comisai 1.0.34 → 1.0.37

package/node_modules/@comis/gateway/dist/index.d.ts

@@ -9,6 +9,8 @@ export type { RpcAdapterDeps } from "./rpc/rpc-adapters.js";
 export { WsConnectionManager } from "./rpc/ws-handler.js";
 export { createMappedWebhookEndpoint } from "./webhook/webhook-endpoint.js";
 export { getPresetMappings } from "./webhook/webhook-presets.js";
+export { createOAuthCallbackRoute, insertPendingFlow, PENDING_FLOW_TIMEOUT_MS, } from "./oauth/oauth-callback-route.js";
+export type { OAuthCallbackDeps, PendingFlow, } from "./oauth/oauth-callback-route.js";
 export { createMediaRoutes } from "./web/index.js";
 export { createOpenaiCompletionsRoute } from "./openai/index.js";
 export { createOpenaiModelsRoute } from "./openai/index.js";

package/node_modules/@comis/gateway/dist/index.js

@@ -16,6 +16,8 @@ export { WsConnectionManager } from "./rpc/ws-handler.js";
 // Webhook
 export { createMappedWebhookEndpoint } from "./webhook/webhook-endpoint.js";
 export { getPresetMappings } from "./webhook/webhook-presets.js";
+// OAuth callback route exports
+export { createOAuthCallbackRoute, insertPendingFlow, PENDING_FLOW_TIMEOUT_MS, } from "./oauth/oauth-callback-route.js";
 // Web -- media routes
 export { createMediaRoutes } from "./web/index.js";
 // OpenAI compatibility endpoints

package/node_modules/@comis/gateway/dist/oauth/oauth-callback-route.d.ts

@@ -0,0 +1,66 @@
+/**
+ * OAuth callback route for the Comis gateway.
+ *
+ * Mounted at `GET /callback/:provider` via `app.route("/oauth", subApp)`. The
+ * handler validates code+state, looks up the state in the in-memory pending-
+ * flow map, verifies path-vs-flow provider match, deletes the entry BEFORE
+ * the token exchange (one-time-use invariant), exchanges the code at
+ * auth.openai.com/oauth/token, resolves identity via
+ * resolveCodexAuthIdentity, persists via OAuthCredentialStorePort.set, emits
+ * auth:profile_bootstrapped, and returns a static "Login Successful" HTML
+ * page (200) on success or a "Login Failed" HTML page (400/500) on failure.
+ *
+ * HTTP method is GET, NOT POST (OAuth servers always redirect with GET).
+ * Logging discipline (CLAUDE.md): submodule: "oauth-callback"
+ * on every line; NEVER log code/state/verifier/access/refresh values.
+ *
+ * @module
+ */
+import { Hono } from "hono";
+import type { OAuthCredentialStorePort, TypedEventBus } from "@comis/core";
+import type { GatewayLogger } from "../server/hono-server.js";
+/** 5-minute pending-flow expiry. Exported for test parity. */
+export declare const PENDING_FLOW_TIMEOUT_MS: number;
+/**
+ * Pending-flow entry stored in the in-memory map keyed by `state`.
+ * Created by insertPendingFlow at flow-initiation time; consumed by the
+ * /callback/:provider handler on a successful state-match.
+ */
+export interface PendingFlow {
+    /** PKCE code_verifier generated at flow initiation. */
+    verifier: string;
+    /** "openai-codex" — used for path-vs-flow provider validation. */
+    provider: string;
+    /** Date.now() at insertion time. */
+    createdAt: number;
+    /**
+     * Cleanup timer reference. The handler clearTimeout(timer) on consume;
+     * the auto-expiry path (PENDING_FLOW_TIMEOUT_MS) deletes the entry.
+     */
+    timer: ReturnType<typeof setTimeout>;
+}
+/** Dependencies for createOAuthCallbackRoute. */
+export interface OAuthCallbackDeps {
+    readonly credentialStore: OAuthCredentialStorePort;
+    readonly eventBus: TypedEventBus;
+    readonly logger: GatewayLogger;
+    /** State -> PendingFlow map; mutated by handler + insertPendingFlow. */
+    readonly pendingFlows: Map<string, PendingFlow>;
+}
+/**
+ * Seed the pending-flow map with a new state -> PendingFlow entry, scheduling
+ * a 5-minute auto-delete cleanup timer.
+ *
+ * The caller is responsible for generating `state` via crypto.randomBytes(16)
+ * — never hand-roll a PRNG.
+ */
+export declare function insertPendingFlow(map: Map<string, PendingFlow>, state: string, flow: Omit<PendingFlow, "timer">, logger: GatewayLogger): void;
+/**
+ * Create the OAuth callback Hono sub-app.
+ *
+ * Mount via:
+ *   const app = new Hono();
+ *   app.route("/oauth", createOAuthCallbackRoute(deps));
+ * Resulting URL: GET /oauth/callback/:provider
+ */
+export declare function createOAuthCallbackRoute(deps: OAuthCallbackDeps): Hono;

