neuralnode 2.2.6__tar.gz → 2.2.7__tar.gz

{neuralnode-2.2.6 → neuralnode-2.2.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: neuralnode
-Version: 2.2.6
+Version: 2.2.7
 Summary: Comprehensive AI Framework with 50+ LLM Providers, Advanced Agents, Chains, Memory, RAG, and 100+ Tools
 Project-URL: Homepage, https://assem.cloud/
 Project-URL: Documentation, https://neuralnode.readthedocs.io
@@ -178,7 +178,7 @@ Provides-Extra: whatsapp
 Requires-Dist: twilio>=9.0.0; extra == 'whatsapp'
 Description-Content-Type: text/markdown
 
-# NeuralNode v2.2.0
+# NeuralNode v2.2.7
 
 NeuralNode is a Python AI framework focused on:
 - real cloud providers that are implemented
@@ -222,7 +222,7 @@ print(ai.chat("Hello from NeuralNode"))
 
 ### Horus Cyper Nano 1.0 BETA Early Access API
 
-Approved Early Access users can call the hosted model through the same
+Horus Cyper Nano 1.0 BETA is a Text-to-Text model. Approved Early Access users can call the hosted model through the same
 `NeuralNode` interface. Each Access Token has its own server-enforced RPM limit,
 and API conversations are retained by TokenAI under the Early Access terms.
 

{neuralnode-2.2.6 → neuralnode-2.2.7}/README.md

@@ -1,4 +1,4 @@
-# NeuralNode v2.2.0
+# NeuralNode v2.2.7
 
 NeuralNode is a Python AI framework focused on:
 - real cloud providers that are implemented
@@ -42,7 +42,7 @@ print(ai.chat("Hello from NeuralNode"))
 
 ### Horus Cyper Nano 1.0 BETA Early Access API
 
-Approved Early Access users can call the hosted model through the same
+Horus Cyper Nano 1.0 BETA is a Text-to-Text model. Approved Early Access users can call the hosted model through the same
 `NeuralNode` interface. Each Access Token has its own server-enforced RPM limit,
 and API conversations are retained by TokenAI under the Early Access terms.
 

{neuralnode-2.2.6 → neuralnode-2.2.7}/examples/horus_cyper_nano_early_access.py

@@ -1,4 +1,4 @@
-"""Horus Cyper Nano 1.0 BETA Early Access example."""
+"""Horus Cyper Nano 1.0 BETA Text-to-Text Early Access example."""
 
 import os
 

{neuralnode-2.2.6 → neuralnode-2.2.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "neuralnode"
-version = "2.2.6"
+version = "2.2.7"
 description = "Comprehensive AI Framework with 50+ LLM Providers, Advanced Agents, Chains, Memory, RAG, and 100+ Tools"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -226,6 +226,7 @@ exclude = [
     "/.tmp_*",
     "/actionlint.zip",
     "/actionlint_bin",
+    "/deployment",
     "/dist",
     "/dist_*",
     "/outputs",

{neuralnode-2.2.6 → neuralnode-2.2.7}/src/neuralnode/__init__.py

@@ -42,7 +42,7 @@ Quick Start::
     text = sr.listen()
 """
 
-__version__ = "2.2.6"
+__version__ = "2.2.7"
 __author__ = "NeuralNode Contributors"
 
 # ── Core types ────────────────────────────────────────────────────────────────

{neuralnode-2.2.6 → neuralnode-2.2.7}/src/neuralnode/providers/chat/horus_cyper_nano.py

@@ -38,11 +38,12 @@ class HorusCyperNanoAPIError(RuntimeError):
 
 
 class HorusCyperNanoProvider(BaseLLMProvider):
-    """Client for the gated Horus Cyper Nano 1.0 BETA API."""
+    """Client for the gated Horus Cyper Nano 1.0 BETA Text-to-Text API."""
 
     provider_name = "horus-cyper-nano"
     provider_type = ProviderType.CLOUD_API
     default_model = DEFAULT_MODEL
+    model_type = "text-to-text"
     api_key_env_var = "HORUS_CYPER_NANO_API_KEY"
     base_url_env_var = "HORUS_CYPER_NANO_BASE_URL"
 

