agentic-flow 2.0.6 → 3.0.0-alpha.1

package/dist/packages/agentdb/src/security/validation.js

@@ -0,0 +1,315 @@
+/**
+ * AgentDB v2 Security Validation
+ *
+ * Comprehensive input validation for RuVector integration:
+ * - Vector dimension and value validation (NaN/Infinity prevention)
+ * - ID sanitization (path traversal prevention)
+ * - Search options validation (bounds checking)
+ * - Cypher query parameter validation (injection prevention)
+ * - Metadata sanitization (sensitive data protection)
+ */
+import { ValidationError } from './input-validation.js';
+/**
+ * Security limits for AgentDB v2
+ */
+export const SECURITY_LIMITS = {
+    MAX_VECTORS: 10_000_000, // 10M vectors max
+    MAX_DIMENSION: 4096, // Maximum vector dimension
+    MAX_BATCH_SIZE: 10_000, // Batch insert limit
+    MAX_K: 10_000, // Search result limit
+    QUERY_TIMEOUT_MS: 30_000, // 30s query timeout
+    MAX_MEMORY_MB: 16_384, // 16GB memory limit
+    MAX_ID_LENGTH: 256, // ID string length
+    MAX_METADATA_SIZE: 65_536, // 64KB metadata per vector
+    MAX_LABEL_LENGTH: 128, // Graph node label length
+    MAX_PROPERTY_KEY_LENGTH: 128, // Property key length
+    MAX_CYPHER_PARAMS: 100, // Maximum Cypher parameters
+    MIN_DIMENSION: 1, // Minimum vector dimension
+    MIN_K: 1, // Minimum search results
+    MIN_THRESHOLD: 0.0, // Minimum similarity threshold
+    MAX_THRESHOLD: 1.0, // Maximum similarity threshold
+    MIN_EF_SEARCH: 1, // Minimum HNSW efSearch
+    MAX_EF_SEARCH: 1000, // Maximum HNSW efSearch
+    MIN_EF_CONSTRUCTION: 4, // Minimum HNSW efConstruction
+    MAX_EF_CONSTRUCTION: 500, // Maximum HNSW efConstruction
+    MAX_M: 64, // Maximum HNSW M parameter
+    MIN_M: 2, // Minimum HNSW M parameter
+};
+/**
+ * Validate vector embedding data
+ * Prevents NaN, Infinity, and dimension mismatches
+ */
+export function validateVector(embedding, expectedDim, fieldName = 'vector') {
+    // Validate dimension bounds
+    if (expectedDim < SECURITY_LIMITS.MIN_DIMENSION || expectedDim > SECURITY_LIMITS.MAX_DIMENSION) {
+        throw new ValidationError(`Invalid expected dimension: ${expectedDim} (must be between ${SECURITY_LIMITS.MIN_DIMENSION} and ${SECURITY_LIMITS.MAX_DIMENSION})`, 'INVALID_DIMENSION', fieldName);
+    }
+    // Check if embedding exists
+    if (!embedding) {
+        throw new ValidationError(`${fieldName} is required`, 'MISSING_VECTOR', fieldName);
+    }
+    // Validate dimension match
+    if (embedding.length !== expectedDim) {
+        throw new ValidationError(`Invalid ${fieldName} dimension: expected ${expectedDim}, got ${embedding.length}`, 'DIMENSION_MISMATCH', fieldName);
+    }
+    // Validate each value for NaN and Infinity
+    for (let i = 0; i < embedding.length; i++) {
+        const value = embedding[i];
+        if (!Number.isFinite(value)) {
+            throw new ValidationError(`Invalid value in ${fieldName} at index ${i}: ${value} (NaN or Infinity not allowed)`, 'INVALID_VECTOR_VALUE', `${fieldName}[${i}]`);
+        }
+        // Optional: Check for extreme values that might indicate errors
+        if (Math.abs(value) > 1e10) {
+            throw new ValidationError(`Extreme value in ${fieldName} at index ${i}: ${value} (magnitude too large)`, 'EXTREME_VECTOR_VALUE', `${fieldName}[${i}]`);
+        }
+    }
+}
+/**
+ * Validate vector ID
+ * Prevents path traversal, excessive length, and malicious characters
+ */
+export function validateVectorId(id, fieldName = 'id') {
+    if (typeof id !== 'string') {
+        throw new ValidationError(`${fieldName} must be a string`, 'INVALID_ID_TYPE', fieldName);
+    }
+    if (id.length === 0) {
+        throw new ValidationError(`${fieldName} cannot be empty`, 'EMPTY_ID', fieldName);
+    }
+    if (id.length > SECURITY_LIMITS.MAX_ID_LENGTH) {
+        throw new ValidationError(`${fieldName} exceeds maximum length (${SECURITY_LIMITS.MAX_ID_LENGTH} chars)`, 'ID_TOO_LONG', fieldName);
+    }
+    // Prevent path traversal attacks
+    if (id.includes('..') || id.includes('/') || id.includes('\\')) {
+        throw new ValidationError(`${fieldName} contains invalid path characters (., /, \\)`, 'PATH_TRAVERSAL_ATTEMPT', fieldName);
+    }
+    // Prevent null bytes and control characters
+    if (/[\x00-\x1F\x7F]/.test(id)) {
+        throw new ValidationError(`${fieldName} contains control characters`, 'INVALID_CHARACTERS', fieldName);
+    }
+    // Prevent potential Cypher injection via IDs used in graph queries
+    const cypherDangerousChars = /['"`;{}[\]()]/;
+    if (cypherDangerousChars.test(id)) {
+        throw new ValidationError(`${fieldName} contains potentially dangerous characters for graph queries`, 'DANGEROUS_ID_CHARACTERS', fieldName);
+    }
+    return id;
+}
+export function validateSearchOptions(options) {
+    const validated = {};
+    // Validate k parameter
+    if (options.k !== undefined) {
+        if (!Number.isInteger(options.k)) {
+            throw new ValidationError('k must be an integer', 'INVALID_K_TYPE', 'k');
+        }
+        if (options.k < SECURITY_LIMITS.MIN_K || options.k > SECURITY_LIMITS.MAX_K) {
+            throw new ValidationError(`k must be between ${SECURITY_LIMITS.MIN_K} and ${SECURITY_LIMITS.MAX_K}`, 'K_OUT_OF_BOUNDS', 'k');
+        }
+        validated.k = options.k;
+    }
+    // Validate threshold parameter
+    if (options.threshold !== undefined) {
+        if (typeof options.threshold !== 'number') {
+            throw new ValidationError('threshold must be a number', 'INVALID_THRESHOLD_TYPE', 'threshold');
+        }
+        if (!Number.isFinite(options.threshold)) {
