@elizaos/agent 2.0.0-alpha.441 → 2.0.0-alpha.501

package/apps/app-lifeops/src/lifeops/service-mixin-imessage.js

@@ -7,12 +7,21 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 // @ts-nocheck — mixin: type safety is enforced on the composed class
+import { execFile } from "node:child_process";
 import { basename } from "node:path";
+import { promisify } from "node:util";
 import { loadElizaConfig } from "@elizaos/agent/config/config";
 import { logger } from "@elizaos/core";
 import { getIMessageBackendStatus, getIMessageDeliveryStatus, listIMessageChats as listIMessageChatsBridge, readIMessages as readIMessagesBridge, searchIMessages as searchIMessagesBridge, sendIMessage as sendIMessageBridge, } from "./imessage-bridge.js";
+import { fail } from "./service-normalize.js";
 const NATIVE_IMESSAGE_SERVICE_LOAD_TIMEOUT_MS = 8_000;
+const NATIVE_IMESSAGE_SEND_TIMEOUT_MS = 20_000;
+const NATIVE_IMESSAGE_SEND_TIMEOUT_MESSAGE = "native iMessage send timed out";
+const IMESSAGE_URL_HANDOFF_TIMEOUT_MS = 12_000;
+const IMESSAGE_URL_HANDOFF_SETTLE_MS = 700;
+const IMESSAGE_URL_HANDOFF_CONFIRM_TIMEOUT_MS = 12_000;
 const IMESSAGE_PLUGIN_PACKAGE = "@elizaos/plugin-imessage";
+const execFileAsync = promisify(execFile);
 function coerceString(value) {
     if (typeof value !== "string") {
         return undefined;
@@ -32,6 +41,11 @@ function coerceBackend(value) {
         ? raw
         : undefined;
 }
+function explicitBackendDisablesNative(env = process.env) {
+    const preferred = coerceBackend(env.ELIZA_IMESSAGE_BACKEND) ??
+        coerceBackend(env.IMESSAGE_BACKEND);
+    return preferred === "bluebubbles" || preferred === "none";
+}
 function normalizeHostPlatform() {
     return process.platform === "darwin" ||
         process.platform === "linux" ||
@@ -39,6 +53,26 @@ function normalizeHostPlatform() {
         ? process.platform
         : "unknown";
 }
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function messagesUrlFor(to, text) {
+    return `sms:${to}?body=${encodeURIComponent(text)}`;
+}
+async function pressMessagesReturn() {
+    await execFileAsync("/usr/bin/osascript", [
+        "-e",
+        'tell application "Messages" to activate',
+        "-e",
+        "delay 0.2",
+        "-e",
+        'tell application "System Events"',
+        "-e",
+        "keystroke return",
+        "-e",
+        "end tell",
+    ], { timeout: IMESSAGE_URL_HANDOFF_TIMEOUT_MS });
+}
 async function waitForNativeIMessageService(runtime) {
     const runtimeWithLifecycle = runtime;
     if (typeof runtimeWithLifecycle.getServiceLoadPromise !== "function") {
@@ -50,6 +84,19 @@ async function waitForNativeIMessageService(runtime) {
     ]);
     return Boolean(runtime.getService("imessage"));
 }
+async function withNativeIMessageSendTimeout(promise) {
+    let timeoutId;
+    const timeout = new Promise((_, reject) => {
+        timeoutId = setTimeout(() => reject(new Error(NATIVE_IMESSAGE_SEND_TIMEOUT_MESSAGE)), NATIVE_IMESSAGE_SEND_TIMEOUT_MS);
+    });
+    try {
+        return await Promise.race([promise, timeout]);
+    }
+    finally {
+        if (timeoutId)
+            clearTimeout(timeoutId);
+    }
+}
 async function ensureNativeIMessagePluginLoaded(runtime) {
     if (process.platform !== "darwin") {
         return false;
@@ -82,6 +129,9 @@ async function ensureNativeIMessagePluginLoaded(runtime) {
     return false;
 }
 async function getNativeIMessageService(runtime) {
+    if (explicitBackendDisablesNative()) {
+        return null;
+    }
     let service = runtime.getService("imessage");
     if (service) {
         return service;
@@ -264,18 +314,56 @@ export function withIMessage(Base) {
         async sendIMessage(req) {
             const nativeService = await getNativeIMessageService(this.runtime);
             if (nativeService) {
