npm - comisai - Versions diffs - 1.0.33 → 1.0.36 - Mend

comisai 1.0.33 → 1.0.36

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (285) hide show

package/node_modules/@comis/gateway/dist/oauth/oauth-callback-route.js ADDED Viewed

@@ -0,0 +1,212 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * OAuth callback route for the Comis gateway.
+ *
+ * Mounted at `GET /callback/:provider` via `app.route("/oauth", subApp)`. The
+ * handler validates code+state, looks up the state in the in-memory pending-
+ * flow map, verifies path-vs-flow provider match, deletes the entry BEFORE
+ * the token exchange (one-time-use invariant), exchanges the code at
+ * auth.openai.com/oauth/token, resolves identity via
+ * resolveCodexAuthIdentity, persists via OAuthCredentialStorePort.set, emits
+ * auth:profile_bootstrapped, and returns a static "Login Successful" HTML
+ * page (200) on success or a "Login Failed" HTML page (400/500) on failure.
+ *
+ * HTTP method is GET, NOT POST (OAuth servers always redirect with GET).
+ * Logging discipline (CLAUDE.md): submodule: "oauth-callback"
+ * on every line; NEVER log code/state/verifier/access/refresh values.
+ *
+ * @module
+ */
+import { Hono } from "hono";
+import { resolveCodexAuthIdentity, rewriteOAuthError, redactEmailForLog, } from "@comis/agent";
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** 5-minute pending-flow expiry. Exported for test parity. */
+export const PENDING_FLOW_TIMEOUT_MS = 5 * 60_000;
+/** OpenAI Codex token endpoint — same as oauth-token-manager.ts:301. */
+const OPENAI_TOKEN_URL = "https://auth.openai.com/oauth/token";
+/** Public OpenAI Codex client_id (NOT a comis secret — per pi-ai source). */
+const OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+/** Redirect URI matches pi-ai device-callback convention. */
+const OPENAI_CODEX_DEVICE_CALLBACK_URL = "https://auth.openai.com/deviceauth/callback";
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+function escapeHtml(s) {
+    return s
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+function oauthSuccessHtml(message) {
+    return [
+        "<!DOCTYPE html>",
+        '<html><head><meta charset="utf-8"><title>Login Successful</title>',
+        "<style>body{font-family:system-ui,sans-serif;max-width:480px;margin:8em auto;padding:2em;text-align:center;color:#222}h1{color:#0a7d2c}</style>",
+        "</head><body><h1>Login Successful</h1>",
+        `<p>${escapeHtml(message)}</p>`,
+        "<p>You can close this window.</p>",
+        "</body></html>",
+    ].join("");
+}
+function oauthErrorHtml(message) {
+    return [
+        "<!DOCTYPE html>",
+        '<html><head><meta charset="utf-8"><title>Login Failed</title>',
+        "<style>body{font-family:system-ui,sans-serif;max-width:480px;margin:8em auto;padding:2em;text-align:center;color:#222}h1{color:#b00020}</style>",
+        "</head><body><h1>Login Failed</h1>",
+        `<p>${escapeHtml(message)}</p>`,
+        "</body></html>",
+    ].join("");
+}
+/**
+ * Exchange an authorization_code at OpenAI's /oauth/token endpoint.
+ *
+ * Mirrors refreshOpenAICodexTokenLocal (oauth-token-manager.ts:298-385) but
+ * uses grant_type=authorization_code with code + code_verifier. Throws on
+ * non-OK status; the public boundary catches and routes through
+ * rewriteOAuthError.
+ */
+async function exchangeAuthorizationCode(params) {
+    const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        code: params.code,
+        redirect_uri: OPENAI_CODEX_DEVICE_CALLBACK_URL,
+        client_id: OPENAI_CODEX_CLIENT_ID,
+        code_verifier: params.verifier,
+    });
+    const response = await fetch(OPENAI_TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body,
+    });
+    if (!response.ok) {
+        let bodyText = "";
+        try {
+            bodyText = await response.text();
+        }
+        catch {
+            /* defensive — body read may fail */
+        }
+        // Surface the wire error verbatim so rewriteOAuthError can detect
+        // invalid_grant / unsupported_country_region_territory substrings.
+        throw new Error(`OAuth token exchange failed: HTTP ${response.status} ${bodyText}`);
+    }
+    const json = (await response.json());
+    return {
+        access: json.access_token,
+        refresh: json.refresh_token,
+        expires: Date.now() + json.expires_in * 1000,
+    };
+}
+// ---------------------------------------------------------------------------
+// Public boundary