+            throw new ValidationError('threshold must be a finite number', 'THRESHOLD_NOT_FINITE', 'threshold');
+        }
+        if (options.threshold < SECURITY_LIMITS.MIN_THRESHOLD ||
+            options.threshold > SECURITY_LIMITS.MAX_THRESHOLD) {
+            throw new ValidationError(`threshold must be between ${SECURITY_LIMITS.MIN_THRESHOLD} and ${SECURITY_LIMITS.MAX_THRESHOLD}`, 'THRESHOLD_OUT_OF_BOUNDS', 'threshold');
+        }
+        validated.threshold = options.threshold;
+    }
+    // Validate efSearch parameter (HNSW specific)
+    if (options.efSearch !== undefined) {
+        if (!Number.isInteger(options.efSearch)) {
+            throw new ValidationError('efSearch must be an integer', 'INVALID_EFSEARCH_TYPE', 'efSearch');
+        }
+        if (options.efSearch < SECURITY_LIMITS.MIN_EF_SEARCH ||
+            options.efSearch > SECURITY_LIMITS.MAX_EF_SEARCH) {
+            throw new ValidationError(`efSearch must be between ${SECURITY_LIMITS.MIN_EF_SEARCH} and ${SECURITY_LIMITS.MAX_EF_SEARCH}`, 'EFSEARCH_OUT_OF_BOUNDS', 'efSearch');
+        }
+        validated.efSearch = options.efSearch;
+    }
+    // Validate filter object
+    if (options.filter !== undefined) {
+        if (typeof options.filter !== 'object' || options.filter === null) {
+            throw new ValidationError('filter must be an object', 'INVALID_FILTER_TYPE', 'filter');
+        }
+        validated.filter = sanitizeMetadata(options.filter);
+    }
+    // Copy boolean flags
+    if (options.includeMetadata !== undefined) {
+        validated.includeMetadata = Boolean(options.includeMetadata);
+    }
+    if (options.includeVectors !== undefined) {
+        validated.includeVectors = Boolean(options.includeVectors);
+    }
+    return validated;
+}
+export function validateHNSWParams(params) {
+    const validated = {};
+    if (params.M !== undefined) {
+        if (!Number.isInteger(params.M)) {
+            throw new ValidationError('M must be an integer', 'INVALID_M_TYPE', 'M');
+        }
+        if (params.M < SECURITY_LIMITS.MIN_M || params.M > SECURITY_LIMITS.MAX_M) {
+            throw new ValidationError(`M must be between ${SECURITY_LIMITS.MIN_M} and ${SECURITY_LIMITS.MAX_M}`, 'M_OUT_OF_BOUNDS', 'M');
+        }
+        validated.M = params.M;
+    }
+    if (params.efConstruction !== undefined) {
+        if (!Number.isInteger(params.efConstruction)) {
+            throw new ValidationError('efConstruction must be an integer', 'INVALID_EFCONSTRUCTION_TYPE', 'efConstruction');
+        }
+        if (params.efConstruction < SECURITY_LIMITS.MIN_EF_CONSTRUCTION ||
+            params.efConstruction > SECURITY_LIMITS.MAX_EF_CONSTRUCTION) {
+            throw new ValidationError(`efConstruction must be between ${SECURITY_LIMITS.MIN_EF_CONSTRUCTION} and ${SECURITY_LIMITS.MAX_EF_CONSTRUCTION}`, 'EFCONSTRUCTION_OUT_OF_BOUNDS', 'efConstruction');
+        }
+        validated.efConstruction = params.efConstruction;
+    }
+    if (params.efSearch !== undefined) {
+        const searchOpts = validateSearchOptions({ efSearch: params.efSearch });
+        validated.efSearch = searchOpts.efSearch;
+    }
+    return validated;
+}
+/**
+ * Sanitize metadata to prevent sensitive data exposure
+ * Removes fields that commonly contain secrets or PII
+ */
+export function sanitizeMetadata(metadata) {
+    if (!metadata || typeof metadata !== 'object') {
+        return {};
+    }
+    const sanitized = { ...metadata };
+    // List of sensitive field names (case-insensitive)
+    const sensitivePatterns = [
+        /password/i,
+        /secret/i,
+        /token/i,
+        /key/i,
+        /credential/i,
+        /api[_-]?key/i,
+        /auth/i,
+        /private/i,
+        /ssn/i,
+        /social[_-]?security/i,
+        /credit[_-]?card/i,
+        /card[_-]?number/i,
+        /cvv/i,
+        /pin/i,
+    ];
+    // Check metadata size
+    const metadataStr = JSON.stringify(metadata);
+    if (metadataStr.length > SECURITY_LIMITS.MAX_METADATA_SIZE) {
+        throw new ValidationError(`Metadata exceeds maximum size (${SECURITY_LIMITS.MAX_METADATA_SIZE} bytes)`, 'METADATA_TOO_LARGE', 'metadata');
+    }
+    // Remove sensitive fields
+    for (const key of Object.keys(sanitized)) {
+        if (sensitivePatterns.some(pattern => pattern.test(key))) {
+            delete sanitized[key];
+            console.warn(`[Security] Removed potentially sensitive metadata field: ${key}`);
+        }
+        // Validate property key length
+        if (key.length > SECURITY_LIMITS.MAX_PROPERTY_KEY_LENGTH) {
+            throw new ValidationError(`Metadata property key exceeds maximum length: ${key.substring(0, 50)}...`, 'PROPERTY_KEY_TOO_LONG', 'metadata');
+        }
+    }
+    return sanitized;
+}
+/**
+ * Validate Cypher query parameters for graph operations
+ * Prevents Cypher injection attacks
+ */
+export function validateCypherParams(params) {
+    if (!params || typeof params !== 'object') {
+        return {};
+    }
+    if (Object.keys(params).length > SECURITY_LIMITS.MAX_CYPHER_PARAMS) {
+        throw new ValidationError(`Too many Cypher parameters (max ${SECURITY_LIMITS.MAX_CYPHER_PARAMS})`, 'TOO_MANY_PARAMS', 'cypherParams');
+    }
+    const validated = {};
+    for (const [key, value] of Object.entries(params)) {
+        // Validate parameter key format (must be alphanumeric + underscore)
+        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(key)) {
+            throw new ValidationError(`Invalid Cypher parameter name: ${key} (must be alphanumeric with underscores)`, 'INVALID_PARAM_NAME', key);
+        }
