llmemory 0.2.2 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fdcf202249038554cae18d79da76c261a9c7a80687081126ce985562ef8607ae
-  data.tar.gz: 9b28b0ba29d4444712c2592a808f6b08bbf38f804c031e6b8b246914f7b86699
+  metadata.gz: 8e44ccb1c23fc659d9607e1eb3181e598a57edb95f47b94df4060ad46bfe7c31
+  data.tar.gz: 5d80e1fefb1dd77cbdc8c0b4d24e588abaf6f18c570db10e3fc0b2c808b09461
 SHA512:
-  metadata.gz: 4bddb0f7e9a4bfe6cfd488a341efce98ab4194c36fd6ebcb22b024db338224d0191e3bfb5bbc9638ad43092cac66bb29d159e87d81b97f6d17c8ee82b400c716
-  data.tar.gz: 8e5fb5edddabce0b1b57903282bb868a076d1595c4d187c973ccb7a7fa61f11847c9889e185459438423553aee0bf52f216e3bbdf0d9ac870f9f8196c230c1f1
+  metadata.gz: edb2f849efc9a6d1dbabc0be0a1210bf21e77f33174b965e3b22e9df3ca90aa536e47152c75891e548d6b43a08d82cfda29afa59d3b2e777aa144f4a3900570f
+  data.tar.gz: a8c84411d9c262dee5b5a0c07835c05816283a17749c1b6b282c75694dc56a497d8fb9f2b18eeccd242a82d5dce36234342ede75a13e2739ad11f99fb23ae005

data/README.md

@@ -65,6 +65,12 @@ Llmemory.configure do |config|
   config.long_term_store = :memory  # or :file, :postgres, :active_record
   config.long_term_storage_path = "./llmemory_data"  # for :file
   config.database_url = ENV["DATABASE_URL"]          # for :postgres
+
+  # Optional encryption at rest (AES-256-GCM). Requires a key; isolates data
+  # cryptographically per key (e.g. per agent/user). See "Encryption at rest".
+  config.encryption_enabled = false
+  config.encryption_key = ENV["LLMEMORY_ENCRYPTION_KEY"]
+
   config.time_decay_half_life_days = 30
   config.max_retrieval_tokens = 2000
   config.prune_after_days = 90
@@ -112,6 +118,31 @@ Llmemory.configure do |config|
 end
 ```
 
+## Encryption at rest
+
+Optional AES-256-GCM encryption protects persisted memory. Without the key, stored data is unreadable — useful for isolating agents or tenants.
+
+```ruby
+# Global default key (applies to all Memory instances)
+Llmemory.configure do |config|
+  config.encryption_enabled = true
+  config.encryption_key = ENV["LLMEMORY_ENCRYPTION_KEY"]
+end
+
+memory = Llmemory::Memory.new(user_id: "agent-1")
+
+# Per-instance key override (isolates this agent even if global config differs)
+memory = Llmemory::Memory.new(user_id: "agent-1", encryption_key: "tenant-specific-secret")
+```
+
+**What is encrypted:** conversation checkpoints (redis/postgres/active_record), file-based facts/resources/categories, episodic/procedural documents, graph node names/types/predicates (deterministic) and properties (random IV). **Vector embeddings are not encrypted** (required for pgvector search); associated `text_content` metadata is encrypted.
+
+**Trade-offs:**
+- Database keyword search (`LIKE`, BM25 on encrypted columns) no longer works on ciphertext; file backends still search in memory after decrypt.
+- `:memory` backends are in-process only and are **not** encrypted at rest.
+- Existing plaintext data remains readable (markers `enc:v1:` / `encd:v1:`); new writes are encrypted when enabled.
+- Deterministic encryption on graph identifiers leaks equality (same name ⇒ same ciphertext) but keeps graph traversal working.
