@anuma/sdk 6.31.0 → 6.31.2

package/dist/react/index.mjs

@@ -21859,14 +21859,14 @@ async function autoFilterClientTools(clientTools, promptEmbeddings, cache, embed
   const alwaysInclude = clientTools.filter(isAlwaysIncluded);
   const filterCandidates = clientTools.filter((t) => !isAlwaysIncluded(t));
   if (filterCandidates.length === 0) {
-    return { tools: clientTools, activatedSetNames: /* @__PURE__ */ new Set() };
+    return { tools: clientTools, activatedSetNames: /* @__PURE__ */ new Set(), matchedSetNames: /* @__PURE__ */ new Set() };
   }
   if (!promptEmbeddings && noEmbeddingsReason === "error") {
-    return { tools: clientTools, activatedSetNames: /* @__PURE__ */ new Set() };
+    return { tools: clientTools, activatedSetNames: /* @__PURE__ */ new Set(), matchedSetNames: /* @__PURE__ */ new Set() };
   }
   if (!promptEmbeddings) {
     if (activeToolSets.length === 0) {
-      return { tools: [], activatedSetNames: /* @__PURE__ */ new Set() };
+      return { tools: [], activatedSetNames: /* @__PURE__ */ new Set(), matchedSetNames: /* @__PURE__ */ new Set() };
     }
     const allSets = extraToolSets.length > 0 ? [...BUILT_IN_TOOL_SETS, ...extraToolSets] : BUILT_IN_TOOL_SETS;
     const activeSets = allSets.filter((s) => activeToolSets.includes(s.name));
@@ -21876,7 +21876,8 @@ async function autoFilterClientTools(clientTools, promptEmbeddings, cache, embed
         ...alwaysInclude,
         ...filterCandidates.filter((t) => stickyMembers.has(getToolName2(t)))
       ],
-      activatedSetNames: new Set(activeSets.map((s) => s.name))
+      activatedSetNames: new Set(activeSets.map((s) => s.name)),
+      matchedSetNames: /* @__PURE__ */ new Set()
     };
   }
   const toolsNeedingEmbeddings = [];
@@ -21894,7 +21895,7 @@ async function autoFilterClientTools(clientTools, promptEmbeddings, cache, embed
         cache.set(toolsNeedingEmbeddings[i].name, embeddings[i]);
       }
     } catch {
-      return { tools: clientTools, activatedSetNames: /* @__PURE__ */ new Set() };
+      return { tools: clientTools, activatedSetNames: /* @__PURE__ */ new Set(), matchedSetNames: /* @__PURE__ */ new Set() };
     }
   }
   const pseudoServerTools = [];
@@ -21940,15 +21941,170 @@ async function autoFilterClientTools(clientTools, promptEmbeddings, cache, embed
     activeSetNames
   );
   const activatedSetNames = activatedToolSetNames(scores, toolSets, activeSetNames);
+  const matchedSetNames = activatedToolSetNames(scores, toolSets);
   if (finalNames.size === 0) {
-    return { tools: alwaysInclude, activatedSetNames };
+    return { tools: alwaysInclude, activatedSetNames, matchedSetNames };
   }
   const filtered = filterCandidates.filter((t) => {
     const name = getToolName2(t);
     return name && finalNames.has(name);
   });
-  return { tools: [...alwaysInclude, ...filtered], activatedSetNames };
+  return { tools: [...alwaysInclude, ...filtered], activatedSetNames, matchedSetNames };
+}
+
+// src/lib/tools/toolCatalog.ts
+var TOOL_CATALOG = {
+  // Gmail (src/tools/gmail.ts)
+  gmail_search_messages: { label: "Search emails", provider: "gmail", connector: "Gmail" },
+  gmail_get_message: { label: "Read an email", provider: "gmail", connector: "Gmail" },
+  gmail_create_draft: { label: "Draft a reply", provider: "gmail", connector: "Gmail" },
+  gmail_send_message: { label: "Send an email", provider: "gmail", connector: "Gmail" },
+  // Google Calendar (src/tools/googleCalendar.ts)
+  google_calendar_list_events: {
+    label: "Search calendar events",
+    provider: "gcalendar",
+    connector: "Calendar"
+  },
+  google_calendar_create_event: {
+    label: "Create calendar event",
+    provider: "gcalendar",
+    connector: "Calendar"
+  },
+  google_calendar_update_event: {
+    label: "Update calendar event",
+    provider: "gcalendar",
+    connector: "Calendar"
+  },
+  // Google Drive (src/tools/googleDrive.ts)
+  google_drive_search: { label: "Search files", provider: "gdrive", connector: "Drive" },
+  google_drive_list_recent: { label: "List recent files", provider: "gdrive", connector: "Drive" },
+  google_drive_get_content: { label: "Read file content", provider: "gdrive", connector: "Drive" },
+  google_drive_create_file: {
+    label: "Create a file in Drive",
+    provider: "gdrive",
+    connector: "Drive"
+  },
+  google_drive_update_file: {
+    label: "Update a Drive file",
+    provider: "gdrive",
+    connector: "Drive"
+  },
+  // Notion (src/tools/notion.ts)
+  "notion-search": { label: "Search", provider: "notion", connector: "Notion" },
+  "notion-fetch": { label: "Read page", provider: "notion", connector: "Notion" },
+  "notion-create-pages": { label: "Create page", provider: "notion", connector: "Notion" },
+  "notion-update-page": { label: "Update page", provider: "notion", connector: "Notion" },
+  "notion-move-pages": { label: "Move pages", provider: "notion", connector: "Notion" },
+  "notion-duplicate-page": { label: "Duplicate page", provider: "notion", connector: "Notion" },
+  "notion-create-database": { label: "Create database", provider: "notion", connector: "Notion" },
+  "notion-update-data-source": {
+    label: "Update data source",
+    provider: "notion",
+    connector: "Notion"
+  },
+  "notion-create-comment": { label: "Add a comment", provider: "notion", connector: "Notion" },
+  "notion-get-comments": { label: "Read comments", provider: "notion", connector: "Notion" },
+  "notion-get-users": {
+    label: "List workspace members",
+    provider: "notion",
+    connector: "Notion"
+  },
+  "notion-get-teams": { label: "List teamspaces", provider: "notion", connector: "Notion" },
+  // GitHub (src/tools/github.ts)
+  github_api: { label: "Use GitHub", provider: "github", connector: "GitHub" },
+  github_get_authenticated_user: {
+    label: "Read GitHub profile",
+    provider: "github",
+    connector: "GitHub"
+  },
+  // X / Twitter (src/tools/x.ts)
+  x_get_me: { label: "Get my X profile", provider: "x", connector: "X" },
+  x_get_my_posts: { label: "Read my recent posts", provider: "x", connector: "X" },
+  // Dropbox (src/tools/dropbox.ts)
+  dropbox_list_folders: { label: "List files", provider: "dropbox", connector: "Dropbox" },
+  dropbox_get_file_content: {
+    label: "Read file content",
+    provider: "dropbox",
+    connector: "Dropbox"
