vesper-memory 0.3.0

package/dist/utils/rate-limiter.js

@@ -0,0 +1,166 @@
+/**
+ * Rate Limiting Module
+ *
+ * Token bucket implementation for preventing DoS attacks and abuse.
+ * Limits requests per user per time window.
+ *
+ * Security Features:
+ * - Per-user rate limiting
+ * - Configurable limits per operation type
+ * - Redis-backed for distributed systems
+ * - Automatic token refill
+ */
+import { validateUserId } from './validation.js';
+/**
+ * Default rate limits per operation
+ */
+export const DEFAULT_RATE_LIMITS = {
+    store_memory: {
+        maxRequests: 100,
+        windowSeconds: 60, // 100 requests per minute
+    },
+    retrieve_memory: {
+        maxRequests: 300,
+        windowSeconds: 60, // 300 requests per minute
+    },
+    list_recent: {
+        maxRequests: 60,
+        windowSeconds: 60, // 60 requests per minute
+    },
+    get_stats: {
+        maxRequests: 30,
+        windowSeconds: 60, // 30 requests per minute
+    },
+};
+/**
+ * Token Bucket Rate Limiter
+ *
+ * Implements the token bucket algorithm using Redis for distributed rate limiting.
+ * Each user has a separate bucket per operation type.
+ */
+export class RateLimiter {
+    redis;
+    limits;
+    constructor(redis, limits = DEFAULT_RATE_LIMITS) {
+        this.redis = redis;
+        this.limits = limits;
+    }
+    /**
+     * Check if a request is allowed under rate limits
+     *
+     * @param userId - User identifier
+     * @param operation - Operation name (e.g., "store_memory")
+     * @returns Rate limit result with allowed status and metadata
+     */
+    async checkLimit(userId, operation) {
+        // Validate user ID to prevent injection attacks
+        const sanitizedUserId = validateUserId(userId);
+        // Get rate limit config for this operation
+        const config = this.limits[operation];
+        if (!config) {
+            throw new Error(`No rate limit configured for operation: ${operation}`);
+        }
+        const key = `ratelimit:${sanitizedUserId}:${operation}`;
+        const now = Date.now();
+        const windowMs = config.windowSeconds * 1000;
+        // Use Redis pipeline for atomic operations
+        const pipeline = this.redis.pipeline();
+        // Add current timestamp to sorted set with unique member
+        // Use timestamp + random component to ensure uniqueness
+        const member = `${now}:${Math.random().toString(36).substr(2, 9)}`;
+        pipeline.zadd(key, now, member);
+        // Remove timestamps outside the current window
+        const windowStart = now - windowMs;
+        pipeline.zremrangebyscore(key, 0, windowStart);
+        // Count requests in current window
+        pipeline.zcard(key);
+        // Set expiration to prevent memory leaks
+        pipeline.expire(key, config.windowSeconds * 2);
+        const results = await pipeline.exec();
+        if (!results) {
+            throw new Error('Redis pipeline failed');
+        }
+        // Extract count from pipeline results
+        // results[2] is the zcard result: [error, count]
+        const count = results[2][1];
+        const allowed = count <= config.maxRequests;
+        const remaining = Math.max(0, config.maxRequests - count);
+        // Calculate reset time (time until oldest request expires)
+        let resetIn = config.windowSeconds;
+        if (count > 0) {
+            const oldestTimestamps = await this.redis.zrange(key, 0, 0, 'WITHSCORES');
+            if (oldestTimestamps.length >= 2) {
+                const oldestTime = parseInt(oldestTimestamps[1]);
+                const expiresAt = oldestTime + windowMs;
+                resetIn = Math.ceil((expiresAt - now) / 1000);
+            }
+        }
+        return {
+            allowed,
+            remaining,
+            resetIn: Math.max(0, resetIn),
+            limit: config.maxRequests,
+        };
+    }
+    /**
+     * Reset rate limit for a user and operation
+     *
+     * Useful for testing or administrative overrides.
+     *
+     * @param userId - User identifier
+     * @param operation - Operation name
+     */
+    async resetLimit(userId, operation) {
+        const sanitizedUserId = validateUserId(userId);
+        const key = `ratelimit:${sanitizedUserId}:${operation}`;
+        await this.redis.del(key);