+
 ## Long-Term Storage
 
 Long-term memory can use different backends:

data/lib/llmemory/configuration.rb

@@ -48,12 +48,14 @@ module Llmemory
                   :message_sanitizer_enabled,
                   :ttl_episodic_days,
                   :ttl_procedural_days,
-                  :skill_mining_enabled
+                  :skill_mining_enabled,
+                  :encryption_enabled,
+                  :encryption_key
 
     def initialize
       @llm_provider = :openai
       @llm_api_key = ENV["OPENAI_API_KEY"]
-      @llm_model = "gpt-4"
+      @llm_model = nil # falls back to the active provider's DEFAULT_MODEL
       @llm_base_url = nil
       @short_term_store = :memory
       @redis_url = ENV["REDIS_URL"] || "redis://localhost:6379/0"
@@ -98,6 +100,8 @@ module Llmemory
       @embedding_cache_max_entries = 10_000
       @max_message_chars = 32_000
       @message_sanitizer_enabled = false
+      @encryption_enabled = false
+      @encryption_key = ENV["LLMEMORY_ENCRYPTION_KEY"]
     end
   end
 
@@ -113,5 +117,21 @@ module Llmemory
     def reset_configuration!
       @configuration = Configuration.new
     end
+
+    # Builds a Crypto::Cipher when encryption is enabled and a key is present;
+    # otherwise returns Crypto::NullCipher. An explicit non-empty instance key
+    # enables encryption even when the global flag is off.
+    def build_cipher(key = nil)
+      explicit_key = !key.nil? && !key.to_s.empty?
+      resolved = key.nil? ? configuration.encryption_key : key
+      enabled = configuration.encryption_enabled || explicit_key
+      if enabled && !resolved.to_s.empty?
+        require_relative "crypto/cipher"
+        Crypto::Cipher.new(resolved)
+      else
+        require_relative "crypto/cipher"
+        Crypto::NullCipher.new
+      end
+    end
   end
 end

data/lib/llmemory/crypto/cipher.rb

@@ -0,0 +1,147 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "json"
+
+module Llmemory
+  module Crypto
+    class DecryptionError < Llmemory::Error; end
+
+    # No-op cipher when encryption is disabled or no key is configured.
+    class NullCipher
+      def enabled?
+        false
+      end
+
+      def encrypt(str)
+        str.to_s
+      end
+
+      def encrypt_deterministic(str)
+        str.to_s
+      end
+
+      def decrypt(str)
+        str.to_s
+      end
+
+      def encrypt_json(obj)
+        JSON.generate(obj)
+      end
+
+      def decrypt_json(str)
+        JSON.parse(str.to_s, symbolize_names: true)
+      end
+
+      def encrypted?(str)
+        false
+      end
+    end
+
+    # AES-256-GCM encryption with separate content (random IV) and index
+    # (deterministic IV) subkeys derived from the master key via HMAC-SHA256.
+    class Cipher
+      MARKER = "enc:v1:"
+      DETERMINISTIC_MARKER = "encd:v1:"
+      IV_LENGTH = 12
+      TAG_LENGTH = 16
+
+      def initialize(key)
+        @master_key = derive_master_key(key)
+        @content_key = derive_subkey("content")
+        @index_key = derive_subkey("index")
+      end
+
+      def enabled?
+        true
+      end
+
+      def encrypt(plaintext)
+        str = plaintext.to_s
+        return str if str.empty?
+
+        encrypt_with_key(str, @content_key, iv: OpenSSL::Random.random_bytes(IV_LENGTH), marker: MARKER)
+      end
+
+      def encrypt_deterministic(plaintext)
+        str = plaintext.to_s
+        return str if str.empty?
+
+        iv = OpenSSL::HMAC.digest("SHA256", @index_key, str)[0, IV_LENGTH]
+        encrypt_with_key(str, @index_key, iv: iv, marker: DETERMINISTIC_MARKER)
+      end
+
+      def decrypt(ciphertext)
+        str = ciphertext.to_s
+        return str if str.empty?
+        return str unless encrypted?(str)
+
+        marker, key = if str.start_with?(DETERMINISTIC_MARKER)
+          [DETERMINISTIC_MARKER, @index_key]
+        else
+          [MARKER, @content_key]
+        end
+
+        payload = decode64(str.delete_prefix(marker))
+        iv = payload[0, IV_LENGTH]
+        tag = payload[IV_LENGTH, TAG_LENGTH]
+        ct = payload[(IV_LENGTH + TAG_LENGTH)..]
