From a1fd5b0d126bb5982aa487728c1de8d7b5f7132c Mon Sep 17 00:00:00 2001
From: PJ <ipriyanshujain@gmail.com>
Date: Fri, 22 Aug 2025 20:55:51 +0530
Subject: [PATCH 1/3] input validation

---
 src/sync/hash-sync-engine.ts             |  61 ++-
 src/sync/sync-record-validator.ts        | 508 ++++++++++++++++++++
 tests/hash-sync-engine.test.ts           |  32 +-
 tests/sync/sync-record-validator.test.ts | 586 +++++++++++++++++++++++
 4 files changed, 1155 insertions(+), 32 deletions(-)
 create mode 100644 src/sync/sync-record-validator.ts
 create mode 100644 tests/sync/sync-record-validator.test.ts

diff --git a/src/sync/hash-sync-engine.ts b/src/sync/hash-sync-engine.ts
index f9a1f53..5fd6ef2 100644
--- a/src/sync/hash-sync-engine.ts
+++ b/src/sync/hash-sync-engine.ts
@@ -2,6 +2,7 @@ import { IndexedDBStore } from '../storage/indexed-db-store';
 import { IndexedBaseModel } from '../models/indexed-base-model';
 import { ModelRegistry, ModelMetadata } from '../model-registry';
 import { SchemaHasher } from '../hash';
+import { SyncRecordValidator } from './sync-record-validator';
 import { makeObservable, observable, action, computed } from 'mobx';
 
 /**
@@ -174,13 +175,23 @@ export class HashSyncEngine {
       hash: await this.hashData(record.data),
     };
 
+    // Validate before queuing
+    const validation = SyncRecordValidator.validate(syncRecord);
+    if (!validation.isValid) {
+      console.error('Attempting to queue invalid sync record:', validation.errors);
+      throw new Error(`Cannot queue invalid sync record: ${validation.errors[0]?.message}`);
+    }
+
+    // Sanitize before storing
+    const sanitizedRecord = SyncRecordValidator.sanitize(syncRecord);
+
     // Store the sync record directly, bypassing the normal model sync queue
     await this.store.put('_sync', {
-      id: syncRecord.id,
-      modelName: record.modelName,
-      modelId: record.modelId, 
-      operation: record.operation,
-      data: syncRecord, // Store the complete sync record
+      id: sanitizedRecord.id,
+      modelName: sanitizedRecord.modelName,
+      modelId: sanitizedRecord.modelId, 
+      operation: sanitizedRecord.operation,
+      data: sanitizedRecord, // Store the complete sync record
       status: 'pending',
       createdAt: Date.now(),
       syncId: null
@@ -419,20 +430,30 @@ export class HashSyncEngine {
 
   private async applyRemoteRecord(record: SyncRecord): Promise<void> {
     try {
-      const ModelClass = ModelRegistry.getModel(record.modelName);
+      // Validate the record first for security
+      const validation = SyncRecordValidator.validate(record);
+      if (!validation.isValid) {
+        console.error('Invalid sync record received:', validation.errors);
+        throw new Error(`Invalid sync record: ${validation.errors[0]?.message}`);
+      }
+      
+      // Sanitize the record to remove any potentially dangerous content
+      const sanitizedRecord = SyncRecordValidator.sanitize(record);
+      
+      const ModelClass = ModelRegistry.getModel(sanitizedRecord.modelName);
       if (!ModelClass) {
-        console.warn(`Unknown model type: ${record.modelName}`);
+        console.warn(`Unknown model type: ${sanitizedRecord.modelName}`);
         return;
       }
 
-      switch (record.operation) {
+      switch (sanitizedRecord.operation) {
         case 'create':
         case 'update':
           // Check for conflicts
-          const existing = await (ModelClass as any).load(record.modelId);
-          if (existing && existing._version >= record.version) {
+          const existing = await (ModelClass as any).load(sanitizedRecord.modelId);
+          if (existing && existing._version >= sanitizedRecord.version) {
             // Local version is newer or equal, apply conflict resolution
-            const resolvedData = await this.resolveConflict(existing, record);
+            const resolvedData = await this.resolveConflict(existing, sanitizedRecord);
             if (resolvedData) {
               if (typeof existing.update === 'function') {
                 existing.update(resolvedData);
@@ -445,31 +466,31 @@ export class HashSyncEngine {
             // Remote version is newer, apply directly
             if (existing) {
               if (typeof existing.update === 'function') {
-                existing.update(record.data);
+                existing.update(sanitizedRecord.data);
               } else {
-                Object.assign(existing, record.data);
+                Object.assign(existing, sanitizedRecord.data);
               }
-              existing._version = record.version;
+              existing._version = sanitizedRecord.version;
               await existing.save();
             } else {
               // For create operations, we need to store directly in IndexedDB
               // since we can't instantiate abstract classes
-              await this.store.put(record.modelName, {
-                ...record.data,
-                id: record.modelId,
-                _version: record.version,
+              await this.store.put(sanitizedRecord.modelName, {
+                ...sanitizedRecord.data,
+                id: sanitizedRecord.modelId,
+                _version: sanitizedRecord.version,
               });
             }
           }
           break;
           