+    }
+    /**
+     * Get current usage for a user and operation
+     *
+     * @param userId - User identifier
+     * @param operation - Operation name
+     * @returns Current request count in window
+     */
+    async getUsage(userId, operation) {
+        const sanitizedUserId = validateUserId(userId);
+        const config = this.limits[operation];
+        if (!config) {
+            throw new Error(`No rate limit configured for operation: ${operation}`);
+        }
+        const key = `ratelimit:${sanitizedUserId}:${operation}`;
+        const now = Date.now();
+        const windowStart = now - (config.windowSeconds * 1000);
+        // Count requests in current window
+        const count = await this.redis.zcount(key, windowStart, now);
+        return count;
+    }
+    /**
+     * Update rate limit configuration
+     *
+     * @param operation - Operation name
+     * @param config - New rate limit configuration
+     */
+    setLimit(operation, config) {
+        this.limits[operation] = config;
+    }
+    /**
+     * Get rate limit configuration for an operation
+     *
+     * @param operation - Operation name
+     * @returns Rate limit configuration
+     */
+    getLimit(operation) {
+        return this.limits[operation];
+    }
+}
+/**
+ * Factory function to create a rate limiter
+ *
+ * @param redis - Redis client
+ * @param limits - Optional custom rate limits
+ */
+export function createRateLimiter(redis, limits) {
+    return new RateLimiter(redis, limits);
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/utils/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../src/utils/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA0BjD;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAoC;IAClE,YAAY,EAAE;QACZ,WAAW,EAAE,GAAG;QAChB,aAAa,EAAE,EAAE,EAAE,0BAA0B;KAC9C;IACD,eAAe,EAAE;QACf,WAAW,EAAE,GAAG;QAChB,aAAa,EAAE,EAAE,EAAE,0BAA0B;KAC9C;IACD,WAAW,EAAE;QACX,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,EAAE,EAAE,yBAAyB;KAC7C;IACD,SAAS,EAAE;QACT,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,EAAE,EAAE,yBAAyB;KAC7C;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IACd,KAAK,CAAQ;IACb,MAAM,CAAkC;IAEhD,YAAY,KAAY,EAAE,SAA0C,mBAAmB;QACrF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,SAAiB;QAChD,gDAAgD;QAChD,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QAE/C,2CAA2C;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,2CAA2C,SAAS,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,GAAG,GAAG,aAAa,eAAe,IAAI,SAAS,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;QAE7C,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAEvC,yDAAyD;QACzD,wDAAwD;QACxD,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAEhC,+CAA+C;QAC/C,MAAM,WAAW,GAAG,GAAG,GAAG,QAAQ,CAAC;QACnC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QAE/C,mCAAmC;QACnC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEpB,yCAAyC;QACzC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,sCAAsC;QACtC,iDAAiD;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC;QAEtC,MAAM,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,WAAW,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,CAAC;QAE1D,2DAA2D;QAC3D,IAAI,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;YAC1E,IAAI,gBAAgB,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACjC,MAAM,UAAU,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,MAAM,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;gBACxC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO;YACP,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC;YAC7B,KAAK,EAAE,MAAM,CAAC,WAAW;SAC1B,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,SAAiB;QAChD,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,aAAa,eAAe,IAAI,SAAS,EAAE,CAAC;QACxD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,SAAiB;QAC9C,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,2CAA2C,SAAS,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,GAAG,GAAG,aAAa,eAAe,IAAI,SAAS,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;QAExD,mCAAmC;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,SAAiB,EAAE,MAAuB;QACjD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,SAAiB;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAY,EACZ,MAAwC;IAExC,OAAO,IAAI,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC"}

