@retrivora-ai/rag-engine 2.0.4 → 2.0.5

package/dist/handlers/index.mjs

@@ -1239,7 +1239,7 @@ __export(QdrantProvider_exports, {
   QdrantProvider: () => QdrantProvider
 });
 import axios4 from "axios";
-import crypto from "crypto";
+import crypto2 from "crypto";
 var QdrantProvider;
 var init_QdrantProvider = __esm({
   "src/providers/vectordb/QdrantProvider.ts"() {
@@ -1471,7 +1471,7 @@ var init_QdrantProvider = __esm({
         if (typeof id === "number") return id;
         const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
         if (uuidRegex.test(id)) return id.toLowerCase();
-        const hash = crypto.createHash("md5").update(id).digest("hex");
+        const hash = crypto2.createHash("md5").update(id).digest("hex");
         return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-${hash.slice(12, 16)}-${hash.slice(16, 20)}-${hash.slice(20, 32)}`;
       }
       async disconnect() {
@@ -2058,6 +2058,285 @@ import { NextResponse } from "next/server";
 // src/core/ConfigResolver.ts
 init_templateUtils();
 
+// src/core/LicenseVerifier.ts
+import * as crypto from "crypto";
+
+// src/exceptions/index.ts
+var RetrivoraError = class extends Error {
+  constructor(message, code, details) {
+    super(message);
+    this.name = new.target.name;
+    this.code = code;
+    this.details = details;
+  }
+};
+var ProviderNotFoundException = class extends RetrivoraError {
+  constructor(providerType, provider, details) {
+    super(`Unsupported ${providerType} provider: ${provider}`, "PROVIDER_NOT_FOUND", details);
+  }
+};
+var EmbeddingFailedException = class extends RetrivoraError {
+  constructor(message = "Embedding generation failed", details) {
+    super(message, "EMBEDDING_FAILED", details);
+  }
+};
+var RetrievalException = class extends RetrivoraError {
+  constructor(message = "Retrieval failed", details) {
+    super(message, "RETRIEVAL_FAILED", details);
+  }
+};
+var RateLimitException = class extends RetrivoraError {
+  constructor(message = "Provider rate limit exceeded", details) {
+    super(message, "RATE_LIMITED", details);
+  }
+};
+var ConfigurationException = class extends RetrivoraError {
+  constructor(message, details) {
+    super(message, "CONFIGURATION_ERROR", details);
+  }
+};
+var AuthenticationException = class extends RetrivoraError {
+  constructor(message = "Provider authentication failed", details) {
+    super(message, "AUTHENTICATION_ERROR", details);
+  }
+};
+function wrapError(err, defaultCode, defaultMessage) {
+  var _a2;
+  if (err instanceof RetrivoraError) {
+    return err;
+  }
+  const error = err;
+  const message = (error == null ? void 0 : error.message) || defaultMessage || String(err);
+  const status = (error == null ? void 0 : error.status) || (error == null ? void 0 : error.statusCode) || ((_a2 = error == null ? void 0 : error.response) == null ? void 0 : _a2.status);
+  const code = error == null ? void 0 : error.code;
+  if (status === 429 || /rate[- ]?limit/i.test(message) || code === "RATE_LIMIT_EXCEEDED") {
+    return new RateLimitException(message, err);
+  }
+  if (status === 401 || status === 403 || /unauthorized|auth|api[- ]?key/i.test(message) || code === "INVALID_API_KEY") {
+    return new AuthenticationException(message, err);
+  }
+  switch (defaultCode) {
+    case "PROVIDER_NOT_FOUND":
+      return new ProviderNotFoundException("provider", message, err);
+    case "EMBEDDING_FAILED":
+      return new EmbeddingFailedException(message, err);
+    case "RETRIEVAL_FAILED":
+      return new RetrievalException(message, err);
+    case "RATE_LIMITED":
+      return new RateLimitException(message, err);
+    case "CONFIGURATION_ERROR":
+      return new ConfigurationException(message, err);
+    case "AUTHENTICATION_ERROR":
+      return new AuthenticationException(message, err);
+    default:
+      return new RetrivoraError(message, defaultCode, err);
+  }
+}
+
+// src/core/LicenseVerifier.ts
+var LicenseVerifier = class {
+  /**
+   * Decodes, verifies signature, and checks metadata of a license key.
+   *
+   * @param licenseKey - Base64url signed JWT license key.
+   * @param currentProjectId - Project namespace ID.
+   * @param publicKeyOverride - Optional override for unit/integration tests.
+   */
+  static verify(licenseKey, currentProjectId, provider, publicKeyOverride) {
+    const isProduction = process.env.NODE_ENV === "production";
+    const now = Date.now();
+    if (licenseKey) {
+      const cacheKey = `${licenseKey}:${currentProjectId}:${provider || ""}:${publicKeyOverride || ""}`;
+      const cached = this.cache.get(cacheKey);
+      if (cached && now - cached.cachedAt < this.CACHE_TTL_MS) {
+        const currentTimestampSec = Math.floor(now / 1e3);
+        if (cached.payload.expiresAt && currentTimestampSec > cached.payload.expiresAt) {
+          this.cache.delete(cacheKey);
+        } else {
+          return cached.payload;
+        }
+      }
+    }
+    if (!licenseKey) {
+      if (isProduction) {
+        throw new ConfigurationException(
+          "[Retrivora SDK] License key (licenseKey) is required in production environments."