package/node_modules/@comis/gateway/dist/oauth/oauth-callback-route.js

@@ -0,0 +1,212 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * OAuth callback route for the Comis gateway.
+ *
+ * Mounted at `GET /callback/:provider` via `app.route("/oauth", subApp)`. The
+ * handler validates code+state, looks up the state in the in-memory pending-
+ * flow map, verifies path-vs-flow provider match, deletes the entry BEFORE
+ * the token exchange (one-time-use invariant), exchanges the code at
+ * auth.openai.com/oauth/token, resolves identity via
+ * resolveCodexAuthIdentity, persists via OAuthCredentialStorePort.set, emits
+ * auth:profile_bootstrapped, and returns a static "Login Successful" HTML
+ * page (200) on success or a "Login Failed" HTML page (400/500) on failure.
+ *
+ * HTTP method is GET, NOT POST (OAuth servers always redirect with GET).
+ * Logging discipline (CLAUDE.md): submodule: "oauth-callback"
+ * on every line; NEVER log code/state/verifier/access/refresh values.
+ *
+ * @module
+ */
+import { Hono } from "hono";
+import { resolveCodexAuthIdentity, rewriteOAuthError, redactEmailForLog, } from "@comis/agent";
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** 5-minute pending-flow expiry. Exported for test parity. */
+export const PENDING_FLOW_TIMEOUT_MS = 5 * 60_000;
+/** OpenAI Codex token endpoint — same as oauth-token-manager.ts:301. */
+const OPENAI_TOKEN_URL = "https://auth.openai.com/oauth/token";
+/** Public OpenAI Codex client_id (NOT a comis secret — per pi-ai source). */
+const OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+/** Redirect URI matches pi-ai device-callback convention. */
+const OPENAI_CODEX_DEVICE_CALLBACK_URL = "https://auth.openai.com/deviceauth/callback";
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+function escapeHtml(s) {
+    return s
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+function oauthSuccessHtml(message) {
+    return [
+        "<!DOCTYPE html>",
+        '<html><head><meta charset="utf-8"><title>Login Successful</title>',
+        "<style>body{font-family:system-ui,sans-serif;max-width:480px;margin:8em auto;padding:2em;text-align:center;color:#222}h1{color:#0a7d2c}</style>",
+        "</head><body><h1>Login Successful</h1>",
+        `<p>${escapeHtml(message)}</p>`,
+        "<p>You can close this window.</p>",
+        "</body></html>",
+    ].join("");
+}
+function oauthErrorHtml(message) {
+    return [
+        "<!DOCTYPE html>",
+        '<html><head><meta charset="utf-8"><title>Login Failed</title>',
+        "<style>body{font-family:system-ui,sans-serif;max-width:480px;margin:8em auto;padding:2em;text-align:center;color:#222}h1{color:#b00020}</style>",
+        "</head><body><h1>Login Failed</h1>",
+        `<p>${escapeHtml(message)}</p>`,
+        "</body></html>",
+    ].join("");
+}
+/**
+ * Exchange an authorization_code at OpenAI's /oauth/token endpoint.
+ *
+ * Mirrors refreshOpenAICodexTokenLocal (oauth-token-manager.ts:298-385) but
+ * uses grant_type=authorization_code with code + code_verifier. Throws on
+ * non-OK status; the public boundary catches and routes through
+ * rewriteOAuthError.
+ */
+async function exchangeAuthorizationCode(params) {
+    const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        code: params.code,
+        redirect_uri: OPENAI_CODEX_DEVICE_CALLBACK_URL,
+        client_id: OPENAI_CODEX_CLIENT_ID,
+        code_verifier: params.verifier,
+    });
+    const response = await fetch(OPENAI_TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body,
+    });
+    if (!response.ok) {
+        let bodyText = "";
+        try {
+            bodyText = await response.text();
+        }
+        catch {
+            /* defensive — body read may fail */
+        }
+        // Surface the wire error verbatim so rewriteOAuthError can detect
+        // invalid_grant / unsupported_country_region_territory substrings.
+        throw new Error(`OAuth token exchange failed: HTTP ${response.status} ${bodyText}`);
+    }
+    const json = (await response.json());
+    return {
+        access: json.access_token,
+        refresh: json.refresh_token,
+        expires: Date.now() + json.expires_in * 1000,
+    };
+}
+// ---------------------------------------------------------------------------
+// Public boundary
+// ---------------------------------------------------------------------------
+/**