-                const result = await nativeService.sendMessage(req.to, req.text, {
-                    ...(req.attachmentPaths?.[0]
-                        ? { mediaUrl: req.attachmentPaths[0] }
-                        : {}),
-                });
+                let result;
+                try {
+                    result = await withNativeIMessageSendTimeout(nativeService.sendMessage(req.to, req.text, {
+                        ...(req.attachmentPaths?.[0]
+                            ? { mediaUrl: req.attachmentPaths[0] }
+                            : {}),
+                    }));
+                }
+                catch (error) {
+                    return this.sendIMessageViaMessagesUrl(req, error);
+                }
                 if (!result.success) {
-                    throw new Error(result.error ?? "native iMessage send failed");
+                    return this.sendIMessageViaMessagesUrl(req, new Error(result.error ?? "native iMessage send failed"));
                 }
                 return { ok: true, messageId: result.messageId };
             }
             return sendIMessageBridge(req, resolveLifeOpsIMessageBridgeConfig());
         }
+        async sendIMessageViaMessagesUrl(req, cause) {
+            if (req.attachmentPaths?.length) {
+                throw cause instanceof Error ? cause : new Error(String(cause));
+            }
+            if (!req.text.trim()) {
+                fail(400, "text is required");
+            }
+            try {
+                await execFileAsync("/usr/bin/open", [messagesUrlFor(req.to, req.text)], {
+                    timeout: IMESSAGE_URL_HANDOFF_TIMEOUT_MS,
+                });
+                await sleep(IMESSAGE_URL_HANDOFF_SETTLE_MS);
+                await pressMessagesReturn();
+                const deadline = Date.now() + IMESSAGE_URL_HANDOFF_CONFIRM_TIMEOUT_MS;
+                while (Date.now() < deadline) {
+                    const messages = await this.readIMessages({ limit: 25 });
+                    const sent = [...messages]
+                        .reverse()
+                        .find((message) => message.isFromMe && message.text === req.text);
+                    if (sent) {
+                        return { ok: true, messageId: sent.id };
+                    }
+                    await sleep(500);
+                }
+                fail(504, "iMessage URL handoff sent no confirmable chat.db message.");
+            }
+            catch (error) {
+                const causeMessage = cause instanceof Error ? cause.message : String(cause);
+                const fallbackMessage = error instanceof Error ? error.message : String(error);
+                fail(502, `native iMessage send failed (${causeMessage}); URL handoff failed (${fallbackMessage}).`);
+            }
+        }
         async readIMessages(opts) {
             const nativeService = await getNativeIMessageService(this.runtime);
             if (nativeService && nativeServiceCanRead(nativeService)) {

package/apps/app-lifeops/src/lifeops/service-mixin-inbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-mixin-inbox.d.ts","sourceRoot":"","sources":["../../../../../../../apps/app-lifeops/src/lifeops/service-mixin-inbox.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,EACL,KAAK,sBAAsB,EAE3B,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EAExB,KAAK,mBAAmB,EAEzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAEL,KAAK,aAAa,EAEnB,MAAM,uBAAuB,CAAC;AAc/B,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;AAEvD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,mBAAmB,GAAG,IAAI,CAQ5B;AAuCD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE,MAAM,GACZ,mBAAmB,CA+DrB;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,cAAc,EAAE,GACxB,mBAAmB,EAAE,CAUvB;AAED,UAAU,iBAAiB;