+// ---------------------------------------------------------------------------
+/**
+ * Seed the pending-flow map with a new state -> PendingFlow entry, scheduling
+ * a 5-minute auto-delete cleanup timer.
+ *
+ * The caller is responsible for generating `state` via crypto.randomBytes(16)
+ * — never hand-roll a PRNG.
+ */
+export function insertPendingFlow(map, state, flow, logger) {
+    const timer = setTimeout(() => {
+        map.delete(state);
+        logger.debug({ provider: flow.provider, submodule: "oauth-callback" }, "Pending OAuth flow expired");
+    }, PENDING_FLOW_TIMEOUT_MS);
+    map.set(state, { ...flow, timer });
+}
+/**
+ * Create the OAuth callback Hono sub-app.
+ *
+ * Mount via:
+ *   const app = new Hono();
+ *   app.route("/oauth", createOAuthCallbackRoute(deps));
+ * Resulting URL: GET /oauth/callback/:provider
+ */
+export function createOAuthCallbackRoute(deps) {
+    const app = new Hono();
+    app.get("/callback/:provider", async (c) => {
+        const provider = c.req.param("provider");
+        const code = c.req.query("code");
+        const state = c.req.query("state");
+        if (!state || !code) {
+            return c.html(oauthErrorHtml("Missing code or state parameter"), 400);
+        }
+        const flow = deps.pendingFlows.get(state);
+        if (!flow) {
+            // No log — stale browser tab is a benign user error (debug-level
+            // logging acceptable but not required by tests; keep silent here).
+            return c.html(oauthErrorHtml("Invalid or expired state"), 400);
+        }
+        if (flow.provider !== provider) {
+            // Preserve the entry — the legitimate provider's callback may still
+            // arrive.
+            return c.html(oauthErrorHtml("Provider mismatch"), 400);
+        }
+        // One-time-use: cancel the timer + remove the entry BEFORE the
+        // exchange so even a failed exchange does not leave a reusable state.
+        clearTimeout(flow.timer);
+        deps.pendingFlows.delete(state);
+        try {
+            const tokens = await exchangeAuthorizationCode({
+                code,
+                verifier: flow.verifier,
+            });
+            const identity = resolveCodexAuthIdentity({
+                accessToken: tokens.access,
+            });
+            const identityKey = identity.email ?? identity.profileName;
+            if (!identityKey) {
+                // Treat as identity_decode_failed; rewriteOAuthError will route
+                // the substring "Failed to extract accountId" to the right code.
+                throw new Error("Failed to extract accountId — identity decode failed");
+            }
+            const profileId = `${provider}:${identityKey}`;
+            const profile = {
+                provider,
+                profileId,
+                access: tokens.access,
+                refresh: tokens.refresh,
+                expires: tokens.expires,
+                email: identity.email,
+                displayName: identity.profileName,
+                version: 1,
+            };
+            const writeResult = await deps.credentialStore.set(profileId, profile);
+            if (!writeResult.ok) {
+                throw new Error(`Failed to persist OAuth profile: ${writeResult.error.message}`);
+            }
+            const identityForEvent = redactEmailForLog(identity.email) ??
+                identity.profileName ??
+                identityKey;
+            deps.eventBus.emit("auth:profile_bootstrapped", {
+                provider,
+                profileId,
+                identity: identityForEvent,
+                timestamp: Date.now(),
+            });
+            deps.logger.info({
+                provider,
+                profileId,
+                identity: identityForEvent,
+                submodule: "oauth-callback",
+            }, "Gateway OAuth callback success");
+            return c.html(oauthSuccessHtml("Login successful — you can close this window and return to Comis."));
+        }
+        catch (caught) {
+            const rewritten = rewriteOAuthError(caught);
+            deps.logger.warn({
+                provider,
+                errorKind: rewritten.errorKind,
+                hint: rewritten.hint,
+                submodule: "oauth-callback",
+            }, "OAuth callback exchange failed");
+            return c.html(oauthErrorHtml(rewritten.userMessage), 500);
+        }
+    });
+    return app;
+}

