@anuma/sdk 6.31.1 → 6.31.2

package/dist/react/index.cjs

@@ -31540,79 +31540,159 @@ var import_react19 = require("react");
 // src/lib/backup/dropbox/auth.ts
 init_logger();
 
+// src/lib/auth/tokenRows.ts
+var ENCRYPTED_PREFIX = "enc:oauth:";
+function parsePlaintextToken(raw, walletAddress) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const record = parsed;
+  const data = record.token?.accessToken ? record.token : record;
+  if (!data?.accessToken) return null;
+  if (record.wallet && record.wallet !== walletAddress) return null;
+  return data;
+}
+function promoteUnscopedRow(raw, data, store, scopedKey, unscopedKey, walletAddress) {
+  const row = raw.startsWith(ENCRYPTED_PREFIX) ? raw : JSON.stringify({ wallet: walletAddress, token: data });
+  if (!store.getItem(scopedKey)) {
+    store.setItem(scopedKey, row);
+  }
+  store.removeItem(unscopedKey);
+}
+function readPlaintextToken(scopedKey, unscopedKey, walletAddress) {
+  if (typeof window === "undefined") return null;
+  const keys = scopedKey === unscopedKey ? [scopedKey] : [scopedKey, unscopedKey];
+  for (const key of keys) {
+    const candidates = [
+      [localStorage.getItem(key), localStorage],
+      [sessionStorage.getItem(key), sessionStorage]
+    ];
+    for (const [raw, store] of candidates) {
+      if (!raw) continue;
+      const data = parsePlaintextToken(raw, walletAddress);
+      if (!data) continue;
+      if (walletAddress && key === unscopedKey) {
+        promoteUnscopedRow(raw, data, store, scopedKey, unscopedKey, walletAddress);
+      }
+      return data;
+    }
+  }
+  return null;
+}
+
 // src/lib/backup/oauth/storage.ts
 init_logger();
 var STORAGE_KEY_PREFIX = "oauth_token_";
-var ENCRYPTED_PREFIX = "enc:oauth:";
-function getStorageKey(provider) {
-  return `${STORAGE_KEY_PREFIX}${provider}`;
+var ENCRYPTED_PREFIX2 = "enc:oauth:";
+function getStorageKey(provider, walletAddress) {
+  const base = `${STORAGE_KEY_PREFIX}${provider}`;
+  return walletAddress ? `${base}:${walletAddress}` : base;
+}
+function readRawRows(keys) {
+  const rows = [];
+  for (const key of keys) {
+    for (const store of [localStorage, sessionStorage]) {
+      const raw = store.getItem(key);
+      if (raw) rows.push({ raw, key, store });
+    }
+  }
+  return rows;
 }
 async function getStoredTokenData(provider, walletAddress) {
   if (typeof window === "undefined") return null;
   try {
-    const key = getStorageKey(provider);
-    let stored = localStorage.getItem(key);
-    if (!stored) {
-      stored = sessionStorage.getItem(key);
-    }
-    if (!stored) return null;
-    if (stored.startsWith(ENCRYPTED_PREFIX)) {
-      if (!walletAddress) {
-        getLogger().warn(
-          `Encrypted OAuth token found for ${provider} but no wallet address provided`
-        );
-        return null;
-      }
-      try {
-        const encryptedData = stored.slice(ENCRYPTED_PREFIX.length);
-        let decryptedJson;
-        try {
-          decryptedJson = await decryptData(encryptedData, walletAddress);
-        } catch {
-          decryptedJson = await decryptData(encryptedData, walletAddress, "v2");
-        }
-        const data2 = JSON.parse(decryptedJson);
-        if (!data2.accessToken) return null;
-        return data2;
-      } catch (error) {
-        getLogger().error(`Failed to decrypt OAuth token for ${provider}:`, error);
-        return null;
+    const scopedKey = getStorageKey(provider, walletAddress);
+    const legacyKey = getStorageKey(provider);
+    const keys = scopedKey === legacyKey ? [legacyKey] : [scopedKey, legacyKey];
+    for (const row of readRawRows(keys)) {
+      const data = await readTokenRow(row.raw, provider, walletAddress);
+      if (!data) continue;
+      if (walletAddress && row.key === legacyKey) {
+        promoteUnscopedRow(row.raw, data, row.store, scopedKey, legacyKey, walletAddress);
       }
+      return data;
     }
-    const data = JSON.parse(stored);
-    if (!data.accessToken) return null;
-    return data;
+    return null;
   } catch {
     return null;
   }
 }
+async function readTokenRow(stored, provider, walletAddress) {
+  if (stored.startsWith(ENCRYPTED_PREFIX2)) {
+    if (!walletAddress) {
+      getLogger().warn(
+        `Encrypted OAuth token found for ${provider} but no wallet address provided`
+      );
+      return null;
+    }
+    try {
+      const encryptedData = stored.slice(ENCRYPTED_PREFIX2.length);
+      let decryptedJson;
+      try {
+        decryptedJson = await decryptData(encryptedData, walletAddress);
+      } catch {
+        decryptedJson = await decryptData(encryptedData, walletAddress, "v2");
+      }
+      const data = JSON.parse(decryptedJson);
+      if (!data.accessToken) return null;
+      return data;
+    } catch (error) {
+      getLogger().error(`Failed to decrypt OAuth token for ${provider}:`, error);
+      return null;
+    }
+  }
+  return parsePlaintextToken(stored, walletAddress);
+}
 async function storeTokenData(provider, data, walletAddress) {
   if (typeof window === "undefined") return;
-  const key = getStorageKey(provider);
+  const key = getStorageKey(provider, walletAddress);