+ * Seed the pending-flow map with a new state -> PendingFlow entry, scheduling
+ * a 5-minute auto-delete cleanup timer.
+ *
+ * The caller is responsible for generating `state` via crypto.randomBytes(16)
+ * — never hand-roll a PRNG.
+ */
+export function insertPendingFlow(map, state, flow, logger) {
+    const timer = setTimeout(() => {
+        map.delete(state);
+        logger.debug({ provider: flow.provider, submodule: "oauth-callback" }, "Pending OAuth flow expired");
+    }, PENDING_FLOW_TIMEOUT_MS);
+    map.set(state, { ...flow, timer });
+}
+/**
+ * Create the OAuth callback Hono sub-app.
+ *
+ * Mount via:
+ *   const app = new Hono();
+ *   app.route("/oauth", createOAuthCallbackRoute(deps));
+ * Resulting URL: GET /oauth/callback/:provider
+ */
+export function createOAuthCallbackRoute(deps) {
+    const app = new Hono();
+    app.get("/callback/:provider", async (c) => {
+        const provider = c.req.param("provider");
+        const code = c.req.query("code");
+        const state = c.req.query("state");
+        if (!state || !code) {
+            return c.html(oauthErrorHtml("Missing code or state parameter"), 400);
+        }
+        const flow = deps.pendingFlows.get(state);
+        if (!flow) {
+            // No log — stale browser tab is a benign user error (debug-level
+            // logging acceptable but not required by tests; keep silent here).
+            return c.html(oauthErrorHtml("Invalid or expired state"), 400);
+        }
+        if (flow.provider !== provider) {
+            // Preserve the entry — the legitimate provider's callback may still
+            // arrive.
+            return c.html(oauthErrorHtml("Provider mismatch"), 400);
+        }
+        // One-time-use: cancel the timer + remove the entry BEFORE the
+        // exchange so even a failed exchange does not leave a reusable state.
+        clearTimeout(flow.timer);
+        deps.pendingFlows.delete(state);
+        try {
+            const tokens = await exchangeAuthorizationCode({
+                code,
+                verifier: flow.verifier,
+            });
+            const identity = resolveCodexAuthIdentity({
+                accessToken: tokens.access,
+            });
+            const identityKey = identity.email ?? identity.profileName;
+            if (!identityKey) {
+                // Treat as identity_decode_failed; rewriteOAuthError will route
+                // the substring "Failed to extract accountId" to the right code.
+                throw new Error("Failed to extract accountId — identity decode failed");
+            }
+            const profileId = `${provider}:${identityKey}`;
+            const profile = {
+                provider,
+                profileId,
+                access: tokens.access,
+                refresh: tokens.refresh,
+                expires: tokens.expires,
+                email: identity.email,
+                displayName: identity.profileName,
+                version: 1,
+            };
+            const writeResult = await deps.credentialStore.set(profileId, profile);
+            if (!writeResult.ok) {
+                throw new Error(`Failed to persist OAuth profile: ${writeResult.error.message}`);
+            }
+            const identityForEvent = redactEmailForLog(identity.email) ??
+                identity.profileName ??
+                identityKey;
+            deps.eventBus.emit("auth:profile_bootstrapped", {
+                provider,
+                profileId,
+                identity: identityForEvent,
+                timestamp: Date.now(),
+            });
+            deps.logger.info({
+                provider,
+                profileId,
+                identity: identityForEvent,
+                submodule: "oauth-callback",
+            }, "Gateway OAuth callback success");
+            return c.html(oauthSuccessHtml("Login successful — you can close this window and return to Comis."));
+        }
+        catch (caught) {
+            const rewritten = rewriteOAuthError(caught);
+            deps.logger.warn({
+                provider,
+                errorKind: rewritten.errorKind,
+                hint: rewritten.hint,
+                submodule: "oauth-callback",
+            }, "OAuth callback exchange failed");
+            return c.html(oauthErrorHtml(rewritten.userMessage), 500);
+        }
+    });
+    return app;
+}

