@cmdoss/memwal-sdk 0.7.0 → 0.8.0

package/dist/client/namespaces/consolidated/StorageNamespace.js

@@ -260,6 +260,7 @@ export class StorageNamespace {
      * Store memory package to Walrus
      *
      * Higher-level method that stores a complete memory package.
+     * Automatically encrypts content if encryption is enabled in config.
      *
      * @param memoryPackage - Memory package to store
      * @returns Upload result
@@ -268,12 +269,93 @@ export class StorageNamespace {
         if (!this.services.storage) {
             throw new Error('Storage service not configured.');
         }
+        // Check if encryption is enabled
+        const encryptionEnabled = this.services.config.features?.enableEncryption ?? true;
+        let encryptedContent;
+        let encryptedEmbedding; // Option A v2: encrypted embedding
+        let encryptionType;
+        let memoryCapId;
+        let keyId;
+        console.log('🔍 Encryption check:', {
+            encryptionEnabled,
+            hasEncryptionService: !!this.services.encryption,
+            hasCapabilityService: !!this.services.capability,
+            configFeatures: this.services.config.features
+        });
+        if (encryptionEnabled && this.services.encryption && this.services.capability) {
+            console.log('🔒 Encrypting memory package with SEAL (capability-based)...');
+            try {
+                // Step 1: Get or create capability for this app context
+                const category = memoryPackage.metadata?.category || 'general';
+                console.log(`🔐 Getting/creating capability for category: ${category}`);
+                const cap = await this.services.capability.getOrCreate({
+                    appId: category,
+                    userAddress: this.services.config.userAddress
+                }, this.services.config.signer);
+                memoryCapId = cap.id;
+                console.log(`✅ Capability ready: ${memoryCapId}`);
+                // Step 2: Compute key_id from capability (keccak256(owner || nonce))
+                keyId = this.services.capability.computeKeyId(cap);
+                console.log(`🔑 Key ID computed: ${keyId.substring(0, 20)}...`);
+                // Step 3: Encrypt the content using key_id as SEAL identity
+                const contentBytes = new TextEncoder().encode(memoryPackage.content);
+                const encryptResult = await this.services.encryption.encrypt(contentBytes, keyId, // Use key_id from capability as SEAL identity!
+                2 // threshold: 2 of 2 key servers
+                );
+                encryptedContent = encryptResult.encryptedObject;
+                encryptionType = 'seal-capability';
+                console.log(`✅ Content encrypted: ${contentBytes.length} bytes → ${encryptedContent?.length || 0} bytes`);
+                // Step 4: Also encrypt the embedding for fast index rebuild (Option A v2)
+                const embeddingToEncrypt = memoryPackage.embedding && memoryPackage.embedding.length > 0
+                    ? memoryPackage.embedding
+                    : (memoryPackage.metadata?.embedding || []);
+                if (embeddingToEncrypt.length > 0) {
+                    const embeddingBytes = new TextEncoder().encode(JSON.stringify(embeddingToEncrypt));
+                    const encryptEmbeddingResult = await this.services.encryption.encrypt(embeddingBytes, keyId, 2);
+                    encryptedEmbedding = encryptEmbeddingResult.encryptedObject;
+                    console.log(`✅ Embedding encrypted: ${embeddingToEncrypt.length}D → ${encryptedEmbedding?.length || 0} bytes`);
+                }
+                console.log(`   Using capability: ${memoryCapId}`);
+                console.log(`   Key ID: ${keyId.substring(0, 20)}...`);
+            }
+            catch (encryptError) {
+                console.error('❌ Encryption failed:', encryptError);
+                console.warn('⚠️ Falling back to plaintext storage');
+                // Fall back to plaintext if encryption fails
+            }
+        }
+        else {
+            console.log('📝 Encryption disabled or services not available - storing plaintext');
+        }
+        // Include capability metadata for decryption
+        const metadata = {
+            ...memoryPackage.metadata,
+            // Add capability info for decryption (CRITICAL for Option A!)
