neuralnode 2.2.4__tar.gz → 2.2.6__tar.gz

{neuralnode-2.2.4 → neuralnode-2.2.6}/.env.example

@@ -15,6 +15,10 @@ GOOGLE_API_KEY=your-google-api-key-here
 # No API key needed, just ensure Ollama is running
 OLLAMA_BASE_URL=http://localhost:11434
 
+# Horus Cyper Nano 1.0 BETA Early Access
+HORUS_CYPER_NANO_API_KEY=horusNN-your-access-token
+HORUS_CYPER_NANO_BASE_URL=https://api.tokenai.llc/v1
+
 # NeuralNode Settings
 NEURALNODE_DEFAULT_PROVIDER=auto
 NEURALNODE_MEMORY_ENABLED=true

{neuralnode-2.2.4 → neuralnode-2.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: neuralnode
-Version: 2.2.4
+Version: 2.2.6
 Summary: Comprehensive AI Framework with 50+ LLM Providers, Advanced Agents, Chains, Memory, RAG, and 100+ Tools
 Project-URL: Homepage, https://assem.cloud/
 Project-URL: Documentation, https://neuralnode.readthedocs.io
@@ -220,7 +220,34 @@ print(ai.chat("Hello from NeuralNode"))
 
 ## Horus
 
-All Horus models use:
+### Horus Cyper Nano 1.0 BETA Early Access API
+
+Approved Early Access users can call the hosted model through the same
+`NeuralNode` interface. Each Access Token has its own server-enforced RPM limit,
+and API conversations are retained by TokenAI under the Early Access terms.
+
+```python
+import neuralnode as nn
+
+ai = nn.NeuralNode(
+    provider="horus-cyper-nano",
+    model="horus-cyper-nano-1.0-beta",
+    api_key="horusNN-XXXXXXXXXXXXXXXX",
+)
+
+print(ai.chat("Review this code for defensive cybersecurity issues."))
+```
+
+The client reads `HORUS_CYPER_NANO_API_KEY` automatically. Override
+`HORUS_CYPER_NANO_BASE_URL` only when TokenAI provides a different API endpoint.
+The production API base URL is `https://api.tokenai.llc/v1`. Agent Mode supports
+function tools, required or named tool choices, tool-result messages, and
+buffered SSE compatibility streams. The hosted Early Access model has a 32,768
+token context. See `examples/horus_cyper_nano_agent_mode.py` for the complete
+tool-call round trip. NeuralNode retries temporary HTTP 429, 502, and 503
+responses up to two times by default and respects the API Retry-After header.
+
+Locally loaded Horus models use:
 - unified chat template: `horus_unified`
 - unified context window: `8192`
 

{neuralnode-2.2.4 → neuralnode-2.2.6}/README.md

@@ -40,7 +40,34 @@ print(ai.chat("Hello from NeuralNode"))
 
 ## Horus
 
-All Horus models use:
+### Horus Cyper Nano 1.0 BETA Early Access API
+
+Approved Early Access users can call the hosted model through the same
+`NeuralNode` interface. Each Access Token has its own server-enforced RPM limit,
+and API conversations are retained by TokenAI under the Early Access terms.
+
+```python
+import neuralnode as nn
+
+ai = nn.NeuralNode(
+    provider="horus-cyper-nano",
+    model="horus-cyper-nano-1.0-beta",
+    api_key="horusNN-XXXXXXXXXXXXXXXX",
+)
+
+print(ai.chat("Review this code for defensive cybersecurity issues."))
+```
+
+The client reads `HORUS_CYPER_NANO_API_KEY` automatically. Override
+`HORUS_CYPER_NANO_BASE_URL` only when TokenAI provides a different API endpoint.
+The production API base URL is `https://api.tokenai.llc/v1`. Agent Mode supports
+function tools, required or named tool choices, tool-result messages, and
+buffered SSE compatibility streams. The hosted Early Access model has a 32,768
+token context. See `examples/horus_cyper_nano_agent_mode.py` for the complete
+tool-call round trip. NeuralNode retries temporary HTTP 429, 502, and 503
+responses up to two times by default and respects the API Retry-After header.
+
+Locally loaded Horus models use:
 - unified chat template: `horus_unified`
 - unified context window: `8192`
 