package/node_modules/@comis/gateway/dist/server/hono-server.d.ts CHANGED Viewed

@@ -7,6 +7,8 @@ import type { HmacAlgorithm } from "../webhook/hmac-verifier.js";
 import { type TokenStore } from "../auth/token-auth.js";
 import { WsConnectionManager } from "../rpc/ws-handler.js";
 import { type WebhookHandler } from "../webhook/webhook-endpoint.js";
+import { type PendingFlow } from "../oauth/oauth-callback-route.js";
+import type { OAuthCredentialStorePort } from "@comis/core";
 /**
  * Logger interface for gateway server (minimal pino-compatible).
  */
@@ -41,6 +43,18 @@ export interface GatewayServerDeps {
         algorithm?: HmacAlgorithm;
         headerName?: string;
     };
+    /**
+     * Optional OAuth callback deps. When provided, the gateway mounts
+     * GET /oauth/callback/:provider for browser-redirect OAuth flows
+     * (web-UI-initiated logins). Pending-flow map is owned by the caller
+     * (e.g., setup-gateway.ts) so daemon restart cleanly drops all in-flight
+     * states.
+     */
+    readonly oauthCallbackDeps?: {
+        credentialStore: OAuthCredentialStorePort;
+        eventBus: TypedEventBus;
+        pendingFlows: Map<string, PendingFlow>;
+    };
     /** Optional hook runner for lifecycle hooks (no-op when absent) */
     readonly hookRunner?: HookRunner;
     /** Optional web dashboard deps (mount REST/SSE/static when provided) */

package/node_modules/@comis/gateway/dist/server/hono-server.js CHANGED Viewed

@@ -14,6 +14,7 @@ import { createRestApi, ActivityRingBuffer, subscribeActivityBuffer } from "../w
 import { createSseEndpoint } from "../web/sse-endpoint.js";
 import { createStaticMiddleware } from "../web/static-middleware.js";
 import { createWebhookEndpoint } from "../webhook/webhook-endpoint.js";
+import { createOAuthCallbackRoute, } from "../oauth/oauth-callback-route.js";
 /**
  * Create a gateway server with Hono.
  *
@@ -123,6 +124,15 @@ export function createGatewayServer(deps) {
         const webhookApp = createWebhookEndpoint(deps.webhookDeps);
         app.route("/hooks", webhookApp);
     }
+    // Mount OAuth callback at GET /oauth/callback/:provider
+    if (deps.oauthCallbackDeps) {
+        const oauthApp = createOAuthCallbackRoute({
+            ...deps.oauthCallbackDeps,
+            logger,
+        });
+        app.route("/oauth", oauthApp);
+        logger.debug({ submodule: "oauth-callback" }, "OAuth callback route mounted at /oauth/callback/:provider");
+    }
     // Mount web dashboard routes (if configured)
     let unsubscribeActivity;
     if (deps.webDeps) {

package/node_modules/@comis/gateway/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "name": "@comis/gateway",
   "private": true,
-  "version": "1.0.33",
+  "version": "1.0.36",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "HTTP, JSON-RPC, and WebSocket gateway for Comis",

package/node_modules/@comis/infra/dist/logging/log-fields.d.ts CHANGED Viewed

@@ -73,6 +73,29 @@ export interface LogFields {
      * that produced it.
      */
     module: string;
+    /**
+     * Finer-grained scope inside an existing `module` binding.
+     *
+     * Use at call sites instead of overriding `module:` in the payload.
+     * Pino concatenates parent-bound fields (pre-serialized JSON fragment)
+     * with the call-site object without deduplication, so passing
+     * `{ module: "agent.bridge.X" }` against a parent already bound with
+     * `module: "agent"` emits BOTH keys on the same line. JSON parsers
+     * keep the last, but the polluted output wastes bytes and confuses
+     * log consumers.
+     *
+     * `submodule` sidesteps the duplicate-key emission entirely:
+     * @example
+     *   logger.info(
+     *     { submodule: "bridge.hash-invariant", agentId, durationMs },
+     *     "Hash invariant assertion ran",
+     *   );
+     *
+     * Convention: omit any redundant parent-prefix from the value
+     * (e.g., under `module: "agent"`, prefer `submodule: "bridge.X"`
+     * over `submodule: "agent.bridge.X"`).
+     */
+    submodule: string;
     /**
      * Pipeline step name.
      * @example "response-filter" | "chunking" | "markdown-ir" | "media-compress"