+        );
+      }
+      console.warn(
+        `\x1B[33m[Retrivora SDK] WARNING: Running without a license key. This namespace (${currentProjectId}) is permitted for local development only.\x1B[0m`
+      );
+      return {
+        projectId: currentProjectId,
+        expiresAt: Math.floor(Date.now() / 1e3) + 86400,
+        // Valid for 24h
+        tier: "hobby"
+      };
+    }
+    try {
+      const parts = licenseKey.split(".");
+      if (parts.length !== 3) {
+        throw new Error("Malformed token structure (expected 3 parts).");
+      }
+      const [headerB64, payloadB64, signatureB64] = parts;
+      const dataToVerify = `${headerB64}.${payloadB64}`;
+      const publicKey = publicKeyOverride != null ? publicKeyOverride : this.PUBLIC_KEY;
+      const signature = Buffer.from(signatureB64, "base64url");
+      const data = Buffer.from(dataToVerify);
+      const isValid = crypto.verify(
+        "sha256",
+        data,
+        publicKey,
+        signature
+      );
+      if (!isValid) {
+        throw new Error("Signature verification failed.");
+      }
+      const payload = JSON.parse(
+        Buffer.from(payloadB64, "base64url").toString("utf8")
+      );
+      if (!payload.projectId) {
+        throw new Error('License payload is missing "projectId".');
+      }
+      if (payload.projectId !== currentProjectId) {
+        throw new Error(
+          `Project ID mismatch. License is bound to project namespace "${payload.projectId}" but configuration has "${currentProjectId}".`
+        );
+      }
+      if (!payload.expiresAt) {
+        throw new Error('License payload is missing expiration ("expiresAt").');
+      }
+      const currentTimestampSec = Math.floor(Date.now() / 1e3);
+      if (currentTimestampSec > payload.expiresAt) {
+        throw new Error(
+          `License key has expired. Expiration: ${new Date(
+            payload.expiresAt * 1e3
+          ).toDateString()}`
+        );
+      }
+      if (isProduction && provider) {
+        const tier = (payload.tier || "").toLowerCase();
+        const normalizedProvider = provider.toLowerCase();
+        if (tier === "hobby") {
+          const allowedHobby = ["postgresql", "pgvector", "supabase"];
+          if (!allowedHobby.includes(normalizedProvider)) {
+            throw new Error(
+              `The database provider "${provider}" is not allowed on the Hobby tier. Hobby tier is restricted to PostgreSQL and Supabase. Please upgrade to a Developer Pro or Enterprise plan.`
+            );
+          }
+        } else if (tier === "pro" || tier === "developer_pro" || tier === "premium" || tier === "growth" || tier === "free_trial" || tier === "free_tier" || tier === "free") {
+          const allowedPro = [
+            "postgresql",
+            "pgvector",
+            "supabase",
+            "pinecone",
+            "qdrant",
+            "mongodb",
+            "milvus",
+            "chroma",
+            "chromadb"
+          ];
+          if (!allowedPro.includes(normalizedProvider)) {
+            throw new Error(
+              `The database provider "${provider}" is not allowed on the Developer Pro tier. Please upgrade to an Enterprise plan.`
+            );
+          }
+        }
+      }
+      if (licenseKey) {
+        const cacheKey = `${licenseKey}:${currentProjectId}:${provider || ""}:${publicKeyOverride || ""}`;
+        this.cache.set(cacheKey, { payload, cachedAt: now });
+      }
+      return payload;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      throw new ConfigurationException(
+        `[Retrivora SDK] License key validation failed: ${message}`
+      );
+    }
+  }
+  static async verifyIP(licenseKey) {
+    if (!licenseKey) return;
+    try {
+      const parts = licenseKey.split(".");
+      if (parts.length !== 3) return;
+      const [, payloadB64] = parts;
+      const payload = JSON.parse(
+        Buffer.from(payloadB64, "base64url").toString("utf8")
+      );
+      const tier = (payload.tier || "").toLowerCase();
+      if (tier === "enterprise" || tier === "custom") {
+        return;
+      }
+      if (payload.ipv4 || payload.ipv6) {
+        let currentIpv4 = "";
+        let currentIpv6 = "";
+        try {
+          const res = await fetch("https://api4.ipify.org?format=json", { signal: AbortSignal.timeout(3e3) });
+          const data = await res.json();
+          currentIpv4 = data.ip;
+        } catch (e) {
+        }
+        try {
+          const res = await fetch("https://api6.ipify.org?format=json", { signal: AbortSignal.timeout(3e3) });
+          const data = await res.json();
+          currentIpv6 = data.ip;
+        } catch (e) {
+        }
+        const localIps = [];
+        try {
+          const osModule = __require("os");
+          const interfaces = osModule.networkInterfaces();
+          for (const name of Object.keys(interfaces)) {
+            for (const iface of interfaces[name] || []) {
+              if (!iface.internal) {
+                localIps.push(iface.address);
+              }
+            }
+          }
+        } catch (e) {
+        }
+        const isIpv4Match = payload.ipv4 && (currentIpv4 === payload.ipv4 || localIps.includes(payload.ipv4));
+        const isIpv6Match = payload.ipv6 && (currentIpv6 === payload.ipv6 || localIps.includes(payload.ipv6));
+        if (payload.ipv4 && payload.ipv6) {
+          if (!isIpv4Match && !isIpv6Match) {
+            throw new Error(
+              `License key access restricted. This license key was created for a different system (authorized IPv4: ${payload.ipv4}, IPv6: ${payload.ipv6}) and cannot be used on this machine.`
+            );
+          }
+        } else if (payload.ipv4 && !isIpv4Match) {
+          throw new Error(
+            `License key access restricted. This license key was created for a different system (authorized IPv4: ${payload.ipv4}) and cannot be used on this machine.`
+          );
+        } else if (payload.ipv6 && !isIpv6Match) {
+          throw new Error(
+            `License key access restricted. This license key was created for a different system (authorized IPv6: ${payload.ipv6}) and cannot be used on this machine.`
+          );
+        }
+      }
+    } catch (err) {
+      if (err.message.includes("License key access restricted")) {
+        throw new ConfigurationException(`[Retrivora SDK] ${err.message}`);
+      }
+    }
+  }
+};
+// A simple in-memory cache to save CPU overhead of cryptographic signature checks.
+LicenseVerifier.cache = /* @__PURE__ */ new Map();
+LicenseVerifier.CACHE_TTL_MS = 60 * 1e3;
+// Cache verified license for 60 seconds
+// Retrivora's Public Key used to verify the license key signature.
+// In production, this matches the private key held by Retrivora SaaS.
