securenow 8.11.3 → 8.12.0

package/README.md

@@ -210,9 +210,9 @@ Everything the MCP server can do is also a command. Run `npx securenow help` for
 
 ---
 
-## Free firewall
+## Firewall
 
-The free tier includes the in-process IP firewall — no tracing required:
+The in-process IP firewall is included in SecureNow (14-day free trial, then $99 per app per month). It runs on its own, no tracing required:
 
 ```bash
 npx securenow run --firewall-only src/index.js
@@ -220,7 +220,7 @@ npx securenow run --firewall-only src/index.js
 node -r securenow/firewall-only src/index.js
 ```
 
-It syncs your app's blocklist plus SecureNow's IP database of 500k+ known-bad IPs, refreshed hourly, and blocks in-process with HTTP 403. No proxies, no DNS changes, no network configuration — and it fails open.
+It syncs your app's blocklist plus SecureNow's known-bad IP feed, refreshed hourly, and blocks in-process with HTTP 403. No proxies, no DNS changes, no network configuration — and it fails open.
 
 ---
 
@@ -239,12 +239,11 @@ More at [securenow.ai/security](https://securenow.ai/security).
 
 ## Pricing
 
-14-day free trial. No credit card. Full product.
+One plan: **$99 per app per month**, every feature included — detection, MCP, AI investigations, traces and logs, custom detections, blocking, rate limits, alerts, and the firewall.
 
-- **Free** — $0: local AI security audit, IP intelligence, basic firewall with 500k+ known-bad IPs refreshed hourly, CLI
-- **Pro** — $49/app/mo: full production security — detection, MCP, AI investigations, traces/logs, custom detections, blocking, rate limits, alerts, 7-day history
-- **Team** — $149/mo: 5 apps, 30-day history, team features
-- **Scale** — custom: dedicated isolated instance
+- **Billed per app.** Your subscription quantity is the number of apps on the account (minimum 1). Creating an app adds $99/month, prorated; deleting one removes it. It's automatic.
+- **14-day free trial** for the whole account, every feature, no credit card.
+- **No free tier.** After the trial, everything pauses until you subscribe, including the firewall (the known-bad IP feed and blocklist sync stop being served).
 
 Details at [securenow.ai](https://securenow.ai/). Full CLI/SDK reference: `npx securenow help` plus the `SKILL-CLI.md` and `SKILL-API.md` files shipped in this package.
 

package/SKILL-API.md

@@ -590,7 +590,6 @@ Local development uses `.securenow/runtime.json`; legacy `.securenow/credentials
 | `config.runtime.noUuid` | Use exact app key as service name without UUID suffix |
 | `config.runtime.strict` | Exit clustered workers when no app identity resolves |
 | `config.runtime.testSpan` | Emit a startup test span |
-| `config.runtime.hideBanner` | Suppress the free-trial upgrade banner |
 | `config.firewall.*` | Local firewall behavior, API URL, intervals, cloud WAF, and trusted proxy settings |
 
 **Resilience:** The firewall SDK includes a circuit breaker (opens after 5 consecutive errors, 2-min cooldown), in-flight request guards (prevents overlapping requests), 429 Retry-After support, and exponential backoff on both lightweight ETag checks and initial sync retries.

package/SKILL-CLI.md

@@ -639,7 +639,8 @@ All commands support `--json` for structured output. When piping to other tools
 |------------------|---------|----------|
 | `Session expired` | Admin JWT expired | `securenow admin login` (or `admin login --global` for shared admin auth) |
 | `Not logged in` | No admin token found | `securenow admin login`; runtime `.securenow/runtime.json` is unrelated |
-| `Access denied (403)` | Insufficient plan or permissions | Upgrade plan or check user role |
+| `Access denied (403)` | Insufficient permissions | Check the user's role in the account/organization |
+| `HTTP 402` | The 14-day trial ended and the account has no active subscription (everything, including the firewall, is paused) | Subscribe in the dashboard: $99 per app per month, every feature included |
 | `Cannot connect` | API unreachable | Check `securenow config get apiUrl` or network |
 | `Unknown command` | Typo or unrecognized command | `securenow help` |
 