package/node_modules/@comis/infra/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "name": "@comis/infra",
   "private": true,
-  "version": "1.0.33",
+  "version": "1.0.36",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Structured logging infrastructure for Comis",

package/node_modules/@comis/memory/dist/compaction.d.ts CHANGED Viewed

@@ -5,9 +5,8 @@
  * into semantic memories, keeping working memory bounded while preserving
  * important information.
  *
- * The summarizer is pluggable -- the actual LLM call will be wired in
- * Phase 3 (Agent). This module defines the interface and orchestrates
- * the compaction workflow.
+ * The summarizer is pluggable -- this module defines the interface and
+ * orchestrates the compaction workflow.
  *
  * Workflow:
  * 1. Find sessions idle for longer than minIdleMs
@@ -25,8 +24,7 @@ import type { SessionStore } from "./session-store.js";
 import type { SqliteMemoryAdapter } from "./sqlite-memory-adapter.js";
 /**
  * Pluggable summarizer function. Takes conversation messages and returns
- * a summary string plus extracted facts. The actual LLM call is wired
- * in Phase 3 (Agent).
+ * a summary string plus extracted facts.
  */
 export type Summarizer = (messages: unknown[]) => Promise<{
     summary: string;

package/node_modules/@comis/memory/dist/compaction.js CHANGED Viewed

@@ -6,9 +6,8 @@
  * into semantic memories, keeping working memory bounded while preserving
  * important information.
  *
- * The summarizer is pluggable -- the actual LLM call will be wired in
- * Phase 3 (Agent). This module defines the interface and orchestrates
- * the compaction workflow.
+ * The summarizer is pluggable -- this module defines the interface and
+ * orchestrates the compaction workflow.
  *
  * Workflow:
  * 1. Find sessions idle for longer than minIdleMs

package/node_modules/@comis/memory/dist/delivery-queue-adapter.d.ts CHANGED Viewed

@@ -8,7 +8,7 @@
  * @module
  */
 import type Database from "better-sqlite3";
-import type { DeliveryQueuePort } from "@comis/core";
+import type { DeliveryQueuePort, TypedEventBus } from "@comis/core";
 /**
  * Create a SQLite-backed DeliveryQueuePort.
  *
@@ -18,4 +18,4 @@ import type { DeliveryQueuePort } from "@comis/core";
  * @param db - An open better-sqlite3 Database instance
  * @returns DeliveryQueuePort implementation (frozen)
  */
-export declare function createSqliteDeliveryQueue(db: Database.Database): DeliveryQueuePort;
+export declare function createSqliteDeliveryQueue(db: Database.Database, eventBus: Pick<TypedEventBus, "emit">): DeliveryQueuePort;