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAClC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAChD;AAiPD,wBAAgB,UAAU,CACxB,OAAO,EAAE,cAAc,EAAE,EACzB,OAAO,EAAE,iBAAiB,GACzB,YAAY,CAEd;AAED,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,SAAS,mBAAmB,EAAE,EAC9C,OAAO,EAAE,iBAAiB,GACzB,YAAY,CAoFd;AA8CD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAClC,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,qBAAqB,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,sBAAsB,GAC9B,oBAAoB,CAyDtB;AAoGD,wBAAsB,UAAU,CAC9B,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,sBAA2B,EACpC,WAAW,CAAC,EAAE,gBAAgB,EAC9B,SAAS,CAAC,EAAE,cAAc,GACzB,OAAO,CAAC,YAAY,CAAC,CAYvB"}
+{"version":3,"file":"service-mixin-inbox.d.ts","sourceRoot":"","sources":["../../../../../../../apps/app-lifeops/src/lifeops/service-mixin-inbox.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,EACL,KAAK,sBAAsB,EAE3B,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EAExB,KAAK,mBAAmB,EAEzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAEL,KAAK,aAAa,EAEnB,MAAM,uBAAuB,CAAC;AAe/B,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;AAEvD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,mBAAmB,GAAG,IAAI,CAQ5B;AAuCD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE,MAAM,GACZ,mBAAmB,CA+DrB;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,cAAc,EAAE,GACxB,mBAAmB,EAAE,CAUvB;AAED,UAAU,iBAAiB;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAClC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAChD;AAiPD,wBAAgB,UAAU,CACxB,OAAO,EAAE,cAAc,EAAE,EACzB,OAAO,EAAE,iBAAiB,GACzB,YAAY,CAEd;AAED,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,SAAS,mBAAmB,EAAE,EAC9C,OAAO,EAAE,iBAAiB,GACzB,YAAY,CAoFd;AA8CD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAClC,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,qBAAqB,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,sBAAsB,GAC9B,oBAAoB,CAyDtB;AAoGD,wBAAsB,UAAU,CAC9B,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,sBAA2B,EACpC,WAAW,CAAC,EAAE,gBAAgB,EAC9B,SAAS,CAAC,EAAE,cAAc,GACzB,OAAO,CAAC,YAAY,CAAC,CAYvB"}

package/apps/app-lifeops/src/lifeops/service-mixin-inbox.js

@@ -3,6 +3,7 @@ import { LIFEOPS_INBOX_CHANNELS, } from "@elizaos/shared";
 import { fetchAllMessages, } from "../inbox/message-fetcher.js";
 import { loadLifeOpsAppState } from "./app-state.js";
 import { scoreInboxMessages, } from "./priority-scoring.js";
+import { fail, requireNonEmptyString } from "./service-normalize.js";
 const DEFAULT_INBOX_LIMIT = 100;
 const INBOX_CACHE_FRESH_MS = 60_000;
 const INBOX_CACHE_WARM_LIMIT = 200;
@@ -594,6 +595,14 @@ export function withInbox(Base) {
             await this.repository.upsertCachedInboxMessages(this.runtime.agentId, flattenInboxMessages(inbox));
             return inbox;
         }
+        async markInboxEntryRead(inboxEntryId) {
+            const id = requireNonEmptyString(inboxEntryId, "inboxEntryId");
+            const message = await this.repository.markCachedInboxMessageRead(this.runtime.agentId, id);
+            if (!message) {
+                fail(404, "life-ops inbox entry not found");
+            }
+            return message;
+        }
     }
     return LifeOpsInboxServiceMixin;
 }

package/apps/app-lifeops/src/lifeops/service-mixin-payments.d.ts

@@ -1,3 +1,6 @@
 import type { LifeOpsPaymentSource } from "./payment-types.js";
+import { type EncryptedTokenEnvelope } from "./token-encryption.js";
+export declare function encryptPaymentMetadataToken(token: string, env?: NodeJS.ProcessEnv): EncryptedTokenEnvelope;
+export declare function readPaymentMetadataToken(value: unknown, field: string, env?: NodeJS.ProcessEnv): string | null;
 export declare function sanitizePaymentSourceForClient(source: LifeOpsPaymentSource): LifeOpsPaymentSource;
 //# sourceMappingURL=service-mixin-payments.d.ts.map