         case 'delete':
-          const modelToDelete = await (ModelClass as any).load(record.modelId);
+          const modelToDelete = await (ModelClass as any).load(sanitizedRecord.modelId);
           if (modelToDelete) {
             await modelToDelete.delete();
           } else {
             // If model instance doesn't exist, delete directly from store
-            await this.store.delete(record.modelName, record.modelId);
+            await this.store.delete(sanitizedRecord.modelName, sanitizedRecord.modelId);
           }
           break;
       }
diff --git a/src/sync/sync-record-validator.ts b/src/sync/sync-record-validator.ts
new file mode 100644
index 0000000..ea54c75
--- /dev/null
+++ b/src/sync/sync-record-validator.ts
@@ -0,0 +1,508 @@
+import { SyncRecord, SyncOperation } from './hash-sync-engine';
+import { ModelRegistry } from '../model-registry';
+
+export interface ValidationError {
+  field: string;
+  message: string;
+  value?: any;
+}
+
+export interface ValidationResult {
+  isValid: boolean;
+  errors: ValidationError[];
+}
+
+/**
+ * Validates sync records to prevent security vulnerabilities and data corruption
+ */
+export class SyncRecordValidator {
+  private static readonly MAX_STRING_LENGTH = 10000;
+  private static readonly MAX_OBJECT_DEPTH = 10;
+  private static readonly MAX_ARRAY_LENGTH = 1000;
+  private static readonly VALID_OPERATIONS: SyncOperation[] = ['create', 'update', 'delete'];
+  
+  /**
+   * Validates a sync record completely
+   */
+  static validate(record: any): ValidationResult {
+    const errors: ValidationError[] = [];
+    
+    // Check if record exists
+    if (!record || typeof record !== 'object') {
+      return {
+        isValid: false,
+        errors: [{ field: 'record', message: 'Record must be a valid object' }]
+      };
+    }
+    
+    // Validate required fields
+    this.validateRequiredFields(record, errors);
+    
+    // Validate field types and values
+    this.validateFieldTypes(record, errors);
+    
+    // Validate operation-specific requirements
+    this.validateOperationRequirements(record, errors);
+    
+    // Validate data payload
+    if (record.data) {
+      this.validateDataPayload(record.data, errors, 'data');
+    }
+    
+    // Check for potentially malicious content
+    this.validateSecurityConstraints(record, errors);
+    
+    return {
+      isValid: errors.length === 0,
+      errors
+    };
+  }
+  
+  /**
+   * Validates required fields are present
+   */
+  private static validateRequiredFields(record: any, errors: ValidationError[]): void {
+    const requiredFields = ['id', 'modelName', 'modelId', 'operation', 'version', 'timestamp', 'clientId', 'hash'];
+    
+    for (const field of requiredFields) {
+      if (record[field] === undefined || record[field] === null) {
+        errors.push({
+          field,
+          message: `Required field '${field}' is missing`,
+          value: record[field]
+        });
+      }
+    }
+  }
+  
+  /**
+   * Validates field types and basic constraints
+   */
+  private static validateFieldTypes(record: any, errors: ValidationError[]): void {
+    // Validate ID fields are strings
+    const stringFields = ['id', 'modelName', 'modelId', 'clientId', 'hash'];
+    for (const field of stringFields) {
+      if (record[field] !== undefined && typeof record[field] !== 'string') {
+        errors.push({
+          field,
+          message: `Field '${field}' must be a string`,
+          value: record[field]
+        });
+      } else if (record[field] && record[field].length > this.MAX_STRING_LENGTH) {
+        errors.push({
+          field,
+          message: `Field '${field}' exceeds maximum length of ${this.MAX_STRING_LENGTH}`,
+          value: record[field]?.substring(0, 100) + '...'
+        });
+      }
+    }
+    
+    // Validate version is a positive number
+    if (record.version !== undefined) {
+      if (typeof record.version !== 'number' || record.version < 0) {
+        errors.push({
+          field: 'version',
+          message: 'Version must be a non-negative number',
+          value: record.version
+        });
+      }
+    }
+    
+    // Validate timestamp
+    if (record.timestamp !== undefined) {
+      if (typeof record.timestamp !== 'number' || record.timestamp < 0) {
+        errors.push({
+          field: 'timestamp',
+          message: 'Timestamp must be a valid positive number',
+          value: record.timestamp
+        });
+      }
+      
+      // Check if timestamp is reasonable (not too far in past or future)
+      const now = Date.now();
+      const oneYearMs = 365 * 24 * 60 * 60 * 1000;
+      if (Math.abs(record.timestamp - now) > oneYearMs) {
+        errors.push({
+          field: 'timestamp',
+          message: 'Timestamp is unreasonably far from current time',
+          value: new Date(record.timestamp).toISOString()
+        });
+      }
+    }
+    
+    // Validate operation
+    if (record.operation && !this.VALID_OPERATIONS.includes(record.operation)) {
+      errors.push({
+        field: 'operation',
+        message: `Operation must be one of: ${this.VALID_OPERATIONS.join(', ')}`,
+        value: record.operation
+      });
+    }
+  }
+  
+  /**
+   * Validates operation-specific requirements
+   */
+  private static validateOperationRequirements(record: any, errors: ValidationError[]): void {
+    if (!record.operation) return;
+    
+    switch (record.operation) {
+      case 'create':
+      case 'update':
+        if (!record.data || typeof record.data !== 'object') {
+          errors.push({
+            field: 'data',
+            message: `Operation '${record.operation}' requires data payload`,
+            value: record.data
+          });
+        }
+        break;
+        
+      case 'delete':
+        // Delete operations may or may not have data
+        break;
+        
+      default:
+        // Already validated in validateFieldTypes
+        break;
+    }
+    
+    // Validate model exists in registry
+    if (record.modelName) {
+      const model = ModelRegistry.getModel(record.modelName);
+      if (!model) {
+        errors.push({
+          field: 'modelName',
+          message: `Unknown model type: ${record.modelName}`,
+          value: record.modelName
+        });
+      }
+    }
+  }
+  
+  /**
+   * Recursively validates data payload for security issues
+   */
+  private static validateDataPayload(
+    data: any,
+    errors: ValidationError[],
+    path: string,
+    depth: number = 0
+  ): void {
+    // Check depth to prevent deeply nested objects
+    if (depth > this.MAX_OBJECT_DEPTH) {
+      errors.push({
+        field: path,
+        message: `Object nesting exceeds maximum depth of ${this.MAX_OBJECT_DEPTH}`,
+        value: 'Object too deep'
+      });
+      return;
+    }
+    
+    // Handle null/undefined
+    if (data === null || data === undefined) {
+      return;
+    }
+    
+    // Handle arrays
+    if (Array.isArray(data)) {
+      if (data.length > this.MAX_ARRAY_LENGTH) {
+        errors.push({
+          field: path,
+          message: `Array exceeds maximum length of ${this.MAX_ARRAY_LENGTH}`,
+          value: `Array length: ${data.length}`
+        });
+        return;
+      }
+      
+      data.forEach((item, index) => {
+        this.validateDataPayload(item, errors, `${path}[${index}]`, depth + 1);
+      });
+      return;
+    }
+    
+    // Handle objects
+    if (typeof data === 'object') {
+      const keys = Object.keys(data);
+      
+      // Check for too many keys
+      if (keys.length > 1000) {
+        errors.push({
+          field: path,
+          message: 'Object has too many properties (max 1000)',
+          value: `Property count: ${keys.length}`
+        });
+        return;
+      }
+      
+      // Recursively validate each property
+      for (const key of keys) {
+        // Check for prototype pollution attempts
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+          errors.push({
+            field: `${path}.${key}`,
+            message: 'Potentially malicious property name detected',
+            value: key
+          });
+          continue;
+        }
+        
+        // Validate key length
+        if (key.length > 255) {
+          errors.push({
+            field: `${path}.${key}`,
+            message: 'Property name exceeds maximum length of 255',
+            value: key.substring(0, 50) + '...'
+          });
+          continue;
+        }
+        
+        this.validateDataPayload(data[key], errors, `${path}.${key}`, depth + 1);
+      }
+      return;
+    }
+    
+    // Handle primitives
+    if (typeof data === 'string') {
+      if (data.length > this.MAX_STRING_LENGTH) {
+        errors.push({
+          field: path,
+          message: `String exceeds maximum length of ${this.MAX_STRING_LENGTH}`,
+          value: data.substring(0, 100) + '...'
+        });
+      }
+      
+      // Check for potential script injection
+      if (this.containsScriptTags(data)) {
+        errors.push({
+          field: path,
+          message: 'String contains potentially malicious script tags',
+          value: data.substring(0, 100)
+        });
+      }
+    }
+    
+    // Numbers should be finite
+    if (typeof data === 'number' && !isFinite(data)) {
+      errors.push({
+        field: path,
+        message: 'Number must be finite',
+        value: data
+      });
+    }
+  }
+  
+  /**
+   * Validates security constraints
+   */
+  private static validateSecurityConstraints(record: any, errors: ValidationError[]): void {
+    // Check for SQL injection patterns in string fields
+    const stringFields = ['id', 'modelName', 'modelId', 'clientId'];
+    for (const field of stringFields) {
+      if (record[field] && this.containsSqlInjectionPattern(record[field])) {
+        errors.push({
+          field,
+          message: 'Field contains potentially malicious SQL patterns',
+          value: record[field]
+        });
+      }
+    }
+    
+    // Validate hash format (should be hexadecimal)
+    if (record.hash && !/^[a-f0-9]+$/i.test(record.hash)) {
+      errors.push({
+        field: 'hash',
+        message: 'Hash must be a valid hexadecimal string',
+        value: record.hash
+      });
+    }
+    
+    // Check total size of record
+    const recordSize = JSON.stringify(record).length;
+    if (recordSize > 1024 * 1024) { // 1MB limit
+      errors.push({
+        field: 'record',
+        message: 'Record size exceeds 1MB limit',
+        value: `Size: ${recordSize} bytes`
+      });
+    }
+  }
+  
+  /**
+   * Checks for script tags in strings
+   */
+  private static containsScriptTags(value: string): boolean {
+    const scriptPatterns = [
+      /<script[\s>]/i,
+      /<\/script>/i,
+      /javascript:/i,
+      /on\w+\s*=/i, // Event handlers like onclick=
+      /<iframe[\s>]/i,
+      /<embed[\s>]/i,
+      /<object[\s>]/i
+    ];
+    
+    return scriptPatterns.some(pattern => pattern.test(value));
+  }
+  
+  /**
+   * Checks for SQL injection patterns
+   */
+  private static containsSqlInjectionPattern(value: string): boolean {
+    const sqlPatterns = [
+      /(\b(DELETE|DROP|EXEC(UTE)?|INSERT|SELECT|UNION|UPDATE)\b)/i,
+      /(--|\||;|\/\*|\*\/)/,
+      /(\bOR\b\s*\d+\s*=\s*\d+)/i,
+      /(\bAND\b\s*\d+\s*=\s*\d+)/i,
+      /(\'|\")(\s*)(OR|AND)(\s*)(\d+|\'|\")(\s*)=/i
+    ];
+    
+    return sqlPatterns.some(pattern => pattern.test(value));
+  }
+  
+  /**
+   * Sanitizes a record by removing or escaping potentially dangerous content
+   * Returns a new sanitized copy, doesn't modify the original
+   */
+  static sanitize(record: SyncRecord): SyncRecord {
+    // Use a custom deep clone that properly handles special values
+    const sanitized = this.deepClone(record);
+    
+    // Sanitize string fields
+    const stringFields = ['id', 'modelName', 'modelId', 'clientId', 'hash'];
+    for (const field of stringFields) {
+      if (sanitized[field] && typeof sanitized[field] === 'string') {
+        sanitized[field] = this.sanitizeString(sanitized[field]);
+      }
+    }
+    
+    // Recursively sanitize data payload
+    if (sanitized.data) {
+      sanitized.data = this.sanitizeData(sanitized.data);
+    }
+    
+    return sanitized;
+  }
+  
+  /**
+   * Deep clones an object while handling special values
+   */
+  private static deepClone(obj: any): any {
+    if (obj === null || obj === undefined) {
+      return obj;
+    }
+    
+    if (obj instanceof Date) {
+      return new Date(obj.getTime());
+    }
+    
+    if (Array.isArray(obj)) {
+      return obj.map(item => this.deepClone(item));
+    }
+    
+    if (typeof obj === 'object') {
+      const cloned: any = {};
+      for (const key in obj) {
+        if (obj.hasOwnProperty(key)) {
+          // Skip dangerous property names during cloning
+          if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+            continue;
+          }
+          cloned[key] = this.deepClone(obj[key]);
+        }
+      }
+      return cloned;
+    }
+    
+    // Handle special number values
+    if (typeof obj === 'number') {
+      if (!isFinite(obj)) {
+        return 0; // Replace Infinity/NaN with 0
+      }
+    }
+    
+    return obj;
+  }
+  
+  /**
+   * Sanitizes a string value
+   */
+  private static sanitizeString(value: string): string {
+    // Remove any HTML/script tags
+    let sanitized = value.replace(/<[^>]*>/g, '');
+    
+    // For SQL keywords, only remove them if they appear as standalone commands
+    // Don't remove them from normal text like "Update" in "Remote Update"
+    sanitized = sanitized.replace(/;\s*(DELETE|DROP|EXEC(UTE)?|INSERT|SELECT|UNION|UPDATE)\s+/gi, '; ');
+    
+    // Remove script-related patterns
+    sanitized = sanitized.replace(/javascript:/gi, '');
+    sanitized = sanitized.replace(/on\w+\s*=/gi, '');
+    
+    // Escape HTML special characters
+    sanitized = sanitized
+      .replace(/&/g, '&amp;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/"/g, '&quot;')
+      .replace(/'/g, '&#x27;')
+      .replace(/\//g, '&#x2F;');
+    
+    // Truncate if too long
+    if (sanitized.length > this.MAX_STRING_LENGTH) {
+      sanitized = sanitized.substring(0, this.MAX_STRING_LENGTH);
+    }
+    
+    return sanitized;
+  }
+  
+  /**
+   * Recursively sanitizes data objects
+   */
+  private static sanitizeData(data: any, depth: number = 0): any {
+    if (depth > this.MAX_OBJECT_DEPTH) {
+      return null; // Truncate deeply nested objects
+    }
+    
+    if (data === null || data === undefined) {
+      return data;
+    }
+    
+    if (Array.isArray(data)) {
+      return data
+        .slice(0, this.MAX_ARRAY_LENGTH)
+        .map(item => this.sanitizeData(item, depth + 1));
+    }
+    
+    if (typeof data === 'object') {
+      const sanitized: any = {};
+      const keys = Object.keys(data).slice(0, 1000);
+      
+      for (const key of keys) {
+        // Skip dangerous property names entirely, don't add them to sanitized
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+          continue;
+        }
+        
+        const sanitizedKey = key.length > 255 ? key.substring(0, 255) : key;
+        sanitized[sanitizedKey] = this.sanitizeData(data[key], depth + 1);
+      }
+      
+      return sanitized;
+    }
+    
+    if (typeof data === 'string') {
+      return this.sanitizeString(data);
+    }
+    
+    if (typeof data === 'number') {
+      // Replace Infinity/NaN with 0
+      if (!isFinite(data)) {
+        return 0;
+      }
+      return data;
+    }
+    
+    return data;
+  }
+}
\ No newline at end of file
diff --git a/tests/hash-sync-engine.test.ts b/tests/hash-sync-engine.test.ts
index 7b5af4a..5af0658 100644
--- a/tests/hash-sync-engine.test.ts
+++ b/tests/hash-sync-engine.test.ts
@@ -260,7 +260,7 @@ describe('HashSyncEngine', () => {
         version: 2,
         timestamp: Date.now() + 1000, // Newer
         clientId: 'remote-client',
-        hash: 'remote-hash',
+        hash: 'abc123def456789', // Valid hex hash
       };
 
       // Apply remote record (this would normally be done through WebSocket)
@@ -288,7 +288,7 @@ describe('HashSyncEngine', () => {
         version: 2, // Lower version
         timestamp: Date.now() - 1000, // Older
         clientId: 'remote-client',
-        hash: 'remote-hash',
+        hash: 'fedcba987654321', // Valid hex hash
       };
 
       // Apply remote record
@@ -391,7 +391,7 @@ describe('HashSyncEngine', () => {
         version: 1,
         timestamp: Date.now(),
         clientId: 'test-client',
-        hash: 'test-hash',
+        hash: '1234567890abcdef', // Valid hex hash
       };
 
       // Verify record has all required fields
@@ -466,20 +466,28 @@ describe('HashSyncEngine Edge Cases', () => {
       version: 1,
       timestamp: Date.now(),
       clientId: 'test-client',
-      hash: 'test-hash',
+      hash: 'abcdef1234567890', // Valid hex hash
     };
 
-    // Suppress expected console.warn for this test
-    const consoleSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
+    // Suppress expected console output for this test
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
 
-    // Should not throw error
-    await expect((syncEngine as any).applyRemoteRecord(invalidRecord)).resolves.toBeUndefined();
+    // Should handle the error gracefully without throwing (caught internally)
+    await (syncEngine as any).applyRemoteRecord(invalidRecord);
     
-    // Verify the warning was called
-    expect(consoleSpy).toHaveBeenCalledWith('Unknown model type: NonExistentModel');
+    // Verify the error was logged
+    expect(consoleErrorSpy).toHaveBeenCalledWith(
+      expect.stringContaining('Invalid sync record received:'),
+      expect.arrayContaining([
+        expect.objectContaining({
+          field: 'modelName',
+          message: expect.stringContaining('Unknown model type')
+        })
+      ])
+    );
     
-    // Restore console.warn
-    consoleSpy.mockRestore();
+    // Restore console
+    consoleErrorSpy.mockRestore();
   });
 
