@retrivora-ai/rag-engine 2.2.7 → 2.2.8

package/dist/index.js

@@ -2760,7 +2760,7 @@ function useRagChat(projectId, options = {}) {
   }, [messages]);
   const sendMessage = (0, import_react11.useCallback)(
     async (text, opts) => {
-      var _a, _b, _c, _d, _e;
+      var _a, _b, _c, _d, _e, _f;
       const trimmed = text.trim();
       if (!trimmed || isLoading) return;
       lastInputRef.current = trimmed;
@@ -2792,9 +2792,18 @@ function useRagChat(projectId, options = {}) {
           messageId: assistantMessageId,
           userMessageId: userMsgId
         });
-        const fetchHeaders = __spreadValues({
+        const getHeader = (headersObj, name) => {
+          if (!headersObj) return void 0;
+          const target = name.toLowerCase();
+          for (const [k, v] of Object.entries(headersObj)) {
+            if (k.toLowerCase() === target) return v;
+          }
+          return void 0;
+        };
+        const resolvedLicenseKey = options.licenseKey || getHeader(options.headers, "x-license-key") || ((_b = getHeader(options.headers, "authorization")) == null ? void 0 : _b.replace(/^Bearer\s+/i, "")) || (typeof process !== "undefined" ? process.env.NEXT_PUBLIC_RETRIVORA_LICENSE_KEY || process.env.RETRIVORA_LICENSE_KEY : "") || "";
+        const fetchHeaders = __spreadValues(__spreadValues({
           "Content-Type": "application/json"
-        }, options.headers || {});
+        }, resolvedLicenseKey ? { "x-license-key": resolvedLicenseKey } : {}), options.headers || {});
         let response = await fetch(primaryUrl, {
           method: "POST",
           headers: fetchHeaders,
@@ -2812,10 +2821,10 @@ function useRagChat(projectId, options = {}) {
         }
         if (!response.ok) {
           const errorData = await response.json().catch(() => ({}));
-          if (response.status === 403 || response.status === 401 || typeof errorData.error === "string" && errorData.error.toLowerCase().includes("license") || ((_b = errorData.error) == null ? void 0 : _b.type) === "license_revoked") {
+          if (response.status === 403 || response.status === 401 || typeof errorData.error === "string" && errorData.error.toLowerCase().includes("license") || ((_c = errorData.error) == null ? void 0 : _c.type) === "license_revoked") {
             throw new Error("Your Retrivora license is no longer valid. Please contact your administrator or obtain a valid license key.");
           }
-          throw new Error(((_c = errorData.error) == null ? void 0 : _c.message) || errorData.error || `Server returned ${response.status}`);
+          throw new Error(((_d = errorData.error) == null ? void 0 : _d.message) || errorData.error || `Server returned ${response.status}`);
         }
         if (!response.body) {
           throw new Error("No response body received from server");
@@ -2879,7 +2888,7 @@ function useRagChat(projectId, options = {}) {
               pendingThinkingRef.current = thinkingContent;
               scheduleFlush(assistantMessageId);
             } else if (frame.type === "metadata") {
-              sources = (_d = frame.sources) != null ? _d : [];
+              sources = (_e = frame.sources) != null ? _e : [];
               thinkingMs = frame.thinkingMs;
             } else if (frame.type === "ui_transformation") {
               uiTransformation = frame.data;
@@ -2895,7 +2904,7 @@ function useRagChat(projectId, options = {}) {
             if (frame.type === "text" && frame.text) assistantContent += frame.text;
             else if (frame.type === "thinking" && frame.text) thinkingContent += frame.text;
             else if (frame.type === "metadata") {
-              sources = (_e = frame.sources) != null ? _e : [];
+              sources = (_f = frame.sources) != null ? _f : [];
               thinkingMs = frame.thinkingMs;
             } else if (frame.type === "observability") trace = frame.data;
           }
@@ -3035,7 +3044,7 @@ function useRagChat(projectId, options = {}) {
 // package.json
 var package_default = {
   name: "@retrivora-ai/rag-engine",
-  version: "2.2.7",
+  version: "2.2.8",
   description: "Retrivora AI is a plug-and-play AI engine for RAG chat experiences \u2014 generic vector DB + LLM provider, embeddable or standalone.",
   author: "Abhinav Alkuchi",
   license: "UNLICENSED",
@@ -3225,6 +3234,213 @@ var LicenseValidationError = class extends RetrivoraError {
   }
 };
 
+// src/core/LicenseVerifier.ts
+var crypto = __toESM(require("crypto"));
+var LicenseVerifier = class {
+  /**
+   * Decodes, verifies signature, and checks metadata of a license key.