+  },
+  dropbox_search: { label: "Search files", provider: "dropbox", connector: "Dropbox" },
+  // Slack (src/tools/slack.ts)
+  slack_get_me: { label: "Get my Slack profile", provider: "slack", connector: "Slack" },
+  slack_list_channels: { label: "List channels", provider: "slack", connector: "Slack" },
+  slack_list_dms: { label: "List direct messages", provider: "slack", connector: "Slack" },
+  slack_search_messages: { label: "Search messages", provider: "slack", connector: "Slack" },
+  slack_list_users: { label: "List members", provider: "slack", connector: "Slack" },
+  slack_get_channel_history: {
+    label: "Read channel history",
+    provider: "slack",
+    connector: "Slack"
+  },
+  slack_get_thread_replies: {
+    label: "Read thread replies",
+    provider: "slack",
+    connector: "Slack"
+  },
+  slack_post_message: { label: "Post a message", provider: "slack", connector: "Slack" }
+};
+
+// src/lib/tools/selection/activeToolSets.ts
+function mergeActiveToolSets(current, derived) {
+  if (derived.length === 0) return current;
+  const merged = Array.from(/* @__PURE__ */ new Set([...current, ...derived]));
+  return merged.length === current.length ? current : merged;
+}
+
+// src/lib/tools/selection/recentToolSets.ts
+var RECENT_TOOL_SET_TURNS = 2;
+var RECENT_TOOL_SET_CONVERSATION_LIMIT = 50;
+var CARRYABLE_TOOL_SETS = new Set(
+  BUILT_IN_TOOL_SETS.filter(
+    (s) => s.anchors.length > 0 && s.anchors.every((a) => a in TOOL_CATALOG)
+  ).map((s) => s.name)
+);
+var recentToolSets = /* @__PURE__ */ new WeakMap();
+function touch(conversations, conversationId) {
+  const turns = conversations.get(conversationId);
+  if (!turns) return void 0;
+  conversations.delete(conversationId);
+  conversations.set(conversationId, turns);
+  return turns;
+}
+function carriedToolSets(database, conversationId) {
+  if (!conversationId) return [];
+  const conversations = recentToolSets.get(database);
+  if (!conversations) return [];
+  return [...touch(conversations, conversationId)?.keys() ?? []];
+}
+function recordToolSetTurn(database, conversationId, matched) {
+  if (!conversationId) return;
+  let conversations = recentToolSets.get(database);
+  if (!conversations) {
+    conversations = /* @__PURE__ */ new Map();
+    recentToolSets.set(database, conversations);
+  }
+  const turns = touch(conversations, conversationId) ?? /* @__PURE__ */ new Map();
+  for (const [name, left] of turns) {
+    if (left > 1) turns.set(name, left - 1);
+    else turns.delete(name);
+  }
+  for (const name of matched) {
+    if (CARRYABLE_TOOL_SETS.has(name)) turns.set(name, RECENT_TOOL_SET_TURNS);
+  }
+  if (turns.size === 0) {
+    conversations.delete(conversationId);
+    return;
+  }
+  conversations.set(conversationId, turns);
+  if (conversations.size > RECENT_TOOL_SET_CONVERSATION_LIMIT) {
+    const oldest = conversations.keys().next().value;
+    if (oldest !== void 0) conversations.delete(oldest);
+  }
+}
+function resetRecentToolSets() {
+  recentToolSets = /* @__PURE__ */ new WeakMap();
 }
+onClearAllEncryptionState(resetRecentToolSets);
 
 // src/react/useChatMedia.ts
 import { useCallback as useCallback3 } from "react";
@@ -23380,6 +23536,8 @@ function useChatStorage(options) {
         }
         let filteredClientTools2 = clientTools;
         let clientActivatedSetNames2;
+        let matchedToolSets2 = /* @__PURE__ */ new Set();
+        const toolSetConversationId = explicitConversationId ?? currentConversationId;
         if (clientToolsFilter && clientTools?.length) {
           if (!skipStorageEmbeddingsFailed) {
             const clientToolNames = clientToolsFilter(skipStorageEmbeddings, clientTools);
@@ -23396,11 +23554,15 @@ function useChatStorage(options) {
             clientToolEmbeddingsCacheRef.current,
             { getToken, baseUrl, model: embeddingModel },
             extraToolSets,
-            activeToolSetsRef.current,
+            mergeActiveToolSets(
+              activeToolSetsRef.current ?? [],
+              carriedToolSets(database, toolSetConversationId)
+            ),
             skipStorageEmbeddingsFailed ? "error" : "short-prompt"
           );
           filteredClientTools2 = clientFilterResult.tools;
           clientActivatedSetNames2 = clientFilterResult.activatedSetNames;
+          matchedToolSets2 = clientFilterResult.matchedSetNames;
         }
         if (filteredServerTools2.length > 0 || filteredClientTools2 && filteredClientTools2.length > 0) {
           mergedTools2 = mergeTools(
@@ -23455,6 +23617,7 @@ function useChatStorage(options) {
             error: result2.error || "Unknown error"
           };
         }
+        recordToolSetTurn(database, toolSetConversationId, matchedToolSets2);
         const refreshResponse = result2.data;
         if (getToken) {
           Promise.resolve().then(
@@ -23835,6 +23998,7 @@ function useChatStorage(options) {
       }
       let filteredClientTools = clientTools;
       let clientActivatedSetNames;
+      let matchedToolSets = /* @__PURE__ */ new Set();
       if (clientToolsFilter && clientTools?.length) {
         if (!userMessageEmbeddingsFailed) {
           const clientToolNames = clientToolsFilter(userMessageEmbeddings ?? null, clientTools);
@@ -23851,11 +24015,12 @@ function useChatStorage(options) {
           clientToolEmbeddingsCacheRef.current,
           { getToken, baseUrl, model: embeddingModel },
           extraToolSets,
-          activeToolSetsRef.current,
+          mergeActiveToolSets(activeToolSetsRef.current ?? [], carriedToolSets(database, convId)),
           userMessageEmbeddingsFailed ? "error" : "short-prompt"
         );
         filteredClientTools = clientFilterResult.tools;
         clientActivatedSetNames = clientFilterResult.activatedSetNames;
+        matchedToolSets = clientFilterResult.matchedSetNames;
       }
       if (!userMsgQueueId) {
         if (userMessageEmbeddings && autoEmbedMessages) {
@@ -23980,6 +24145,7 @@ function useChatStorage(options) {
               ],
               usage: void 0
             };
+            recordToolSetTurn(database, convId, matchedToolSets);
             return {
               data: responseData2,
               error: null,
@@ -24017,6 +24183,7 @@ function useChatStorage(options) {
