velesdb_memory/
limits.rs

1//! Resource caps shared by every adapter (the MCP server and the language
2//! bindings).
3//!
4//! These are security-relevant DoS limits. They live here — not inside any one
5//! adapter — so every transport enforces the *same* numbers without a manual
6//! "keep in sync" comment, and so a build without the `mcp` feature still sees
7//! them. Each adapter formats its own transport-native error; only the values
8//! and the clamping policy are shared.
9
10/// Default hop budget for `why` traversal when the caller supplies none.
11pub const DEFAULT_WHY_HOPS: usize = 2;
12
13/// Maximum accepted fact size (1 MiB) — prevents allocating huge embeddings.
14pub const MAX_FACT_BYTES: usize = 1_048_576;
15
16/// Cap on a `recall` limit — prevents unbounded vector scans (core does not
17/// cap `k`, so the adapters do).
18pub const MAX_RECALL_LIMIT: usize = 1_000;
19
20/// Cap on `why` hop depth — prevents exponential graph fan-out.
21pub const MAX_WHY_HOPS: usize = 10;
22
23/// Maximum accepted size of a single context-compiler fragment (1 MiB, the
24/// same ceiling as [`MAX_FACT_BYTES`]) — prevents a single fragment from
25/// forcing huge allocations in the compile pipeline.
26pub const MAX_FRAGMENT_BYTES: usize = 1_048_576;
27
28/// Cap on the number of fragments in one compile request — bounds the work a
29/// single call can demand across every adapter.
30pub const MAX_FRAGMENTS: usize = 1_024;
31
32/// Cap on a caller-supplied token budget. A budget cannot force allocations
33/// by itself, but an absurd value would make the savings arithmetic
34/// meaningless, so adapters clamp to this ceiling instead of erroring.
35pub const MAX_TOKEN_BUDGET: u64 = 10_000_000;
36
37/// Clamp a caller-supplied token budget to [`MAX_TOKEN_BUDGET`].
38#[must_use]
39pub fn clamp_token_budget(budget: u64) -> u64 {
40    budget.min(MAX_TOKEN_BUDGET)
41}
42
43/// Clamp a caller-supplied recall limit to [`MAX_RECALL_LIMIT`].
44#[must_use]
45pub fn clamp_recall_limit(k: usize) -> usize {
46    k.min(MAX_RECALL_LIMIT)
47}
48
49/// Clamp a caller-supplied `why` hop budget to [`MAX_WHY_HOPS`].
50#[must_use]
51pub fn clamp_hops(hops: usize) -> usize {
52    hops.min(MAX_WHY_HOPS)
53}
velesdb_memory/limits.rs

velesdb_memory/
limits.rs
