securenow 8.11.2 → 8.12.0

package/TELEMETRY-SQL.md

@@ -81,10 +81,15 @@ Event properties are stored in the logs table:
 | `userId` | `attributes_string['enduser.id']` |
 | `sessionId` | `attributes_string['session.id']` |
 | `ip` | `attributes_string['http.client_ip']` |
-| `userAgent` | `attributes_string['http.user_agent']` |
+| `userAgent` | `attributes_string['user_agent.original']` (HTTP spans use `http.user_agent`) |
 | String custom attribute | `attributes_string['<key>']` |
 | Numeric custom attribute | `attributes_number['<key>']` |
 | Boolean custom attribute | `attributes_bool['<key>']` |
+| ASN of `ip` (when the instance has ASN enrichment) | `attributes_string['client.asn']`, `attributes_string['client.as_org']` |
+
+Custom attribute keys that start with a reserved prefix — `event.`, `enduser.`, `session.`, `http.`, `service.`, `securenow.`, `client.` — are stored as `attr.<key>`. Name custom attributes without those prefixes (`auth_method`, `device_hash`, …). Events carry the timestamp the sender supplied; there is no separate ingest time and no event ID.
+
+The logs `timestamp` is UInt64 nanoseconds: filter with `timestamp >= toUnixTimestamp64Nano(now64() - INTERVAL 15 MINUTE)`. `timestamp >= now() - INTERVAL …` is accepted by ClickHouse but always true on this table, so the rule would scan the whole retention period — the API rejects it on rule create/update.
 
 Never send raw passwords, tokens, OTPs, session secrets, email addresses, phone numbers, or other unnecessary personal data. Hash destinations when correlation is required.
 

package/app-config.js

@@ -17,9 +17,13 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 
-const FREE_TRIAL_INSTANCE = 'https://ingest.securenow.ai';
+// Shared SecureNow Cloud ingestion gateway (production collector for every
+// paying account and for the 14-day trial).
+const SECURENOW_CLOUD_INGEST = 'https://ingest.securenow.ai';
+// Deprecated alias kept for consumers of securenow/app-config.
+const FREE_TRIAL_INSTANCE = SECURENOW_CLOUD_INGEST;
 const DEFAULT_API_URL = 'https://api.securenow.ai';
-const DEFAULT_FIREWALL_API_URL = FREE_TRIAL_INSTANCE;
+const DEFAULT_FIREWALL_API_URL = SECURENOW_CLOUD_INGEST;
 const LEGACY_SECURENOW_GATEWAY = 'https://api.securenow.ai/api/otlp';
 const CONFIG_SCHEMA_VERSION = 2;
 const CREDENTIAL_FILE_ENVIRONMENTS = Object.freeze([
@@ -58,7 +62,6 @@ const DEFAULT_CONFIG = Object.freeze({
     noUuid: null,
     strict: false,
     testSpan: false,
-    hideBanner: false,
   },
   firewall: {
     enabled: true,
@@ -112,7 +115,6 @@ const CONFIG_EXPLANATIONS = Object.freeze({
   'config.runtime.noUuid': 'null means auto: true when app.key is present. Set true/false only for advanced routing needs.',
   'config.runtime.strict': 'If true, PM2/cluster workers exit when no app identity is resolvable.',
   'config.runtime.testSpan': 'If true, emit a startup smoke span. Prefer `npx securenow test-span` for manual checks.',
-  'config.runtime.hideBanner': 'Hide the free-trial response banner when using the managed free-trial collector.',
   'config.firewall.enabled': 'Deprecated local hint. Runtime firewall enforcement is controlled by the SecureNow dashboard/API app environment toggle; the SDK starts sync whenever apiKey is present.',
   'config.firewall.apiUrl': 'Optional SecureNow firewall control-plane base URL. Leave unset/default so hosted SDKs sync through the SecureNow ingest gateway.',
   'config.firewall.versionCheckInterval': 'Seconds between lightweight firewall version/ETag checks.',
@@ -440,13 +442,13 @@ function normalizeInstanceEndpoint(value) {
   if (value === undefined || value === null || value === '') return value;
   const endpoint = String(value).trim().replace(/\/$/, '');
   if (!endpoint) return endpoint;
-  if (endpoint === LEGACY_SECURENOW_GATEWAY) return FREE_TRIAL_INSTANCE;
+  if (endpoint === LEGACY_SECURENOW_GATEWAY) return SECURENOW_CLOUD_INGEST;
 
