opensentinel 3.1.1 → 3.7.0

package/dist/chunk-IZJMVV7O.js

@@ -1,347 +0,0 @@
-import {
-  archivedMemories,
-  db,
-  memories
-} from "./chunk-XKYRH4FM.js";
-import {
-  env
-} from "./chunk-ZLZKF2PM.js";
-
-// src/core/memory.ts
-import { eq, desc, sql } from "drizzle-orm";
-import OpenAI from "openai";
-
-// src/core/security/field-encryption.ts
-import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-var ALGORITHM = "aes-256-gcm";
-var IV_LENGTH = 16;
-var TAG_LENGTH = 16;
-var KEY_LENGTH = 32;
-var CURRENT_KEY_VERSION = 1;
-var _masterKey = null;
-function getMasterKey() {
-  if (_masterKey) return _masterKey;
-  const keyBase64 = env.ENCRYPTION_MASTER_KEY;
-  if (keyBase64) {
-    const key = Buffer.from(keyBase64, "base64");
-    if (key.length !== KEY_LENGTH) {
-      throw new Error(
-        `ENCRYPTION_MASTER_KEY must be ${KEY_LENGTH} bytes (${KEY_LENGTH * 4 / 3} base64 chars). Got ${key.length} bytes.`
-      );
-    }
-    _masterKey = key;
-    return _masterKey;
-  }
-  if (env.NODE_ENV === "production") {
-    throw new Error(
-      `ENCRYPTION_MASTER_KEY is required in production for SOC 2 compliance. Generate one with: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"`
-    );
-  }
-  console.warn("[field-encryption] No ENCRYPTION_MASTER_KEY set \u2014 using ephemeral key (dev only)");
-  _masterKey = randomBytes(KEY_LENGTH);
-  return _masterKey;
-}
-function encryptField(plaintext) {
-  if (plaintext === null || plaintext === void 0) return null;
-  const key = getMasterKey();
-  const iv = randomBytes(IV_LENGTH);
-  const cipher = createCipheriv(ALGORITHM, key, iv);
-  const encrypted = Buffer.concat([
-    cipher.update(plaintext, "utf8"),
-    cipher.final()
-  ]);
-  const tag = cipher.getAuthTag();
-  const combined = Buffer.concat([
-    Buffer.from([CURRENT_KEY_VERSION]),
-    iv,
-    tag,
-    encrypted
-  ]);
-  return combined.toString("base64");
-}
-function decryptField(encryptedBase64) {
-  if (encryptedBase64 === null || encryptedBase64 === void 0) return null;
-  const combined = Buffer.from(encryptedBase64, "base64");
-  if (combined.length < 1 + IV_LENGTH + TAG_LENGTH + 1) {
-    throw new Error("Encrypted data too short");
-  }
-  const keyVersion = combined[0];
-  if (keyVersion !== CURRENT_KEY_VERSION) {
-    throw new Error(`Unsupported encryption key version: ${keyVersion}`);
-  }
-  const iv = combined.subarray(1, 1 + IV_LENGTH);
-  const tag = combined.subarray(1 + IV_LENGTH, 1 + IV_LENGTH + TAG_LENGTH);
-  const ciphertext = combined.subarray(1 + IV_LENGTH + TAG_LENGTH);
-  const key = getMasterKey();
-  const decipher = createDecipheriv(ALGORITHM, key, iv);
-  decipher.setAuthTag(tag);
-  const decrypted = Buffer.concat([
-    decipher.update(ciphertext),
-    decipher.final()
-  ]);
-  return decrypted.toString("utf8");
-}
-function isEncryptionAvailable() {
-  try {
-    getMasterKey();
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-// src/core/memory.ts
-var _openai = null;
-function getOpenAI() {
-  if (!_openai) {
-    _openai = new OpenAI({ apiKey: env.OPENAI_API_KEY });
-  }
-  return _openai;
-}
-var openai = new Proxy({}, {
-  get(_target, prop) {
-    const instance = getOpenAI();
-    const value = instance[prop];
-    if (typeof value === "function") {
-      return value.bind(instance);
-    }
-    return value;
-  }
-});
-async function generateEmbedding(text) {
-  const response = await openai.embeddings.create({
-    model: "text-embedding-3-small",
-    input: text
-  });
-  return response.data[0].embedding;
-}
-async function storeMemory(memory) {
-  const embedding = await generateEmbedding(memory.content);
-  const shouldEncrypt = isEncryptionAvailable();
-  const contentForDb = shouldEncrypt ? encryptField(memory.content) : memory.content;
-  const [stored] = await db.insert(memories).values({
-    ...memory,
-    content: contentForDb,
-    encrypted: shouldEncrypt,
-    embedding,
-    provenance: memory.provenance || `${memory.source || "unknown"}:auto`
-  }).returning();
-  try {
-    await db.execute(sql`
-      UPDATE memories
-      SET search_vector = to_tsvector('english', ${memory.content})
-      WHERE id = ${stored.id}
-    `);
-  } catch {
-  }
-  return { ...stored, content: memory.content };
-}
-async function updateMemory(id, updates) {
-  const setClauses = [];