+            ...(memoryCapId && keyId ? {
+                memoryCapId,
+                keyId,
+                encryptionVersion: 'v2-capability' // Mark as new capability-based encryption
+            } : {})
+        };
+        // Get embedding from root level (correct API) or metadata (legacy fallback)
+        const rootEmbedding = memoryPackage.embedding && memoryPackage.embedding.length > 0;
+        const metadataEmbedding = memoryPackage.metadata?.embedding && memoryPackage.metadata.embedding.length > 0;
+        const embedding = rootEmbedding
+            ? memoryPackage.embedding
+            : (memoryPackage.metadata?.embedding || []);
+        if (metadataEmbedding && !rootEmbedding) {
+            console.warn('⚠️ Embedding in metadata (legacy) - should be at root level');
+        }
+        console.log(`📊 Embedding: ${embedding.length}D vector`);
         // Use uploadMemoryPackage method
         const result = await this.services.storage.uploadMemoryPackage({
             content: memoryPackage.content,
-            embedding: memoryPackage.embedding || [],
-            metadata: memoryPackage.metadata || {},
-            identity: this.services.config.userAddress
+            embedding,
+            metadata,
+            identity: this.services.config.userAddress,
+            encryptedContent, // Pass encrypted content if available
+            encryptedEmbedding, // Pass encrypted embedding for Option A v2
+            encryptionType
         }, {
             signer: this.services.config.signer,
             epochs: 3,
@@ -282,32 +364,277 @@ export class StorageNamespace {
         return {
             blobId: result.blobId,
             size: 0, // Size not returned by uploadMemoryPackage
-            contentType: 'application/json'
+            contentType: 'application/json',
+            memoryCapId, // Return capability ID for reference
+            keyId // Return key ID for reference
         };
     }
     /**
-     * Retrieve memory package from Walrus
+     * Retrieve memory package from Walrus with optional decryption
      *
      * @param blobId - Blob ID of the memory package
+     * @param decryptionContext - Optional context for decrypting SEAL-encrypted content
      * @returns Retrieved memory package with decrypted content
+     *
+     * @example
+     * ```typescript
+     * // Without decryption (returns encrypted data info)
+     * const result = await pdw.storage.retrieveMemoryPackage(blobId);
+     *
+     * // With decryption
+     * const result = await pdw.storage.retrieveMemoryPackage(blobId, {
+     *   sessionKey,
+     *   memoryCapId,
+     *   keyId
+     * });
+     * ```
      */
-    async retrieveMemoryPackage(blobId) {
+    async retrieveMemoryPackage(blobId, decryptionContext) {
         if (!this.services.storage) {
             throw new Error('Storage service not configured.');
         }
         const result = await this.services.storage.retrieveMemoryPackage(blobId);
-        // Map to expected return type
-        return {
-            memoryPackage: result.memoryPackage ? {
-                content: result.memoryPackage.content,
-                contentType: result.memoryPackage.contentType || 'text/plain',
+        // If not encrypted, return as-is
+        if (!result.isEncrypted && result.memoryPackage) {
+            return {
+                memoryPackage: {
+                    content: result.memoryPackage.content,
+                    contentType: result.memoryPackage.contentType || 'text/plain',
+                    metadata: result.memoryPackage.metadata,
+                    embedding: result.memoryPackage.embedding,
+                    createdAt: result.memoryPackage.timestamp
+                },
+                decryptionStatus: 'not_encrypted'
+            };
+        }
+        // v2.2 JSON package with encrypted content + encrypted embedding
+        if (result.memoryPackage?.version === '2.2' && result.memoryPackage?.encryptedContent) {
+            console.log('🔐 Detected v2.2 JSON package (Full Encryption - Content + Embedding)');
+            const embeddingDimension = result.memoryPackage.metadata?.embeddingDimension || 0;
+            console.log(`   embeddingDimension: ${embeddingDimension}D (encrypted on Walrus)`);
+            // Return base package (content encrypted, embedding encrypted)
+            const basePackage = {
+                content: '[ENCRYPTED - requires decryption]',
+                contentType: 'text/plain',
+                metadata: result.memoryPackage.metadata,
+                embedding: [], // Embedding is encrypted, needs decryption
+                createdAt: result.memoryPackage.timestamp
+            };
+            if (decryptionContext && this.services.encryption) {
+                try {
+                    console.log('🔐 Decrypting v2.2 content...');
+                    // Decrypt content
+                    const encryptedContentBase64 = result.memoryPackage.encryptedContent;
+                    const contentBinaryString = atob(encryptedContentBase64);
+                    const encryptedContentBytes = new Uint8Array(contentBinaryString.length);
+                    for (let i = 0; i < contentBinaryString.length; i++) {
+                        encryptedContentBytes[i] = contentBinaryString.charCodeAt(i);
+                    }
+                    const decryptedContentData = await this.services.encryption.decrypt({
+                        encryptedContent: encryptedContentBytes,
+                        userAddress: this.services.config.userAddress,
+                        sessionKey: decryptionContext.sessionKey,
+                        memoryCapId: decryptionContext.memoryCapId,
