agentic-flow 2.0.7 → 3.0.0-alpha.2

package/dist/packages/agentdb/src/security/input-validation.js

@@ -0,0 +1,398 @@
+/**
+ * Input Validation and Sanitization for AgentDB Security
+ *
+ * Provides comprehensive validation to prevent SQL injection and other attacks:
+ * - Whitelist-based validation for identifiers (tables, columns, PRAGMA commands)
+ * - Input sanitization for user data
+ * - Type validation and constraints
+ * - Error handling that doesn't leak sensitive information
+ */
+/**
+ * Allowed table names in AgentDB (whitelist)
+ */
+const ALLOWED_TABLES = new Set([
+    'episodes',
+    'episode_embeddings',
+    'skills',
+    'skill_embeddings',
+    'causal_edges',
+    'causal_experiments',
+    'causal_observations',
+    'provenance_certificates',
+    'reasoning_patterns',
+    'pattern_embeddings',
+    'rl_sessions',
+    'rl_experiences',
+    'rl_policies',
+    'rl_q_values',
+]);
+/**
+ * Allowed column names by table (whitelist)
+ */
+const ALLOWED_COLUMNS = {
+    episodes: new Set([
+        'id', 'ts', 'session_id', 'task', 'input', 'output', 'critique',
+        'reward', 'success', 'latency_ms', 'tokens_used', 'tags', 'metadata'
+    ]),
+    skills: new Set([
+        'id', 'ts', 'name', 'description', 'signature', 'code',
+        'success_rate', 'uses', 'avg_reward', 'avg_latency_ms', 'tags', 'metadata'
+    ]),
+    causal_edges: new Set([
+        'id', 'ts', 'from_memory_id', 'from_memory_type', 'to_memory_id',
+        'to_memory_type', 'similarity', 'uplift', 'confidence', 'sample_size', 'evidence_ids'
+    ]),
+    // Add more as needed
+};
+/**
+ * Allowed PRAGMA commands (whitelist)
+ */
+const ALLOWED_PRAGMAS = new Set([
+    'journal_mode',
+    'synchronous',
+    'cache_size',
+    'page_size',
+    'page_count',
+    'user_version',
+    'foreign_keys',
+    'temp_store',
+    'mmap_size',
+    'wal_autocheckpoint',
+]);
+/**
+ * Validation error with safe error messages
+ */
+export class ValidationError extends Error {
+    code;
+    field;
+    constructor(message, code = 'VALIDATION_ERROR', field) {
+        super(message);
+        this.name = 'ValidationError';
+        this.code = code;
+        this.field = field;
+    }
+    /**
+     * Get safe error message (doesn't leak sensitive info)
+     */
+    getSafeMessage() {
+        return `Invalid input: ${this.field || 'unknown field'}`;
+    }
+}
+/**
+ * Validate task string (NEW - for MCP tool optimization)
+ */
+export function validateTaskString(task, fieldName = 'task') {
+    if (task === null || task === undefined) {
+        throw new ValidationError(`${fieldName} is required`, 'MISSING_REQUIRED_FIELD', fieldName);
+    }
+    if (typeof task !== 'string') {
+        throw new ValidationError(`${fieldName} must be a string`, 'INVALID_TYPE', fieldName);
+    }
+    const trimmed = task.trim();
+    if (trimmed.length === 0) {
+        throw new ValidationError(`${fieldName} cannot be empty`, 'EMPTY_STRING', fieldName);
+    }
+    if (trimmed.length > 10000) {
+        throw new ValidationError(`${fieldName} exceeds maximum length of 10000 characters`, 'STRING_TOO_LONG', fieldName);
+    }
+    // Check for potentially malicious patterns
+    const suspiciousPatterns = [
+        /<script/i,
+        /javascript:/i,
+        /on\w+\s*=/i, // onclick=, onload=, etc.
+        /\x00/, // Null bytes
+    ];
+    for (const pattern of suspiciousPatterns) {
+        if (pattern.test(trimmed)) {
+            throw new ValidationError(`${fieldName} contains potentially malicious content`, 'SUSPICIOUS_CONTENT', fieldName);
+        }
+    }
+    return trimmed;
+}
+/**
+ * Validate numeric range (NEW - for MCP tool optimization)
+ */
+export function validateNumericRange(value, fieldName, min, max) {
+    if (value === null || value === undefined) {
+        throw new ValidationError(`${fieldName} is required`, 'MISSING_REQUIRED_FIELD', fieldName);
+    }
+    if (typeof value !== 'number' || isNaN(value) || !isFinite(value)) {
+        throw new ValidationError(`${fieldName} must be a valid number`, 'INVALID_NUMBER', fieldName);
+    }
+    if (value < min || value > max) {
+        throw new ValidationError(`${fieldName} must be between ${min} and ${max} (got ${value})`, 'OUT_OF_RANGE', fieldName);
+    }
+    return value;
+}
+/**
+ * Validate array length (NEW - for MCP tool optimization)
+ */
+export function validateArrayLength(arr, fieldName, minLength, maxLength) {
+    if (arr === null || arr === undefined) {
+        throw new ValidationError(`${fieldName} is required`, 'MISSING_REQUIRED_FIELD', fieldName);
+    }
+    if (!Array.isArray(arr)) {
+        throw new ValidationError(`${fieldName} must be an array`, 'INVALID_ARRAY', fieldName);
+    }
+    if (arr.length < minLength || arr.length > maxLength) {
+        throw new ValidationError(`${fieldName} must contain between ${minLength} and ${maxLength} items (got ${arr.length})`, 'ARRAY_LENGTH_INVALID', fieldName);
+    }
+    return arr;
+}
+/**
+ * Validate object (NEW - for MCP tool optimization)
+ */
+export function validateObject(obj, fieldName, required = true) {
+    if (obj === null || obj === undefined) {
+        if (required) {
+            throw new ValidationError(`${fieldName} is required`, 'MISSING_REQUIRED_FIELD', fieldName);
+        }
+        return {};
+    }