{neuralnode-2.2.6 → neuralnode-2.2.7}/tests/test_horus_cyper_nano_api.py

@@ -38,6 +38,8 @@ class TestHorusCyperNanoProvider(unittest.TestCase):
     def test_provider_reports_hosted_context_window(self):
         provider = nn.HorusCyperNanoProvider(api_key="horusNN-ABCDEFGHIJKLMNOP")
         self.assertEqual(provider.capabilities.context_window, 32768)
+        self.assertEqual(provider.model_type, "text-to-text")
+        self.assertFalse(provider.capabilities.vision)
 
     def test_access_token_is_required(self):
         with patch.dict("os.environ", {}, clear=True), self.assertRaisesRegex(

{neuralnode-2.2.6 → neuralnode-2.2.7}/tests/test_release_readiness.py

@@ -7,9 +7,9 @@ import nn as nn_short
 class TestReleaseReadiness(unittest.TestCase):
     
     def test_version_bump(self):
-        """Verify version is updated to 2.2.6 in the packages."""
-        self.assertEqual(nn.__version__, "2.2.6")
-        self.assertEqual(nn_short.__version__, "2.2.6")
+        """Verify version is updated to 2.2.7 in the packages."""
+        self.assertEqual(nn.__version__, "2.2.7")
+        self.assertEqual(nn_short.__version__, "2.2.7")
 
     def test_provider_registration(self):
         """Verify key providers are registered in the registry."""

neuralnode-2.2.6/deployment/early-access-api/002-retention-rate-limits.sql

@@ -1,35 +0,0 @@
-BEGIN;
-
-ALTER TABLE api_conversations
-  DROP CONSTRAINT IF EXISTS api_conversations_special_request_id_fkey;
-
-ALTER TABLE api_usage_events
-  DROP CONSTRAINT IF EXISTS api_usage_events_special_request_id_fkey;
-
-DO $$
-BEGIN
-  IF EXISTS (
-    SELECT 1
-    FROM api_keys
-    GROUP BY special_request_id
-    HAVING count(*) > 1
-  ) THEN
-    RAISE EXCEPTION 'Cannot enforce one Access Token per user while duplicate API keys exist.';
-  END IF;
-END
-$$;
-
-CREATE UNIQUE INDEX IF NOT EXISTS api_keys_one_per_user_idx
-  ON api_keys (special_request_id);
-
-CREATE TABLE IF NOT EXISTS api_request_rate_events (
-  id BIGSERIAL PRIMARY KEY,
-  api_key_id BIGINT NOT NULL REFERENCES api_keys(id) ON DELETE CASCADE,
-  special_request_id TEXT NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
-);
-
-CREATE INDEX IF NOT EXISTS api_request_rate_events_key_time_idx
-  ON api_request_rate_events (api_key_id, created_at DESC);
-
-COMMIT;

neuralnode-2.2.6/deployment/early-access-api/003-security-hardening.sql

@@ -1,46 +0,0 @@
-BEGIN;
-
-ALTER TABLE api_keys
-  ADD COLUMN IF NOT EXISTS key_ciphertext TEXT,
-  ADD COLUMN IF NOT EXISTS metadata JSONB NOT NULL DEFAULT '{}'::jsonb,
-  ADD COLUMN IF NOT EXISTS expires_at TIMESTAMPTZ;
-
-DO $$
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM pg_constraint WHERE conname = 'api_keys_rpm_limit_check'
-  ) THEN
-    ALTER TABLE api_keys
-      ADD CONSTRAINT api_keys_rpm_limit_check CHECK (rpm_limit BETWEEN 1 AND 600);
-  END IF;
-
-  IF NOT EXISTS (
-    SELECT 1 FROM pg_constraint WHERE conname = 'access_requests_rpm_limit_check'
-  ) THEN
-    ALTER TABLE access_requests
-      ADD CONSTRAINT access_requests_rpm_limit_check CHECK (rpm_limit BETWEEN 1 AND 600);
-  END IF;
-END
-$$;
-
-CREATE TABLE IF NOT EXISTS public_request_rate_events (
-  id BIGSERIAL PRIMARY KEY,
-  fingerprint TEXT NOT NULL,
-  event_type TEXT NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
-);
-
-CREATE INDEX IF NOT EXISTS public_request_rate_events_lookup_idx
-  ON public_request_rate_events (fingerprint, event_type, created_at DESC);
-
-CREATE TABLE IF NOT EXISTS api_inflight_requests (
-  id UUID PRIMARY KEY,
-  api_key_id BIGINT NOT NULL REFERENCES api_keys(id) ON DELETE CASCADE,
-  expires_at TIMESTAMPTZ NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
-);
-
-CREATE INDEX IF NOT EXISTS api_inflight_requests_key_expiry_idx
-  ON api_inflight_requests (api_key_id, expires_at);
-
-COMMIT;