   try {
     const parseable = /^[a-z][a-z0-9+.-]*:\/\//i.test(endpoint) ? endpoint : `https://${endpoint}`;
     const url = new URL(parseable);
     if (url.port === '4318' && url.hostname.toLowerCase().endsWith('.securenow.ai')) {
-      return FREE_TRIAL_INSTANCE;
+      return SECURENOW_CLOUD_INGEST;
     }
   } catch {}
 
@@ -626,7 +628,7 @@ function resolveApiKey() {
 function resolveInstance() {
   const fromConfig = pick(resolveConfigPath('otel.endpoint'));
   if (fromConfig) return normalizeInstanceEndpoint(fromConfig);
-  return FREE_TRIAL_INSTANCE;
+  return SECURENOW_CLOUD_INGEST;
 }
 
 function resolveAll() {
@@ -725,6 +727,7 @@ function resolveFirewallOptions() {
 }
 
 module.exports = {
+  SECURENOW_CLOUD_INGEST,
   FREE_TRIAL_INSTANCE,
   DEFAULT_API_URL,
   DEFAULT_FIREWALL_API_URL,

package/cidr.js

@@ -1,83 +1,83 @@
-'use strict';
-
-/**
- * Bitmask-based CIDR matching. No regex on user input — prevents ReDoS.
- * All operations use unsigned 32-bit integers for IPv4 addresses.
- */
-
-function ipToInt(ip) {
-  const parts = ip.split('.');
-  if (parts.length !== 4) return null;
-  let result = 0;
-  for (let i = 0; i < 4; i++) {
-    const n = parseInt(parts[i], 10);
-    if (isNaN(n) || n < 0 || n > 255) return null;
-    result = (result << 8) + n;
-  }
-  return result >>> 0;
-}
-
-function parseCidr(cidr) {
-  const slash = cidr.indexOf('/');
-  if (slash === -1) return null;
-  const ip = cidr.slice(0, slash);
-  const bits = parseInt(cidr.slice(slash + 1), 10);
-  if (isNaN(bits) || bits < 0 || bits > 32) return null;
-  const network = ipToInt(ip);
-  if (network === null) return null;
-  const mask = bits === 0 ? 0 : (~((1 << (32 - bits)) - 1)) >>> 0;
-  return { network: (network & mask) >>> 0, mask };
-}
-
-function matchesCidr(ipInt, cidrEntry) {
-  return ((ipInt & cidrEntry.mask) >>> 0) === cidrEntry.network;
-}
-
-/**
- * Create a matcher from a list of IPs and CIDRs.
- * Returns { isBlocked(ip), stats() }.
- * Exact IPs use a Set for O(1) lookup; CIDRs use array scan (typically < 100 entries).
- */
-function createMatcher(ipList) {
-  const exactSet = new Set();
-  const cidrRanges = [];
-
-  for (const entry of ipList) {
-    const trimmed = (entry || '').trim();
-    if (!trimmed) continue;
-
-    if (trimmed.includes('/')) {
-      const parsed = parseCidr(trimmed);
-      if (parsed) cidrRanges.push(parsed);
-    } else {
-      const normalized = trimmed.replace(/^::ffff:/, '');
-      exactSet.add(normalized);
-    }
-  }
-
-  function isBlocked(ip) {
-    if (!ip) return false;
-    const normalized = ip.replace(/^::ffff:/, '');
-
-    if (exactSet.has(normalized)) return true;
-
-    if (cidrRanges.length > 0) {
-      const ipInt = ipToInt(normalized);
-      if (ipInt !== null) {
-        for (const cidr of cidrRanges) {
-          if (matchesCidr(ipInt, cidr)) return true;
-        }
-      }
-    }
-
-    return false;
-  }
-
-  function stats() {
-    return { exact: exactSet.size, cidr: cidrRanges.length, total: exactSet.size + cidrRanges.length };
-  }
-
-  return { isBlocked, stats };
-}
-
-module.exports = { ipToInt, parseCidr, matchesCidr, createMatcher };
+'use strict';
+
+/**
+ * Bitmask-based CIDR matching. No regex on user input — prevents ReDoS.
+ * All operations use unsigned 32-bit integers for IPv4 addresses.
+ */
+
+function ipToInt(ip) {
+  const parts = ip.split('.');
+  if (parts.length !== 4) return null;
+  let result = 0;
+  for (let i = 0; i < 4; i++) {
+    const n = parseInt(parts[i], 10);
+    if (isNaN(n) || n < 0 || n > 255) return null;
+    result = (result << 8) + n;
+  }
+  return result >>> 0;
+}
+
+function parseCidr(cidr) {
+  const slash = cidr.indexOf('/');
+  if (slash === -1) return null;
+  const ip = cidr.slice(0, slash);
+  const bits = parseInt(cidr.slice(slash + 1), 10);
+  if (isNaN(bits) || bits < 0 || bits > 32) return null;
+  const network = ipToInt(ip);
+  if (network === null) return null;
+  const mask = bits === 0 ? 0 : (~((1 << (32 - bits)) - 1)) >>> 0;
+  return { network: (network & mask) >>> 0, mask };
+}
+
+function matchesCidr(ipInt, cidrEntry) {
+  return ((ipInt & cidrEntry.mask) >>> 0) === cidrEntry.network;
+}
+
+/**
+ * Create a matcher from a list of IPs and CIDRs.
+ * Returns { isBlocked(ip), stats() }.
+ * Exact IPs use a Set for O(1) lookup; CIDRs use array scan (typically < 100 entries).
+ */
+function createMatcher(ipList) {
+  const exactSet = new Set();
+  const cidrRanges = [];
+
+  for (const entry of ipList) {
+    const trimmed = (entry || '').trim();
+    if (!trimmed) continue;
+
+    if (trimmed.includes('/')) {
+      const parsed = parseCidr(trimmed);
+      if (parsed) cidrRanges.push(parsed);
+    } else {
+      const normalized = trimmed.replace(/^::ffff:/, '');
+      exactSet.add(normalized);
+    }
+  }
+
+  function isBlocked(ip) {
+    if (!ip) return false;
+    const normalized = ip.replace(/^::ffff:/, '');
+
+    if (exactSet.has(normalized)) return true;
+
+    if (cidrRanges.length > 0) {
+      const ipInt = ipToInt(normalized);
+      if (ipInt !== null) {
+        for (const cidr of cidrRanges) {
+          if (matchesCidr(ipInt, cidr)) return true;
+        }
+      }
+    }
+
+    return false;
+  }
+
+  function stats() {
+    return { exact: exactSet.size, cidr: cidrRanges.length, total: exactSet.size + cidrRanges.length };
+  }
+
+  return { isBlocked, stats };
+}
+
+module.exports = { ipToInt, parseCidr, matchesCidr, createMatcher };

package/cli/apps.js

@@ -4,11 +4,31 @@ const { api, requireAuth } = require('./client');
 const config = require('./config');
 const ui = require('./ui');
 