+    if (typeof obj !== 'object' || Array.isArray(obj)) {
+        throw new ValidationError(`${fieldName} must be an object`, 'INVALID_OBJECT', fieldName);
+    }
+    return obj;
+}
+/**
+ * Validate boolean (NEW - for MCP tool optimization)
+ */
+export function validateBoolean(value, fieldName, defaultValue) {
+    if (value === null || value === undefined) {
+        if (defaultValue !== undefined) {
+            return defaultValue;
+        }
+        throw new ValidationError(`${fieldName} is required`, 'MISSING_REQUIRED_FIELD', fieldName);
+    }
+    if (typeof value !== 'boolean') {
+        throw new ValidationError(`${fieldName} must be a boolean`, 'INVALID_BOOLEAN', fieldName);
+    }
+    return value;
+}
+/**
+ * Validate enum value (NEW - for MCP tool optimization)
+ */
+export function validateEnum(value, fieldName, allowedValues) {
+    if (value === null || value === undefined) {
+        throw new ValidationError(`${fieldName} is required`, 'MISSING_REQUIRED_FIELD', fieldName);
+    }
+    if (typeof value !== 'string') {
+        throw new ValidationError(`${fieldName} must be a string`, 'INVALID_TYPE', fieldName);
+    }
+    if (!allowedValues.includes(value)) {
+        throw new ValidationError(`${fieldName} must be one of: ${allowedValues.join(', ')} (got "${value}")`, 'INVALID_ENUM_VALUE', fieldName);
+    }
+    return value;
+}
+/**
+ * Validate table name against whitelist
+ */
+export function validateTableName(tableName) {
+    if (!tableName || typeof tableName !== 'string') {
+        throw new ValidationError('Table name must be a non-empty string', 'INVALID_TABLE', 'tableName');
+    }
+    const sanitized = tableName.trim().toLowerCase();
+    if (!ALLOWED_TABLES.has(sanitized)) {
+        throw new ValidationError(`Invalid table name: ${sanitized}. Allowed tables: ${Array.from(ALLOWED_TABLES).join(', ')}`, 'INVALID_TABLE', 'tableName');
+    }
+    return sanitized;
+}
+/**
+ * Validate column name against whitelist
+ */
+export function validateColumnName(tableName, columnName) {
+    if (!columnName || typeof columnName !== 'string') {
+        throw new ValidationError('Column name must be a non-empty string', 'INVALID_COLUMN', 'columnName');
+    }
+    const sanitized = columnName.trim().toLowerCase();
+    const validatedTable = validateTableName(tableName);
+    const allowedColumns = ALLOWED_COLUMNS[validatedTable];
+    if (allowedColumns && !allowedColumns.has(sanitized)) {
+        throw new ValidationError(`Invalid column name for table ${validatedTable}: ${sanitized}`, 'INVALID_COLUMN', 'columnName');
+    }
+    return sanitized;
+}
+/**
+ * Validate PRAGMA command against whitelist
+ */
+export function validatePragmaCommand(pragma) {
+    if (!pragma || typeof pragma !== 'string') {
+        throw new ValidationError('PRAGMA command must be a non-empty string', 'INVALID_PRAGMA', 'pragma');
+    }
+    // Extract the pragma name (before any = or space)
+    const pragmaName = pragma.trim().toLowerCase().split(/[=\s]/)[0];
+    if (!ALLOWED_PRAGMAS.has(pragmaName)) {
+        throw new ValidationError(`Invalid PRAGMA command: ${pragmaName}. Allowed: ${Array.from(ALLOWED_PRAGMAS).join(', ')}`, 'INVALID_PRAGMA', 'pragma');
+    }
+    // Return the full pragma for execution (e.g., "journal_mode = WAL")
+    return pragma.trim();
+}
+/**
+ * Validate and sanitize session ID
+ */
+export function validateSessionId(sessionId) {
+    if (!sessionId || typeof sessionId !== 'string') {
+        throw new ValidationError('Session ID must be a non-empty string', 'INVALID_SESSION_ID', 'sessionId');
+    }
+    // Allow alphanumeric, hyphens, underscores (max 255 chars)
+    const sanitized = sessionId.trim();
+    if (sanitized.length > 255) {
+        throw new ValidationError('Session ID exceeds maximum length (255)', 'INVALID_SESSION_ID', 'sessionId');
+    }
+    if (!/^[a-zA-Z0-9_-]+$/.test(sanitized)) {
+        throw new ValidationError('Session ID must contain only alphanumeric characters, hyphens, and underscores', 'INVALID_SESSION_ID', 'sessionId');
+    }
+    return sanitized;
+}
+/**
+ * Validate numeric ID
+ */
+export function validateId(id, fieldName = 'id') {
+    const numId = Number(id);
+    if (!Number.isFinite(numId) || numId < 0 || !Number.isInteger(numId)) {
+        throw new ValidationError(`${fieldName} must be a non-negative integer`, 'INVALID_ID', fieldName);
+    }
+    return numId;
+}
+/**
+ * Validate timestamp
+ */
+export function validateTimestamp(timestamp, fieldName = 'timestamp') {
+    const numTs = Number(timestamp);
+    if (!Number.isFinite(numTs) || numTs < 0) {
+        throw new ValidationError(`${fieldName} must be a non-negative number`, 'INVALID_TIMESTAMP', fieldName);
+    }
+    // Reasonable timestamp bounds (2000-01-01 to 2100-01-01)
+    const MIN_TIMESTAMP = 946684800; // 2000-01-01
+    const MAX_TIMESTAMP = 4102444800; // 2100-01-01
+    if (numTs < MIN_TIMESTAMP || numTs > MAX_TIMESTAMP) {
+        throw new ValidationError(`${fieldName} is out of valid range (2000-2100)`, 'INVALID_TIMESTAMP', fieldName);
+    }
+    return numTs;
+}
+/**
+ * Validate reward value (0-1)
+ */
+export function validateReward(reward) {
+    const numReward = Number(reward);
+    if (!Number.isFinite(numReward)) {
+        throw new ValidationError('Reward must be a number', 'INVALID_REWARD', 'reward');
