBody) {
-      console.log('[securenow] 📝 Request body capture: ENABLED (max: %d bytes, redacting %d sensitive fields)', maxBodySize, allSensitiveFields.length);
+      console.log('[securenow] 📝 Request body capture: ENABLED (max: %d bytes, redacting %d sensitive fields)', maxBodySize, allSensitiveFields.length);
     }
     if (captureMultipart) {
-      console.log('[securenow] 📎 Multipart body capture: ENABLED (streaming — file content not buffered)');
+      console.log('[securenow] 📎 Multipart body capture: ENABLED (streaming — file content not buffered)');
     }
-    if (String(env('SECURENOW_TEST_SPAN')) === '1') {
+    if (appConfig.boolConfig('runtime.testSpan', false)) {
       const api = require('@opentelemetry/api');
       const tracer = api.trace.getTracer('securenow-smoke');
       const span = tracer.startSpan('securenow.startup.smoke'); span.end();
@@ -671,13 +655,13 @@ const sdk = new NodeSDK({
 
     // Free trial banner
     const { isFreeTrial, patchHttpForBanner } = require('./free-trial-banner');
-    if (isFreeTrial(endpointBase) && String(env('SECURENOW_HIDE_BANNER')) !== '1') {
+    if (isFreeTrial(endpointBase) && !appConfig.boolConfig('runtime.hideBanner', false)) {
       patchHttpForBanner();
     }
 
-    // Firewall — auto-activates only when a real snk_live_ key is resolvable.
+    // Firewall — auto-activates only when a real snk_live_ key is resolvable.
     // resolveApiKey() enforces the prefix, so we skip cleanly when the app has
-    // only an app-routing UUID (or nothing at all) — no 401 polling loops.
+    // only an app-routing UUID (or nothing at all) — no 401 polling loops.
     const firewallOptions = appConfig.resolveFirewallOptions();
     if (firewallOptions.apiKey && firewallOptions.enabled) {
       require('./firewall').init({