+                        keyId: decryptionContext.keyId
+                    });
+                    const decryptedContent = new TextDecoder().decode(decryptedContentData);
+                    console.log(`✅ v2.2 content decrypted: "${decryptedContent.substring(0, 50)}..."`);
+                    // Decrypt embedding if available
+                    let decryptedEmbedding = [];
+                    if (result.memoryPackage.encryptedEmbedding) {
+                        console.log('🔐 Decrypting v2.2 embedding...');
+                        const encryptedEmbeddingBase64 = result.memoryPackage.encryptedEmbedding;
+                        const embeddingBinaryString = atob(encryptedEmbeddingBase64);
+                        const encryptedEmbeddingBytes = new Uint8Array(embeddingBinaryString.length);
+                        for (let i = 0; i < embeddingBinaryString.length; i++) {
+                            encryptedEmbeddingBytes[i] = embeddingBinaryString.charCodeAt(i);
+                        }
+                        const decryptedEmbeddingData = await this.services.encryption.decrypt({
+                            encryptedContent: encryptedEmbeddingBytes,
+                            userAddress: this.services.config.userAddress,
+                            sessionKey: decryptionContext.sessionKey,
+                            memoryCapId: decryptionContext.memoryCapId,
+                            keyId: decryptionContext.keyId
+                        });
+                        const embeddingJson = new TextDecoder().decode(decryptedEmbeddingData);
+                        decryptedEmbedding = JSON.parse(embeddingJson);
+                        console.log(`✅ v2.2 embedding decrypted: ${decryptedEmbedding.length}D vector`);
+                    }
+                    return {
+                        memoryPackage: {
+                            ...basePackage,
+                            content: decryptedContent,
+                            embedding: decryptedEmbedding
+                        },
+                        decryptionStatus: 'success'
+                    };
+                }
+                catch (decryptError) {
+                    console.error('❌ v2.2 decryption failed:', decryptError.message);
+                    return {
+                        memoryPackage: basePackage,
+                        decryptionStatus: 'failed',
+                        error: decryptError.message
+                    };
+                }
+            }
+            // No decryption context
+            return {
+                memoryPackage: basePackage,
+                decryptionStatus: 'failed',
+                error: 'No decryption context provided for v2.2 encrypted package'
+            };
+        }
+        // v2.1 JSON package with encrypted content only (no embedding on Walrus)
+        if (result.memoryPackage?.version === '2.1' && result.memoryPackage?.encryptedContent) {
+            console.log('🔐 Detected v2.1 JSON package (Full Encryption - Content only)');
+            const embeddingDimension = result.memoryPackage.metadata?.embeddingDimension || 0;
+            console.log(`   embeddingDimension: ${embeddingDimension}D (stored locally, not on Walrus)`);
+            const basePackage = {
+                content: '[ENCRYPTED - requires decryption]',
+                contentType: 'text/plain',
                 metadata: result.memoryPackage.metadata,
-                embedding: result.memoryPackage.embedding,
+                embedding: [], // v2.1 has no embedding on Walrus
                 createdAt: result.memoryPackage.timestamp
-            } : null,
-            decryptionStatus: result.isEncrypted
-                ? (result.memoryPackage ? 'success' : 'failed')
-                : 'not_encrypted'
+            };
+            if (decryptionContext && this.services.encryption) {
+                try {
+                    console.log('🔐 Decrypting v2.1 content...');
+                    const encryptedBase64 = result.memoryPackage.encryptedContent;
+                    const binaryString = atob(encryptedBase64);
+                    const encryptedBytes = new Uint8Array(binaryString.length);
+                    for (let i = 0; i < binaryString.length; i++) {
+                        encryptedBytes[i] = binaryString.charCodeAt(i);
+                    }
+                    const decryptedData = await this.services.encryption.decrypt({
+                        encryptedContent: encryptedBytes,
+                        userAddress: this.services.config.userAddress,
+                        sessionKey: decryptionContext.sessionKey,
+                        memoryCapId: decryptionContext.memoryCapId,
+                        keyId: decryptionContext.keyId
+                    });
+                    const decryptedContent = new TextDecoder().decode(decryptedData);
+                    console.log(`✅ v2.1 decryption successful: "${decryptedContent.substring(0, 50)}..."`);
+                    return {
+                        memoryPackage: {
+                            ...basePackage,
+                            content: decryptedContent
+                        },
+                        decryptionStatus: 'success'
+                    };
+                }
+                catch (decryptError) {
+                    console.error('❌ v2.1 decryption failed:', decryptError.message);
+                    return {
+                        memoryPackage: basePackage,
+                        decryptionStatus: 'failed',
+                        error: decryptError.message
+                    };
+                }
+            }
+            return {
+                memoryPackage: basePackage,
+                decryptionStatus: 'failed',