package/apps/app-lifeops/src/lifeops/service-mixin-payments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-mixin-payments.d.ts","sourceRoot":"","sources":["../../../../../../../apps/app-lifeops/src/lifeops/service-mixin-payments.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAIV,oBAAoB,EAUrB,MAAM,oBAAoB,CAAC;AAmC5B,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,oBAAoB,GAC3B,oBAAoB,CAQtB"}
+{"version":3,"file":"service-mixin-payments.d.ts","sourceRoot":"","sources":["../../../../../../../apps/app-lifeops/src/lifeops/service-mixin-payments.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAIV,oBAAoB,EAUrB,MAAM,oBAAoB,CAAC;AAqB5B,OAAO,EAEL,KAAK,sBAAsB,EAI5B,MAAM,uBAAuB,CAAC;AAmB/B,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,sBAAsB,CAIxB;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAqBf;AAED,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,oBAAoB,GAC3B,oBAAoB,CAQtB"}

package/apps/app-lifeops/src/lifeops/service-mixin-payments.js

@@ -1,11 +1,14 @@
 // @ts-nocheck — mixin: type safety is enforced on the composed class
 import crypto from "node:crypto";
+import path from "node:path";
+import { resolveOAuthDir } from "@elizaos/agent/config/paths";
 import { parseTransactionsCsv, } from "./payment-csv-import.js";
 import { detectRecurringCharges, normalizeMerchant, } from "./payment-recurrence.js";
 import { PaypalManagedClient, PaypalManagedClientError, } from "./paypal-managed-client.js";
 import { PlaidManagedClient, PlaidManagedClientError, } from "./plaid-managed-client.js";
 import { fail, normalizeOptionalString, requireNonEmptyString, } from "./service-normalize.js";
 import { findLifeOpsSubscriptionPlaybook } from "./subscriptions-playbooks.js";
+import { decryptTokenEnvelope, encryptTokenPayload, isEncryptedTokenEnvelope, resolveTokenEncryptionKey, } from "./token-encryption.js";
 const DEFAULT_WINDOW_DAYS = 30;
 const MS_PER_DAY = 86_400_000;
 const VALID_SOURCE_KINDS = [
@@ -17,6 +20,31 @@ const VALID_SOURCE_KINDS = [
 ];
 const EMAIL_SOURCE_LABEL = "Email bills";
 const SENSITIVE_PAYMENT_SOURCE_METADATA_KEYS = new Set(["plaid", "paypal"]);
+function paymentTokenStorageRoot(env = process.env) {
+    return path.join(resolveOAuthDir(env), "lifeops", "payments");
+}
+export function encryptPaymentMetadataToken(token, env = process.env) {
+    const normalized = requireNonEmptyString(token, "token");
+    const key = resolveTokenEncryptionKey(paymentTokenStorageRoot(env), env);
+    return encryptTokenPayload(normalized, key);
+}
+export function readPaymentMetadataToken(value, field, env = process.env) {
+    if (typeof value === "string") {
+        return value.trim().length > 0 ? value : null;
+    }
+    if (value === null || value === undefined) {
+        return null;
+    }
+    if (!isEncryptedTokenEnvelope(value)) {
+        fail(409, `${field} token metadata is malformed. Re-link the account.`);
+    }
+    try {
+        return decryptTokenEnvelope(value, resolveTokenEncryptionKey(paymentTokenStorageRoot(env), env));
+    }
+    catch {
+        fail(409, `${field} token metadata could not be decrypted. Restore ELIZA_TOKEN_ENCRYPTION_KEY or re-link the account.`);
+    }
+}
 export function sanitizePaymentSourceForClient(source) {
     const metadata = {};
     for (const [key, value] of Object.entries(source.metadata ?? {})) {
@@ -469,8 +497,8 @@ export function withPayments(Base) {
             return { ok: true, dueDate: nextDue };
         }
         /**
-         * Read upcoming bills (transactions on the email source whose metadata
-         * carries `kind: "bill"` and a future `dueDate`) sorted by due date.
+         * Read bills extracted from email. This includes overdue and no-date bills
+         * so extraction misses do not disappear from the user's review queue.