-  if (updates.content) {
-    const newEmbedding = await generateEmbedding(updates.content);
-    setClauses.push(sql`content = ${updates.content}`);
-    setClauses.push(sql`embedding = ${JSON.stringify(newEmbedding)}::vector`);
-    setClauses.push(sql`search_vector = to_tsvector('english', ${updates.content})`);
-  }
-  if (updates.type) {
-    setClauses.push(sql`type = ${updates.type}`);
-  }
-  if (updates.importance !== void 0) {
-    setClauses.push(sql`importance = ${updates.importance}`);
-  }
-  if (setClauses.length === 0) return null;
-  const result = await db.execute(sql`
-    UPDATE memories
-    SET ${sql.join(setClauses, sql`, `)}
-    WHERE id = ${id}
-    RETURNING *
-  `);
-  return result[0] || null;
-}
-async function deleteMemory(id) {
-  const result = await db.execute(sql`
-    SELECT * FROM memories WHERE id = ${id}
-  `);
-  const memory = result[0];
-  if (!memory) return false;
-  await db.insert(archivedMemories).values({
-    originalMemoryId: memory.id,
-    userId: memory.user_id,
-    type: memory.type,
-    content: memory.content,
-    reason: "user_request",
-    originalCreatedAt: memory.created_at
-  });
-  await db.execute(sql`DELETE FROM memories WHERE id = ${id}`);
-  return true;
-}
-async function exportMemories(userId, format = "markdown") {
-  const mems = await db.select().from(memories).where(userId ? eq(memories.userId, userId) : void 0).orderBy(desc(memories.createdAt));
-  for (const m of mems) {
-    if (m.encrypted) {
-      try {
-        m.content = decryptField(m.content) ?? m.content;
-      } catch {
-      }
-    }
-  }
-  if (format === "json") {
-    return JSON.stringify(
-      mems.map((m) => ({
-        id: m.id,
-        type: m.type,
-        content: m.content,
-        importance: m.importance,
-        source: m.source,
-        provenance: m.provenance,
-        createdAt: m.createdAt
-      })),
-      null,
-      2
-    );
-  }
-  const lines = [
-    "# Memories Export",
-    `Exported: ${(/* @__PURE__ */ new Date()).toISOString()}`,
-    `Total: ${mems.length} memories`,
-    ""
-  ];
-  for (const m of mems) {
-    lines.push(`## [${m.type}] (Importance: ${m.importance}/10)`);
-    lines.push(m.content);
-    lines.push(`_Source: ${m.source || "unknown"} | Created: ${m.createdAt.toISOString()}_`);
-    lines.push("");
-  }
-  return lines.join("\n");
-}
-async function searchMemories(query, userId, limit = 5) {
-  const queryEmbedding = await generateEmbedding(query);
-  const results = await db.execute(sql`
-    SELECT
-      id, user_id, type, content, importance, source, provenance, metadata,
-      last_accessed, created_at,
-      1 - (embedding <=> ${JSON.stringify(queryEmbedding)}::vector) as similarity
-    FROM memories
-    ${userId ? sql`WHERE user_id = ${userId}` : sql``}
-    ORDER BY embedding <=> ${JSON.stringify(queryEmbedding)}::vector
-    LIMIT ${limit}
-  `);
-  const rows = results;
-  const memoryIds = rows.map((r) => r.id);
-  if (memoryIds.length > 0) {
-    await db.execute(sql`
-      UPDATE memories
-      SET last_accessed = NOW()
-      WHERE id = ANY(${memoryIds}::uuid[])
-    `);
-  }
-  for (const row of rows) {
-    if (row.encrypted) {
-      try {
-        row.content = decryptField(row.content) ?? row.content;
-      } catch {
-      }
-    }
-  }
-  return rows;
-}
-async function getMemoryById(id) {
-  const result = await db.execute(sql`
-    SELECT * FROM memories WHERE id = ${id}
-  `);
-  const row = result[0] || null;
-  if (row && row.encrypted) {
-    try {
-      row.content = decryptField(row.content) ?? row.content;
-    } catch {
-    }
-  }
-  return row;
-}
-async function extractMemories(content, userId) {
-  const extractionPrompt = `Analyze this text and extract any important facts that should be remembered about the user or their preferences. Return a JSON array of objects with "content" (the fact), "type" (semantic/episodic/procedural), and "importance" (1-10).
-
-Text: "${content}"
-
-Return only the JSON array, no other text. If no memorable facts, return [].`;
-  try {
-    const response = await openai.chat.completions.create({
-      model: "gpt-4o-mini",
-      messages: [{ role: "user", content: extractionPrompt }],
-      response_format: { type: "json_object" }
-    });
-    const extracted = JSON.parse(