+   *
+   * @param licenseKey - Base64url signed JWT license key.
+   * @param currentProjectId - Project namespace ID.
+   * @param publicKeyOverride - Optional override for unit/integration tests.
+   */
+  static verify(licenseKey, currentProjectId, provider, publicKeyOverride) {
+    const isProduction = process.env.NODE_ENV === "production";
+    const now = Date.now();
+    if (licenseKey) {
+      const cacheKey = `${licenseKey}:${currentProjectId}:${provider || ""}:${publicKeyOverride || ""}`;
+      const cached = this.cache.get(cacheKey);
+      if (cached && now - cached.cachedAt < this.CACHE_TTL_MS) {
+        const currentTimestampSec = Math.floor(now / 1e3);
+        if (cached.payload.expiresAt && currentTimestampSec > cached.payload.expiresAt) {
+          this.cache.delete(cacheKey);
+        } else {
+          return cached.payload;
+        }
+      }
+    }
+    if (!licenseKey) {
+      if (isProduction) {
+        throw new ConfigurationException(
+          "[Retrivora SDK] License key (licenseKey) is required in production environments."
+        );
+      }
+      console.warn(
+        `\x1B[33m[Retrivora SDK] WARNING: Running without a license key. This namespace (${currentProjectId}) is permitted for local development only.\x1B[0m`
+      );
+      return {
+        projectId: currentProjectId,
+        expiresAt: Math.floor(Date.now() / 1e3) + 86400,
+        // Valid for 24h
+        tier: "hobby"
+      };
+    }
+    try {
+      const rawToken = licenseKey.replace(/^rtv_/i, "").trim();
+      const parts = rawToken.split(".");
+      if (parts.length !== 3) {
+        throw new Error("Malformed token structure (expected 3 parts).");
+      }
+      const [headerB64, payloadB64, signatureB64] = parts;
+      const dataToVerify = `${headerB64}.${payloadB64}`;
+      const publicKey = publicKeyOverride != null ? publicKeyOverride : this.PUBLIC_KEY;
+      const signature = Buffer.from(signatureB64, "base64url");
+      const data = Buffer.from(dataToVerify);
+      const isValid = crypto.verify(
+        "sha256",
+        data,
+        publicKey,
+        signature
+      );
+      if (!isValid) {
+        throw new Error("Signature verification failed.");
+      }
+      const payload = JSON.parse(
+        Buffer.from(payloadB64, "base64url").toString("utf8")
+      );
+      if (!payload.projectId) {
+        throw new Error('License payload is missing "projectId".');
+      }
+      const isProjectMatch = payload.projectId === currentProjectId || payload.projectId === `retrivora-${currentProjectId}` || `retrivora-${payload.projectId}` === currentProjectId;
+      if (!isProjectMatch) {
+        throw new Error(
+          `Project ID mismatch. License is bound to project namespace "${payload.projectId}" but configuration has "${currentProjectId}".`
+        );
+      }
+      if (!payload.expiresAt) {
+        throw new Error('License payload is missing expiration ("expiresAt").');
+      }
+      const currentTimestampSec = Math.floor(Date.now() / 1e3);
+      if (currentTimestampSec > payload.expiresAt) {
+        throw new Error(
+          `License key has expired. Expiration: ${new Date(
+            payload.expiresAt * 1e3
+          ).toDateString()}`
+        );
+      }
+      if (isProduction && provider) {
+        const tier = (payload.tier || "").toLowerCase();
+        const normalizedProvider = provider.toLowerCase();
+        if (tier === "hobby") {
+          const allowedHobby = ["postgresql", "pgvector", "supabase"];
+          if (!allowedHobby.includes(normalizedProvider)) {
+            throw new Error(
+              `The database provider "${provider}" is not allowed on the Hobby tier. Hobby tier is restricted to PostgreSQL and Supabase. Please upgrade to a Developer Pro or Enterprise plan.`
+            );
+          }