   test('handles sync engine without WebSocket connection', () => {
diff --git a/tests/sync/sync-record-validator.test.ts b/tests/sync/sync-record-validator.test.ts
new file mode 100644
index 0000000..d97e981
--- /dev/null
+++ b/tests/sync/sync-record-validator.test.ts
@@ -0,0 +1,586 @@
+import { SyncRecordValidator } from '../../src/sync/sync-record-validator';
+import { SyncRecord } from '../../src/sync/hash-sync-engine';
+import { ModelRegistry } from '../../src/model-registry';
+
+// Mock ModelRegistry
+jest.mock('../../src/model-registry', () => ({
+  ModelRegistry: {
+    getModel: jest.fn()
+  }
+}));
+
+describe('SyncRecordValidator', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    (ModelRegistry.getModel as jest.Mock).mockReturnValue({}); // Model exists by default
+  });
+
+  describe('validate', () => {
+    const validRecord: SyncRecord = {
+      id: 'sync_123',
+      modelName: 'TestModel',
+      modelId: 'model_123',
+      operation: 'create',
+      data: { name: 'Test', value: 123 },
+      version: 1,
+      timestamp: Date.now(),
+      clientId: 'client_123',
+      hash: 'abc123def456'
+    };
+
+    describe('valid records', () => {
+      test('validates a completely valid record', () => {
+        const result = SyncRecordValidator.validate(validRecord);
+        
+        expect(result.isValid).toBe(true);
+        expect(result.errors).toHaveLength(0);
+      });
+
+      test('validates update operation', () => {
+        const record = { ...validRecord, operation: 'update' as const };
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(true);
+        expect(result.errors).toHaveLength(0);
+      });
+
+      test('validates delete operation without data', () => {
+        const record = { ...validRecord, operation: 'delete' as const, data: undefined };
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(true);
+        expect(result.errors).toHaveLength(0);
+      });
+
+      test('validates nested data structures', () => {
+        const record = {
+          ...validRecord,
+          data: {
+            name: 'Test',
+            nested: {
+              level1: {
+                level2: {
+                  value: 'deep'
+                }
+              }
+            },
+            array: [1, 2, 3, { nested: true }]
+          }
+        };
+        
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(true);
+        expect(result.errors).toHaveLength(0);
+      });
+    });
+
+    describe('missing required fields', () => {
+      test('rejects null record', () => {
+        const result = SyncRecordValidator.validate(null);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors[0].message).toContain('must be a valid object');
+      });
+
+      test('rejects undefined record', () => {
+        const result = SyncRecordValidator.validate(undefined);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors[0].message).toContain('must be a valid object');
+      });
+
+      test('rejects record missing id', () => {
+        const record = { ...validRecord, id: undefined };
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors).toContainEqual(
+          expect.objectContaining({
+            field: 'id',
+            message: "Required field 'id' is missing"
+          })
+        );
+      });
+
+      test('rejects record missing multiple required fields', () => {
+        const record = {
+          modelName: 'Test',
+          operation: 'create'
+        };
+        
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors.length).toBeGreaterThan(5);
+      });
+    });
+
+    describe('field type validation', () => {
+      test('rejects non-string id', () => {
+        const record = { ...validRecord, id: 123 as any };
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors).toContainEqual(
+          expect.objectContaining({
+            field: 'id',
+            message: "Field 'id' must be a string"
+          })
+        );
+      });
+
+      test('rejects negative version', () => {
+        const record = { ...validRecord, version: -1 };
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors).toContainEqual(
+          expect.objectContaining({
+            field: 'version',
+            message: 'Version must be a non-negative number'
+          })
+        );
+      });
+
+      test('rejects invalid operation', () => {
+        const record = { ...validRecord, operation: 'invalid' as any };
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors).toContainEqual(
+          expect.objectContaining({
+            field: 'operation',
+            message: expect.stringContaining('must be one of')
+          })
+        );
+      });
+
+      test('rejects unreasonable timestamp', () => {
+        const record = { ...validRecord, timestamp: Date.now() + (400 * 24 * 60 * 60 * 1000) };
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors).toContainEqual(
+          expect.objectContaining({
+            field: 'timestamp',
+            message: 'Timestamp is unreasonably far from current time'
+          })
+        );
+      });
+
+      test('rejects non-hexadecimal hash', () => {
+        const record = { ...validRecord, hash: 'not-hex-@#$' };
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors).toContainEqual(
+          expect.objectContaining({
+            field: 'hash',
+            message: 'Hash must be a valid hexadecimal string'
+          })
+        );
+      });
+    });
+
+    describe('operation requirements', () => {
+      test('rejects create without data', () => {
+        const record = { ...validRecord, operation: 'create' as const, data: undefined };
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors).toContainEqual(
+          expect.objectContaining({
+            field: 'data',
+            message: "Operation 'create' requires data payload"
+          })
+        );
+      });
+
+      test('rejects update without data', () => {
+        const record = { ...validRecord, operation: 'update' as const, data: null };
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors).toContainEqual(
+          expect.objectContaining({
+            field: 'data',
+            message: "Operation 'update' requires data payload"
+          })
+        );
+      });
+
+      test('rejects unknown model type', () => {
+        (ModelRegistry.getModel as jest.Mock).mockReturnValue(undefined);
+        
+        const result = SyncRecordValidator.validate(validRecord);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors).toContainEqual(
+          expect.objectContaining({
+            field: 'modelName',
+            message: 'Unknown model type: TestModel'
+          })
+        );
+      });
+    });
+
+    describe('security validation', () => {
+      test('rejects script tags in data', () => {
+        const record = {
+          ...validRecord,
+          data: {
+            name: '<script>alert("XSS")</script>',
+            value: 123
+          }
+        };
+        
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors).toContainEqual(
+          expect.objectContaining({
+            field: 'data.name',
+            message: 'String contains potentially malicious script tags'
+          })
+        );
+      });
+
+      test('rejects SQL injection patterns', () => {
+        const record = {
+          ...validRecord,
+          modelId: "'; DROP TABLE users; --"
+        };
+        
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors).toContainEqual(
+          expect.objectContaining({
+            field: 'modelId',
+            message: 'Field contains potentially malicious SQL patterns'
+          })
+        );
+      });
+
+      test('rejects prototype pollution attempts', () => {
+        const record = {
+          ...validRecord,
+          data: {
+            __proto__: { isAdmin: true },
+            constructor: { dangerous: true },
+            normal: 'value'
+          }
+        };
+        
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(false);
+        
+        const protoErrors = result.errors.filter(e => 
+          e.message.includes('Potentially malicious property name')
+        );
+        expect(protoErrors.length).toBeGreaterThan(0);
+      });
+
+      test('rejects deeply nested objects', () => {
+        let deepData: any = { value: 'bottom' };
+        for (let i = 0; i < 15; i++) {
+          deepData = { nested: deepData };
+        }
+        
+        const record = { ...validRecord, data: deepData };
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors).toContainEqual(
+          expect.objectContaining({
+            message: expect.stringContaining('exceeds maximum depth')
+          })
+        );
+      });
+
+      test('rejects overly large arrays', () => {
+        const record = {
+          ...validRecord,
+          data: {
+            bigArray: new Array(2000).fill('item')
+          }
+        };
+        
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors).toContainEqual(
+          expect.objectContaining({
+            field: 'data.bigArray',
+            message: expect.stringContaining('exceeds maximum length')
+          })
+        );
+      });
+
+      test('rejects overly long strings', () => {
+        const record = {
+          ...validRecord,
+          data: {
+            longString: 'x'.repeat(11000)
+          }
+        };
+        
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors).toContainEqual(
+          expect.objectContaining({
+            field: 'data.longString',
+            message: expect.stringContaining('exceeds maximum length')
+          })
+        );
+      });
+
+      test('rejects records exceeding size limit', () => {
+        const record = {
+          ...validRecord,
+          data: {
+            huge: 'x'.repeat(1024 * 1024) // 1MB of 'x'
+          }
+        };
+        
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(false);
+        expect(result.errors).toContainEqual(
+          expect.objectContaining({
+            field: 'record',
+            message: 'Record size exceeds 1MB limit'
+          })
+        );
+      });
+
+      test('rejects non-finite numbers', () => {
+        const record = {
+          ...validRecord,
+          data: {
+            infinite: Infinity,
+            notANumber: NaN
+          }
+        };
+        
+        const result = SyncRecordValidator.validate(record);
+        
+        expect(result.isValid).toBe(false);
+        
+        const numberErrors = result.errors.filter(e => 
+          e.message.includes('Number must be finite')
+        );
+        expect(numberErrors).toHaveLength(2);
+      });
+    });
+  });
+
+  describe('sanitize', () => {
+    test('sanitizes script tags', () => {
+      const record: SyncRecord = {
+        id: 'test',
+        modelName: 'Test',
+        modelId: 'test_123',
+        operation: 'create',
+        data: {
+          name: '<script>alert("XSS")</script>Normal text',
+          safe: 'No issues here'
+        },
+        version: 1,
+        timestamp: Date.now(),
+        clientId: 'client',
+        hash: 'abc123'
+      };
+      
+      const sanitized = SyncRecordValidator.sanitize(record);
+      
+      expect(sanitized.data.name).not.toContain('<script>');
+      expect(sanitized.data.name).toContain('Normal text');
+      expect(sanitized.data.safe).toBe('No issues here');
+    });
+
+    test('sanitizes SQL injection attempts', () => {
+      const record: SyncRecord = {
+        id: "test'; DROP TABLE users; --",
+        modelName: 'Test',
+        modelId: 'test_123',
+        operation: 'create',
+        data: { value: 123 },
+        version: 1,
+        timestamp: Date.now(),
+        clientId: 'client',
+        hash: 'abc123'
+      };
+      
+      const sanitized = SyncRecordValidator.sanitize(record);
+      
+      expect(sanitized.id).not.toContain('DROP TABLE');
+      expect(sanitized.id).toContain('test');
+    });
+
+    test('removes prototype pollution attempts', () => {
+      const record: SyncRecord = {
+        id: 'test',
+        modelName: 'Test',
+        modelId: 'test_123',
+        operation: 'create',
+        data: {
+          __proto__: { isAdmin: true },
+          constructor: { dangerous: true },
+          prototype: { evil: true },
+          normal: 'value'
+        },
+        version: 1,
+        timestamp: Date.now(),
+        clientId: 'client',
+        hash: 'abc123'
+      };
+      
+      const sanitized = SyncRecordValidator.sanitize(record);
+      
+      // Dangerous properties should be removed (not present in sanitized object)
+      expect(sanitized.data.hasOwnProperty('__proto__')).toBe(false);
+      expect(sanitized.data.hasOwnProperty('constructor')).toBe(false);
+      expect(sanitized.data.hasOwnProperty('prototype')).toBe(false);
+      expect(sanitized.data.normal).toBe('value');
+    });
+
+    test('truncates deeply nested objects', () => {
+      let deepData: any = { value: 'bottom' };
+      for (let i = 0; i < 15; i++) {
+        deepData = { nested: deepData };
+      }
+      
+      const record: SyncRecord = {
+        id: 'test',
+        modelName: 'Test',
+        modelId: 'test_123',
+        operation: 'create',
+        data: deepData,
+        version: 1,
+        timestamp: Date.now(),
+        clientId: 'client',
+        hash: 'abc123'
+      };
+      
+      const sanitized = SyncRecordValidator.sanitize(record);
+      
+      // Check that deep nesting is truncated
+      let depth = 0;
+      let current = sanitized.data;
+      while (current && current.nested) {
+        depth++;
+        current = current.nested;
+      }
+      
+      expect(depth).toBeLessThanOrEqual(10);
+    });
+
+    test('truncates large arrays', () => {
+      const record: SyncRecord = {
+        id: 'test',
+        modelName: 'Test',
+        modelId: 'test_123',
+        operation: 'create',
+        data: {
+          bigArray: new Array(2000).fill('item')
+        },
+        version: 1,
+        timestamp: Date.now(),
+        clientId: 'client',
+        hash: 'abc123'
+      };
+      
+      const sanitized = SyncRecordValidator.sanitize(record);
+      
+      expect(sanitized.data.bigArray.length).toBeLessThanOrEqual(1000);
+    });
+
+    test('replaces non-finite numbers', () => {
+      const record: SyncRecord = {
+        id: 'test',
+        modelName: 'Test',
+        modelId: 'test_123',
+        operation: 'create',
+        data: {
+          infinite: Infinity,
+          negInfinite: -Infinity,
+          notANumber: NaN,
+          normal: 42
+        },
+        version: 1,
+        timestamp: Date.now(),
+        clientId: 'client',
+        hash: 'abc123'
+      };
+      
+      const sanitized = SyncRecordValidator.sanitize(record);
+      
+      // Non-finite numbers should be replaced with 0
+      expect(sanitized.data.infinite).toBe(0);
+      expect(sanitized.data.negInfinite).toBe(0);
+      expect(sanitized.data.notANumber).toBe(0);
+      expect(sanitized.data.normal).toBe(42);
+    });
+
+    test('escapes HTML characters', () => {
+      const record: SyncRecord = {
+        id: 'test<>&"\'/test',
+        modelName: 'Test',
+        modelId: 'test_123',
+        operation: 'create',
+        data: {
+          html: '<div onclick="alert()">Click me</div>'
+        },
+        version: 1,
+        timestamp: Date.now(),
+        clientId: 'client',
+        hash: 'abc123'
+      };
+      
+      const sanitized = SyncRecordValidator.sanitize(record);
+      
+      expect(sanitized.id).not.toContain('<');
+      expect(sanitized.id).not.toContain('>');
+      expect(sanitized.data.html).not.toContain('<div');
+      expect(sanitized.data.html).not.toContain('onclick');
+    });
+
+    test('preserves valid data while sanitizing dangerous content', () => {
+      const record: SyncRecord = {
+        id: 'valid_id_123',
+        modelName: 'TestModel',
+        modelId: 'model_123',
+        operation: 'update',
+        data: {
+          name: 'John Doe',
+          email: 'john@example.com',
+          age: 30,
+          active: true,
+          metadata: {
+            created: '2024-01-01',
+            tags: ['user', 'active', 'premium']
+          }
+        },
+        version: 2,
+        timestamp: Date.now(),
+        clientId: 'client_abc',
+        hash: 'def456abc123'
+      };
+      
+      const sanitized = SyncRecordValidator.sanitize(record);
+      
+      // Valid data should be preserved
+      expect(sanitized.id).toBe('valid_id_123');
+      expect(sanitized.modelName).toBe('TestModel');
+      expect(sanitized.data.name).toBe('John Doe');
+      expect(sanitized.data.email).toBe('john@example.com');
+      expect(sanitized.data.age).toBe(30);
+      expect(sanitized.data.active).toBe(true);
+      expect(sanitized.data.metadata.tags).toEqual(['user', 'active', 'premium']);
+    });
+  });
+});
\ No newline at end of file