+
+        cipher = OpenSSL::Cipher.new("aes-256-gcm")
+        cipher.decrypt
+        cipher.key = key
+        cipher.iv = iv
+        cipher.auth_tag = tag
+        cipher.auth_data = ""
+        cipher.update(ct) + cipher.final
+      rescue OpenSSL::Cipher::CipherError, ArgumentError => e
+        raise DecryptionError, "Failed to decrypt data: #{e.message}"
+      end
+
+      def encrypt_json(obj)
+        encrypt(JSON.generate(obj))
+      end
+
+      def decrypt_json(str)
+        JSON.parse(decrypt(str), symbolize_names: true)
+      end
+
+      def encrypted?(str)
+        s = str.to_s
+        s.start_with?(MARKER) || s.start_with?(DETERMINISTIC_MARKER)
+      end
+
+      private
+
+      def encrypt_with_key(plaintext, key, iv:, marker:)
+        cipher = OpenSSL::Cipher.new("aes-256-gcm")
+        cipher.encrypt
+        cipher.key = key
+        cipher.iv = iv
+        cipher.auth_data = ""
+        ct = cipher.update(plaintext) + cipher.final
+        tag = cipher.auth_tag
+        marker + encode64(iv + tag + ct)
+      end
+
+      def encode64(bin)
+        [bin].pack("m0")
+      end
+
+      def decode64(str)
+        str.unpack1("m0")
+      end
+
+      def derive_master_key(key)
+        raw = key.to_s
+        raise ConfigurationError, "encryption_key cannot be empty when encryption is enabled" if raw.empty?
+
+        OpenSSL::Digest::SHA256.digest(raw)
+      end
+
+      def derive_subkey(label)
+        OpenSSL::HMAC.digest("SHA256", @master_key, "llmemory:#{label}")[0, 32]
+      end
+    end
+  end
+end

data/lib/llmemory/crypto/field_helpers.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Llmemory
+  module Crypto
+    # Shared encrypt/decrypt helpers for storage backends.
+    module FieldHelpers
+      private
+
+      def cipher
+        @cipher || Llmemory.build_cipher
+      end
+
+      def enc(str)
+        return str if str.nil?
+        return str.to_s unless cipher.enabled?
+
+        cipher.encrypt(str.to_s)
+      end
+
+      def dec(str)
+        return str if str.nil?
+        return str unless str.is_a?(String) && cipher.encrypted?(str)
+
+        cipher.decrypt(str)
+      end
+
+      def enc_det(str)
+        return str if str.nil?
+        return str.to_s unless cipher.enabled?
+
+        cipher.encrypt_deterministic(str.to_s)
+      end
+
+      def enc_json(obj)
+        return obj if obj.nil?
+        return obj unless cipher.enabled?
+
+        cipher.encrypt_json(obj)
+      end
+
+      def dec_json(value)
+        return value if value.nil?
+        return value.transform_keys(&:to_sym) if value.is_a?(Hash)
+        return value unless value.is_a?(String) && cipher.encrypted?(value)
+
+        cipher.decrypt_json(value)
+      end
+
+      def write_encrypted_file(path, data)
+        payload = JSON.generate(data)
+        File.write(path, cipher.enabled? ? cipher.encrypt(payload) : payload)
+      end
+
+      def read_encrypted_file(path)
+        raw = File.read(path)
+        json = cipher.enabled? && cipher.encrypted?(raw) ? cipher.decrypt(raw) : raw
+        JSON.parse(json, symbolize_names: true)
+      end
+
+      def write_encrypted_text_file(path, content, append: false)
+        text = content.to_s
+        if cipher.enabled?
+          if append && File.file?(path)
+            existing = read_encrypted_text_file(path)
+            text = existing + text
+          end
+          File.write(path, cipher.encrypt(text))
+        elsif append && File.file?(path)
+          File.write(path, File.read(path) + text)
+        else
+          File.write(path, text)
+        end
+      end
+
+      def read_encrypted_text_file(path)
+        raw = File.read(path)
+        cipher.enabled? && cipher.encrypted?(raw) ? cipher.decrypt(raw) : raw
+      end
+
+      def serialize_state(state)
+        json = JSON.generate(state)
+        return json unless cipher.enabled?
+
+        cipher.encrypt(json)
+      end
+
+      def deserialize_state(data)
+        if data.is_a?(Hash)
+          return data.transform_keys(&:to_sym)
+        end
+
+        str = data.to_s
+        json = cipher.enabled? && cipher.encrypted?(str) ? cipher.decrypt(str) : str
+        JSON.parse(json, symbolize_names: true)
+      end
+
+      def parse_provenance(value)
+        return nil if value.nil?
