openclaw/dist/openclaw-agent-db-validation-cache-CHrtutWN.mjs

Multi-channel AI gateway with extensible messaging integrations

import { a as resolveGlobalSingleton } from "./global-singleton-0m-JziJW.mjs";
import { c as isRecord } from "./record-coerce-TIsquoVR.mjs";
import { r as isPathInside } from "./path-guards-CH7noY0Z.mjs";
import { a as executeSqliteQueryTakeFirstSync, i as executeSqliteQuerySync, o as getNodeSqliteKysely } from "./kysely-sync-DUWzQvCU.mjs";
import { c as registerNodeSqliteDisposeCallback } from "./kysely-sync-cache-state-DbAMR_DD.mjs";
import { a as getSqliteReadOperationRevision, i as getAdmittedSqliteSchemaFacts, m as registerSqliteSchemaMutationListener, n as adoptSqliteSchemaFacts } from "./sqlite-schema-facts-BVf0E_0z.mjs";
import { d as readDatabasePathIdentitySync, f as resolveDatabasePathKey } from "./sqlite-worker-identity-BRNRpRyc.mjs";
import { a as tableHasColumn, n as ensureColumn } from "./openclaw-state-db-schema-helpers-DKz5xGgh.mjs";
import { o as stageSqliteTransactionState, t as deferSqlitePostCommitPublication } from "./sqlite-post-commit-DENvzR6w.mjs";
import { a as readSqliteUserVersion } from "./sqlite-user-version-DLMl1A7W.mjs";
import { c as matchesAgentDatabaseReadCandidatePath } from "./agent-database-readers-m64TtGjG.mjs";
import { r as assertCanonicalSessionValidationSchema, t as adoptCanonicalSessionValidationSchema } from "./openclaw-agent-canonical-validation-schema-4dL3LLg2.mjs";
import { t as CANONICAL_READY_COLUMN_DEFINITION } from "./openclaw-agent-db-additive-columns-DEY4xthY.mjs";
import "./openclaw-agent-db-contract-OYt2DCoK.mjs";
import { a as readOpenClawAgentDatabaseIdentity, i as isOpenClawAgentDatabasePathCurrent, r as findOpenClawAgentDatabaseIdentity } from "./openclaw-agent-db-identity-BlmER9-X.mjs";
import { C as AgentDatabaseSchemaAdmissionInvalidError, S as AgentDatabaseSchemaAdmissionChangedError } from "./openclaw-agent-db-resources-Cm-sH7kg.mjs";
import path from "node:path";
import { randomUUID } from "node:crypto";
//#region src/state/openclaw-agent-canonical-validation-receipt.ts
const receiptSchemas = /* @__PURE__ */ new WeakSet();
function hasReceiptColumn(db) {
	if (receiptSchemas.has(db)) return true;
	const { tableName, columnName } = CANONICAL_READY_COLUMN_DEFINITION;
	const present = tableHasColumn(db, tableName, columnName);
	if (present && !db.isTransaction) receiptSchemas.add(db);
	return present;
}
function physicalReceipt(database) {
	const physical = findOpenClawAgentDatabaseIdentity(database);
	if (!physical || typeof physical.identity !== "string" || !isOpenClawAgentDatabasePathCurrent({
		...database,
		path: physical.filename
	})) return;
	return JSON.stringify([
		1,
		database.agentId,
		physical.identity,
		physical.birthtime
	]);
}
/** Canonical proof follows this file generation; it never certifies physical integrity. */
function hasPersistedOpenClawAgentCanonicalValidation(database) {
	const receipt = physicalReceipt(database);
	if (!receipt || !hasReceiptColumn(database.db)) return false;
	assertCanonicalSessionValidationSchema(database.db);
	return executeSqliteQueryTakeFirstSync(database.db, getNodeSqliteKysely(database.db).selectFrom("session_key_contract").select("canonical_ready").where("id", "=", 1))?.canonical_ready === receipt;
}
/** The certifying writer records proof in the same authorized transaction as its final batch. */
function recordOpenClawAgentCanonicalValidation(database) {
	if (!database.db.isTransaction) throw new Error("Canonical validation receipt requires write admission");
	const receipt = physicalReceipt(database);
	if (!receipt) throw new Error("Canonical validation database owner is no longer current");
	assertCanonicalSessionValidationSchema(database.db);
	if (!hasReceiptColumn(database.db)) {
		const { tableName, columnName, dataType } = CANONICAL_READY_COLUMN_DEFINITION;
		ensureColumn(database.db, tableName, `${columnName} ${dataType}`);
	}
	deferSqlitePostCommitPublication(database.db, () => receiptSchemas.add(database.db));
	executeSqliteQuerySync(database.db, getNodeSqliteKysely(database.db).updateTable("session_key_contract").set({ canonical_ready: receipt }).where("id", "=", 1));
}
/** Offline repair revokes imported-row proof without changing physical integrity admission. */