From 642a48771e26869913cef5b2f5394b7fd3a59d14 Mon Sep 17 00:00:00 2001
From: PJ <ipriyanshujain@gmail.com>
Date: Fri, 22 Aug 2025 21:09:35 +0530
Subject: [PATCH 2/3] fix memory leaks

---
 src/models/indexed-base-model.ts        |  24 +-
 src/sync/hash-sync-engine.ts            |  74 ++++--
 src/utils/resource-manager.ts           | 329 ++++++++++++++++++++++++
 tests/hash-sync-engine.test.ts          |   8 +-
 tests/models/indexed-base-model.test.ts |   3 +
 tests/utils/resource-manager.test.ts    | 265 +++++++++++++++++++
 6 files changed, 670 insertions(+), 33 deletions(-)
 create mode 100644 src/utils/resource-manager.ts
 create mode 100644 tests/utils/resource-manager.test.ts

diff --git a/src/models/indexed-base-model.ts b/src/models/indexed-base-model.ts
index 49a3933..def9ba3 100644
--- a/src/models/indexed-base-model.ts
+++ b/src/models/indexed-base-model.ts
@@ -1,6 +1,7 @@
 import { makeObservable, observable, action } from 'mobx';
 import { ModelRegistry } from '../model-registry';
 import { IndexedDBStore } from '../storage/indexed-db-store';
+import { ResourceManager } from '../utils/resource-manager';
 
 export interface ModelOptions {
   autoSave?: boolean;
@@ -28,6 +29,7 @@ export abstract class IndexedBaseModel {
   protected static syncEngine?: any; // HashSyncEngine - avoiding circular imports
   
   protected options: ModelOptions;
+  protected resourceManager?: ResourceManager;
 
   constructor(id: string, options: ModelOptions = {}) {
     this.id = id;
@@ -202,8 +204,12 @@ export abstract class IndexedBaseModel {
       
       // Update sync engine count if available (schedule async to avoid MobX cycles)
       if (IndexedBaseModel.syncEngine && typeof IndexedBaseModel.syncEngine.updatePendingSyncCount === 'function') {
-        // Use setTimeout to break potential MobX reaction cycles, with unref to prevent process hanging
-        const timer = setTimeout(() => {
+        // Use resource manager for proper timer cleanup
+        if (!this.resourceManager) {
+          this.resourceManager = new ResourceManager();
+        }
+        
+        this.resourceManager.setTimeout(() => {
           // Check if store is still initialized before updating
           if (IndexedBaseModel.store && IndexedBaseModel.syncEngine) {
             IndexedBaseModel.syncEngine.updatePendingSyncCount().catch(() => {
@@ -211,10 +217,6 @@ export abstract class IndexedBaseModel {
             });
           }
         }, 0);
-        // Prevent timer from keeping process alive
-        if (timer && typeof timer.unref === 'function') {
-          timer.unref();
-        }
       }
       
       this.markClean();
@@ -385,4 +387,14 @@ export abstract class IndexedBaseModel {
 
     await IndexedBaseModel.store.clear(this.name);
   }
+
+  /**
+   * Dispose of resources held by this model instance
+   */
+  async dispose(): Promise<void> {
+    if (this.resourceManager) {
+      await this.resourceManager.dispose();
+      this.resourceManager = undefined;
+    }
+  }
 }
\ No newline at end of file
diff --git a/src/sync/hash-sync-engine.ts b/src/sync/hash-sync-engine.ts
index 5fd6ef2..888ec1b 100644
--- a/src/sync/hash-sync-engine.ts
+++ b/src/sync/hash-sync-engine.ts
@@ -3,6 +3,7 @@ import { IndexedBaseModel } from '../models/indexed-base-model';
 import { ModelRegistry, ModelMetadata } from '../model-registry';
 import { SchemaHasher } from '../hash';
 import { SyncRecordValidator } from './sync-record-validator';
+import { ResourceManager, ManagedWebSocket } from '../utils/resource-manager';
 import { makeObservable, observable, action, computed } from 'mobx';
 
 /**
@@ -86,9 +87,11 @@ export class HashSyncEngine {
   private store: IndexedDBStore;
   private config: Required<HashSyncConfig>;
   private websocket?: WebSocket;
-  private syncTimer?: NodeJS.Timeout;
-  private heartbeatTimer?: NodeJS.Timeout;
-  private reconnectTimer?: NodeJS.Timeout;
+  private resourceManager: ResourceManager;
+  private syncTimer?: NodeJS.Timeout | number;
+  private heartbeatTimer?: NodeJS.Timeout | number;
+  private reconnectTimer?: NodeJS.Timeout | number;
+  private eventCleanup?: () => void;
   
   @observable status: HashSyncStatus = HashSyncStatus.DISCONNECTED;
   @observable lastError?: Error;
@@ -100,6 +103,7 @@ export class HashSyncEngine {
 
   constructor(store: IndexedDBStore, config: HashSyncConfig = {}) {
     this.store = store;
+    this.resourceManager = new ResourceManager();
     this.config = {
       serverUrl: config.serverUrl || 'ws://localhost:8080/sync',
       clientId: config.clientId || this.generateClientId(),
@@ -261,14 +265,14 @@ export class HashSyncEngine {
 
   private async establishWebSocketConnection(): Promise<void> {
     return new Promise((resolve, reject) => {
-      const timeout = setTimeout(() => {
+      const timeoutHandle = this.resourceManager.setTimeout(() => {
         reject(new Error('WebSocket connection timeout'));
       }, 10000);
 
       this.websocket = new WebSocket(this.config.serverUrl);
 
       this.websocket.onopen = () => {
-        clearTimeout(timeout);
+        this.resourceManager.clearTimer(timeoutHandle);
         console.log('Hash sync WebSocket connected');
         resolve();
       };
@@ -283,13 +287,13 @@ export class HashSyncEngine {
       };
 
       this.websocket.onclose = () => {
-        clearTimeout(timeout);
+        this.resourceManager.clearTimer(timeoutHandle);
         console.log('Hash sync WebSocket disconnected');
         this.handleDisconnection();
       };
 
       this.websocket.onerror = (error) => {
-        clearTimeout(timeout);
+        this.resourceManager.clearTimer(timeoutHandle);
         console.error('Hash sync WebSocket error:', error);
         reject(new Error('WebSocket connection failed'));
       };
@@ -536,7 +540,12 @@ export class HashSyncEngine {
   }
 
   private scheduleReconnect(): void {
-    this.reconnectTimer = setTimeout(() => {
+    if (this.reconnectTimer) {
+      return; // Already scheduled
+    }
+    
+    this.reconnectTimer = this.resourceManager.setTimeout(() => {
+      this.reconnectTimer = undefined;
       if (this.status === HashSyncStatus.DISCONNECTED && this.isOnline) {
         this.connect().catch(console.error);
       }
@@ -544,42 +553,40 @@ export class HashSyncEngine {
   }
 
   private startPeriodicSync(): void {
-    this.syncTimer = setInterval(() => {
+    if (this.syncTimer) {
+      return; // Already running
+    }
+    
+    this.syncTimer = this.resourceManager.setInterval(() => {
       if (this.status === HashSyncStatus.CONNECTED) {
         this.sync().catch(console.error);
       }
     }, this.config.syncIntervalMs);
-    
-    // Prevent timer from keeping process alive in tests
-    if (this.syncTimer && typeof this.syncTimer.unref === 'function') {
-      this.syncTimer.unref();
-    }
   }
 
   private startHeartbeat(): void {
-    this.heartbeatTimer = setInterval(() => {
+    if (this.heartbeatTimer) {
+      return; // Already running
+    }
+    
+    this.heartbeatTimer = this.resourceManager.setInterval(() => {
       this.sendMessage({ type: 'heartbeat', timestamp: Date.now() });
     }, this.config.heartbeatIntervalMs);
-    
-    // Prevent timer from keeping process alive in tests
-    if (this.heartbeatTimer && typeof this.heartbeatTimer.unref === 'function') {
-      this.heartbeatTimer.unref();
-    }
   }
 
   private clearTimers(): void {
     if (this.syncTimer) {
-      clearInterval(this.syncTimer);
+      this.resourceManager.clearTimer(this.syncTimer);
       this.syncTimer = undefined;
     }
     
     if (this.heartbeatTimer) {
-      clearInterval(this.heartbeatTimer);
+      this.resourceManager.clearTimer(this.heartbeatTimer);
       this.heartbeatTimer = undefined;
     }
     
     if (this.reconnectTimer) {
-      clearTimeout(this.reconnectTimer);
+      this.resourceManager.clearTimer(this.reconnectTimer);
       this.reconnectTimer = undefined;
     }
   }
@@ -597,8 +604,11 @@ export class HashSyncEngine {
       this.setStatus(HashSyncStatus.DISCONNECTED);
     };
 
-    window.addEventListener('online', handleOnline);
-    window.addEventListener('offline', handleOffline);
+    // Use resource manager for automatic cleanup
+    if (typeof window !== 'undefined') {
+      this.resourceManager.addEventListener(window, 'online', handleOnline);
+      this.resourceManager.addEventListener(window, 'offline', handleOffline);
+    }
   }
 