package/node_modules/@comis/gateway/dist/server/hono-server.d.ts

@@ -7,6 +7,8 @@ import type { HmacAlgorithm } from "../webhook/hmac-verifier.js";
 import { type TokenStore } from "../auth/token-auth.js";
 import { WsConnectionManager } from "../rpc/ws-handler.js";
 import { type WebhookHandler } from "../webhook/webhook-endpoint.js";
+import { type PendingFlow } from "../oauth/oauth-callback-route.js";
+import type { OAuthCredentialStorePort } from "@comis/core";
 /**
  * Logger interface for gateway server (minimal pino-compatible).
  */
@@ -41,6 +43,18 @@ export interface GatewayServerDeps {
         algorithm?: HmacAlgorithm;
         headerName?: string;
     };
+    /**
+     * Optional OAuth callback deps. When provided, the gateway mounts
+     * GET /oauth/callback/:provider for browser-redirect OAuth flows
+     * (web-UI-initiated logins). Pending-flow map is owned by the caller
+     * (e.g., setup-gateway.ts) so daemon restart cleanly drops all in-flight
+     * states.
+     */
+    readonly oauthCallbackDeps?: {
+        credentialStore: OAuthCredentialStorePort;
+        eventBus: TypedEventBus;
+        pendingFlows: Map<string, PendingFlow>;
+    };
     /** Optional hook runner for lifecycle hooks (no-op when absent) */
     readonly hookRunner?: HookRunner;
     /** Optional web dashboard deps (mount REST/SSE/static when provided) */

package/node_modules/@comis/gateway/dist/server/hono-server.js

@@ -14,6 +14,7 @@ import { createRestApi, ActivityRingBuffer, subscribeActivityBuffer } from "../w
 import { createSseEndpoint } from "../web/sse-endpoint.js";
 import { createStaticMiddleware } from "../web/static-middleware.js";
 import { createWebhookEndpoint } from "../webhook/webhook-endpoint.js";
+import { createOAuthCallbackRoute, } from "../oauth/oauth-callback-route.js";
 /**
  * Create a gateway server with Hono.
  *
@@ -123,6 +124,15 @@ export function createGatewayServer(deps) {
         const webhookApp = createWebhookEndpoint(deps.webhookDeps);
         app.route("/hooks", webhookApp);
     }
+    // Mount OAuth callback at GET /oauth/callback/:provider
+    if (deps.oauthCallbackDeps) {
+        const oauthApp = createOAuthCallbackRoute({
+            ...deps.oauthCallbackDeps,
+            logger,
+        });
+        app.route("/oauth", oauthApp);
+        logger.debug({ submodule: "oauth-callback" }, "OAuth callback route mounted at /oauth/callback/:provider");
+    }
     // Mount web dashboard routes (if configured)
     let unsubscribeActivity;
     if (deps.webDeps) {

package/node_modules/@comis/gateway/dist/webhook/webhook-endpoint.d.ts

@@ -19,13 +19,9 @@ interface WebhookEnv extends Env {
  * the required fields before passing to the handler.
  */
 export declare const WebhookPayloadSchema: z.ZodObject<{
-    /** Event type (e.g., "deployment.completed", "alert.fired") */
     event: z.ZodString;
-    /** Source system identifier */
     source: z.ZodString;
-    /** Arbitrary event data */
     data: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-    /** Optional ISO 8601 timestamp */
     timestamp: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 /**

package/node_modules/@comis/gateway/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/gateway",
   "private": true,
-  "version": "1.0.34",
+  "version": "1.0.37",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "HTTP, JSON-RPC, and WebSocket gateway for Comis",