+LicenseVerifier.PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArMieCkCBtTfByRNOserm
+XM4T0Am29JyNzB4XQPe+WJJ56CN73H1HLXx9n1ByFcxkEJ9po+SURj5DnvUXwEy+
+xstx33wDPpVmcMQe33j5CRYS0S4gICiNqIRN7XkTlJtrcXqrmh1/hdOAwfRbjO1T
+NVtORHwUwWfI/lBLyxUPGtKPed+0fQ7NtcW4o00JXxs3EjCB5BV9CbnXoTjQb/4h
+iwZof4l8rb7oaNzOsVg0RSyxsETX7Ex5sI0CjBz1p2mYp4oVhw/A/h8Ls7H0XzjC
++Eb6BLtsytt5JHoSp0jExLlCpDmpys2L+kETcBVx+IqiXtdN1n6KbkksvEDUVzLI
+MwIDAQAB
+-----END PUBLIC KEY-----`;
+
 // src/config/constants.ts
 var VECTOR_DB_PROVIDERS = [
   "pinecone",
@@ -2127,14 +2406,12 @@ function readEnum(env, name, fallback, allowed) {
   throw new Error(`[getRagConfig] ${name} must be one of: ${allowed.join(", ")}`);
 }
 function getEnvConfig(env = process.env, base) {
-  var _a2, _b, _c, _d, _e, _f, _g2, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _A, _B, _C, _D, _E, _F, _G, _H, _I, _J, _K, _L, _M, _N, _O, _P, _Q, _R, _S, _T, _U, _V, _W, _X, _Y, _Z, __, _$, _aa, _ba, _ca, _da, _ea, _fa, _ga, _ha, _ia, _ja, _ka, _la, _ma, _na, _oa, _pa, _qa, _ra, _sa, _ta, _ua, _va, _wa, _xa, _ya, _za, _Aa, _Ba, _Ca, _Da, _Ea, _Fa, _Ga, _Ha, _Ia, _Ja, _Ka, _La, _Ma, _Na, _Oa, _Pa, _Qa, _Ra, _Sa, _Ta, _Ua;
+  var _a2, _b, _c, _d, _e, _f, _g2, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _A, _B, _C, _D, _E, _F, _G, _H, _I, _J, _K, _L, _M, _N, _O, _P, _Q, _R, _S, _T, _U, _V, _W, _X, _Y, _Z, __, _$, _aa, _ba, _ca, _da, _ea, _fa, _ga, _ha, _ia, _ja, _ka, _la, _ma, _na, _oa, _pa, _qa, _ra, _sa, _ta, _ua, _va, _wa, _xa, _ya, _za, _Aa, _Ba, _Ca, _Da, _Ea, _Fa, _Ga, _Ha, _Ia, _Ja, _Ka, _La, _Ma, _Na, _Oa, _Pa, _Qa, _Ra, _Sa, _Ta, _Ua, _Va, _Wa, _Xa, _Ya, _Za, __a, _$a, _ab, _bb, _cb, _db, _eb, _fb, _gb, _hb, _ib, _jb, _kb, _lb, _mb, _nb, _ob, _pb, _qb, _rb, _sb, _tb, _ub, _vb, _wb;
   const projectId = (_c = (_b = (_a2 = readString(env, "RAG_PROJECT_ID")) != null ? _a2 : readString(env, "NEXT_PUBLIC_PROJECT_ID")) != null ? _b : base == null ? void 0 : base.projectId) != null ? _c : "__default__";
   const licenseKey = (_g2 = (_f = (_e = (_d = readString(env, "RAG_LICENSE_KEY")) != null ? _d : readString(env, "RETRIVORA_LICENSE_KEY")) != null ? _e : readString(env, "NEXT_PUBLIC_RETRIVORA_LICENSE_KEY")) != null ? _f : readString(env, "LICENSE_KEY")) != null ? _g2 : base == null ? void 0 : base.licenseKey;
   const telemetryEnabled = readString(env, "TELEMETRY_ENABLED") === "true" || readString(env, "NEXT_PUBLIC_TELEMETRY_ENABLED") === "true" || ((_h = base == null ? void 0 : base.telemetry) == null ? void 0 : _h.enabled) || Boolean(licenseKey);
   const vectorProvider = readEnum(env, "VECTOR_DB_PROVIDER", "pinecone", VECTOR_DB_PROVIDERS);
-  const llmProvider = readEnum(env, "LLM_PROVIDER", "openai", LLM_PROVIDERS);
-  const embeddingProvider = readEnum(env, "EMBEDDING_PROVIDER", "openai", EMBEDDING_PROVIDERS);
-  const embeddingDimensions = readNumber(env, "EMBEDDING_DIMENSIONS", 1536);
+  const embeddingDimensions = readNumber(env, "EMBEDDING_DIMENSIONS", 768);
   const vectorDbOptions = {};
   if (vectorProvider === "pinecone") {
     vectorDbOptions.apiKey = (_l = (_k = readString(env, "PINECONE_API_KEY")) != null ? _k : (_j = (_i = base == null ? void 0 : base.vectorDb) == null ? void 0 : _i.options) == null ? void 0 : _j.apiKey) != null ? _l : "";
@@ -2199,65 +2476,88 @@ function getEnvConfig(env = process.env, base) {
     rest: "default",
     custom: "default"
   };
+  const isFreeTier = (() => {
+    if (!licenseKey) return true;
+    try {
+      const payload = LicenseVerifier.verify(licenseKey, projectId);
+      const tier = (payload.tier || "").toLowerCase();
+      return tier === "free_trial" || tier === "free_tier" || tier === "free" || tier === "hobby";
+    } catch (e) {
+      return true;
+    }
+  })();
+  const DEFAULT_FREE_GATEWAY = "https://llm.retrivora.com/api/v1";
+  const defaultLlmProvider = isFreeTier ? "universal_rest" : "universal_rest";
+  const llmProvider = (_na = (_ma = readEnum(env, "LLM_PROVIDER", defaultLlmProvider, LLM_PROVIDERS)) != null ? _ma : (_la = base == null ? void 0 : base.llm) == null ? void 0 : _la.provider) != null ? _na : defaultLlmProvider;
+  const llmBaseUrl = (_qa = (_pa = readString(env, "LLM_BASE_URL")) != null ? _pa : (_oa = base == null ? void 0 : base.llm) == null ? void 0 : _oa.baseUrl) != null ? _qa : DEFAULT_FREE_GATEWAY;
+  const llmModel = (_ua = (_sa = readString(env, "LLM_MODEL")) != null ? _sa : (_ra = base == null ? void 0 : base.llm) == null ? void 0 : _ra.model) != null ? _ua : isFreeTier ? "llama-3.1-8b-instant" : (_ta = DEFAULT_MODEL_BY_PROVIDER[llmProvider]) != null ? _ta : "gpt-4o";
+  const llmApiKey = (_ya = (_xa = (_va = llmApiKeyByProvider[llmProvider]) != null ? _va : readString(env, "LLM_API_KEY")) != null ? _xa : (_wa = base == null ? void 0 : base.llm) == null ? void 0 : _wa.apiKey) != null ? _ya : "sk-retrivora-cancer-280590";
+  const llmProfile = (_Ca = (_Ba = readString(env, "LLM_UNIVERSAL_PROFILE")) != null ? _Ba : (_Aa = (_za = base == null ? void 0 : base.llm) == null ? void 0 : _za.options) == null ? void 0 : _Aa.profile) != null ? _Ca : "litellm";