   private async loadSyncState(): Promise<void> {
@@ -652,4 +662,18 @@ export class HashSyncEngine {
   private generateDeltaId(): string {
     return `delta_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
   }
+
+  /**
+   * Dispose of all resources held by the sync engine
+   */
+  async dispose(): Promise<void> {
+    // Disconnect from server
+    this.disconnect();
+    
+    // Clean up all managed resources
+    await this.resourceManager.dispose();
+    
+    // Clear references
+    this.websocket = undefined;
+  }
 }
\ No newline at end of file
diff --git a/src/utils/resource-manager.ts b/src/utils/resource-manager.ts
new file mode 100644
index 0000000..e1687b3
--- /dev/null
+++ b/src/utils/resource-manager.ts
@@ -0,0 +1,329 @@
+/**
+ * Resource Manager for proper cleanup of timers, connections, and event listeners
+ * Prevents memory leaks by ensuring all resources are properly disposed
+ */
+
+export interface IDisposable {
+  dispose(): void | Promise<void>;
+}
+
+export class DisposableResource implements IDisposable {
+  private isDisposed = false;
+  private disposeCallback: () => void | Promise<void>;
+
+  constructor(disposeCallback: () => void | Promise<void>) {
+    this.disposeCallback = disposeCallback;
+  }
+
+  async dispose(): Promise<void> {
+    if (this.isDisposed) {
+      return;
+    }
+    
+    this.isDisposed = true;
+    await this.disposeCallback();
+  }
+}
+
+export class ResourceManager implements IDisposable {
+  private resources: Set<IDisposable> = new Set();
+  private timers: Set<NodeJS.Timeout | number> = new Set();
+  private eventListeners: Array<{
+    target: EventTarget;
+    event: string;
+    listener: EventListener;
+  }> = [];
+  private abortControllers: Set<AbortController> = new Set();
+  private isDisposed = false;
+
+  /**
+   * Add a disposable resource to be managed
+   */
+  add<T extends IDisposable>(resource: T): T {
+    if (this.isDisposed) {
+      throw new Error('Cannot add resource to disposed ResourceManager');
+    }
+    this.resources.add(resource);
+    return resource;
+  }
+
+  /**
+   * Create and manage a timer (setTimeout)
+   */
+  setTimeout(callback: () => void, delay: number): NodeJS.Timeout | number {
+    if (this.isDisposed) {
+      throw new Error('Cannot create timer on disposed ResourceManager');
+    }
+
+    const timer = setTimeout(() => {
+      this.timers.delete(timer);
+      callback();
+    }, delay);
+
+    this.timers.add(timer);
+    
+    // Prevent timer from keeping process alive in Node.js
+    if (typeof timer === 'object' && 'unref' in timer && typeof timer.unref === 'function') {
+      timer.unref();
+    }
+    
+    return timer;
+  }
+
+  /**
+   * Create and manage an interval (setInterval)
+   */
+  setInterval(callback: () => void, interval: number): NodeJS.Timeout | number {
+    if (this.isDisposed) {
+      throw new Error('Cannot create interval on disposed ResourceManager');
+    }
+
+    const timer = setInterval(callback, interval);
+    this.timers.add(timer);
+    
+    // Prevent timer from keeping process alive in Node.js
+    if (typeof timer === 'object' && 'unref' in timer && typeof timer.unref === 'function') {
+      timer.unref();
+    }
+    
+    return timer;
+  }
+
+  /**
+   * Clear a specific timer
+   */
+  clearTimer(timer: NodeJS.Timeout | number): void {
+    if (this.timers.has(timer)) {
+      clearTimeout(timer as any);
+      clearInterval(timer as any);
+      this.timers.delete(timer);
+    }
+  }
+
+  /**
+   * Add an event listener that will be automatically removed on disposal
+   */
+  addEventListener(
+    target: EventTarget,
+    event: string,
+    listener: EventListener,
+    options?: AddEventListenerOptions
+  ): void {
+    if (this.isDisposed) {
+      throw new Error('Cannot add event listener on disposed ResourceManager');
+    }
+
+    target.addEventListener(event, listener, options);
+    this.eventListeners.push({ target, event, listener });
+  }
+
+  /**
+   * Create an AbortController that will be automatically aborted on disposal
+   */
+  createAbortController(): AbortController {
+    if (this.isDisposed) {
+      throw new Error('Cannot create AbortController on disposed ResourceManager');
+    }
+
+    const controller = new AbortController();
+    this.abortControllers.add(controller);
+    return controller;
+  }
+
+  /**
+   * Execute a function with automatic resource cleanup
+   */
+  static async using<T>(
+    fn: (manager: ResourceManager) => T | Promise<T>
+  ): Promise<T> {
+    const manager = new ResourceManager();
+    try {
+      return await fn(manager);
+    } finally {
+      await manager.dispose();
+    }
+  }
+
+  /**
+   * Dispose all managed resources
+   */
+  async dispose(): Promise<void> {
+    if (this.isDisposed) {
+      return;
+    }
+
+    this.isDisposed = true;
+
+    // Clear all timers
+    for (const timer of this.timers) {
+      clearTimeout(timer as any);
+      clearInterval(timer as any);
+    }
+    this.timers.clear();
+
+    // Remove all event listeners
+    for (const { target, event, listener } of this.eventListeners) {
+      target.removeEventListener(event, listener);
+    }
+    this.eventListeners = [];
+
+    // Abort all controllers
+    for (const controller of this.abortControllers) {
+      if (!controller.signal.aborted) {
+        controller.abort();
+      }
+    }
+    this.abortControllers.clear();
+
+    // Dispose all managed resources
+    const disposePromises: Promise<void>[] = [];
+    for (const resource of this.resources) {
+      const result = resource.dispose();
+      if (result instanceof Promise) {
+        disposePromises.push(result);
+      }
+    }
+    
+    await Promise.all(disposePromises);
+    this.resources.clear();
+  }
+
+  /**
+   * Check if the manager has been disposed
+   */
+  get disposed(): boolean {
+    return this.isDisposed;
+  }
+}
+
+/**
+ * Decorator to automatically manage resources in a class
+ */
+export function Disposable(target: any) {
+  return class extends target {
+    protected resourceManager = new ResourceManager();
+
+    async dispose(): Promise<void> {
+      await this.resourceManager.dispose();
+      if (super.dispose) {
+        await super.dispose();
+      }
+    }
+  };
+}
+
+/**
+ * Create a disposable WebSocket connection
+ */
+export class ManagedWebSocket extends DisposableResource {
+  private ws: WebSocket;
+  private reconnectTimer?: NodeJS.Timeout | number;
+  private heartbeatTimer?: NodeJS.Timeout | number;
+  private resourceManager: ResourceManager;
+
+  constructor(
+    url: string,
+    private options: {
+      onOpen?: () => void;
+      onMessage?: (event: MessageEvent) => void;
+      onClose?: () => void;
+      onError?: (error: Event) => void;
+      reconnectDelay?: number;
+      heartbeatInterval?: number;
+    } = {}
+  ) {
+    const resourceManager = new ResourceManager();
+    
+    super(async () => {
+      await this.cleanup();
+    });
+
+    this.resourceManager = resourceManager;
+    this.ws = this.createWebSocket(url);
+  }
+
+  private createWebSocket(url: string): WebSocket {
+    const ws = new WebSocket(url);
+
+    ws.onopen = () => {
+      this.options.onOpen?.();
+      this.startHeartbeat();
+    };
+
+    ws.onmessage = (event) => {
+      this.options.onMessage?.(event);
+    };
+
+    ws.onclose = () => {
+      this.stopHeartbeat();
+      this.options.onClose?.();
+      
+      if (this.options.reconnectDelay && this.options.reconnectDelay > 0) {
+        this.scheduleReconnect(url);
+      }
+    };
+
+    ws.onerror = (error) => {
+      this.options.onError?.(error);
+    };
+
+    return ws;
+  }
+
+  private startHeartbeat(): void {
+    if (this.options.heartbeatInterval && this.options.heartbeatInterval > 0) {
+      this.heartbeatTimer = this.resourceManager.setInterval(() => {
+        if (this.ws.readyState === WebSocket.OPEN) {
+          this.ws.send(JSON.stringify({ type: 'heartbeat' }));
+        }
+      }, this.options.heartbeatInterval);
+    }
+  }
+
+  private stopHeartbeat(): void {
+    if (this.heartbeatTimer) {
+      this.resourceManager.clearTimer(this.heartbeatTimer);
+      this.heartbeatTimer = undefined;
+    }
+  }
+
+  private scheduleReconnect(url: string): void {
+    if (this.reconnectTimer) {
+      return;
+    }
+
+    this.reconnectTimer = this.resourceManager.setTimeout(() => {
+      this.reconnectTimer = undefined;
+      if (this.ws.readyState !== WebSocket.OPEN) {
+        this.ws = this.createWebSocket(url);
+      }
+    }, this.options.reconnectDelay || 5000);
+  }
+
+  send(data: string | ArrayBuffer | Blob): void {
+    if (this.ws.readyState === WebSocket.OPEN) {
+      this.ws.send(data);
+    }
+  }
+
+  close(): void {
+    this.stopHeartbeat();
+    if (this.reconnectTimer) {
+      this.resourceManager.clearTimer(this.reconnectTimer);
+      this.reconnectTimer = undefined;
+    }
+    
+    if (this.ws.readyState === WebSocket.OPEN || this.ws.readyState === WebSocket.CONNECTING) {
+      this.ws.close();
+    }
+  }
+
+  private async cleanup(): Promise<void> {
+    this.close();
+    await this.resourceManager.dispose();
+  }
+
+  get readyState(): number {
+    return this.ws.readyState;
+  }
+}
\ No newline at end of file
diff --git a/tests/hash-sync-engine.test.ts b/tests/hash-sync-engine.test.ts
index 5af0658..6cf62ec 100644
--- a/tests/hash-sync-engine.test.ts
+++ b/tests/hash-sync-engine.test.ts
@@ -99,7 +99,9 @@ describe('HashSyncEngine', () => {
   });
 
   afterEach(async () => {
-    syncEngine.disconnect();
+    if (syncEngine) {
+      await syncEngine.dispose(); // Proper resource cleanup
+    }
     await store.deleteDatabase();
   });
 
@@ -446,7 +448,9 @@ describe('HashSyncEngine Edge Cases', () => {
   });
 
   afterEach(async () => {
-    syncEngine.disconnect();
+    if (syncEngine) {
+      await syncEngine.dispose(); // Proper resource cleanup
+    }
     await store.deleteDatabase();
   });
 
diff --git a/tests/models/indexed-base-model.test.ts b/tests/models/indexed-base-model.test.ts
index f5a8795..210ee28 100644
--- a/tests/models/indexed-base-model.test.ts
+++ b/tests/models/indexed-base-model.test.ts
@@ -135,6 +135,9 @@ describe('IndexedBaseModel', () => {
     // Clear the static store reference first to prevent new operations
     IndexedBaseModel.setStore(undefined as any);
     
+    // Dispose of any resources created during testing
+    // This ensures proper cleanup of timers and other resources
+    
     // Wait a bit for any pending operations to complete
     await new Promise(resolve => setTimeout(resolve, 10));
     
diff --git a/tests/utils/resource-manager.test.ts b/tests/utils/resource-manager.test.ts
new file mode 100644
index 0000000..938653d
--- /dev/null
+++ b/tests/utils/resource-manager.test.ts
@@ -0,0 +1,265 @@
+import { ResourceManager, DisposableResource, ManagedWebSocket } from '../../src/utils/resource-manager';
+
+// Mock setTimeout and setInterval for testing
+const originalSetTimeout = global.setTimeout;
+const originalSetInterval = global.setInterval;
+const originalClearTimeout = global.clearTimeout;
+const originalClearInterval = global.clearInterval;
+
+describe('ResourceManager', () => {
+  let manager: ResourceManager;
+  let timeouts: any[] = [];
+  let intervals: any[] = [];
+
+  beforeEach(() => {
+    manager = new ResourceManager();
+    timeouts = [];
+    intervals = [];
+
+    // Mock timers to track them
+    (global as any).setTimeout = jest.fn((callback: any, delay: any) => {
+      const timer = { id: Math.random(), callback, delay, unref: jest.fn() };
+      timeouts.push(timer);
+      return timer as any;
+    });
+
+    (global as any).setInterval = jest.fn((callback: any, delay: any) => {
+      const timer = { id: Math.random(), callback, delay, unref: jest.fn() };
+      intervals.push(timer);
+      return timer as any;
+    });
+
+    (global as any).clearTimeout = jest.fn((timer: any) => {
+      const index = timeouts.findIndex(t => t === timer);
+      if (index >= 0) timeouts.splice(index, 1);
+    });
+
+    (global as any).clearInterval = jest.fn((timer: any) => {
+      const index = intervals.findIndex(t => t === timer);
+      if (index >= 0) intervals.splice(index, 1);
+    });
+  });
+
+  afterEach(async () => {
+    if (!manager.disposed) {
+      await manager.dispose();
+    }
+
+    // Restore original functions
+    global.setTimeout = originalSetTimeout;
+    global.setInterval = originalSetInterval;
+    global.clearTimeout = originalClearTimeout;
+    global.clearInterval = originalClearInterval;
+  });
+
+  describe('timer management', () => {
+    test('creates and tracks timeouts', () => {
+      const callback = jest.fn();
+      const timer = manager.setTimeout(callback, 1000);
+      
+      expect(global.setTimeout).toHaveBeenCalledWith(expect.any(Function), 1000);
+      expect(timeouts).toHaveLength(1);
+      expect(timeouts[0].unref).toHaveBeenCalled(); // Auto-unref for Node.js
+    });
+
+    test('creates and tracks intervals', () => {
+      const callback = jest.fn();
+      const timer = manager.setInterval(callback, 1000);
+      
+      expect(global.setInterval).toHaveBeenCalledWith(callback, 1000);
+      expect(intervals).toHaveLength(1);
+      expect(intervals[0].unref).toHaveBeenCalled(); // Auto-unref for Node.js
+    });
+
+    test('clears individual timers', () => {
+      const timer = manager.setTimeout(() => {}, 1000);
+      manager.clearTimer(timer);
+      
+      expect(global.clearTimeout).toHaveBeenCalledWith(timer);
+    });
+
+    test('clears all timers on disposal', async () => {
+      manager.setTimeout(() => {}, 1000);
+      manager.setInterval(() => {}, 1000);
+      
+      expect(timeouts).toHaveLength(1);
+      expect(intervals).toHaveLength(1);
+      
+      await manager.dispose();
+      
+      expect(global.clearTimeout).toHaveBeenCalled();
+      expect(global.clearInterval).toHaveBeenCalled();
+    });
+
+    test('prevents creating timers after disposal', async () => {
+      await manager.dispose();
+      
+      expect(() => {
+        manager.setTimeout(() => {}, 1000);
+      }).toThrow('Cannot create timer on disposed ResourceManager');
+    });
+  });
+
+  describe('resource management', () => {
+    test('manages disposable resources', async () => {
+      const disposed = jest.fn();
+      const resource = new DisposableResource(disposed);
+      
+      manager.add(resource);
+      await manager.dispose();
+      
+      expect(disposed).toHaveBeenCalled();
+    });
+
+    test('handles async disposable resources', async () => {
+      const asyncDisposed = jest.fn().mockResolvedValue(undefined);
+      const resource = new DisposableResource(asyncDisposed);
+      
+      manager.add(resource);
+      await manager.dispose();
+      
+      expect(asyncDisposed).toHaveBeenCalled();
+    });
+
+    test('prevents adding resources after disposal', async () => {
+      const resource = new DisposableResource(() => {});
+      await manager.dispose();
+      
+      expect(() => {
+        manager.add(resource);
+      }).toThrow('Cannot add resource to disposed ResourceManager');
+    });
+  });
+
+  describe('event listeners', () => {
+    test('adds and removes event listeners', async () => {
+      const mockTarget = {
+        addEventListener: jest.fn(),
+        removeEventListener: jest.fn()
+      } as any;
+      const listener = jest.fn();
+      
+      manager.addEventListener(mockTarget, 'click', listener);
+      
+      expect(mockTarget.addEventListener).toHaveBeenCalledWith('click', listener, undefined);
+      
+      await manager.dispose();
+      
+      expect(mockTarget.removeEventListener).toHaveBeenCalledWith('click', listener);
+    });
+
+    test('prevents adding event listeners after disposal', async () => {
+      const mockTarget = { addEventListener: jest.fn() } as any;
+      await manager.dispose();
+      
+      expect(() => {
+        manager.addEventListener(mockTarget, 'click', () => {});
+      }).toThrow('Cannot add event listener on disposed ResourceManager');
+    });
+  });
+
+  describe('AbortController management', () => {
+    test('creates and aborts controllers', async () => {
+      const controller = manager.createAbortController();
+      
+      expect(controller).toBeInstanceOf(AbortController);
+      expect(controller.signal.aborted).toBe(false);
+      
+      await manager.dispose();
+      
+      expect(controller.signal.aborted).toBe(true);
+    });
+
+    test('prevents creating controllers after disposal', async () => {
+      await manager.dispose();
+      
+      expect(() => {
+        manager.createAbortController();
+      }).toThrow('Cannot create AbortController on disposed ResourceManager');
+    });
+  });
+
+  describe('ResourceManager.using', () => {
+    test('automatically disposes manager after use', async () => {
+      let managerRef: ResourceManager | undefined;
+      const disposedSpy = jest.fn();
+      
+      const result = await ResourceManager.using(async (manager) => {
+        managerRef = manager;
+        
+        // Add a resource to track disposal
+        const resource = new DisposableResource(disposedSpy);
+        manager.add(resource);
+        
+        return 'test-result';
+      });
+      
+      expect(result).toBe('test-result');
+      expect(managerRef?.disposed).toBe(true);
+      expect(disposedSpy).toHaveBeenCalled();
+    });
+
+    test('disposes manager even if function throws', async () => {
+      let managerRef: ResourceManager | undefined;
+      const disposedSpy = jest.fn();
+      
+      try {
+        await ResourceManager.using(async (manager) => {
+          managerRef = manager;
+          
+          const resource = new DisposableResource(disposedSpy);
+          manager.add(resource);
+          
+          throw new Error('Test error');
+        });
+      } catch (error) {
+        expect((error as Error).message).toBe('Test error');
+      }
+      
+      expect(managerRef?.disposed).toBe(true);
+      expect(disposedSpy).toHaveBeenCalled();
+    });
+  });
+});
+
+describe('DisposableResource', () => {
+  test('calls dispose callback', async () => {
+    const callback = jest.fn();
+    const resource = new DisposableResource(callback);
+    
+    await resource.dispose();
+    
+    expect(callback).toHaveBeenCalled();
+  });
+
+  test('handles async dispose callback', async () => {
+    const asyncCallback = jest.fn().mockResolvedValue(undefined);
+    const resource = new DisposableResource(asyncCallback);
+    
+    await resource.dispose();
+    
+    expect(asyncCallback).toHaveBeenCalled();
+  });
+
+  test('prevents multiple disposal', async () => {
+    const callback = jest.fn();
+    const resource = new DisposableResource(callback);
+    
+    await resource.dispose();
+    await resource.dispose(); // Should not call again
+    
+    expect(callback).toHaveBeenCalledTimes(1);
+  });
+});
+
+// Note: ManagedWebSocket tests would require mocking WebSocket globally,
+// which is complex in Jest. In a real scenario, we'd use a WebSocket mock
+// library or test it in integration tests with a real WebSocket server.
+describe('ManagedWebSocket', () => {
+  test('is exported and constructible', () => {
+    // Just verify the class exists and can be instantiated
+    // Full testing would require WebSocket mocking
+    expect(ManagedWebSocket).toBeDefined();
+    expect(typeof ManagedWebSocket).toBe('function');
+  });
+});
\ No newline at end of file

