@anuma/sdk 7.0.0 → 7.0.1

package/dist/index.mjs

@@ -1148,6 +1148,192 @@ function attachFileContextToLastUserMessage(messages, fileContext) {
   return result;
 }
 
+// src/lib/logger.ts
+var consoleLogger = {
+  debug: console.log.bind(console),
+  info: console.info.bind(console),
+  warn: console.warn.bind(console),
+  error: console.error.bind(console)
+};
+var noopLogger = {
+  debug: () => {
+  },
+  info: () => {
+  },
+  warn: () => {
+  },
+  error: () => {
+  }
+};
+var LOGGER_STATE_KEY = /* @__PURE__ */ Symbol.for("@anuma/sdk/logger/v1");
+var loggerGlobal = globalThis;
+var fallbackLoggerState = { logger: consoleLogger };
+var fallbackWarned = false;
+function getLoggerState() {
+  try {
+    return loggerGlobal[LOGGER_STATE_KEY] ?? (loggerGlobal[LOGGER_STATE_KEY] = fallbackLoggerState);
+  } catch {
+    if (!fallbackWarned) {
+      fallbackWarned = true;
+      fallbackLoggerState.logger.warn(
+        "@anuma/sdk: the global object rejects new properties. This entrypoint keeps its own logger, so setLogger does not reach other entrypoints."
+      );
+    }
+    return fallbackLoggerState;
+  }
+}
+function setLogger(logger) {
+  getLoggerState().logger = logger;
+}
+function getLogger() {
+  return getLoggerState().logger;
+}
+
+// src/react/useEncryption.ts
+var EncryptionKeyMissingError = class extends Error {
+  constructor(address, version) {
+    super(
+      `Encryption key (${version}) not found for ${address}. Please sign a message to generate your encryption key.`
+    );
+    this.name = "EncryptionKeyMissingError";
+    this.address = address;
+    this.version = version;
+  }
+};
+var encryptionKeyStore = /* @__PURE__ */ new Map();
+var cryptoKeyCache = /* @__PURE__ */ new Map();
+var clearAllEncryptionStateCallbacks = /* @__PURE__ */ new Set();
+function onClearAllEncryptionState(callback) {
+  clearAllEncryptionStateCallbacks.add(callback);
+  return () => {
+    clearAllEncryptionStateCallbacks.delete(callback);
+  };
+}
+function getStoredKeyByVersion(address, version) {
+  const keys = encryptionKeyStore.get(address);
+  if (!keys) return null;
+  const value = version === "v2" ? keys.legacy : keys.current;
+  return value ?? null;
+}
+function hexNibble(code) {
+  if (code >= 48 && code <= 57) return code - 48;
+  if (code >= 65 && code <= 70) return code - 55;
+  if (code >= 97 && code <= 102) return code - 87;
+  return -1;
+}
+function hexToBytes(hex) {
+  if (typeof hex !== "string") {
+    throw new TypeError(
+      "hexToBytes: expected a hex string. Pass raw signature bytes to deriveKeyFromSignatureBytes instead of stringifying them."