+    }
+    if (numReward < 0 || numReward > 1) {
+        throw new ValidationError('Reward must be between 0 and 1', 'INVALID_REWARD', 'reward');
+    }
+    return numReward;
+}
+/**
+ * Validate success flag
+ */
+export function validateSuccess(success) {
+    if (typeof success === 'boolean') {
+        return success;
+    }
+    if (typeof success === 'number') {
+        return success !== 0;
+    }
+    if (typeof success === 'string') {
+        const lower = success.toLowerCase();
+        if (lower === 'true' || lower === '1' || lower === 'yes')
+            return true;
+        if (lower === 'false' || lower === '0' || lower === 'no')
+            return false;
+    }
+    throw new ValidationError('Success must be a boolean value', 'INVALID_BOOLEAN', 'success');
+}
+/**
+ * Sanitize text input (prevent extremely long strings, null bytes, etc.)
+ */
+export function sanitizeText(text, maxLength = 100000, fieldName = 'text') {
+    if (typeof text !== 'string') {
+        throw new ValidationError(`${fieldName} must be a string`, 'INVALID_TEXT', fieldName);
+    }
+    // Remove null bytes
+    const sanitized = text.replace(/\0/g, '');
+    if (sanitized.length > maxLength) {
+        throw new ValidationError(`${fieldName} exceeds maximum length (${maxLength})`, 'TEXT_TOO_LONG', fieldName);
+    }
+    return sanitized;
+}
+/**
+ * Build safe WHERE clause with parameterized values
+ * Returns both the SQL clause and the parameter values
+ */
+export function buildSafeWhereClause(tableName, conditions) {
+    const validatedTable = validateTableName(tableName);
+    if (!conditions || typeof conditions !== 'object' || Object.keys(conditions).length === 0) {
+        throw new ValidationError('Conditions must be a non-empty object', 'INVALID_CONDITIONS', 'conditions');
+    }
+    const clauses = [];
+    const values = [];
+    for (const [column, value] of Object.entries(conditions)) {
+        const validatedColumn = validateColumnName(validatedTable, column);
+        clauses.push(`${validatedColumn} = ?`);
+        values.push(value);
+    }
+    return {
+        clause: clauses.join(' AND '),
+        values,
+    };
+}
+/**
+ * Build safe SET clause for UPDATE statements
+ */
+export function buildSafeSetClause(tableName, updates) {
+    const validatedTable = validateTableName(tableName);
+    if (!updates || typeof updates !== 'object' || Object.keys(updates).length === 0) {
+        throw new ValidationError('Updates must be a non-empty object', 'INVALID_UPDATES', 'updates');
+    }
+    const clauses = [];
+    const values = [];
+    for (const [column, value] of Object.entries(updates)) {
+        const validatedColumn = validateColumnName(validatedTable, column);
+        clauses.push(`${validatedColumn} = ?`);
+        values.push(value);
+    }
+    return {
+        clause: clauses.join(', '),
+        values,
+    };
+}
+/**
+ * Validate JSON data
+ */
+export function validateJSON(data, fieldName = 'json') {
+    try {
+        return JSON.stringify(data);
+    }
+    catch (error) {
+        throw new ValidationError(`${fieldName} is not valid JSON`, 'INVALID_JSON', fieldName);
+    }
+}
+/**
+ * Validate array of tags
+ */
+export function validateTags(tags) {
+    if (!Array.isArray(tags)) {
+        throw new ValidationError('Tags must be an array', 'INVALID_TAGS', 'tags');
+    }
+    const sanitized = tags.map((tag, i) => {
+        if (typeof tag !== 'string') {
+            throw new ValidationError(`Tag at index ${i} must be a string`, 'INVALID_TAG', `tags[${i}]`);
+        }
+        return sanitizeText(tag, 100, `tags[${i}]`);
+    });
+    return sanitized;
+}
+/**
+ * Safe error handler that doesn't leak sensitive information
+ */
+export function handleSecurityError(error) {
+    if (error instanceof ValidationError) {
+        // Safe to return validation errors
+        return error.message;
+    }
+    // For other errors, return generic message and log details internally
+    console.error('Security error:', error);
+    return 'An error occurred while processing your request. Please check your input and try again.';
+}
+//# sourceMappingURL=input-validation.js.map

package/dist/packages/agentdb/src/security/input-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-validation.js","sourceRoot":"","sources":["../../../../../../packages/agentdb/src/security/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,UAAU;IACV,oBAAoB;IACpB,QAAQ;IACR,kBAAkB;IAClB,cAAc;IACd,oBAAoB;IACpB,qBAAqB;IACrB,yBAAyB;IACzB,oBAAoB;IACpB,oBAAoB;IACpB,aAAa;IACb,gBAAgB;IAChB,aAAa;IACb,aAAa;CACd,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,eAAe,GAAgC;IACnD,QAAQ,EAAE,IAAI,GAAG,CAAC;QAChB,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU;QAC/D,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU;KACrE,CAAC;IACF,MAAM,EAAE,IAAI,GAAG,CAAC;QACd,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM;QACtD,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU;KAC3E,CAAC;IACF,YAAY,EAAE,IAAI,GAAG,CAAC;QACpB,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,cAAc;QAChE,gBAAgB,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc;KACtF,CAAC;IACF,qBAAqB;CACtB,CAAC;AAEF;;GAEG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,cAAc;IACd,aAAa;IACb,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,cAAc;IACd,cAAc;IACd,YAAY;IACZ,WAAW;IACX,oBAAoB;CACrB,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxB,IAAI,CAAS;IACb,KAAK,CAAU;IAE/B,YAAY,OAAe,EAAE,OAAe,kBAAkB,EAAE,KAAc;QAC5E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,kBAAkB,IAAI,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;IAC3D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAa,EAAE,YAAoB,MAAM;IAC1E,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,cAAc,EAAE,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,mBAAmB,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAE5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,kBAAkB,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,6CAA6C,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IAED,2CAA2C;IAC3C,MAAM,kBAAkB,GAAG;QACzB,UAAU;QACV,cAAc;QACd,YAAY,EAAE,0BAA0B;QACxC,MAAM,EAAE,aAAa;KACtB,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,yCAAyC,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,SAAiB,EACjB,GAAW,EACX,GAAW;IAEX,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,cAAc,EAAE,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,yBAAyB,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,oBAAoB,GAAG,QAAQ,GAAG,SAAS,KAAK,GAAG,EAC/D,cAAc,EACd,SAAS,CACV,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAY,EACZ,SAAiB,EACjB,SAAiB,EACjB,SAAiB;IAEjB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,cAAc,EAAE,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,mBAAmB,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QACrD,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,yBAAyB,SAAS,QAAQ,SAAS,eAAe,GAAG,CAAC,MAAM,GAAG,EAC3F,sBAAsB,EACtB,SAAS,CACV,CAAC;IACJ,CAAC;IAED,OAAO,GAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAY,EACZ,SAAiB,EACjB,WAAoB,IAAI;IAExB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,cAAc,EAAE,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,oBAAoB,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO,GAA0B,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAc,EACd,SAAiB,EACjB,YAAsB;IAEtB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,cAAc,EAAE,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,oBAAoB,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAc,EACd,SAAiB,EACjB,aAA2B;IAE3B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,cAAc,EAAE,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,mBAAmB,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,oBAAoB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,EAC3E,oBAAoB,EACpB,SAAS,CACV,CAAC;IACJ,CAAC;IAED,OAAO,KAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CAAC,uCAAuC,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEjD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,eAAe,CACvB,uBAAuB,SAAS,qBAAqB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC5F,eAAe,EACf,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,UAAkB;IACtE,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,eAAe,CAAC,wCAAwC,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,cAAc,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAEpD,MAAM,cAAc,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IACvD,IAAI,cAAc,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,eAAe,CACvB,iCAAiC,cAAc,KAAK,SAAS,EAAE,EAC/D,gBAAgB,EAChB,YAAY,CACb,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,eAAe,CAAC,2CAA2C,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IACrG,CAAC;IAED,kDAAkD;IAClD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,eAAe,CACvB,2BAA2B,UAAU,cAAc,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3F,gBAAgB,EAChB,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CAAC,uCAAuC,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;IACxG,CAAC;IAED,2DAA2D;IAC3D,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAEnC,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,yCAAyC,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAC1G,CAAC;IAED,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,eAAe,CACvB,gFAAgF,EAChF,oBAAoB,EACpB,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,EAAO,EAAE,YAAoB,IAAI;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IAEzB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,iCAAiC,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAc,EAAE,YAAoB,WAAW;IAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAEhC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,gCAAgC,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAC;IAC1G,CAAC;IAED,yDAAyD;IACzD,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,aAAa;IAC9C,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,aAAa;IAE/C,IAAI,KAAK,GAAG,aAAa,IAAI,KAAK,GAAG,aAAa,EAAE,CAAC;QACnD,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,oCAAoC,EAChD,mBAAmB,EACnB,SAAS,CACV,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,MAAW;IACxC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAEjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,eAAe,CAAC,yBAAyB,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAY;IAC1C,IAAI,OAAO,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,OAAO,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACtE,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IACzE,CAAC;IAED,MAAM,IAAI,eAAe,CAAC,iCAAiC,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;AAC7F,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,YAAoB,MAAM,EAAE,YAAoB,MAAM;IAC/F,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