   const json4 = JSON.stringify(data);
+  const plaintextRecord = JSON.stringify({
+    wallet: walletAddress,
+    token: data
+  });
   if (walletAddress) {
     try {
       const encrypted = await encryptData(json4, walletAddress);
-      localStorage.setItem(key, `${ENCRYPTED_PREFIX}${encrypted}`);
+      localStorage.setItem(key, `${ENCRYPTED_PREFIX2}${encrypted}`);
+      sessionStorage.removeItem(key);
     } catch (error) {
       getLogger().warn(
         `Failed to encrypt OAuth token for ${provider}, storing temporarily:`,
         error
       );
-      sessionStorage.setItem(key, json4);
+      sessionStorage.setItem(key, plaintextRecord);
       throw new Error(
         `OAuth token encryption failed: ${error instanceof Error ? error.message : String(error)}`
       );
     }
   } else {
-    sessionStorage.setItem(key, json4);
+    sessionStorage.setItem(key, plaintextRecord);
   }
 }
-function clearTokenData(provider) {
+function clearTokenData(provider, walletAddress) {
   if (typeof window === "undefined") return;
-  const key = getStorageKey(provider);
-  localStorage.removeItem(key);
-  sessionStorage.removeItem(key);
+  const base = getStorageKey(provider);
+  const keys = walletAddress ? [getStorageKey(provider, walletAddress), base] : [base];
+  if (!walletAddress) keys.push(...suffixedKeys(base));
+  for (const key of keys) {
+    localStorage.removeItem(key);
+    sessionStorage.removeItem(key);
+  }
+}
+function suffixedKeys(base) {
+  const found = [];
+  for (const storage of [localStorage, sessionStorage]) {
+    for (let i = 0; i < storage.length; i++) {
+      const key = storage.key(i);
+      if (key && key.startsWith(`${base}:`) && !found.includes(key)) found.push(key);
+    }
+  }
+  return found;
 }
 function isTokenExpired(data, bufferSeconds = 60) {
   if (!data) return true;
@@ -31636,22 +31716,40 @@ async function getRefreshToken(provider, walletAddress) {
 async function migrateUnencryptedTokens(provider, walletAddress) {
   if (typeof window === "undefined") return false;
   try {
-    const key = getStorageKey(provider);
-    const localStored = localStorage.getItem(key);
-    const sessionStored = sessionStorage.getItem(key);
-    const isEncrypted2 = (value) => !!value && value.startsWith(ENCRYPTED_PREFIX);
-    const tokenToMigrate = sessionStored && !isEncrypted2(sessionStored) ? sessionStored : localStored && !isEncrypted2(localStored) ? localStored : null;
+    const scopedKey = getStorageKey(provider, walletAddress);
+    const legacyKey = getStorageKey(provider);
+    const keys = [scopedKey, legacyKey];
+    const isEncrypted2 = (value) => !!value && value.startsWith(ENCRYPTED_PREFIX2);
+    const plaintextAt = (key) => {
+      const stored = sessionStorage.getItem(key) ?? localStorage.getItem(key);
+      return stored && !isEncrypted2(stored) ? stored : null;
+    };
+    let tokenToMigrate = null;
+    for (const key of keys) {
+      const value = plaintextAt(key);
+      if (value) {
+        tokenToMigrate = value;
+        break;
+      }
+    }
     if (!tokenToMigrate) {
-      if (isEncrypted2(localStored) && sessionStored && !isEncrypted2(sessionStored)) {
-        sessionStorage.removeItem(key);
+      for (const key of keys) {
+        const stored = sessionStorage.getItem(key);
+        if (isEncrypted2(localStorage.getItem(key)) && stored && !isEncrypted2(stored)) {
+          sessionStorage.removeItem(key);
+        }
       }
       return false;
     }
     try {
-      const data = JSON.parse(tokenToMigrate);
+      const data = parsePlaintextToken(tokenToMigrate, walletAddress);
+      if (!data) return false;
       await storeTokenData(provider, data, walletAddress);
-      if (sessionStored && !isEncrypted2(sessionStored)) {
-        sessionStorage.removeItem(key);
+      for (const key of keys) {
+        if (plaintextAt(key)) sessionStorage.removeItem(key);
+        if (key === legacyKey && !isEncrypted2(localStorage.getItem(key))) {
+          localStorage.removeItem(key);
+        }
       }
       return true;
     } catch (error) {
@@ -31820,7 +31918,7 @@ async function refreshDropboxToken(apiClient, walletAddress) {
     await storeTokenData(PROVIDER, tokenData, walletAddress);
     return response.data.access_token;
   } catch {
-    clearTokenData(PROVIDER);
+    clearTokenData(PROVIDER, walletAddress);
     return null;
   }
 }
@@ -31836,7 +31934,7 @@ async function revokeDropboxToken(apiClient, walletAddress) {
     });
   } catch {
   } finally {
-    clearTokenData(PROVIDER);
+    clearTokenData(PROVIDER, walletAddress);
   }
 }
 async function getDropboxAccessToken(apiClient, walletAddress) {
@@ -32440,7 +32538,7 @@ async function refreshGoogleDriveToken(apiClient, walletAddress) {
     await storeTokenData(PROVIDER2, tokenData, walletAddress);
     return response.data.access_token;
   } catch {
-    clearTokenData(PROVIDER2);
+    clearTokenData(PROVIDER2, walletAddress);
     return null;
   }
 }
@@ -32456,7 +32554,7 @@ async function revokeGoogleDriveToken(apiClient, walletAddress) {
     });
   } catch {
   } finally {
-    clearTokenData(PROVIDER2);