+                error: 'No decryption context provided for v2.1 encrypted package'
+            };
+        }
+        // v2.0 JSON package with encrypted content + plaintext embedding (legacy)
+        if (result.memoryPackage?.version === '2.0' && result.memoryPackage?.encryptedContent) {
+            console.log('📦 Detected v2.0 JSON package with encrypted content (legacy)');
+            // Get embedding from root level OR metadata.embedding (fallback for encryption service bug)
+            const embeddingArray = result.memoryPackage.embedding?.length > 0
+                ? result.memoryPackage.embedding
+                : result.memoryPackage.metadata?.embedding;
+            const embeddingSource = result.memoryPackage.embedding?.length > 0 ? 'root' : 'metadata';
+            console.log(`   embedding: ${embeddingArray?.length || 0}D (from ${embeddingSource})`);
+            // Return embedding even without decryption (for index rebuilding)
+            const basePackage = {
+                content: '[ENCRYPTED - requires decryption]',
+                contentType: 'text/plain',
+                metadata: result.memoryPackage.metadata,
+                embedding: embeddingArray, // Plaintext embedding available!
+                createdAt: result.memoryPackage.timestamp
+            };
+            if (decryptionContext && this.services.encryption) {
+                try {
+                    console.log('🔐 Decrypting v2.0 encryptedContent...');
+                    // Convert base64 back to Uint8Array
+                    const encryptedBase64 = result.memoryPackage.encryptedContent;
+                    const binaryString = atob(encryptedBase64);
+                    const encryptedBytes = new Uint8Array(binaryString.length);
+                    for (let i = 0; i < binaryString.length; i++) {
+                        encryptedBytes[i] = binaryString.charCodeAt(i);
+                    }
+                    const decryptedData = await this.services.encryption.decrypt({
+                        encryptedContent: encryptedBytes,
+                        userAddress: this.services.config.userAddress,
+                        sessionKey: decryptionContext.sessionKey,
+                        memoryCapId: decryptionContext.memoryCapId,
+                        keyId: decryptionContext.keyId
+                    });
+                    const decryptedContent = new TextDecoder().decode(decryptedData);
+                    console.log(`✅ v2.0 decryption successful, content: "${decryptedContent.substring(0, 50)}..."`);
+                    return {
+                        memoryPackage: {
+                            ...basePackage,
+                            content: decryptedContent
+                        },
+                        decryptionStatus: 'success'
+                    };
+                }
+                catch (decryptError) {
+                    console.error('❌ v2.0 decryption failed:', decryptError.message);
+                    return {
+                        memoryPackage: basePackage, // Return with embedding but encrypted content
+                        decryptionStatus: 'failed',
+                        error: decryptError.message
+                    };
+                }
+            }
+            // No decryption context - return with embedding only
+            return {
+                memoryPackage: basePackage,
+                decryptionStatus: 'failed',
+                error: 'No decryption context provided (embedding still available)'
+            };
+        }
+        // Legacy binary format (v0) - try to decrypt if context provided
+        if (decryptionContext && this.services.encryption) {
+            try {
+                console.log('🔐 Decrypting legacy binary format...');
+                const decryptedData = await this.services.encryption.decrypt({
+                    encryptedContent: result.content,
+                    userAddress: this.services.config.userAddress,
+                    sessionKey: decryptionContext.sessionKey,
+                    memoryCapId: decryptionContext.memoryCapId,
+                    keyId: decryptionContext.keyId
+                });
+                const decryptedContent = new TextDecoder().decode(decryptedData);
+                console.log(`✅ Legacy decryption successful, content length: ${decryptedContent.length}`);
+                return {
+                    memoryPackage: {
+                        content: decryptedContent,
+                        contentType: 'text/plain',
+                        metadata: result.metadata,
+                        createdAt: result.metadata.createdTimestamp
+                    },
+                    decryptionStatus: 'success'
+                };
+            }
+            catch (decryptError) {
+                console.error('❌ Legacy decryption failed:', decryptError.message);
+                return {
+                    memoryPackage: null,
+                    decryptionStatus: 'failed',
+                    error: decryptError.message
+                };
+            }
+        }
+        // Encrypted but no decryption context provided
+        return {
+            memoryPackage: null,
+            decryptionStatus: 'failed',
+            error: 'Content is encrypted but no decryption context provided'
         };
     }
     /**
@@ -348,6 +675,212 @@ export class StorageNamespace {
         }
     }
     // ==========================================================================
+    // High-Level Decrypt API
+    // ==========================================================================
+    /**
+     * Retrieve and decrypt a memory package with minimal boilerplate.