           userMessage: { ...storedUserMessage, error: errorMessage }
         };
       }
+      recordToolSetTurn(database, convId, matchedToolSets);
       const responseData = result.data;
       let assistantContent = "";
       let thinkingContent;
@@ -29403,78 +29570,158 @@ import {
   useState as useState16
 } from "react";
 
+// src/lib/auth/tokenRows.ts
+var ENCRYPTED_PREFIX = "enc:oauth:";
+function parsePlaintextToken(raw, walletAddress) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const record = parsed;
+  const data = record.token?.accessToken ? record.token : record;
+  if (!data?.accessToken) return null;
+  if (record.wallet && record.wallet !== walletAddress) return null;
+  return data;
+}
+function promoteUnscopedRow(raw, data, store, scopedKey, unscopedKey, walletAddress) {
+  const row = raw.startsWith(ENCRYPTED_PREFIX) ? raw : JSON.stringify({ wallet: walletAddress, token: data });
+  if (!store.getItem(scopedKey)) {
+    store.setItem(scopedKey, row);
+  }
+  store.removeItem(unscopedKey);
+}
+function readPlaintextToken(scopedKey, unscopedKey, walletAddress) {
+  if (typeof window === "undefined") return null;
+  const keys = scopedKey === unscopedKey ? [scopedKey] : [scopedKey, unscopedKey];
+  for (const key of keys) {
+    const candidates = [
+      [localStorage.getItem(key), localStorage],
+      [sessionStorage.getItem(key), sessionStorage]
+    ];
+    for (const [raw, store] of candidates) {
+      if (!raw) continue;
+      const data = parsePlaintextToken(raw, walletAddress);
+      if (!data) continue;
+      if (walletAddress && key === unscopedKey) {
+        promoteUnscopedRow(raw, data, store, scopedKey, unscopedKey, walletAddress);
+      }
+      return data;
+    }
+  }
+  return null;
+}
+
 // src/lib/backup/oauth/storage.ts
 var STORAGE_KEY_PREFIX = "oauth_token_";
-var ENCRYPTED_PREFIX = "enc:oauth:";
-function getStorageKey(provider) {
-  return `${STORAGE_KEY_PREFIX}${provider}`;
+var ENCRYPTED_PREFIX2 = "enc:oauth:";
+function getStorageKey(provider, walletAddress) {
+  const base = `${STORAGE_KEY_PREFIX}${provider}`;
+  return walletAddress ? `${base}:${walletAddress}` : base;
+}
+function readRawRows(keys) {
+  const rows = [];
+  for (const key of keys) {
+    for (const store of [localStorage, sessionStorage]) {
+      const raw = store.getItem(key);
+      if (raw) rows.push({ raw, key, store });
+    }
+  }
+  return rows;
 }
 async function getStoredTokenData(provider, walletAddress) {
   if (typeof window === "undefined") return null;
   try {
-    const key = getStorageKey(provider);
-    let stored = localStorage.getItem(key);
-    if (!stored) {
-      stored = sessionStorage.getItem(key);
-    }
-    if (!stored) return null;
-    if (stored.startsWith(ENCRYPTED_PREFIX)) {
-      if (!walletAddress) {
-        getLogger().warn(
-          `Encrypted OAuth token found for ${provider} but no wallet address provided`
-        );
-        return null;
-      }
-      try {
-        const encryptedData = stored.slice(ENCRYPTED_PREFIX.length);
-        let decryptedJson;
-        try {
-          decryptedJson = await decryptData(encryptedData, walletAddress);
-        } catch {
-          decryptedJson = await decryptData(encryptedData, walletAddress, "v2");
-        }
-        const data2 = JSON.parse(decryptedJson);
-        if (!data2.accessToken) return null;
-        return data2;
-      } catch (error) {
-        getLogger().error(`Failed to decrypt OAuth token for ${provider}:`, error);
-        return null;
+    const scopedKey = getStorageKey(provider, walletAddress);
+    const legacyKey = getStorageKey(provider);
+    const keys = scopedKey === legacyKey ? [legacyKey] : [scopedKey, legacyKey];
+    for (const row of readRawRows(keys)) {
+      const data = await readTokenRow(row.raw, provider, walletAddress);
+      if (!data) continue;
+      if (walletAddress && row.key === legacyKey) {
+        promoteUnscopedRow(row.raw, data, row.store, scopedKey, legacyKey, walletAddress);
       }
+      return data;
     }
-    const data = JSON.parse(stored);
-    if (!data.accessToken) return null;
-    return data;
+    return null;
   } catch {
     return null;
   }
 }
+async function readTokenRow(stored, provider, walletAddress) {
+  if (stored.startsWith(ENCRYPTED_PREFIX2)) {
+    if (!walletAddress) {
+      getLogger().warn(
+        `Encrypted OAuth token found for ${provider} but no wallet address provided`
+      );
+      return null;
+    }
+    try {
+      const encryptedData = stored.slice(ENCRYPTED_PREFIX2.length);
+      let decryptedJson;
+      try {
+        decryptedJson = await decryptData(encryptedData, walletAddress);
+      } catch {
+        decryptedJson = await decryptData(encryptedData, walletAddress, "v2");
+      }
+      const data = JSON.parse(decryptedJson);
+      if (!data.accessToken) return null;
+      return data;
+    } catch (error) {
+      getLogger().error(`Failed to decrypt OAuth token for ${provider}:`, error);
+      return null;
+    }
+  }
+  return parsePlaintextToken(stored, walletAddress);
+}
 async function storeTokenData(provider, data, walletAddress) {
   if (typeof window === "undefined") return;
-  const key = getStorageKey(provider);
+  const key = getStorageKey(provider, walletAddress);
   const json4 = JSON.stringify(data);
+  const plaintextRecord = JSON.stringify({
+    wallet: walletAddress,
+    token: data
+  });
   if (walletAddress) {
     try {
       const encrypted = await encryptData(json4, walletAddress);
-      localStorage.setItem(key, `${ENCRYPTED_PREFIX}${encrypted}`);
+      localStorage.setItem(key, `${ENCRYPTED_PREFIX2}${encrypted}`);
+      sessionStorage.removeItem(key);
     } catch (error) {
       getLogger().warn(
         `Failed to encrypt OAuth token for ${provider}, storing temporarily:`,
         error
       );
-      sessionStorage.setItem(key, json4);
+      sessionStorage.setItem(key, plaintextRecord);
       throw new Error(
         `OAuth token encryption failed: ${error instanceof Error ? error.message : String(error)}`
       );
     }
   } else {
-    sessionStorage.setItem(key, json4);
+    sessionStorage.setItem(key, plaintextRecord);
   }
 }
-function clearTokenData(provider) {
+function clearTokenData(provider, walletAddress) {
   if (typeof window === "undefined") return;