,mBAAmB,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;IAED,oBAAoB;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE1C,IAAI,SAAS,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,4BAA4B,SAAS,GAAG,EACpD,eAAe,EACf,SAAS,CACV,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAiB,EACjB,UAA+B;IAE/B,MAAM,cAAc,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAEpD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,eAAe,CAAC,uCAAuC,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAU,EAAE,CAAC;IAEzB,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACzD,MAAM,eAAe,GAAG,kBAAkB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,GAAG,eAAe,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAC7B,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAiB,EACjB,OAA4B;IAE5B,MAAM,cAAc,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAEpD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,eAAe,CAAC,oCAAoC,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAU,EAAE,CAAC;IAEzB,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,MAAM,eAAe,GAAG,kBAAkB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,GAAG,eAAe,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1B,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAS,EAAE,YAAoB,MAAM;IAChE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,oBAAoB,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAS;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,eAAe,CAAC,uBAAuB,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,eAAe,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAU;IAC5C,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QACrC,mCAAmC;QACnC,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,sEAAsE;IACtE,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IACxC,OAAO,yFAAyF,CAAC;AACnG,CAAC","sourcesContent":["/**\n * Input Validation and Sanitization for AgentDB Security\n *\n * Provides comprehensive validation to prevent SQL injection and other attacks:\n * - Whitelist-based validation for identifiers (tables, columns, PRAGMA commands)\n * - Input sanitization for user data\n * - Type validation and constraints\n * - Error handling that doesn't leak sensitive information\n */\n\n/**\n * Allowed table names in AgentDB (whitelist)\n */\nconst ALLOWED_TABLES = new Set([\n  'episodes',\n  'episode_embeddings',\n  'skills',\n  'skill_embeddings',\n  'causal_edges',\n  'causal_experiments',\n  'causal_observations',\n  'provenance_certificates',\n  'reasoning_patterns',\n  'pattern_embeddings',\n  'rl_sessions',\n  'rl_experiences',\n  'rl_policies',\n  'rl_q_values',\n]);\n\n/**\n * Allowed column names by table (whitelist)\n */\nconst ALLOWED_COLUMNS: Record<string, Set<string>> = {\n  episodes: new Set([\n    'id', 'ts', 'session_id', 'task', 'input', 'output', 'critique',\n    'reward', 'success', 'latency_ms', 'tokens_used', 'tags', 'metadata'\n  ]),\n  skills: new Set([\n    'id', 'ts', 'name', 'description', 'signature', 'code',\n    'success_rate', 'uses', 'avg_reward', 'avg_latency_ms', 'tags', 'metadata'\n  ]),\n  causal_edges: new Set([\n    'id', 'ts', 'from_memory_id', 'from_memory_type', 'to_memory_id',\n    'to_memory_type', 'similarity', 'uplift', 'confidence', 'sample_size', 'evidence_ids'\n  ]),\n  // Add more as needed\n};\n\n/**\n * Allowed PRAGMA commands (whitelist)\n */\nconst ALLOWED_PRAGMAS = new Set([\n  'journal_mode',\n  'synchronous',\n  'cache_size',\n  'page_size',\n  'page_count',\n  'user_version',\n  'foreign_keys',\n  'temp_store',\n  'mmap_size',\n  'wal_autocheckpoint',\n]);\n\n/**\n * Validation error with safe error messages\n */\nexport class ValidationError extends Error {\n  public readonly code: string;\n  public readonly field?: string;\n\n  constructor(message: string, code: string = 'VALIDATION_ERROR', field?: string) {\n    super(message);\n    this.name = 'ValidationError';\n    this.code = code;\n    this.field = field;\n  }\n\n  /**\n   * Get safe error message (doesn't leak sensitive info)\n   */\n  getSafeMessage(): string {\n    return `Invalid input: ${this.field || 'unknown field'}`;\n  }\n}\n\n/**\n * Validate task string (NEW - for MCP tool optimization)\n */\nexport function validateTaskString(task: unknown, fieldName: string = 'task'): string {\n  if (task === null || task === undefined) {\n    throw new ValidationError(`${fieldName} is required`, 'MISSING_REQUIRED_FIELD', fieldName);\n  }\n\n  if (typeof task !== 'string') {\n    throw new ValidationError(`${fieldName} must be a string`, 'INVALID_TYPE', fieldName);\n  }\n\n  const trimmed = task.trim();\n\n  if (trimmed.length === 0) {\n    throw new ValidationError(`${fieldName} cannot be empty`, 'EMPTY_STRING', fieldName);\n  }\n\n  if (trimmed.length > 10000) {\n    throw new ValidationError(`${fieldName} exceeds maximum length of 10000 characters`, 'STRING_TOO_LONG', fieldName);\n  }\n\n  // Check for potentially malicious patterns\n  const suspiciousPatterns = [\n    /<script/i,\n    /javascript:/i,\n    /on\\w+\\s*=/i, // onclick=, onload=, etc.