+     * SDK handles all version detection, format conversion, and decryption internally.
+     *
+     * @param blobId - Blob ID on Walrus
+     * @param options - Decryption options
+     * @returns Decrypted content, embedding, and metadata
+     *
+     * @example
+     * ```typescript
+     * // With sign function (SDK creates session key)
+     * const result = await pdw.storage.retrieveAndDecrypt(blobId, {
+     *   signFn: async (message) => {
+     *     const sig = await signPersonalMessage({ message: new TextEncoder().encode(message) });
+     *     return { signature: sig.signature };
+     *   }
+     * });
+     *
+     * // With existing session key
+     * const result = await pdw.storage.retrieveAndDecrypt(blobId, { sessionKey });
+     *
+     * console.log(result.content);     // "my name is Aaron"
+     * console.log(result.embedding);   // [0.12, -0.34, ...] (3072D)
+     * console.log(result.version);     // "2.2"
+     * ```
+     */
+    async retrieveAndDecrypt(blobId, options = {}) {
+        if (!this.services.storage) {
+            throw new Error('Storage service not configured.');
+        }
+        console.log(`🔐 retrieveAndDecrypt: Downloading blob ${blobId}...`);
+        // Step 1: Download blob from Walrus
+        const blobData = await this.download(blobId);
+        console.log(`   Downloaded ${blobData.length} bytes`);
+        // Step 2: Detect format and parse
+        let version = 'legacy';
+        let isEncrypted = false;
+        let encryptedContentBase64 = null;
+        let encryptedEmbeddingBase64 = null;
+        let metadata = {};
+        let plainEmbedding = [];
+        try {
+            const blobText = new TextDecoder().decode(blobData);
+            const parsed = JSON.parse(blobText);
+            // v2.2: Full encryption (content + embedding both encrypted)
+            if (parsed.version === '2.2' && parsed.encryptedContent) {
+                version = '2.2';
+                isEncrypted = true;
+                encryptedContentBase64 = parsed.encryptedContent;
+                encryptedEmbeddingBase64 = parsed.encryptedEmbedding || null;
+                metadata = parsed.metadata || {};
+                console.log(`   Detected v2.2: encrypted content + encrypted embedding`);
+            }
+            // v2.1: Encrypted content only (no embedding on Walrus)
+            else if (parsed.version === '2.1' && parsed.encryptedContent) {
+                version = '2.1';
+                isEncrypted = true;
+                encryptedContentBase64 = parsed.encryptedContent;
+                metadata = parsed.metadata || {};
+                console.log(`   Detected v2.1: encrypted content only`);
+            }
+            // v2.0: Encrypted content + plaintext embedding
+            else if (parsed.version === '2.0' && parsed.encryptedContent) {
+                version = '2.0';
+                isEncrypted = true;
+                encryptedContentBase64 = parsed.encryptedContent;
+                plainEmbedding = parsed.embedding || [];
+                metadata = parsed.metadata || {};
+                console.log(`   Detected v2.0: encrypted content + ${plainEmbedding.length}D plaintext embedding`);
+            }
+            // v1.0: Plaintext JSON package
+            else if (parsed.version && parsed.content) {
+                version = 'plaintext';
+                isEncrypted = false;
+                metadata = parsed.metadata || {};
+                plainEmbedding = parsed.embedding || [];
+                console.log(`   Detected plaintext JSON package`);
+                return {
+                    content: parsed.content,
+                    embedding: plainEmbedding,
+                    version,
+                    isEncrypted,
+                    metadata,
+                    blobId
+                };
+            }
+        }
+        catch {
+            // Not JSON - check if binary SEAL data
+            const isBinary = blobData.some(byte => byte < 32 && byte !== 9 && byte !== 10 && byte !== 13);
+            if (isBinary || blobData.some(byte => byte > 127)) {
+                version = 'legacy';
+                isEncrypted = true;
+                console.log(`   Detected legacy binary format`);
+            }
+            else {
+                // Plain text content
+                version = 'plaintext';
+                isEncrypted = false;
+                console.log(`   Detected plaintext content`);
+                return {
+                    content: new TextDecoder().decode(blobData),
+                    embedding: [],
+                    version,
+                    isEncrypted,
+                    metadata: {},
+                    blobId
+                };
+            }
+        }
+        // Step 3: If not encrypted, return as-is
+        if (!isEncrypted) {
+            return {
+                content: new TextDecoder().decode(blobData),
+                embedding: plainEmbedding,
+                version,
+                isEncrypted,
+                metadata,
+                blobId
+            };
+        }
+        // Step 4: Get decryption parameters (from options or metadata)
+        const memoryCapId = options.memoryCapId || metadata.memoryCapId;
+        const keyIdHex = options.keyId || metadata.keyId;
+        if (!memoryCapId || !keyIdHex) {
+            throw new Error(`Missing decryption parameters. memoryCapId=${!!memoryCapId}, keyId=${!!keyIdHex}. ` +
+                `Provide via options or ensure metadata contains these values.`);
+        }
+        // Step 5: Convert keyId hex string to Uint8Array (SDK handles this!)