-  const key = getStorageKey(provider);
-  localStorage.removeItem(key);
-  sessionStorage.removeItem(key);
+  const base = getStorageKey(provider);
+  const keys = walletAddress ? [getStorageKey(provider, walletAddress), base] : [base];
+  if (!walletAddress) keys.push(...suffixedKeys(base));
+  for (const key of keys) {
+    localStorage.removeItem(key);
+    sessionStorage.removeItem(key);
+  }
+}
+function suffixedKeys(base) {
+  const found = [];
+  for (const storage of [localStorage, sessionStorage]) {
+    for (let i = 0; i < storage.length; i++) {
+      const key = storage.key(i);
+      if (key && key.startsWith(`${base}:`) && !found.includes(key)) found.push(key);
+    }
+  }
+  return found;
 }
 function isTokenExpired(data, bufferSeconds = 60) {
   if (!data) return true;
@@ -29498,22 +29745,40 @@ async function getRefreshToken(provider, walletAddress) {
 async function migrateUnencryptedTokens(provider, walletAddress) {
   if (typeof window === "undefined") return false;
   try {
-    const key = getStorageKey(provider);
-    const localStored = localStorage.getItem(key);
-    const sessionStored = sessionStorage.getItem(key);
-    const isEncrypted2 = (value) => !!value && value.startsWith(ENCRYPTED_PREFIX);
-    const tokenToMigrate = sessionStored && !isEncrypted2(sessionStored) ? sessionStored : localStored && !isEncrypted2(localStored) ? localStored : null;
+    const scopedKey = getStorageKey(provider, walletAddress);
+    const legacyKey = getStorageKey(provider);
+    const keys = [scopedKey, legacyKey];
+    const isEncrypted2 = (value) => !!value && value.startsWith(ENCRYPTED_PREFIX2);
+    const plaintextAt = (key) => {
+      const stored = sessionStorage.getItem(key) ?? localStorage.getItem(key);
+      return stored && !isEncrypted2(stored) ? stored : null;
+    };
+    let tokenToMigrate = null;
+    for (const key of keys) {
+      const value = plaintextAt(key);
+      if (value) {
+        tokenToMigrate = value;
+        break;
+      }
+    }
     if (!tokenToMigrate) {
-      if (isEncrypted2(localStored) && sessionStored && !isEncrypted2(sessionStored)) {
-        sessionStorage.removeItem(key);
+      for (const key of keys) {
+        const stored = sessionStorage.getItem(key);
+        if (isEncrypted2(localStorage.getItem(key)) && stored && !isEncrypted2(stored)) {
+          sessionStorage.removeItem(key);
+        }
       }
       return false;
     }
     try {
-      const data = JSON.parse(tokenToMigrate);
+      const data = parsePlaintextToken(tokenToMigrate, walletAddress);
+      if (!data) return false;
       await storeTokenData(provider, data, walletAddress);
-      if (sessionStored && !isEncrypted2(sessionStored)) {
-        sessionStorage.removeItem(key);
+      for (const key of keys) {
+        if (plaintextAt(key)) sessionStorage.removeItem(key);
+        if (key === legacyKey && !isEncrypted2(localStorage.getItem(key))) {
+          localStorage.removeItem(key);
+        }
       }
       return true;
     } catch (error) {
@@ -29682,7 +29947,7 @@ async function refreshDropboxToken(apiClient, walletAddress) {
     await storeTokenData(PROVIDER, tokenData, walletAddress);
     return response.data.access_token;
   } catch {
-    clearTokenData(PROVIDER);
+    clearTokenData(PROVIDER, walletAddress);
     return null;
   }
 }
@@ -29698,7 +29963,7 @@ async function revokeDropboxToken(apiClient, walletAddress) {
     });
   } catch {
   } finally {
-    clearTokenData(PROVIDER);
+    clearTokenData(PROVIDER, walletAddress);
   }
 }
 async function getDropboxAccessToken(apiClient, walletAddress) {
@@ -30307,7 +30572,7 @@ async function refreshGoogleDriveToken(apiClient, walletAddress) {
     await storeTokenData(PROVIDER2, tokenData, walletAddress);
     return response.data.access_token;
   } catch {
-    clearTokenData(PROVIDER2);
+    clearTokenData(PROVIDER2, walletAddress);
     return null;
   }
 }
@@ -30323,7 +30588,7 @@ async function revokeGoogleDriveToken(apiClient, walletAddress) {
     });
   } catch {
   } finally {
-    clearTokenData(PROVIDER2);
+    clearTokenData(PROVIDER2, walletAddress);
   }
 }
 async function getGoogleDriveAccessToken(apiClient, walletAddress) {
@@ -31966,7 +32231,7 @@ var CODE_STORAGE_KEY2 = "google_calendar_oauth_state";
 var TOKEN_STORAGE_KEY = "oauth_token_google-calendar";
 var RETURN_URL_KEY = "google_calendar_return_url";
 var PENDING_MESSAGE_KEY = "google_calendar_pending_message";
-var ENCRYPTED_PREFIX2 = "enc:oauth:";
+var ENCRYPTED_PREFIX3 = "enc:oauth:";
 var cachedAccessToken = null;
 var cachedExpiresAt = null;
 var cachedRefreshToken = null;
@@ -31997,9 +32262,9 @@ async function getStoredTokenData2(walletAddress) {
   }
   try {
     const scopedStored = localStorage.getItem(getTokenStorageKey(walletAddress));
-    if (scopedStored && scopedStored.startsWith(ENCRYPTED_PREFIX2) && walletAddress && hasEncryptionKey(walletAddress)) {
+    if (scopedStored && scopedStored.startsWith(ENCRYPTED_PREFIX3) && walletAddress && hasEncryptionKey(walletAddress)) {
       try {
-        const encryptedData = scopedStored.slice(ENCRYPTED_PREFIX2.length);
+        const encryptedData = scopedStored.slice(ENCRYPTED_PREFIX3.length);
         const cryptoKey = await getEncryptionKey(walletAddress);
         const decryptedJson = await decryptDataWithKey(encryptedData, cryptoKey);
         const data = JSON.parse(decryptedJson);
@@ -32014,33 +32279,18 @@ async function getStoredTokenData2(walletAddress) {
         getLogger().error("Failed to decrypt Calendar OAuth token:", error);
       }
     }
-    const legacyStored = localStorage.getItem(TOKEN_STORAGE_KEY);
-    if (legacyStored && !legacyStored.startsWith(ENCRYPTED_PREFIX2)) {
-      try {
-        const data = JSON.parse(legacyStored);
-        if (data.accessToken) {
-          cachedAccessToken = data.accessToken;
-          cachedExpiresAt = data.expiresAt ?? null;
-          cachedRefreshToken = data.refreshToken ?? null;
-          cachedWalletAddress = walletAddress ?? null;
-          return data;
-        }
-      } catch {
-      }
-    }
-    const sessionStored = sessionStorage.getItem(TOKEN_STORAGE_KEY);
-    if (sessionStored) {
-      try {
-        const data = JSON.parse(sessionStored);
-        if (!data.accessToken) return null;