          */
         async getUpcomingBills(args = {}) {
             const sources = await this.listPaymentSources();
@@ -489,8 +517,11 @@ export function withPayments(Base) {
                 if (metadata.kind !== "bill")
                     continue;
                 const dueDate = typeof metadata.dueDate === "string" ? metadata.dueDate : null;
-                if (!dueDate || dueDate < todayIso)
-                    continue;
+                const status = dueDate === null
+                    ? "needs_due_date"
+                    : dueDate < todayIso
+                        ? "overdue"
+                        : "upcoming";
                 const sourceMessageId = typeof metadata.sourceMessageId === "string"
                     ? metadata.sourceMessageId
                     : null;
@@ -504,12 +535,29 @@ export function withPayments(Base) {
                     amountUsd: transaction.amountUsd,
                     currency: transaction.currency,
                     dueDate,
+                    status,
                     postedAt: transaction.postedAt,
                     sourceMessageId,
                     confidence,
                 });
             }
-            bills.sort((a, b) => a.dueDate.localeCompare(b.dueDate));
+            const statusRank = {
+                overdue: 0,
+                needs_due_date: 1,
+                upcoming: 2,
+            };
+            bills.sort((a, b) => {
+                const rankDelta = statusRank[a.status] - statusRank[b.status];
+                if (rankDelta !== 0)
+                    return rankDelta;
+                if (a.dueDate && b.dueDate)
+                    return a.dueDate.localeCompare(b.dueDate);
+                if (a.dueDate)
+                    return 1;
+                if (b.dueDate)
+                    return -1;
+                return b.postedAt.localeCompare(a.postedAt);
+            });
             return bills;
         }
         summarizePaymentsDashboard(dashboard) {
@@ -592,11 +640,7 @@ export function withPayments(Base) {
                 transactionCount: 0,
                 metadata: {
                     plaid: {
-                        // Storing the access_token in source metadata is required for
-                        // sync. The cloud already authorized this Item to the user;
-                        // local storage is encrypted at rest by the underlying database
-                        // adapter.
-                        accessToken: result.accessToken,
+                        accessToken: encryptPaymentMetadataToken(result.accessToken),
                         itemId: result.itemId,
                         institutionId: result.institution.institutionId,
                         cursor: "",
@@ -623,8 +667,8 @@ export function withPayments(Base) {
                 fail(409, `Source ${sourceId} is not a Plaid source.`);
             }
             const plaidMetadata = source.metadata?.plaid ?? null;
-            const accessToken = plaidMetadata?.accessToken;
-            if (typeof accessToken !== "string" || accessToken.length === 0) {
+            const accessToken = readPaymentMetadataToken(plaidMetadata?.accessToken, "Plaid access");
+            if (!accessToken) {
                 fail(409, "Plaid source is missing an access token. Re-link the account.");
             }
             const cursor = plaidMetadata?.cursor ?? "";
@@ -679,6 +723,7 @@ export function withPayments(Base) {
                     ...source.metadata,
                     plaid: {
                         ...plaidMetadata,
+                        accessToken: encryptPaymentMetadataToken(accessToken),
                         cursor: pageCursor,
                     },
                 },
@@ -759,8 +804,10 @@ export function withPayments(Base) {
                 transactionCount: 0,
                 metadata: {
                     paypal: {
-                        accessToken: exchange.accessToken,
-                        refreshToken: exchange.refreshToken,
+                        accessToken: encryptPaymentMetadataToken(exchange.accessToken),
+                        refreshToken: exchange.refreshToken
+                            ? encryptPaymentMetadataToken(exchange.refreshToken)
+                            : null,
                         tokenExpiresAt,
                         scope: exchange.scope,
                         capability: exchange.capability,
@@ -788,9 +835,10 @@ export function withPayments(Base) {
             if (source.kind !== "paypal") {
                 fail(409, `Source ${sourceId} is not a PayPal source.`);
             }
-            const paypalMetadata = source.metadata?.paypal ?? null;
-            let accessToken = paypalMetadata?.accessToken;
-            if (typeof accessToken !== "string" || accessToken.length === 0) {
+            let paypalMetadata = source.metadata?.paypal ?? null;
+            let accessToken = readPaymentMetadataToken(paypalMetadata?.accessToken, "PayPal access");
+            let refreshToken = readPaymentMetadataToken(paypalMetadata?.refreshToken, "PayPal refresh");
+            if (!accessToken) {
                 fail(409, "PayPal source is missing an access token. Re-link.");
             }
             // Refresh if we're within 60s of expiry — saves a round-trip 401.
@@ -798,23 +846,28 @@ export function withPayments(Base) {
                 ? Date.parse(paypalMetadata.tokenExpiresAt)
                 : 0;
             if (Number.isFinite(expiryMs) && expiryMs <= Date.now() + 60_000) {
-                if (paypalMetadata?.refreshToken) {
+                if (refreshToken) {
                     try {
                         const refreshed = await this.getPaypalManagedClient().refreshAccessToken({
-                            refreshToken: paypalMetadata.refreshToken,
+                            refreshToken,
                         });
                         accessToken = refreshed.accessToken;
+                        refreshToken = refreshed.refreshToken ?? refreshToken;
+                        const tokenExpiresAt = new Date(Date.now() + Math.max(0, refreshed.expiresIn - 60) * 1_000).toISOString();
+                        paypalMetadata = {
+                            ...paypalMetadata,
+                            accessToken: encryptPaymentMetadataToken(accessToken),
+                            refreshToken: refreshToken
+                                ? encryptPaymentMetadataToken(refreshToken)
+                                : null,
+                            tokenExpiresAt,
+                            scope: refreshed.scope,
+                        };
                         await this.repository.upsertPaymentSource({
                             ...source,
                             metadata: {
                                 ...source.metadata,
-                                paypal: {
-                                    ...paypalMetadata,
-                                    accessToken: refreshed.accessToken,
-                                    refreshToken: refreshed.refreshToken ?? paypalMetadata.refreshToken,
-                                    tokenExpiresAt: new Date(Date.now() + Math.max(0, refreshed.expiresIn - 60) * 1_000).toISOString(),
-                                    scope: refreshed.scope,
-                                },
+                                paypal: paypalMetadata,
                             },
                             updatedAt: new Date().toISOString(),
                         });
@@ -872,6 +925,10 @@ export function withPayments(Base) {
                             ...source.metadata,
                             paypal: {
                                 ...paypalMetadata,
+                                accessToken: encryptPaymentMetadataToken(accessToken),
+                                refreshToken: refreshToken
+                                    ? encryptPaymentMetadataToken(refreshToken)
+                                    : null,
                                 capability: { hasReporting: false, hasIdentity: true },
                                 lastFallbackError: error.message,
                             },
@@ -891,6 +948,16 @@ export function withPayments(Base) {
                 status: "active",
                 lastSyncedAt: new Date().toISOString(),
                 transactionCount: newCount,
+                metadata: {
+                    ...source.metadata,
+                    paypal: {
+                        ...paypalMetadata,
+                        accessToken: encryptPaymentMetadataToken(accessToken),
+                        refreshToken: refreshToken
+                            ? encryptPaymentMetadataToken(refreshToken)
+                            : null,
+                    },
+                },
                 updatedAt: new Date().toISOString(),
             });
             return { inserted, skipped, fallback: null };

package/apps/app-lifeops/src/lifeops/service-mixin-reminders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-mixin-reminders.d.ts","sourceRoot":"","sources":["../../../../../../../apps/app-lifeops/src/lifeops/service-mixin-reminders.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,iCAAiC,EACjC,mCAAmC,EACnC,mCAAmC,EACnC,iCAAiC,EACjC,qBAAqB,EACrB,oBAAoB,EAEpB,2BAA2B,EAG3B,sBAAsB,EAGtB,yBAAyB,EAGzB,yBAAyB,EACzB,+BAA+B,EAI/B,qBAAqB,EAErB,kBAAkB,EAClB,mCAAmC,EACnC,iCAAiC,EAClC,MAAM,uBAAuB,CAAC;AA6B/B,OAAO,EAGL,KAAK,iBAAiB,EAGvB,MAAM,0BAA0B,CAAC;AAuBlC,OAAO,EAGL,KAAK,sCAAsC,EAC3C,KAAK,uCAAuC,EAC7C,MAAM,8BAA8B,CAAC;AA+BtC;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,mBAAmB,EAAE,OAAO,CAAC;IAC7B,2EAA2E;IAC3E,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,kBAAkB,EAAE,MAAM,EAC1B,KAAK,EAAE,wBAAwB,GAAG,IAAI,GACrC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAU/C;AAiED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,UAAU,EACN,IAAI