+        } else if (tier === "pro" || tier === "developer_pro" || tier === "premium" || tier === "growth" || tier === "free_trial" || tier === "free_tier" || tier === "free") {
+          const allowedPro = [
+            "postgresql",
+            "pgvector",
+            "supabase",
+            "pinecone",
+            "qdrant",
+            "mongodb",
+            "milvus",
+            "chroma",
+            "chromadb"
+          ];
+          if (!allowedPro.includes(normalizedProvider)) {
+            throw new Error(
+              `The database provider "${provider}" is not allowed on the Developer Pro tier. Please upgrade to an Enterprise plan.`
+            );
+          }
+        }
+      }
+      if (licenseKey) {
+        const cacheKey = `${licenseKey}:${currentProjectId}:${provider || ""}:${publicKeyOverride || ""}`;
+        this.cache.set(cacheKey, { payload, cachedAt: now });
+      }
+      return payload;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      throw new ConfigurationException(
+        `[Retrivora SDK] License key validation failed: ${message}`
+      );
+    }
+  }
+  static async verifyIP(licenseKey) {
+    if (!licenseKey) return;
+    try {
+      const parts = licenseKey.split(".");
+      if (parts.length !== 3) return;
+      const [, payloadB64] = parts;
+      const payload = JSON.parse(
+        Buffer.from(payloadB64, "base64url").toString("utf8")
+      );
+      const tier = (payload.tier || "").toLowerCase();
+      if (tier === "enterprise" || tier === "custom") {
+        return;
+      }
+      if (payload.ipv4 || payload.ipv6) {
+        let currentIpv4 = "";
+        let currentIpv6 = "";
+        try {
+          const res = await fetch("https://api4.ipify.org?format=json", { signal: AbortSignal.timeout(3e3) });
+          const data = await res.json();
+          currentIpv4 = data.ip;
+        } catch (e) {
+        }
+        try {
+          const res = await fetch("https://api6.ipify.org?format=json", { signal: AbortSignal.timeout(3e3) });
+          const data = await res.json();
+          currentIpv6 = data.ip;
+        } catch (e) {
+        }
+        const localIps = [];
+        try {
+          const osModule = require("os");
+          const interfaces = osModule.networkInterfaces();
+          for (const name of Object.keys(interfaces)) {
+            for (const iface of interfaces[name] || []) {
+              if (!iface.internal) {
+                localIps.push(iface.address);
+              }
+            }
+          }
+        } catch (e) {
+        }
+        const isIpv4Match = payload.ipv4 && (currentIpv4 === payload.ipv4 || localIps.includes(payload.ipv4));
+        const isIpv6Match = payload.ipv6 && (currentIpv6 === payload.ipv6 || localIps.includes(payload.ipv6));
+        if (payload.ipv4 && payload.ipv6) {
+          if (!isIpv4Match && !isIpv6Match) {
+            throw new Error(
+              `License key access restricted. This license key was created for a different system (authorized IPv4: ${payload.ipv4}, IPv6: ${payload.ipv6}) and cannot be used on this machine.`
+            );
+          }
+        } else if (payload.ipv4 && !isIpv4Match) {
+          throw new Error(
+            `License key access restricted. This license key was created for a different system (authorized IPv4: ${payload.ipv4}) and cannot be used on this machine.`
+          );
+        } else if (payload.ipv6 && !isIpv6Match) {
+          throw new Error(
+            `License key access restricted. This license key was created for a different system (authorized IPv6: ${payload.ipv6}) and cannot be used on this machine.`
+          );
+        }
+      }
+    } catch (err) {
+      if (err.message.includes("License key access restricted")) {
+        throw new ConfigurationException(`[Retrivora SDK] ${err.message}`);
+      }
+    }
+  }
+};
+// A simple in-memory cache to save CPU overhead of cryptographic signature checks.