package/node_modules/@comis/infra/dist/logging/log-fields.d.ts

@@ -73,6 +73,29 @@ export interface LogFields {
      * that produced it.
      */
     module: string;
+    /**
+     * Finer-grained scope inside an existing `module` binding.
+     *
+     * Use at call sites instead of overriding `module:` in the payload.
+     * Pino concatenates parent-bound fields (pre-serialized JSON fragment)
+     * with the call-site object without deduplication, so passing
+     * `{ module: "agent.bridge.X" }` against a parent already bound with
+     * `module: "agent"` emits BOTH keys on the same line. JSON parsers
+     * keep the last, but the polluted output wastes bytes and confuses
+     * log consumers.
+     *
+     * `submodule` sidesteps the duplicate-key emission entirely:
+     * @example
+     *   logger.info(
+     *     { submodule: "bridge.hash-invariant", agentId, durationMs },
+     *     "Hash invariant assertion ran",
+     *   );
+     *
+     * Convention: omit any redundant parent-prefix from the value
+     * (e.g., under `module: "agent"`, prefer `submodule: "bridge.X"`
+     * over `submodule: "agent.bridge.X"`).
+     */
+    submodule: string;
     /**
      * Pipeline step name.
      * @example "response-filter" | "chunking" | "markdown-ir" | "media-compress"

package/node_modules/@comis/infra/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/infra",
   "private": true,
-  "version": "1.0.34",
+  "version": "1.0.37",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Structured logging infrastructure for Comis",

package/node_modules/@comis/memory/dist/compaction.d.ts

@@ -5,9 +5,8 @@
  * into semantic memories, keeping working memory bounded while preserving
  * important information.
  *
- * The summarizer is pluggable -- the actual LLM call will be wired in
- * Phase 3 (Agent). This module defines the interface and orchestrates
- * the compaction workflow.
+ * The summarizer is pluggable -- this module defines the interface and
+ * orchestrates the compaction workflow.
  *
  * Workflow:
  * 1. Find sessions idle for longer than minIdleMs
@@ -25,8 +24,7 @@ import type { SessionStore } from "./session-store.js";
 import type { SqliteMemoryAdapter } from "./sqlite-memory-adapter.js";
 /**
  * Pluggable summarizer function. Takes conversation messages and returns
- * a summary string plus extracted facts. The actual LLM call is wired
- * in Phase 3 (Agent).
+ * a summary string plus extracted facts.
  */
 export type Summarizer = (messages: unknown[]) => Promise<{
     summary: string;

package/node_modules/@comis/memory/dist/compaction.js

@@ -6,9 +6,8 @@
  * into semantic memories, keeping working memory bounded while preserving
  * important information.
  *
- * The summarizer is pluggable -- the actual LLM call will be wired in
- * Phase 3 (Agent). This module defines the interface and orchestrates
- * the compaction workflow.
+ * The summarizer is pluggable -- this module defines the interface and
+ * orchestrates the compaction workflow.
  *
  * Workflow:
  * 1. Find sessions idle for longer than minIdleMs

package/node_modules/@comis/memory/dist/delivery-queue-adapter.d.ts

@@ -8,7 +8,7 @@
  * @module
  */
 import type Database from "better-sqlite3";
-import type { DeliveryQueuePort } from "@comis/core";
+import type { DeliveryQueuePort, TypedEventBus } from "@comis/core";
 /**
  * Create a SQLite-backed DeliveryQueuePort.
  *
@@ -18,4 +18,4 @@ import type { DeliveryQueuePort } from "@comis/core";
  * @param db - An open better-sqlite3 Database instance
  * @returns DeliveryQueuePort implementation (frozen)
  */
-export declare function createSqliteDeliveryQueue(db: Database.Database): DeliveryQueuePort;
+export declare function createSqliteDeliveryQueue(db: Database.Database, eventBus: Pick<TypedEventBus, "emit">): DeliveryQueuePort;