-      response.choices[0].message.content || '{"memories":[]}'
-    );
-    const memoriesToStore = extracted.memories || extracted || [];
-    const storedMemories = [];
-    for (const mem of memoriesToStore) {
-      if (mem.content && mem.content.length > 5) {
-        const stored = await storeMemory({
-          userId,
-          content: mem.content,
-          type: mem.type || "semantic",
-          importance: mem.importance || 5,
-          source: "conversation",
-          provenance: "extraction:auto"
-        });
-        storedMemories.push(stored);
-      }
-    }
-    return storedMemories;
-  } catch (error) {
-    console.error("Error extracting memories:", error);
-    return [];
-  }
-}
-async function buildMemoryContext(query, userId, conversationHistory) {
-  const anyAdvancedEnabled = env.HYDE_ENABLED || env.RERANK_ENABLED || env.MULTISTEP_RAG_ENABLED || env.RETRIEVAL_CACHE_ENABLED || env.CONTEXTUAL_QUERY_ENABLED;
-  if (anyAdvancedEnabled) {
-    try {
-      const { enhancedRetrieve } = await import("./enhanced-retrieval-DNLLEM4Z.js");
-      const result = await enhancedRetrieve(query, { userId, limit: 5, conversationHistory });
-      if (result.results.length === 0) {
-        return "";
-      }
-      const memoryStrings2 = result.results.map((m) => {
-        const provenance = m.provenance ? ` [${m.provenance}]` : "";
-        const score = m.rerankScore != null ? `rerank: ${m.rerankScore}/10` : `relevance: ${((m.similarity || 0) * 100).toFixed(0)}%`;
-        return `- [${m.type}] ${m.content} (${score})${provenance}`;
-      });
-      return `
-
-Relevant memories about the user:
-${memoryStrings2.join("\n")}`;
-    } catch {
-    }
-  }
-  const relevantMemories = await searchMemories(query, userId, 5);
-  if (relevantMemories.length === 0) {
-    return "";
-  }
-  const memoryStrings = relevantMemories.map(
-    (m) => {
-      const provenance = m.provenance ? ` [${m.provenance}]` : "";
-      return `- [${m.type}] ${m.content} (relevance: ${(m.similarity * 100).toFixed(0)}%)${provenance}`;
-    }
-  );
-  return `
-
-Relevant memories about the user:
-${memoryStrings.join("\n")}`;
-}
-
-export {
-  decryptField,
-  generateEmbedding,
-  storeMemory,
-  updateMemory,
-  deleteMemory,
-  exportMemories,
-  searchMemories,
-  getMemoryById,
-  extractMemories,
-  buildMemoryContext
-};
-//# sourceMappingURL=chunk-IZJMVV7O.js.map

package/dist/chunk-IZJMVV7O.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/core/memory.ts","../src/core/security/field-encryption.ts"],"sourcesContent":["import { db, memories, archivedMemories, type NewMemory, type Memory } from \"../db\";\r\nimport { eq, desc, sql, and } from \"drizzle-orm\";\r\nimport OpenAI from \"openai\";\r\nimport { env } from \"../config/env\";\r\nimport { encryptField, decryptField, isEncryptionAvailable } from \"./security/field-encryption\";\r\n\r\n// Lazy OpenAI client — created on first use\r\nlet _openai: OpenAI | null = null;\r\nfunction getOpenAI(): OpenAI {\r\n  if (!_openai) {\r\n    _openai = new OpenAI({ apiKey: env.OPENAI_API_KEY });\r\n  }\r\n  return _openai;\r\n}\r\nconst openai = new Proxy({} as OpenAI, {\r\n  get(_target, prop) {\r\n    const instance = getOpenAI();\r\n    const value = (instance as any)[prop];\r\n    if (typeof value === \"function\") {\r\n      return value.bind(instance);\r\n    }\r\n    return value;\r\n  },\r\n});\r\n\r\n// Generate embedding for text using OpenAI\r\nexport async function generateEmbedding(text: string): Promise<number[]> {\r\n  const response = await openai.embeddings.create({\r\n    model: \"text-embedding-3-small\",\r\n    input: text,\r\n  });\r\n  return response.data[0].embedding;\r\n}\r\n\r\n// Store a new memory with embedding and tsvector\r\n// Content is encrypted at rest when ENCRYPTION_MASTER_KEY is configured\r\nexport async function storeMemory(\r\n  memory: Omit<NewMemory, \"embedding\" | \"searchVector\">\r\n): Promise<Memory> {\r\n  // Generate embedding from plaintext BEFORE encryption (vectors can't be encrypted)\r\n  const embedding = await generateEmbedding(memory.content);\r\n\r\n  // Encrypt content at rest if encryption is available\r\n  const shouldEncrypt = isEncryptionAvailable();\r\n  const contentForDb = shouldEncrypt ? encryptField(memory.content)! : memory.content;\r\n\r\n  