+        // Validate string values aren't suspiciously long
+        if (typeof value === 'string' && value.length > 10000) {
+            throw new ValidationError(`Cypher parameter value too long: ${key}`, 'PARAM_VALUE_TOO_LONG', key);
+        }
+        // Prevent null bytes in string parameters
+        if (typeof value === 'string' && value.includes('\x00')) {
+            throw new ValidationError(`Cypher parameter contains null bytes: ${key}`, 'NULL_BYTE_IN_PARAM', key);
+        }
+        validated[key] = value;
+    }
+    return validated;
+}
+/**
+ * Validate graph node label
+ */
+export function validateLabel(label) {
+    if (typeof label !== 'string') {
+        throw new ValidationError('Label must be a string', 'INVALID_LABEL_TYPE', 'label');
+    }
+    if (label.length === 0) {
+        throw new ValidationError('Label cannot be empty', 'EMPTY_LABEL', 'label');
+    }
+    if (label.length > SECURITY_LIMITS.MAX_LABEL_LENGTH) {
+        throw new ValidationError(`Label exceeds maximum length (${SECURITY_LIMITS.MAX_LABEL_LENGTH} chars)`, 'LABEL_TOO_LONG', 'label');
+    }
+    // Label must be alphanumeric + underscore (Cypher safe)
+    if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(label)) {
+        throw new ValidationError('Label must be alphanumeric with underscores, starting with letter or underscore', 'INVALID_LABEL_FORMAT', 'label');
+    }
+    return label;
+}
+/**
+ * Validate batch size for bulk operations
+ */
+export function validateBatchSize(batchSize) {
+    if (!Number.isInteger(batchSize)) {
+        throw new ValidationError('Batch size must be an integer', 'INVALID_BATCH_SIZE_TYPE', 'batchSize');
+    }
+    if (batchSize < 1 || batchSize > SECURITY_LIMITS.MAX_BATCH_SIZE) {
+        throw new ValidationError(`Batch size must be between 1 and ${SECURITY_LIMITS.MAX_BATCH_SIZE}`, 'BATCH_SIZE_OUT_OF_BOUNDS', 'batchSize');
+    }
+    return batchSize;
+}
+/**
+ * Validate vector count doesn't exceed limits
+ */
+export function validateVectorCount(count) {
+    if (count > SECURITY_LIMITS.MAX_VECTORS) {
+        throw new ValidationError(`Vector count exceeds maximum (${SECURITY_LIMITS.MAX_VECTORS})`, 'TOO_MANY_VECTORS', 'vectorCount');
+    }
+}
+/**
+ * Safe logging that doesn't expose vectors or sensitive data
+ */
+export function safeLog(message, data) {
+    if (!data) {
+        console.log(message);
+        return;
+    }
+    if (typeof data === 'object') {
+        const safe = { ...data };
+        // Remove sensitive fields
+        delete safe.embedding;
+        delete safe.vector;
+        delete safe.metadata;
+        delete safe.password;
+        delete safe.token;
+        delete safe.apiKey;
+        // Truncate IDs if they're arrays
+        if (Array.isArray(safe.ids) && safe.ids.length > 5) {
+            safe.ids = `[${safe.ids.length} IDs...]`;
+        }
+        console.log(message, safe);
+    }
+    else {
+        console.log(message, data);
+    }
+}
+//# sourceMappingURL=validation.js.map

package/dist/packages/agentdb/src/security/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../../../../packages/agentdb/src/security/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,WAAW,EAAE,UAAU,EAAS,kBAAkB;IAClD,aAAa,EAAE,IAAI,EAAa,2BAA2B;IAC3D,cAAc,EAAE,MAAM,EAAU,qBAAqB;IACrD,KAAK,EAAE,MAAM,EAAmB,sBAAsB;IACtD,gBAAgB,EAAE,MAAM,EAAQ,oBAAoB;IACpD,aAAa,EAAE,MAAM,EAAW,oBAAoB;IACpD,aAAa,EAAE,GAAG,EAAc,mBAAmB;IACnD,iBAAiB,EAAE,MAAM,EAAO,2BAA2B;IAC3D,gBAAgB,EAAE,GAAG,EAAW,0BAA0B;IAC1D,uBAAuB,EAAE,GAAG,EAAI,sBAAsB;IACtD,iBAAiB,EAAE,GAAG,EAAU,4BAA4B;IAC5D,aAAa,EAAE,CAAC,EAAgB,2BAA2B;IAC3D,KAAK,EAAE,CAAC,EAAwB,yBAAyB;IACzD,aAAa,EAAE,GAAG,EAAc,+BAA+B;IAC/D,aAAa,EAAE,GAAG,EAAc,+BAA+B;IAC/D,aAAa,EAAE,CAAC,EAAgB,wBAAwB;IACxD,aAAa,EAAE,IAAI,EAAa,wBAAwB;IACxD,mBAAmB,EAAE,CAAC,EAAU,8BAA8B;IAC9D,mBAAmB,EAAE,GAAG,EAAQ,8BAA8B;IAC9D,KAAK,EAAE,EAAE,EAAuB,2BAA2B;IAC3D,KAAK,EAAE,CAAC,EAAwB,2BAA2B;CACnD,CAAC;AAEX;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAkC,EAClC,WAAmB,EACnB,YAAoB,QAAQ;IAE5B,4BAA4B;IAC5B,IAAI,WAAW,GAAG,eAAe,CAAC,aAAa,IAAI,WAAW,GAAG,eAAe,CAAC,aAAa,EAAE,CAAC;QAC/F,MAAM,IAAI,eAAe,CACvB,+BAA+B,WAAW,qBAAqB,eAAe,CAAC,aAAa,QAAQ,eAAe,CAAC,aAAa,GAAG,EACpI,mBAAmB,EACnB,SAAS,CACV,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,cAAc,EAC1B,gBAAgB,EAChB,SAAS,CACV,CAAC;IACJ,CAAC;IAED,2BAA2B;IAC3B,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,eAAe,CACvB,WAAW,SAAS,wBAAwB,WAAW,SAAS,SAAS,CAAC,MAAM,EAAE,EAClF,oBAAoB,EACpB,SAAS,CACV,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAE3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,eAAe,CACvB,oBAAoB,SAAS,aAAa,CAAC,KAAK,KAAK,gCAAgC,EACrF,sBAAsB,EACtB,GAAG,SAAS,IAAI,CAAC,GAAG,CACrB,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,eAAe,CACvB,oBAAoB,SAAS,aAAa,CAAC,KAAK,KAAK,wBAAwB,EAC7E,sBAAsB,EACtB,GAAG,SAAS,IAAI,CAAC,GAAG,CACrB,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAU,EAAE,YAAoB,IAAI;IACnE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,mBAAmB,EAC/B,iBAAiB,EACjB,SAAS,CACV,CAAC;IACJ,CAAC;IAED,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,kBAAkB,EAC9B,UAAU,EACV,SAAS,CACV,CAAC;IACJ,CAAC;IAED,IAAI,EAAE,CAAC,MAAM,GAAG,eAAe,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,4BAA4B,eAAe,CAAC,aAAa,SAAS,EAC9E,aAAa,EACb,SAAS,CACV,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,8CAA8C,EAC1D,wBAAwB,EACxB,SAAS,CACV,CAAC;IACJ,CAAC;IAED,4CAA4C;IAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,8BAA8B,EAC1C,oBAAoB,EACpB,SAAS,CACV,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,MAAM,oBAAoB,GAAG,eAAe,CAAC;IAC7C,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,8DAA8D,EAC1E,yBAAyB,EACzB,SAAS,CACV