package/node_modules/@comis/memory/dist/delivery-queue-adapter.js CHANGED Viewed

@@ -50,7 +50,7 @@ function rowToEntry(row) {
  * @param db - An open better-sqlite3 Database instance
  * @returns DeliveryQueuePort implementation (frozen)
  */
-export function createSqliteDeliveryQueue(db) {
+export function createSqliteDeliveryQueue(db, eventBus) {
     // --- Prepared statements ---
     const insertStmt = db.prepare(`
     INSERT INTO delivery_queue (
@@ -87,6 +87,19 @@ export function createSqliteDeliveryQueue(db) {
     const pruneStmt = db.prepare(`
     DELETE FROM delivery_queue
     WHERE expire_at < ? AND status NOT IN ('delivered')
+  `);
+    const insertInFlightStmt = db.prepare(`
+    INSERT INTO delivery_queue (
+      id, text, channel_type, channel_id, tenant_id, options_json, origin,
+      format_applied, chunking_applied, status, attempt_count, max_attempts,
+      created_at, scheduled_at, expire_at, last_attempt_at, next_retry_at,
+      last_error, markdown_fallback_applied, delivered_message_id, trace_id
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'in_flight', 0, ?, ?, ?, ?, NULL, NULL, NULL, 0, NULL, ?)
+  `);
+    const recoverInFlightStmt = db.prepare(`
+    UPDATE delivery_queue
+    SET status = 'pending', last_error = NULL
+    WHERE status = 'in_flight'
   `);
     const depthStmt = db.prepare(`
     SELECT COUNT(*) as count FROM delivery_queue
@@ -103,6 +116,32 @@ export function createSqliteDeliveryQueue(db) {
             try {
                 const id = randomUUID();
                 insertStmt.run(id, entry.text, entry.channelType, entry.channelId, entry.tenantId, entry.optionsJson, entry.origin, entry.formatApplied ? 1 : 0, entry.chunkingApplied ? 1 : 0, entry.maxAttempts, entry.createdAt, entry.scheduledAt, entry.expireAt, entry.traceId ?? null);
+                // Emit AFTER SQL success -- preserves invariant: one delivery:enqueued <=> one persisted row.
+                eventBus.emit("delivery:enqueued", {
+                    entryId: id,
+                    channelId: entry.channelId,
+                    channelType: entry.channelType,
+                    origin: entry.origin,
+                    timestamp: Date.now(),
+                });
+                return Promise.resolve(ok(id));
+            }
+            catch (e) {
+                return Promise.resolve(err(e instanceof Error ? e : new Error(String(e))));
+            }
+        },
+        enqueueInFlight(entry) {
+            try {
+                const id = randomUUID();
+                insertInFlightStmt.run(id, entry.text, entry.channelType, entry.channelId, entry.tenantId, entry.optionsJson, entry.origin, entry.formatApplied ? 1 : 0, entry.chunkingApplied ? 1 : 0, entry.maxAttempts, entry.createdAt, entry.scheduledAt, entry.expireAt, entry.traceId ?? null);
+                // Same delivery:enqueued event as enqueue() -- universal observability (SPEC-R5).
+                eventBus.emit("delivery:enqueued", {
+                    entryId: id,
+                    channelId: entry.channelId,
+                    channelType: entry.channelType,
+                    origin: entry.origin,
+                    timestamp: Date.now(),
+                });
                 return Promise.resolve(ok(id));
             }
             catch (e) {
@@ -192,6 +231,15 @@ export function createSqliteDeliveryQueue(db) {
                 return Promise.resolve(err(e instanceof Error ? e : new Error(String(e))));
             }
         },
+        recoverInFlight() {
+            try {
+                const result = recoverInFlightStmt.run();
+                return Promise.resolve(ok(result.changes));
+            }
+            catch (e) {
+                return Promise.resolve(err(e instanceof Error ? e : new Error(String(e))));
+            }
+        },
     };
     return Object.freeze(queue);
 }

package/node_modules/@comis/memory/dist/index.d.ts CHANGED Viewed

@@ -22,6 +22,8 @@ export type { BatchIndexer, BatchIndexerOptions, BatchIndexerResult } from "./em
 export { openSqliteDatabase, chmodDbFiles } from "./sqlite-adapter-base.js";
 export type { SqliteAdapterOptions } from "./sqlite-adapter-base.js";
 export { createSqliteSecretStore } from "./sqlite-secret-store.js";
+export { initOAuthProfileSchema } from "./oauth-profile-schema.js";
+export { createOAuthProfileStoreEncrypted } from "./oauth-profile-store-encrypted.js";
 export { setupSecrets } from "./setup-secrets.js";
 export type { SecretsBootResult } from "./setup-secrets.js";
 export { createNamedGraphStore } from "./named-graph-store.js";

package/node_modules/@comis/memory/dist/index.js CHANGED Viewed

@@ -28,6 +28,9 @@ export { createBatchIndexer } from "./embedding-batch-indexer.js";
 export { openSqliteDatabase, chmodDbFiles } from "./sqlite-adapter-base.js";
 // SQLite secret store (SecretStorePort implementation)
 export { createSqliteSecretStore } from "./sqlite-secret-store.js";
+// OAuth profile schema + encrypted SQLite OAuthCredentialStorePort adapter
+export { initOAuthProfileSchema } from "./oauth-profile-schema.js";
+export { createOAuthProfileStoreEncrypted } from "./oauth-profile-store-encrypted.js";
 // Secret store bootstrap (master key resolution)
 export { setupSecrets } from "./setup-secrets.js";
 // Named graph store (server-side pipeline persistence)

package/node_modules/@comis/memory/dist/memory-api.d.ts CHANGED Viewed

@@ -80,6 +80,6 @@ export interface MemoryApi {
  * and memory config.
  *
  * The factory function pattern is consistent with createSessionStore and
- * createSecretManager from Phase 1.
+ * createSecretManager.
  */
 export declare function createMemoryApi(db: Database.Database, adapter: SqliteMemoryAdapter, sessionStore: SessionStore, config: MemoryConfig): MemoryApi;