neuralnode-2.2.6/deployment/early-access-api/004-production-readiness.sql

@@ -1,39 +0,0 @@
-BEGIN;
-
-ALTER TABLE api_keys
-  ADD COLUMN IF NOT EXISTS safety_strikes INTEGER NOT NULL DEFAULT 0,
-  ADD COLUMN IF NOT EXISTS disabled_reason TEXT;
-
-CREATE TABLE IF NOT EXISTS inference_queue_leases (
-  id UUID PRIMARY KEY,
-  request_id TEXT NOT NULL UNIQUE,
-  api_key_id BIGINT NOT NULL REFERENCES api_keys(id) ON DELETE CASCADE,
-  special_request_id TEXT NOT NULL,
-  status TEXT NOT NULL CHECK (status IN ('waiting', 'running')),
-  queued_at TIMESTAMPTZ NOT NULL DEFAULT now(),
-  started_at TIMESTAMPTZ,
-  expires_at TIMESTAMPTZ NOT NULL
-);
-
-CREATE INDEX IF NOT EXISTS inference_queue_leases_status_time_idx
-  ON inference_queue_leases (status, queued_at, expires_at);
-
-CREATE TABLE IF NOT EXISTS api_safety_events (
-  id BIGSERIAL PRIMARY KEY,
-  api_key_id BIGINT REFERENCES api_keys(id) ON DELETE SET NULL,
-  special_request_id TEXT NOT NULL,
-  request_id TEXT NOT NULL,
-  conversation_id UUID,
-  severity TEXT NOT NULL CHECK (severity IN ('low', 'medium', 'high', 'critical')),
-  action TEXT NOT NULL CHECK (action IN ('observed', 'blocked', 'token_disabled')),
-  categories TEXT[] NOT NULL DEFAULT '{}',
-  matched_rules TEXT[] NOT NULL DEFAULT '{}',
-  content_sha256 TEXT NOT NULL,
-  metadata JSONB NOT NULL DEFAULT '{}'::jsonb,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
-);
-
-CREATE INDEX IF NOT EXISTS api_safety_events_request_time_idx
-  ON api_safety_events (special_request_id, created_at DESC);
-
-COMMIT;

neuralnode-2.2.6/deployment/early-access-api/Dockerfile

@@ -1,14 +0,0 @@
-FROM node:22-alpine
-
-WORKDIR /app
-COPY package*.json ./
-RUN npm ci --omit=dev
-COPY --chown=node:node *.js ./
-COPY --chown=node:node *.sh ./
-COPY --chown=node:node assets ./assets
-RUN chmod 755 ./*.sh
-
-USER node
-
-EXPOSE 8080
-CMD ["node", "server.js"]