,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAeD,MAAM,UAAU,qBAAqB,CAAC,OAAsB;IAC1D,MAAM,SAAS,GAAkB,EAAE,CAAC;IAEpC,uBAAuB;IACvB,IAAI,OAAO,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,eAAe,CACvB,sBAAsB,EACtB,gBAAgB,EAChB,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,CAAC,GAAG,eAAe,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3E,MAAM,IAAI,eAAe,CACvB,qBAAqB,eAAe,CAAC,KAAK,QAAQ,eAAe,CAAC,KAAK,EAAE,EACzE,iBAAiB,EACjB,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,SAAS,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAC1B,CAAC;IAED,+BAA+B;IAC/B,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,eAAe,CACvB,4BAA4B,EAC5B,wBAAwB,EACxB,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CACvB,mCAAmC,EACnC,sBAAsB,EACtB,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,GAAG,eAAe,CAAC,aAAa;YACjD,OAAO,CAAC,SAAS,GAAG,eAAe,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,eAAe,CACvB,6BAA6B,eAAe,CAAC,aAAa,QAAQ,eAAe,CAAC,aAAa,EAAE,EACjG,yBAAyB,EACzB,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,SAAS,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAC1C,CAAC;IAED,8CAA8C;IAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CACvB,6BAA6B,EAC7B,uBAAuB,EACvB,UAAU,CACX,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,GAAG,eAAe,CAAC,aAAa;YAChD,OAAO,CAAC,QAAQ,GAAG,eAAe,CAAC,aAAa,EAAE,CAAC;YACrD,MAAM,IAAI,eAAe,CACvB,4BAA4B,eAAe,CAAC,aAAa,QAAQ,eAAe,CAAC,aAAa,EAAE,EAChG,wBAAwB,EACxB,UAAU,CACX,CAAC;QACJ,CAAC;QAED,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IACxC,CAAC;IAED,yBAAyB;IACzB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAClE,MAAM,IAAI,eAAe,CACvB,0BAA0B,EAC1B,qBAAqB,EACrB,QAAQ,CACT,CAAC;QACJ,CAAC;QAED,SAAS,CAAC,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IAED,qBAAqB;IACrB,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC1C,SAAS,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,SAAS,CAAC,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,MAAM,SAAS,GAAe,EAAE,CAAC;IAEjC,IAAI,MAAM,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,eAAe,CACvB,sBAAsB,EACtB,gBAAgB,EAChB,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,CAAC,GAAG,eAAe,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,CAAC;YACzE,MAAM,IAAI,eAAe,CACvB,qBAAqB,eAAe,CAAC,KAAK,QAAQ,eAAe,CAAC,KAAK,EAAE,EACzE,iBAAiB,EACjB,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,eAAe,CACvB,mCAAmC,EACnC,6BAA6B,EAC7B,gBAAgB,CACjB,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,cAAc,GAAG,eAAe,CAAC,mBAAmB;YAC3D,MAAM,CAAC,cAAc,GAAG,eAAe,CAAC,mBAAmB,EAAE,CAAC;YAChE,MAAM,IAAI,eAAe,CACvB,kCAAkC,eAAe,CAAC,mBAAmB,QAAQ,eAAe,CAAC,mBAAmB,EAAE,EAClH,8BAA8B,EAC9B,gBAAgB,CACjB,CAAC;QACJ,CAAC;QAED,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IACnD,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,SAAS,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IAC3C,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA6B;IAE7B,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAElC,mDAAmD;IACnD,MAAM,iBAAiB,GAAG;QACxB,WAAW;QACX,SAAS;QACT,QAAQ;QACR,MAAM;QACN,aAAa;QACb,cAAc;QACd,OAAO;QACP,UAAU;QACV,MAAM;QACN,sBAAsB;QACtB,kBAAkB;QAClB,kBAAkB;QAClB,MAAM;QACN,MAAM;KACP,CAAC;IAEF,sBAAsB;IACtB,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,WAAW,CAAC,MAAM,GAAG,eAAe,CAAC,iBAAiB,EAAE,CAAC;QAC3D,MAAM,IAAI,eAAe,CACvB,kCAAkC,eAAe,CAAC,iBAAiB,SAAS,EAC5E,oBAAoB,EACpB,UAAU,CACX,CAAC;IACJ,CAAC;IAED,0BAA0B;IAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,4DAA4D,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,+BAA+B;QAC/B,IAAI,GAAG,CAAC,MAAM,GAAG,eAAe,CAAC,uBAAuB,EAAE,CAAC;YACzD,MAAM,IAAI,eAAe,CACvB,iDAAiD,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,EAC1E,uBAAuB,EACvB,UAAU,CACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAA2B;IAE3B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,eAAe,CAAC,iBAAiB,EAAE,CAAC;QACnE,MAAM,IAAI,eAAe,CACvB,mCAAmC,eAAe,CAAC,iBAAiB,GAAG,EACvE,iBAAiB,EACjB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAwB,EAAE,CAAC;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,oEAAoE;QACpE,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,eAAe,CACvB,kCAAkC,GAAG,0CAA0C,EAC/E,oBAAoB,EACpB,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YACtD,MAAM,IAAI,eAAe,CACvB,oCAAoC,GAAG,EAAE,EACzC,sBAAsB,EACtB,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,eAAe,CACvB,yCAAyC,GAAG,EAAE,EAC9C,oBAAoB,EACpB,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,eAAe,CACvB,wBAAwB,EACxB,oBAAoB,EACpB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,eAAe,CACvB,uBAAuB,EACvB,aAAa,EACb,OAAO,CACR,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,gBAAgB,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CACvB,iCAAiC,eAAe,CAAC,gBAAgB,SAAS,EAC1E,gBAAgB,EAChB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CACvB,iFAAiF,EACjF,sBAAsB,EACtB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,eAAe,CACvB,+BAA+B,EAC/B,yBAAyB,EACzB,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,eAAe,CAAC,cAAc,EAAE,CAAC;QAChE,MAAM,IAAI,eAAe,CACvB,oCAAoC,eAAe,CAAC,cAAc,EAAE,EACpE,0BAA0B,EAC1B,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,KAAK,GAAG,eAAe,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,IAAI,eAAe,CACvB,iCAAiC,eAAe,CAAC,WAAW,GAAG,EAC/D,kBAAkB,EAClB,aAAa,CACd,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,OAAe,EAAE,IAAU;IACjD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAEzB,0BAA0B;QAC1B,OAAO,IAAI,CAAC,SAAS,CAAC;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC;QACrB,OAAO,IAAI,CAAC,QAAQ,CAAC;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC;QAEnB,iCAAiC;QACjC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,UAAU,CAAC;QAC3C,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC","sourcesContent":["/**\n * AgentDB v2 Security Validation\n *\n * Comprehensive input validation for RuVector integration:\n * - Vector dimension and value validation (NaN/Infinity prevention)\n * - ID sanitization (path traversal prevention)\n * - Search options validation (bounds checking)\n * - Cypher query parameter validation (injection prevention)\n * - Metadata sanitization (sensitive data protection)\n */\n\nimport { ValidationError } from './input-validation.js';\n\n/**\n * Security limits for AgentDB v2\n */\nexport const SECURITY_LIMITS = {\n  MAX_VECTORS: 10_000_000,        // 10M vectors max\n  MAX_DIMENSION: 4096,            // Maximum vector dimension\n  MAX_BATCH_SIZE: 10_000,         // Batch insert limit\n  MAX_K: 10_000,                  // Search result limit\n  QUERY_TIMEOUT_MS: 30_000,       // 30s query timeout\n  MAX_MEMORY_MB: 16_384,          // 16GB memory limit\n  MAX_ID_LENGTH: 256,             // ID string length\n  MAX_METADATA_SIZE: 65_536,      // 64KB metadata per vector\n  MAX_LABEL_LENGTH: 128,          // Graph node label length\n  MAX_PROPERTY_KEY_LENGTH: 128,   // Property key length\n  MAX_CYPHER_PARAMS: 100,         // Maximum Cypher parameters\n  MIN_DIMENSION: 1,               // Minimum vector dimension\n  MIN_K: 1,                       // Minimum search results\n  MIN_THRESHOLD: 0.0,             // Minimum similarity threshold\n  MAX_THRESHOLD: 1.0,             // Maximum similarity threshold\n  MIN_EF_SEARCH: 1,               // Minimum HNSW efSearch\n  MAX_EF_SEARCH: 1000,            // Maximum HNSW efSearch\n  MIN_EF_CONSTRUCTION: 4,         // Minimum HNSW efConstruction\n  MAX_EF_CONSTRUCTION: 500,       // Maximum HNSW efConstruction\n  MAX_M: 64,                      // Maximum HNSW M parameter\n  MIN_M: 2,                       // Minimum HNSW M parameter\n} as const;\n\n/**\n * Validate vector embedding data\n * Prevents NaN, Infinity, and dimension mismatches\n */\nexport function validateVector(\n  embedding: Float32Array | number[],\n  expectedDim: number,\n  fieldName: string = 'vector'\n): void {\n  // Validate dimension bounds\n  if (expectedDim < SECURITY_LIMITS.MIN_DIMENSION || expectedDim > SECURITY_LIMITS.MAX_DIMENSION) {\n    throw new ValidationError(\n      `Invalid expected dimension: ${expectedDim} (must be between ${SECURITY_LIMITS.MIN_DIMENSION} and ${SECURITY_LIMITS.MAX_DIMENSION})`,\n      'INVALID_DIMENSION',\n      fieldName\n    );\n  }\n\n  // Check if embedding exists\n  if (!embedding) {\n    throw new ValidationError(\n      `${fieldName} is required`,\n      'MISSING_VECTOR',\n      fieldName\n    );\n  }\n\n  // Validate dimension match\n  if (embedding.length !== expectedDim) {\n    throw new ValidationError(\n      `Invalid ${fieldName} dimension: expected ${expectedDim}, got ${embedding.length}`,\n      'DIMENSION_MISMATCH',\n      fieldName\n    );\n  }\n\n  // Validate each value for NaN and Infinity\n  for (let i = 0; i < embedding.length; i++) {\n    const value = embedding[i];\n\n    if (!Number.isFinite(value)) {\n      throw new ValidationError(\n        `Invalid value in ${fieldName} at index ${i}: ${value} (NaN or Infinity not allowed)`,\n        'INVALID_VECTOR_VALUE',\n        `${fieldName}[${i}]`\n      );\n    }\n\n    // Optional: Check for extreme values that might indicate errors\n    if (Math.abs(value) > 1e10) {\n      throw new ValidationError(\n        `Extreme value in ${fieldName} at index ${i}: ${value} (magnitude too large)`,\n        'EXTREME_VECTOR_VALUE',\n        `${fieldName}[${i}]`\n      );\n    }\n  }\n}\n\n/**\n * Validate vector ID\n * Prevents path traversal, excessive length, and malicious characters\n */\nexport function validateVectorId(id: string, fieldName: string = 'id'): string {\n  if (typeof id !== 'string') {\n    throw new ValidationError(\n      `${fieldName} must be a string`,\n      'INVALID_ID_TYPE',\n      fieldName\n    );\n  }\n\n  if (id.length === 0) {\n    throw new ValidationError(\n      `${fieldName} cannot be empty`,\n      'EMPTY_ID',\n      fieldName\n    );\n  }\n\n  if (id.length > SECURITY_LIMITS.MAX_ID_LENGTH) {\n    throw new ValidationError(\n      `${fieldName} exceeds maximum length (${SECURITY_LIMITS.MAX_ID_LENGTH} chars)`,\n      'ID_TOO_LONG',\n      fieldName\n    );\n  }\n\n  // Prevent path traversal attacks\n  if (id.includes('..') || id.includes('/') || id.includes('\\\\')) {\n    throw new ValidationError(\n      `${fieldName} contains invalid path characters (., /, \\\\)`,\n      'PATH_TRAVERSAL_ATTEMPT',\n      fieldName\n    );\n  }\n\n  // Prevent null bytes and control characters\n  if (/[\\x00-\\x1F\\x7F]/.test(id)) {\n    throw new ValidationError(\n      `${fieldName} contains control characters`,\n      'INVALID_CHARACTERS',\n      fieldName\n    );\n  }\n\n  // Prevent potential Cypher injection via IDs used in graph queries\n  const cypherDangerousChars = /['\"`;{}[\\]()]/;\n  if (cypherDangerousChars.test(id)) {\n    throw new ValidationError(\n      `${fieldName} contains potentially dangerous characters for graph queries`,\n      'DANGEROUS_ID_CHARACTERS',\n      fieldName\n    );\n  }\n\n  return id;\n}\n\n/**\n * Validate search options\n * Ensures k, threshold, and other parameters are within safe bounds\n */\nexport interface SearchOptions {\n  k?: number;\n  threshold?: number;\n  efSearch?: number;\n  filter?: Record<string, any>;\n  includeMetadata?: boolean;\n  includeVectors?: boolean;\n}\n\nexport function validateSearchOptions(options: SearchOptions): SearchOptions {\n  const validated: SearchOptions = {};\n\n  // Validate k parameter\n  if (options.k !