const [stored] = await db\r\n    .insert(memories)\r\n    .values({\r\n      ...memory,\r\n      content: contentForDb,\r\n      encrypted: shouldEncrypt,\r\n      embedding,\r\n      provenance: memory.provenance || `${memory.source || \"unknown\"}:auto`,\r\n    })\r\n    .returning();\r\n\r\n  // Update tsvector for full-text search (uses plaintext for indexing)\r\n  try {\r\n    await db.execute(sql`\r\n      UPDATE memories\r\n      SET search_vector = to_tsvector('english', ${memory.content})\r\n      WHERE id = ${stored.id}\r\n    `);\r\n  } catch {\r\n    // tsvector update is non-critical\r\n  }\r\n\r\n  // Return with plaintext content (caller expects readable content)\r\n  return { ...stored, content: memory.content };\r\n}\r\n\r\n// Update an existing memory\r\nexport async function updateMemory(\r\n  id: string,\r\n  updates: { content?: string; type?: string; importance?: number }\r\n): Promise<Memory | null> {\r\n  // Build SET clause dynamically\r\n  const setClauses: any[] = [];\r\n  if (updates.content) {\r\n    const newEmbedding = await generateEmbedding(updates.content);\r\n    setClauses.push(sql`content = ${updates.content}`);\r\n    setClauses.push(sql`embedding = ${JSON.stringify(newEmbedding)}::vector`);\r\n    setClauses.push(sql`search_vector = to_tsvector('english', ${updates.content})`);\r\n  }\r\n  if (updates.type) {\r\n    setClauses.push(sql`type = ${updates.type}`);\r\n  }\r\n  if (updates.importance !== undefined) {\r\n    setClauses.push(sql`importance = ${updates.importance}`);\r\n  }\r\n\r\n  if (setClauses.length === 0) return null;\r\n\r\n  const result = await db.execute(sql`\r\n    UPDATE memories\r\n    SET ${sql.join(setClauses, sql`, `)}\r\n    WHERE id = ${id}\r\n    RETURNING *\r\n  `);\r\n\r\n  return (result as any[])[0] || null;\r\n}\r\n\r\n// Delete a memory (soft-delete: move to archived)\r\nexport async function deleteMemory(id: string): Promise<boolean> {\r\n  // Get the memory first\r\n  const result = await db.execute(sql`\r\n    SELECT * FROM memories WHERE id = ${id}\r\n  `);\r\n  const memory = (result as any[])[0];\r\n  if (!memory) return false;\r\n\r\n  // Archive it\r\n  await db.insert(archivedMemories).values({\r\n    originalMemoryId: memory.id,\r\n    userId: memory.user_id,\r\n    type: memory.type,\r\n    content: memory.content,\r\n    reason: \"user_request\",\r\n    originalCreatedAt: memory.created_at,\r\n  });\r\n\r\n  // Delete from active memories\r\n  await db.execute(sql`DELETE FROM memories WHERE id = ${id}`);\r\n\r\n  return true;\r\n}\r\n\r\n// Export memories as Markdown or JSON\r\nexport async function exportMemories(\r\n  userId?: string,\r\n  format: \"markdown\" | \"json\" = \"markdown\"\r\n): Promise<string> {\r\n  const mems = await db\r\n    .select()\r\n    .from(memories)\r\n    .where(userId ? eq(memories.userId, userId) : undefined)\r\n    .orderBy(desc(memories.createdAt));\r\n\r\n  // Decrypt encrypted memories\r\n  for (const m of mems) {\r\n    if ((m as any).encrypted) {\r\n      try {\r\n        (m as any).content = decryptField(m.content) ?? m.content;\r\n      } catch {\r\n        // If decryption fails, return as-is\r\n      }\r\n    }\r\n  }\r\n\r\n  if (format === \"json\") {\r\n    return JSON.stringify(\r\n      mems.map((m) => ({\r\n        id: m.id,\r\n        type: m.type,\r\n        content: m.content,\r\n        importance: m.importance,\r\n        source: m.source,\r\n        provenance: (m as any).provenance,\r\n        createdAt: m.createdAt,\r\n      })),\r\n      null,\r\n      2\r\n    );\r\n  }\r\n\r\n  // Markdown format\r\n  const lines = [\r\n    \"# Memories Export\",\r\n    `Exported: ${new Date().toISOString()}`,\r\n    `Total: ${mems.length} memories`,\r\n    \"\",\r\n  ];\r\n\r\n  for (const m of mems) {\r\n    lines.push(`## [${m.type}] (Importance: ${m.importance}/10)`);\r\n    lines.push(m.content);\r\n    lines.push(`_Source: ${m.source || \"unknown\"} | Created: ${m.createdAt.toISOString()}_`);\r\n    lines.push(\"\");\r\n  }\r\n\r\n  return lines.join(\"\\n\");\r\n}\r\n\r\n// Search memories by semantic similarity\r\nexport async function searchMemories(\r\n  query: string,\r\n  userId?: string,\r\n  limit = 5\r\n): Promise<Memory[]> {\r\n  const queryEmbedding = await generateEmbedding(query);\r\n\r\n  // Use