neuralnode-2.2.6/deployment/early-access-api/002-retention-rate-limits.sql

@@ -0,0 +1,35 @@
+BEGIN;
+
+ALTER TABLE api_conversations
+  DROP CONSTRAINT IF EXISTS api_conversations_special_request_id_fkey;
+
+ALTER TABLE api_usage_events
+  DROP CONSTRAINT IF EXISTS api_usage_events_special_request_id_fkey;
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM api_keys
+    GROUP BY special_request_id
+    HAVING count(*) > 1
+  ) THEN
+    RAISE EXCEPTION 'Cannot enforce one Access Token per user while duplicate API keys exist.';
+  END IF;
+END
+$$;
+
+CREATE UNIQUE INDEX IF NOT EXISTS api_keys_one_per_user_idx
+  ON api_keys (special_request_id);
+
+CREATE TABLE IF NOT EXISTS api_request_rate_events (
+  id BIGSERIAL PRIMARY KEY,
+  api_key_id BIGINT NOT NULL REFERENCES api_keys(id) ON DELETE CASCADE,
+  special_request_id TEXT NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS api_request_rate_events_key_time_idx
+  ON api_request_rate_events (api_key_id, created_at DESC);
+
+COMMIT;

neuralnode-2.2.6/deployment/early-access-api/003-security-hardening.sql

@@ -0,0 +1,46 @@
+BEGIN;
+
+ALTER TABLE api_keys
+  ADD COLUMN IF NOT EXISTS key_ciphertext TEXT,
+  ADD COLUMN IF NOT EXISTS metadata JSONB NOT NULL DEFAULT '{}'::jsonb,
+  ADD COLUMN IF NOT EXISTS expires_at TIMESTAMPTZ;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'api_keys_rpm_limit_check'
+  ) THEN
+    ALTER TABLE api_keys
+      ADD CONSTRAINT api_keys_rpm_limit_check CHECK (rpm_limit BETWEEN 1 AND 600);
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'access_requests_rpm_limit_check'
+  ) THEN
+    ALTER TABLE access_requests
+      ADD CONSTRAINT access_requests_rpm_limit_check CHECK (rpm_limit BETWEEN 1 AND 600);
+  END IF;
+END
+$$;
+
+CREATE TABLE IF NOT EXISTS public_request_rate_events (
+  id BIGSERIAL PRIMARY KEY,
+  fingerprint TEXT NOT NULL,
+  event_type TEXT NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS public_request_rate_events_lookup_idx
+  ON public_request_rate_events (fingerprint, event_type, created_at DESC);
+
+CREATE TABLE IF NOT EXISTS api_inflight_requests (
+  id UUID PRIMARY KEY,
+  api_key_id BIGINT NOT NULL REFERENCES api_keys(id) ON DELETE CASCADE,
+  expires_at TIMESTAMPTZ NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS api_inflight_requests_key_expiry_idx
+  ON api_inflight_requests (api_key_id, expires_at);
+
+COMMIT;

neuralnode-2.2.6/deployment/early-access-api/004-production-readiness.sql

@@ -0,0 +1,39 @@
+BEGIN;
+
+ALTER TABLE api_keys
+  ADD COLUMN IF NOT EXISTS safety_strikes INTEGER NOT NULL DEFAULT 0,
+  ADD COLUMN IF NOT EXISTS disabled_reason TEXT;
+
+CREATE TABLE IF NOT EXISTS inference_queue_leases (
+  id UUID PRIMARY KEY,
+  request_id TEXT NOT NULL UNIQUE,
+  api_key_id BIGINT NOT NULL REFERENCES api_keys(id) ON DELETE CASCADE,
+  special_request_id TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('waiting', 'running')),
+  queued_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  started_at TIMESTAMPTZ,
+  expires_at TIMESTAMPTZ NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS inference_queue_leases_status_time_idx
+  ON inference_queue_leases (status, queued_at, expires_at);
+
+CREATE TABLE IF NOT EXISTS api_safety_events (
+  id BIGSERIAL PRIMARY KEY,
+  api_key_id BIGINT REFERENCES api_keys(id) ON DELETE SET NULL,
+  special_request_id TEXT NOT NULL,
+  request_id TEXT NOT NULL,
+  conversation_id UUID,
+  severity TEXT NOT NULL CHECK (severity IN ('low', 'medium', 'high', 'critical')),
+  action TEXT NOT NULL CHECK (action IN ('observed', 'blocked', 'token_disabled')),
+  categories TEXT[] NOT NULL DEFAULT '{}',
+  matched_rules TEXT[] NOT NULL DEFAULT '{}',
+  content_sha256 TEXT NOT NULL,
+  metadata JSONB NOT NULL DEFAULT '{}'::jsonb,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS api_safety_events_request_time_idx
+  ON api_safety_events (special_request_id, created_at DESC);
+
+COMMIT;