-const FREE_TRIAL_URL = 'https://ingest.securenow.ai';
+// Shared SecureNow Cloud collector (the production ingestion gateway).
+const SECURENOW_CLOUD_URL = 'https://ingest.securenow.ai';
+const SECURENOW_CLOUD_NAME = 'SecureNow Cloud';
 const DOMAIN_REGEX = /^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
 
 function instanceUrl(inst) {
-  return FREE_TRIAL_URL;
+  return SECURENOW_CLOUD_URL;
+}
+
+function formatUsd(amount) {
+  const n = Number(amount);
+  if (!Number.isFinite(n)) return null;
+  return Number.isInteger(n) ? `$${n}` : `$${n.toFixed(2)}`;
+}
+
+// POST /applications and /applications/bulk return `billing` for the account.
+// Per-app subscribers pay for every app, so tell them the new monthly total.
+// Human mode only: --json output stays exactly what it was.
+function printBillingNotice(billing, flags) {
+  if (!billing || !billing.isPerAppSubscriber || (flags && flags.json)) return;
+  const count = Number(billing.appCount) || 0;
+  const price = formatUsd(billing.perAppPrice) || '$99';
+  const total = formatUsd(billing.estimatedMonthlyTotal);
+  const totalText = total ? ` → ${total}/month` : '';
+  ui.info(`Billing: this account now has ${count} app${count !== 1 ? 's' : ''}${totalText} (${price}/app, prorated).`);
 }
 
 async function fetchInstanceMap() {
@@ -51,7 +71,7 @@ async function list(args, flags) {
     const rows = apps.map(app => {
       const inst = app.instanceId ? instMap[app.instanceId] : null;
       const url = instanceUrl(inst);
-      const instLabel = inst ? `${inst.name} ${ui.c.dim(url)}` : `${ui.c.green('Free Trial')} ${ui.c.dim(url)}`;
+      const instLabel = inst ? `${inst.name} ${ui.c.dim(url)}` : `${ui.c.green(SECURENOW_CLOUD_NAME)} ${ui.c.dim(url)}`;
       return [
         app.name + (app.key === defaultApp ? ui.c.cyan(' (default)') : ''),
         ui.c.dim(app.key),
@@ -120,7 +140,7 @@ async function create(args, flags) {
       ['Name', app.name],
       ['Key', ui.c.green(ui.c.bold(app.key))],
       ['ID', ui.c.dim(app._id)],
-      ['Instance', inst ? `${inst.name} ${ui.c.dim(`(${envUrl})`)}` : `${ui.c.green('Free Trial')} ${ui.c.dim(`(${envUrl})`)}`],
+      ['Instance', inst ? `${inst.name} ${ui.c.dim(`(${envUrl})`)}` : `${ui.c.green(SECURENOW_CLOUD_NAME)} ${ui.c.dim(`(${envUrl})`)}`],
       ['Hosts', app.hosts?.length ? app.hosts.join(', ') : ui.c.dim('none')],
     ]);
 
@@ -130,6 +150,11 @@ async function create(args, flags) {
     console.log(`  ${ui.c.dim('(writes .securenow/runtime.json - no env var needed)')}`);
     console.log('');
 
+    if (!flags.json && result.billing?.isPerAppSubscriber) {
+      printBillingNotice(result.billing, flags);
+      console.log('');
+    }
+
     if (flags.json) {
       ui.json({ ...app, instanceUrl: envUrl });
     }
@@ -155,9 +180,9 @@ async function pickInstance() {
     return null;
   }
 
-  const FREE_TRIAL_LABEL = `${ui.c.green('Free Trial')} ${ui.c.dim('— SecureNow managed instance (no setup needed)')}`;
+  const CLOUD_LABEL = `${ui.c.green(SECURENOW_CLOUD_NAME)} ${ui.c.dim('— managed collector, no setup needed')}`;
 