package/app-config.js

@@ -17,9 +17,13 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 
-const FREE_TRIAL_INSTANCE = 'https://ingest.securenow.ai';
+// Shared SecureNow Cloud ingestion gateway (production collector for every
+// paying account and for the 14-day trial).
+const SECURENOW_CLOUD_INGEST = 'https://ingest.securenow.ai';
+// Deprecated alias kept for consumers of securenow/app-config.
+const FREE_TRIAL_INSTANCE = SECURENOW_CLOUD_INGEST;
 const DEFAULT_API_URL = 'https://api.securenow.ai';
-const DEFAULT_FIREWALL_API_URL = FREE_TRIAL_INSTANCE;
+const DEFAULT_FIREWALL_API_URL = SECURENOW_CLOUD_INGEST;
 const LEGACY_SECURENOW_GATEWAY = 'https://api.securenow.ai/api/otlp';
 const CONFIG_SCHEMA_VERSION = 2;
 const CREDENTIAL_FILE_ENVIRONMENTS = Object.freeze([
@@ -58,7 +62,6 @@ const DEFAULT_CONFIG = Object.freeze({
     noUuid: null,
     strict: false,
     testSpan: false,
-    hideBanner: false,
   },
   firewall: {
     enabled: true,
@@ -112,7 +115,6 @@ const CONFIG_EXPLANATIONS = Object.freeze({
   'config.runtime.noUuid': 'null means auto: true when app.key is present. Set true/false only for advanced routing needs.',
   'config.runtime.strict': 'If true, PM2/cluster workers exit when no app identity is resolvable.',
   'config.runtime.testSpan': 'If true, emit a startup smoke span. Prefer `npx securenow test-span` for manual checks.',
-  'config.runtime.hideBanner': 'Hide the free-trial response banner when using the managed free-trial collector.',
   'config.firewall.enabled': 'Deprecated local hint. Runtime firewall enforcement is controlled by the SecureNow dashboard/API app environment toggle; the SDK starts sync whenever apiKey is present.',
   'config.firewall.apiUrl': 'Optional SecureNow firewall control-plane base URL. Leave unset/default so hosted SDKs sync through the SecureNow ingest gateway.',
   'config.firewall.versionCheckInterval': 'Seconds between lightweight firewall version/ETag checks.',
@@ -440,13 +442,13 @@ function normalizeInstanceEndpoint(value) {
   if (value === undefined || value === null || value === '') return value;
   const endpoint = String(value).trim().replace(/\/$/, '');
   if (!endpoint) return endpoint;
-  if (endpoint === LEGACY_SECURENOW_GATEWAY) return FREE_TRIAL_INSTANCE;
+  if (endpoint === LEGACY_SECURENOW_GATEWAY) return SECURENOW_CLOUD_INGEST;
 
   try {
     const parseable = /^[a-z][a-z0-9+.-]*:\/\//i.test(endpoint) ? endpoint : `https://${endpoint}`;
     const url = new URL(parseable);
     if (url.port === '4318' && url.hostname.toLowerCase().endsWith('.securenow.ai')) {
-      return FREE_TRIAL_INSTANCE;
+      return SECURENOW_CLOUD_INGEST;
     }
   } catch {}
 
@@ -626,7 +628,7 @@ function resolveApiKey() {
 function resolveInstance() {
   const fromConfig = pick(resolveConfigPath('otel.endpoint'));
   if (fromConfig) return normalizeInstanceEndpoint(fromConfig);
-  return FREE_TRIAL_INSTANCE;
+  return SECURENOW_CLOUD_INGEST;
 }
 
 function resolveAll() {
@@ -725,6 +727,7 @@ function resolveFirewallOptions() {
 }
 
 module.exports = {
+  SECURENOW_CLOUD_INGEST,
   FREE_TRIAL_INSTANCE,
   DEFAULT_API_URL,
   DEFAULT_FIREWALL_API_URL,

package/cli/apps.js

@@ -4,11 +4,31 @@ const { api, requireAuth } = require('./client');
 const config = require('./config');
 const ui = require('./ui');
 