+    );
+  }
+  const cleanHex = hex.startsWith("0x") ? hex.slice(2) : hex;
+  if (cleanHex.length === 0 || cleanHex.length % 2 !== 0) {
+    throw new Error(
+      `hexToBytes: invalid hex string (expected a non-empty even length, got ${cleanHex.length})`
+    );
+  }
+  const bytes = new Uint8Array(cleanHex.length / 2);
+  for (let i = 0; i < cleanHex.length; i += 2) {
+    const hi = hexNibble(cleanHex.charCodeAt(i));
+    const lo = hexNibble(cleanHex.charCodeAt(i + 1));
+    if (hi < 0 || lo < 0) {
+      throw new Error(`hexToBytes: invalid hex string (non-hex character at index ${i})`);
+    }
+    bytes[i / 2] = hi << 4 | lo;
+  }
+  return bytes;
+}
+var SHARED_TEXT_ENCODER = new TextEncoder();
+var SHARED_TEXT_DECODER = new TextDecoder();
+async function getEncryptionKey(address, version = "v3") {
+  const cacheKey = `${address}:${version}`;
+  const cachedKey = cryptoKeyCache.get(cacheKey);
+  if (cachedKey) {
+    return cachedKey;
+  }
+  const keyHex = getStoredKeyByVersion(address, version);
+  if (!keyHex) {
+    throw new EncryptionKeyMissingError(address, version);
+  }
+  const keyBytes = hexToBytes(keyHex);
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    keyBytes.buffer,
+    { name: "AES-GCM" },
+    false,
+    ["encrypt", "decrypt"]
+  );
+  cryptoKeyCache.set(cacheKey, cryptoKey);
+  return cryptoKey;
+}
+async function decryptData(encryptedHex, address, version = "v3") {
+  const key = await getEncryptionKey(address, version);
+  return decryptDataWithKey(encryptedHex, key);
+}
+function hasEncryptionKey(address, version) {
+  return getStoredKeyByVersion(address, version ?? "v3") !== null;
+}
+async function decryptDataWithKey(encryptedHex, key) {
+  const combined = hexToBytes(encryptedHex);
+  const iv = combined.subarray(0, 12);
+  const encryptedData = combined.subarray(12);
+  const decryptedData = await crypto.subtle.decrypt(
+    {
+      name: "AES-GCM",
+      iv
+    },
+    key,
+    encryptedData
+  );
+  return SHARED_TEXT_DECODER.decode(decryptedData);
+}
+
+// src/lib/db/encryption-utils.ts
+function isEncrypted(value) {
+  const prefix = value.startsWith("enc:v3:") ? "enc:v3:" : value.startsWith("enc:v2:") ? "enc:v2:" : null;
+  if (!prefix) return false;
+  const payload = value.slice(prefix.length);
+  return payload.length >= 56 && /^[0-9a-f]+$/i.test(payload);
+}
+function hasEncryptedToolPayload(event) {
+  return [event.arguments, event.output].some(
+    (value) => typeof value === "string" && isEncrypted(value)
+  );
+}
+function detectEncryptionVersion(value) {
+  if (value.startsWith("enc:v3:")) {
+    return { version: "v3", encryptedData: value.slice("enc:v3:".length) };
+  }
+  if (value.startsWith("enc:v2:")) {
+    return { version: "v2", encryptedData: value.slice("enc:v2:".length) };
+  }
+  return null;
+}
+async function decryptFieldDetailed(value, address) {
+  if (!value) return { status: "plaintext", value };
+  const detected = detectEncryptionVersion(value);
+  if (!detected) return { status: "plaintext", value };
+  if (detected.encryptedData.length < 56 || !/^[0-9a-f]+$/i.test(detected.encryptedData)) {
+    return { status: "invalid_payload", value, version: detected.version };
+  }
+  try {
+    const plaintext = await decryptData(detected.encryptedData, address, detected.version);
+    return { status: "ok", value: plaintext, version: detected.version };
+  } catch (error) {
+    if (error instanceof EncryptionKeyMissingError) {
+      getLogger().warn("Failed to decrypt field (key missing for version):", error.message);
+      return { status: "key_missing", value, version: detected.version };
+    }
+    getLogger().warn("Failed to decrypt field (auth mismatch or crypto error):", error);
+    return { status: "auth_mismatch", value, version: detected.version };
+  }
+}
+async function decryptField(value, address) {
+  const result = await decryptFieldDetailed(value, address);
+  return result.value;
+}
+
 // src/lib/chat/reservationReceipts.ts
 var ACTIONS = [
   {
@@ -1169,7 +1355,8 @@ function extractReservationReceipts(toolCallEvents) {
   for (const event of toolCallEvents ?? []) {
     const action = ACTIONS.find((a) => event.name?.endsWith(a.tool));
     const output = event.output ?? "";
-    if (!action || !output || NOT_AN_ATTEMPT.test(output)) continue;
+    if (!action || !output || hasEncryptedToolPayload(event) || NOT_AN_ATTEMPT.test(output))
+      continue;
     const kept = latest.get(action.kind)?.status;
     if (kept === "made") continue;
     const receipt = toReceipt(action, event.arguments ?? "", output);
@@ -1418,187 +1605,6 @@ function getImageModel(r) {
   return r.image_model;
 }
 
-// src/lib/logger.ts
-var consoleLogger = {
-  debug: console.log.bind(console),
-  info: console.info.bind(console),
-  warn: console.warn.bind(console),
-  error: console.error.bind(console)
-};
-var noopLogger = {
-  debug: () => {
-  },
-  info: () => {
-  },
-  warn: () => {
-  },
-  error: () => {
-  }
-};
-var LOGGER_STATE_KEY = /* @__PURE__ */ Symbol.for("@anuma/sdk/logger/v1");
-var loggerGlobal = globalThis;
-var fallbackLoggerState = { logger: consoleLogger };
-var fallbackWarned = false;
-function getLoggerState() {
-  try {
-    return loggerGlobal[LOGGER_STATE_KEY] ?? (loggerGlobal[LOGGER_STATE_KEY] = fallbackLoggerState);
-  } catch {
-    if (!fallbackWarned) {
-      fallbackWarned = true;
-      fallbackLoggerState.logger.warn(
-        "@anuma/sdk: the global object rejects new properties. This entrypoint keeps its own logger, so setLogger does not reach other entrypoints."