+        const keyIdBytes = new Uint8Array((keyIdHex.startsWith('0x') ? keyIdHex.slice(2) : keyIdHex)
+            .match(/.{1,2}/g)
+            .map((byte) => parseInt(byte, 16)));
+        // Step 6: Get or create session key
+        let sessionKey = options.sessionKey;
+        if (!sessionKey) {
+            if (!options.signFn) {
+                throw new Error('Decryption requires either sessionKey or signFn. ' +
+                    'Provide signFn to create session key automatically.');
+            }
+            if (!this.services.encryption) {
+                throw new Error('Encryption service not configured.');
+            }
+            console.log(`   Creating session key (will prompt for signature)...`);
+            sessionKey = await this.services.encryption.createSessionKey(this.services.config.userAddress, {
+                signPersonalMessageFn: async (message) => {
+                    return options.signFn(message);
+                }
+            });
+            console.log(`   Session key created`);
+        }
+        // Step 7: Decrypt content
+        console.log(`   Decrypting content...`);
+        // Convert base64 to Uint8Array if needed
+        let dataToDecrypt;
+        if (encryptedContentBase64) {
+            const binaryString = atob(encryptedContentBase64);
+            dataToDecrypt = new Uint8Array(binaryString.length);
+            for (let i = 0; i < binaryString.length; i++) {
+                dataToDecrypt[i] = binaryString.charCodeAt(i);
+            }
+        }
+        else {
+            dataToDecrypt = blobData;
+        }
+        const decryptedContentData = await this.services.encryption.decrypt({
+            encryptedContent: dataToDecrypt,
+            userAddress: this.services.config.userAddress,
+            sessionKey,
+            memoryCapId,
+            keyId: keyIdBytes
+        });
+        const content = new TextDecoder().decode(decryptedContentData);
+        console.log(`   Content decrypted: "${content.substring(0, 50)}${content.length > 50 ? '...' : ''}"`);
+        // Step 8: Decrypt embedding if v2.2
+        let embedding = plainEmbedding;
+        if (version === '2.2' && encryptedEmbeddingBase64) {
+            console.log(`   Decrypting embedding...`);
+            const embeddingBinaryString = atob(encryptedEmbeddingBase64);
+            const encryptedEmbeddingBytes = new Uint8Array(embeddingBinaryString.length);
+            for (let i = 0; i < embeddingBinaryString.length; i++) {
+                encryptedEmbeddingBytes[i] = embeddingBinaryString.charCodeAt(i);
+            }
+            const decryptedEmbeddingData = await this.services.encryption.decrypt({
+                encryptedContent: encryptedEmbeddingBytes,
+                userAddress: this.services.config.userAddress,
+                sessionKey,
+                memoryCapId,
+                keyId: keyIdBytes
+            });
+            const embeddingJson = new TextDecoder().decode(decryptedEmbeddingData);
+            embedding = JSON.parse(embeddingJson);
+            console.log(`   Embedding decrypted: ${embedding.length}D vector`);
+        }
+        console.log(`✅ retrieveAndDecrypt complete: ${content.length} chars, ${embedding.length}D embedding`);
+        return {
+            content,
+            embedding,
+            version,
+            isEncrypted,
+            metadata,
+            blobId
+        };
+    }
+    // ==========================================================================
     // Batch Operations (Quilt)
     // ==========================================================================
     /**