\n    /\\x00/, // Null bytes\n  ];\n\n  for (const pattern of suspiciousPatterns) {\n    if (pattern.test(trimmed)) {\n      throw new ValidationError(`${fieldName} contains potentially malicious content`, 'SUSPICIOUS_CONTENT', fieldName);\n    }\n  }\n\n  return trimmed;\n}\n\n/**\n * Validate numeric range (NEW - for MCP tool optimization)\n */\nexport function validateNumericRange(\n  value: unknown,\n  fieldName: string,\n  min: number,\n  max: number\n): number {\n  if (value === null || value === undefined) {\n    throw new ValidationError(`${fieldName} is required`, 'MISSING_REQUIRED_FIELD', fieldName);\n  }\n\n  if (typeof value !== 'number' || isNaN(value) || !isFinite(value)) {\n    throw new ValidationError(`${fieldName} must be a valid number`, 'INVALID_NUMBER', fieldName);\n  }\n\n  if (value < min || value > max) {\n    throw new ValidationError(\n      `${fieldName} must be between ${min} and ${max} (got ${value})`,\n      'OUT_OF_RANGE',\n      fieldName\n    );\n  }\n\n  return value;\n}\n\n/**\n * Validate array length (NEW - for MCP tool optimization)\n */\nexport function validateArrayLength<T>(\n  arr: unknown,\n  fieldName: string,\n  minLength: number,\n  maxLength: number\n): T[] {\n  if (arr === null || arr === undefined) {\n    throw new ValidationError(`${fieldName} is required`, 'MISSING_REQUIRED_FIELD', fieldName);\n  }\n\n  if (!Array.isArray(arr)) {\n    throw new ValidationError(`${fieldName} must be an array`, 'INVALID_ARRAY', fieldName);\n  }\n\n  if (arr.length < minLength || arr.length > maxLength) {\n    throw new ValidationError(\n      `${fieldName} must contain between ${minLength} and ${maxLength} items (got ${arr.length})`,\n      'ARRAY_LENGTH_INVALID',\n      fieldName\n    );\n  }\n\n  return arr as T[];\n}\n\n/**\n * Validate object (NEW - for MCP tool optimization)\n */\nexport function validateObject(\n  obj: unknown,\n  fieldName: string,\n  required: boolean = true\n): Record<string, any> {\n  if (obj === null || obj === undefined) {\n    if (required) {\n      throw new ValidationError(`${fieldName} is required`, 'MISSING_REQUIRED_FIELD', fieldName);\n    }\n    return {};\n  }\n\n  if (typeof obj !== 'object' || Array.isArray(obj)) {\n    throw new ValidationError(`${fieldName} must be an object`, 'INVALID_OBJECT', fieldName);\n  }\n\n  return obj as Record<string, any>;\n}\n\n/**\n * Validate boolean (NEW - for MCP tool optimization)\n */\nexport function validateBoolean(\n  value: unknown,\n  fieldName: string,\n  defaultValue?: boolean\n): boolean {\n  if (value === null || value === undefined) {\n    if (defaultValue !== undefined) {\n      return defaultValue;\n    }\n    throw new ValidationError(`${fieldName} is required`, 'MISSING_REQUIRED_FIELD', fieldName);\n  }\n\n  if (typeof value !== 'boolean') {\n    throw new ValidationError(`${fieldName} must be a boolean`, 'INVALID_BOOLEAN', fieldName);\n  }\n\n  return value;\n}\n\n/**\n * Validate enum value (NEW - for MCP tool optimization)\n */\nexport function validateEnum<T extends string>(\n  value: unknown,\n  fieldName: string,\n  allowedValues: readonly T[]\n): T {\n  if (value === null || value === undefined) {\n    throw new ValidationError(`${fieldName} is required`, 'MISSING_REQUIRED_FIELD', fieldName);\n  }\n\n  if (typeof value !== 'string') {\n    throw new ValidationError(`${fieldName} must be a string`, 'INVALID_TYPE', fieldName);\n  }\n\n  if (!allowedValues.includes(value as T)) {\n    throw new ValidationError(\n      `${fieldName} must be one of: ${allowedValues.join(', ')} (got \"${value}\")`,\n      'INVALID_ENUM_VALUE',\n      fieldName\n    );\n  }\n\n  return value as T;\n}\n\n/**\n * Validate table name against whitelist\n */\nexport function validateTableName(tableName: string): string {\n  if (!tableName || typeof tableName !== 'string') {\n    throw new ValidationError('Table name must be a non-empty string', 'INVALID_TABLE', 'tableName');\n  }\n\n  const sanitized = tableName.trim().toLowerCase();\n\n  if (!ALLOWED_TABLES.has(sanitized)) {\n    throw new ValidationError(\n      `Invalid table name: ${sanitized}. Allowed tables: ${Array.from(ALLOWED_TABLES).join(', ')}`,\n      'INVALID_TABLE',\n      'tableName'\n    );\n  }\n\n  return sanitized;\n}\n\n/**\n * Validate column name against whitelist\n */\nexport function validateColumnName(tableName: string, columnName: string): string {\n  if (!columnName || typeof columnName !== 'string') {\n    throw new ValidationError('Column name must be a non-empty string', 'INVALID_COLUMN', 'columnName');\n  }\n\n  const sanitized = columnName.trim().toLowerCase();\n  const validatedTable = validateTableName(tableName);\n\n  const allowedColumns = ALLOWED_COLUMNS[validatedTable];\n  if (allowedColumns && !allowedColumns.has(sanitized)) {\n    throw new ValidationError(\n      `Invalid column name for table ${validatedTable}: ${sanitized}`,\n      'INVALID_COLUMN',\n      'columnName'\n    );\n  }\n\n  return sanitized;\n}\n\n/**\n * Validate PRAGMA command against whitelist\n */\nexport function validatePragmaCommand(pragma: string): string {\n  if (!pragma || typeof pragma !== 'string') {\n    throw new ValidationError('PRAGMA command must be a non-empty string', 'INVALID_PRAGMA', 'pragma');\n  }\n\n  // Extract the pragma name (before any = or space)\n  const pragmaName = pragma.trim().toLowerCase().split(/[=\\s]/)[0];\n\n  if (!ALLOWED_PRAGMAS.has(pragmaName)) {\n    throw new ValidationError(\n      `Invalid PRAGMA command: ${pragmaName}. Allowed: ${Array.from(ALLOWED_PRAGMAS).join(', ')}`,\n      'INVALID_PRAGMA',\n      'pragma'\n    );\n  }\n\n  // Return the full pragma for execution (e.g., \"journal_mode = WAL\")\n  return pragma.trim();\n}\n\n/**\n * Validate and sanitize session ID\n */\nexport function validateSessionId(sessionId: string): string {\n  if (!sessionId || typeof sessionId !