+    clearTokenData(PROVIDER2, walletAddress);
   }
 }
 async function getGoogleDriveAccessToken(apiClient, walletAddress) {
@@ -34090,7 +34188,7 @@ var CODE_STORAGE_KEY2 = "google_calendar_oauth_state";
 var TOKEN_STORAGE_KEY = "oauth_token_google-calendar";
 var RETURN_URL_KEY = "google_calendar_return_url";
 var PENDING_MESSAGE_KEY = "google_calendar_pending_message";
-var ENCRYPTED_PREFIX2 = "enc:oauth:";
+var ENCRYPTED_PREFIX3 = "enc:oauth:";
 var cachedAccessToken = null;
 var cachedExpiresAt = null;
 var cachedRefreshToken = null;
@@ -34121,9 +34219,9 @@ async function getStoredTokenData2(walletAddress) {
   }
   try {
     const scopedStored = localStorage.getItem(getTokenStorageKey(walletAddress));
-    if (scopedStored && scopedStored.startsWith(ENCRYPTED_PREFIX2) && walletAddress && hasEncryptionKey(walletAddress)) {
+    if (scopedStored && scopedStored.startsWith(ENCRYPTED_PREFIX3) && walletAddress && hasEncryptionKey(walletAddress)) {
       try {
-        const encryptedData = scopedStored.slice(ENCRYPTED_PREFIX2.length);
+        const encryptedData = scopedStored.slice(ENCRYPTED_PREFIX3.length);
         const cryptoKey = await getEncryptionKey(walletAddress);
         const decryptedJson = await decryptDataWithKey(encryptedData, cryptoKey);
         const data = JSON.parse(decryptedJson);
@@ -34138,33 +34236,18 @@ async function getStoredTokenData2(walletAddress) {
         getLogger().error("Failed to decrypt Calendar OAuth token:", error);
       }
     }
-    const legacyStored = localStorage.getItem(TOKEN_STORAGE_KEY);
-    if (legacyStored && !legacyStored.startsWith(ENCRYPTED_PREFIX2)) {
-      try {
-        const data = JSON.parse(legacyStored);
-        if (data.accessToken) {
-          cachedAccessToken = data.accessToken;
-          cachedExpiresAt = data.expiresAt ?? null;
-          cachedRefreshToken = data.refreshToken ?? null;
-          cachedWalletAddress = walletAddress ?? null;
-          return data;
-        }
-      } catch {
-      }
-    }
-    const sessionStored = sessionStorage.getItem(TOKEN_STORAGE_KEY);
-    if (sessionStored) {
-      try {
-        const data = JSON.parse(sessionStored);
-        if (!data.accessToken) return null;
-        cachedAccessToken = data.accessToken;
-        cachedExpiresAt = data.expiresAt ?? null;
-        cachedRefreshToken = data.refreshToken ?? null;
-        cachedScope = data.scope ?? null;
-        cachedWalletAddress = walletAddress ?? null;
-        return data;
-      } catch {
-      }
+    const plaintext = readPlaintextToken(
+      getTokenStorageKey(walletAddress),
+      TOKEN_STORAGE_KEY,
+      walletAddress
+    );
+    if (plaintext) {
+      cachedAccessToken = plaintext.accessToken;
+      cachedExpiresAt = plaintext.expiresAt ?? null;
+      cachedRefreshToken = plaintext.refreshToken ?? null;
+      cachedScope = plaintext.scope ?? null;
+      cachedWalletAddress = walletAddress ?? null;
+      return plaintext;
     }
     return null;
   } catch {
@@ -34179,16 +34262,19 @@ async function storeTokenData2(data, walletAddress) {
   cachedScope = data.scope ?? null;
   cachedWalletAddress = walletAddress ?? null;
   const json4 = JSON.stringify(data);
-  sessionStorage.setItem(TOKEN_STORAGE_KEY, json4);
   if (walletAddress && hasEncryptionKey(walletAddress)) {
     try {
       const cryptoKey = await getEncryptionKey(walletAddress);
       const encrypted = await encryptDataWithKey(json4, cryptoKey);
-      localStorage.setItem(getTokenStorageKey(walletAddress), ENCRYPTED_PREFIX2 + encrypted);
+      localStorage.setItem(getTokenStorageKey(walletAddress), ENCRYPTED_PREFIX3 + encrypted);
+      sessionStorage.removeItem(getTokenStorageKey(walletAddress));
+      return;
     } catch (error) {
       getLogger().warn("Failed to encrypt Calendar OAuth token:", error);
     }
   }
+  const record = { wallet: walletAddress, token: data };
+  sessionStorage.setItem(getTokenStorageKey(walletAddress), JSON.stringify(record));
 }
 function clearCalendarToken(walletAddress) {
   if (typeof window === "undefined") return;
@@ -34202,6 +34288,7 @@ function clearCalendarToken(walletAddress) {
     localStorage.removeItem(TOKEN_STORAGE_KEY);
   }
   sessionStorage.removeItem(TOKEN_STORAGE_KEY);
+  sessionStorage.removeItem(getTokenStorageKey(walletAddress));
 }
 function isTokenExpired2(data, bufferSeconds = 60) {
   if (!data) return true;
@@ -34383,24 +34470,38 @@ async function migrateCalendarToken(walletAddress) {
   if (typeof window === "undefined") return false;
   if (!walletAddress || !hasEncryptionKey(walletAddress)) return false;
   try {
-    const sessionStored = sessionStorage.getItem(TOKEN_STORAGE_KEY);
-    const legacyStored = localStorage.getItem(TOKEN_STORAGE_KEY);
-    const isLegacyUnencrypted = legacyStored && !legacyStored.startsWith(ENCRYPTED_PREFIX2);
-    const unencryptedJson = sessionStored || (isLegacyUnencrypted ? legacyStored : null);
-    if (!unencryptedJson) return false;
     const scopedKey = getTokenStorageKey(walletAddress);
+    const sources = [
+      { key: scopedKey, store: sessionStorage },
+      // A read moves a legacy localStorage row here as plain text.