+        return value.transform_keys(&:to_sym) if value.is_a?(Hash)
+        return dec_json(value) if value.is_a?(String) && cipher.encrypted?(value)
+
+        JSON.parse(value.to_s, symbolize_names: true)
+      rescue JSON::ParserError
+        nil
+      end
+    end
+  end
+end

data/lib/llmemory/llm/anthropic.rb

@@ -8,10 +8,11 @@ module Llmemory
   module LLM
     class Anthropic < Base
       DEFAULT_BASE_URL = "https://api.anthropic.com"
+      DEFAULT_MODEL = "claude-sonnet-4-6"
 
       def initialize(api_key: nil, model: nil, base_url: nil)
         @api_key = api_key || config.llm_api_key || ENV["ANTHROPIC_API_KEY"]
-        @model = model || config.llm_model || "claude-3-sonnet-20240229"
+        @model = model || config.llm_model || DEFAULT_MODEL
         @base_url = base_url || config.llm_base_url || DEFAULT_BASE_URL
       end
 

data/lib/llmemory/llm/openai.rb

@@ -8,10 +8,11 @@ module Llmemory
   module LLM
     class OpenAI < Base
       DEFAULT_BASE_URL = "https://api.openai.com/v1"
+      DEFAULT_MODEL = "gpt-4"
 
       def initialize(api_key: nil, model: nil, base_url: nil)
         @api_key = api_key || config.llm_api_key
-        @model = model || config.llm_model
+        @model = model || config.llm_model || DEFAULT_MODEL
         @base_url = base_url || config.llm_base_url || DEFAULT_BASE_URL
       end
 

data/lib/llmemory/long_term/episodic/memory.rb

@@ -21,9 +21,10 @@ module Llmemory
 
         attr_reader :user_id, :storage
 
-        def initialize(user_id:, storage: nil, vector_store: nil)
+        def initialize(user_id:, storage: nil, vector_store: nil, cipher: nil)
           @user_id = user_id
-          @storage = storage || Storages.build
+          @cipher = cipher || Llmemory.build_cipher
+          @storage = storage || Storages.build(cipher: @cipher)
           @vector_store = vector_store
           @vector_explicit = !vector_store.nil?
         end
@@ -125,7 +126,7 @@ module Llmemory
           if @vector_explicit
             @vector_store
           elsif Llmemory.configuration.episodic_vector_enabled
-            @vector_store ||= Llmemory::VectorStore.build(source_type: "episode")
+            @vector_store ||= Llmemory::VectorStore.build(source_type: "episode", cipher: @cipher)
           end
         end
 

data/lib/llmemory/long_term/episodic/storage.rb

@@ -12,17 +12,24 @@ module Llmemory
       Storage = Storages::MemoryStorage
 
       module Storages
-        def self.build(store: nil, base_path: nil, database_url: nil)
+        def self.build(store: nil, base_path: nil, database_url: nil, cipher: nil)
+          resolved_cipher = cipher || Llmemory.build_cipher
           case (store || Llmemory.configuration.long_term_store).to_s.to_sym
           when :memory
             MemoryStorage.new
           when :file
-            FileStorage.new(base_path: base_path || Llmemory.configuration.long_term_storage_path)
+            FileStorage.new(
+              base_path: base_path || Llmemory.configuration.long_term_storage_path,
+              cipher: resolved_cipher
+            )
           when :postgres, :database
-            DatabaseStorage.new(database_url: database_url || Llmemory.configuration.database_url)
+            DatabaseStorage.new(
+              database_url: database_url || Llmemory.configuration.database_url,
+              cipher: resolved_cipher
+            )
           when :active_record, :activerecord
             require_relative "storages/active_record_storage"
-            ActiveRecordStorage.new
+            ActiveRecordStorage.new(cipher: resolved_cipher)
           else
             MemoryStorage.new
           end

data/lib/llmemory/long_term/episodic/storages/active_record_storage.rb

@@ -4,6 +4,7 @@ require "json"
 require "securerandom"
 require "time"
 require_relative "base"
+require_relative "../../../crypto/field_helpers"
 
 module Llmemory
   module LongTerm
@@ -13,7 +14,10 @@ module Llmemory
         # AR auto-deserializes jsonb to a Hash (string keys), which Episode.from_h
         # handles. Mirrors the file-based ActiveRecordStorage pattern.
         class ActiveRecordStorage < Base
-          def initialize
+          include Llmemory::Crypto::FieldHelpers
+
+          def initialize(cipher: nil)
+            @cipher = cipher || Llmemory.build_cipher
             self.class.load_models!