-      );
-    }
-    return fallbackLoggerState;
-  }
-}
-function setLogger(logger) {
-  getLoggerState().logger = logger;
-}
-function getLogger() {
-  return getLoggerState().logger;
-}
-
-// src/react/useEncryption.ts
-var EncryptionKeyMissingError = class extends Error {
-  constructor(address, version) {
-    super(
-      `Encryption key (${version}) not found for ${address}. Please sign a message to generate your encryption key.`
-    );
-    this.name = "EncryptionKeyMissingError";
-    this.address = address;
-    this.version = version;
-  }
-};
-var encryptionKeyStore = /* @__PURE__ */ new Map();
-var cryptoKeyCache = /* @__PURE__ */ new Map();
-var clearAllEncryptionStateCallbacks = /* @__PURE__ */ new Set();
-function onClearAllEncryptionState(callback) {
-  clearAllEncryptionStateCallbacks.add(callback);
-  return () => {
-    clearAllEncryptionStateCallbacks.delete(callback);
-  };
-}
-function getStoredKeyByVersion(address, version) {
-  const keys = encryptionKeyStore.get(address);
-  if (!keys) return null;
-  const value = version === "v2" ? keys.legacy : keys.current;
-  return value ?? null;
-}
-function hexNibble(code) {
-  if (code >= 48 && code <= 57) return code - 48;
-  if (code >= 65 && code <= 70) return code - 55;
-  if (code >= 97 && code <= 102) return code - 87;
-  return -1;
-}
-function hexToBytes(hex) {
-  if (typeof hex !== "string") {
-    throw new TypeError(
-      "hexToBytes: expected a hex string. Pass raw signature bytes to deriveKeyFromSignatureBytes instead of stringifying them."
-    );
-  }
-  const cleanHex = hex.startsWith("0x") ? hex.slice(2) : hex;
-  if (cleanHex.length === 0 || cleanHex.length % 2 !== 0) {
-    throw new Error(
-      `hexToBytes: invalid hex string (expected a non-empty even length, got ${cleanHex.length})`
-    );
-  }
-  const bytes = new Uint8Array(cleanHex.length / 2);
-  for (let i = 0; i < cleanHex.length; i += 2) {
-    const hi = hexNibble(cleanHex.charCodeAt(i));
-    const lo = hexNibble(cleanHex.charCodeAt(i + 1));
-    if (hi < 0 || lo < 0) {
-      throw new Error(`hexToBytes: invalid hex string (non-hex character at index ${i})`);
-    }
-    bytes[i / 2] = hi << 4 | lo;
-  }
-  return bytes;
-}
-var SHARED_TEXT_ENCODER = new TextEncoder();
-var SHARED_TEXT_DECODER = new TextDecoder();
-async function getEncryptionKey(address, version = "v3") {
-  const cacheKey = `${address}:${version}`;
-  const cachedKey = cryptoKeyCache.get(cacheKey);
-  if (cachedKey) {
-    return cachedKey;
-  }
-  const keyHex = getStoredKeyByVersion(address, version);
-  if (!keyHex) {
-    throw new EncryptionKeyMissingError(address, version);
-  }
-  const keyBytes = hexToBytes(keyHex);
-  const cryptoKey = await crypto.subtle.importKey(
-    "raw",
-    keyBytes.buffer,
-    { name: "AES-GCM" },
-    false,
-    ["encrypt", "decrypt"]
-  );
-  cryptoKeyCache.set(cacheKey, cryptoKey);
-  return cryptoKey;
-}
-async function decryptData(encryptedHex, address, version = "v3") {
-  const key = await getEncryptionKey(address, version);
-  return decryptDataWithKey(encryptedHex, key);
-}
-function hasEncryptionKey(address, version) {
-  return getStoredKeyByVersion(address, version ?? "v3") !== null;
-}
-async function decryptDataWithKey(encryptedHex, key) {
-  const combined = hexToBytes(encryptedHex);
-  const iv = combined.subarray(0, 12);
-  const encryptedData = combined.subarray(12);
-  const decryptedData = await crypto.subtle.decrypt(
-    {
-      name: "AES-GCM",
-      iv
-    },
-    key,