+      { key: scopedKey, store: localStorage },
+      { key: TOKEN_STORAGE_KEY, store: sessionStorage },
+      { key: TOKEN_STORAGE_KEY, store: localStorage }
+    ];
+    let used = null;
+    let unencryptedJson = "";
+    for (const source of sources) {
+      const value = source.store.getItem(source.key);
+      if (value && !value.startsWith(ENCRYPTED_PREFIX3)) {
+        unencryptedJson = value;
+        used = source;
+        break;
+      }
+    }
+    if (!used) return false;
     const existingEncrypted = localStorage.getItem(scopedKey);
-    if (existingEncrypted?.startsWith(ENCRYPTED_PREFIX2)) {
-      sessionStorage.removeItem(TOKEN_STORAGE_KEY);
-      if (isLegacyUnencrypted) localStorage.removeItem(TOKEN_STORAGE_KEY);
+    if (existingEncrypted?.startsWith(ENCRYPTED_PREFIX3)) {
+      used.store.removeItem(used.key);
       return true;
     }
-    const data = JSON.parse(unencryptedJson);
+    const data = parsePlaintextToken(unencryptedJson, walletAddress);
+    if (!data) return false;
     await storeTokenData2(data, walletAddress);
     const migrated = localStorage.getItem(scopedKey);
-    if (!migrated?.startsWith(ENCRYPTED_PREFIX2)) return false;
-    sessionStorage.removeItem(TOKEN_STORAGE_KEY);
-    if (isLegacyUnencrypted) localStorage.removeItem(TOKEN_STORAGE_KEY);
+    if (!migrated?.startsWith(ENCRYPTED_PREFIX3)) return false;
+    if (used.store !== localStorage || used.key !== scopedKey) {
+      used.store.removeItem(used.key);
+    }
     return true;
   } catch {
     return false;
@@ -34414,7 +34515,7 @@ var CODE_STORAGE_KEY3 = "google_drive_oauth_state";
 var TOKEN_STORAGE_KEY2 = "oauth_token_google-drive-full";
 var RETURN_URL_KEY2 = "google_drive_return_url";
 var PENDING_MESSAGE_KEY2 = "google_drive_pending_message";
-var ENCRYPTED_PREFIX3 = "enc:oauth:";
+var ENCRYPTED_PREFIX4 = "enc:oauth:";
 var cachedAccessToken2 = null;
 var cachedExpiresAt2 = null;
 var cachedRefreshToken2 = null;
@@ -34445,9 +34546,9 @@ async function getStoredTokenData3(walletAddress) {
   }
   try {
     const scopedStored = localStorage.getItem(getTokenStorageKey2(walletAddress));
-    if (scopedStored && scopedStored.startsWith(ENCRYPTED_PREFIX3) && walletAddress && hasEncryptionKey(walletAddress)) {
+    if (scopedStored && scopedStored.startsWith(ENCRYPTED_PREFIX4) && walletAddress && hasEncryptionKey(walletAddress)) {
       try {
-        const encryptedData = scopedStored.slice(ENCRYPTED_PREFIX3.length);
+        const encryptedData = scopedStored.slice(ENCRYPTED_PREFIX4.length);
         const cryptoKey = await getEncryptionKey(walletAddress);
         const decryptedJson = await decryptDataWithKey(encryptedData, cryptoKey);
         const data = JSON.parse(decryptedJson);
@@ -34462,33 +34563,18 @@ async function getStoredTokenData3(walletAddress) {
         getLogger().error("Failed to decrypt Drive OAuth token:", error);
       }
     }
-    const legacyStored = localStorage.getItem(TOKEN_STORAGE_KEY2);
-    if (legacyStored && !legacyStored.startsWith(ENCRYPTED_PREFIX3)) {
-      try {
-        const data = JSON.parse(legacyStored);
-        if (data.accessToken) {
-          cachedAccessToken2 = data.accessToken;
-          cachedExpiresAt2 = data.expiresAt ?? null;
-          cachedRefreshToken2 = data.refreshToken ?? null;
-          cachedWalletAddress2 = walletAddress ?? null;
-          return data;
-        }
-      } catch {
-      }
-    }
-    const sessionStored = sessionStorage.getItem(TOKEN_STORAGE_KEY2);
-    if (sessionStored) {
-      try {
-        const data = JSON.parse(sessionStored);
-        if (!data.accessToken) return null;
-        cachedAccessToken2 = data.accessToken;
-        cachedExpiresAt2 = data.expiresAt ?? null;
-        cachedRefreshToken2 = data.refreshToken ?? null;
-        cachedScope2 = data.scope ?? null;
-        cachedWalletAddress2 = walletAddress ?? null;
-        return data;
-      } catch {
-      }
+    const plaintext = readPlaintextToken(
+      getTokenStorageKey2(walletAddress),
+      TOKEN_STORAGE_KEY2,
+      walletAddress
+    );
+    if (plaintext) {
+      cachedAccessToken2 = plaintext.accessToken;
+      cachedExpiresAt2 = plaintext.expiresAt ?? null;
+      cachedRefreshToken2 = plaintext.refreshToken ?? null;
+      cachedScope2 = plaintext.scope ?? null;
+      cachedWalletAddress2 = walletAddress ?? null;
+      return plaintext;
     }
     return null;
   } catch {