-        cachedAccessToken = data.accessToken;
-        cachedExpiresAt = data.expiresAt ?? null;
-        cachedRefreshToken = data.refreshToken ?? null;
-        cachedScope = data.scope ?? null;
-        cachedWalletAddress = walletAddress ?? null;
-        return data;
-      } catch {
-      }
+    const plaintext = readPlaintextToken(
+      getTokenStorageKey(walletAddress),
+      TOKEN_STORAGE_KEY,
+      walletAddress
+    );
+    if (plaintext) {
+      cachedAccessToken = plaintext.accessToken;
+      cachedExpiresAt = plaintext.expiresAt ?? null;
+      cachedRefreshToken = plaintext.refreshToken ?? null;
+      cachedScope = plaintext.scope ?? null;
+      cachedWalletAddress = walletAddress ?? null;
+      return plaintext;
     }
     return null;
   } catch {
@@ -32055,16 +32305,19 @@ async function storeTokenData2(data, walletAddress) {
   cachedScope = data.scope ?? null;
   cachedWalletAddress = walletAddress ?? null;
   const json4 = JSON.stringify(data);
-  sessionStorage.setItem(TOKEN_STORAGE_KEY, json4);
   if (walletAddress && hasEncryptionKey(walletAddress)) {
     try {
       const cryptoKey = await getEncryptionKey(walletAddress);
       const encrypted = await encryptDataWithKey(json4, cryptoKey);
-      localStorage.setItem(getTokenStorageKey(walletAddress), ENCRYPTED_PREFIX2 + encrypted);
+      localStorage.setItem(getTokenStorageKey(walletAddress), ENCRYPTED_PREFIX3 + encrypted);
+      sessionStorage.removeItem(getTokenStorageKey(walletAddress));
+      return;
     } catch (error) {
       getLogger().warn("Failed to encrypt Calendar OAuth token:", error);
     }
   }
+  const record = { wallet: walletAddress, token: data };
+  sessionStorage.setItem(getTokenStorageKey(walletAddress), JSON.stringify(record));
 }
 function clearCalendarToken(walletAddress) {
   if (typeof window === "undefined") return;
@@ -32078,6 +32331,7 @@ function clearCalendarToken(walletAddress) {
     localStorage.removeItem(TOKEN_STORAGE_KEY);
   }
   sessionStorage.removeItem(TOKEN_STORAGE_KEY);
+  sessionStorage.removeItem(getTokenStorageKey(walletAddress));
 }
 function isTokenExpired2(data, bufferSeconds = 60) {
   if (!data) return true;
@@ -32259,24 +32513,38 @@ async function migrateCalendarToken(walletAddress) {
   if (typeof window === "undefined") return false;
   if (!walletAddress || !hasEncryptionKey(walletAddress)) return false;
   try {
-    const sessionStored = sessionStorage.getItem(TOKEN_STORAGE_KEY);
-    const legacyStored = localStorage.getItem(TOKEN_STORAGE_KEY);
-    const isLegacyUnencrypted = legacyStored && !legacyStored.startsWith(ENCRYPTED_PREFIX2);
-    const unencryptedJson = sessionStored || (isLegacyUnencrypted ? legacyStored : null);
-    if (!unencryptedJson) return false;
     const scopedKey = getTokenStorageKey(walletAddress);
+    const sources = [
+      { key: scopedKey, store: sessionStorage },
+      // A read moves a legacy localStorage row here as plain text.
+      { key: scopedKey, store: localStorage },
+      { key: TOKEN_STORAGE_KEY, store: sessionStorage },
+      { key: TOKEN_STORAGE_KEY, store: localStorage }
+    ];
+    let used = null;
+    let unencryptedJson = "";
+    for (const source of sources) {
+      const value = source.store.getItem(source.key);
+      if (value && !value.startsWith(ENCRYPTED_PREFIX3)) {
+        unencryptedJson = value;
+        used = source;
+        break;
+      }
+    }
+    if (!used) return false;
     const existingEncrypted = localStorage.getItem(scopedKey);
-    if (existingEncrypted?.startsWith(ENCRYPTED_PREFIX2)) {
-      sessionStorage.removeItem(TOKEN_STORAGE_KEY);
-      if (isLegacyUnencrypted) localStorage.removeItem(TOKEN_STORAGE_KEY);
+    if (existingEncrypted?.startsWith(ENCRYPTED_PREFIX3)) {
+      used.store.removeItem(used.key);
       return true;
     }
-    const data = JSON.parse(unencryptedJson);
+    const data = parsePlaintextToken(unencryptedJson, walletAddress);
+    if (!data) return false;
     await storeTokenData2(data, walletAddress);
     const migrated = localStorage.getItem(scopedKey);
-    if (!migrated?.startsWith(ENCRYPTED_PREFIX2)) return false;
-    sessionStorage.removeItem(TOKEN_STORAGE_KEY);
-    if (isLegacyUnencrypted) localStorage.removeItem(TOKEN_STORAGE_KEY);
+    if (!migrated?.startsWith(ENCRYPTED_PREFIX3)) return false;
+    if (used.store !== localStorage || used.key !== scopedKey) {
+      used.store.removeItem(used.key);
+    }
     return true;
   } catch {
     return false;
@@ -32289,7 +32557,7 @@ var CODE_STORAGE_KEY3 = "google_drive_oauth_state";
 var TOKEN_STORAGE_KEY2 = "oauth_token_google-drive-full";
 var RETURN_URL_KEY2 = "google_drive_return_url";
 var PENDING_MESSAGE_KEY2 = "google_drive_pending_message";
-var ENCRYPTED_PREFIX3 = "enc:oauth:";
+var ENCRYPTED_PREFIX4 = "enc:oauth:";
 var cachedAccessToken2 = null;
 var cachedExpiresAt2 = null;
 var cachedRefreshToken2 = null;
@@ -32320,9 +32588,9 @@ async function getStoredTokenData3(walletAddress) {
   }
   try {
     const scopedStored = localStorage.getItem(getTokenStorageKey2(walletAddress));
-    if (scopedStored && scopedStored.startsWith(ENCRYPTED_PREFIX3) && walletAddress && hasEncryptionKey(walletAddress)) {
+    if (scopedStored && scopedStored.startsWith(ENCRYPTED_PREFIX4) && walletAddress && hasEncryptionKey(walletAddress)) {
       try {
-        const encryptedData = scopedStored.slice(ENCRYPTED_PREFIX3.length);
+        const encryptedData = scopedStored.slice(ENCRYPTED_PREFIX4.length);
         const cryptoKey = await getEncryptionKey(walletAddress);
         const decryptedJson = await decryptDataWithKey(encryptedData, cryptoKey);
         const data = JSON.parse(decryptedJson);
@@ -32337,33 +32605,18 @@ async function getStoredTokenData3(walletAddress) {
         getLogger().error("Failed to decrypt Drive OAuth token:", error);
       }
     }
-    const legacyStored = localStorage.getItem(TOKEN_STORAGE_KEY2);
-    if (legacyStored && !legacyStored.startsWith(ENCRYPTED_PREFIX3)) {
-      try {
-        const data = JSON.parse(legacyStored);
-        if (data.accessToken) {
-          cachedAccessToken2 = data.accessToken;
-          cachedExpiresAt2 = data.expiresAt ?? null;
-          cachedRefreshToken2 = data.refreshToken ?? null;
-          cachedWalletAddress2 = walletAddress ?? null;