package/node_modules/@comis/memory/dist/memory-api.js CHANGED Viewed

@@ -16,7 +16,7 @@ import { rowToEntry, buildFilterClause, countRows, groupCountRows } from "./row-
  * and memory config.
  *
  * The factory function pattern is consistent with createSessionStore and
- * createSecretManager from Phase 1.
+ * createSecretManager.
  */
 export function createMemoryApi(db, adapter, sessionStore, config) {
     return {

package/node_modules/@comis/memory/dist/oauth-profile-schema.d.ts ADDED Viewed

@@ -0,0 +1,17 @@
+import type Database from "better-sqlite3";
+/**
+ * Create the oauth_profiles table and supporting index.
+ *
+ * Single ciphertext+iv+auth_tag+salt per row — entire OAuthProfile JSON
+ * encrypted as one blob, no half-rotated state.
+ *
+ * Denormalized expires_at column lets the doctor query expiring profiles
+ * via SELECT profile_id FROM oauth_profiles WHERE provider = ?
+ * AND expires_at < ? without decrypting any blob.
+ *
+ * No FK to secrets table — OAuth profiles are independent from named
+ * secrets. Index on provider supports list({ provider }) filtering.
+ *
+ * Idempotent via IF NOT EXISTS — safe to call multiple times.
+ */
+export declare function initOAuthProfileSchema(db: Database.Database): void;

package/node_modules/@comis/memory/dist/oauth-profile-schema.js ADDED Viewed

@@ -0,0 +1,33 @@
+/**
+ * Create the oauth_profiles table and supporting index.
+ *
+ * Single ciphertext+iv+auth_tag+salt per row — entire OAuthProfile JSON
+ * encrypted as one blob, no half-rotated state.
+ *
+ * Denormalized expires_at column lets the doctor query expiring profiles
+ * via SELECT profile_id FROM oauth_profiles WHERE provider = ?
+ * AND expires_at < ? without decrypting any blob.
+ *
+ * No FK to secrets table — OAuth profiles are independent from named
+ * secrets. Index on provider supports list({ provider }) filtering.
+ *
+ * Idempotent via IF NOT EXISTS — safe to call multiple times.
+ */
+export function initOAuthProfileSchema(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS oauth_profiles (
+      profile_id              TEXT PRIMARY KEY,
+      provider                TEXT NOT NULL,
+      identity                TEXT NOT NULL,
+      credentials_ciphertext  BLOB NOT NULL,
+      credentials_iv          BLOB NOT NULL,
+      credentials_auth_tag    BLOB NOT NULL,
+      credentials_salt        BLOB NOT NULL,
+      expires_at              INTEGER NOT NULL,
+      version                 INTEGER NOT NULL DEFAULT 1,
+      created_at              INTEGER NOT NULL,
+      updated_at              INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_oauth_profiles_provider ON oauth_profiles(provider);
+  `);
+}

package/node_modules/@comis/memory/dist/oauth-profile-store-encrypted.d.ts ADDED Viewed

@@ -0,0 +1,27 @@
+/**
+ * Encrypted SQLite-backed OAuthCredentialStorePort adapter.
+ *
+ * Mirrors credential-mapping-store's factory pattern (takes a pre-opened
+ * Database instance, does NOT open its own). The lifecycle is owned by
+ * the caller — we share the existing secrets.db connection to keep all
+ * encrypted-at-rest data in one DB file.
+ *
+ * The entire OAuthProfile JSON payload is encrypted as one AES-256-GCM
+ * blob per row. One ciphertext+iv+authTag+salt set per profile. Atomic
+ * update — no half-rotated state where access changes but refresh doesn't.
+ *
+ * Denormalized expires_at column stays in sync on every write so the
+ * doctor can query expiring profiles without decrypting any blob.
+ *
+ * @module
+ */
+import type Database from "better-sqlite3";
+import type { OAuthCredentialStorePort, SecretsCrypto } from "@comis/core";
+/**
+ * Create an encrypted OAuthCredentialStorePort backed by a shared SQLite DB.
+ *
+ * The adapter does NOT own the db lifecycle — the caller supplies an
+ * already-open Database (typically the secrets.db chain). Initializes its
+ * own oauth_profiles table via initOAuthProfileSchema (idempotent).
+ */
+export declare function createOAuthProfileStoreEncrypted(db: Database.Database, crypto: SecretsCrypto): OAuthCredentialStorePort;