pgvector cosine similarity search\r\n  const results = await db.execute(sql`\r\n    SELECT\r\n      id, user_id, type, content, importance, source, provenance, metadata,\r\n      last_accessed, created_at,\r\n      1 - (embedding <=> ${JSON.stringify(queryEmbedding)}::vector) as similarity\r\n    FROM memories\r\n    ${userId ? sql`WHERE user_id = ${userId}` : sql``}\r\n    ORDER BY embedding <=> ${JSON.stringify(queryEmbedding)}::vector\r\n    LIMIT ${limit}\r\n  `);\r\n\r\n  // Update last_accessed for retrieved memories\r\n  const rows = results as any[];\r\n  const memoryIds = rows.map((r: any) => r.id);\r\n  if (memoryIds.length > 0) {\r\n    await db.execute(sql`\r\n      UPDATE memories\r\n      SET last_accessed = NOW()\r\n      WHERE id = ANY(${memoryIds}::uuid[])\r\n    `);\r\n  }\r\n\r\n  // Decrypt content for any encrypted memories\r\n  for (const row of rows) {\r\n    if (row.encrypted) {\r\n      try {\r\n        row.content = decryptField(row.content) ?? row.content;\r\n      } catch {\r\n        // If decryption fails, return as-is\r\n      }\r\n    }\r\n  }\r\n\r\n  return rows as Memory[];\r\n}\r\n\r\n// Get a single memory by ID\r\nexport async function getMemoryById(id: string): Promise<Memory | null> {\r\n  const result = await db.execute(sql`\r\n    SELECT * FROM memories WHERE id = ${id}\r\n  `);\r\n  const row = (result as any[])[0] || null;\r\n  if (row && row.encrypted) {\r\n    try {\r\n      row.content = decryptField(row.content) ?? row.content;\r\n    } catch {\r\n      // If decryption fails, return as-is\r\n    }\r\n  }\r\n  return row;\r\n}\r\n\r\n// Get recent memories for a user\r\nexport async function getRecentMemories(\r\n  userId: string,\r\n  limit = 10\r\n): Promise<Memory[]> {\r\n  return db\r\n    .select()\r\n    .from(memories)\r\n    .where(eq(memories.userId, userId))\r\n    .orderBy(desc(memories.createdAt))\r\n    .limit(limit);\r\n}\r\n\r\n// Extract and store memories from a conversation turn\r\nexport async function extractMemories(\r\n  content: string,\r\n  userId?: string\r\n): Promise<Memory[]> {\r\n  // Use Claude to extract memorable facts\r\n  const extractionPrompt = `Analyze this text and extract any important facts that should be remembered about the user or their preferences. Return a JSON array of objects with \"content\" (the fact), \"type\" (semantic/episodic/procedural), and \"importance\" (1-10).\r\n\r\nText: \"${content}\"\r\n\r\nReturn only the JSON array, no other text. If no memorable facts, return [].`;\r\n\r\n  try {\r\n    const response = await openai.chat.completions.create({\r\n      model: \"gpt-4o-mini\",\r\n      messages: [{ role: \"user\", content: extractionPrompt }],\r\n      response_format: { type: \"json_object\" },\r\n    });\r\n\r\n    const extracted = JSON.parse(\r\n      response.choices[0].message.content || '{\"memories\":[]}'\r\n    );\r\n    const memoriesToStore = extracted.memories || extracted || [];\r\n\r\n    const storedMemories: Memory[] = [];\r\n    for (const mem of memoriesToStore) {\r\n      if (mem.content && mem.content.length > 5) {\r\n        const stored = await storeMemory({\r\n          userId,\r\n          content: mem.content,\r\n          type: mem.type || \"semantic\",\r\n          importance: mem.importance || 5,\r\n          source: \"conversation\",\r\n          provenance: \"extraction:auto\",\r\n        });\r\n        storedMemories.push(stored);\r\n      }\r\n    }\r\n\r\n    return storedMemories;\r\n  } catch (error) {\r\n    console.error(\"Error extracting memories:\", error);\r\n    return [];\r\n  }\r\n}\r\n\r\n// Build context string from relevant memories\r\nexport async function buildMemoryContext(\r\n  query: string,\r\n  userId?: string,\r\n  conversationHistory?: Array<{ role: \"user\" | \"assistant\"; content: string }>\r\n): Promise<string> {\r\n  // Use enhanced retrieval pipeline when any advanced RAG feature is enabled\r\n  const anyAdvancedEnabled = env.HYDE_ENABLED || env.RERANK_ENABLED ||\r\n    env.MULTISTEP_RAG_ENABLED || env.RETRIEVAL_CACHE_ENABLED || env.CONTEXTUAL_QUERY_ENABLED;\r\n\r\n  if (anyAdvancedEnabled) {\r\n    try {\r\n      const { enhancedRetrieve } = await import(\"./memory/enhanced-retrieval\");\r\n      const result = await enhancedRetrieve(query, { userId, limit: 5, conversationHistory });\r\n\r\n      if (result.results.length === 0) {\r\n        return \"\";\r\n      }\r\n\r\n      const memoryStrings = result.results.map((m: any) => {\r\n        const provenance = m.provenance ? ` [${m.provenance}]` : \"\";\r\n        const score = m.rerankScore != null\r\n          ? `rerank: ${m.rerankScore}/10`\r\n          : `relevance: ${((m.similarity || 0) * 100).toFixed(0)}%`;\r\n        return `- [${m.type}] ${m.content} (${score})${provenance}`;\r\n      });\r\n\r\n      return `\\n\\nRelevant memories about the user:\\n${memoryStrings.join(\"\\n\")}`;\r\n    } catch {\r\n      // Enhanced retrieval failed, fall back to basic search\r\n    }\r\n  }\r\n\r\n  // Fallback: basic vector search\r\n  const relevantMemories = await searchMemories(query, userId, 5);\r\n\r\n  if (relevantMemories.length === 0) {\r\n    return \"\";\r\n  }\r\n\r\n  const memoryStrings = relevantMemories.map(\r\n    (m: any) => {\r\n      const provenance = m.provenance ? ` [${m.provenance}]` : \"\";\r\n      return `- [${m.type}] ${m.content} (relevance: ${(m.similarity * 100).toFixed(0)}%)${provenance}`;\r\n    }\r\n  );\r\n\r\n  return `\\n\\nRelevant memories about the user:\\n${memoryStrings.join(\"\\n\")}`;\r\n}\r\n","/**\n * Field-Level Encryption for SOC 2 Compliance\n *\n * AES-256-GCM encryption for database column values.\n * Used to encrypt sensitive fields (messages, memories) at rest.\n *\n * Format: base64(keyVersion[1] + iv[16] + authTag[16] + ciphertext)\n */\n\nimport { createCipheriv, createDecipheriv, randomBytes } from \"crypto\";\nimport { env } from \"../../config/env\";\n\nconst ALGORITHM = \"aes-256-gcm\";\nconst IV_LENGTH = 16;\nconst TAG_LENGTH = 16;\nconst KEY_LENGTH = 32;\nconst CURRENT_KEY_VERSION = 1;\n\nlet _masterKey: Buffer | null = null;\n\nfunction getMasterKey(): Buffer {\n  if (_masterKey) return _masterKey;\n\n  const keyBase64 = env.ENCRYPTION_MASTER_KEY;\n\n  if (keyBase64) {\n    const key = Buffer.from(keyBase64, \"base64\");\n    if (key.length !== KEY_LENGTH) {\n      throw new Error(\n        `ENCRYPTION_MASTER_KEY must be ${KEY_LENGTH} bytes (${KEY_LENGTH * 4 / 3} base64 chars). Got ${key.length} bytes.`\n      );\n    }\n    _masterKey = key;\n    return _masterKey;\n  }\n\n  // No key configured — in production this is an error\n  if (env.NODE_ENV === \"production\") {\n    throw new Error(\n      \"ENCRYPTION_MASTER_KEY is required in production for SOC 2 compliance. \" +\n      \"Generate one with: node -e \\\"console.log(require('crypto').randomBytes(32).toString('base64'))\\\"\"\n    );\n  }\n\n  // Dev/test: generate ephemeral key (data won't survive restarts)\n  console.warn(\"[field-encryption] No ENCRYPTION_MASTER_KEY set — using ephemeral key (dev only)\");\n  _masterKey = randomBytes(KEY_LENGTH);\n  return _masterKey;\n}\n\n/**\n * Encrypt a field value using AES-256-GCM.\n * Returns base64(keyVersion + iv + authTag + ciphertext), or null if input is null.\n */\nexport function encryptField(plaintext: string | null): string | null {\n  if (plaintext === null || plaintext === undefined) return null;\n\n  const key = getMasterKey();\n  const iv = randomBytes(IV_LENGTH);\n  const cipher = createCipheriv(ALGORITHM, key, iv);\n\n  const encrypted = Buffer.concat([\n    cipher.update(plaintext, \"utf8\"),\n    cipher.final(),\n  ]);\n  const tag = cipher.getAuthTag();\n\n  // keyVersion (1 byte) + iv (16) + tag (16) + ciphertext\n  const combined = Buffer.concat([\n    Buffer.from([CURRENT_KEY_VERSION]),\n    iv,\n    tag,\n    encrypted,\n  ]);\n\n  return combined.toString(\"base64\");\n}\n\n/**\n * Decrypt a field value encrypted by encryptField().\n * Returns plaintext, or null if input is null.\n */\nexport function decryptField(encryptedBase64: string | null): string | null {\n  if (encryptedBase64 === null || encryptedBase64 === undefined) return null;\n\n  const combined = Buffer.from(encryptedBase64, \"base64\");\n\n  if (combined.length < 1 + IV_LENGTH + TAG_LENGTH + 1) {\n    throw new Error(\"Encrypted data too short\");\n  }\n\n  const keyVersion = combined[0];\n  if (keyVersion !