+  const defaultEmbeddingProvider = isFreeTier ? "universal_rest" : "universal_rest";
+  const embeddingProvider = (_Fa = (_Ea = readEnum(env, "EMBEDDING_PROVIDER", defaultEmbeddingProvider, EMBEDDING_PROVIDERS)) != null ? _Ea : (_Da = base == null ? void 0 : base.embedding) == null ? void 0 : _Da.provider) != null ? _Fa : defaultEmbeddingProvider;
+  const embeddingBaseUrl = (_Ia = (_Ha = readString(env, "EMBEDDING_BASE_URL")) != null ? _Ha : (_Ga = base == null ? void 0 : base.embedding) == null ? void 0 : _Ga.baseUrl) != null ? _Ia : DEFAULT_FREE_GATEWAY;
+  const embeddingModel = (_La = (_Ka = readString(env, "EMBEDDING_MODEL")) != null ? _Ka : (_Ja = base == null ? void 0 : base.embedding) == null ? void 0 : _Ja.model) != null ? _La : "text-embedding-004";
+  const embeddingApiKey = (_Qa = (_Pa = (_Na = (_Ma = embeddingApiKeyByProvider[embeddingProvider]) != null ? _Ma : readString(env, "EMBEDDING_API_KEY")) != null ? _Na : readString(env, "LLM_API_KEY")) != null ? _Pa : (_Oa = base == null ? void 0 : base.embedding) == null ? void 0 : _Oa.apiKey) != null ? _Qa : "sk-retrivora-cancer-280590";
+  const embeddingProfile = (_Ua = (_Ta = readString(env, "EMBEDDING_UNIVERSAL_PROFILE")) != null ? _Ta : (_Sa = (_Ra = base == null ? void 0 : base.embedding) == null ? void 0 : _Ra.options) == null ? void 0 : _Sa.profile) != null ? _Ua : "litellm";
   return __spreadProps(__spreadValues({
     projectId,
-    licenseKey: (_ma = (_la = readString(env, "RETRIVORA_LICENSE_KEY")) != null ? _la : readString(env, "LICENSE_KEY")) != null ? _ma : base == null ? void 0 : base.licenseKey,
+    licenseKey,
     vectorDb: {
       provider: vectorProvider,
-      indexName: (_oa = (_na = readString(env, "VECTOR_DB_INDEX")) != null ? _na : vectorDbOptions.indexName) != null ? _oa : "rag-index",
+      indexName: (_Wa = (_Va = readString(env, "VECTOR_DB_INDEX")) != null ? _Va : vectorDbOptions.indexName) != null ? _Wa : "rag-index",
       options: vectorDbOptions
     },
     llm: {
       provider: llmProvider,
-      model: (_qa = (_pa = readString(env, "LLM_MODEL")) != null ? _pa : DEFAULT_MODEL_BY_PROVIDER[llmProvider]) != null ? _qa : "gpt-4o",
-      apiKey: (_ra = llmApiKeyByProvider[llmProvider]) != null ? _ra : "",
-      baseUrl: readString(env, "LLM_BASE_URL"),
+      model: llmModel,
+      apiKey: llmApiKey,
+      baseUrl: llmBaseUrl,
       systemPrompt: readString(env, "LLM_SYSTEM_PROMPT"),
       maxTokens: readNumber(env, "LLM_MAX_TOKENS", 4096),
       temperature: readNumber(env, "LLM_TEMPERATURE", 0.7),
       options: {
-        profile: readString(env, "LLM_UNIVERSAL_PROFILE"),
+        profile: llmProfile,
         thinking: readString(env, "LLM_THINKING") === "true" || readString(env, "LLM_THINKING") === "enabled" ? true : readString(env, "LLM_THINKING") === "false" ? false : void 0,
         thinkingBudget: env.LLM_THINKING_BUDGET ? parseInt(env.LLM_THINKING_BUDGET, 10) : void 0
       }
     },
     embedding: {
       provider: embeddingProvider,
-      model: (_sa = readString(env, "EMBEDDING_MODEL")) != null ? _sa : "text-embedding-3-small",
-      apiKey: embeddingApiKeyByProvider[embeddingProvider],
-      baseUrl: readString(env, "EMBEDDING_BASE_URL"),
+      model: embeddingModel,
+      apiKey: embeddingApiKey,
+      baseUrl: embeddingBaseUrl,
       dimensions: embeddingDimensions,
       queryPrefix: readString(env, "EMBEDDING_QUERY_PREFIX"),
       documentPrefix: readString(env, "EMBEDDING_DOCUMENT_PREFIX"),
       options: {
-        profile: readString(env, "EMBEDDING_UNIVERSAL_PROFILE")
+        profile: embeddingProfile
       }
     },
     ui: {
-      title: (_ua = (_ta = readString(env, "NEXT_PUBLIC_UI_TITLE")) != null ? _ta : readString(env, "UI_TITLE")) != null ? _ua : "AI Assistant",
-      subtitle: (_wa = (_va = readString(env, "NEXT_PUBLIC_UI_SUBTITLE")) != null ? _va : readString(env, "UI_SUBTITLE")) != null ? _wa : "Powered by RAG",
-      primaryColor: (_ya = (_xa = readString(env, "NEXT_PUBLIC_PRIMARY_COLOR")) != null ? _xa : readString(env, "UI_PRIMARY_COLOR")) != null ? _ya : "#10b981",
-      accentColor: (_Aa = (_za = readString(env, "NEXT_PUBLIC_ACCENT_COLOR")) != null ? _za : readString(env, "UI_ACCENT_COLOR")) != null ? _Aa : "#3b82f6",
-      logoUrl: (_Ba = readString(env, "NEXT_PUBLIC_LOGO_URL")) != null ? _Ba : readString(env, "UI_LOGO_URL"),
-      placeholder: (_Da = (_Ca = readString(env, "NEXT_PUBLIC_PLACEHOLDER")) != null ? _Ca : readString(env, "UI_PLACEHOLDER")) != null ? _Da : "Ask me anything\u2026",
-      showSources: ((_Fa = (_Ea = readString(env, "NEXT_PUBLIC_SHOW_SOURCES")) != null ? _Ea : readString(env, "UI_SHOW_SOURCES")) != null ? _Fa : "true") !== "false",
-      welcomeMessage: (_Ha = (_Ga = readString(env, "NEXT_PUBLIC_WELCOME_MESSAGE")) != null ? _Ga : readString(env, "UI_WELCOME_MESSAGE")) != null ? _Ha : "Hello! I'm your AI assistant. Ask me anything about your documents.",
-      visualStyle: (_Ja = (_Ia = readString(env, "NEXT_PUBLIC_UI_VISUAL_STYLE")) != null ? _Ia : readString(env, "UI_VISUAL_STYLE")) != null ? _Ja : "glass",