== undefined) {\n    if (!Number.isInteger(options.k)) {\n      throw new ValidationError(\n        'k must be an integer',\n        'INVALID_K_TYPE',\n        'k'\n      );\n    }\n\n    if (options.k < SECURITY_LIMITS.MIN_K || options.k > SECURITY_LIMITS.MAX_K) {\n      throw new ValidationError(\n        `k must be between ${SECURITY_LIMITS.MIN_K} and ${SECURITY_LIMITS.MAX_K}`,\n        'K_OUT_OF_BOUNDS',\n        'k'\n      );\n    }\n\n    validated.k = options.k;\n  }\n\n  // Validate threshold parameter\n  if (options.threshold !== undefined) {\n    if (typeof options.threshold !== 'number') {\n      throw new ValidationError(\n        'threshold must be a number',\n        'INVALID_THRESHOLD_TYPE',\n        'threshold'\n      );\n    }\n\n    if (!Number.isFinite(options.threshold)) {\n      throw new ValidationError(\n        'threshold must be a finite number',\n        'THRESHOLD_NOT_FINITE',\n        'threshold'\n      );\n    }\n\n    if (options.threshold < SECURITY_LIMITS.MIN_THRESHOLD ||\n        options.threshold > SECURITY_LIMITS.MAX_THRESHOLD) {\n      throw new ValidationError(\n        `threshold must be between ${SECURITY_LIMITS.MIN_THRESHOLD} and ${SECURITY_LIMITS.MAX_THRESHOLD}`,\n        'THRESHOLD_OUT_OF_BOUNDS',\n        'threshold'\n      );\n    }\n\n    validated.threshold = options.threshold;\n  }\n\n  // Validate efSearch parameter (HNSW specific)\n  if (options.efSearch !== undefined) {\n    if (!Number.isInteger(options.efSearch)) {\n      throw new ValidationError(\n        'efSearch must be an integer',\n        'INVALID_EFSEARCH_TYPE',\n        'efSearch'\n      );\n    }\n\n    if (options.efSearch < SECURITY_LIMITS.MIN_EF_SEARCH ||\n        options.efSearch > SECURITY_LIMITS.MAX_EF_SEARCH) {\n      throw new ValidationError(\n        `efSearch must be between ${SECURITY_LIMITS.MIN_EF_SEARCH} and ${SECURITY_LIMITS.MAX_EF_SEARCH}`,\n        'EFSEARCH_OUT_OF_BOUNDS',\n        'efSearch'\n      );\n    }\n\n    validated.efSearch = options.efSearch;\n  }\n\n  // Validate filter object\n  if (options.filter !== undefined) {\n    if (typeof options.filter !== 'object' || options.filter === null) {\n      throw new ValidationError(\n        'filter must be an object',\n        'INVALID_FILTER_TYPE',\n        'filter'\n      );\n    }\n\n    validated.filter = sanitizeMetadata(options.filter);\n  }\n\n  // Copy boolean flags\n  if (options.includeMetadata !== undefined) {\n    validated.includeMetadata = Boolean(options.includeMetadata);\n  }\n\n  if (options.includeVectors !== undefined) {\n    validated.includeVectors = Boolean(options.includeVectors);\n  }\n\n  return validated;\n}\n\n/**\n * Validate HNSW index parameters\n */\nexport interface HNSWParams {\n  M?: number;\n  efConstruction?: number;\n  efSearch?: number;\n}\n\nexport function validateHNSWParams(params: HNSWParams): HNSWParams {\n  const validated: HNSWParams = {};\n\n  if (params.M !== undefined) {\n    if (!Number.isInteger(params.M)) {\n      throw new ValidationError(\n        'M must be an integer',\n        'INVALID_M_TYPE',\n        'M'\n      );\n    }\n\n    if (params.M < SECURITY_LIMITS.MIN_M || params.M > SECURITY_LIMITS.MAX_M) {\n      throw new ValidationError(\n        `M must be between ${SECURITY_LIMITS.MIN_M} and ${SECURITY_LIMITS.MAX_M}`,\n        'M_OUT_OF_BOUNDS',\n        'M'\n      );\n    }\n\n    validated.M = params.M;\n  }\n\n  if (params.efConstruction !== undefined) {\n    if (!Number.isInteger(params.efConstruction)) {\n      throw new ValidationError(\n        'efConstruction must be an integer',\n        'INVALID_EFCONSTRUCTION_TYPE',\n        'efConstruction'\n      );\n    }\n\n    if (params.efConstruction < SECURITY_LIMITS.MIN_EF_CONSTRUCTION ||\n        params.efConstruction > SECURITY_LIMITS.MAX_EF_CONSTRUCTION) {\n      throw new ValidationError(\n        `efConstruction must be between ${SECURITY_LIMITS.MIN_EF_CONSTRUCTION} and ${SECURITY_LIMITS.MAX_EF_CONSTRUCTION}`,\n        'EFCONSTRUCTION_OUT_OF_BOUNDS',\n        'efConstruction'\n      );\n    }\n\n    validated.efConstruction = params.efConstruction;\n  }\n\n  if (params.efSearch !== undefined) {\n    const searchOpts = validateSearchOptions({ efSearch: params.efSearch });\n    validated.efSearch = searchOpts.efSearch;\n  }\n\n  return validated;\n}\n\n/**\n * Sanitize metadata to prevent sensitive data exposure\n * Removes fields that commonly contain secrets or PII\n */\nexport function sanitizeMetadata(\n  metadata: Record<string, any>\n): Record<string, any> {\n  if (!metadata || typeof metadata !== 'object') {\n    return {};\n  }\n\n  const sanitized = { ...metadata };\n\n  // List of sensitive field names (case-insensitive)\n  const sensitivePatterns = [\n    /password/i,\n    /secret/i,\n    /token/i,\n    /key/i,\n    /credential/i,\n    /api[_-]?key/i,\n    /auth/i,\n    /private/i,\n    /ssn/i,\n    /social[_-]?security/i,\n    /credit[_-]?card/i,\n    /card[_-]?number/i,\n    /cvv/i,\n    /pin/i,\n  ];\n\n  // Check metadata size\n  const metadataStr = JSON.stringify(metadata);\n  if (metadataStr.length > SECURITY_LIMITS.MAX_METADATA_SIZE) {\n    throw new ValidationError(\n      `Metadata exceeds maximum size (${SECURITY_LIMITS.MAX_METADATA_SIZE} bytes)`,\n      'METADATA_TOO_LARGE',\n      'metadata'\n    );\n  }\n\n  // Remove sensitive fields\n  for (const key of Object.keys(sanitized)) {\n    if (sensitivePatterns.some(pattern => pattern.test(key))) {\n      delete sanitized[key];\n      console.warn(`[Security] Removed potentially sensitive metadata field: ${key}`);\n    }\n\n    // Validate property key length\n    if (key.length > SECURITY_LIMITS.MAX_PROPERTY_KEY_LENGTH) {\n      throw new ValidationError(\n        `Metadata property key exceeds maximum length: ${key.substring(0, 50)}...