neuralnode-2.2.6/deployment/early-access-api/README.md

@@ -1,79 +0,0 @@
-# Horus Cyper Nano Early Access Gateway
-
-This module is installed beside the existing TokenAI Early Access API on AWS.
-It reuses the existing Access Token authentication and PostgreSQL pool. The
-deployed API entrypoint is mirrored in `server.production.js`.
-
-The public API contract is:
-
-- `GET /v1/access`
-- `GET /v1/models`
-- `POST /v1/chat/completions`
-
-Production guarantees:
-
-- One active Access Token may exist for each Early Access user.
-- Accepted requests are limited by the per-key RPM value stored in PostgreSQL.
-- Every successful completion stores the customer messages and matching model
-  response in the same conversation record.
-- Agent Mode accepts function tools, tool choices, assistant tool calls, tool
-  results, and buffered SSE responses while retaining the complete interaction.
-- Production inference uses two CUDA workers with a 32,768-token context. The
-  public base URL is `https://api.tokenai.llc/v1`.
-- A PostgreSQL-backed FIFO queue limits global model concurrency to two running
-  requests. A full queue returns HTTP 503 with `Retry-After` instead of
-  overloading the GPU workers.
-- High-confidence malicious cybersecurity or model-extraction requests are
-  blocked, audited, and permanently disable the offending Access Token.
-- Raw role markers and duplicate output are rejected and retried against the
-  alternate worker before the gateway fails closed.
-- Deleting a user removes their application, email, token, and personal data so
-  the email can register again. Conversation and usage audit records are kept
-  and shown as belonging to a deleted identity.
-
-Database setup runs migrations `001` through `004`. They add the one-token
-unique index, durable rate-limit events, encrypted Access Token recovery,
-concurrency and queue leases, safety events, public endpoint throttling, and
-audit-log retention behavior.
-
-`tokenai-early-access-backup.timer` creates and validates a PostgreSQL custom
-dump every day. The dump is encrypted with a unique AES-256 key, the AES key is
-wrapped by an RSA public key, and the archive is copied to the model host. Only
-the off-instance destination has the RSA private key. The receiver verifies the
-checksum, decrypts the dump, and runs `pg_restore --list` before accepting it.
-Local encrypted archives are retained for 14 days and off-instance archives for
-30 days.
-
-`docker-compose.aws.yml` mirrors the AWS deployment. The permanent named
-Cloudflare Tunnel publishes only the private API origin. The edge Worker reaches
-that origin through a Cloudflare VPC Service binding; no Quick Tunnel or public
-origin address is used.
-
-`tokenai-early-access-monitor.timer` checks the API, database, edge path, model
-transport, both workers, queue state, GPU health, latency, disk usage, and backup
-age every minute. Alert and recovery messages are delivered through the
-configured TokenAI mailbox.
-
-Required model-server configuration:
-
-```dotenv
-MODEL_UPSTREAM_URLS=http://model-worker-1/v1,http://model-worker-2/v1
-MODEL_UPSTREAM_MODEL=deployed-model-id
-MODEL_UPSTREAM_MODE=completion
-MODEL_UPSTREAM_API_KEY=
-MODEL_UPSTREAM_AUTH_HEADER=Authorization
-MODEL_UPSTREAM_AUTH_SCHEME=Bearer
-MODEL_UPSTREAM_TIMEOUT_MS=120000
-```
-
-`MODEL_UPSTREAM_URLS` accepts a comma-separated list of API base URLs or complete
-`/chat/completions` endpoints. Requests are distributed in round-robin order and
-retry another worker after a network error or an HTTP 5xx response. The singular
-`MODEL_UPSTREAM_URL` remains supported for one-worker deployments. Until either
-setting is configured, authenticated requests fail closed with HTTP 503 and are
-recorded as failed usage events.
-
-The current model transport is restricted to the Docker bridge address and uses
-a pinned SSH host key. `../model-server/direct-vpc-cutover.md` contains the
-single security-group rule required to replace that transport with direct VPC
-traffic restricted to the Early Access API security group.