-      borderRadius: (_La = (_Ka = readString(env, "NEXT_PUBLIC_UI_BORDER_RADIUS")) != null ? _Ka : readString(env, "UI_BORDER_RADIUS")) != null ? _La : "xl",
-      allowUpload: ((_Na = (_Ma = readString(env, "NEXT_PUBLIC_ALLOW_UPLOAD")) != null ? _Ma : readString(env, "UI_ALLOW_UPLOAD")) != null ? _Na : "false") === "true"
+      title: (_Ya = (_Xa = readString(env, "NEXT_PUBLIC_UI_TITLE")) != null ? _Xa : readString(env, "UI_TITLE")) != null ? _Ya : "AI Assistant",
+      subtitle: (__a = (_Za = readString(env, "NEXT_PUBLIC_UI_SUBTITLE")) != null ? _Za : readString(env, "UI_SUBTITLE")) != null ? __a : "Powered by RAG",
+      primaryColor: (_ab = (_$a = readString(env, "NEXT_PUBLIC_PRIMARY_COLOR")) != null ? _$a : readString(env, "UI_PRIMARY_COLOR")) != null ? _ab : "#10b981",
+      accentColor: (_cb = (_bb = readString(env, "NEXT_PUBLIC_ACCENT_COLOR")) != null ? _bb : readString(env, "UI_ACCENT_COLOR")) != null ? _cb : "#3b82f6",
+      logoUrl: (_db = readString(env, "NEXT_PUBLIC_LOGO_URL")) != null ? _db : readString(env, "UI_LOGO_URL"),
+      placeholder: (_fb = (_eb = readString(env, "NEXT_PUBLIC_PLACEHOLDER")) != null ? _eb : readString(env, "UI_PLACEHOLDER")) != null ? _fb : "Ask me anything\u2026",
+      showSources: ((_hb = (_gb = readString(env, "NEXT_PUBLIC_SHOW_SOURCES")) != null ? _gb : readString(env, "UI_SHOW_SOURCES")) != null ? _hb : "true") !== "false",
+      welcomeMessage: (_jb = (_ib = readString(env, "NEXT_PUBLIC_WELCOME_MESSAGE")) != null ? _ib : readString(env, "UI_WELCOME_MESSAGE")) != null ? _jb : "Hello! I'm your AI assistant. Ask me anything about your documents.",
+      visualStyle: (_lb = (_kb = readString(env, "NEXT_PUBLIC_UI_VISUAL_STYLE")) != null ? _kb : readString(env, "UI_VISUAL_STYLE")) != null ? _lb : "glass",
+      borderRadius: (_nb = (_mb = readString(env, "NEXT_PUBLIC_UI_BORDER_RADIUS")) != null ? _mb : readString(env, "UI_BORDER_RADIUS")) != null ? _nb : "xl",
+      allowUpload: ((_pb = (_ob = readString(env, "NEXT_PUBLIC_ALLOW_UPLOAD")) != null ? _ob : readString(env, "UI_ALLOW_UPLOAD")) != null ? _pb : "false") === "true"
     },
     rag: {
       topK: readNumber(env, "RAG_TOP_K", 5),
       scoreThreshold: readNumber(env, "RAG_SCORE_THRESHOLD", 0),
       chunkSize: readNumber(env, "RAG_CHUNK_SIZE", 1e3),
       chunkOverlap: readNumber(env, "RAG_CHUNK_OVERLAP", 200),
-      filterableFields: (_Oa = readString(env, "RAG_FILTERABLE_FIELDS")) == null ? void 0 : _Oa.split(",").map((f) => f.trim()),
+      filterableFields: (_qb = readString(env, "RAG_FILTERABLE_FIELDS")) == null ? void 0 : _qb.split(",").map((f) => f.trim()),
       // Query pipeline toggles — read from .env.local
       useQueryTransformation: readString(env, "RAG_USE_QUERY_TRANSFORMATION") === "true",
       useReranking: readString(env, "RAG_USE_RERANKING") === "true",
       useGraphRetrieval: readString(env, "RAG_USE_GRAPH_RETRIEVAL") === "true",
-      architecture: (_Pa = readString(env, "RAG_ARCHITECTURE")) != null ? _Pa : "simple",
-      chunkingStrategy: (_Qa = readString(env, "RAG_CHUNKING_STRATEGY")) != null ? _Qa : "recursive",
+      architecture: (_rb = readString(env, "RAG_ARCHITECTURE")) != null ? _rb : "simple",
+      chunkingStrategy: (_sb = readString(env, "RAG_CHUNKING_STRATEGY")) != null ? _sb : "recursive",
       uiMapping: (() => {
         const raw = readString(env, "RAG_UI_MAPPING");
         if (!raw) return void 0;
@@ -2270,7 +2570,7 @@ function getEnvConfig(env = process.env, base) {
     },
     telemetry: {
       enabled: telemetryEnabled,
-      url: (_Ua = (_Ta = (_Ra = readString(env, "TELEMETRY_URL")) != null ? _Ra : readString(env, "NEXT_PUBLIC_TELEMETRY_URL")) != null ? _Ta : (_Sa = base == null ? void 0 : base.telemetry) == null ? void 0 : _Sa.url) != null ? _Ua : process.env.NODE_ENV === "development" ? "http://localhost:3001/api/telemetry" : "https://retrivora.com/api/telemetry"
+      url: (_wb = (_vb = (_tb = readString(env, "TELEMETRY_URL")) != null ? _tb : readString(env, "NEXT_PUBLIC_TELEMETRY_URL")) != null ? _vb : (_ub = base == null ? void 0 : base.telemetry) == null ? void 0 : _ub.url) != null ? _wb : process.env.NODE_ENV === "development" ? "http://localhost:3001/api/telemetry" : "https://retrivora.com/api/telemetry"
     }
   }, readString(env, "GRAPH_DB_PROVIDER") ? {
     graphDb: {
@@ -2757,10 +3057,12 @@ var AnthropicProvider = class {
 import axios from "axios";
 var OllamaProvider = class {
   constructor(llmConfig, embeddingConfig) {
-    var _a2, _b;
-    const baseURL = (_a2 = llmConfig.baseUrl) != null ? _a2 : "http://localhost:11434";
+    var _a2, _b, _c;
+    const rawBaseURL = ((_a2 = llmConfig.baseUrl) != null ? _a2 : "http://localhost:11434").replace(/\/+$/, "");
+    const baseURL = rawBaseURL.replace(/\/(?:api\/v1|v1|api)$/i, "");
     const timeout = Number((_b = llmConfig.options) == null ? void 0 : _b.timeout) || 3e5;
-    this.http = axios.create({ baseURL, timeout });
+    const headers = ((_c = llmConfig.options) == null ? void 0 : _c.headers) || {};
+    this.http = axios.create({ baseURL, timeout, headers });
     this.llmConfig = llmConfig;
     this.embeddingConfig = embeddingConfig;
   }