+LicenseVerifier.cache = /* @__PURE__ */ new Map();
+LicenseVerifier.CACHE_TTL_MS = 60 * 1e3;
+// Cache verified license for 60 seconds
+// Retrivora's Public Key used to verify the license key signature.
+// In production, this matches the private key held by Retrivora SaaS.
+LicenseVerifier.PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArMieCkCBtTfByRNOserm
+XM4T0Am29JyNzB4XQPe+WJJ56CN73H1HLXx9n1ByFcxkEJ9po+SURj5DnvUXwEy+
+xstx33wDPpVmcMQe33j5CRYS0S4gICiNqIRN7XkTlJtrcXqrmh1/hdOAwfRbjO1T
+NVtORHwUwWfI/lBLyxUPGtKPed+0fQ7NtcW4o00JXxs3EjCB5BV9CbnXoTjQb/4h
+iwZof4l8rb7oaNzOsVg0RSyxsETX7Ex5sI0CjBz1p2mYp4oVhw/A/h8Ls7H0XzjC
++Eb6BLtsytt5JHoSp0jExLlCpDmpys2L+kETcBVx+IqiXtdN1n6KbkksvEDUVzLI
+MwIDAQAB
+-----END PUBLIC KEY-----`;
+
 // src/core/LicenseValidator.ts
 var _LicenseValidator = class _LicenseValidator {
   // 5-minute TTL for successful validation only
@@ -3251,6 +3467,7 @@ var _LicenseValidator = class _LicenseValidator {
    * Validate license status and SDK version against Retrivora License Service
    */
   async validate(request) {
+    var _a;
     const {
       licenseKey,
       projectId,
@@ -3260,29 +3477,38 @@ var _LicenseValidator = class _LicenseValidator {
       retrivoraApiBase,
       headers: customHeaders
     } = request;
-    if (!licenseKey) {
-      this.purgeCache(licenseKey);
+    const getHeader = (name) => {
+      if (!customHeaders) return void 0;
+      const target = name.toLowerCase();
+      for (const [k, v] of Object.entries(customHeaders)) {
+        if (k.toLowerCase() === target) return v;
+      }
+      return void 0;
+    };
+    const effectiveLicenseKey = licenseKey || getHeader("x-license-key") || ((_a = getHeader("authorization")) == null ? void 0 : _a.replace(/^Bearer\s+/i, "")) || (typeof process !== "undefined" ? process.env.NEXT_PUBLIC_RETRIVORA_LICENSE_KEY || process.env.RETRIVORA_LICENSE_KEY : "") || "";
+    if (!effectiveLicenseKey) {
+      this.purgeCache(effectiveLicenseKey);
       throw new LicenseValidationError("Missing RETRIVORA_LICENSE_KEY in request.");
     }
-    const cached = this.cache.get(licenseKey);
+    const cached = this.cache.get(effectiveLicenseKey);
     if (cached) {
       const isFresh = Date.now() - cached.timestamp < _LicenseValidator.SUCCESS_CACHE_TTL_MS;
       if (isFresh && cached.response.valid && cached.response.licenseStatus === "ACTIVE" && !cached.response.forceUpgrade) {
         return cached.response;
       } else {
-        this.cache.delete(licenseKey);
+        this.cache.delete(effectiveLicenseKey);
       }
     }
     const base = retrivoraApiBase || (typeof process !== "undefined" ? process.env.NEXT_PUBLIC_RETRIVORA_API_BASE || process.env.RETRIVORA_API_BASE : "") || "/api/retrivora";
     const validateUrl = `${base.replace(/\/$/, "")}/v1/license/validate`;
-    let res;
+    let res = null;
     try {
       res = await fetch(validateUrl, {
         method: "POST",
         cache: "no-store",
         headers: __spreadValues({
           "Content-Type": "application/json",
-          "x-license-key": licenseKey,