`,\n        'PROPERTY_KEY_TOO_LONG',\n        'metadata'\n      );\n    }\n  }\n\n  return sanitized;\n}\n\n/**\n * Validate Cypher query parameters for graph operations\n * Prevents Cypher injection attacks\n */\nexport function validateCypherParams(\n  params: Record<string, any>\n): Record<string, any> {\n  if (!params || typeof params !== 'object') {\n    return {};\n  }\n\n  if (Object.keys(params).length > SECURITY_LIMITS.MAX_CYPHER_PARAMS) {\n    throw new ValidationError(\n      `Too many Cypher parameters (max ${SECURITY_LIMITS.MAX_CYPHER_PARAMS})`,\n      'TOO_MANY_PARAMS',\n      'cypherParams'\n    );\n  }\n\n  const validated: Record<string, any> = {};\n\n  for (const [key, value] of Object.entries(params)) {\n    // Validate parameter key format (must be alphanumeric + underscore)\n    if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(key)) {\n      throw new ValidationError(\n        `Invalid Cypher parameter name: ${key} (must be alphanumeric with underscores)`,\n        'INVALID_PARAM_NAME',\n        key\n      );\n    }\n\n    // Validate string values aren't suspiciously long\n    if (typeof value === 'string' && value.length > 10000) {\n      throw new ValidationError(\n        `Cypher parameter value too long: ${key}`,\n        'PARAM_VALUE_TOO_LONG',\n        key\n      );\n    }\n\n    // Prevent null bytes in string parameters\n    if (typeof value === 'string' && value.includes('\\x00')) {\n      throw new ValidationError(\n        `Cypher parameter contains null bytes: ${key}`,\n        'NULL_BYTE_IN_PARAM',\n        key\n      );\n    }\n\n    validated[key] = value;\n  }\n\n  return validated;\n}\n\n/**\n * Validate graph node label\n */\nexport function validateLabel(label: string): string {\n  if (typeof label !== 'string') {\n    throw new ValidationError(\n      'Label must be a string',\n      'INVALID_LABEL_TYPE',\n      'label'\n    );\n  }\n\n  if (label.length === 0) {\n    throw new ValidationError(\n      'Label cannot be empty',\n      'EMPTY_LABEL',\n      'label'\n    );\n  }\n\n  if (label.length > SECURITY_LIMITS.MAX_LABEL_LENGTH) {\n    throw new ValidationError(\n      `Label exceeds maximum length (${SECURITY_LIMITS.MAX_LABEL_LENGTH} chars)`,\n      'LABEL_TOO_LONG',\n      'label'\n    );\n  }\n\n  // Label must be alphanumeric + underscore (Cypher safe)\n  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(label)) {\n    throw new ValidationError(\n      'Label must be alphanumeric with underscores, starting with letter or underscore',\n      'INVALID_LABEL_FORMAT',\n      'label'\n    );\n  }\n\n  return label;\n}\n\n/**\n * Validate batch size for bulk operations\n */\nexport function validateBatchSize(batchSize: number): number {\n  if (!Number.isInteger(batchSize)) {\n    throw new ValidationError(\n      'Batch size must be an integer',\n      'INVALID_BATCH_SIZE_TYPE',\n      'batchSize'\n    );\n  }\n\n  if (batchSize < 1 || batchSize > SECURITY_LIMITS.MAX_BATCH_SIZE) {\n    throw new ValidationError(\n      `Batch size must be between 1 and ${SECURITY_LIMITS.MAX_BATCH_SIZE}`,\n      'BATCH_SIZE_OUT_OF_BOUNDS',\n      'batchSize'\n    );\n  }\n\n  return batchSize;\n}\n\n/**\n * Validate vector count doesn't exceed limits\n */\nexport function validateVectorCount(count: number): void {\n  if (count > SECURITY_LIMITS.MAX_VECTORS) {\n    throw new ValidationError(\n      `Vector count exceeds maximum (${SECURITY_LIMITS.MAX_VECTORS})`,\n      'TOO_MANY_VECTORS',\n      'vectorCount'\n    );\n  }\n}\n\n/**\n * Safe logging that doesn't expose vectors or sensitive data\n */\nexport function safeLog(message: string, data?: any): void {\n  if (!data) {\n    console.log(message);\n    return;\n  }\n\n  if (typeof data === 'object') {\n    const safe = { ...data };\n\n    // Remove sensitive fields\n    delete safe.embedding;\n    delete safe.vector;\n    delete safe.metadata;\n    delete safe.password;\n    delete safe.token;\n    delete safe.apiKey;\n\n    // Truncate IDs if they're arrays\n    if (Array.isArray(safe.ids) && safe.ids.length > 5) {\n      safe.ids = `[${safe.ids.length} IDs...]`;\n    }\n\n    console.log(message, safe);\n  } else {\n    console.log(message, data);\n  }\n}\n"]}

package/dist/packages/agentdb/src/services/GNNService.d.ts

@@ -0,0 +1,173 @@
+/**
+ * GNNService - Graph Neural Network Integration
+ *
+ * Provides high-level GNN capabilities on top of @ruvector/gnn:
+ * - Semantic intent classification
+ * - Graph-based skill recommendations
+ * - Code pattern similarity via graph embeddings
+ *
+ * Tries native @ruvector/gnn first (NAPI-RS), falls back to JS.
+ * All public methods are safe to call regardless of engine availability.
+ *
+ * Performance targets (ADR-062):
+ * - 100x-50000x speedup when native @ruvector/gnn is available
+ * - Zero-overhead JS fallback when native is not present
+ */
+export interface GNNConfig {
+    inputDim: number;
+    hiddenDim: number;
+    outputDim: number;
+    heads: number;
+    layers?: number;
+}
+export interface IntentResult {
+    intent: string;
+    confidence: number;
+    logits?: number[];
+}
+export declare class GNNService {
+    private gnn;
+    private engineType;
+    private initialized;
+    private config;
+    constructor(config?: Partial<GNNConfig>);
+    /**
+     * Initialize the GNN engine.
+     *
+     * Attempts to load @ruvector/gnn and create a GNN layer.