@@ -3697,112 +3999,40 @@ ${context != null ? context : "None"}` },
       payload = buildPayload(this.opts.embedPayloadTemplate, {
         model: this.model,
         input: text
-      });
-    } else {
-      payload = {
-        model: this.model,
-        input: text
-      };
-    }
-    const { data } = await this.http.post(path2, payload);
-    const extractPath = (_b = this.opts.embedExtractPath) != null ? _b : "data[0].embedding";
-    const vector = resolvePath(data, extractPath);
-    if (!Array.isArray(vector)) {
-      throw new Error(`[UniversalLLMAdapter] Expected a number array at '${extractPath}' for embeddings.`);
-    }
-    return vector;
-  }
-  async batchEmbed(texts) {
-    const vectors = [];
-    for (const text of texts) {
-      vectors.push(await this.embed(text));
-    }
-    return vectors;
-  }
-  async ping() {
-    try {
-      if (this.opts.pingPath) {
-        await this.http.get(this.opts.pingPath);
-      }
-      return true;
-    } catch (err) {
-      console.error("[UniversalLLMAdapter] Ping failed:", err);
-      return false;
-    }
-  }
-};
-
-// src/exceptions/index.ts
-var RetrivoraError = class extends Error {
-  constructor(message, code, details) {
-    super(message);
-    this.name = new.target.name;
-    this.code = code;
-    this.details = details;
-  }
-};
-var ProviderNotFoundException = class extends RetrivoraError {
-  constructor(providerType, provider, details) {
-    super(`Unsupported ${providerType} provider: ${provider}`, "PROVIDER_NOT_FOUND", details);
-  }
-};
-var EmbeddingFailedException = class extends RetrivoraError {
-  constructor(message = "Embedding generation failed", details) {
-    super(message, "EMBEDDING_FAILED", details);
-  }
-};
-var RetrievalException = class extends RetrivoraError {
-  constructor(message = "Retrieval failed", details) {
-    super(message, "RETRIEVAL_FAILED", details);
-  }
-};
-var RateLimitException = class extends RetrivoraError {
-  constructor(message = "Provider rate limit exceeded", details) {
-    super(message, "RATE_LIMITED", details);
-  }
-};
-var ConfigurationException = class extends RetrivoraError {
-  constructor(message, details) {
-    super(message, "CONFIGURATION_ERROR", details);
-  }
-};
-var AuthenticationException = class extends RetrivoraError {
-  constructor(message = "Provider authentication failed", details) {
-    super(message, "AUTHENTICATION_ERROR", details);
-  }
-};
-function wrapError(err, defaultCode, defaultMessage) {
-  var _a2;
-  if (err instanceof RetrivoraError) {
-    return err;
-  }
-  const error = err;
-  const message = (error == null ? void 0 : error.message) || defaultMessage || String(err);
-  const status = (error == null ? void 0 : error.status) || (error == null ? void 0 : error.statusCode) || ((_a2 = error == null ? void 0 : error.response) == null ? void 0 : _a2.status);
-  const code = error == null ? void 0 : error.code;
-  if (status === 429 || /rate[- ]?limit/i.test(message) || code === "RATE_LIMIT_EXCEEDED") {
-    return new RateLimitException(message, err);
+      });
+    } else {
+      payload = {
+        model: this.model,
+        input: text
+      };
+    }
+    const { data } = await this.http.post(path2, payload);
+    const extractPath = (_b = this.opts.embedExtractPath) != null ? _b : "data[0].embedding";
+    const vector = resolvePath(data, extractPath);
+    if (!Array.isArray(vector)) {
+      throw new Error(`[UniversalLLMAdapter] Expected a number array at '${extractPath}' for embeddings.`);
+    }
+    return vector;
   }
-  if (status === 401 || status === 403 || /unauthorized|auth|api[- ]?key/i.test(message) || code === "INVALID_API_KEY") {
-    return new AuthenticationException(message, err);
+  async batchEmbed(texts) {
+    const vectors = [];
+    for (const text of texts) {
+      vectors.push(await this.embed(text));
+    }
+    return vectors;
   }
-  switch (defaultCode) {
-    case "PROVIDER_NOT_FOUND":
-      return new ProviderNotFoundException("provider", message, err);
-    case "EMBEDDING_FAILED":
-      return new EmbeddingFailedException(message, err);
-    case "RETRIEVAL_FAILED":
-      return new RetrievalException(message, err);
-    case "RATE_LIMITED":
-      return new RateLimitException(message, err);
-    case "CONFIGURATION_ERROR":
-      return new ConfigurationException(message, err);
-    case "AUTHENTICATION_ERROR":
-      return new AuthenticationException(message, err);
-    default:
-      return new RetrivoraError(message, defaultCode, err);
+  async ping() {
+    try {
+      if (this.opts.pingPath) {
+        await this.http.get(this.opts.pingPath);
+      }
+      return true;
+    } catch (err) {
+      console.error("[UniversalLLMAdapter] Ping failed:", err);
+      return false;
+    }
   }
-}
+};
 
 // src/llm/LLMFactory.ts
 var customProviders = /* @__PURE__ */ new Map();
@@ -8729,211 +8959,6 @@ var ProviderHealthCheck = class {
   }
 };
 
-// src/core/LicenseVerifier.ts
-import * as crypto2 from "crypto";
-var LicenseVerifier = class {
-  /**
-   * Decodes, verifies signature, and checks metadata of a license key.