+          "x-license-key": effectiveLicenseKey,
           "x-sdk-version": sdkVersion
         }, customHeaders || {}),
         body: JSON.stringify({
@@ -3294,8 +3520,40 @@ var _LicenseValidator = class _LicenseValidator {
         })
       });
     } catch (err) {
-      this.purgeCache(licenseKey);
-      throw new LicenseValidationError(`License validation request failed: ${(err == null ? void 0 : err.message) || "Network error"}`);
+      try {
+        const payload = LicenseVerifier.verify(licenseKey, projectId || "my-rag-app");
+        const fallbackResp = {
+          valid: true,
+          licenseStatus: "ACTIVE",
+          minimumSupportedVersion: "2.1.0",
+          latestVersion: SDK_VERSION,
+          forceUpgrade: false,
+          expiresAt: payload.expiresAt ? new Date(payload.expiresAt * 1e3).toISOString() : null,
+          message: "Local license verification active."
+        };
+        this.cache.set(licenseKey, { response: fallbackResp, timestamp: Date.now() });
+        return fallbackResp;
+      } catch (e) {
+        this.purgeCache(licenseKey);
+        throw new LicenseValidationError(`License validation request failed: ${(err == null ? void 0 : err.message) || "Network error"}`);
+      }
+    }
+    if (res && !res.ok) {
+      try {
+        const payload = LicenseVerifier.verify(licenseKey, projectId || "my-rag-app");
+        const fallbackResp = {
+          valid: true,
+          licenseStatus: "ACTIVE",
+          minimumSupportedVersion: "2.1.0",
+          latestVersion: SDK_VERSION,
+          forceUpgrade: false,
+          expiresAt: payload.expiresAt ? new Date(payload.expiresAt * 1e3).toISOString() : null,
+          message: "Local license verification active."
+        };
+        this.cache.set(licenseKey, { response: fallbackResp, timestamp: Date.now() });
+        return fallbackResp;
+      } catch (e) {
+      }
     }
     const data = await res.json().catch(() => ({
       valid: false,
@@ -3342,6 +3600,7 @@ function ChatWindow({
   onAddToCart,
   apiUrl,
   retrivoraApiBase,
+  licenseKey: licenseKeyProp,
   headers
 }) {
   var _a;
@@ -3356,6 +3615,7 @@ function ChatWindow({
     namespace: projectId,
     apiUrl,
     retrivoraApiBase,
+    licenseKey: licenseKeyProp,
     headers
   });
   const [suggestions, setSuggestions] = (0, import_react12.useState)([]);
@@ -3370,9 +3630,17 @@ function ChatWindow({
     async function validateSessionLicense() {
       var _a2;
       try {
-        const licenseKey = (headers == null ? void 0 : headers["x-license-key"]) || ((_a2 = headers == null ? void 0 : headers["authorization"]) == null ? void 0 : _a2.replace(/^Bearer\s+/i, "")) || "";
+        const getHeader = (name) => {
+          if (!headers) return void 0;
+          const target = name.toLowerCase();
+          for (const [k, v] of Object.entries(headers)) {
+            if (k.toLowerCase() === target) return v;
+          }
+          return void 0;
+        };