-  const choices = [{ label: FREE_TRIAL_LABEL, value: null }];
+  const choices = [{ label: CLOUD_LABEL, value: null }];
 
   for (const inst of instances) {
     const status = inst.status === 'active' ? ui.c.green('●') : ui.c.red('●');
@@ -233,7 +258,7 @@ async function info(args, flags) {
     ui.keyValue([
       ['Key', ui.c.bold(app.key)],
       ['ID', ui.c.dim(app._id)],
-      ['Instance', inst ? `${inst.name} ${ui.c.dim(`(${envUrl})`)}` : `${ui.c.green('Free Trial')} ${ui.c.dim(`(${envUrl})`)}`],
+      ['Instance', inst ? `${inst.name} ${ui.c.dim(`(${envUrl})`)}` : `${ui.c.green(SECURENOW_CLOUD_NAME)} ${ui.c.dim(`(${envUrl})`)}`],
       ['Hosts', app.hosts?.length ? app.hosts.join(', ') : ui.c.dim('none')],
       ['Created', app.createdAt ? new Date(app.createdAt).toLocaleString() : '—'],
       ['Updated', app.updatedAt ? new Date(app.updatedAt).toLocaleString() : '—'],
@@ -295,7 +320,7 @@ async function setDefault(args) {
       name: app.name || null,
     });
     ui.success(`Default application set to ${ui.c.bold(app.name || key)}`);
-    ui.info(`SDK will use ${ui.c.dim(FREE_TRIAL_URL)} for telemetry; the gateway routes by app key.`);
+    ui.info(`SDK will use ${ui.c.dim(SECURENOW_CLOUD_URL)} for telemetry; the gateway routes by app key.`);
   } catch {
     // If we can't reach the API (offline / invalid key), still set the CLI default.
     ui.success(`Default application set to ${ui.c.bold(key)}`);
@@ -418,6 +443,7 @@ async function discoverAndAdd(domains, instanceId, flags) {
       ]);
       ui.table(['Name', 'Key', 'Hosts'], rows);
     }
+    printBillingNotice(result.billing, flags);
     console.log('');
   } catch (err) {
     createSpinner.fail('Failed to create applications');
@@ -535,6 +561,7 @@ async function scan(args, flags) {
         });
         totalCreated = result.count || subdomainNames.length;
         createSpinner.stop(`Created ${totalCreated} application${totalCreated !== 1 ? 's' : ''}`);
+        printBillingNotice(result.billing, flags);
       } catch (err) {
         createSpinner.fail('Failed to create applications');
         throw err;
@@ -564,6 +591,7 @@ async function scan(args, flags) {
         });
         totalCreated = result.count || selected.length;
         createSpinner.stop(`Created ${totalCreated} application${totalCreated !== 1 ? 's' : ''}`);
+        printBillingNotice(result.billing, flags);
       } catch (err) {
         createSpinner.fail('Failed to create applications');
         throw err;