-const FREE_TRIAL_URL = 'https://ingest.securenow.ai';
+// Shared SecureNow Cloud collector (the production ingestion gateway).
+const SECURENOW_CLOUD_URL = 'https://ingest.securenow.ai';
+const SECURENOW_CLOUD_NAME = 'SecureNow Cloud';
 const DOMAIN_REGEX = /^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
 
 function instanceUrl(inst) {
-  return FREE_TRIAL_URL;
+  return SECURENOW_CLOUD_URL;
+}
+
+function formatUsd(amount) {
+  const n = Number(amount);
+  if (!Number.isFinite(n)) return null;
+  return Number.isInteger(n) ? `$${n}` : `$${n.toFixed(2)}`;
+}
+
+// POST /applications and /applications/bulk return `billing` for the account.
+// Per-app subscribers pay for every app, so tell them the new monthly total.
+// Human mode only: --json output stays exactly what it was.
+function printBillingNotice(billing, flags) {
+  if (!billing || !billing.isPerAppSubscriber || (flags && flags.json)) return;
+  const count = Number(billing.appCount) || 0;
+  const price = formatUsd(billing.perAppPrice) || '$99';
+  const total = formatUsd(billing.estimatedMonthlyTotal);
+  const totalText = total ? ` → ${total}/month` : '';
+  ui.info(`Billing: this account now has ${count} app${count !== 1 ? 's' : ''}${totalText} (${price}/app, prorated).`);
 }
 
 async function fetchInstanceMap() {
@@ -51,7 +71,7 @@ async function list(args, flags) {
     const rows = apps.map(app => {
       const inst = app.instanceId ? instMap[app.instanceId] : null;
       const url = instanceUrl(inst);
-      const instLabel = inst ? `${inst.name} ${ui.c.dim(url)}` : `${ui.c.green('Free Trial')} ${ui.c.dim(url)}`;
+      const instLabel = inst ? `${inst.name} ${ui.c.dim(url)}` : `${ui.c.green(SECURENOW_CLOUD_NAME)} ${ui.c.dim(url)}`;
       return [
         app.name + (app.key === defaultApp ? ui.c.cyan(' (default)') : ''),
         ui.c.dim(app.key),
@@ -120,7 +140,7 @@ async function create(args, flags) {
       ['Name', app.name],
       ['Key', ui.c.green(ui.c.bold(app.key))],
       ['ID', ui.c.dim(app._id)],
-      ['Instance', inst ? `${inst.name} ${ui.c.dim(`(${envUrl})`)}` : `${ui.c.green('Free Trial')} ${ui.c.dim(`(${envUrl})`)}`],
+      ['Instance', inst ? `${inst.name} ${ui.c.dim(`(${envUrl})`)}` : `${ui.c.green(SECURENOW_CLOUD_NAME)} ${ui.c.dim(`(${envUrl})`)}`],
       ['Hosts', app.hosts?.length ? app.hosts.join(', ') : ui.c.dim('none')],
     ]);
 
@@ -130,6 +150,11 @@ async function create(args, flags) {
     console.log(`  ${ui.c.dim('(writes .securenow/runtime.json - no env var needed)')}`);
     console.log('');
 
+    if (!flags.json && result.billing?.isPerAppSubscriber) {
+      printBillingNotice(result.billing, flags);
+      console.log('');
+    }
+
     if (flags.json) {
       ui.json({ ...app, instanceUrl: envUrl });
     }
@@ -155,9 +180,9 @@ async function pickInstance() {
     return null;
   }
 