-          return data;
-        }
-      } catch {
-      }
-    }
-    const sessionStored = sessionStorage.getItem(TOKEN_STORAGE_KEY2);
-    if (sessionStored) {
-      try {
-        const data = JSON.parse(sessionStored);
-        if (!data.accessToken) return null;
-        cachedAccessToken2 = data.accessToken;
-        cachedExpiresAt2 = data.expiresAt ?? null;
-        cachedRefreshToken2 = data.refreshToken ?? null;
-        cachedScope2 = data.scope ?? null;
-        cachedWalletAddress2 = walletAddress ?? null;
-        return data;
-      } catch {
-      }
+    const plaintext = readPlaintextToken(
+      getTokenStorageKey2(walletAddress),
+      TOKEN_STORAGE_KEY2,
+      walletAddress
+    );
+    if (plaintext) {
+      cachedAccessToken2 = plaintext.accessToken;
+      cachedExpiresAt2 = plaintext.expiresAt ?? null;
+      cachedRefreshToken2 = plaintext.refreshToken ?? null;
+      cachedScope2 = plaintext.scope ?? null;
+      cachedWalletAddress2 = walletAddress ?? null;
+      return plaintext;
     }
     return null;
   } catch {
@@ -32378,16 +32631,19 @@ async function storeTokenData3(data, walletAddress) {
   cachedScope2 = data.scope ?? null;
   cachedWalletAddress2 = walletAddress ?? null;
   const json4 = JSON.stringify(data);
-  sessionStorage.setItem(TOKEN_STORAGE_KEY2, json4);
   if (walletAddress && hasEncryptionKey(walletAddress)) {
     try {
       const cryptoKey = await getEncryptionKey(walletAddress);
       const encrypted = await encryptDataWithKey(json4, cryptoKey);
-      localStorage.setItem(getTokenStorageKey2(walletAddress), `${ENCRYPTED_PREFIX3}${encrypted}`);
+      localStorage.setItem(getTokenStorageKey2(walletAddress), `${ENCRYPTED_PREFIX4}${encrypted}`);
+      sessionStorage.removeItem(getTokenStorageKey2(walletAddress));
+      return;
     } catch (error) {
       getLogger().warn("Failed to encrypt Drive OAuth token:", error);
     }
   }
+  const record = { wallet: walletAddress, token: data };
+  sessionStorage.setItem(getTokenStorageKey2(walletAddress), JSON.stringify(record));
 }
 function clearDriveToken(walletAddress) {
   if (typeof window === "undefined") return;
@@ -32401,6 +32657,7 @@ function clearDriveToken(walletAddress) {
     localStorage.removeItem(TOKEN_STORAGE_KEY2);
   }
   sessionStorage.removeItem(TOKEN_STORAGE_KEY2);
+  sessionStorage.removeItem(getTokenStorageKey2(walletAddress));
 }
 function isTokenExpired3(data, bufferSeconds = 60) {
   if (!data) return true;
@@ -32582,24 +32839,38 @@ async function migrateDriveToken(walletAddress) {
   if (typeof window === "undefined") return false;
   if (!walletAddress || !hasEncryptionKey(walletAddress)) return false;
   try {
-    const sessionStored = sessionStorage.getItem(TOKEN_STORAGE_KEY2);
-    const legacyStored = localStorage.getItem(TOKEN_STORAGE_KEY2);
-    const isLegacyUnencrypted = legacyStored && !legacyStored.startsWith(ENCRYPTED_PREFIX3);
-    const unencryptedJson = sessionStored || (isLegacyUnencrypted ? legacyStored : null);
-    if (!unencryptedJson) return false;
     const scopedKey = getTokenStorageKey2(walletAddress);
+    const sources = [
+      { key: scopedKey, store: sessionStorage },
+      // A read moves a legacy localStorage row here as plain text.
+      { key: scopedKey, store: localStorage },
+      { key: TOKEN_STORAGE_KEY2, store: sessionStorage },
+      { key: TOKEN_STORAGE_KEY2, store: localStorage }
+    ];
+    let used = null;
+    let unencryptedJson = "";
+    for (const source of sources) {
+      const value = source.store.getItem(source.key);
+      if (value && !value.startsWith(ENCRYPTED_PREFIX4)) {
+        unencryptedJson = value;
+        used = source;
+        break;
+      }
+    }
+    if (!used) return false;
     const existingEncrypted = localStorage.getItem(scopedKey);
-    if (existingEncrypted?.startsWith(ENCRYPTED_PREFIX3)) {
-      sessionStorage.removeItem(TOKEN_STORAGE_KEY2);
-      if (isLegacyUnencrypted) localStorage.removeItem(TOKEN_STORAGE_KEY2);
+    if (existingEncrypted?.startsWith(ENCRYPTED_PREFIX4)) {
+      used.store.removeItem(used.key);
       return true;
     }
-    const data = JSON.parse(unencryptedJson);
+    const data = parsePlaintextToken(unencryptedJson, walletAddress);
+    if (!data) return false;
     await storeTokenData3(data, walletAddress);
     const migrated = localStorage.getItem(scopedKey);
-    if (!migrated?.startsWith(ENCRYPTED_PREFIX3)) return false;
-    sessionStorage.removeItem(TOKEN_STORAGE_KEY2);
-    if (isLegacyUnencrypted) localStorage.removeItem(TOKEN_STORAGE_KEY2);
+    if (!migrated?.startsWith(ENCRYPTED_PREFIX4)) return false;
+    if (used.store !== localStorage || used.key !== scopedKey) {
+      used.store.removeItem(used.key);
+    }
     return true;
   } catch {
     return false;
@@ -32631,7 +32902,7 @@ var FALLBACK_OAUTH_AUTHORIZE = "https://api.notion.com/v1/oauth/authorize";
 var FALLBACK_OAUTH_TOKEN = "https://api.notion.com/v1/oauth/token";
 var FALLBACK_REGISTRATION = "https://api.notion.com/v1/oauth/register";
 var DEFAULT_TOKEN_EXPIRY_SECONDS = 8 * 3600;
-var ENCRYPTED_PREFIX4 = "enc:oauth:";
+var ENCRYPTED_PREFIX5 = "enc:oauth:";
 var cachedAccessToken3 = null;
 var cachedExpiresAt3 = null;
 var cachedWalletAddress3 = null;
@@ -32769,12 +33040,14 @@ async function storeTokenData4(data, walletAddress) {
     try {
       const cryptoKey = await getEncryptionKey(walletAddress);
       const encrypted = await encryptDataWithKey(json4, cryptoKey);
-      localStorage.setItem(getTokenStorageKey3(walletAddress), `${ENCRYPTED_PREFIX4}${encrypted}`);
+      localStorage.setItem(getTokenStorageKey3(walletAddress), `${ENCRYPTED_PREFIX5}${encrypted}`);
+      sessionStorage.removeItem(getTokenStorageKey3(walletAddress));
       return;
     } catch {
     }
   }
-  sessionStorage.setItem(TOKEN_STORAGE_KEY3, json4);
+  const record = { wallet: walletAddress, token: data };
+  sessionStorage.setItem(getTokenStorageKey3(walletAddress), JSON.stringify(record));
 }
 async function getStoredTokenData4(walletAddress) {
   if (typeof window === "undefined") return null;
@@ -32791,11 +33064,11 @@ async function getStoredTokenData4(walletAddress) {
   }
   try {
     const stored = localStorage.getItem(getTokenStorageKey3(walletAddress));
-    if (stored?.startsWith(ENCRYPTED_PREFIX4)) {