neuralnode-2.2.6/deployment/early-access-api/Dockerfile

@@ -0,0 +1,14 @@
+FROM node:22-alpine
+
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci --omit=dev
+COPY --chown=node:node *.js ./
+COPY --chown=node:node *.sh ./
+COPY --chown=node:node assets ./assets
+RUN chmod 755 ./*.sh
+
+USER node
+
+EXPOSE 8080
+CMD ["node", "server.js"]

neuralnode-2.2.6/deployment/early-access-api/README.md

@@ -0,0 +1,79 @@
+# Horus Cyper Nano Early Access Gateway
+
+This module is installed beside the existing TokenAI Early Access API on AWS.
+It reuses the existing Access Token authentication and PostgreSQL pool. The
+deployed API entrypoint is mirrored in `server.production.js`.
+
+The public API contract is:
+
+- `GET /v1/access`
+- `GET /v1/models`
+- `POST /v1/chat/completions`
+
+Production guarantees:
+
+- One active Access Token may exist for each Early Access user.
+- Accepted requests are limited by the per-key RPM value stored in PostgreSQL.
+- Every successful completion stores the customer messages and matching model
+  response in the same conversation record.
+- Agent Mode accepts function tools, tool choices, assistant tool calls, tool
+  results, and buffered SSE responses while retaining the complete interaction.
+- Production inference uses two CUDA workers with a 32,768-token context. The
+  public base URL is `https://api.tokenai.llc/v1`.
+- A PostgreSQL-backed FIFO queue limits global model concurrency to two running
+  requests. A full queue returns HTTP 503 with `Retry-After` instead of
+  overloading the GPU workers.
+- High-confidence malicious cybersecurity or model-extraction requests are
+  blocked, audited, and permanently disable the offending Access Token.
+- Raw role markers and duplicate output are rejected and retried against the
+  alternate worker before the gateway fails closed.
+- Deleting a user removes their application, email, token, and personal data so
+  the email can register again. Conversation and usage audit records are kept
+  and shown as belonging to a deleted identity.
+
+Database setup runs migrations `001` through `004`. They add the one-token
+unique index, durable rate-limit events, encrypted Access Token recovery,
+concurrency and queue leases, safety events, public endpoint throttling, and
+audit-log retention behavior.
+
+`tokenai-early-access-backup.timer` creates and validates a PostgreSQL custom
+dump every day. The dump is encrypted with a unique AES-256 key, the AES key is
+wrapped by an RSA public key, and the archive is copied to the model host. Only
+the off-instance destination has the RSA private key. The receiver verifies the
+checksum, decrypts the dump, and runs `pg_restore --list` before accepting it.
+Local encrypted archives are retained for 14 days and off-instance archives for
+30 days.
+
+`docker-compose.aws.yml` mirrors the AWS deployment. The permanent named
+Cloudflare Tunnel publishes only the private API origin. The edge Worker reaches
+that origin through a Cloudflare VPC Service binding; no Quick Tunnel or public
+origin address is used.
+
+`tokenai-early-access-monitor.timer` checks the API, database, edge path, model
+transport, both workers, queue state, GPU health, latency, disk usage, and backup
+age every minute. Alert and recovery messages are delivered through the
+configured TokenAI mailbox.
+
+Required model-server configuration:
+
+```dotenv
+MODEL_UPSTREAM_URLS=http://model-worker-1/v1,http://model-worker-2/v1
+MODEL_UPSTREAM_MODEL=deployed-model-id
+MODEL_UPSTREAM_MODE=completion
+MODEL_UPSTREAM_API_KEY=
+MODEL_UPSTREAM_AUTH_HEADER=Authorization
+MODEL_UPSTREAM_AUTH_SCHEME=Bearer
+MODEL_UPSTREAM_TIMEOUT_MS=120000
+```
+
+`MODEL_UPSTREAM_URLS` accepts a comma-separated list of API base URLs or complete
+`/chat/completions` endpoints. Requests are distributed in round-robin order and
+retry another worker after a network error or an HTTP 5xx response. The singular
+`MODEL_UPSTREAM_URL` remains supported for one-worker deployments. Until either
+setting is configured, authenticated requests fail closed with HTTP 503 and are
+recorded as failed usage events.
+
+The current model transport is restricted to the Docker bridge address and uses
+a pinned SSH host key. `../model-server/direct-vpc-cutover.md` contains the
+single security-group rule required to replace that transport with direct VPC
+traffic restricted to the Early Access API security group.