-  const FREE_TRIAL_LABEL = `${ui.c.green('Free Trial')} ${ui.c.dim('— SecureNow managed instance (no setup needed)')}`;
+  const CLOUD_LABEL = `${ui.c.green(SECURENOW_CLOUD_NAME)} ${ui.c.dim('— managed collector, no setup needed')}`;
 
-  const choices = [{ label: FREE_TRIAL_LABEL, value: null }];
+  const choices = [{ label: CLOUD_LABEL, value: null }];
 
   for (const inst of instances) {
     const status = inst.status === 'active' ? ui.c.green('●') : ui.c.red('●');
@@ -233,7 +258,7 @@ async function info(args, flags) {
     ui.keyValue([
       ['Key', ui.c.bold(app.key)],
       ['ID', ui.c.dim(app._id)],
-      ['Instance', inst ? `${inst.name} ${ui.c.dim(`(${envUrl})`)}` : `${ui.c.green('Free Trial')} ${ui.c.dim(`(${envUrl})`)}`],
+      ['Instance', inst ? `${inst.name} ${ui.c.dim(`(${envUrl})`)}` : `${ui.c.green(SECURENOW_CLOUD_NAME)} ${ui.c.dim(`(${envUrl})`)}`],
       ['Hosts', app.hosts?.length ? app.hosts.join(', ') : ui.c.dim('none')],
       ['Created', app.createdAt ? new Date(app.createdAt).toLocaleString() : '—'],
       ['Updated', app.updatedAt ? new Date(app.updatedAt).toLocaleString() : '—'],
@@ -295,7 +320,7 @@ async function setDefault(args) {
       name: app.name || null,
     });
     ui.success(`Default application set to ${ui.c.bold(app.name || key)}`);
-    ui.info(`SDK will use ${ui.c.dim(FREE_TRIAL_URL)} for telemetry; the gateway routes by app key.`);
+    ui.info(`SDK will use ${ui.c.dim(SECURENOW_CLOUD_URL)} for telemetry; the gateway routes by app key.`);
   } catch {
     // If we can't reach the API (offline / invalid key), still set the CLI default.
     ui.success(`Default application set to ${ui.c.bold(key)}`);
@@ -418,6 +443,7 @@ async function discoverAndAdd(domains, instanceId, flags) {
       ]);
       ui.table(['Name', 'Key', 'Hosts'], rows);
     }
+    printBillingNotice(result.billing, flags);
     console.log('');
   } catch (err) {
     createSpinner.fail('Failed to create applications');
@@ -535,6 +561,7 @@ async function scan(args, flags) {
         });
         totalCreated = result.count || subdomainNames.length;
         createSpinner.stop(`Created ${totalCreated} application${totalCreated !== 1 ? 's' : ''}`);
+        printBillingNotice(result.billing, flags);
       } catch (err) {
         createSpinner.fail('Failed to create applications');
         throw err;
@@ -564,6 +591,7 @@ async function scan(args, flags) {
         });
         totalCreated = result.count || selected.length;
         createSpinner.stop(`Created ${totalCreated} application${totalCreated !== 1 ? 's' : ''}`);
+        printBillingNotice(result.billing, flags);
       } catch (err) {
         createSpinner.fail('Failed to create applications');
         throw err;

package/cli/diagnostics.js

@@ -497,7 +497,7 @@ async function doctor(_args, flags) {
   } else if (cfg.instance === 'https://api.securenow.ai/api/otlp') {
     warnings.push('Using the legacy SecureNow telemetry gateway path. Regenerate credentials so telemetry uses https://ingest.securenow.ai.');
   } else if (cfg.instance === 'https://freetrial.securenow.ai:4318') {
-    warnings.push('Using the legacy free-trial collector directly. Regenerate credentials so telemetry flows through https://ingest.securenow.ai.');
+    warnings.push('Using the legacy SecureNow Cloud collector address directly. Regenerate credentials so telemetry flows through https://ingest.securenow.ai.');
   }
   if (!cfg.apiKey && token) {
     warnings.push('Admin CLI/MCP auth is connected, but the runtime API key is missing. Run `npx securenow app connect` or `npx securenow api-key create` to refresh .securenow/runtime.json.');