,CAAC,qBAAqB,EAAE,MAAM,GAAG,UAAU,CAAC,GAChD,IAAI,GACJ,SAAS,GACZ,OAAO,CAcT;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,EACT,QAAQ,EAAE,MAAM,EAChB,UAAU,EACN,IAAI,CAAC,qBAAqB,EAAE,MAAM,GAAG,UAAU,CAAC,GAChD,IAAI,GACJ,SAAS,EACb,oBAAoB,EAAE,OAAO,EAC7B,OAAO,CAAC,EAAE,iBAAiB,EAAE,GAC5B,wBAAwB,CAa1B;AAyDD,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,CACnB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAC3B,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtC,qBAAqB,CACnB,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtC,qBAAqB,CACnB,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClC,qBAAqB,CACnB,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxC,mBAAmB,CAAC,IAAI,CAAC,EAAE;QACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,MAAM,CAAC,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;KAClD,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACrC,mBAAmB,CACjB,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,mBAAmB,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC;QACvE,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,oBAAoB,EAAE,CAAC;KAClC,CAAC,CAAC;IACH,gBAAgB,CAAC,OAAO,CAAC,EAAE;QACzB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAC7C,oBAAoB,CAAC,OAAO,CAAC,EAAE;QAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC;QACV,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,sBAAsB,EAAE,CAAC;QAC3C,YAAY,EAAE,kBAAkB,EAAE,CAAC;KACpC,CAAC,CAAC;IACH,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAC9E,4BAA4B,CAC1B,WAAW,EAAE,MAAM,EACnB,GAAG,CAAC,EAAE,IAAI,GACT,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACzB,eAAe,CACb,SAAS,EAAE,YAAY,GAAG,gBAAgB,EAC1C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtC,mBAAmB,CACjB,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACzB,0BAA0B,CACxB,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,uCAAuC,CAAC,CAAC;CACrD"}
+{"version":3,"file":"service-mixin-reminders.d.ts","sourceRoot":"","sources":["../../../../../../../apps/app-lifeops/src/lifeops/service-mixin-reminders.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,iCAAiC,EACjC,mCAAmC,EACnC,mCAAmC,EACnC,iCAAiC,EACjC,qBAAqB,EACrB,oBAAoB,EAEpB,2BAA2B,EAG3B,sBAAsB,EAGtB,yBAAyB,EAGzB,yBAAyB,EACzB,+BAA+B,EAI/B,qBAAqB,EAErB,kBAAkB,EAClB,mCAAmC,EACnC,iCAAiC,EAClC,MAAM,uBAAuB,CAAC;AA6B/B,OAAO,EAGL,KAAK,iBAAiB,EAGvB,MAAM,0BAA0B,CAAC;AAuBlC,OAAO,EAGL,KAAK,sCAAsC,EAC3C,KAAK,uCAAuC,EAC7C,MAAM,8BAA8B,CAAC;AAyDtC;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,mBAAmB,EAAE,OAAO,CAAC;IAC7B,2EAA2E;IAC3E,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,kBAAkB,EAAE,MAAM,EAC1B,KAAK,EAAE,wBAAwB,GAAG,IAAI,GACrC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAU/C;AAiED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,UAAU,EACN,IAAI,CAAC,qBAAqB,EAAE,MAAM,GAAG,UAAU,CAAC,GAChD,IAAI,GACJ,SAAS,GACZ,OAAO,CAcT;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,EACT,QAAQ,EAAE,MAAM,EAChB,UAAU,EACN,IAAI,CAAC,qBAAqB,EAAE,MAAM,GAAG,UAAU,CAAC,GAChD,IAAI,GACJ,SAAS,EACb,oBAAoB,EAAE,OAAO,EAC7B,OAAO,CAAC,EAAE,iBAAiB,EAAE,GAC5B,wBAAwB,CAa1B;AAyDD,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,CACnB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAC3B,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtC,qBAAqB,CACnB,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtC,qBAAqB,CACnB,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClC,qBAAqB,CACnB,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxC,mBAAmB,CAAC,IAAI,CAAC,EAAE;QACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,MAAM,CAAC,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;KAClD,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACrC,mBAAmB,CACjB,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,mBAAmB,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC;QACvE,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,oBAAoB,EAAE,CAAC;KAClC,CAAC,CAAC;IACH,gBAAgB,CAAC,OAAO,CAAC,EAAE;QACzB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAC7C,oBAAoB,CAAC,OAAO,CAAC,EAAE;QAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC;QACV,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,sBAAsB,EAAE,CAAC;QAC3C,YAAY,EAAE,kBAAkB,EAAE,CAAC;KACpC,CAAC,CAAC;IACH,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAC9E,4BAA4B,CAC1B,WAAW,EAAE,MAAM,EACnB,GAAG,CAAC,EAAE,IAAI,GACT,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACzB,eAAe,CACb,SAAS,EAAE,YAAY,GAAG,gBAAgB,EAC1C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtC,mBAAmB,CACjB,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACzB,0BAA0B,CACxB,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,uCAAuC,CAAC,CAAC;CACrD"}