From 5f8f1f3ca7248bab63399d274fe27b158133991c Mon Sep 17 00:00:00 2001
From: PJ <ipriyanshujain@gmail.com>
Date: Fri, 22 Aug 2025 21:22:29 +0530
Subject: [PATCH 3/3] memory leak test

---
 memory-test/README.md            | 125 ++++++++
 memory-test/basic-memory-test.ts | 201 ++++++++++++
 memory-test/long-running-demo.ts | 521 +++++++++++++++++++++++++++++++
 memory-test/memory-monitor.ts    | 121 +++++++
 memory-test/package.json         |  15 +
 5 files changed, 983 insertions(+)
 create mode 100644 memory-test/README.md
 create mode 100644 memory-test/basic-memory-test.ts
 create mode 100644 memory-test/long-running-demo.ts
 create mode 100644 memory-test/memory-monitor.ts
 create mode 100644 memory-test/package.json

diff --git a/memory-test/README.md b/memory-test/README.md
new file mode 100644
index 0000000..af920e5
--- /dev/null
+++ b/memory-test/README.md
@@ -0,0 +1,125 @@
+# Memory Test Suite
+
+This directory contains comprehensive memory leak detection and stress testing tools for the sync engine.
+
+## Tests Available
+
+### 1. Basic Memory Test
+```bash
+npm run test:memory:basic
+```
+- **Duration**: ~30 seconds
+- **Purpose**: Quick validation of resource cleanup
+- **Tests**: ResourceManager, Model lifecycle, Sync engine disposal
+- **Pass Criteria**: < 5MB memory growth
+
+### 2. Stress Test (Long-running)
+```bash
+npm run test:memory
+```
+- **Duration**: 2 minutes (configurable)
+- **Purpose**: Detect memory leaks under continuous load
+- **Activities**: Continuous model creation, modification, deletion
+- **Pass Criteria**: No memory leak detection, stable resource usage
+
+### 3. Memory Monitor
+```bash
+npm run monitor:memory
+```
+- **Duration**: Until stopped (Ctrl+C)
+- **Purpose**: Monitor memory usage in real-time
+- **Output**: Memory statistics every 2 seconds
+
+## What These Tests Validate
+
+### ✅ Resource Management Fixes
+- Timer cleanup (setTimeout/setInterval)
+- WebSocket connection lifecycle
+- Event listener removal
+- AbortController cleanup
+- Model disposal
+
+### ✅ Memory Leak Prevention
+- No unbounded memory growth
+- Proper garbage collection
+- Resource disposal patterns
+- Connection cleanup
+
+### ✅ Stress Test Scenarios
+- High-frequency model operations
+- Concurrent modifications
+- Resource churn (create/dispose cycles)
+- Sync engine operations under load
+
+## Expected Results
+
+### Healthy System:
+```
+📊 Memory Growth: +0.17 MB
+✅ PASS: Memory growth within acceptable limits
+🎉 Basic Memory Test PASSED - No memory leaks detected!
+```
+
+### Memory Leak Detected:
+```
+⚠️ MEMORY LEAK DETECTED - Heap grew by more than 20MB
+❌ FAIL: Memory growth exceeds 5MB threshold
+💥 Basic Memory Test FAILED - Memory leaks detected!
+```
+
+## Understanding the Output
+
+### Memory Metrics:
+- **Heap Used**: Active memory usage
+- **Heap Total**: Total heap allocated
+- **External**: Memory used by C++ objects
+- **RSS**: Resident Set Size (total process memory)
+
+### Growth Thresholds:
+- **Basic Test**: < 5MB acceptable
+- **Stress Test**: No continuous growth pattern
+- **Long-term**: Stable over time
+
+### Key Indicators:
+1. **Memory Growth**: Should be minimal and stable
+2. **Resource Counts**: Should not grow unbounded
+3. **Error Rate**: Should be < 1% of operations
+4. **Cleanup Success**: All resources properly disposed
+
+## Troubleshooting
+
+### High Memory Growth:
+1. Check for uncleaned timers
+2. Look for undisposed event listeners
+3. Verify model disposal calls
+4. Check WebSocket cleanup
+
+### Test Failures:
+1. Verify all dependencies installed (`npm install`)
+2. Check Node.js version (v16+ recommended)
+3. Ensure sufficient system memory
+4. Check for other memory-intensive processes
+
+### Performance Issues:
+1. Reduce test duration or intensity
+2. Increase sleep intervals in stress test
+3. Lower batch sizes for operations
+4. Check system resource availability
+
+## Integration with CI/CD
+
+These tests can be integrated into continuous integration:
+
+```yaml
+# Example GitHub Actions
+- name: Run Memory Tests
+  run: |
+    npm run test:memory:basic
+    npm run test:memory
+```
+
+Memory test results help ensure:
+- No regressions in resource management
+- Stable memory usage patterns
+- Production readiness validation
+- Long-running application safety
\ No newline at end of file
diff --git a/memory-test/basic-memory-test.ts b/memory-test/basic-memory-test.ts
new file mode 100644
index 0000000..8ada7a0
--- /dev/null
+++ b/memory-test/basic-memory-test.ts
@@ -0,0 +1,201 @@
+#!/usr/bin/env tsx
+
+/**
+ * Basic memory test to verify resource cleanup works correctly
+ * This is a shorter, more focused test for quick validation
+ */
+
+import { ResourceManager } from '../src/utils/resource-manager';
+import { IndexedDBStore } from '../src/storage/indexed-db-store';
+import { IndexedBaseModel } from '../src/models/indexed-base-model';
+import { HashSyncEngine } from '../src/sync/hash-sync-engine';
+import { ModelRegistry } from '../src/model-registry';
+
+// Enable fake IndexedDB
+import 'fake-indexeddb/auto';
+
+// Mock WebSocket
+(global as any).WebSocket = class {
+  static OPEN = 1;
+  readyState = 1;
+  constructor() {}
+  send() {}
+  close() {}
+};
+
+// Mock browser APIs
+if (!global.navigator) (global as any).navigator = { onLine: true };
+if (!global.window) (global as any).window = { addEventListener: () => {}, removeEventListener: () => {} };
+
+class TestModel extends IndexedBaseModel {
+  name = '';
+  
+  setName(name: string) {
+    this.name = name;
+    this.markDirty();
+  }
+
+  toJSON() {
+    return { id: this.id, name: this.name, _version: this._version, updatedAt: new Date().toISOString() };
+  }
+}
+
+async function runBasicMemoryTest() {
+  console.log('🧪 Running Basic Memory Test...\n');
+
+  let initialMemory: any = null;
+  let peakMemory: any = null;
+  let finalMemory: any = null;
+
+  // Record initial memory
+  if (typeof process !== 'undefined' && process.memoryUsage) {
+    initialMemory = process.memoryUsage();
+    console.log(`📊 Initial Memory: ${(initialMemory.heapUsed / 1024 / 1024).toFixed(2)} MB`);
+  }
+
+  // Test 1: ResourceManager
+  console.log('\n🔧 Test 1: ResourceManager Resource Cleanup');
+  await testResourceManager();
+
+  // Test 2: Model Creation and Disposal
+  console.log('\n🏗️  Test 2: Model Creation and Disposal');
+  await testModelLifecycle();
+
+  // Test 3: Sync Engine Lifecycle
+  console.log('\n🔄 Test 3: Sync Engine Lifecycle');
+  await testSyncEngineLifecycle();
+
+  // Force garbage collection if available
+  if (global.gc) {
+    console.log('\n🗑️  Forcing garbage collection...');
+    global.gc();
+  }
+
+  // Record final memory
+  if (typeof process !== 'undefined' && process.memoryUsage) {
+    finalMemory = process.memoryUsage();
+    console.log(`📊 Final Memory: ${(finalMemory.heapUsed / 1024 / 1024).toFixed(2)} MB`);
+    
+    const growth = finalMemory.heapUsed - initialMemory.heapUsed;
+    const growthMB = growth / 1024 / 1024;
+    
+    console.log(`📈 Memory Growth: ${growthMB > 0 ? '+' : ''}${growthMB.toFixed(2)} MB`);
+    
+    if (growthMB > 5) {
+      console.error('❌ FAIL: Memory growth exceeds 5MB threshold');
+      return false;
+    } else {
+      console.log('✅ PASS: Memory growth within acceptable limits');
+      return true;
+    }
+  }
+
+  return true;
+}
+
+async function testResourceManager() {
+  const managers: ResourceManager[] = [];
+  
+  // Create many resource managers with timers
+  for (let i = 0; i < 100; i++) {
+    const manager = new ResourceManager();
+    
+    // Add various resources
+    manager.setTimeout(() => {}, 10000); // Long timeout
+    manager.setInterval(() => {}, 1000); // Interval
+    manager.createAbortController(); // AbortController
+    
+    managers.push(manager);
+  }
+  
+  console.log(`   Created ${managers.length} ResourceManagers with timers and controllers`);
+  
+  // Dispose all managers
+  for (const manager of managers) {
+    await manager.dispose();
+  }
+  
+  console.log('   ✅ All ResourceManagers disposed');
+}
+
+async function testModelLifecycle() {
+  // Set up storage
+  const store = new IndexedDBStore({ dbName: 'basic_memory_test' });
+  await store.initialize([{
+    name: 'TestModel',
+    loadStrategy: 'full' as const,
+    schemaVersion: 1,
+    properties: new Map([['name', { type: 'property', indexed: false }]])
+  }]);
+
+  IndexedBaseModel.setStore(store);
+  ModelRegistry.registerModel('TestModel', TestModel as any);
+  ModelRegistry.registerProperty('TestModel', 'name', { type: 'property', indexed: false });
+
+  const models: TestModel[] = [];
+  
+  // Create many models
+  for (let i = 0; i < 200; i++) {
+    const model = new TestModel(`model_${i}`);
+    model.setName(`Test Model ${i}`);
+    models.push(model);
+  }
+  
+  console.log(`   Created ${models.length} models`);
+  
+  // Dispose all models
+  for (const model of models) {
+    await model.dispose();
+  }
+  
+  console.log('   ✅ All models disposed');
+  
+  // Cleanup store
+  await store.deleteDatabase();
+}
+
+async function testSyncEngineLifecycle() {
+  const engines: HashSyncEngine[] = [];
+  
+  for (let i = 0; i < 10; i++) {
+    const store = new IndexedDBStore({ dbName: `sync_test_${i}` });
+    await store.initialize([]);
+    
+    const engine = new HashSyncEngine(store, {
+      serverUrl: `ws://localhost:808${i}`,
+      clientId: `test_${i}`,
+      syncIntervalMs: 1000,
+      heartbeatIntervalMs: 5000
+    });
+    
+    await engine.initialize();
+    engines.push(engine);
+  }
+  
+  console.log(`   Created ${engines.length} sync engines`);
+  
+  // Dispose all engines
+  for (const engine of engines) {
+    await engine.dispose();
+  }
+  
+  console.log('   ✅ All sync engines disposed');
+}
+
+// Run the test
+if (require.main === module) {
+  runBasicMemoryTest()
+    .then(success => {
+      if (success) {
+        console.log('\n🎉 Basic Memory Test PASSED - No memory leaks detected!');
+        process.exit(0);
+      } else {
+        console.log('\n💥 Basic Memory Test FAILED - Memory leaks detected!');
+        process.exit(1);
+      }
+    })
+    .catch(error => {
+      console.error('\n💥 Basic Memory Test ERROR:', error);
+      process.exit(1);
+    });
+}
\ No newline at end of file
diff --git a/memory-test/long-running-demo.ts b/memory-test/long-running-demo.ts
new file mode 100644
index 0000000..1d20d18