package/dist/utils/validation.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Input Validation Module
+ *
+ * Provides Zod schemas and validation functions for all MCP tool inputs
+ * and internal data types. Prevents injection attacks, DoS via oversized
+ * payloads, and data corruption.
+ *
+ * Security Features:
+ * - Length limits on all string inputs
+ * - Enum validation for controlled vocabularies
+ * - Vector value validation (NaN/Infinity prevention)
+ * - Collection name sanitization (injection prevention)
+ */
+import { z } from 'zod';
+/**
+ * Schema for store_memory tool input
+ *
+ * Enforces:
+ * - Content between 1 and 100,000 characters (100KB limit)
+ * - Memory type must be one of: episodic, semantic, procedural
+ * - Metadata object optional, max 50 keys
+ */
+export declare const StoreMemoryInputSchema: z.ZodObject<{
+    content: z.ZodString;
+    memory_type: z.ZodEnum<{
+        episodic: "episodic";
+        semantic: "semantic";
+        procedural: "procedural";
+    }>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type StoreMemoryInput = z.infer<typeof StoreMemoryInputSchema>;
+/**
+ * Schema for retrieve_memory tool input
+ *
+ * Enforces:
+ * - Query between 1 and 10,000 characters (10KB limit)
+ * - Memory types array max 10 items
+ * - Max results between 1 and 100
+ */
+export declare const RetrieveMemoryInputSchema: z.ZodObject<{
+    query: z.ZodString;
+    memory_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        episodic: "episodic";
+        semantic: "semantic";
+        procedural: "procedural";
+    }>>>;
+    max_results: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    routing_strategy: z.ZodOptional<z.ZodEnum<{
+        semantic: "semantic";
+        fast_path: "fast_path";
+        full_text: "full_text";
+        graph: "graph";
+    }>>;
+}, z.core.$strip>;
+export type RetrieveMemoryInput = z.infer<typeof RetrieveMemoryInputSchema>;
+/**
+ * Schema for list_recent tool input
+ */
+export declare const ListRecentInputSchema: z.ZodObject<{
+    limit: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    memory_type: z.ZodOptional<z.ZodEnum<{
+        episodic: "episodic";
+        semantic: "semantic";
+        procedural: "procedural";
+    }>>;
+}, z.core.$strip>;
+export type ListRecentInput = z.infer<typeof ListRecentInputSchema>;
+/**
+ * Schema for get_stats tool input
+ */
+export declare const GetStatsInputSchema: z.ZodObject<{
+    detailed: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, z.core.$strip>;
+export type GetStatsInput = z.infer<typeof GetStatsInputSchema>;
+/**
+ * Vector validation schema
+ *
+ * Validates that all vector elements are finite numbers.
+ * Prevents NaN poisoning attacks that corrupt vector indexes.
+ *
+ * Security: SEC-005 fix
+ */
+export declare const VectorSchema: z.ZodArray<z.ZodNumber>;
+/**
+ * Collection name validation schema
+ *
+ * Enforces alphanumeric names with underscores/hyphens only.
+ * Prevents injection attacks via malicious collection names.
+ *
+ * Security: SEC-012 fix
+ */
+export declare const CollectionNameSchema: z.ZodString;
+/**
+ * User ID schema (for rate limiting)
+ */
+export declare const UserIdSchema: z.ZodString;
+/**
+ * Validates input against a Zod schema and returns typed result
+ *
+ * @param schema - Zod schema to validate against
+ * @param input - Raw input to validate
+ * @returns Validated and typed data
+ * @throws McpError if validation fails
+ */
+export declare function validateInput<T>(schema: z.ZodSchema<T>, input: unknown): T;
+/**
+ * Validates a vector has correct dimensions and finite values
+ *
+ * @param vector - Vector to validate
+ * @param expectedSize - Expected vector dimension
+ * @returns true if valid
+ * @throws Error if invalid
+ */
+export declare function validateVector(vector: number[], expectedSize: number): void;
+/**
+ * Sanitizes a collection name to prevent injection attacks
+ *
+ * @param name - Collection name to sanitize
+ * @returns Sanitized collection name
+ * @throws Error if name is invalid
+ */
+export declare function sanitizeCollectionName(name: string): string;
+/**
+ * Sanitizes a string by removing potentially dangerous characters
+ *
+ * @param input - String to sanitize
+ * @returns Sanitized string
+ */
+export declare function sanitizeString(input: string): string;
+/**
+ * Validates a user ID for rate limiting
+ *
+ * @param userId - User ID to validate
+ * @returns Validated user ID
+ * @throws Error if invalid
+ */
+export declare function validateUserId(userId: string): string;
+//# sourceMappingURL=validation.d.ts.map