== CURRENT_KEY_VERSION) {\n    throw new Error(`Unsupported encryption key version: ${keyVersion}`);\n  }\n\n  const iv = combined.subarray(1, 1 + IV_LENGTH);\n  const tag = combined.subarray(1 + IV_LENGTH, 1 + IV_LENGTH + TAG_LENGTH);\n  const ciphertext = combined.subarray(1 + IV_LENGTH + TAG_LENGTH);\n\n  const key = getMasterKey();\n  const decipher = createDecipheriv(ALGORITHM, key, iv);\n  decipher.setAuthTag(tag);\n\n  const decrypted = Buffer.concat([\n    decipher.update(ciphertext),\n    decipher.final(),\n  ]);\n\n  return decrypted.toString(\"utf8\");\n}\n\n/**\n * Encrypt multiple fields at once.\n */\nexport function encryptFields(\n  fields: Record<string, string | null>\n): Record<string, string | null> {\n  const result: Record<string, string | null> = {};\n  for (const [k, v] of Object.entries(fields)) {\n    result[k] = encryptField(v);\n  }\n  return result;\n}\n\n/**\n * Decrypt multiple fields at once.\n */\nexport function decryptFields(\n  fields: Record<string, string | null>\n): Record<string, string | null> {\n  const result: Record<string, string | null> = {};\n  for (const [k, v] of Object.entries(fields)) {\n    result[k] = decryptField(v);\n  }\n  return result;\n}\n\n/**\n * Generate a new random 32-byte encryption key, returned as base64.\n * Use this to create an ENCRYPTION_MASTER_KEY for .env.\n */\nexport function generateEncryptionKey(): string {\n  return randomBytes(KEY_LENGTH).toString(\"base64\");\n}\n\n/**\n * Check whether field encryption is available (master key is configured).\n */\nexport function isEncryptionAvailable(): boolean {\n  try {\n    getMasterKey();\n    return true;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;AACA,SAAS,IAAI,MAAM,WAAgB;AACnC,OAAO,YAAY;;;ACOnB,SAAS,gBAAgB,kBAAkB,mBAAmB;AAG9D,IAAM,YAAY;AAClB,IAAM,YAAY;AAClB,IAAM,aAAa;AACnB,IAAM,aAAa;AACnB,IAAM,sBAAsB;AAE5B,IAAI,aAA4B;AAEhC,SAAS,eAAuB;AAC9B,MAAI,WAAY,QAAO;AAEvB,QAAM,YAAY,IAAI;AAEtB,MAAI,WAAW;AACb,UAAM,MAAM,OAAO,KAAK,WAAW,QAAQ;AAC3C,QAAI,IAAI,WAAW,YAAY;AAC7B,YAAM,IAAI;AAAA,QACR,iCAAiC,UAAU,WAAW,aAAa,IAAI,CAAC,uBAAuB,IAAI,MAAM;AAAA,MAC3G;AAAA,IACF;AACA,iBAAa;AACb,WAAO;AAAA,EACT;AAGA,MAAI,IAAI,aAAa,cAAc;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAGA,UAAQ,KAAK,uFAAkF;AAC/F,eAAa,YAAY,UAAU;AACnC,SAAO;AACT;AAMO,SAAS,aAAa,WAAyC;AACpE,MAAI,cAAc,QAAQ,cAAc,OAAW,QAAO;AAE1D,QAAM,MAAM,aAAa;AACzB,QAAM,KAAK,YAAY,SAAS;AAChC,QAAM,SAAS,eAAe,WAAW,KAAK,EAAE;AAEhD,QAAM,YAAY,OAAO,OAAO;AAAA,IAC9B,OAAO,OAAO,WAAW,MAAM;AAAA,IAC/B,OAAO,MAAM;AAAA,EACf,CAAC;AACD,QAAM,MAAM,OAAO,WAAW;AAG9B,QAAM,WAAW,OAAO,OAAO;AAAA,IAC7B,OAAO,KAAK,CAAC,mBAAmB,CAAC;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO,SAAS,SAAS,QAAQ;AACnC;AAMO,SAAS,aAAa,iBAA+C;AAC1E,MAAI,oBAAoB,QAAQ,oBAAoB,OAAW,QAAO;AAEtE,QAAM,WAAW,OAAO,KAAK,iBAAiB,QAAQ;AAEtD,MAAI,SAAS,SAAS,IAAI,YAAY,aAAa,GAAG;AACpD,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,QAAM,aAAa,SAAS,CAAC;AAC7B,MAAI,eAAe,qBAAqB;AACtC,UAAM,IAAI,MAAM,uCAAuC,UAAU,EAAE;AAAA,EACrE;AAEA,QAAM,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS;AAC7C,QAAM,MAAM,SAAS,SAAS,IAAI,WAAW,IAAI,YAAY,UAAU;AACvE,QAAM,aAAa,SAAS,SAAS,IAAI,YAAY,UAAU;AAE/D,QAAM,MAAM,aAAa;AACzB,QAAM,WAAW,iBAAiB,WAAW,KAAK,EAAE;AACpD,WAAS,WAAW,GAAG;AAEvB,QAAM,YAAY,OAAO,OAAO;AAAA,IAC9B,SAAS,OAAO,UAAU;AAAA,IAC1B,SAAS,MAAM;AAAA,EACjB,CAAC;AAED,SAAO,UAAU,SAAS,MAAM;AAClC;AAuCO,SAAS,wBAAiC;AAC/C,MAAI;AACF,iBAAa;AACb,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ADrJA,IAAI,UAAyB;AAC7B,SAAS,YAAoB;AAC3B,MAAI,CAAC,SAAS;AACZ,cAAU,IAAI,OAAO,EAAE,QAAQ,IAAI,eAAe,CAAC;AAAA,EACrD;AACA,SAAO;AACT;AACA,IAAM,SAAS,IAAI,MAAM,CAAC,GAAa;AAAA,EACrC,IAAI,SAAS,MAAM;AACjB,UAAM,WAAW,UAAU;AAC3B,UAAM,QAAS,SAAiB,IAAI;AACpC,QAAI,OAAO,UAAU,YAAY;AAC/B,aAAO,MAAM,KAAK,QAAQ;AAAA,IAC5B;AACA,WAAO;AAAA,EACT;AACF,CAAC;AAGD,eAAsB,kBAAkB,MAAiC;AACvE,QAAM,WAAW,MAAM,OAAO,WAAW,OAAO;AAAA,IAC9C,OAAO;AAAA,IACP,OAAO;AAAA,EACT,CAAC;AACD,SAAO,SAAS,KAAK,CAAC,EAAE;AAC1B;AAIA,eAAsB,YACpB,QACiB;AAEjB,QAAM,YAAY,MAAM,kBAAkB,OAAO,OAAO;AAGxD,QAAM,gBAAgB,sBAAsB;AAC5C,QAAM,eAAe,gBAAgB,aAAa,OAAO,OAAO,IAAK,OAAO;AAE5E,QAAM,CAAC,MAAM,IAAI,MAAM,GACpB,OAAO,QAAQ,EACf,OAAO;AAAA,IACN,GAAG;AAAA,IACH,SAAS;AAAA,IACT,WAAW;AAAA,IACX;AAAA,IACA,YAAY,OAAO,cAAc,GAAG,OAAO,UAAU,SAAS;AAAA,EAChE,CAAC,EACA,UAAU;AAGb,MAAI;AACF,UAAM,GAAG,QAAQ;AAAA;AAAA,mDAE8B,OAAO,OAAO;AAAA,mBAC9C,OAAO,EAAE;AAAA,KACvB;AAAA,EACH,QAAQ;AAAA,EAER;AAGA,SAAO,EAAE,GAAG,QAAQ,SAAS,OAAO,QAAQ;AAC9C;AAGA,eAAsB,aACpB,IACA,SACwB;AAExB,QAAM,aAAoB,CAAC;AAC3B,MAAI,QAAQ,SAAS;AACnB,UAAM,eAAe,MAAM,kBAAkB,QAAQ,OAAO;AAC5D,eAAW,KAAK,gBAAgB,QAAQ,OAAO,EAAE;AACjD,eAAW,KAAK,kBAAkB,KAAK,UAAU,YAAY,CAAC,UAAU;AACxE,eAAW,KAAK,6CAA6C,QAAQ,OAAO,GAAG;AAAA,EACjF;AACA,MAAI,QAAQ,MAAM;AAChB,eAAW,KAAK,aAAa,QAAQ,IAAI,EAAE;AAAA,EAC7C;AACA,MAAI,QAAQ,eAAe,QAAW;AACpC,eAAW,KAAK,mBAAmB,QAAQ,UAAU,EAAE;AAAA,EACzD;AAEA,MAAI,WAAW,WAAW,EAAG,QAAO;AAEpC,QAAM,SAAS,MAAM,GAAG,QAAQ;AAAA;AAAA,UAExB,IAAI,KAAK,YAAY,OAAO,CAAC;AAAA,iBACtB,EAAE;AAAA;AAAA,GAEhB;AAED,SAAQ,OAAiB,CAAC,KAAK;AACjC;AAGA,eAAsB,aAAa,IAA8B;AAE/D,QAAM,SAAS,MAAM,GAAG,QAAQ;AAAA,wCACM,EAAE;AAAA,GACvC;AACD,QAAM,SAAU,OAAiB,CAAC;AAClC,MAAI,CAAC,OAAQ,QAAO;AAGpB,QAAM,GAAG,OAAO,gBAAgB,EAAE,OAAO;AAAA,IACvC,kBAAkB,OAAO;AAAA,IACzB,QAAQ,OAAO;AAAA,IACf,MAAM,OAAO;AAAA,IACb,SAAS,OAAO;AAAA,IAChB,QAAQ;AAAA,IACR,mBAAmB,OAAO;AAAA,EAC5B,CAAC;AAGD,QAAM,GAAG,QAAQ,sCAAsC,EAAE,EAAE;AAE3D,SAAO;AACT;AAGA,eAAsB,eACpB,QACA,SAA8B,YACb;AACjB,QAAM,OAAO,MAAM,GAChB,OAAO,EACP,KAAK,QAAQ,EACb,MAAM,SAAS,GAAG,SAAS,QAAQ,MAAM,IAAI,MAAS,EACtD,QAAQ,KAAK,SAAS,SAAS,CAAC;AAGnC,aAAW,KAAK,MAAM;AACpB,QAAK,EAAU,WAAW;AACxB,UAAI;AACF,QAAC,EAAU,UAAU,aAAa,EAAE,OAAO,KAAK,EAAE;AAAA,MACpD,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,MAAI,WAAW,QAAQ;AACrB,WAAO,KAAK;AAAA,MACV,KAAK,IAAI,CAAC,OAAO;AAAA,QACf,IAAI,EAAE;AAAA,QACN,MAAM,EAAE;AAAA,QACR,SAAS,EAAE;AAAA,QACX,YAAY,EAAE;AAAA,QACd,QAAQ,EAAE;AAAA,QACV,YAAa,EAAU;AAAA,QACvB,WAAW,EAAE;AAAA,MACf,EAAE;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,cAAa,oBAAI,KAAK,GAAE,YAAY,CAAC;AAAA,IACrC,UAAU,KAAK,MAAM;AAAA,IACrB;AAAA,EACF;AAEA,aAAW,KAAK,MAAM;AACpB,UAAM,KAAK,OAAO,EAAE,IAAI,kBAAkB,EAAE,UAAU,MAAM;AAC5D,UAAM,KAAK,EAAE,OAAO;AACpB,UAAM,KAAK,YAAY,EAAE,UAAU,SAAS,eAAe,EAAE,UAAU,YAAY,CAAC,GAAG;AACvF,UAAM,KAAK,EAAE;AAAA,EACf;AAEA,SAAO,MAAM,KAAK,IAAI;AACxB;AAGA,eAAsB,eACpB,OACA,QACA,QAAQ,GACW;AACnB,QAAM,iBAAiB,MAAM,kBAAkB,KAAK;AAGpD,QAAM,UAAU,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA,2BAIR,KAAK,UAAU,cAAc,CAAC;AAAA;AAAA,MAEnD,SAAS,sBAAsB,MAAM,KAAK,KAAK;AAAA,6BACxB,KAAK,UAAU,cAAc,CAAC;AAAA,YAC/C,KAAK;AAAA,GACd;AAGD,QAAM,OAAO;AACb,QAAM,YAAY,KAAK,IAAI,CAAC,MAAW,EAAE,EAAE;AAC3C,MAAI,UAAU,SAAS,GAAG;AACxB,UAAM,GAAG,QAAQ;AAAA;AAAA;AAAA,uBAGE,SAAS;AAAA,KAC3B;AAAA,EACH;AAGA,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,WAAW;AACjB,UAAI;AACF,YAAI,UAAU,aAAa,IAAI,OAAO,KAAK,IAAI;AAAA,MACjD,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAGA,eAAsB,cAAc,IAAoC;AACtE,QAAM,SAAS,MAAM,GAAG,QAAQ;AAAA,wCACM,EAAE;AAAA,GACvC;AACD,QAAM,MAAO,OAAiB,CAAC,KAAK;AACpC,MAAI,OAAO,IAAI,WAAW;AACxB,QAAI;AACF,UAAI,UAAU,aAAa,IAAI,OAAO,KAAK,IAAI;AAAA,IACjD,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAgBA,eAAsB,gBACpB,SACA,QACmB;AAEnB,QAAM,mBAAmB;AAAA;AAAA,SAElB,OAAO;AAAA;AAAA;AAId,MAAI;AACF,UAAM,WAAW,MAAM,OAAO,KAAK,YAAY,OAAO;AAAA,MACpD,OAAO;AAAA,MACP,UAAU,CAAC,EAAE,MAAM,QAAQ,SAAS,iBAAiB,CAAC;AAAA,MACtD,iBAAiB,EAAE,MAAM,cAAc;AAAA,IACzC,CAAC;AAED,UAAM,YAAY,KAAK;AAAA,MACrB,SAAS,QAAQ,CAAC,EAAE,QAAQ,WAAW;AAAA,IACzC;AACA,UAAM,kBAAkB,UAAU,YAAY,aAAa,CAAC;AAE5D,UAAM,iBAA2B,CAAC;AAClC,eAAW,OAAO,iBAAiB;AACjC,UAAI,IAAI,WAAW,IAAI,QAAQ,SAAS,GAAG;AACzC,cAAM,SAAS,MAAM,YAAY;AAAA,UAC/B;AAAA,UACA,SAAS,IAAI;AAAA,UACb,MAAM,IAAI,QAAQ;AAAA,UAClB,YAAY,IAAI,cAAc;AAAA,UAC9B,QAAQ;AAAA,UACR,YAAY;AAAA,QACd,CAAC;AACD,uBAAe,KAAK,MAAM;AAAA,MAC5B;AAAA,IACF;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,YAAQ,MAAM,8BAA8B,KAAK;AACjD,WAAO,CAAC;AAAA,EACV;AACF;AAGA,eAAsB,mBACpB,OACA,QACA,qBACiB;AAEjB,QAAM,qBAAqB,IAAI,gBAAgB,IAAI,kBACjD,IAAI,yBAAyB,IAAI,2BAA2B,IAAI;AAElE,MAAI,oBAAoB;AACtB,QAAI;AACF,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,kCAA6B;AACvE,YAAM,SAAS,MAAM,iBAAiB,OAAO,EAAE,QAAQ,OAAO,GAAG,oBAAoB,CAAC;AAEtF,UAAI,OAAO,QAAQ,WAAW,GAAG;AAC/B,eAAO;AAAA,MACT;AAEA,YAAMA,iBAAgB,OAAO,QAAQ,IAAI,CAAC,MAAW;AACnD,cAAM,aAAa,EAAE,aAAa,KAAK,EAAE,UAAU,MAAM;AACzD,cAAM,QAAQ,EAAE,eAAe,OAC3B,WAAW,EAAE,WAAW,QACxB,gBAAgB,EAAE,cAAc,KAAK,KAAK,QAAQ,CAAC,CAAC;AACxD,eAAO,MAAM,EAAE,IAAI,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,UAAU;AAAA,MAC3D,CAAC;AAED,aAAO;AAAA;AAAA;AAAA,EAA0CA,eAAc,KAAK,IAAI,CAAC;AAAA,IAC3E,QAAQ;AAAA,IAER;AAAA,EACF;AAGA,QAAM,mBAAmB,MAAM,eAAe,OAAO,QAAQ,CAAC;AAE9D,MAAI,iBAAiB,WAAW,GAAG;AACjC,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,iBAAiB;AAAA,IACrC,CAAC,MAAW;AACV,YAAM,aAAa,EAAE,aAAa,KAAK,EAAE,UAAU,MAAM;AACzD,aAAO,MAAM,EAAE,IAAI,KAAK,EAAE,OAAO,iBAAiB,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,KAAK,UAAU;AAAA,IACjG;AAAA,EACF;AAEA,SAAO;AAAA;AAAA;AAAA,EAA0C,cAAc,KAAK,IAAI,CAAC;AAC3E;","names":["memoryStrings"]}