package/mcp/catalog.js

@@ -209,7 +209,7 @@ const TOOLS = [
   {
     name: 'securenow_apps_create',
     title: 'Create Application',
-    description: 'Create a SecureNow application. Write action; requires confirmation.',
+    description: 'Create a SecureNow application. Write action; requires confirmation. Each app is billed $99/month on subscribed accounts (free during the 14-day trial). Confirm with the user before creating apps.',
     scope: 'applications:write',
     readOnly: false,
     confirm: true,

package/nextjs.js

@@ -268,7 +268,6 @@ function registerSecureNow(options = {}) {
 
     // -------- Endpoint Configuration --------
     const resolvedEndpoints = appConfig.resolveEndpoints({ endpoint: options.endpoint || resolvedApp.instance });
-    const endpointBase = resolvedEndpoints.endpointBase;
     const tracesUrl = resolvedEndpoints.tracesUrl;
     const logsUrl = resolvedEndpoints.logsUrl;
     const headers = resolvedEndpoints.headers;
@@ -704,14 +703,6 @@ function registerSecureNow(options = {}) {
 
     isRegistered = true;
 
-    // Free trial banner (optional - may not be bundled in standalone builds)
-    try {
-      const { isFreeTrial, patchHttpForBanner } = requireRuntimeModule('./free-trial-banner');
-      if (isFreeTrial(endpointBase) && !appConfig.boolConfig('runtime.hideBanner', false)) {
-        patchHttpForBanner();
-      }
-    } catch (_) {}
-
     console.log('[securenow] OpenTelemetry started for Next.js -> %s', tracesUrl);
     console.log('[securenow] Auto-capturing comprehensive request metadata:');
     console.log('[securenow]    - IP addresses (x-forwarded-for, x-real-ip, socket)');

package/nuxt-server-plugin.mjs

@@ -196,7 +196,6 @@ export default defineNitroPlugin(async (nitroApp) => {
 
   // ── Endpoints ──
   const resolvedEndpoints = appConfig.resolveEndpoints({ endpoint: opts.endpoint || resolvedApp.instance });
-  const endpointBase = resolvedEndpoints.endpointBase;
   const tracesUrl = resolvedEndpoints.tracesUrl;
   const logsUrl = resolvedEndpoints.logsUrl;
   const headers = resolvedEndpoints.headers;
@@ -400,16 +399,6 @@ export default defineNitroPlugin(async (nitroApp) => {
     );
   }
 
-  // ── Free trial banner ──
-  try {
-    const { isFreeTrial, patchHttpForBanner } = await import('./free-trial-banner.js');
-    if (isFreeTrial(endpointBase) && !appConfig.boolConfig('runtime.hideBanner', false)) {
-      patchHttpForBanner();
-    }
-  } catch {
-    // not critical
-  }
-
   // ── Firewall — runs independently from OTel ──
   const firewallOptions = appConfig.resolveFirewallOptions();
   if (firewallOptions.apiKey) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.11.3",
+  "version": "8.12.0",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",
@@ -153,7 +153,6 @@
     "cli.js",
     "cli/",
     "mcp/",
-    "free-trial-banner.js",
     "resolve-ip.js",
     "cidr.js",
     "firewall.js",

package/tracing.js

@@ -792,12 +792,6 @@ const sdk = new NodeSDK({
       const span = tracer.startSpan('securenow.startup.smoke'); span.end();
     }
 