package/node_modules/@comis/memory/dist/delivery-queue-adapter.js

@@ -50,7 +50,7 @@ function rowToEntry(row) {
  * @param db - An open better-sqlite3 Database instance
  * @returns DeliveryQueuePort implementation (frozen)
  */
-export function createSqliteDeliveryQueue(db) {
+export function createSqliteDeliveryQueue(db, eventBus) {
     // --- Prepared statements ---
     const insertStmt = db.prepare(`
     INSERT INTO delivery_queue (
@@ -87,6 +87,19 @@ export function createSqliteDeliveryQueue(db) {
     const pruneStmt = db.prepare(`
     DELETE FROM delivery_queue
     WHERE expire_at < ? AND status NOT IN ('delivered')
+  `);
+    const insertInFlightStmt = db.prepare(`
+    INSERT INTO delivery_queue (
+      id, text, channel_type, channel_id, tenant_id, options_json, origin,
+      format_applied, chunking_applied, status, attempt_count, max_attempts,
+      created_at, scheduled_at, expire_at, last_attempt_at, next_retry_at,
+      last_error, markdown_fallback_applied, delivered_message_id, trace_id
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'in_flight', 0, ?, ?, ?, ?, NULL, NULL, NULL, 0, NULL, ?)
+  `);
+    const recoverInFlightStmt = db.prepare(`
+    UPDATE delivery_queue
+    SET status = 'pending', last_error = NULL
+    WHERE status = 'in_flight'
   `);
     const depthStmt = db.prepare(`
     SELECT COUNT(*) as count FROM delivery_queue
@@ -103,6 +116,32 @@ export function createSqliteDeliveryQueue(db) {
             try {
                 const id = randomUUID();
                 insertStmt.run(id, entry.text, entry.channelType, entry.channelId, entry.tenantId, entry.optionsJson, entry.origin, entry.formatApplied ? 1 : 0, entry.chunkingApplied ? 1 : 0, entry.maxAttempts, entry.createdAt, entry.scheduledAt, entry.expireAt, entry.traceId ?? null);
+                // Emit AFTER SQL success -- preserves invariant: one delivery:enqueued <=> one persisted row.
+                eventBus.emit("delivery:enqueued", {
+                    entryId: id,
+                    channelId: entry.channelId,
+                    channelType: entry.channelType,
+                    origin: entry.origin,
+                    timestamp: Date.now(),
+                });
+                return Promise.resolve(ok(id));
+            }
+            catch (e) {
+                return Promise.resolve(err(e instanceof Error ? e : new Error(String(e))));
+            }
+        },
+        enqueueInFlight(entry) {
+            try {
+                const id = randomUUID();
+                insertInFlightStmt.run(id, entry.text, entry.channelType, entry.channelId, entry.tenantId, entry.optionsJson, entry.origin, entry.formatApplied ? 1 : 0, entry.chunkingApplied ? 1 : 0, entry.maxAttempts, entry.createdAt, entry.scheduledAt, entry.expireAt, entry.traceId ?? null);
+                // Same delivery:enqueued event as enqueue() -- universal observability (SPEC-R5).
+                eventBus.emit("delivery:enqueued", {
+                    entryId: id,
+                    channelId: entry.channelId,
+                    channelType: entry.channelType,
+                    origin: entry.origin,
+                    timestamp: Date.now(),
+                });
                 return Promise.resolve(ok(id));
             }
             catch (e) {
@@ -192,6 +231,15 @@ export function createSqliteDeliveryQueue(db) {
                 return Promise.resolve(err(e instanceof Error ? e : new Error(String(e))));
             }
         },
+        recoverInFlight() {
+            try {
+                const result = recoverInFlightStmt.run();
+                return Promise.resolve(ok(result.changes));
+            }
+            catch (e) {
+                return Promise.resolve(err(e instanceof Error ? e : new Error(String(e))));
+            }
+        },
     };
     return Object.freeze(queue);
 }

package/node_modules/@comis/memory/dist/index.d.ts

@@ -22,6 +22,8 @@ export type { BatchIndexer, BatchIndexerOptions, BatchIndexerResult } from "./em
 export { openSqliteDatabase, chmodDbFiles } from "./sqlite-adapter-base.js";
 export type { SqliteAdapterOptions } from "./sqlite-adapter-base.js";
 export { createSqliteSecretStore } from "./sqlite-secret-store.js";
+export { initOAuthProfileSchema } from "./oauth-profile-schema.js";
+export { createOAuthProfileStoreEncrypted } from "./oauth-profile-store-encrypted.js";
 export { setupSecrets } from "./setup-secrets.js";
 export type { SecretsBootResult } from "./setup-secrets.js";
 export { createNamedGraphStore } from "./named-graph-store.js";