neuralnode-2.2.6/deployment/early-access-api/agent-mode-self-test.js

@@ -0,0 +1,117 @@
+import crypto from "node:crypto"
+import pg from "pg"
+
+const { Pool } = pg
+const pool = new Pool({ connectionString: process.env.DATABASE_URL, max: 2 })
+const suffix = crypto.randomBytes(5).toString("hex").toUpperCase()
+const specialRequestId = `HCN10-AGENT-${suffix}`
+const apiKey = `horusNN-${crypto.randomBytes(12).toString("hex").slice(0, 16)}`
+const keyPrefix = `${apiKey.slice(0, 12)}...`
+const keyHash = crypto.createHash("sha256").update(`${apiKey}:${process.env.API_KEY_PEPPER}`).digest("hex")
+const conversationId = crypto.randomUUID()
+const apiBase = "http://127.0.0.1:18081"
+
+async function request(payload) {
+  return fetch(`${apiBase}/v1/chat/completions`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "Content-Type": "application/json",
+      "X-Client-Name": "Agent Mode Self Test",
+    },
+    body: JSON.stringify({ model: "horus-cyper-nano-1.0-beta", max_tokens: 64, ...payload }),
+  })
+}
+
+let result = {}
+try {
+  await pool.query(
+    `INSERT INTO access_requests (
+       special_request_id, first_name, second_name, full_name, company_name,
+       company_website, job, applicant_type, rpm_limit, business_mail,
+       linkedin_profile_url, github_profile_url, portfolio_url, country_or_region,
+       use_cases, responsible_use_accepted, responsible_use_accepted_at, status, source
+     ) VALUES (
+       $1, 'Agent', 'Self Test', 'Agent Self Test', 'TokenAI',
+       'https://tokenai.llc', 'Integration test', 'developer_researcher', 10, $2,
+       'https://linkedin.com/in/tokenai-test', 'https://github.com/tokenai-test', '', 'Internal',
+       'Temporary automated Agent Mode verification.', true, now(), 'approved', 'agent-mode-self-test'
+     )`,
+    [specialRequestId, `agent-${suffix.toLowerCase()}@tokenai.llc`],
+  )
+  await pool.query(
+    `INSERT INTO api_keys (special_request_id, key_prefix, key_hash, rpm_limit)
+     VALUES ($1, $2, $3, 10)`,
+    [specialRequestId, keyPrefix, keyHash],
+  )
+
+  const firstResponse = await request({
+    conversation_id: conversationId,
+    messages: [{ role: "user", content: "Check the gateway status using the available tool." }],
+    tools: [{
+      type: "function",
+      function: {
+        name: "get_status",
+        description: "Read a service status.",
+        parameters: {
+          type: "object",
+          properties: { target: { type: "string" } },
+          required: ["target"],
+          additionalProperties: false,
+        },
+      },
+    }],
+    tool_choice: "required",
+  })
+  const firstBody = await firstResponse.json()
+  const toolCall = firstBody.choices?.[0]?.message?.tool_calls?.[0]
+
+  if (!toolCall) {
+    throw new Error(`The model did not return a required tool call: ${JSON.stringify(firstBody).slice(0, 1000)}`)
+  }
+
+  const secondResponse = await request({
+    conversation_id: conversationId,
+    messages: [
+      { role: "user", content: "Check the gateway status using the available tool." },
+      { role: "assistant", content: null, tool_calls: [toolCall] },
+      { role: "tool", tool_call_id: toolCall.id, content: '{"status":"healthy"}' },
+    ],
+  })
+  const secondBody = await secondResponse.json()
+
+  const streamResponse = await request({
+    messages: [{ role: "user", content: "Return a short compatibility response." }],
+    stream: true,
+  })
+  const streamBody = await streamResponse.text()
+
+  const stored = await pool.query(
+    `SELECT
+       count(*)::int AS total_messages,
+       count(*) FILTER (WHERE role = 'tool')::int AS tool_messages,
+       count(*) FILTER (WHERE cm.role = 'assistant' AND cm.metadata ? 'toolCalls')::int AS tool_call_messages
+     FROM conversation_messages cm
+     JOIN api_conversations ac ON ac.id = cm.conversation_id
+     WHERE ac.special_request_id = $1`,
+    [specialRequestId],
+  )
+
+  result = {
+    toolRequestStatus: firstResponse.status,
+    toolCallName: toolCall?.function?.name,
+    toolResultStatus: secondResponse.status,
+    finalContent: secondBody.choices?.[0]?.message?.content,
+    streamStatus: streamResponse.status,
+    streamContentType: streamResponse.headers.get("content-type"),
+    streamDone: streamBody.includes("data: [DONE]"),
+    stored: stored.rows[0],
+  }
+} finally {
+  await pool.query("DELETE FROM access_requests WHERE special_request_id = $1", [specialRequestId])
+  await pool.query("DELETE FROM api_conversations WHERE special_request_id = $1", [specialRequestId])
+  await pool.query("DELETE FROM api_usage_events WHERE special_request_id = $1", [specialRequestId])
+  await pool.end()
+}
+
+console.log(JSON.stringify(result))