function clearPersistedOpenClawAgentCanonicalValidation(database) {
	if (!hasReceiptColumn(database.db)) return;
	executeSqliteQuerySync(database.db, getNodeSqliteKysely(database.db).updateTable("session_key_contract").set({ canonical_ready: null }).where("id", "=", 1).where("canonical_ready", "is not", null));
}
//#endregion
//#region src/state/openclaw-agent-db-validation-receipt.ts
function createValidationReceipt(database, canonicalReady) {
	const { identity } = readOpenClawAgentDatabaseIdentity(database);
	if (typeof identity !== "string") throw new Error("Only persistent agent databases retain integrity validation");
	const validation = {
		agentId: database.agentId,
		identity,
		receiptId: randomUUID(),
		valid: new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT),
		canonicalReady: new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT)
	};
	if (canonicalReady) Atomics.store(new Int32Array(validation.canonicalReady), 0, 1);
	Atomics.store(new Int32Array(validation.valid), 0, 1);
	return validation;
}
const admittedSpellings = resolveGlobalSingleton(Symbol.for("openclaw.agentDatabaseValidationSpellings"), () => /* @__PURE__ */ new WeakMap());
function recordValidationReceiptSpelling(receipt, pathname) {
	const spellings = admittedSpellings.get(receipt) ?? /* @__PURE__ */ new Set();
	spellings.add(path.resolve(pathname));
	admittedSpellings.set(receipt, spellings);
}
function hasValidationReceiptSpelling(receipt, pathname) {
	return admittedSpellings.get(receipt)?.has(path.resolve(pathname)) === true;
}
//#endregion
//#region src/state/openclaw-agent-db-validation-cache.ts
const validatedPaths = resolveGlobalSingleton(Symbol.for("openclaw.agentDatabaseValidatedPaths"), () => /* @__PURE__ */ new Map(), () => clearOpenClawAgentDatabaseValidationCache());
const validationBindings = resolveGlobalSingleton(Symbol.for("openclaw.agentDatabaseValidationBindings"), () => /* @__PURE__ */ new WeakMap());
function bindValidationLifetime(database, validation) {
	const current = validationBindings.get(database.db);
	if (!database.db.isOpen || current?.validation === validation) return;
	current?.unregister();
	const key = resolveDatabasePathKey(database.path);
	const unobserve = registerSqliteSchemaMutationListener(database.db, (observed) => {
		const revoke = (schema) => {
			if (schema && (!observed || schema.facts.schemaVersion !== observed.schemaVersion || schema.facts.userVersion !== observed.userVersion)) Atomics.store(new Int32Array(schema.valid), 0, 0);
		};
		revoke(validation.schema);
		const published = validatedPaths.get(key)?.validation;
		if (published?.schema && published.agentId === validation.agentId && published.identity === validation.identity) revoke(published.schema);
	});
	const unregister = registerNodeSqliteDisposeCallback(database.db, (reason) => {
		if (reason === "replace") Atomics.store(new Int32Array(validation.valid), 0, 0);
		validationBindings.delete(database.db);
		unobserve();
		unregister();
	});
	validationBindings.set(database.db, {
		validation,
		unregister: () => {
			unobserve();
			unregister();
		}
	});
}
/** Revocation precedes schema inspection so siblings cannot borrow the superseded revision. */
function invalidateOpenClawAgentDatabaseSchema(database) {
	const schema = getOpenClawAgentDatabaseValidation(database)?.schema;
	if (schema) Atomics.store(new Int32Array(schema.valid), 0, 0);
}
/** Consume only a live physical owner's schema proof at connection admission. */
function adoptOpenClawAgentDatabaseSchema(database, reuseIntegrity = true, required = false) {
	const schema = getOpenClawAgentDatabaseValidation(database)?.schema;
	const admitted = reuseIntegrity && schema ? getSqliteReadOperationRevision(database.db)?.schema : void 0;
	const adopted = Boolean(reuseIntegrity && schema && Atomics.load(new Int32Array(schema.valid), 0) === 1 && (admitted?.schemaVersion === schema.facts.schemaVersion && admitted.userVersion === schema.facts.userVersion || adoptSqliteSchemaFacts(database.db, schema.facts)) && Atomics.load(new Int32Array(schema.valid), 0) === 1);
	if (required && !adopted) throw new Error("Agent schema admission changed before handle adoption; retry the operation");
	if (adopted) adoptCanonicalSessionValidationSchema(database.db);
	return adopted;
}