-    // Free trial banner
-    const { isFreeTrial, patchHttpForBanner } = require('./free-trial-banner');
-    if (isFreeTrial(endpointBase) && !appConfig.boolConfig('runtime.hideBanner', false)) {
-      patchHttpForBanner();
-    }
-
     // Firewall — auto-activates only when a real snk_live_ key is resolvable.
     // resolveApiKey() enforces the prefix, so we skip cleanly when the app has
     // only an app-routing UUID (or nothing at all) — no 401 polling loops.

package/web-vite.mjs

@@ -24,7 +24,6 @@ const DEFAULT_BROWSER_CONFIG = Object.freeze({
       noUuid: null,
       strict: false,
       testSpan: false,
-      hideBanner: false,
     },
   },
 });
@@ -258,84 +257,9 @@ export function startSecurenowWeb() {
   console.log('[securenow] Web OTel started → %s', tracesUrl);
 }
 
-// ---- Free trial banner (browser DOM injection) ----
-function injectFreeTrialBanner() {
-  const FREE_TRIAL_HOSTS = ['ingest.securenow.ai', 'freetrial.securenow.ai'];
-  const hideBanner = boolConfig('config.runtime.hideBanner', false);
-  if (hideBanner || !FREE_TRIAL_HOSTS.some(host => endpointBase.includes(host))) return;
-  if (typeof document === 'undefined') return;
-
-  function create() {
-    if (document.getElementById('sn-ft-banner')) return;
-
-    const d = document.createElement('div');
-    d.id = 'sn-ft-banner';
-    d.style.cssText =
-      'position:fixed;top:0;left:0;right:0;z-index:2147483647;' +
-      'background:#FEF3CD;color:#856404;padding:10px 16px;' +
-      'font-family:system-ui,-apple-system,sans-serif;font-size:13px;' +
-      'text-align:center;border-bottom:2px solid #FFE69C;' +
-      'display:flex;align-items:center;justify-content:center;gap:6px;' +
-      'box-shadow:0 2px 8px rgba(0,0,0,0.12)';
-
-    const icon = document.createElement('span');
-    icon.textContent = '\u26a0\ufe0f';
-    d.appendChild(icon);
-
-    const msg = document.createElement('span');
-    const strong = document.createElement('strong');
-    strong.textContent = 'Testing Environment:';
-    msg.appendChild(strong);
-    msg.appendChild(document.createTextNode(
-      ' Only add test applications. For production usage, '
-    ));
-
-    const link = document.createElement('a');
-    link.href = 'https://app.securenow.ai/dashboard/settings/instances';
-    link.target = '_blank';
-    link.rel = 'noopener';
-    link.style.cssText = 'color:#664D03;font-weight:600;text-decoration:underline';
-    link.textContent = 'create a new production instance';
-    msg.appendChild(link);
-    msg.appendChild(document.createTextNode('.'));
-    d.appendChild(msg);
-
-    const upgradeBtn = document.createElement('a');
-    upgradeBtn.href = 'https://app.securenow.ai/dashboard/settings/instances';
-    upgradeBtn.target = '_blank';
-    upgradeBtn.rel = 'noopener';
-    upgradeBtn.textContent = '\u26a1 Upgrade';
-    upgradeBtn.style.cssText =
-      'display:inline-flex;align-items:center;gap:4px;' +
-      'background:#D97706;color:#fff;padding:4px 12px;border-radius:4px;' +
-      'font-size:12px;font-weight:600;text-decoration:none;margin-left:10px;' +
-      'white-space:nowrap;transition:background 0.15s';
-    upgradeBtn.onmouseover = () => { upgradeBtn.style.background = '#B45309'; };
-    upgradeBtn.onmouseout = () => { upgradeBtn.style.background = '#D97706'; };
-    d.appendChild(upgradeBtn);
-
-    const close = document.createElement('button');
-    close.textContent = '\u00d7';
-    close.style.cssText =
-      'background:none;border:none;color:#856404;font-size:18px;' +
-      'cursor:pointer;margin-left:12px;padding:0 4px;line-height:1';
-    close.onclick = () => { d.style.display = 'none'; };
-    d.appendChild(close);
-
-    document.body.prepend(d);
-  }
-
-  if (document.readyState === 'loading') {
-    document.addEventListener('DOMContentLoaded', create);
-  } else {
-    create();
-  }
-}
-
 // Auto-start
 try {
   startSecurenowWeb();
-  injectFreeTrialBanner();
 } catch (e) {
   console.error('[securenow/web-vite] failed to start:', e);
 }