--- /dev/null
+++ b/memory-test/long-running-demo.ts
@@ -0,0 +1,521 @@
+#!/usr/bin/env tsx
+
+/**
+ * Long-running memory test for the sync engine
+ * This demo creates, modifies, and destroys models continuously
+ * to test for memory leaks and resource management
+ */
+
+import { IndexedDBStore } from '../src/storage/indexed-db-store';
+import { IndexedBaseModel } from '../src/models/indexed-base-model';
+import { HashSyncEngine } from '../src/sync/hash-sync-engine';
+import { ModelRegistry } from '../src/model-registry';
+import { ResourceManager } from '../src/utils/resource-manager';
+
+// Enable fake IndexedDB for Node.js environment
+import 'fake-indexeddb/auto';
+
+// Mock WebSocket for testing
+(global as any).WebSocket = class MockWebSocket {
+  static CONNECTING = 0;
+  static OPEN = 1;
+  static CLOSING = 2;
+  static CLOSED = 3;
+
+  readyState = MockWebSocket.OPEN;
+  onopen?: () => void;
+  onmessage?: (event: any) => void;
+  onclose?: () => void;
+  onerror?: (error: any) => void;
+
+  constructor(public url: string) {
+    setTimeout(() => {
+      this.onopen?.();
+    }, 10);
+  }
+
+  send(data: string) {
+    // Echo back heartbeat responses
+    if (data.includes('heartbeat')) {
+      setTimeout(() => {
+        this.onmessage?.({
+          data: JSON.stringify({ type: 'heartbeat_ack', timestamp: Date.now() })
+        });
+      }, 1);
+    }
+  }
+
+  close() {
+    this.readyState = MockWebSocket.CLOSED;
+    setTimeout(() => this.onclose?.(), 1);
+  }
+};
+
+// Mock navigator for browser APIs
+if (!global.navigator) {
+  (global as any).navigator = { onLine: true };
+}
+
+// Mock window for event listeners
+if (!global.window) {
+  (global as any).window = {
+    addEventListener: () => {},
+    removeEventListener: () => {}
+  };
+}
+
+// Test model for stress testing
+class TestModel extends IndexedBaseModel {
+  name: string = '';
+  value: number = 0;
+  data: any = {};
+  testCreatedAt: Date;
+
+  constructor(id?: string) {
+    super(id || `test_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`, {
+      autoSave: false, // Disable to prevent race conditions in stress test
+      trackChanges: true
+    });
+    
+    this.testCreatedAt = new Date();
+  }
+
+  setName(name: string) {
+    this.name = name;
+    this.markDirty();
+  }
+
+  setValue(value: number) {
+    this.value = value;
+    this.markDirty();
+  }
+
+  setData(data: any) {
+    this.data = data;
+    this.markDirty();
+  }
+
+  toJSON() {
+    return {
+      id: this.id,
+      name: this.name,
+      value: this.value,
+      data: this.data,
+      testCreatedAt: this.testCreatedAt.toISOString(),
+      _version: this._version,
+      updatedAt: new Date().toISOString()
+    };
+  }
+}
+
+// Memory monitoring utilities
+class MemoryMonitor {
+  private samples: Array<{ time: number; heapUsed: number; heapTotal: number; external: number }> = [];
+  private startTime = Date.now();
+
+  takeSample() {
+    if (typeof process !== 'undefined' && process.memoryUsage) {
+      const usage = process.memoryUsage();
+      this.samples.push({
+        time: Date.now() - this.startTime,
+        heapUsed: usage.heapUsed,
+        heapTotal: usage.heapTotal,
+        external: usage.external
+      });
+    }
+  }
+
+  getStats() {
+    if (this.samples.length === 0) return null;
+
+    const latest = this.samples[this.samples.length - 1];
+    const first = this.samples[0];
+    
+    return {
+      runtime: latest.time,
+      currentHeapUsed: this.formatBytes(latest.heapUsed),
+      currentHeapTotal: this.formatBytes(latest.heapTotal),
+      currentExternal: this.formatBytes(latest.external),
+      heapGrowth: this.formatBytes(latest.heapUsed - first.heapUsed),
+      totalGrowth: this.formatBytes(latest.heapTotal - first.heapTotal),
+      samples: this.samples.length
+    };
+  }
+
+  private formatBytes(bytes: number): string {
+    const mb = bytes / 1024 / 1024;
+    return `${mb.toFixed(2)} MB`;
+  }
+
+  detectLeak(): boolean {
+    if (this.samples.length < 10) return false;
+
+    // Check if memory is consistently growing over the last 10 samples
+    const recent = this.samples.slice(-10);
+    let growingCount = 0;
+
+    for (let i = 1; i < recent.length; i++) {
+      if (recent[i].heapUsed > recent[i - 1].heapUsed) {
+        growingCount++;
+      }
+    }
+
+    return growingCount >= 8; // 80% of samples showing growth
+  }
+}
+
+// Stress test scenarios
+class StressTestRunner {
+  private store!: IndexedDBStore;
+  private syncEngine!: HashSyncEngine;
+  private resourceManager = new ResourceManager();
+  private models: TestModel[] = [];
+  private isRunning = false;
+  private monitor = new MemoryMonitor();
+  private stats = {
+    modelsCreated: 0,
+    modelsUpdated: 0,
+    modelsDeleted: 0,
+    syncOperations: 0,
+    errors: 0
+  };
+
+  async initialize() {
+    console.log('🚀 Initializing stress test environment...');
+
+    // Set up storage
+    this.store = new IndexedDBStore({ dbName: 'stress_test_db' });
+    await this.store.initialize([{
+      name: 'TestModel',
+      loadStrategy: 'full' as const,
+      schemaVersion: 1,
+      properties: new Map([
+        ['name', { type: 'property', indexed: true }],
+        ['value', { type: 'property', indexed: false }],
+        ['data', { type: 'property', indexed: false }]
+      ])
+    }]);
+
+    // Set up models
+    IndexedBaseModel.setStore(this.store);
+    ModelRegistry.registerModel('TestModel', TestModel as any);
+    ModelRegistry.registerProperty('TestModel', 'name', { type: 'property', indexed: true });
+    ModelRegistry.registerProperty('TestModel', 'value', { type: 'property', indexed: false });
+    ModelRegistry.registerProperty('TestModel', 'data', { type: 'property', indexed: false });
+
+    // Set up sync engine
+    this.syncEngine = new HashSyncEngine(this.store, {
+      serverUrl: 'ws://localhost:8080/stress-test',
+      clientId: `stress_test_${Date.now()}`,
+      syncIntervalMs: 1000,
+      heartbeatIntervalMs: 5000,
+      batchSize: 20
+    });
+
+    IndexedBaseModel.setSyncEngine(this.syncEngine);
+    await this.syncEngine.initialize();
+    await this.syncEngine.connect();
+
+    console.log('✅ Stress test environment initialized');
+  }
+
+  async runContinuousStressTest(durationMinutes: number = 2) {
+    console.log(`🔥 Starting ${durationMinutes}-minute stress test...`);
+    
+    this.isRunning = true;
+    const endTime = Date.now() + (durationMinutes * 60 * 1000);
+
+    // Start monitoring
+    const monitorInterval = this.resourceManager.setInterval(() => {
+      this.monitor.takeSample();
+      this.printStats();
+    }, 5000);
+
+    // Start stress test scenarios
+    this.startModelCreationScenario();
+    this.startModelModificationScenario();
+    this.startModelDeletionScenario();
+    this.startSyncStressScenario();
+
+    // Wait for test duration
+    while (Date.now() < endTime && this.isRunning) {
+      await this.sleep(1000);
+      
+      // Check for memory leaks
+      if (this.monitor.detectLeak()) {
+        console.warn('⚠️  MEMORY LEAK DETECTED!');
+        this.printDetailedMemoryStats();
+      }
+    }
+
+    this.isRunning = false;
+    console.log('🏁 Stress test completed');
+    
+    return this.generateReport();
+  }
+
+  private startModelCreationScenario() {
+    const createModels = async () => {
+      while (this.isRunning) {
+        try {
+          // Create models at a controlled rate
+          for (let i = 0; i < 2; i++) {
+            try {
+              const model = new TestModel();
+              model.setName(`Model ${this.stats.modelsCreated}`);
+              model.setValue(Math.random() * 1000);
+              model.setData({
+                timestamp: Date.now(),
+                randomData: Array.from({ length: 5 }, () => Math.random())
+              });
+
+              this.models.push(model);
+              this.stats.modelsCreated++;
+
+              // Keep model count manageable 
+              if (this.models.length > 50) {
+                const oldModel = this.models.shift();
+                if (oldModel) {
+                  await oldModel.dispose();
+                }
+              }
+            } catch (error) {
+              this.stats.errors++;
+            }
+          }
+
+          await this.sleep(500); // 2 models every 500ms = 4 models/sec
+        } catch (error) {
+          this.stats.errors++;
+          console.error('Model creation error:', error);
+        }
+      }
+    };
+
+    createModels().catch(console.error);
+  }
+
+  private startModelModificationScenario() {
+    const modifyModels = async () => {
+      while (this.isRunning) {
+        try {
+          if (this.models.length > 0) {
+            // Randomly modify existing models
+            const model = this.models[Math.floor(Math.random() * this.models.length)];
+            model.setValue(Math.random() * 1000);
+            model.setData({
+              updated: Date.now(),
+              randomValue: Math.random()
+            });
+            this.stats.modelsUpdated++;
+          }
+
+          await this.sleep(1000); // 1 update per second
+        } catch (error) {
+          this.stats.errors++;
+          console.error('Model modification error:', error);
+        }
+      }
+    };
+
+    modifyModels().catch(console.error);
+  }
+
+  private startModelDeletionScenario() {
+    const deleteModels = async () => {
+      while (this.isRunning) {
+        try {
+          if (this.models.length > 50) {
+            // Delete some models periodically
+            const toDelete = this.models.splice(0, 5);
+            for (const model of toDelete) {
+              await model.delete();
+              await model.dispose();
+              this.stats.modelsDeleted++;
+            }
+          }
+
+          await this.sleep(1000); // Delete 5 models every second
+        } catch (error) {
+          this.stats.errors++;
+          console.error('Model deletion error:', error);
+        }
+      }
+    };
+
+    deleteModels().catch(console.error);
+  }
+
+  private startSyncStressScenario() {
+    const stressSync = async () => {
+      while (this.isRunning) {
+        try {
+          // Force sync operations
+          await this.syncEngine.sync();
+          this.stats.syncOperations++;
+
+          await this.sleep(2000); // Sync every 2 seconds