neuralnode-2.2.6/deployment/early-access-api/agent-mode-self-test.js

@@ -1,117 +0,0 @@
-import crypto from "node:crypto"
-import pg from "pg"
-
-const { Pool } = pg
-const pool = new Pool({ connectionString: process.env.DATABASE_URL, max: 2 })
-const suffix = crypto.randomBytes(5).toString("hex").toUpperCase()
-const specialRequestId = `HCN10-AGENT-${suffix}`
-const apiKey = `horusNN-${crypto.randomBytes(12).toString("hex").slice(0, 16)}`
-const keyPrefix = `${apiKey.slice(0, 12)}...`
-const keyHash = crypto.createHash("sha256").update(`${apiKey}:${process.env.API_KEY_PEPPER}`).digest("hex")
-const conversationId = crypto.randomUUID()
-const apiBase = "http://127.0.0.1:18081"
-
-async function request(payload) {
-  return fetch(`${apiBase}/v1/chat/completions`, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${apiKey}`,
-      "Content-Type": "application/json",
-      "X-Client-Name": "Agent Mode Self Test",
-    },
-    body: JSON.stringify({ model: "horus-cyper-nano-1.0-beta", max_tokens: 64, ...payload }),
-  })
-}
-
-let result = {}
-try {
-  await pool.query(
-    `INSERT INTO access_requests (
-       special_request_id, first_name, second_name, full_name, company_name,
-       company_website, job, applicant_type, rpm_limit, business_mail,
-       linkedin_profile_url, github_profile_url, portfolio_url, country_or_region,
-       use_cases, responsible_use_accepted, responsible_use_accepted_at, status, source
-     ) VALUES (
-       $1, 'Agent', 'Self Test', 'Agent Self Test', 'TokenAI',
-       'https://tokenai.llc', 'Integration test', 'developer_researcher', 10, $2,
-       'https://linkedin.com/in/tokenai-test', 'https://github.com/tokenai-test', '', 'Internal',
-       'Temporary automated Agent Mode verification.', true, now(), 'approved', 'agent-mode-self-test'
-     )`,
-    [specialRequestId, `agent-${suffix.toLowerCase()}@tokenai.llc`],
-  )
-  await pool.query(
-    `INSERT INTO api_keys (special_request_id, key_prefix, key_hash, rpm_limit)
-     VALUES ($1, $2, $3, 10)`,
-    [specialRequestId, keyPrefix, keyHash],
-  )
-
-  const firstResponse = await request({
-    conversation_id: conversationId,
-    messages: [{ role: "user", content: "Check the gateway status using the available tool." }],
-    tools: [{
-      type: "function",
-      function: {
-        name: "get_status",
-        description: "Read a service status.",
-        parameters: {
-          type: "object",
-          properties: { target: { type: "string" } },
-          required: ["target"],
-          additionalProperties: false,
-        },
-      },
-    }],
-    tool_choice: "required",
-  })
-  const firstBody = await firstResponse.json()
-  const toolCall = firstBody.choices?.[0]?.message?.tool_calls?.[0]
-
-  if (!toolCall) {
-    throw new Error(`The model did not return a required tool call: ${JSON.stringify(firstBody).slice(0, 1000)}`)
-  }
-
-  const secondResponse = await request({
-    conversation_id: conversationId,
-    messages: [
-      { role: "user", content: "Check the gateway status using the available tool." },
-      { role: "assistant", content: null, tool_calls: [toolCall] },
-      { role: "tool", tool_call_id: toolCall.id, content: '{"status":"healthy"}' },
-    ],
-  })
-  const secondBody = await secondResponse.json()
-
-  const streamResponse = await request({
-    messages: [{ role: "user", content: "Return a short compatibility response." }],
-    stream: true,
-  })
-  const streamBody = await streamResponse.text()
-
-  const stored = await pool.query(
-    `SELECT
-       count(*)::int AS total_messages,
-       count(*) FILTER (WHERE role = 'tool')::int AS tool_messages,
-       count(*) FILTER (WHERE cm.role = 'assistant' AND cm.metadata ? 'toolCalls')::int AS tool_call_messages
-     FROM conversation_messages cm
-     JOIN api_conversations ac ON ac.id = cm.conversation_id
-     WHERE ac.special_request_id = $1`,
-    [specialRequestId],
-  )
-
-  result = {
-    toolRequestStatus: firstResponse.status,
-    toolCallName: toolCall?.function?.name,
-    toolResultStatus: secondResponse.status,
-    finalContent: secondBody.choices?.[0]?.message?.content,
-    streamStatus: streamResponse.status,
-    streamContentType: streamResponse.headers.get("content-type"),
-    streamDone: streamBody.includes("data: [DONE]"),
-    stored: stored.rows[0],
-  }
-} finally {
-  await pool.query("DELETE FROM access_requests WHERE special_request_id = $1", [specialRequestId])
-  await pool.query("DELETE FROM api_conversations WHERE special_request_id = $1", [specialRequestId])
-  await pool.query("DELETE FROM api_usage_events WHERE special_request_id = $1", [specialRequestId])
-  await pool.end()
-}
-
-console.log(JSON.stringify(result))