-   *
-   * @param licenseKey - Base64url signed JWT license key.
-   * @param currentProjectId - Project namespace ID.
-   * @param publicKeyOverride - Optional override for unit/integration tests.
-   */
-  static verify(licenseKey, currentProjectId, provider, publicKeyOverride) {
-    const isProduction = process.env.NODE_ENV === "production";
-    const now = Date.now();
-    if (licenseKey) {
-      const cacheKey = `${licenseKey}:${currentProjectId}:${provider || ""}:${publicKeyOverride || ""}`;
-      const cached = this.cache.get(cacheKey);
-      if (cached && now - cached.cachedAt < this.CACHE_TTL_MS) {
-        const currentTimestampSec = Math.floor(now / 1e3);
-        if (cached.payload.expiresAt && currentTimestampSec > cached.payload.expiresAt) {
-          this.cache.delete(cacheKey);
-        } else {
-          return cached.payload;
-        }
-      }
-    }
-    if (!licenseKey) {
-      if (isProduction) {
-        throw new ConfigurationException(
-          "[Retrivora SDK] License key (licenseKey) is required in production environments."
-        );
-      }
-      console.warn(
-        `\x1B[33m[Retrivora SDK] WARNING: Running without a license key. This namespace (${currentProjectId}) is permitted for local development only.\x1B[0m`
-      );
-      return {
-        projectId: currentProjectId,
-        expiresAt: Math.floor(Date.now() / 1e3) + 86400,
-        // Valid for 24h
-        tier: "hobby"
-      };
-    }
-    try {
-      const parts = licenseKey.split(".");
-      if (parts.length !== 3) {
-        throw new Error("Malformed token structure (expected 3 parts).");
-      }
-      const [headerB64, payloadB64, signatureB64] = parts;
-      const dataToVerify = `${headerB64}.${payloadB64}`;
-      const publicKey = publicKeyOverride != null ? publicKeyOverride : this.PUBLIC_KEY;
-      const signature = Buffer.from(signatureB64, "base64url");
-      const data = Buffer.from(dataToVerify);
-      const isValid = crypto2.verify(
-        "sha256",
-        data,
-        publicKey,
-        signature
-      );
-      if (!isValid) {
-        throw new Error("Signature verification failed.");
-      }
-      const payload = JSON.parse(
-        Buffer.from(payloadB64, "base64url").toString("utf8")
-      );
-      if (!payload.projectId) {
-        throw new Error('License payload is missing "projectId".');
-      }
-      if (payload.projectId !== currentProjectId) {
-        throw new Error(
-          `Project ID mismatch. License is bound to project namespace "${payload.projectId}" but configuration has "${currentProjectId}".`
-        );
-      }
-      if (!payload.expiresAt) {
-        throw new Error('License payload is missing expiration ("expiresAt").');
-      }
-      const currentTimestampSec = Math.floor(Date.now() / 1e3);
-      if (currentTimestampSec > payload.expiresAt) {
-        throw new Error(
-          `License key has expired. Expiration: ${new Date(
-            payload.expiresAt * 1e3
-          ).toDateString()}`
-        );
-      }
-      if (isProduction && provider) {
-        const tier = (payload.tier || "").toLowerCase();
-        const normalizedProvider = provider.toLowerCase();
-        if (tier === "hobby") {
-          const allowedHobby = ["postgresql", "pgvector", "supabase"];
-          if (!allowedHobby.includes(normalizedProvider)) {
-            throw new Error(
-              `The database provider "${provider}" is not allowed on the Hobby tier. Hobby tier is restricted to PostgreSQL and Supabase. Please upgrade to a Developer Pro or Enterprise plan.`
-            );
-          }
-        } else if (tier === "pro" || tier === "developer_pro" || tier === "premium" || tier === "growth" || tier === "free_trial" || tier === "free_tier" || tier === "free") {
-          const allowedPro = [
-            "postgresql",
-            "pgvector",
-            "supabase",
-            "pinecone",
-            "qdrant",
-            "mongodb",
-            "milvus",
-            "chroma",
-            "chromadb"
-          ];
-          if (!allowedPro.includes(normalizedProvider)) {
-            throw new Error(
-              `The database provider "${provider}" is not allowed on the Developer Pro tier. Please upgrade to an Enterprise plan.`
-            );
-          }
-        }
-      }
-      if (licenseKey) {
-        const cacheKey = `${licenseKey}:${currentProjectId}:${provider || ""}:${publicKeyOverride || ""}`;
-        this.cache.set(cacheKey, { payload, cachedAt: now });
-      }
-      return payload;
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      throw new ConfigurationException(
-        `[Retrivora SDK] License key validation failed: ${message}`
-      );
-    }
-  }
-  static async verifyIP(licenseKey) {
-    if (!licenseKey) return;
-    try {
-      const parts = licenseKey.split(".");
-      if (parts.length !== 3) return;
-      const [, payloadB64] = parts;
-      const payload = JSON.parse(
-        Buffer.from(payloadB64, "base64url").toString("utf8")
-      );
-      const tier = (payload.tier || "").toLowerCase();
-      if (tier === "enterprise" || tier === "custom") {
-        return;
-      }
-      if (payload.ipv4 || payload.ipv6) {
-        let currentIpv4 = "";
-        let currentIpv6 = "";
-        try {
-          const res = await fetch("https://api4.ipify.org?format=json", { signal: AbortSignal.timeout(3e3) });