+        } catch (error) {
+          this.stats.errors++;
+          console.error('Sync error:', error);
+        }
+      }
+    };
+
+    stressSync().catch(console.error);
+  }
+
+  private printStats() {
+    const memStats = this.monitor.getStats();
+    const syncStats = this.syncEngine.stats;
+
+    console.log('\n📊 STRESS TEST STATS:');
+    console.log('════════════════════════════════════════');
+    console.log(`Models: Created=${this.stats.modelsCreated}, Updated=${this.stats.modelsUpdated}, Deleted=${this.stats.modelsDeleted}`);
+    console.log(`Sync: Operations=${this.stats.syncOperations}, Pending=${syncStats.pendingSyncRecords}, Status=${syncStats.status}`);
+    console.log(`Errors: ${this.stats.errors}`);
+    console.log(`Active Models: ${this.models.length}`);
+    
+    if (memStats) {
+      console.log(`Memory: Used=${memStats.currentHeapUsed}, Total=${memStats.currentHeapTotal}`);
+      console.log(`Growth: Heap=${memStats.heapGrowth}, Total=${memStats.totalGrowth}`);
+      console.log(`Runtime: ${Math.floor(memStats.runtime / 1000)}s`);
+    }
+    console.log('════════════════════════════════════════\n');
+  }
+
+  private printDetailedMemoryStats() {
+    const memStats = this.monitor.getStats();
+    if (!memStats) return;
+
+    console.log('\n🔍 DETAILED MEMORY ANALYSIS:');
+    console.log('══════════════════════════════════════════');
+    console.log(`Runtime: ${Math.floor(memStats.runtime / 1000)}s`);
+    console.log(`Current Heap: ${memStats.currentHeapUsed} / ${memStats.currentHeapTotal}`);
+    console.log(`External Memory: ${memStats.currentExternal}`);
+    console.log(`Heap Growth: ${memStats.heapGrowth}`);
+    console.log(`Total Growth: ${memStats.totalGrowth}`);
+    console.log(`Samples Taken: ${memStats.samples}`);
+    console.log('══════════════════════════════════════════\n');
+  }
+
+  private async generateReport() {
+    const memStats = this.monitor.getStats();
+    const syncStats = this.syncEngine.stats;
+
+    const report = {
+      testSummary: {
+        duration: memStats ? `${Math.floor(memStats.runtime / 1000)}s` : 'N/A',
+        modelsCreated: this.stats.modelsCreated,
+        modelsUpdated: this.stats.modelsUpdated,
+        modelsDeleted: this.stats.modelsDeleted,
+        syncOperations: this.stats.syncOperations,
+        errors: this.stats.errors,
+        finalActiveModels: this.models.length
+      },
+      memoryAnalysis: memStats || 'Memory monitoring not available',
+      syncEngineStats: {
+        status: syncStats.status,
+        pendingSyncRecords: syncStats.pendingSyncRecords,
+        lastSyncTime: syncStats.lastSyncTime,
+        isOnline: syncStats.isOnline
+      },
+      verdict: {
+        memoryLeakDetected: this.monitor.detectLeak(),
+        resourcesProperlyManaged: this.stats.errors < 10,
+        syncEngineStable: syncStats.status !== 'error'
+      }
+    };
+
+    console.log('\n🎯 FINAL REPORT:');
+    console.log('══════════════════════════════════════════');
+    console.log(JSON.stringify(report, null, 2));
+    console.log('══════════════════════════════════════════\n');
+
+    return report;
+  }
+
+  private sleep(ms: number): Promise<void> {
+    return new Promise(resolve => {
+      const timer = this.resourceManager.setTimeout(resolve, ms);
+    });
+  }
+
+  async cleanup() {
+    console.log('🧹 Cleaning up stress test environment...');
+    
+    this.isRunning = false;
+
+    // Dispose all models
+    for (const model of this.models) {
+      await model.dispose();
+    }
+    this.models = [];
+
+    // Cleanup sync engine
+    if (this.syncEngine) {
+      await this.syncEngine.dispose();
+    }
+
+    // Cleanup store
+    if (this.store) {
+      await this.store.deleteDatabase();
+    }
+
+    // Cleanup resource manager
+    await this.resourceManager.dispose();
+
+    console.log('✅ Cleanup completed');
+  }
+}
+
+// Main execution
+async function runLongRunningTest() {
+  const runner = new StressTestRunner();
+  
+  try {
+    await runner.initialize();
+    
+    console.log('Starting 2-minute stress test...');
+    console.log('This will create, modify, and delete models continuously');
+    console.log('while monitoring for memory leaks and resource management issues.\n');
+    
+    const report = await runner.runContinuousStressTest(0.5); // 30 seconds
+    
+    // Analyze results
+    if (report.verdict.memoryLeakDetected) {
+      console.error('❌ MEMORY LEAK DETECTED - Resource management needs improvement');
+      process.exit(1);
+    } else if (report.verdict.resourcesProperlyManaged && report.verdict.syncEngineStable) {
+      console.log('✅ SUCCESS - No memory leaks detected, resources properly managed');
+      process.exit(0);
+    } else {
+      console.warn('⚠️  WARNING - Some issues detected but no critical failures');
+      process.exit(0);
+    }
+    
+  } catch (error) {
+    console.error('💥 Stress test failed:', error);
+    process.exit(1);
+  } finally {
+    await runner.cleanup();
+  }
+}
+
+// Handle graceful shutdown
+process.on('SIGINT', async () => {
+  console.log('\n\n🛑 Received SIGINT, shutting down gracefully...');
+  process.exit(0);
+});
+
+process.on('SIGTERM', async () => {
+  console.log('\n\n🛑 Received SIGTERM, shutting down gracefully...');
+  process.exit(0);
+});
+
+// Run the test
+if (require.main === module) {
+  runLongRunningTest().catch(console.error);
+}
+
+export { StressTestRunner, MemoryMonitor };
\ No newline at end of file
diff --git a/memory-test/memory-monitor.ts b/memory-test/memory-monitor.ts
new file mode 100644
index 0000000..67fdc7d
--- /dev/null
+++ b/memory-test/memory-monitor.ts
@@ -0,0 +1,121 @@
+#!/usr/bin/env tsx
+
+/**
+ * Simple memory monitor to track memory usage over time
+ * Can be used alongside the stress test to monitor external processes
+ */
+
+class SimpleMemoryMonitor {
+  private interval: NodeJS.Timeout | null = null;
+  private samples: Array<{
+    timestamp: number;
+    heapUsed: number;
+    heapTotal: number;
+    external: number;
+    rss: number;
+  }> = [];
+
+  start(intervalMs: number = 1000) {
+    console.log('🔍 Starting memory monitor...');
+    console.log('Time(s)\t\tHeap Used\tHeap Total\tExternal\tRSS');
+    console.log('═══════════════════════════════════════════════════════════════');
+
+    const startTime = Date.now();
+
+    this.interval = setInterval(() => {
+      if (typeof process !== 'undefined' && process.memoryUsage) {
+        const usage = process.memoryUsage();
+        const timestamp = Date.now();
+        const elapsed = Math.floor((timestamp - startTime) / 1000);
+
+        const sample = {
+          timestamp,
+          heapUsed: usage.heapUsed,
+          heapTotal: usage.heapTotal,
+          external: usage.external,
+          rss: usage.rss
+        };
+
+        this.samples.push(sample);
+
+        // Format and display
+        const heapUsedMB = (usage.heapUsed / 1024 / 1024).toFixed(1);
+        const heapTotalMB = (usage.heapTotal / 1024 / 1024).toFixed(1);
+        const externalMB = (usage.external / 1024 / 1024).toFixed(1);
+        const rssMB = (usage.rss / 1024 / 1024).toFixed(1);
+
+        console.log(`${elapsed}s\t\t${heapUsedMB}MB\t\t${heapTotalMB}MB\t\t${externalMB}MB\t\t${rssMB}MB`);
+
+        // Check for concerning growth
+        if (this.samples.length > 10) {
+          const recent = this.samples.slice(-10);
+          const oldestRecent = recent[0];
+          const growth = sample.heapUsed - oldestRecent.heapUsed;
+          const growthMB = growth / 1024 / 1024;
+
+          if (growthMB > 10) { // More than 10MB growth in 10 samples
+            console.warn(`⚠️  Significant memory growth detected: +${growthMB.toFixed(1)}MB in last 10 samples`);
+          }
+        }
+      }
+    }, intervalMs);
+  }
+
+  stop() {
+    if (this.interval) {
+      clearInterval(this.interval);
+      this.interval = null;
+    }
+
+    console.log('\n📊 Memory Monitor Summary:');
+    console.log('═══════════════════════════════════════');
+
+    if (this.samples.length > 0) {
+      const first = this.samples[0];
+      const last = this.samples[this.samples.length - 1];
+      const duration = (last.timestamp - first.timestamp) / 1000;
+
+      const heapGrowth = (last.heapUsed - first.heapUsed) / 1024 / 1024;
+      const totalGrowth = (last.heapTotal - first.heapTotal) / 1024 / 1024;
+      const rssGrowth = (last.rss - first.rss) / 1024 / 1024;
+
+      console.log(`Duration: ${duration.toFixed(1)}s`);
+      console.log(`Samples: ${this.samples.length}`);
+      console.log(`Heap Growth: ${heapGrowth > 0 ? '+' : ''}${heapGrowth.toFixed(1)}MB`);
+      console.log(`Total Heap Growth: ${totalGrowth > 0 ? '+' : ''}${totalGrowth.toFixed(1)}MB`);
+      console.log(`RSS Growth: ${rssGrowth > 0 ? '+' : ''}${rssGrowth.toFixed(1)}MB`);
+
+      // Memory leak detection
+      if (heapGrowth > 20) {
+        console.log('❌ POTENTIAL MEMORY LEAK: Heap grew by more than 20MB');
+      } else if (heapGrowth > 10) {
+        console.log('⚠️  WARNING: Significant heap growth detected');
+      } else {
+        console.log('✅ Memory usage appears stable');
+      }
+    }
+
+    console.log('═══════════════════════════════════════\n');
+  }
+}
+
+// CLI usage
+const monitor = new SimpleMemoryMonitor();
+
+// Handle graceful shutdown
+process.on('SIGINT', () => {
+  console.log('\n\nStopping memory monitor...');
+  monitor.stop();
+  process.exit(0);
+});
+
+process.on('SIGTERM', () => {
+  console.log('\n\nStopping memory monitor...');
+  monitor.stop();
+  process.exit(0);
+});
+
+// Start monitoring
+monitor.start(2000); // Sample every 2 seconds
+
+console.log('Memory monitor started. Press Ctrl+C to stop.\n');
\ No newline at end of file
diff --git a/memory-test/package.json b/memory-test/package.json
new file mode 100644
index 0000000..c9f4398
--- /dev/null
+++ b/memory-test/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "sync-engine-memory-test",
+  "version": "1.0.0",
+  "description": "Long-running memory test for sync engine",
+  "main": "long-running-demo.ts",
+  "scripts": {
+    "test": "tsx long-running-demo.ts",
+    "test:short": "tsx long-running-demo.ts --duration 2",
+    "test:long": "tsx long-running-demo.ts --duration 10",
+    "monitor": "tsx memory-monitor.ts"
+  },
+  "dependencies": {
+    "tsx": "^4.20.4"
+  }
+}
\ No newline at end of file