package/node_modules/@comis/memory/dist/index.js

@@ -28,6 +28,9 @@ export { createBatchIndexer } from "./embedding-batch-indexer.js";
 export { openSqliteDatabase, chmodDbFiles } from "./sqlite-adapter-base.js";
 // SQLite secret store (SecretStorePort implementation)
 export { createSqliteSecretStore } from "./sqlite-secret-store.js";
+// OAuth profile schema + encrypted SQLite OAuthCredentialStorePort adapter
+export { initOAuthProfileSchema } from "./oauth-profile-schema.js";
+export { createOAuthProfileStoreEncrypted } from "./oauth-profile-store-encrypted.js";
 // Secret store bootstrap (master key resolution)
 export { setupSecrets } from "./setup-secrets.js";
 // Named graph store (server-side pipeline persistence)

package/node_modules/@comis/memory/dist/memory-api.d.ts

@@ -80,6 +80,6 @@ export interface MemoryApi {
  * and memory config.
  *
  * The factory function pattern is consistent with createSessionStore and
- * createSecretManager from Phase 1.
+ * createSecretManager.
  */
 export declare function createMemoryApi(db: Database.Database, adapter: SqliteMemoryAdapter, sessionStore: SessionStore, config: MemoryConfig): MemoryApi;

package/node_modules/@comis/memory/dist/memory-api.js

@@ -16,7 +16,7 @@ import { rowToEntry, buildFilterClause, countRows, groupCountRows } from "./row-
  * and memory config.
  *
  * The factory function pattern is consistent with createSessionStore and
- * createSecretManager from Phase 1.
+ * createSecretManager.
  */
 export function createMemoryApi(db, adapter, sessionStore, config) {
     return {

package/node_modules/@comis/memory/dist/oauth-profile-schema.d.ts

@@ -0,0 +1,17 @@
+import type Database from "better-sqlite3";
+/**
+ * Create the oauth_profiles table and supporting index.
+ *
+ * Single ciphertext+iv+auth_tag+salt per row — entire OAuthProfile JSON
+ * encrypted as one blob, no half-rotated state.
+ *
+ * Denormalized expires_at column lets the doctor query expiring profiles
+ * via SELECT profile_id FROM oauth_profiles WHERE provider = ?
+ * AND expires_at < ? without decrypting any blob.
+ *
+ * No FK to secrets table — OAuth profiles are independent from named
+ * secrets. Index on provider supports list({ provider }) filtering.
+ *
+ * Idempotent via IF NOT EXISTS — safe to call multiple times.
+ */
+export declare function initOAuthProfileSchema(db: Database.Database): void;

package/node_modules/@comis/memory/dist/oauth-profile-schema.js

@@ -0,0 +1,33 @@
+/**
+ * Create the oauth_profiles table and supporting index.
+ *
+ * Single ciphertext+iv+auth_tag+salt per row — entire OAuthProfile JSON
+ * encrypted as one blob, no half-rotated state.
+ *
+ * Denormalized expires_at column lets the doctor query expiring profiles
+ * via SELECT profile_id FROM oauth_profiles WHERE provider = ?
+ * AND expires_at < ? without decrypting any blob.
+ *
+ * No FK to secrets table — OAuth profiles are independent from named
+ * secrets. Index on provider supports list({ provider }) filtering.
+ *
+ * Idempotent via IF NOT EXISTS — safe to call multiple times.
+ */
+export function initOAuthProfileSchema(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS oauth_profiles (
+      profile_id              TEXT PRIMARY KEY,
+      provider                TEXT NOT NULL,
+      identity                TEXT NOT NULL,
+      credentials_ciphertext  BLOB NOT NULL,
+      credentials_iv          BLOB NOT NULL,
+      credentials_auth_tag    BLOB NOT NULL,
+      credentials_salt        BLOB NOT NULL,
+      expires_at              INTEGER NOT NULL,
+      version                 INTEGER NOT NULL DEFAULT 1,
+      created_at              INTEGER NOT NULL,
+      updated_at              INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_oauth_profiles_provider ON oauth_profiles(provider);
+  `);
+}