package/free-trial-banner.js

@@ -1,175 +0,0 @@
-'use strict';
-
-/**
- * Free Trial Banner — auto-injects a visible "Testing Environment" banner
- * into HTML pages served by apps using the SecureNow free trial instance.
- *
- * Opt-out: set config.runtime.hideBanner=true in .securenow/credentials.json
- */
-
-const FREE_TRIAL_HOSTS = ['ingest.securenow.ai', 'freetrial.securenow.ai'];
-
-function isFreeTrial(endpointBase) {
-  return !!endpointBase && FREE_TRIAL_HOSTS.some((host) => endpointBase.includes(host));
-}
-
-/* istanbul ignore next — runs in browser, not Node */
-function _bannerClientCode() {
-  if (window.__snBanner) return;
-  window.__snBanner = 1;
-
-  function create() {
-    if (document.getElementById('sn-ft-banner')) return;
-
-    var d = document.createElement('div');
-    d.id = 'sn-ft-banner';
-    d.style.cssText =
-      'position:fixed;top:0;left:0;right:0;z-index:2147483647;' +
-      'background:#FEF3CD;color:#856404;padding:10px 16px;' +
-      'font-family:system-ui,-apple-system,sans-serif;font-size:13px;' +
-      'text-align:center;border-bottom:2px solid #FFE69C;' +
-      'display:flex;align-items:center;justify-content:center;gap:6px;' +
-      'box-shadow:0 2px 8px rgba(0,0,0,0.12)';
-
-    var icon = document.createElement('span');
-    icon.textContent = '\u26a0\ufe0f';
-    d.appendChild(icon);
-
-    var msg = document.createElement('span');
-    var strong = document.createElement('strong');
-    strong.textContent = 'Testing Environment:';
-    msg.appendChild(strong);
-    msg.appendChild(document.createTextNode(
-      ' Only add test applications. For production usage, '
-    ));
-
-    var link = document.createElement('a');
-    link.href = 'https://app.securenow.ai/dashboard/settings/instances';
-    link.target = '_blank';
-    link.rel = 'noopener';
-    link.style.cssText = 'color:#664D03;font-weight:600;text-decoration:underline';
-    link.textContent = 'create a new production instance';
-    msg.appendChild(link);
-    msg.appendChild(document.createTextNode('.'));
-    d.appendChild(msg);
-
-    var upgradeBtn = document.createElement('a');
-    upgradeBtn.href = 'https://app.securenow.ai/dashboard/settings/instances';
-    upgradeBtn.target = '_blank';
-    upgradeBtn.rel = 'noopener';
-    upgradeBtn.textContent = '\u26a1 Upgrade';
-    upgradeBtn.style.cssText =
-      'display:inline-flex;align-items:center;gap:4px;' +
-      'background:#D97706;color:#fff;padding:4px 12px;border-radius:4px;' +
-      'font-size:12px;font-weight:600;text-decoration:none;margin-left:10px;' +
-      'white-space:nowrap;transition:background 0.15s';
-    upgradeBtn.onmouseover = function () { upgradeBtn.style.background = '#B45309'; };
-    upgradeBtn.onmouseout = function () { upgradeBtn.style.background = '#D97706'; };
-    d.appendChild(upgradeBtn);
-
-    var close = document.createElement('button');
-    close.textContent = '\u00d7';
-    close.style.cssText =
-      'background:none;border:none;color:#856404;font-size:18px;' +
-      'cursor:pointer;margin-left:12px;padding:0 4px;line-height:1';
-    close.onclick = function () { d.style.display = 'none'; };
-    d.appendChild(close);
-
-    document.body.prepend(d);
-  }
-
-  if (document.readyState === 'loading') {
-    document.addEventListener('DOMContentLoaded', create);
-  } else {
-    create();
-  }
-}
-
-var BANNER_SCRIPT =