== 'string') {\n    throw new ValidationError('Session ID must be a non-empty string', 'INVALID_SESSION_ID', 'sessionId');\n  }\n\n  // Allow alphanumeric, hyphens, underscores (max 255 chars)\n  const sanitized = sessionId.trim();\n\n  if (sanitized.length > 255) {\n    throw new ValidationError('Session ID exceeds maximum length (255)', 'INVALID_SESSION_ID', 'sessionId');\n  }\n\n  if (!/^[a-zA-Z0-9_-]+$/.test(sanitized)) {\n    throw new ValidationError(\n      'Session ID must contain only alphanumeric characters, hyphens, and underscores',\n      'INVALID_SESSION_ID',\n      'sessionId'\n    );\n  }\n\n  return sanitized;\n}\n\n/**\n * Validate numeric ID\n */\nexport function validateId(id: any, fieldName: string = 'id'): number {\n  const numId = Number(id);\n\n  if (!Number.isFinite(numId) || numId < 0 || !Number.isInteger(numId)) {\n    throw new ValidationError(`${fieldName} must be a non-negative integer`, 'INVALID_ID', fieldName);\n  }\n\n  return numId;\n}\n\n/**\n * Validate timestamp\n */\nexport function validateTimestamp(timestamp: any, fieldName: string = 'timestamp'): number {\n  const numTs = Number(timestamp);\n\n  if (!Number.isFinite(numTs) || numTs < 0) {\n    throw new ValidationError(`${fieldName} must be a non-negative number`, 'INVALID_TIMESTAMP', fieldName);\n  }\n\n  // Reasonable timestamp bounds (2000-01-01 to 2100-01-01)\n  const MIN_TIMESTAMP = 946684800; // 2000-01-01\n  const MAX_TIMESTAMP = 4102444800; // 2100-01-01\n\n  if (numTs < MIN_TIMESTAMP || numTs > MAX_TIMESTAMP) {\n    throw new ValidationError(\n      `${fieldName} is out of valid range (2000-2100)`,\n      'INVALID_TIMESTAMP',\n      fieldName\n    );\n  }\n\n  return numTs;\n}\n\n/**\n * Validate reward value (0-1)\n */\nexport function validateReward(reward: any): number {\n  const numReward = Number(reward);\n\n  if (!Number.isFinite(numReward)) {\n    throw new ValidationError('Reward must be a number', 'INVALID_REWARD', 'reward');\n  }\n\n  if (numReward < 0 || numReward > 1) {\n    throw new ValidationError('Reward must be between 0 and 1', 'INVALID_REWARD', 'reward');\n  }\n\n  return numReward;\n}\n\n/**\n * Validate success flag\n */\nexport function validateSuccess(success: any): boolean {\n  if (typeof success === 'boolean') {\n    return success;\n  }\n\n  if (typeof success === 'number') {\n    return success !== 0;\n  }\n\n  if (typeof success === 'string') {\n    const lower = success.toLowerCase();\n    if (lower === 'true' || lower === '1' || lower === 'yes') return true;\n    if (lower === 'false' || lower === '0' || lower === 'no') return false;\n  }\n\n  throw new ValidationError('Success must be a boolean value', 'INVALID_BOOLEAN', 'success');\n}\n\n/**\n * Sanitize text input (prevent extremely long strings, null bytes, etc.)\n */\nexport function sanitizeText(text: string, maxLength: number = 100000, fieldName: string = 'text'): string {\n  if (typeof text !== 'string') {\n    throw new ValidationError(`${fieldName} must be a string`, 'INVALID_TEXT', fieldName);\n  }\n\n  // Remove null bytes\n  const sanitized = text.replace(/\\0/g, '');\n\n  if (sanitized.length > maxLength) {\n    throw new ValidationError(\n      `${fieldName} exceeds maximum length (${maxLength})`,\n      'TEXT_TOO_LONG',\n      fieldName\n    );\n  }\n\n  return sanitized;\n}\n\n/**\n * Build safe WHERE clause with parameterized values\n * Returns both the SQL clause and the parameter values\n */\nexport function buildSafeWhereClause(\n  tableName: string,\n  conditions: Record<string, any>\n): { clause: string; values: any[] } {\n  const validatedTable = validateTableName(tableName);\n\n  if (!conditions || typeof conditions !== 'object' || Object.keys(conditions).length === 0) {\n    throw new ValidationError('Conditions must be a non-empty object', 'INVALID_CONDITIONS', 'conditions');\n  }\n\n  const clauses: string[] = [];\n  const values: any[] = [];\n\n  for (const [column, value] of Object.entries(conditions)) {\n    const validatedColumn = validateColumnName(validatedTable, column);\n    clauses.push(`${validatedColumn} = ?`);\n    values.push(value);\n  }\n\n  return {\n    clause: clauses.join(' AND '),\n    values,\n  };\n}\n\n/**\n * Build safe SET clause for UPDATE statements\n */\nexport function buildSafeSetClause(\n  tableName: string,\n  updates: Record<string, any>\n): { clause: string; values: any[] } {\n  const validatedTable = validateTableName(tableName);\n\n  if (!updates || typeof updates !== 'object' || Object.keys(updates).length === 0) {\n    throw new ValidationError('Updates must be a non-empty object', 'INVALID_UPDATES', 'updates');\n  }\n\n  const clauses: string[] = [];\n  const values: any[] = [];\n\n  for (const [column, value] of Object.entries(updates)) {\n    const validatedColumn = validateColumnName(validatedTable, column);\n    clauses.push(`${validatedColumn} = ?