-    encryptedData
-  );
-  return SHARED_TEXT_DECODER.decode(decryptedData);
-}
-
-// src/lib/db/encryption-utils.ts
-function isEncrypted(value) {
-  const prefix = value.startsWith("enc:v3:") ? "enc:v3:" : value.startsWith("enc:v2:") ? "enc:v2:" : null;
-  if (!prefix) return false;
-  const payload = value.slice(prefix.length);
-  return payload.length >= 56 && /^[0-9a-f]+$/i.test(payload);
-}
-function detectEncryptionVersion(value) {
-  if (value.startsWith("enc:v3:")) {
-    return { version: "v3", encryptedData: value.slice("enc:v3:".length) };
-  }
-  if (value.startsWith("enc:v2:")) {
-    return { version: "v2", encryptedData: value.slice("enc:v2:".length) };
-  }
-  return null;
-}
-async function decryptFieldDetailed(value, address) {
-  if (!value) return { status: "plaintext", value };
-  const detected = detectEncryptionVersion(value);
-  if (!detected) return { status: "plaintext", value };
-  if (detected.encryptedData.length < 56 || !/^[0-9a-f]+$/i.test(detected.encryptedData)) {
-    return { status: "invalid_payload", value, version: detected.version };
-  }
-  try {
-    const plaintext = await decryptData(detected.encryptedData, address, detected.version);
-    return { status: "ok", value: plaintext, version: detected.version };
-  } catch (error) {
-    if (error instanceof EncryptionKeyMissingError) {
-      getLogger().warn("Failed to decrypt field (key missing for version):", error.message);
-      return { status: "key_missing", value, version: detected.version };
-    }
-    getLogger().warn("Failed to decrypt field (auth mismatch or crypto error):", error);
-    return { status: "auth_mismatch", value, version: detected.version };
-  }
-}
-async function decryptField(value, address) {
-  const result = await decryptFieldDetailed(value, address);
-  return result.value;
-}
-
 // src/lib/db/chat/lazyDecrypt.ts
 var LRU_CAPACITY = 256;
 var titleCache = /* @__PURE__ */ new Map();

package/dist/react/index.cjs

@@ -1566,6 +1566,7 @@ __export(index_exports, {
   encryptDataBatch: () => encryptDataBatch,
   encryptDataBytes: () => encryptDataBytes,
   encryptDataWithKey: () => encryptDataWithKey,
+  encryptToolCallEventsOp: () => encryptToolCallEventsOp,
   ensureDefaultFoldersOp: () => ensureDefaultFoldersOp,
   expandToolSetsAdditive: () => expandToolSetsAdditive,
   exportElementToPdf: () => exportElementToPdf,
@@ -3593,6 +3594,11 @@ function isEncrypted(value) {
   const payload = value.slice(prefix.length);
   return payload.length >= 56 && /^[0-9a-f]+$/i.test(payload);
 }
+function hasEncryptedToolPayload(event) {
+  return [event.arguments, event.output].some(
+    (value) => typeof value === "string" && isEncrypted(value)
+  );
+}
 function detectEncryptionVersion(value) {
   if (value.startsWith("enc:v3:")) {
     return { version: "v3", encryptedData: value.slice("enc:v3:".length) };
@@ -3730,6 +3736,12 @@ async function encryptMessageFields(message, address, signMessage, embeddedWalle
     const encryptedChunks = msg.chunks ? await encryptJsonField(msg.chunks, address, signMessage, embeddedWalletSigner, true) : void 0;
     const encryptedSources = msg.sources ? await encryptJsonField(msg.sources, address, signMessage, embeddedWalletSigner, true) : void 0;
     const encryptedThoughtProcess = msg.thoughtProcess ? await encryptJsonField(msg.thoughtProcess, address, signMessage, embeddedWalletSigner, true) : void 0;
+    const encryptedToolCallEvents = Array.isArray(msg.toolCallEvents) ? await encryptToolCallEvents(