package/dist/utils/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/utils/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;iBAajC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;iBAkBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;iBAUhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;GAEG;AACH,eAAO,MAAM,mBAAmB;;iBAI9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,yBAItB,CAAC;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,aAM9B,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,YAAY,aAMtB,CAAC;AAMJ;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,CAAC,CAY1E;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAc3E;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS3D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQpD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQrD"}

package/dist/utils/validation.js

@@ -0,0 +1,195 @@
+/**
+ * Input Validation Module
+ *
+ * Provides Zod schemas and validation functions for all MCP tool inputs
+ * and internal data types. Prevents injection attacks, DoS via oversized
+ * payloads, and data corruption.
+ *
+ * Security Features:
+ * - Length limits on all string inputs
+ * - Enum validation for controlled vocabularies
+ * - Vector value validation (NaN/Infinity prevention)
+ * - Collection name sanitization (injection prevention)
+ */
+import { z } from 'zod';
+import { McpError, ErrorCode } from '@modelcontextprotocol/sdk/types.js';
+// ============================================================================
+// MCP Tool Input Schemas
+// ============================================================================
+/**
+ * Schema for store_memory tool input
+ *
+ * Enforces:
+ * - Content between 1 and 100,000 characters (100KB limit)
+ * - Memory type must be one of: episodic, semantic, procedural
+ * - Metadata object optional, max 50 keys
+ */
+export const StoreMemoryInputSchema = z.object({
+    content: z.string()
+        .min(1, "Content cannot be empty")
+        .max(100000, "Content exceeds 100KB limit"),
+    memory_type: z.enum(["episodic", "semantic", "procedural"], {
+        message: "Invalid memory type. Must be episodic, semantic, or procedural"
+    }),
+    metadata: z.record(z.string(), z.unknown())
+        .optional()
+        .refine((val) => !val || Object.keys(val).length <= 50, "Metadata cannot exceed 50 keys")
+        .refine((val) => !val || JSON.stringify(val).length <= 10000, "Metadata size exceeds 10KB limit"),
+});
+/**
+ * Schema for retrieve_memory tool input
+ *
+ * Enforces:
+ * - Query between 1 and 10,000 characters (10KB limit)
+ * - Memory types array max 10 items
+ * - Max results between 1 and 100
+ */
+export const RetrieveMemoryInputSchema = z.object({
+    query: z.string()
+        .min(1, "Query cannot be empty")
+        .max(10000, "Query exceeds 10KB limit"),
+    memory_types: z.array(z.enum(["episodic", "semantic", "procedural"]))
+        .max(10, "Cannot filter by more than 10 memory types")
+        .optional(),
+    max_results: z.number()
+        .int("max_results must be an integer")
+        .min(1, "max_results must be at least 1")
+        .max(100, "max_results cannot exceed 100")
+        .optional()
+        .default(5),
+    routing_strategy: z.enum(["fast_path", "semantic", "full_text", "graph"])
+        .optional(),
+});
+/**
+ * Schema for list_recent tool input
+ */
+export const ListRecentInputSchema = z.object({
+    limit: z.number()
+        .int("limit must be an integer")
+        .min(1, "limit must be at least 1")
+        .max(100, "limit cannot exceed 100")
+        .optional()
+        .default(5),
+    memory_type: z.enum(["episodic", "semantic", "procedural"])
+        .optional(),
+});
+/**
+ * Schema for get_stats tool input
+ */
+export const GetStatsInputSchema = z.object({
+    detailed: z.boolean()
+        .optional()
+        .default(false),
+});
+// ============================================================================
+// Internal Data Type Schemas
+// ============================================================================
+/**
+ * Vector validation schema
+ *
+ * Validates that all vector elements are finite numbers.
+ * Prevents NaN poisoning attacks that corrupt vector indexes.
+ *
+ * Security: SEC-005 fix
+ */
+export const VectorSchema = z.array(z.number())
+    .refine((arr) => arr.every(v => Number.isFinite(v)), { message: "Vector contains NaN or Infinity values" });
+/**
+ * Collection name validation schema
+ *
+ * Enforces alphanumeric names with underscores/hyphens only.
+ * Prevents injection attacks via malicious collection names.
+ *
+ * Security: SEC-012 fix
+ */
+export const CollectionNameSchema = z.string()
+    .min(1, "Collection name cannot be empty")
+    .max(255, "Collection name cannot exceed 255 characters")
+    .regex(/^[a-zA-Z][a-zA-Z0-9_-]*$/, "Collection name must start with a letter and contain only alphanumeric characters, underscores, or hyphens");
+/**
+ * User ID schema (for rate limiting)
+ */
+export const UserIdSchema = z.string()
+    .min(1, "User ID cannot be empty")
+    .max(255, "User ID cannot exceed 255 characters")
+    .regex(/^[a-zA-Z0-9_-]+$/, "User ID must be alphanumeric with underscores or hyphens only");
+// ============================================================================
+// Validation Helper Functions
+// ============================================================================
+/**
+ * Validates input against a Zod schema and returns typed result
+ *
+ * @param schema - Zod schema to validate against
+ * @param input - Raw input to validate
+ * @returns Validated and typed data
+ * @throws McpError if validation fails
+ */
+export function validateInput(schema, input) {
+    const result = schema.safeParse(input);
+    if (!result.success) {
+        const errors = result.error.issues.map(e => `${e.path.join('.')}: ${e.message}`).join(', ');
+        throw new McpError(ErrorCode.InvalidParams, `Validation failed: ${errors}`);
+    }
+    return result.data;
+}
+/**
+ * Validates a vector has correct dimensions and finite values
+ *
+ * @param vector - Vector to validate
+ * @param expectedSize - Expected vector dimension
+ * @returns true if valid
+ * @throws Error if invalid
+ */
+export function validateVector(vector, expectedSize) {
+    // Dimension check
+    if (vector.length !== expectedSize) {
+        throw new Error(`Vector dimension mismatch: expected ${expectedSize}, got ${vector.length}`);
+    }
+    // Value validation (NaN/Infinity check)
+    if (!vector.every(v => Number.isFinite(v))) {
+        throw new Error("Vector contains invalid values (NaN or Infinity)");
+    }
+}
+/**
+ * Sanitizes a collection name to prevent injection attacks
+ *
+ * @param name - Collection name to sanitize
+ * @returns Sanitized collection name
+ * @throws Error if name is invalid
+ */
+export function sanitizeCollectionName(name) {
+    const result = CollectionNameSchema.safeParse(name);
+    if (!result.success) {
+        const error = result.error.issues[0];
+        throw new Error(`Invalid collection name: ${error.message}`);
+    }
+    return result.data;
+}
+/**
+ * Sanitizes a string by removing potentially dangerous characters
+ *
+ * @param input - String to sanitize
+ * @returns Sanitized string
+ */
+export function sanitizeString(input) {
+    // Remove null bytes
+    let sanitized = input.replace(/\0/g, '');
+    // Trim whitespace
+    sanitized = sanitized.trim();
+    return sanitized;
+}
+/**
+ * Validates a user ID for rate limiting
+ *
+ * @param userId - User ID to validate
+ * @returns Validated user ID
+ * @throws Error if invalid
+ */
+export function validateUserId(userId) {
+    const result = UserIdSchema.safeParse(userId);
+    if (!result.success) {
+        throw new Error("Invalid user ID format");
+    }
+    return result.data;
+}
+//# sourceMappingURL=validation.js.map