@@ -34503,16 +34589,19 @@ async function storeTokenData3(data, walletAddress) {
   cachedScope2 = data.scope ?? null;
   cachedWalletAddress2 = walletAddress ?? null;
   const json4 = JSON.stringify(data);
-  sessionStorage.setItem(TOKEN_STORAGE_KEY2, json4);
   if (walletAddress && hasEncryptionKey(walletAddress)) {
     try {
       const cryptoKey = await getEncryptionKey(walletAddress);
       const encrypted = await encryptDataWithKey(json4, cryptoKey);
-      localStorage.setItem(getTokenStorageKey2(walletAddress), `${ENCRYPTED_PREFIX3}${encrypted}`);
+      localStorage.setItem(getTokenStorageKey2(walletAddress), `${ENCRYPTED_PREFIX4}${encrypted}`);
+      sessionStorage.removeItem(getTokenStorageKey2(walletAddress));
+      return;
     } catch (error) {
       getLogger().warn("Failed to encrypt Drive OAuth token:", error);
     }
   }
+  const record = { wallet: walletAddress, token: data };
+  sessionStorage.setItem(getTokenStorageKey2(walletAddress), JSON.stringify(record));
 }
 function clearDriveToken(walletAddress) {
   if (typeof window === "undefined") return;
@@ -34526,6 +34615,7 @@ function clearDriveToken(walletAddress) {
     localStorage.removeItem(TOKEN_STORAGE_KEY2);
   }
   sessionStorage.removeItem(TOKEN_STORAGE_KEY2);
+  sessionStorage.removeItem(getTokenStorageKey2(walletAddress));
 }
 function isTokenExpired3(data, bufferSeconds = 60) {
   if (!data) return true;
@@ -34707,24 +34797,38 @@ async function migrateDriveToken(walletAddress) {
   if (typeof window === "undefined") return false;
   if (!walletAddress || !hasEncryptionKey(walletAddress)) return false;
   try {
-    const sessionStored = sessionStorage.getItem(TOKEN_STORAGE_KEY2);
-    const legacyStored = localStorage.getItem(TOKEN_STORAGE_KEY2);
-    const isLegacyUnencrypted = legacyStored && !legacyStored.startsWith(ENCRYPTED_PREFIX3);
-    const unencryptedJson = sessionStored || (isLegacyUnencrypted ? legacyStored : null);
-    if (!unencryptedJson) return false;
     const scopedKey = getTokenStorageKey2(walletAddress);
+    const sources = [
+      { key: scopedKey, store: sessionStorage },
+      // A read moves a legacy localStorage row here as plain text.
+      { key: scopedKey, store: localStorage },
+      { key: TOKEN_STORAGE_KEY2, store: sessionStorage },
+      { key: TOKEN_STORAGE_KEY2, store: localStorage }
+    ];
+    let used = null;
+    let unencryptedJson = "";
+    for (const source of sources) {
+      const value = source.store.getItem(source.key);
+      if (value && !value.startsWith(ENCRYPTED_PREFIX4)) {
+        unencryptedJson = value;
+        used = source;
+        break;
+      }
+    }
+    if (!used) return false;
     const existingEncrypted = localStorage.getItem(scopedKey);
-    if (existingEncrypted?.startsWith(ENCRYPTED_PREFIX3)) {
-      sessionStorage.removeItem(TOKEN_STORAGE_KEY2);
-      if (isLegacyUnencrypted) localStorage.removeItem(TOKEN_STORAGE_KEY2);
+    if (existingEncrypted?.startsWith(ENCRYPTED_PREFIX4)) {
+      used.store.removeItem(used.key);
       return true;
     }
-    const data = JSON.parse(unencryptedJson);
+    const data = parsePlaintextToken(unencryptedJson, walletAddress);
+    if (!data) return false;
     await storeTokenData3(data, walletAddress);
     const migrated = localStorage.getItem(scopedKey);
-    if (!migrated?.startsWith(ENCRYPTED_PREFIX3)) return false;
-    sessionStorage.removeItem(TOKEN_STORAGE_KEY2);
-    if (isLegacyUnencrypted) localStorage.removeItem(TOKEN_STORAGE_KEY2);
+    if (!migrated?.startsWith(ENCRYPTED_PREFIX4)) return false;
+    if (used.store !== localStorage || used.key !== scopedKey) {
+      used.store.removeItem(used.key);
+    }
     return true;
   } catch {
     return false;
@@ -34757,7 +34861,7 @@ var FALLBACK_OAUTH_AUTHORIZE = "https://api.notion.com/v1/oauth/authorize";
 var FALLBACK_OAUTH_TOKEN = "https://api.notion.com/v1/oauth/token";
 var FALLBACK_REGISTRATION = "https://api.notion.com/v1/oauth/register";
 var DEFAULT_TOKEN_EXPIRY_SECONDS = 8 * 3600;
-var ENCRYPTED_PREFIX4 = "enc:oauth:";
+var ENCRYPTED_PREFIX5 = "enc:oauth:";
 var cachedAccessToken3 = null;
 var cachedExpiresAt3 = null;
 var cachedWalletAddress3 = null;
@@ -34895,12 +34999,14 @@ async function storeTokenData4(data, walletAddress) {
     try {
       const cryptoKey = await getEncryptionKey(walletAddress);
       const encrypted = await encryptDataWithKey(json4, cryptoKey);
-      localStorage.setItem(getTokenStorageKey3(walletAddress), `${ENCRYPTED_PREFIX4}${encrypted}`);