neuralnode-2.2.6/deployment/early-access-api/backup-postgres.sh

@@ -0,0 +1,61 @@
+#!/bin/sh
+set -eu
+
+backup_dir=${BACKUP_LOCAL_DIR:-/opt/tokenai-early-access/backups}
+remote_host=${BACKUP_REMOTE_HOST:-54.91.40.201}
+remote_user=${BACKUP_REMOTE_USER:-ec2-user}
+remote_key=${BACKUP_REMOTE_SSH_KEY:-/home/ec2-user/.ssh/horus_backup_transfer}
+public_key=${BACKUP_ENCRYPTION_PUBLIC_KEY:-/opt/tokenai-early-access/backup_public.pem}
+timestamp=$(date -u +%Y%m%dT%H%M%SZ)
+name=early-access-$timestamp
+work_dir=$(mktemp -d)
+umask 077
+
+cleanup() {
+  rm -rf "$work_dir"
+}
+trap cleanup EXIT INT TERM
+
+mkdir -p "$backup_dir"
+test -r "$remote_key"
+test -r "$public_key"
+
+docker exec tokenai-early-access-postgres-1 sh -lc \
+  'pg_dump -U "$POSTGRES_USER" -d "$POSTGRES_DB" --format=custom --no-owner --no-privileges' \
+  > "$work_dir/$name.dump"
+
+docker exec -i tokenai-early-access-postgres-1 pg_restore --list \
+  < "$work_dir/$name.dump" > /dev/null
+
+openssl rand -base64 48 > "$work_dir/passphrase"
+openssl enc -aes-256-cbc -pbkdf2 -iter 200000 -salt \
+  -in "$work_dir/$name.dump" \
+  -out "$work_dir/database.dump.enc" \
+  -pass file:"$work_dir/passphrase"
+openssl pkeyutl -encrypt -pubin -inkey "$public_key" \
+  -in "$work_dir/passphrase" \
+  -out "$work_dir/passphrase.enc" \
+  -pkeyopt rsa_padding_mode:oaep \
+  -pkeyopt rsa_oaep_md:sha256
+
+dump_sha=$(sha256sum "$work_dir/database.dump.enc" | awk '{print $1}')
+key_sha=$(sha256sum "$work_dir/passphrase.enc" | awk '{print $1}')
+cat > "$work_dir/manifest.txt" <<EOF
+format=tokenai-early-access-backup-v1
+created_at=$timestamp
+database_cipher_sha256=$dump_sha
+wrapped_key_sha256=$key_sha
+encryption=aes-256-cbc-pbkdf2-200000+rsa-oaep-sha256
+EOF
+
+tar -C "$work_dir" -czf "$backup_dir/$name.tar.gz" database.dump.enc passphrase.enc manifest.txt
+archive_sha=$(sha256sum "$backup_dir/$name.tar.gz" | awk '{print $1}')
+
+ssh -o BatchMode=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/home/ec2-user/.ssh/known_hosts -i "$remote_key" \
+  "$remote_user@$remote_host" "upload $name.tar.gz $archive_sha" \
+  < "$backup_dir/$name.tar.gz"
+ssh -o BatchMode=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/home/ec2-user/.ssh/known_hosts -i "$remote_key" \
+  "$remote_user@$remote_host" "verify $name.tar.gz"
+
+find "$backup_dir" -type f -name 'early-access-*.tar.gz' -mtime +14 -delete
+find "$backup_dir" -type f -name 'early-access-*.dump' -delete