-          const data = await res.json();
-          currentIpv4 = data.ip;
-        } catch (e) {
-        }
-        try {
-          const res = await fetch("https://api6.ipify.org?format=json", { signal: AbortSignal.timeout(3e3) });
-          const data = await res.json();
-          currentIpv6 = data.ip;
-        } catch (e) {
-        }
-        const localIps = [];
-        try {
-          const osModule = __require("os");
-          const interfaces = osModule.networkInterfaces();
-          for (const name of Object.keys(interfaces)) {
-            for (const iface of interfaces[name] || []) {
-              if (!iface.internal) {
-                localIps.push(iface.address);
-              }
-            }
-          }
-        } catch (e) {
-        }
-        const isIpv4Match = payload.ipv4 && (currentIpv4 === payload.ipv4 || localIps.includes(payload.ipv4));
-        const isIpv6Match = payload.ipv6 && (currentIpv6 === payload.ipv6 || localIps.includes(payload.ipv6));
-        if (payload.ipv4 && payload.ipv6) {
-          if (!isIpv4Match && !isIpv6Match) {
-            throw new Error(
-              `License key access restricted. This license key was created for a different system (authorized IPv4: ${payload.ipv4}, IPv6: ${payload.ipv6}) and cannot be used on this machine.`
-            );
-          }
-        } else if (payload.ipv4 && !isIpv4Match) {
-          throw new Error(
-            `License key access restricted. This license key was created for a different system (authorized IPv4: ${payload.ipv4}) and cannot be used on this machine.`
-          );
-        } else if (payload.ipv6 && !isIpv6Match) {
-          throw new Error(
-            `License key access restricted. This license key was created for a different system (authorized IPv6: ${payload.ipv6}) and cannot be used on this machine.`
-          );
-        }
-      }
-    } catch (err) {
-      if (err.message.includes("License key access restricted")) {
-        throw new ConfigurationException(`[Retrivora SDK] ${err.message}`);
-      }
-    }
-  }
-};
-// A simple in-memory cache to save CPU overhead of cryptographic signature checks.
-LicenseVerifier.cache = /* @__PURE__ */ new Map();
-LicenseVerifier.CACHE_TTL_MS = 60 * 1e3;
-// Cache verified license for 60 seconds
-// Retrivora's Public Key used to verify the license key signature.
-// In production, this matches the private key held by Retrivora SaaS.
-LicenseVerifier.PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArMieCkCBtTfByRNOserm
-XM4T0Am29JyNzB4XQPe+WJJ56CN73H1HLXx9n1ByFcxkEJ9po+SURj5DnvUXwEy+
-xstx33wDPpVmcMQe33j5CRYS0S4gICiNqIRN7XkTlJtrcXqrmh1/hdOAwfRbjO1T
-NVtORHwUwWfI/lBLyxUPGtKPed+0fQ7NtcW4o00JXxs3EjCB5BV9CbnXoTjQb/4h
-iwZof4l8rb7oaNzOsVg0RSyxsETX7Ex5sI0CjBz1p2mYp4oVhw/A/h8Ls7H0XzjC
-+Eb6BLtsytt5JHoSp0jExLlCpDmpys2L+kETcBVx+IqiXtdN1n6KbkksvEDUVzLI
-MwIDAQAB
------END PUBLIC KEY-----`;
-
 // src/core/VectorPlugin.ts
 var VectorPlugin = class {
   constructor(hostConfig) {
@@ -9731,7 +9756,17 @@ function createChatHandler(configOrPlugin, options) {
     if (rateLimited) return rateLimited;
     try {
       const body = await req.json();
-      const { message: rawMessage, history = [], namespace, sessionId = "default", messageId, userMessageId } = body;
+      const bodyObj = body != null ? body : {};
+      let rawMessage = bodyObj.message;
+      if (!rawMessage && Array.isArray(bodyObj.messages) && bodyObj.messages.length > 0) {
+        const lastMsg = bodyObj.messages[bodyObj.messages.length - 1];
+        rawMessage = typeof lastMsg === "string" ? lastMsg : (lastMsg == null ? void 0 : lastMsg.content) || (lastMsg == null ? void 0 : lastMsg.text);
+      }
+      if (!rawMessage && typeof bodyObj.prompt === "string") {
+        rawMessage = bodyObj.prompt;
+      }
+      const history = bodyObj.history || (Array.isArray(bodyObj.messages) ? bodyObj.messages.slice(0, -1) : []);
+      const { namespace, sessionId = "default", messageId, userMessageId } = bodyObj;
       const sanitized = sanitizeInput(rawMessage != null ? rawMessage : "");
       if (!sanitized.ok) {
         return NextResponse.json({ error: { code: "INVALID_INPUT", message: sanitized.error } }, { status: 400 });
@@ -9783,7 +9818,17 @@ function createStreamHandler(configOrPlugin, options) {
         headers: { "Content-Type": "application/json" }
       });
     }
-    const { message: rawMessage, history = [], namespace, sessionId = "default", messageId, userMessageId } = body;
+    const bodyObj = body != null ? body : {};
+    let rawMessage = bodyObj.message;
+    if (!rawMessage && Array.isArray(bodyObj.messages) && bodyObj.messages.length > 0) {
+      const lastMsg = bodyObj.messages[bodyObj.messages.length - 1];
+      rawMessage = typeof lastMsg === "string" ? lastMsg : (lastMsg == null ? void 0 : lastMsg.content) || (lastMsg == null ? void 0 : lastMsg.text);
+    }
+    if (!rawMessage && typeof bodyObj.prompt === "string") {
+      rawMessage = bodyObj.prompt;
+    }
+    const history = bodyObj.history || (Array.isArray(bodyObj.messages) ? bodyObj.messages.slice(0, -1) : []);
+    const { namespace, sessionId = "default", messageId, userMessageId } = bodyObj;
     const sanitized = sanitizeInput(rawMessage != null ? rawMessage : "");
     if (!sanitized.ok) {
       return new Response(