package/dist/utils/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/utils/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAEzE,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC;SACjC,GAAG,CAAC,MAAM,EAAE,6BAA6B,CAAC;IAE7C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE;QAC1D,OAAO,EAAE,gEAAgE;KAC1E,CAAC;IAEF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SACxC,QAAQ,EAAE;SACV,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,gCAAgC,CAAC;SACxF,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,KAAK,EAAE,kCAAkC,CAAC;CACpG,CAAC,CAAC;AAIH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;SACd,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;SAC/B,GAAG,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAEzC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;SAClE,GAAG,CAAC,EAAE,EAAE,4CAA4C,CAAC;SACrD,QAAQ,EAAE;IAEb,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;SACpB,GAAG,CAAC,gCAAgC,CAAC;SACrC,GAAG,CAAC,CAAC,EAAE,gCAAgC,CAAC;SACxC,GAAG,CAAC,GAAG,EAAE,+BAA+B,CAAC;SACzC,QAAQ,EAAE;SACV,OAAO,CAAC,CAAC,CAAC;IAEb,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;SACtE,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;SACd,GAAG,CAAC,0BAA0B,CAAC;SAC/B,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC;SAClC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC;SACnC,QAAQ,EAAE;SACV,OAAO,CAAC,CAAC,CAAC;IAEb,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;SACxD,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;SAClB,QAAQ,EAAE;SACV,OAAO,CAAC,KAAK,CAAC;CAClB,CAAC,CAAC;AAIH,+EAA+E;AAC/E,6BAA6B;AAC7B,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC5C,MAAM,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAC3C,EAAE,OAAO,EAAE,wCAAwC,EAAE,CACtD,CAAC;AAEJ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE;KAC3C,GAAG,CAAC,CAAC,EAAE,iCAAiC,CAAC;KACzC,GAAG,CAAC,GAAG,EAAE,8CAA8C,CAAC;KACxD,KAAK,CACJ,0BAA0B,EAC1B,4GAA4G,CAC7G,CAAC;AAEJ;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE;KACnC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC;KACjC,GAAG,CAAC,GAAG,EAAE,sCAAsC,CAAC;KAChD,KAAK,CACJ,kBAAkB,EAClB,+DAA+D,CAChE,CAAC;AAEJ,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAI,MAAsB,EAAE,KAAc;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAEvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5F,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,aAAa,EACvB,sBAAsB,MAAM,EAAE,CAC/B,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,MAAgB,EAAE,YAAoB;IACnE,kBAAkB;IAClB,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,uCAAuC,YAAY,SAAS,MAAM,CAAC,MAAM,EAAE,CAC5E,CAAC;IACJ,CAAC;IAED,wCAAwC;IACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,kDAAkD,CACnD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAEpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,oBAAoB;IACpB,IAAI,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEzC,kBAAkB;IAClB,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAE7B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAE9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/utils 2/monitoring.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Monitoring & Logging - v3.0
+ *
+ * Track latency, accuracy, cache hit rates.
+ */
+export interface PerformanceMetrics {
+    p50: number;
+    p95: number;
+    p99: number;
+}
+export declare class PerformanceMonitor {
+    private latencies;
+    private cacheHits;
+    private cacheMisses;
+    recordLatency(ms: number): void;
+    recordCacheHit(): void;
+    recordCacheMiss(): void;
+    getMetrics(): {
+        latency: PerformanceMetrics;
+        cacheHitRate: number;
+        totalRequests: number;
+    };
+    reset(): void;
+}
+//# sourceMappingURL=monitoring.d.ts.map