package/cli/client.js

@@ -1,55 +1,55 @@
-'use strict';
-
-const https = require('https');
-const http = require('http');
-const { URL } = require('url');
-const config = require('./config');
-const ui = require('./ui');
-
-function buildQueryString(params) {
-  if (!params) return '';
-  const entries = Object.entries(params).filter(([, v]) => v != null && v !== '');
-  if (!entries.length) return '';
-  return '?' + entries.map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join('&');
-}
-
-function request(method, endpoint, { body, query, token, raw } = {}) {
-  const baseUrl = config.getApiUrl();
-  const qs = buildQueryString(query);
-  const urlStr = `${baseUrl}/api${endpoint}${qs}`;
-  const url = new URL(urlStr);
-  const mod = url.protocol === 'https:' ? https : http;
-
-  const authToken = token || config.getToken();
-
-  return new Promise((resolve, reject) => {
-    const options = {
-      hostname: url.hostname,
-      port: url.port || (url.protocol === 'https:' ? 443 : 80),
-      path: url.pathname + url.search,
-      method,
-      headers: { 'Content-Type': 'application/json', 'User-Agent': 'securenow-cli' },
-    };
-
-    if (authToken) {
-      options.headers['Authorization'] = `Bearer ${authToken}`;
-    }
-
-    const req = mod.request(options, (res) => {
-      let data = '';
-      res.on('data', (chunk) => (data += chunk));
-      res.on('end', () => {
-        if (raw) {
-          return resolve({ status: res.statusCode, headers: res.headers, body: data });
-        }
-
-        let parsed;
-        try {
-          parsed = JSON.parse(data);
-        } catch {
-          parsed = data;
-        }
-
+'use strict';
+
+const https = require('https');
+const http = require('http');
+const { URL } = require('url');
+const config = require('./config');
+const ui = require('./ui');
+
+function buildQueryString(params) {
+  if (!params) return '';
+  const entries = Object.entries(params).filter(([, v]) => v != null && v !== '');
+  if (!entries.length) return '';
+  return '?' + entries.map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join('&');
+}
+
+function request(method, endpoint, { body, query, token, raw } = {}) {
+  const baseUrl = config.getApiUrl();
+  const qs = buildQueryString(query);
+  const urlStr = `${baseUrl}/api${endpoint}${qs}`;
+  const url = new URL(urlStr);
+  const mod = url.protocol === 'https:' ? https : http;
+
+  const authToken = token || config.getToken();
+
+  return new Promise((resolve, reject) => {
+    const options = {
+      hostname: url.hostname,
+      port: url.port || (url.protocol === 'https:' ? 443 : 80),
+      path: url.pathname + url.search,
+      method,
+      headers: { 'Content-Type': 'application/json', 'User-Agent': 'securenow-cli' },
+    };
+
+    if (authToken) {
+      options.headers['Authorization'] = `Bearer ${authToken}`;
+    }
+
+    const req = mod.request(options, (res) => {
+      let data = '';
+      res.on('data', (chunk) => (data += chunk));
+      res.on('end', () => {
+        if (raw) {
+          return resolve({ status: res.statusCode, headers: res.headers, body: data });
+        }
+
+        let parsed;
+        try {
+          parsed = JSON.parse(data);
+        } catch {
+          parsed = data;
+        }
+
         if (res.statusCode === 401) {
           reject(new CLIError('Admin auth is missing or expired. Run `securenow admin login` to re-authenticate. Runtime app credentials are unrelated.', 401));
           return;
@@ -59,58 +59,58 @@ function request(method, endpoint, { body, query, token, raw } = {}) {