neuralnode-2.2.6/deployment/early-access-api/docker-compose.aws.yml

@@ -0,0 +1,94 @@
+services:
+  postgres:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB}
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+      - ./db/init.sql:/docker-entrypoint-initdb.d/001-init.sql:ro
+      - ./db/002-retention-rate-limits.sql:/docker-entrypoint-initdb.d/002-retention-rate-limits.sql:ro
+      - ./db/003-security-hardening.sql:/docker-entrypoint-initdb.d/003-security-hardening.sql:ro
+      - ./db/004-production-readiness.sql:/docker-entrypoint-initdb.d/004-production-readiness.sql:ro
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  api:
+    build:
+      context: ./api
+    image: tokenai-early-access-api:0.3.5
+    restart: unless-stopped
+    environment:
+      DATABASE_URL: ${DATABASE_URL}
+      PORT: ${PORT}
+      ADMIN_TOKEN: ${ADMIN_TOKEN}
+      API_KEY_PEPPER: ${API_KEY_PEPPER}
+      API_KEY_ENCRYPTION_KEY: ${API_KEY_ENCRYPTION_KEY}
+      TOKENAI_ALLOWED_ORIGINS: ${TOKENAI_ALLOWED_ORIGINS}
+      SMTP_HOST: ${SMTP_HOST}
+      SMTP_PORT: ${SMTP_PORT}
+      SMTP_SECURE: ${SMTP_SECURE}
+      SMTP_USER: ${SMTP_USER}
+      SMTP_PASS: ${SMTP_PASS}
+      SMTP_FROM_EMAIL: ${SMTP_FROM_EMAIL}
+      SMTP_FROM_NAME: ${SMTP_FROM_NAME}
+      REPLY_TO_EMAIL: ${REPLY_TO_EMAIL}
+      MODEL_UPSTREAM_URL: ${MODEL_UPSTREAM_URL:-}
+      MODEL_UPSTREAM_URLS: ${MODEL_UPSTREAM_URLS:-}
+      MODEL_UPSTREAM_MODEL: ${MODEL_UPSTREAM_MODEL:-}
+      MODEL_UPSTREAM_MODE: ${MODEL_UPSTREAM_MODE:-chat}
+      MODEL_UPSTREAM_API_KEY: ${MODEL_UPSTREAM_API_KEY:-}
+      MODEL_UPSTREAM_AUTH_HEADER: ${MODEL_UPSTREAM_AUTH_HEADER:-Authorization}
+      MODEL_UPSTREAM_AUTH_SCHEME: ${MODEL_UPSTREAM_AUTH_SCHEME:-Bearer}
+      MODEL_UPSTREAM_TIMEOUT_MS: ${MODEL_UPSTREAM_TIMEOUT_MS:-120000}
+      MODEL_QUALITY_FAIL_CLOSED: ${MODEL_QUALITY_FAIL_CLOSED:-true}
+      GLOBAL_INFERENCE_CAPACITY: ${GLOBAL_INFERENCE_CAPACITY:-2}
+      GLOBAL_INFERENCE_MAX_QUEUE: ${GLOBAL_INFERENCE_MAX_QUEUE:-40}
+      GLOBAL_INFERENCE_QUEUE_TIMEOUT_MS: ${GLOBAL_INFERENCE_QUEUE_TIMEOUT_MS:-120000}
+      GLOBAL_INFERENCE_LEASE_SECONDS: ${GLOBAL_INFERENCE_LEASE_SECONDS:-240}
+    extra_hosts:
+      - "host.docker.internal:172.18.0.1"
+    ports:
+      - "127.0.0.1:8080:8080"
+    read_only: true
+    tmpfs:
+      - /tmp:size=16m,mode=1777
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8080/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+  cloudflared:
+    image: cloudflare/cloudflared:latest
+    restart: unless-stopped
+    command: tunnel --no-autoupdate run --token ${TUNNEL_TOKEN}
+    depends_on:
+      - api
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
+volumes:
+  postgres_data:
+
+networks:
+  default:
+    ipam:
+      config:
+        - subnet: 172.18.0.0/16
+          gateway: 172.18.0.1