+    if (stored?.startsWith(ENCRYPTED_PREFIX5)) {
       if (walletAddress && hasEncryptionKey(walletAddress)) {
         try {
           const cryptoKey = await getEncryptionKey(walletAddress);
-          const encrypted = stored.slice(ENCRYPTED_PREFIX4.length);
+          const encrypted = stored.slice(ENCRYPTED_PREFIX5.length);
           const decrypted = await decryptDataWithKey(encrypted, cryptoKey);
           const data = JSON.parse(decrypted);
           if (data.accessToken) return data;
@@ -32803,12 +33076,12 @@ async function getStoredTokenData4(walletAddress) {
         }
       }
     }
-    const sessionStored = sessionStorage.getItem(TOKEN_STORAGE_KEY3);
-    if (sessionStored) {
-      const data = JSON.parse(sessionStored);
-      if (!data.accessToken) return null;
-      return data;
-    }
+    const plaintext = readPlaintextToken(
+      getTokenStorageKey3(walletAddress),
+      TOKEN_STORAGE_KEY3,
+      walletAddress
+    );
+    if (plaintext) return plaintext;
     return null;
   } catch {
     return null;
@@ -32818,6 +33091,7 @@ function clearNotionToken(walletAddress) {
   if (typeof window === "undefined") return;
   localStorage.removeItem(getTokenStorageKey3(walletAddress));
   sessionStorage.removeItem(TOKEN_STORAGE_KEY3);
+  sessionStorage.removeItem(getTokenStorageKey3(walletAddress));
   cachedAccessToken3 = null;
   cachedExpiresAt3 = null;
   cachedWalletAddress3 = null;
@@ -32833,20 +33107,34 @@ async function migrateNotionToken(walletAddress) {
   if (typeof window === "undefined") return false;
   if (!walletAddress || !hasEncryptionKey(walletAddress)) return false;
   try {
-    const sessionStored = sessionStorage.getItem(TOKEN_STORAGE_KEY3);
-    if (!sessionStored) return false;
     const scopedKey = getTokenStorageKey3(walletAddress);
+    const sources = [
+      { key: scopedKey, store: sessionStorage },
+      { key: TOKEN_STORAGE_KEY3, store: sessionStorage }
+    ];
+    let used = null;
+    let unencryptedJson = "";
+    for (const source of sources) {
+      const value = source.store.getItem(source.key);
+      if (value && !value.startsWith(ENCRYPTED_PREFIX5)) {
+        unencryptedJson = value;
+        used = source;
+        break;
+      }
+    }
+    if (!used) return false;
     const localStored = localStorage.getItem(scopedKey);
-    if (localStored?.startsWith(ENCRYPTED_PREFIX4)) {
+    if (localStored?.startsWith(ENCRYPTED_PREFIX5)) {
       localStorage.removeItem(scopedKey);
     }
-    const data = JSON.parse(sessionStored);
+    const data = parsePlaintextToken(unencryptedJson, walletAddress);
+    if (!data) return false;
     await storeTokenData4(data, walletAddress);
     const migrated = localStorage.getItem(scopedKey);
-    if (!migrated?.startsWith(ENCRYPTED_PREFIX4)) {
+    if (!migrated?.startsWith(ENCRYPTED_PREFIX5)) {
       return false;
     }
-    sessionStorage.removeItem(TOKEN_STORAGE_KEY3);
+    used.store.removeItem(used.key);
     return true;
   } catch {
     return false;
@@ -32858,12 +33146,12 @@ async function migrateNotionClientRegistration(walletAddress) {
   try {
     const sessionStored = sessionStorage.getItem(CLIENT_REGISTRATION_KEY);
     const legacyStored = localStorage.getItem(CLIENT_REGISTRATION_KEY);
-    const isLegacyUnencrypted = legacyStored && !legacyStored.startsWith(ENCRYPTED_PREFIX4);
+    const isLegacyUnencrypted = legacyStored && !legacyStored.startsWith(ENCRYPTED_PREFIX5);
     const unencryptedJson = sessionStored || (isLegacyUnencrypted ? legacyStored : null);
     if (!unencryptedJson) return false;
     const scopedKey = getClientRegistrationStorageKey(walletAddress);
     const existingEncrypted = localStorage.getItem(scopedKey);
-    if (existingEncrypted?.startsWith(ENCRYPTED_PREFIX4)) {
+    if (existingEncrypted?.startsWith(ENCRYPTED_PREFIX5)) {
       sessionStorage.removeItem(CLIENT_REGISTRATION_KEY);
       if (isLegacyUnencrypted) {
         localStorage.removeItem(CLIENT_REGISTRATION_KEY);
@@ -32873,7 +33161,7 @@ async function migrateNotionClientRegistration(walletAddress) {
     const data = JSON.parse(unencryptedJson);
     await storeClientRegistration(data, walletAddress);
     const migrated = localStorage.getItem(scopedKey);
-    if (!migrated?.startsWith(ENCRYPTED_PREFIX4)) {
+    if (!migrated?.startsWith(ENCRYPTED_PREFIX5)) {
       return false;
     }
     sessionStorage.removeItem(CLIENT_REGISTRATION_KEY);
@@ -32890,11 +33178,11 @@ async function getClientRegistration(walletAddress) {
   try {
     const scopedKey = getClientRegistrationStorageKey(walletAddress);
     const stored = localStorage.getItem(scopedKey);
-    if (stored?.startsWith(ENCRYPTED_PREFIX4)) {
+    if (stored?.startsWith(ENCRYPTED_PREFIX5)) {
       if (walletAddress && hasEncryptionKey(walletAddress)) {
         try {
           const cryptoKey = await getEncryptionKey(walletAddress);
-          const encrypted = stored.slice(ENCRYPTED_PREFIX4.length);
+          const encrypted = stored.slice(ENCRYPTED_PREFIX5.length);
           const decrypted = await decryptDataWithKey(encrypted, cryptoKey);
           const data = JSON.parse(decrypted);
           if (data.clientId) {
@@ -32904,7 +33192,7 @@ async function getClientRegistration(walletAddress) {
         }
       }
     }
-    if (stored && !stored.startsWith(ENCRYPTED_PREFIX4)) {
+    if (stored && !stored.startsWith(ENCRYPTED_PREFIX5)) {
       const data = JSON.parse(stored);
       if (!data.clientId) return null;
       return data;
@@ -32929,7 +33217,7 @@ async function storeClientRegistration(registration, walletAddress) {
       const cryptoKey = await getEncryptionKey(walletAddress);
       const encrypted = await encryptDataWithKey(json4, cryptoKey);
       const scopedKey = getClientRegistrationStorageKey(walletAddress);
-      localStorage.setItem(scopedKey, `${ENCRYPTED_PREFIX4}${encrypted}`);
+      localStorage.setItem(scopedKey, `${ENCRYPTED_PREFIX5}${encrypted}`);
     } catch {
     }
   }
@@ -33161,7 +33449,7 @@ var CODE_STORAGE_KEY4 = "github_oauth_state";
 var TOKEN_STORAGE_KEY4 = "oauth_token_github";
 var RETURN_URL_KEY4 = "github_return_url";
 var PENDING_MESSAGE_KEY4 = "github_pending_message";
-var ENCRYPTED_PREFIX5 = "enc:oauth:";
+var ENCRYPTED_PREFIX6 = "enc:oauth:";
 var cachedAccessToken4 = null;