`);\n    values.push(value);\n  }\n\n  return {\n    clause: clauses.join(', '),\n    values,\n  };\n}\n\n/**\n * Validate JSON data\n */\nexport function validateJSON(data: any, fieldName: string = 'json'): string {\n  try {\n    return JSON.stringify(data);\n  } catch (error) {\n    throw new ValidationError(`${fieldName} is not valid JSON`, 'INVALID_JSON', fieldName);\n  }\n}\n\n/**\n * Validate array of tags\n */\nexport function validateTags(tags: any): string[] {\n  if (!Array.isArray(tags)) {\n    throw new ValidationError('Tags must be an array', 'INVALID_TAGS', 'tags');\n  }\n\n  const sanitized = tags.map((tag, i) => {\n    if (typeof tag !== 'string') {\n      throw new ValidationError(`Tag at index ${i} must be a string`, 'INVALID_TAG', `tags[${i}]`);\n    }\n    return sanitizeText(tag, 100, `tags[${i}]`);\n  });\n\n  return sanitized;\n}\n\n/**\n * Safe error handler that doesn't leak sensitive information\n */\nexport function handleSecurityError(error: any): string {\n  if (error instanceof ValidationError) {\n    // Safe to return validation errors\n    return error.message;\n  }\n\n  // For other errors, return generic message and log details internally\n  console.error('Security error:', error);\n  return 'An error occurred while processing your request. Please check your input and try again.';\n}\n"]}

package/dist/packages/agentdb/src/security/validation.d.ts

@@ -0,0 +1,95 @@
+/**
+ * AgentDB v2 Security Validation
+ *
+ * Comprehensive input validation for RuVector integration:
+ * - Vector dimension and value validation (NaN/Infinity prevention)
+ * - ID sanitization (path traversal prevention)
+ * - Search options validation (bounds checking)
+ * - Cypher query parameter validation (injection prevention)
+ * - Metadata sanitization (sensitive data protection)
+ */
+/**
+ * Security limits for AgentDB v2
+ */
+export declare const SECURITY_LIMITS: {
+    readonly MAX_VECTORS: 10000000;
+    readonly MAX_DIMENSION: 4096;
+    readonly MAX_BATCH_SIZE: 10000;
+    readonly MAX_K: 10000;
+    readonly QUERY_TIMEOUT_MS: 30000;
+    readonly MAX_MEMORY_MB: 16384;
+    readonly MAX_ID_LENGTH: 256;
+    readonly MAX_METADATA_SIZE: 65536;
+    readonly MAX_LABEL_LENGTH: 128;
+    readonly MAX_PROPERTY_KEY_LENGTH: 128;
+    readonly MAX_CYPHER_PARAMS: 100;
+    readonly MIN_DIMENSION: 1;
+    readonly MIN_K: 1;
+    readonly MIN_THRESHOLD: 0;
+    readonly MAX_THRESHOLD: 1;
+    readonly MIN_EF_SEARCH: 1;
+    readonly MAX_EF_SEARCH: 1000;
+    readonly MIN_EF_CONSTRUCTION: 4;
+    readonly MAX_EF_CONSTRUCTION: 500;
+    readonly MAX_M: 64;
+    readonly MIN_M: 2;
+};
+/**
+ * Validate vector embedding data
+ * Prevents NaN, Infinity, and dimension mismatches
+ */
+export declare function validateVector(embedding: Float32Array | number[], expectedDim: number, fieldName?: string): void;
+/**
+ * Validate vector ID
+ * Prevents path traversal, excessive length, and malicious characters
+ */
+export declare function validateVectorId(id: string, fieldName?: string): string;
+/**
+ * Validate search options
+ * Ensures k, threshold, and other parameters are within safe bounds
+ */
+export interface SearchOptions {
+    k?: number;
+    threshold?: number;
+    efSearch?: number;
+    filter?: Record<string, any>;
+    includeMetadata?: boolean;
+    includeVectors?: boolean;
+}
+export declare function validateSearchOptions(options: SearchOptions): SearchOptions;
+/**
+ * Validate HNSW index parameters
+ */
+export interface HNSWParams {
+    M?: number;
+    efConstruction?: number;
+    efSearch?: number;
+}
+export declare function validateHNSWParams(params: HNSWParams): HNSWParams;
+/**
+ * Sanitize metadata to prevent sensitive data exposure
+ * Removes fields that commonly contain secrets or PII
+ */
+export declare function sanitizeMetadata(metadata: Record<string, any>): Record<string, any>;
+/**
+ * Validate Cypher query parameters for graph operations
+ * Prevents Cypher injection attacks
+ */
+export declare function validateCypherParams(params: Record<string, any>): Record<string, any>;
+/**
+ * Validate graph node label
+ */
+export declare function validateLabel(label: string): string;
+/**
+ * Validate batch size for bulk operations
+ */
+export declare function validateBatchSize(batchSize: number): number;
+/**
+ * Validate vector count doesn't exceed limits
+ */
+export declare function validateVectorCount(count: number): void;
+/**
+ * Safe logging that doesn't expose vectors or sensitive data
+ */
+export declare function safeLog(message: string, data?: any): void;
+//# sourceMappingURL=validation.d.ts.map

package/dist/packages/agentdb/src/security/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../../../../packages/agentdb/src/security/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH;;GAEG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;CAsBlB,CAAC;AAEX;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,YAAY,GAAG,MAAM,EAAE,EAClC,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,MAAiB,GAC3B,IAAI,CAiDN;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,GAAE,MAAa,GAAG,MAAM,CAsD7E;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,aAAa,GAAG,aAAa,CAmG3E;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAkDjE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAqDrB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CA+CrB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAmCnD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAkB3D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAQvD;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,CA0BzD"}