+      msg.toolCallEvents,
+      address,
+      signMessage,
+      embeddedWalletSigner
+    ) : void 0;
     return {
       ...message,
       ...encryptedContent !== void 0 && { content: encryptedContent },
@@ -3737,13 +3749,31 @@ async function encryptMessageFields(message, address, signMessage, embeddedWalle
       ...encryptedVector !== void 0 && { vector: encryptedVector },
       ...encryptedChunks !== void 0 && { chunks: encryptedChunks },
       ...encryptedSources !== void 0 && { sources: encryptedSources },
-      ...encryptedThoughtProcess !== void 0 && { thoughtProcess: encryptedThoughtProcess }
+      ...encryptedThoughtProcess !== void 0 && { thoughtProcess: encryptedThoughtProcess },
+      ...encryptedToolCallEvents !== void 0 && { toolCallEvents: encryptedToolCallEvents }
     };
   } catch (error) {
     getLogger().warn("Failed to encrypt message fields:", error);
     throw error;
   }
 }
+function mapToolCallPayloads(events, transform) {
+  return Promise.all(
+    events.map(async (event) => {
+      if (!event || typeof event !== "object") return event;
+      const mapped = { ...event };
+      if (typeof event.arguments === "string") mapped.arguments = await transform(event.arguments);
+      if (typeof event.output === "string") mapped.output = await transform(event.output);
+      return mapped;
+    })
+  );
+}
+function encryptToolCallEvents(events, address, signMessage, embeddedWalletSigner) {
+  return mapToolCallPayloads(
+    events,
+    (value) => encryptField(value, address, signMessage, embeddedWalletSigner, true)
+  );
+}
 async function decryptMaybeJsonFieldDetailed(value, address) {
   if (value === void 0) return { value: void 0, status: "plaintext" };
   if (value === null) return { value, status: "plaintext" };
@@ -3829,6 +3859,10 @@ async function assembleDecryptedMessage(message, address) {
     message.thoughtProcess,
     address
   );
+  const toolCallEventsResult = await decryptMaybeJsonFieldDetailed(
+    message.toolCallEvents,
+    address
+  );
   let decryptionStatus;
   let refreshProbe;
   const consider = (status, probe) => {
@@ -3847,6 +3881,14 @@ async function assembleDecryptedMessage(message, address) {
   if (thoughtProcessResult.probe) {
     consider(thoughtProcessResult.status, thoughtProcessResult.probe);
   }
+  if (toolCallEventsResult.probe) {
+    consider(toolCallEventsResult.status, toolCallEventsResult.probe);
+  }
+  const toolCallEvents = Array.isArray(toolCallEventsResult.value) ? await mapToolCallPayloads(toolCallEventsResult.value, async (value) => {
+    const detailed = await decryptFieldDetailed(value, address);
+    consider(detailed.status, isEncrypted(value) ? value : void 0);
+    return detailed.value;
+  }) : void 0;
   const statusForConsumer = decryptionStatus === "ok" || decryptionStatus === "plaintext" || !decryptionStatus ? void 0 : decryptionStatus;
   const result = {
     ...message,
@@ -3855,7 +3897,8 @@ async function assembleDecryptedMessage(message, address) {
     vector: vectorResult.value,
     chunks: chunksResult.value,
     sources: sourcesResult.value,
-    thoughtProcess: thoughtProcessResult.value
+    thoughtProcess: thoughtProcessResult.value,
+    toolCallEvents
   };
   if (statusForConsumer) {
     result.decryptionStatus = statusForConsumer;
@@ -4649,7 +4692,7 @@ async function updateMessageChunksOp(ctx, uniqueId, chunks3, embeddingModel) {
   });
   return messageToStored(message, ctx.walletAddress, ctx.signMessage, ctx.embeddedWalletSigner);