 var cachedExpiresAt4 = null;
 var cachedRefreshToken3 = null;
@@ -33194,9 +33482,9 @@ async function getStoredTokenData5(walletAddress) {
   }
   try {
     const scopedStored = localStorage.getItem(getTokenStorageKey4(walletAddress));
-    if (scopedStored && scopedStored.startsWith(ENCRYPTED_PREFIX5) && walletAddress && hasEncryptionKey(walletAddress)) {
+    if (scopedStored && scopedStored.startsWith(ENCRYPTED_PREFIX6) && walletAddress && hasEncryptionKey(walletAddress)) {
       try {
-        const encryptedData = scopedStored.slice(ENCRYPTED_PREFIX5.length);
+        const encryptedData = scopedStored.slice(ENCRYPTED_PREFIX6.length);
         const cryptoKey = await getEncryptionKey(walletAddress);
         const decryptedJson = await decryptDataWithKey(encryptedData, cryptoKey);
         const data = JSON.parse(decryptedJson);
@@ -33211,34 +33499,18 @@ async function getStoredTokenData5(walletAddress) {
         getLogger().error("Failed to decrypt GitHub OAuth token:", error);
       }
     }
-    const legacyStored = localStorage.getItem(TOKEN_STORAGE_KEY4);
-    if (legacyStored && !legacyStored.startsWith(ENCRYPTED_PREFIX5)) {
-      try {
-        const data = JSON.parse(legacyStored);
-        if (data.accessToken) {
-          cachedAccessToken4 = data.accessToken;
-          cachedExpiresAt4 = data.expiresAt ?? null;
-          cachedRefreshToken3 = data.refreshToken ?? null;
-          cachedScope3 = data.scope ?? null;
-          cachedWalletAddress4 = walletAddress ?? null;
-          return data;
-        }
-      } catch {
-      }
-    }
-    const sessionStored = sessionStorage.getItem(TOKEN_STORAGE_KEY4);
-    if (sessionStored) {
-      try {
-        const data = JSON.parse(sessionStored);
-        if (!data.accessToken) return null;
-        cachedAccessToken4 = data.accessToken;
-        cachedExpiresAt4 = data.expiresAt ?? null;
-        cachedRefreshToken3 = data.refreshToken ?? null;
-        cachedScope3 = data.scope ?? null;
-        cachedWalletAddress4 = walletAddress ?? null;
-        return data;
-      } catch {
-      }
+    const plaintext = readPlaintextToken(
+      getTokenStorageKey4(walletAddress),
+      TOKEN_STORAGE_KEY4,
+      walletAddress
+    );
+    if (plaintext) {
+      cachedAccessToken4 = plaintext.accessToken;
+      cachedExpiresAt4 = plaintext.expiresAt ?? null;
+      cachedRefreshToken3 = plaintext.refreshToken ?? null;
+      cachedScope3 = plaintext.scope ?? null;
+      cachedWalletAddress4 = walletAddress ?? null;
+      return plaintext;
     }
     return null;
   } catch {
@@ -33253,16 +33525,19 @@ async function storeTokenData5(data, walletAddress) {
   cachedScope3 = data.scope ?? null;
   cachedWalletAddress4 = walletAddress ?? null;
   const json4 = JSON.stringify(data);
-  sessionStorage.setItem(TOKEN_STORAGE_KEY4, json4);
   if (walletAddress && hasEncryptionKey(walletAddress)) {
     try {
       const cryptoKey = await getEncryptionKey(walletAddress);
       const encrypted = await encryptDataWithKey(json4, cryptoKey);
-      localStorage.setItem(getTokenStorageKey4(walletAddress), `${ENCRYPTED_PREFIX5}${encrypted}`);
+      localStorage.setItem(getTokenStorageKey4(walletAddress), `${ENCRYPTED_PREFIX6}${encrypted}`);
+      sessionStorage.removeItem(getTokenStorageKey4(walletAddress));
+      return;
     } catch (error) {
       getLogger().warn("Failed to encrypt GitHub OAuth token:", error);
     }
   }
+  const record = { wallet: walletAddress, token: data };
+  sessionStorage.setItem(getTokenStorageKey4(walletAddress), JSON.stringify(record));
 }
 function clearGithubToken(walletAddress) {
   if (typeof window === "undefined") return;
@@ -33276,6 +33551,7 @@ function clearGithubToken(walletAddress) {
     localStorage.removeItem(TOKEN_STORAGE_KEY4);
   }
   sessionStorage.removeItem(TOKEN_STORAGE_KEY4);
+  sessionStorage.removeItem(getTokenStorageKey4(walletAddress));
 }
 function isTokenExpired5(data, bufferSeconds = 60) {
   if (!data) return true;
@@ -33484,24 +33760,38 @@ async function migrateGithubToken(walletAddress) {
   if (typeof window === "undefined") return false;
   if (!walletAddress || !hasEncryptionKey(walletAddress)) return false;
   try {
-    const sessionStored = sessionStorage.getItem(TOKEN_STORAGE_KEY4);
-    const legacyStored = localStorage.getItem(TOKEN_STORAGE_KEY4);
-    const isLegacyUnencrypted = legacyStored && !legacyStored.startsWith(ENCRYPTED_PREFIX5);
-    const unencryptedJson = sessionStored || (isLegacyUnencrypted ? legacyStored : null);
-    if (!unencryptedJson) return false;
     const scopedKey = getTokenStorageKey4(walletAddress);
+    const sources = [
+      { key: scopedKey, store: sessionStorage },
+      // A read moves a legacy localStorage row here as plain text.
+      { key: scopedKey, store: localStorage },
+      { key: TOKEN_STORAGE_KEY4, store: sessionStorage },
+      { key: TOKEN_STORAGE_KEY4, store: localStorage }
+    ];
+    let used = null;
+    let unencryptedJson = "";
+    for (const source of sources) {
+      const value = source.store.getItem(source.key);
+      if (value && !value.startsWith(ENCRYPTED_PREFIX6)) {
+        unencryptedJson = value;
+        used = source;
+        break;
+      }
+    }
+    if (!used) return false;
     const existingEncrypted = localStorage.getItem(scopedKey);
-    if (existingEncrypted?.startsWith(ENCRYPTED_PREFIX5)) {
-      sessionStorage.removeItem(TOKEN_STORAGE_KEY4);
-      if (isLegacyUnencrypted) localStorage.removeItem(TOKEN_STORAGE_KEY4);
+    if (existingEncrypted?.startsWith(ENCRYPTED_PREFIX6)) {
+      used.store.removeItem(used.key);
       return true;
     }
-    const data = JSON.parse(unencryptedJson);
+    const data = parsePlaintextToken(unencryptedJson, walletAddress);
+    if (!data) return false;
     await storeTokenData5(data, walletAddress);
     const migrated = localStorage.getItem(scopedKey);
-    if (!migrated?.startsWith(ENCRYPTED_PREFIX5)) return false;
-    sessionStorage.removeItem(TOKEN_STORAGE_KEY4);
-    if (isLegacyUnencrypted) localStorage.removeItem(TOKEN_STORAGE_KEY4);
+    if (!migrated?.startsWith(ENCRYPTED_PREFIX6)) return false;
+    if (used.store !== localStorage || used.key !== scopedKey) {
+      used.store.removeItem(used.key);
+    }
     return true;
   } catch {
     return false;