package/dist/utils 2/monitoring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitoring.d.ts","sourceRoot":"","sources":["../../src/utils/monitoring.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,SAAS,CAAa;IAC9B,OAAO,CAAC,WAAW,CAAa;IAEhC,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAO/B,cAAc,IAAI,IAAI;IAItB,eAAe,IAAI,IAAI;IAIvB,UAAU,IAAI;QACZ,OAAO,EAAE,kBAAkB,CAAC;QAC5B,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;KACvB;IAgBD,KAAK,IAAI,IAAI;CAKd"}

package/dist/utils 2/monitoring.js

@@ -0,0 +1,41 @@
+/**
+ * Monitoring & Logging - v3.0
+ *
+ * Track latency, accuracy, cache hit rates.
+ */
+export class PerformanceMonitor {
+    latencies = [];
+    cacheHits = 0;
+    cacheMisses = 0;
+    recordLatency(ms) {
+        this.latencies.push(ms);
+        if (this.latencies.length > 1000) {
+            this.latencies.shift();
+        }
+    }
+    recordCacheHit() {
+        this.cacheHits++;
+    }
+    recordCacheMiss() {
+        this.cacheMisses++;
+    }
+    getMetrics() {
+        const sorted = [...this.latencies].sort((a, b) => a - b);
+        const p50 = sorted[Math.floor(sorted.length * 0.5)] || 0;
+        const p95 = sorted[Math.floor(sorted.length * 0.95)] || 0;
+        const p99 = sorted[Math.floor(sorted.length * 0.99)] || 0;
+        const total = this.cacheHits + this.cacheMisses;
+        const hitRate = total > 0 ? this.cacheHits / total : 0;
+        return {
+            latency: { p50, p95, p99 },
+            cacheHitRate: hitRate,
+            totalRequests: this.latencies.length,
+        };
+    }
+    reset() {
+        this.latencies = [];
+        this.cacheHits = 0;
+        this.cacheMisses = 0;
+    }
+}
+//# sourceMappingURL=monitoring.js.map

package/dist/utils 2/monitoring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitoring.js","sourceRoot":"","sources":["../../src/utils/monitoring.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,MAAM,OAAO,kBAAkB;IACrB,SAAS,GAAa,EAAE,CAAC;IACzB,SAAS,GAAW,CAAC,CAAC;IACtB,WAAW,GAAW,CAAC,CAAC;IAEhC,aAAa,CAAC,EAAU;QACtB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,cAAc;QACZ,IAAI,CAAC,SAAS,EAAE,CAAC;IACnB,CAAC;IAED,eAAe;QACb,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAED,UAAU;QAKR,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAE1D,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvD,OAAO;YACL,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC1B,YAAY,EAAE,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;SACrC,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;IACvB,CAAC;CACF"}