+      localStorage.setItem(getTokenStorageKey3(walletAddress), `${ENCRYPTED_PREFIX5}${encrypted}`);
+      sessionStorage.removeItem(getTokenStorageKey3(walletAddress));
       return;
     } catch {
     }
   }
-  sessionStorage.setItem(TOKEN_STORAGE_KEY3, json4);
+  const record = { wallet: walletAddress, token: data };
+  sessionStorage.setItem(getTokenStorageKey3(walletAddress), JSON.stringify(record));
 }
 async function getStoredTokenData4(walletAddress) {
   if (typeof window === "undefined") return null;
@@ -34917,11 +35023,11 @@ async function getStoredTokenData4(walletAddress) {
   }
   try {
     const stored = localStorage.getItem(getTokenStorageKey3(walletAddress));
-    if (stored?.startsWith(ENCRYPTED_PREFIX4)) {
+    if (stored?.startsWith(ENCRYPTED_PREFIX5)) {
       if (walletAddress && hasEncryptionKey(walletAddress)) {
         try {
           const cryptoKey = await getEncryptionKey(walletAddress);
-          const encrypted = stored.slice(ENCRYPTED_PREFIX4.length);
+          const encrypted = stored.slice(ENCRYPTED_PREFIX5.length);
           const decrypted = await decryptDataWithKey(encrypted, cryptoKey);
           const data = JSON.parse(decrypted);
           if (data.accessToken) return data;
@@ -34929,12 +35035,12 @@ async function getStoredTokenData4(walletAddress) {
         }
       }
     }
-    const sessionStored = sessionStorage.getItem(TOKEN_STORAGE_KEY3);
-    if (sessionStored) {
-      const data = JSON.parse(sessionStored);
-      if (!data.accessToken) return null;
-      return data;
-    }
+    const plaintext = readPlaintextToken(
+      getTokenStorageKey3(walletAddress),
+      TOKEN_STORAGE_KEY3,
+      walletAddress
+    );
+    if (plaintext) return plaintext;
     return null;
   } catch {
     return null;
@@ -34944,6 +35050,7 @@ function clearNotionToken(walletAddress) {
   if (typeof window === "undefined") return;
   localStorage.removeItem(getTokenStorageKey3(walletAddress));
   sessionStorage.removeItem(TOKEN_STORAGE_KEY3);
+  sessionStorage.removeItem(getTokenStorageKey3(walletAddress));
   cachedAccessToken3 = null;
   cachedExpiresAt3 = null;
   cachedWalletAddress3 = null;
@@ -34959,20 +35066,34 @@ async function migrateNotionToken(walletAddress) {
   if (typeof window === "undefined") return false;
   if (!walletAddress || !hasEncryptionKey(walletAddress)) return false;
   try {
-    const sessionStored = sessionStorage.getItem(TOKEN_STORAGE_KEY3);
-    if (!sessionStored) return false;
     const scopedKey = getTokenStorageKey3(walletAddress);
+    const sources = [
+      { key: scopedKey, store: sessionStorage },
+      { key: TOKEN_STORAGE_KEY3, store: sessionStorage }
+    ];
+    let used = null;
+    let unencryptedJson = "";
+    for (const source of sources) {
+      const value = source.store.getItem(source.key);
+      if (value && !value.startsWith(ENCRYPTED_PREFIX5)) {
+        unencryptedJson = value;
+        used = source;
+        break;
+      }
+    }
+    if (!used) return false;
     const localStored = localStorage.getItem(scopedKey);
-    if (localStored?.startsWith(ENCRYPTED_PREFIX4)) {
+    if (localStored?.startsWith(ENCRYPTED_PREFIX5)) {
       localStorage.removeItem(scopedKey);
     }
-    const data = JSON.parse(sessionStored);
+    const data = parsePlaintextToken(unencryptedJson, walletAddress);
+    if (!data) return false;
     await storeTokenData4(data, walletAddress);
     const migrated = localStorage.getItem(scopedKey);
-    if (!migrated?.startsWith(ENCRYPTED_PREFIX4)) {
+    if (!migrated?.startsWith(ENCRYPTED_PREFIX5)) {
       return false;
     }
-    sessionStorage.removeItem(TOKEN_STORAGE_KEY3);
+    used.store.removeItem(used.key);
     return true;
   } catch {
     return false;
@@ -34984,12 +35105,12 @@ async function migrateNotionClientRegistration(walletAddress) {
   try {
     const sessionStored = sessionStorage.getItem(CLIENT_REGISTRATION_KEY);
     const legacyStored = localStorage.getItem(CLIENT_REGISTRATION_KEY);
-    const isLegacyUnencrypted = legacyStored && !legacyStored.startsWith(ENCRYPTED_PREFIX4);
+    const isLegacyUnencrypted = legacyStored && !legacyStored.startsWith(ENCRYPTED_PREFIX5);
     const unencryptedJson = sessionStored || (isLegacyUnencrypted ? legacyStored : null);
     if (!unencryptedJson) return false;
     const scopedKey = getClientRegistrationStorageKey(walletAddress);
     const existingEncrypted = localStorage.getItem(scopedKey);