           reject(new CLIError(`${msg}. Admin auth is connected, but this user/plan may lack permission for this control-plane operation. Runtime app connection is unrelated.`, 403));
           return;
         }
-        if (res.statusCode >= 400) {
-          const msg = parsed?.error || parsed?.message || `Request failed (HTTP ${res.statusCode})`;
-          const details = parsed?.details || parsed?.unauthorizedKeys;
-          const err = new CLIError(details ? `${msg} — ${details}` : msg, res.statusCode);
-          reject(err);
-          return;
-        }
-
-        resolve(parsed);
-      });
-    });
-
-    req.on('error', (err) => {
-      if (err.code === 'ECONNREFUSED') {
-        reject(new CLIError(`Cannot connect to ${baseUrl}. Is the API server running?`));
-      } else if (err.code === 'ENOTFOUND') {
-        reject(new CLIError(`Cannot resolve ${url.hostname}. Check your internet connection.`));
-      } else {
-        reject(new CLIError(`Network error: ${err.message}`));
-      }
-    });
-
-    if (body) {
-      req.write(JSON.stringify(body));
-    }
-    req.end();
-  });
-}
-
-class CLIError extends Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.name = 'CLIError';
-    this.statusCode = statusCode;
-  }
-}
-
-function requireAuth() {
+        if (res.statusCode >= 400) {
+          const msg = parsed?.error || parsed?.message || `Request failed (HTTP ${res.statusCode})`;
+          const details = parsed?.details || parsed?.unauthorizedKeys;
+          const err = new CLIError(details ? `${msg} — ${details}` : msg, res.statusCode);
+          reject(err);
+          return;
+        }
+
+        resolve(parsed);
+      });
+    });
+
+    req.on('error', (err) => {
+      if (err.code === 'ECONNREFUSED') {
+        reject(new CLIError(`Cannot connect to ${baseUrl}. Is the API server running?`));
+      } else if (err.code === 'ENOTFOUND') {
+        reject(new CLIError(`Cannot resolve ${url.hostname}. Check your internet connection.`));
+      } else {
+        reject(new CLIError(`Network error: ${err.message}`));
+      }
+    });
+
+    if (body) {
+      req.write(JSON.stringify(body));
+    }
+    req.end();
+  });
+}
+
+class CLIError extends Error {
+  constructor(message, statusCode) {
+    super(message);
+    this.name = 'CLIError';
+    this.statusCode = statusCode;
+  }
+}
+
+function requireAuth() {
   const token = config.getToken();
   if (!token) {
     ui.error('Admin auth is not connected. Run `securenow admin login` first.');
     process.exit(1);
   }
-  return token;
-}
-
-const api = {
-  get: (endpoint, opts) => request('GET', endpoint, opts),
-  post: (endpoint, body, opts) => request('POST', endpoint, { body, ...opts }),
-  put: (endpoint, body, opts) => request('PUT', endpoint, { body, ...opts }),
-  patch: (endpoint, body, opts) => request('PATCH', endpoint, { body, ...opts }),
-  delete: (endpoint, opts) => request('DELETE', endpoint, opts),
-};
-
-module.exports = { api, CLIError, requireAuth, buildQueryString };
+  return token;
+}
+
+const api = {
+  get: (endpoint, opts) => request('GET', endpoint, opts),
+  post: (endpoint, body, opts) => request('POST', endpoint, { body, ...opts }),
+  put: (endpoint, body, opts) => request('PUT', endpoint, { body, ...opts }),
+  patch: (endpoint, body, opts) => request('PATCH', endpoint, { body, ...opts }),
+  delete: (endpoint, opts) => request('DELETE', endpoint, opts),
+};
+
+module.exports = { api, CLIError, requireAuth, buildQueryString };