neuralnode-2.2.6/deployment/early-access-api/gateway-self-test.js

@@ -0,0 +1,92 @@
+import crypto from "node:crypto"
+import pg from "pg"
+
+const { Pool } = pg
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL, max: 2 })
+const suffix = crypto.randomBytes(5).toString("hex").toUpperCase()
+const specialRequestId = `HCN10-INTEGRATION-${suffix}`
+const tokenSuffix = crypto.randomBytes(12).toString("base64url").replace(/[^A-Za-z0-9]/g, "").slice(0, 16)
+const apiKey = `horusNN-${tokenSuffix.padEnd(16, "A")}`
+const keyPrefix = `${apiKey.slice(0, 12)}...`
+const keyHash = crypto
+  .createHash("sha256")
+  .update(`${apiKey}:${process.env.API_KEY_PEPPER}`)
+  .digest("hex")
+
+let result
+try {
+  await pool.query(
+    `INSERT INTO access_requests (
+       special_request_id, first_name, second_name, full_name, company_name,
+       company_website, job, applicant_type, rpm_limit, business_mail,
+       linkedin_profile_url, github_profile_url, portfolio_url, country_or_region,
+       use_cases, responsible_use_accepted, responsible_use_accepted_at, status,
+       api_key_prefix, api_key_hash, source
+     ) VALUES (
+       $1, 'Gateway', 'Self Test', 'Gateway Self Test', 'TokenAI',
+       'https://tokenai.llc', 'Integration test', 'developer_researcher', 20, $2,
+       'https://linkedin.com/in/tokenai-test', 'https://github.com/tokenai-test', '', 'Internal',
+       'Temporary automated gateway verification record.', true, now(), 'approved',
+       $3, $4, 'gateway-self-test'
+     )`,
+    [specialRequestId, `gateway-${suffix.toLowerCase()}@tokenai.llc`, keyPrefix, keyHash],
+  )
+  await pool.query(
+    `INSERT INTO api_keys (special_request_id, key_prefix, key_hash, rpm_limit)
+     VALUES ($1, $2, $3, 20)`,
+    [specialRequestId, keyPrefix, keyHash],
+  )
+
+  const accessResponse = await fetch("http://127.0.0.1:8080/v1/access", {
+    headers: { Authorization: `Bearer ${apiKey}` },
+  })
+  const accessBody = await accessResponse.json()
+
+  const chatResponse = await fetch("http://127.0.0.1:8080/v1/chat/completions", {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "Content-Type": "application/json",
+      "X-Client-Name": "NeuralNode Gateway Self Test",
+    },
+    body: JSON.stringify({
+      model: "horus-cyper-nano-1.0-beta",
+      messages: [{ role: "user", content: "Gateway storage verification message." }],
+      max_tokens: 32,
+      stream: false,
+    }),
+  })
+  const chatBody = await chatResponse.json()
+
+  const counts = await pool.query(
+    `SELECT
+       (SELECT count(*)::int FROM api_conversations WHERE special_request_id = $1) AS conversations,
+       (SELECT count(*)::int FROM conversation_messages cm
+          JOIN api_conversations ac ON ac.id = cm.conversation_id
+        WHERE ac.special_request_id = $1) AS messages,
+       (SELECT count(*)::int FROM api_usage_events WHERE special_request_id = $1) AS usage_events`,
+    [specialRequestId],
+  )
+
+  result = {
+    accessStatus: accessResponse.status,
+    accessRpmLimit: accessBody.rpm_limit,
+    chatStatus: chatResponse.status,
+    chatErrorCode: chatBody?.error?.code,
+    requestIdPresent: Boolean(chatBody.request_id),
+    conversationIdPresent: Boolean(chatBody.conversation_id),
+    assistantPreview: String(chatBody?.choices?.[0]?.message?.content || "").slice(0, 240),
+    stored: counts.rows[0],
+  }
+} finally {
+  await pool.query("DELETE FROM access_requests WHERE special_request_id = $1", [specialRequestId])
+  const cleanup = await pool.query(
+    "SELECT count(*)::int AS remaining FROM access_requests WHERE special_request_id = $1",
+    [specialRequestId],
+  )
+  result = { ...(result || {}), cleanupRemaining: cleanup.rows[0].remaining }
+  await pool.end()
+}
+
+console.log(JSON.stringify(result))