-    if (existingEncrypted?.startsWith(ENCRYPTED_PREFIX4)) {
+    if (existingEncrypted?.startsWith(ENCRYPTED_PREFIX5)) {
       sessionStorage.removeItem(CLIENT_REGISTRATION_KEY);
       if (isLegacyUnencrypted) {
         localStorage.removeItem(CLIENT_REGISTRATION_KEY);
@@ -34999,7 +35120,7 @@ async function migrateNotionClientRegistration(walletAddress) {
     const data = JSON.parse(unencryptedJson);
     await storeClientRegistration(data, walletAddress);
     const migrated = localStorage.getItem(scopedKey);
-    if (!migrated?.startsWith(ENCRYPTED_PREFIX4)) {
+    if (!migrated?.startsWith(ENCRYPTED_PREFIX5)) {
       return false;
     }
     sessionStorage.removeItem(CLIENT_REGISTRATION_KEY);
@@ -35016,11 +35137,11 @@ async function getClientRegistration(walletAddress) {
   try {
     const scopedKey = getClientRegistrationStorageKey(walletAddress);
     const stored = localStorage.getItem(scopedKey);
-    if (stored?.startsWith(ENCRYPTED_PREFIX4)) {
+    if (stored?.startsWith(ENCRYPTED_PREFIX5)) {
       if (walletAddress && hasEncryptionKey(walletAddress)) {
         try {
           const cryptoKey = await getEncryptionKey(walletAddress);
-          const encrypted = stored.slice(ENCRYPTED_PREFIX4.length);
+          const encrypted = stored.slice(ENCRYPTED_PREFIX5.length);
           const decrypted = await decryptDataWithKey(encrypted, cryptoKey);
           const data = JSON.parse(decrypted);
           if (data.clientId) {
@@ -35030,7 +35151,7 @@ async function getClientRegistration(walletAddress) {
         }
       }
     }
-    if (stored && !stored.startsWith(ENCRYPTED_PREFIX4)) {
+    if (stored && !stored.startsWith(ENCRYPTED_PREFIX5)) {
       const data = JSON.parse(stored);
       if (!data.clientId) return null;
       return data;
@@ -35055,7 +35176,7 @@ async function storeClientRegistration(registration, walletAddress) {
       const cryptoKey = await getEncryptionKey(walletAddress);
       const encrypted = await encryptDataWithKey(json4, cryptoKey);
       const scopedKey = getClientRegistrationStorageKey(walletAddress);
-      localStorage.setItem(scopedKey, `${ENCRYPTED_PREFIX4}${encrypted}`);
+      localStorage.setItem(scopedKey, `${ENCRYPTED_PREFIX5}${encrypted}`);
     } catch {
     }
   }
@@ -35288,7 +35409,7 @@ var CODE_STORAGE_KEY4 = "github_oauth_state";
 var TOKEN_STORAGE_KEY4 = "oauth_token_github";
 var RETURN_URL_KEY4 = "github_return_url";
 var PENDING_MESSAGE_KEY4 = "github_pending_message";
-var ENCRYPTED_PREFIX5 = "enc:oauth:";
+var ENCRYPTED_PREFIX6 = "enc:oauth:";
 var cachedAccessToken4 = null;
 var cachedExpiresAt4 = null;
 var cachedRefreshToken3 = null;
@@ -35321,9 +35442,9 @@ async function getStoredTokenData5(walletAddress) {
   }
   try {
     const scopedStored = localStorage.getItem(getTokenStorageKey4(walletAddress));
-    if (scopedStored && scopedStored.startsWith(ENCRYPTED_PREFIX5) && walletAddress && hasEncryptionKey(walletAddress)) {
+    if (scopedStored && scopedStored.startsWith(ENCRYPTED_PREFIX6) && walletAddress && hasEncryptionKey(walletAddress)) {
       try {
-        const encryptedData = scopedStored.slice(ENCRYPTED_PREFIX5.length);
+        const encryptedData = scopedStored.slice(ENCRYPTED_PREFIX6.length);
         const cryptoKey = await getEncryptionKey(walletAddress);
         const decryptedJson = await decryptDataWithKey(encryptedData, cryptoKey);
         const data = JSON.parse(decryptedJson);
@@ -35338,34 +35459,18 @@ async function getStoredTokenData5(walletAddress) {
         getLogger().error("Failed to decrypt GitHub OAuth token:", error);
       }
     }
-    const legacyStored = localStorage.getItem(TOKEN_STORAGE_KEY4);
-    if (legacyStored && !legacyStored.startsWith(ENCRYPTED_PREFIX5)) {
-      try {
-        const data = JSON.parse(legacyStored);
-        if (data.accessToken) {
-          cachedAccessToken4 = data.accessToken;
-          cachedExpiresAt4 = data.expiresAt ?? null;
-          cachedRefreshToken3 = data.refreshToken ?? null;
-          cachedScope3 = data.scope ?? null;
-          cachedWalletAddress4 = walletAddress ?? null;
-          return data;
-        }
-      } catch {
-      }
-    }
-    const sessionStored = sessionStorage.getItem(TOKEN_STORAGE_KEY4);
-    if (sessionStored) {
-      try {
-        const data = JSON.parse(sessionStored);
-        if (!data.accessToken) return null;
-        cachedAccessToken4 = data.accessToken;
