velesdb_memory/
limits.rs

1//! Resource caps shared by every adapter (the MCP server and the language
2//! bindings).
3//!
4//! These are security-relevant DoS limits. They live here — not inside any one
5//! adapter — so every transport enforces the *same* numbers without a manual
6//! "keep in sync" comment, and so a build without the `mcp` feature still sees
7//! them. Each adapter formats its own transport-native error; only the values
8//! and the clamping policy are shared.
9
10/// Default hop budget for `why` traversal when the caller supplies none.
11pub const DEFAULT_WHY_HOPS: usize = 2;
12
13/// Maximum accepted fact size (1 MiB) — prevents allocating huge embeddings.
14pub const MAX_FACT_BYTES: usize = 1_048_576;
15
16/// Cap on a `recall` limit — prevents unbounded vector scans (core does not
17/// cap `k`, so the adapters do).
18pub const MAX_RECALL_LIMIT: usize = 1_000;
19
20/// Cap on `why` hop depth — prevents exponential graph fan-out.
21pub const MAX_WHY_HOPS: usize = 10;
22
23/// Clamp a caller-supplied recall limit to [`MAX_RECALL_LIMIT`].
24#[must_use]
25pub fn clamp_recall_limit(k: usize) -> usize {
26    k.min(MAX_RECALL_LIMIT)
27}
28
29/// Clamp a caller-supplied `why` hop budget to [`MAX_WHY_HOPS`].
30#[must_use]
31pub fn clamp_hops(hops: usize) -> usize {
32    hops.min(MAX_WHY_HOPS)
33}
velesdb_memory/limits.rs

velesdb_memory/
limits.rs