neuralnode-2.2.6/deployment/early-access-api/backup-postgres.sh

@@ -1,61 +0,0 @@
-#!/bin/sh
-set -eu
-
-backup_dir=${BACKUP_LOCAL_DIR:-/opt/tokenai-early-access/backups}
-remote_host=${BACKUP_REMOTE_HOST:-54.91.40.201}
-remote_user=${BACKUP_REMOTE_USER:-ec2-user}
-remote_key=${BACKUP_REMOTE_SSH_KEY:-/home/ec2-user/.ssh/horus_backup_transfer}
-public_key=${BACKUP_ENCRYPTION_PUBLIC_KEY:-/opt/tokenai-early-access/backup_public.pem}
-timestamp=$(date -u +%Y%m%dT%H%M%SZ)
-name=early-access-$timestamp
-work_dir=$(mktemp -d)
-umask 077
-
-cleanup() {
-  rm -rf "$work_dir"
-}
-trap cleanup EXIT INT TERM
-
-mkdir -p "$backup_dir"
-test -r "$remote_key"
-test -r "$public_key"
-
-docker exec tokenai-early-access-postgres-1 sh -lc \
-  'pg_dump -U "$POSTGRES_USER" -d "$POSTGRES_DB" --format=custom --no-owner --no-privileges' \
-  > "$work_dir/$name.dump"
-
-docker exec -i tokenai-early-access-postgres-1 pg_restore --list \
-  < "$work_dir/$name.dump" > /dev/null
-
-openssl rand -base64 48 > "$work_dir/passphrase"
-openssl enc -aes-256-cbc -pbkdf2 -iter 200000 -salt \
-  -in "$work_dir/$name.dump" \
-  -out "$work_dir/database.dump.enc" \
-  -pass file:"$work_dir/passphrase"
-openssl pkeyutl -encrypt -pubin -inkey "$public_key" \
-  -in "$work_dir/passphrase" \
-  -out "$work_dir/passphrase.enc" \
-  -pkeyopt rsa_padding_mode:oaep \
-  -pkeyopt rsa_oaep_md:sha256
-
-dump_sha=$(sha256sum "$work_dir/database.dump.enc" | awk '{print $1}')
-key_sha=$(sha256sum "$work_dir/passphrase.enc" | awk '{print $1}')
-cat > "$work_dir/manifest.txt" <<EOF
-format=tokenai-early-access-backup-v1
-created_at=$timestamp
-database_cipher_sha256=$dump_sha
-wrapped_key_sha256=$key_sha
-encryption=aes-256-cbc-pbkdf2-200000+rsa-oaep-sha256
-EOF
-
-tar -C "$work_dir" -czf "$backup_dir/$name.tar.gz" database.dump.enc passphrase.enc manifest.txt
-archive_sha=$(sha256sum "$backup_dir/$name.tar.gz" | awk '{print $1}')
-
-ssh -o BatchMode=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/home/ec2-user/.ssh/known_hosts -i "$remote_key" \
-  "$remote_user@$remote_host" "upload $name.tar.gz $archive_sha" \
-  < "$backup_dir/$name.tar.gz"
-ssh -o BatchMode=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/home/ec2-user/.ssh/known_hosts -i "$remote_key" \
-  "$remote_user@$remote_host" "verify $name.tar.gz"
-
-find "$backup_dir" -type f -name 'early-access-*.tar.gz' -mtime +14 -delete
-find "$backup_dir" -type f -name 'early-access-*.dump' -delete