+        const resolvedLicenseKey = licenseKeyProp || getHeader("x-license-key") || ((_a2 = getHeader("authorization")) == null ? void 0 : _a2.replace(/^Bearer\s+/i, "")) || (typeof process !== "undefined" ? process.env.NEXT_PUBLIC_RETRIVORA_LICENSE_KEY || process.env.RETRIVORA_LICENSE_KEY : "") || "";
         await LicenseValidator.getInstance().validate({
-          licenseKey,
+          licenseKey: resolvedLicenseKey,
           projectId,
           retrivoraApiBase,
           headers
@@ -3843,7 +4111,7 @@ var GEMINI_STYLES = `
     --circle: shape(evenodd from 13.482% 79.505%, curve by -7.1945% -12.47% with -1.4985% -1.8575% / -6.328% -10.225%, curve by 0.0985% -33.8965% with -4.1645% -10.7945% / -4.1685% -23.0235%, curve by 6.9955% -12.101% with 1.72% -4.3825% / 4.0845% -8.458%, curve by 30.125% -17.119% with 7.339% -9.1825% / 18.4775% -15.5135%, curve by 13.4165% 0.095% with 4.432% -0.6105% / 8.9505% -0.5855%, curve by 29.364% 16.9% with 11.6215% 1.77% / 22.102% 7.9015%, curve by 7.176% 12.4145% with 3.002% 3.7195% / 5.453% 7.968%, curve by -0.0475% 33.8925% with 4.168% 10.756% / 4.2305% 22.942%, curve by -7.1135% 12.2825% with -1.74% 4.4535% / -4.1455% 8.592%, curve by -29.404% 16.9075% with -7.202% 8.954% / -18.019% 15.137%, curve by -14.19% -0.018% with -4.6635% 0.7255% / -9.4575% 0.7205%, curve by -29.226% -16.8875% with -11.573% -1.8065% / -21.9955% -7.9235%, close);
   }
 `;
-function ChatWidget({ position = "bottom-right", onAddToCart, apiUrl, retrivoraApiBase, headers }) {
+function ChatWidget({ position = "bottom-right", onAddToCart, apiUrl, retrivoraApiBase, licenseKey: licenseKeyProp, headers }) {
   const { ui, projectId } = useConfig();
   const [isOpen, setIsOpen] = (0, import_react13.useState)(false);
   const [hasUnread, setHasUnread] = (0, import_react13.useState)(false);
@@ -3860,9 +4128,17 @@ function ChatWidget({ position = "bottom-right", onAddToCart, apiUrl, retrivoraA
     var _a;
     setIsValidating(true);
     try {
-      const licenseKey = (headers == null ? void 0 : headers["x-license-key"]) || ((_a = headers == null ? void 0 : headers["authorization"]) == null ? void 0 : _a.replace(/^Bearer\s+/i, "")) || "";
+      const getHeader = (name) => {
+        if (!headers) return void 0;
+        const target = name.toLowerCase();
+        for (const [k, v] of Object.entries(headers)) {
+          if (k.toLowerCase() === target) return v;
+        }
+        return void 0;
+      };
+      const resolvedLicenseKey = licenseKeyProp || getHeader("x-license-key") || ((_a = getHeader("authorization")) == null ? void 0 : _a.replace(/^Bearer\s+/i, "")) || (typeof process !== "undefined" ? process.env.NEXT_PUBLIC_RETRIVORA_LICENSE_KEY || process.env.RETRIVORA_LICENSE_KEY : "") || "";
       await LicenseValidator.getInstance().validate({
-        licenseKey,
+        licenseKey: resolvedLicenseKey,
         projectId,
         retrivoraApiBase,
         headers
@@ -3944,6 +4220,7 @@ function ChatWidget({ position = "bottom-right", onAddToCart, apiUrl, retrivoraA
               onAddToCart,
               apiUrl,
               retrivoraApiBase,
+              licenseKey: licenseKeyProp,
               headers
             }
           ),