           end
 
@@ -30,8 +34,8 @@ module Llmemory
             data["created_at"] ||= Time.now.utc.iso8601
             rec = LlmemoryEpisode.find_or_initialize_by(id: id)
             rec.user_id = user_id
-            rec.data = data
-            rec.search_text = searchable_text(data)
+            rec.data = cipher.enabled? ? enc_json(data) : data
+            rec.search_text = enc(searchable_text(data))
             rec.created_at ||= Time.current
             rec.save!
             id
@@ -39,19 +43,21 @@ module Llmemory
 
           def get_episode(user_id, id)
             rec = LlmemoryEpisode.find_by(user_id: user_id, id: id)
-            rec&.data
+            return nil unless rec
+
+            decode_data(rec.data)
           end
 
           def list_episodes(user_id, limit: nil, offset: nil)
             scope = LlmemoryEpisode.where(user_id: user_id, archived_at: nil).order(created_at: :desc)
             scope = scope.limit(limit) if limit && limit.to_i.positive?
             scope = scope.offset(offset) if offset && offset.to_i.positive?
-            scope.map(&:data)
+            scope.map { |r| decode_data(r.data) }
           end
 
           def search_episodes(user_id, query)
             token_scope(LlmemoryEpisode.where(user_id: user_id, archived_at: nil), "search_text", query)
-              .order(created_at: :desc).map(&:data)
+              .order(created_at: :desc).map { |r| decode_data(r.data) }
           end
 
           def count_episodes(user_id)
@@ -96,6 +102,13 @@ module Llmemory
             end
             parts.compact.join("\n")
           end
+
+          def decode_data(raw)
+            return raw.transform_keys(&:to_sym) if raw.is_a?(Hash)
+            return dec_json(raw) if raw.is_a?(String) && cipher.encrypted?(raw)
+
+            raw
+          end
         end
       end
     end

data/lib/llmemory/long_term/episodic/storages/database_storage.rb

@@ -4,6 +4,7 @@ require "json"
 require "securerandom"
 require "time"
 require_relative "base"
+require_relative "../../../crypto/field_helpers"
 
 module Llmemory
   module LongTerm
@@ -13,9 +14,12 @@ module Llmemory
         # (plus id/user_id/created_at and a denormalized search_text for keyword
         # search), mirroring the file-based DatabaseStorage pattern.
         class DatabaseStorage < Base
-          def initialize(database_url: nil)
+          include Llmemory::Crypto::FieldHelpers
+
+          def initialize(database_url: nil, cipher: nil)
             @database_url = database_url || Llmemory.configuration.database_url
             @connection = nil
+            @cipher = cipher || Llmemory.build_cipher
           end
 
           def save_episode(user_id, episode)
@@ -23,11 +27,12 @@ module Llmemory
             id = episode[:id] || episode["id"] || "ep_#{SecureRandom.hex(8)}"
             data = symbolize(episode).merge(id: id, user_id: user_id)
             data[:created_at] ||= Time.now.utc.iso8601
+            search = searchable_text(data)
             conn.exec_params(
               "INSERT INTO llmemory_episodes (id, user_id, data, search_text, created_at) " \
               "VALUES ($1, $2, $3::jsonb, $4, $5) " \
               "ON CONFLICT (id) DO UPDATE SET data = $3::jsonb, search_text = $4",
-              [id, user_id, JSON.generate(data), searchable_text(data), created_at_value(data)]
+              [id, user_id, store_data(data), enc(search), created_at_value(data)]
             )
             id
           end
@@ -124,11 +129,28 @@ module Llmemory
           end
 
           def parse_data(value)
-            JSON.parse(value.to_s, symbolize_names: true)
+            if value.is_a?(Hash)
+              return value.transform_keys(&:to_sym)
+            end
+
+            str = value.to_s
+            if cipher.encrypted?(str)
+              cipher.decrypt_json(str)
+            else
+              JSON.parse(str, symbolize_names: true)
+            end
           rescue JSON::ParserError
             {}
           end
 
+          def store_data(data)
+            if cipher.enabled?