 }
-var STRIP_CHUNK_TEXT_PAGE_SIZE = 100;
+var RAW_REPAIR_PAGE_SIZE = 100;
 function chunksWithoutText(raw) {
   if (typeof raw !== "string") return null;
   let parsed;
@@ -4672,8 +4715,8 @@ function chunksWithoutText(raw) {
 async function stripLegacyChunkTextOp(ctx) {
   const candidateIds = await ctx.messagesCollection.query(import_watermelondb2.Q.where("chunks", import_watermelondb2.Q.like(`%${import_watermelondb2.Q.sanitizeLikeString('"text":')}%`))).fetchIds();
   let stripped = 0;
-  for (let start = 0; start < candidateIds.length; start += STRIP_CHUNK_TEXT_PAGE_SIZE) {
-    const pageIds = candidateIds.slice(start, start + STRIP_CHUNK_TEXT_PAGE_SIZE);
+  for (let start = 0; start < candidateIds.length; start += RAW_REPAIR_PAGE_SIZE) {
+    const pageIds = candidateIds.slice(start, start + RAW_REPAIR_PAGE_SIZE);
     const rows = await ctx.messagesCollection.query(import_watermelondb2.Q.where("id", import_watermelondb2.Q.oneOf(pageIds))).unsafeFetchRaw();
     const changedIds = rows.filter((row) => chunksWithoutText(row.chunks) !== null).map((row) => String(row.id));
     if (changedIds.length === 0) continue;
@@ -4697,6 +4740,88 @@ async function stripLegacyChunkTextOp(ctx) {
   }
   return stripped;
 }
+async function encryptedToolCallEventsColumn(raw, address, signMessage, embeddedWalletSigner) {
+  if (typeof raw !== "string") return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(parsed)) return null;
+  const column = JSON.stringify(
+    await encryptToolCallEvents(
+      parsed,
+      address,
+      signMessage,
+      embeddedWalletSigner
+    )
+  );
+  return column === JSON.stringify(parsed) ? null : column;
+}
+async function encryptToolCallEventsOp(ctx) {
+  const { walletAddress: address, signMessage, embeddedWalletSigner } = ctx;
+  if (!address || !signMessage) return 0;
+  if (!await requestEncryptionKey(address, signMessage, embeddedWalletSigner)) return 0;
+  if (!hasEncryptionKey(address)) return 0;
+  if (!await savedKeyOpensExistingData(ctx, address, signMessage, embeddedWalletSigner)) {
+    return 0;
+  }
+  const candidateIds = await ctx.messagesCollection.query(
+    import_watermelondb2.Q.where("tool_call_events", import_watermelondb2.Q.notEq(null)),
+    import_watermelondb2.Q.where("tool_call_events", import_watermelondb2.Q.notIn(["", "[]"]))
+  ).fetchIds();
+  let encrypted = 0;
+  for (let start = 0; start < candidateIds.length; start += RAW_REPAIR_PAGE_SIZE) {
+    const pageIds = candidateIds.slice(start, start + RAW_REPAIR_PAGE_SIZE);
+    const rows = await ctx.messagesCollection.query(import_watermelondb2.Q.where("id", import_watermelondb2.Q.oneOf(pageIds))).unsafeFetchRaw();
+    const repairs = /* @__PURE__ */ new Map();
+    for (const row of rows) {
+      const column = await encryptedToolCallEventsColumn(
+        row.tool_call_events,
+        address,
+        signMessage,
+        embeddedWalletSigner
+      );
+      if (column !== null) repairs.set(String(row.id), { raw: row.tool_call_events, column });
+    }
+    if (repairs.size === 0) continue;
+    await ctx.database.write(async () => {
+      const messages = (await ctx.messagesCollection.query(import_watermelondb2.Q.where("id", import_watermelondb2.Q.oneOf([...repairs.keys()]))).fetch()).filter(
+        (message) => message._raw.tool_call_events === repairs.get(message.id)?.raw
+      );
+      if (messages.length === 0) return;
+      const conversationIds = [...new Set(messages.map((message) => message.conversationId))];