-        cachedExpiresAt4 = data.expiresAt ?? null;
-        cachedRefreshToken3 = data.refreshToken ?? null;
-        cachedScope3 = data.scope ?? null;
-        cachedWalletAddress4 = walletAddress ?? null;
-        return data;
-      } catch {
-      }
+    const plaintext = readPlaintextToken(
+      getTokenStorageKey4(walletAddress),
+      TOKEN_STORAGE_KEY4,
+      walletAddress
+    );
+    if (plaintext) {
+      cachedAccessToken4 = plaintext.accessToken;
+      cachedExpiresAt4 = plaintext.expiresAt ?? null;
+      cachedRefreshToken3 = plaintext.refreshToken ?? null;
+      cachedScope3 = plaintext.scope ?? null;
+      cachedWalletAddress4 = walletAddress ?? null;
+      return plaintext;
     }
     return null;
   } catch {
@@ -35380,16 +35485,19 @@ async function storeTokenData5(data, walletAddress) {
   cachedScope3 = data.scope ?? null;
   cachedWalletAddress4 = walletAddress ?? null;
   const json4 = JSON.stringify(data);
-  sessionStorage.setItem(TOKEN_STORAGE_KEY4, json4);
   if (walletAddress && hasEncryptionKey(walletAddress)) {
     try {
       const cryptoKey = await getEncryptionKey(walletAddress);
       const encrypted = await encryptDataWithKey(json4, cryptoKey);
-      localStorage.setItem(getTokenStorageKey4(walletAddress), `${ENCRYPTED_PREFIX5}${encrypted}`);
+      localStorage.setItem(getTokenStorageKey4(walletAddress), `${ENCRYPTED_PREFIX6}${encrypted}`);
+      sessionStorage.removeItem(getTokenStorageKey4(walletAddress));
+      return;
     } catch (error) {
       getLogger().warn("Failed to encrypt GitHub OAuth token:", error);
     }
   }
+  const record = { wallet: walletAddress, token: data };
+  sessionStorage.setItem(getTokenStorageKey4(walletAddress), JSON.stringify(record));
 }
 function clearGithubToken(walletAddress) {
   if (typeof window === "undefined") return;
@@ -35403,6 +35511,7 @@ function clearGithubToken(walletAddress) {
     localStorage.removeItem(TOKEN_STORAGE_KEY4);
   }
   sessionStorage.removeItem(TOKEN_STORAGE_KEY4);
+  sessionStorage.removeItem(getTokenStorageKey4(walletAddress));
 }
 function isTokenExpired5(data, bufferSeconds = 60) {
   if (!data) return true;
@@ -35611,24 +35720,38 @@ async function migrateGithubToken(walletAddress) {
   if (typeof window === "undefined") return false;
   if (!walletAddress || !hasEncryptionKey(walletAddress)) return false;
   try {
-    const sessionStored = sessionStorage.getItem(TOKEN_STORAGE_KEY4);
-    const legacyStored = localStorage.getItem(TOKEN_STORAGE_KEY4);
-    const isLegacyUnencrypted = legacyStored && !legacyStored.startsWith(ENCRYPTED_PREFIX5);
-    const unencryptedJson = sessionStored || (isLegacyUnencrypted ? legacyStored : null);
-    if (!unencryptedJson) return false;
     const scopedKey = getTokenStorageKey4(walletAddress);
+    const sources = [
+      { key: scopedKey, store: sessionStorage },
+      // A read moves a legacy localStorage row here as plain text.
+      { key: scopedKey, store: localStorage },
+      { key: TOKEN_STORAGE_KEY4, store: sessionStorage },
+      { key: TOKEN_STORAGE_KEY4, store: localStorage }
+    ];
+    let used = null;
+    let unencryptedJson = "";
+    for (const source of sources) {
+      const value = source.store.getItem(source.key);
+      if (value && !value.startsWith(ENCRYPTED_PREFIX6)) {
+        unencryptedJson = value;
+        used = source;
+        break;
+      }
+    }
+    if (!used) return false;
     const existingEncrypted = localStorage.getItem(scopedKey);
-    if (existingEncrypted?.startsWith(ENCRYPTED_PREFIX5)) {
-      sessionStorage.removeItem(TOKEN_STORAGE_KEY4);
-      if (isLegacyUnencrypted) localStorage.removeItem(TOKEN_STORAGE_KEY4);
+    if (existingEncrypted?.startsWith(ENCRYPTED_PREFIX6)) {
+      used.store.removeItem(used.key);
       return true;
     }
-    const data = JSON.parse(unencryptedJson);
+    const data = parsePlaintextToken(unencryptedJson, walletAddress);
+    if (!data) return false;
     await storeTokenData5(data, walletAddress);
     const migrated = localStorage.getItem(scopedKey);
-    if (!migrated?.startsWith(ENCRYPTED_PREFIX5)) return false;
-    sessionStorage.removeItem(TOKEN_STORAGE_KEY4);
-    if (isLegacyUnencrypted) localStorage.removeItem(TOKEN_STORAGE_KEY4);
+    if (!migrated?.startsWith(ENCRYPTED_PREFIX6)) return false;
+    if (used.store !== localStorage || used.key !== scopedKey) {
+      used.store.removeItem(used.key);
+    }
     return true;
   } catch {
     return false;