+              JSON.generate(enc_json(data))
+            else
+              JSON.generate(data)
+            end
+          end
+
           def symbolize(hash)
             hash.each_with_object({}) { |(k, v), acc| acc[k.to_sym] = v }
           end

data/lib/llmemory/long_term/episodic/storages/file_storage.rb

@@ -4,22 +4,26 @@ require "fileutils"
 require "json"
 require "time"
 require_relative "base"
+require_relative "../../../crypto/field_helpers"
 
 module Llmemory
   module LongTerm
     module Episodic
       module Storages
         class FileStorage < Base
-          def initialize(base_path: nil)
+          include Llmemory::Crypto::FieldHelpers
+
+          def initialize(base_path: nil, cipher: nil)
             @base_path = base_path || Llmemory.configuration.long_term_storage_path || "./llmemory_data"
             @base_path = File.expand_path(@base_path)
+            @cipher = cipher || Llmemory.build_cipher
           end
 
           def save_episode(user_id, episode)
             id = episode[:id] || episode["id"] || "ep_#{next_seq(user_id)}"
             data = stringify_for_json(episode).merge("id" => id, "user_id" => user_id)
             data["created_at"] ||= Time.now.iso8601
-            File.write(episode_path(user_id, id), JSON.generate(data))
+            write_episode_file(episode_path(user_id, id), data)
             id
           end
 
@@ -57,10 +61,10 @@ module Llmemory
             Array(ids).map(&:to_s).count do |id|
               path = episode_path(user_id, id)
               next false unless File.file?(path)
-              data = JSON.parse(File.read(path))
+              data = load_episode_raw(path)
               next false if data["archived_at"]
               data["archived_at"] = Time.now.iso8601
-              File.write(path, JSON.generate(data))
+              write_episode_file(path, data)
               true
             end
           end
@@ -89,13 +93,26 @@ module Llmemory
           end
 
           def load_episode(path)
-            data = JSON.parse(File.read(path), symbolize_names: true)
+            data = load_episode_raw(path)
+            return nil unless data
+
             data[:created_at] = parse_time(data[:created_at])
             data
           rescue JSON::ParserError
             nil
           end
 
+          def load_episode_raw(path)
+            raw = File.read(path)
+            json = cipher.enabled? && cipher.encrypted?(raw) ? cipher.decrypt(raw) : raw
+            JSON.parse(json, symbolize_names: true)
+          end
+
+          def write_episode_file(path, data)
+            payload = JSON.generate(data)
+            File.write(path, cipher.enabled? ? cipher.encrypt(payload) : payload)
+          end
+
           def episode_text(episode)
             parts = [episode[:summary], episode[:outcome]]
             Array(episode[:steps]).each do |s|

data/lib/llmemory/long_term/file_based/storage.rb

@@ -14,17 +14,24 @@ module Llmemory
       Storage = Storages::MemoryStorage
 
       module Storages
-        def self.build(store: nil, base_path: nil, database_url: nil)
+        def self.build(store: nil, base_path: nil, database_url: nil, cipher: nil)
+          resolved_cipher = cipher || Llmemory.build_cipher
           case (store || Llmemory.configuration.long_term_store).to_s.to_sym
           when :memory
             MemoryStorage.new
           when :file
-            FileStorage.new(base_path: base_path || Llmemory.configuration.long_term_storage_path)
+            FileStorage.new(
+              base_path: base_path || Llmemory.configuration.long_term_storage_path,
+              cipher: resolved_cipher
+            )
           when :postgres, :database
-            DatabaseStorage.new(database_url: database_url || Llmemory.configuration.database_url)
+            DatabaseStorage.new(
+              database_url: database_url || Llmemory.configuration.database_url,
+              cipher: resolved_cipher
+            )
           when :active_record, :activerecord
             require_relative "storages/active_record_storage"
-            ActiveRecordStorage.new
+            ActiveRecordStorage.new(cipher: resolved_cipher)
           else
             MemoryStorage.new
           end