+      const conversations = await ctx.conversationsCollection.query(import_watermelondb2.Q.where("conversation_id", import_watermelondb2.Q.oneOf(conversationIds))).fetch();
+      await ctx.database.batch(
+        ...messages.map(
+          (message) => message.prepareUpdate((msg) => {
+            msg._setRaw("tool_call_events", repairs.get(message.id).column);
+          })
+        ),
+        ...conversations.map((conversation) => conversation.prepareUpdate(() => {
+        }))
+      );
+      encrypted += messages.length;
+    });
+  }
+  return encrypted;
+}
+async function savedKeyOpensExistingData(ctx, address, signMessage, embeddedWalletSigner) {
+  const v3Probe = await findEncryptedContent(ctx, "enc:v3:%");
+  if (v3Probe) {
+    const { status } = await decryptFieldDetailed(v3Probe, address);
+    if (status !== "auth_mismatch" && status !== "key_missing") return true;
+    return refreshEncryptionKeyIfMatches(address, v3Probe, signMessage, embeddedWalletSigner);
+  }
+  const v2Probe = await findEncryptedContent(ctx, "enc:v2:%");
+  if (!v2Probe) return true;
+  return refreshEncryptionKeyIfMatches(address, v2Probe, signMessage, embeddedWalletSigner);
+}
+async function findEncryptedContent(ctx, pattern) {
+  const [row] = await ctx.messagesCollection.query(import_watermelondb2.Q.where("content", import_watermelondb2.Q.like(pattern)), import_watermelondb2.Q.take(1)).unsafeFetchRaw();
+  return row ? String(row.content) : null;
+}
 async function updateMessageErrorOp(ctx, uniqueId, error) {
   let message;
   try {
@@ -6575,7 +6700,8 @@ function extractReservationReceipts(toolCallEvents) {
   for (const event of toolCallEvents ?? []) {
     const action = ACTIONS.find((a) => event.name?.endsWith(a.tool));
     const output = event.output ?? "";
-    if (!action || !output || NOT_AN_ATTEMPT.test(output)) continue;
+    if (!action || !output || hasEncryptedToolPayload(event) || NOT_AN_ATTEMPT.test(output))
+      continue;
     const kept = latest.get(action.kind)?.status;
     if (kept === "made") continue;
     const receipt = toReceipt(action, event.arguments ?? "", output);
@@ -32041,11 +32167,12 @@ async function storedToLlmapiMessage(stored2, encryptionKey, resolveMediaByIds)
   textContent = textContent.replace(/\n{3,}/g, "\n\n").trim();
   const content = [{ type: "text", text: textContent }, ...imageParts];
   const messages = [];
-  if (stored2.role === "assistant" && stored2.toolCallEvents?.length) {
+  const toolCallEvents = Array.isArray(stored2.toolCallEvents) ? stored2.toolCallEvents.filter((event) => !hasEncryptedToolPayload(event)) : [];
+  if (stored2.role === "assistant" && toolCallEvents.length) {
     messages.push({
       role: stored2.role,
       content: void 0,
-      tool_calls: stored2.toolCallEvents.map((event) => ({
+      tool_calls: toolCallEvents.map((event) => ({
         id: event.id,
         type: "function",
         function: {
@@ -32054,7 +32181,7 @@ async function storedToLlmapiMessage(stored2, encryptionKey, resolveMediaByIds)
         }
       }))
     });
-    for (const event of stored2.toolCallEvents) {
+    for (const event of toolCallEvents) {
       if (event.id && event.output !== void 0 && event.output !== null) {
         messages.push({
           role: "tool",
@@ -37042,6 +37169,7 @@ function useWalletBinding(options = {}) {
   encryptDataBatch,
   encryptDataBytes,
   encryptDataWithKey,
+  encryptToolCallEventsOp,
   ensureDefaultFoldersOp,
   expandToolSetsAdditive,
   exportElementToPdf,