-  '<script data-securenow-banner>(' +
-  _bannerClientCode.toString() +
-  ')()</scr' + 'ipt>';
-
-/**
- * Monkey-patch http.ServerResponse to inject the banner script into HTML
- * responses. Searches for `<head...>` and inserts the script right after it.
- * Skips compressed responses and non-HTML content types.
- */
-function patchHttpForBanner() {
-  try {
-    var nodeRequire = typeof __non_webpack_require__ === 'function' ? __non_webpack_require__ : eval('require');
-    var http = nodeRequire('node:http');
-    var _origWrite = http.ServerResponse.prototype.write;
-    var _origEnd   = http.ServerResponse.prototype.end;
-
-    function maybeInject(res, chunk) {
-      if (res._snBannerDone || !chunk) return chunk;
-
-      if (res._snIsHtml === undefined) {
-        var ct = res.getHeader('content-type');
-        var ce = res.getHeader('content-encoding');
-        var csp = res.getHeader('content-security-policy');
-        res._snIsHtml = !!(ct && String(ct).includes('text/html') && !ce && !csp);
-      }
-      if (!res._snIsHtml) {
-        res._snBannerDone = true;
-        return chunk;
-      }
-
-      var isStr = typeof chunk === 'string';
-      var isBuf = Buffer.isBuffer(chunk);
-      if (!isStr && !isBuf) return chunk;
-
-      var str = isStr ? chunk : chunk.toString('utf8');
-      var headIdx = str.indexOf('<head');
-      if (headIdx === -1) return chunk;
-
-      var gt = str.indexOf('>', headIdx);
-      if (gt === -1) return chunk;
-
-      res._snBannerDone = true;
-      var result = str.slice(0, gt + 1) + BANNER_SCRIPT + str.slice(gt + 1);
-      return isStr ? result : Buffer.from(result, 'utf8');
-    }
-
-    http.ServerResponse.prototype.write = function (chunk, encoding, cb) {
-      try {
-        var modified = maybeInject(this, chunk);
-        if (modified !== chunk) {
-          var enc = typeof encoding === 'function' ? 'utf8' : encoding;
-          var callback = typeof encoding === 'function' ? encoding : cb;
-          try {
-            if (this.getHeader('content-length')) {
-              this.setHeader('content-length', Buffer.byteLength(modified));
-            }
-          } catch (_) { /* headers already sent */ }
-          return _origWrite.call(this, modified, enc, callback);
-        }
-      } catch (_) { /* never break the app */ }
-      return _origWrite.call(this, chunk, encoding, cb);
-    };
-
-    http.ServerResponse.prototype.end = function (chunk, encoding, cb) {
-      try {
-        var modified = maybeInject(this, chunk);
-        if (modified !== chunk) {
-          var enc = typeof encoding === 'function' ? 'utf8' : encoding;
-          var callback = typeof encoding === 'function' ? encoding : cb;
-          try {
-            if (this.getHeader('content-length')) {
-              this.setHeader('content-length', Buffer.byteLength(modified));
-            }
-          } catch (_) { /* headers already sent */ }
-          return _origEnd.call(this, modified, enc, callback);
-        }
-      } catch (_) { /* never break the app */ }
-      return _origEnd.call(this, chunk, encoding, cb);
-    };
-
-    console.log('[securenow] Free trial banner injection enabled');
-  } catch (err) {
-    console.warn('[securenow] Could not setup free trial banner:', err.message);
-  }
-}
-
-module.exports = { isFreeTrial, patchHttpForBanner, BANNER_SCRIPT };