+     * Falls back to JS-based heuristics if unavailable.
+     */
+    initialize(): Promise<void>;
+    /**
+     * Semantic intent classification.
+     *
+     * When native GNN is available, runs a forward pass on the embedding
+     * and maps logits to intent categories. Otherwise uses keyword matching.
+     */
+    classifyIntent(query: string, embedding: Float32Array): Promise<IntentResult>;
+    /**
+     * Graph-based skill recommendations.
+     *
+     * Uses GNN node classification when available, otherwise
+     * returns adjacent skills from the skill graph map.
+     */
+    recommendSkills(currentSkill: string, skillGraph: Record<string, string[]>): Promise<string[]>;
+    /**
+     * Find similar code patterns using graph embedding similarity.
+     *
+     * When native GNN is available, uses graph-level similarity.
+     * Otherwise falls back to cosine similarity.
+     */
+    findSimilarPatterns(pattern: number[], patterns: number[][]): Promise<Array<{
+        index: number;
+        similarity: number;
+    }>>;
+    /**
+     * Get the current engine type.
+     */
+    getEngineType(): 'native' | 'js';
+    /**
+     * Check if the service is initialized.
+     */
+    isInitialized(): boolean;
+    /**
+     * Get service statistics.
+     */
+    getStats(): {
+        engineType: string;
+        initialized: boolean;
+        config: GNNConfig;
+    };
+    /**
+     * Graph Convolutional Network (GCN) for skill matching.
+     *
+     * Uses GCN layers to learn representations of skills based on their
+     * relationships in the skill graph. Achieves >90% accuracy when native.
+     */
+    matchSkillsGCN(taskEmbedding: Float32Array, skillGraph: Record<string, {
+        embedding: Float32Array;
+        neighbors: string[];
+    }>, topK?: number): Promise<Array<{
+        skill: string;
+        score: number;
+        confidence: number;
+    }>>;
+    /**
+     * Graph Attention Network (GAT) for context understanding.
+     *
+     * Applies attention mechanisms to weight the importance of different
+     * context nodes when making predictions.
+     */
+    understandContextGAT(queryEmbedding: Float32Array, contextNodes: Array<{
+        id: string;
+        embedding: Float32Array;
+        type: string;
+    }>, attentionHeads?: number): Promise<{
+        contextVector: Float32Array;
+        attentionWeights: Record<string, number>;
+        dominantTypes: string[];
+    }>;
+    /**
+     * Process heterogeneous graphs with multiple node and edge types.
+     *
+     * Handles graphs with different types of entities (agents, tasks, skills)
+     * and relationships (depends_on, requires, similar_to).
+     */
+    processHeterogeneousGraph(graph: {
+        nodes: Array<{
+            id: string;
+            type: string;
+            embedding: Float32Array;
+        }>;
+        edges: Array<{
+            from: string;
+            to: string;
+            type: string;
+            weight: number;
+        }>;
+    }, queryNodeId: string): Promise<{
+        embedding: Float32Array;
+        relatedNodes: Array<{
+            id: string;
+            type: string;
+            relevance: number;
+        }>;
+        pathways: Array<{
+            path: string[];
+            strength: number;
+        }>;
+    }>;
+    /**
+     * Node classification for task categorization.
+     *
+     * Classifies nodes into predefined categories using GNN-based features.
+     */
+    classifyNode(nodeEmbedding: Float32Array, neighborEmbeddings: Float32Array[], categories: string[]): Promise<{
+        category: string;
+        confidence: number;
+        scores: Record<string, number>;
+    }>;
+    /**
+     * Link prediction for workflow optimization.
+     *
+     * Predicts likely connections between nodes to suggest workflow improvements.
+     */
+    predictLinks(sourceNode: {
+        id: string;
+        embedding: Float32Array;
+    }, candidateNodes: Array<{
+        id: string;
+        embedding: Float32Array;
+        type: string;
+    }>, existingEdges: Array<{
+        from: string;
+        to: string;
+    }>, topK?: number): Promise<Array<{
+        targetId: string;
+        probability: number;
+        reasoning: string;
+    }>>;
+    private findStrongPathways;
+    private cosineSim;
+}
+//# sourceMappingURL=GNNService.d.ts.map

package/dist/packages/agentdb/src/services/GNNService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GNNService.d.ts","sourceRoot":"","sources":["../../../../../../packages/agentdb/src/services/GNNService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,MAAM,CAAY;gBAEd,MAAM,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC;IAYvC;;;;;OAKG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA0DjC;;;;;OAKG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAyDnF;;;;;OAKG;IACG,eAAe,CACnB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GACnC,OAAO,CAAC,MAAM,EAAE,CAAC;IAyDpB;;;;;OAKG;IACG,mBAAmB,CACvB,OAAO,EAAE,MAAM,EAAE,EACjB,QAAQ,EAAE,MAAM,EAAE,EAAE,GACnB,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAsCxD;;OAEG;IACH,aAAa,IAAI,QAAQ,GAAG,IAAI;IAIhC;;OAEG;IACH,aAAa,IAAI,OAAO;IAIxB;;OAEG;IACH,QAAQ,IAAI;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,SAAS,CAAA;KAAE;IAQ3E;;;;;OAKG;IACG,cAAc,CAClB,aAAa,EAAE,YAAY,EAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,YAAY,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,EAC5E,IAAI,GAAE,MAAU,GACf,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IA4DvE;;;;;OAKG;IACG,oBAAoB,CACxB,cAAc,EAAE,YAAY,EAC5B,YAAY,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,YAAY,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,EAC1E,cAAc,GAAE,MAAU,GACzB,OAAO,CAAC;QACT,aAAa,EAAE,YAAY,CAAC;QAC5B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzC,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IAgFF;;;;;OAKG;IACG,yBAAyB,CAC7B,KAAK,EAAE;QACL,KAAK,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,YAAY,CAAA;SAAE,CAAC,CAAC;QACpE,KAAK,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC1E,EACD,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QACT,SAAS,EAAE,YAAY,CAAC;QACxB,YAAY,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACrE,QAAQ,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACvD,CAAC;IA8FF;;;;OAIG;IACG,YAAY,CAChB,aAAa,EAAE,YAAY,EAC3B,kBAAkB,EAAE,YAAY,EAAE,EAClC,UAAU,EAAE,MAAM,EAAE,GACnB,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IA0DpF;;;;OAIG;IACG,YAAY,CAChB,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,YAAY,CAAA;KAAE,EACnD,cAAc,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,YAAY,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,EAC5E,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,EAClD,IAAI,GAAE,MAAU,GACf,OAAO,CAAC,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAuE/E,OAAO,CAAC,kBAAkB;IA0D1B,OAAO,CAAC,SAAS;CAelB"}