neuralnode-2.2.6/deployment/early-access-api/docker-compose.aws.yml

@@ -1,94 +0,0 @@
-services:
-  postgres:
-    image: postgres:16-alpine
-    restart: unless-stopped
-    environment:
-      POSTGRES_DB: ${POSTGRES_DB}
-      POSTGRES_USER: ${POSTGRES_USER}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
-    volumes:
-      - postgres_data:/var/lib/postgresql/data
-      - ./db/init.sql:/docker-entrypoint-initdb.d/001-init.sql:ro
-      - ./db/002-retention-rate-limits.sql:/docker-entrypoint-initdb.d/002-retention-rate-limits.sql:ro
-      - ./db/003-security-hardening.sql:/docker-entrypoint-initdb.d/003-security-hardening.sql:ro
-      - ./db/004-production-readiness.sql:/docker-entrypoint-initdb.d/004-production-readiness.sql:ro
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-  api:
-    build:
-      context: ./api
-    image: tokenai-early-access-api:0.3.5
-    restart: unless-stopped
-    environment:
-      DATABASE_URL: ${DATABASE_URL}
-      PORT: ${PORT}
-      ADMIN_TOKEN: ${ADMIN_TOKEN}
-      API_KEY_PEPPER: ${API_KEY_PEPPER}
-      API_KEY_ENCRYPTION_KEY: ${API_KEY_ENCRYPTION_KEY}
-      TOKENAI_ALLOWED_ORIGINS: ${TOKENAI_ALLOWED_ORIGINS}
-      SMTP_HOST: ${SMTP_HOST}
-      SMTP_PORT: ${SMTP_PORT}
-      SMTP_SECURE: ${SMTP_SECURE}
-      SMTP_USER: ${SMTP_USER}
-      SMTP_PASS: ${SMTP_PASS}
-      SMTP_FROM_EMAIL: ${SMTP_FROM_EMAIL}
-      SMTP_FROM_NAME: ${SMTP_FROM_NAME}
-      REPLY_TO_EMAIL: ${REPLY_TO_EMAIL}
-      MODEL_UPSTREAM_URL: ${MODEL_UPSTREAM_URL:-}
-      MODEL_UPSTREAM_URLS: ${MODEL_UPSTREAM_URLS:-}
-      MODEL_UPSTREAM_MODEL: ${MODEL_UPSTREAM_MODEL:-}
-      MODEL_UPSTREAM_MODE: ${MODEL_UPSTREAM_MODE:-chat}
-      MODEL_UPSTREAM_API_KEY: ${MODEL_UPSTREAM_API_KEY:-}
-      MODEL_UPSTREAM_AUTH_HEADER: ${MODEL_UPSTREAM_AUTH_HEADER:-Authorization}
-      MODEL_UPSTREAM_AUTH_SCHEME: ${MODEL_UPSTREAM_AUTH_SCHEME:-Bearer}
-      MODEL_UPSTREAM_TIMEOUT_MS: ${MODEL_UPSTREAM_TIMEOUT_MS:-120000}
-      MODEL_QUALITY_FAIL_CLOSED: ${MODEL_QUALITY_FAIL_CLOSED:-true}
-      GLOBAL_INFERENCE_CAPACITY: ${GLOBAL_INFERENCE_CAPACITY:-2}
-      GLOBAL_INFERENCE_MAX_QUEUE: ${GLOBAL_INFERENCE_MAX_QUEUE:-40}
-      GLOBAL_INFERENCE_QUEUE_TIMEOUT_MS: ${GLOBAL_INFERENCE_QUEUE_TIMEOUT_MS:-120000}
-      GLOBAL_INFERENCE_LEASE_SECONDS: ${GLOBAL_INFERENCE_LEASE_SECONDS:-240}
-    extra_hosts:
-      - "host.docker.internal:172.18.0.1"
-    ports:
-      - "127.0.0.1:8080:8080"
-    read_only: true
-    tmpfs:
-      - /tmp:size=16m,mode=1777
-    security_opt:
-      - no-new-privileges:true
-    cap_drop:
-      - ALL
-    healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8080/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
-      interval: 15s
-      timeout: 5s
-      retries: 5
-    depends_on:
-      postgres:
-        condition: service_healthy
-
-  cloudflared:
-    image: cloudflare/cloudflared:latest
-    restart: unless-stopped
-    command: tunnel --no-autoupdate run --token ${TUNNEL_TOKEN}
-    depends_on:
-      - api
-    read_only: true
-    security_opt:
-      - no-new-privileges:true
-    cap_drop:
-      - ALL
-
-volumes:
-  postgres_data:
-
-networks:
-  default:
-    ipam:
-      config:
-        - subnet: 172.18.0.0/16
-          gateway: 172.18.0.1