package/cli/diagnostics.js

@@ -497,7 +497,7 @@ async function doctor(_args, flags) {
   } else if (cfg.instance === 'https://api.securenow.ai/api/otlp') {
     warnings.push('Using the legacy SecureNow telemetry gateway path. Regenerate credentials so telemetry uses https://ingest.securenow.ai.');
   } else if (cfg.instance === 'https://freetrial.securenow.ai:4318') {
-    warnings.push('Using the legacy free-trial collector directly. Regenerate credentials so telemetry flows through https://ingest.securenow.ai.');
+    warnings.push('Using the legacy SecureNow Cloud collector address directly. Regenerate credentials so telemetry flows through https://ingest.securenow.ai.');
   }
   if (!cfg.apiKey && token) {
     warnings.push('Admin CLI/MCP auth is connected, but the runtime API key is missing. Run `npx securenow app connect` or `npx securenow api-key create` to refresh .securenow/runtime.json.');
@@ -555,6 +555,10 @@ async function eventSend(args, flags) {
   if (Object.keys(attributes).length) ev.attributes = attributes;
 
   const headers = { 'Content-Type': 'application/json', ...cfg.headers };
+  // `--env` must win over the environment stored with the runtime credentials.
+  if ((flags.env || flags.environment) && cfg.deploymentEnvironment) {
+    headers['x-securenow-environment'] = cfg.deploymentEnvironment;
+  }
   const spin = ui.spinner(`Sending event to ${eventsEndpoint}`);
   try {
     const res = await httpRequest({ endpoint: eventsEndpoint, headers, body: JSON.stringify({ events: [ev] }) });