function readTransferredSchema(value) {
	if (!isRecord(value) || !isRecord(value.facts)) return;
	const { facts, valid } = value;
	if (!(valid instanceof SharedArrayBuffer) || valid.byteLength !== Int32Array.BYTES_PER_ELEMENT || typeof facts.revision !== "number" || typeof facts.userVersion !== "number" || typeof facts.schemaVersion !== "number" || !(facts.tables instanceof Set) || ![...facts.tables].every((table) => typeof table === "string") || !(facts.tableSql instanceof Map) || ![...facts.tableSql].every(([name, sql]) => typeof name === "string" && (sql === null || typeof sql === "string")) || !(facts.indexes instanceof Set) || ![...facts.indexes].every((index) => typeof index === "string") || !(facts.triggers instanceof Map) || ![...facts.triggers].every(([name, trigger]) => typeof name === "string" && isRecord(trigger) && typeof trigger.table === "string" && (trigger.sql === null || typeof trigger.sql === "string"))) return;
	return {
		valid,
		facts: {
			revision: facts.revision,
			userVersion: facts.userVersion,
			schemaVersion: facts.schemaVersion,
			tables: facts.tables,
			tableSql: facts.tableSql,
			indexes: facts.indexes,
			triggers: facts.triggers
		}
	};
}
function matchesValidation(database, validation) {
	return validation.agentId === database.agentId && validation.identity === findOpenClawAgentDatabaseIdentity(database)?.identity && Atomics.load(new Int32Array(validation.valid), 0) === 1;
}
function hasRevokedOpenClawAgentDatabaseValidation(pathname, received) {
	const previous = validatedPaths.get(resolveDatabasePathKey(pathname));
	return received !== void 0 && Atomics.load(new Int32Array(received.valid), 0) !== 1 || previous?.revoked === true || previous?.validation !== void 0 && Atomics.load(new Int32Array(previous.validation.valid), 0) !== 1;
}
function getOpenClawAgentDatabaseValidation(database) {
	const entry = validatedPaths.get(resolveDatabasePathKey(database.path));
	if (!entry?.integrityVerified || !entry.validation || !matchesValidation(database, entry.validation)) return;
	const validation = entry.validation;
	bindValidationLifetime(database, validation);
	return validation;
}
/** Registry rows keep lexical spellings; true when current proof was admitted under this one. */
function hasOpenClawAgentDatabaseValidationSpelling(pathname) {
	const validation = validatedPaths.get(resolveDatabasePathKey(pathname))?.validation;
	return validation !== void 0 && hasValidationReceiptSpelling(validation, pathname);
}
/** The receiving opener must adopt this proof against its own physical file identity. */
function getOpenClawAgentDatabaseValidationForTransfer(database) {
	const entry = validatedPaths.get(resolveDatabasePathKey(database.path));
	if (!entry?.integrityVerified || !entry.validation || entry.validation.agentId !== database.agentId || Atomics.load(new Int32Array(entry.validation.valid), 0) !== 1) return;
	return entry.validation;
}
/** Readers borrow physical/canonical proof without copying the schema catalog or opening a host handle. */
function captureOpenClawAgentDatabaseReadValidation(database) {
	const current = getOpenClawAgentDatabaseValidationForTransfer(database);
	if (!current) return;
	if (readDatabasePathIdentitySync(database.path).key !== `file:${current.identity}`) return;
	const { agentId, identity, receiptId, valid, canonicalReady } = current;
	const validation = {
		agentId,
		identity,
		receiptId,
		valid,
		canonicalReady
	};
	return {
		validation,
		inputBytes: JSON.stringify(validation).length * 2 + valid.byteLength + canonicalReady.byteLength,
		assertCurrent() {
			if (getOpenClawAgentDatabaseValidationForTransfer(database) !== current) throw new Error("Session reader validation is no longer current");
		}
	};
}
/** Retire a replaced file's proof before capturing its successor's publication guard. */
function retireReplacedAgentValidation(agentId, pathname, expectedIdentity) {
	if (!expectedIdentity) return;
	const retainedValidation = getOpenClawAgentDatabaseValidationForTransfer({
		agentId,
		path: pathname
	});
	if (retainedValidation && retainedValidation.identity !== expectedIdentity.physicalIdentity) invalidateOpenClawAgentDatabaseValidation(pathname, retainedValidation.identity);
}
/** Native admission supplies the checked file identity; no host SQLite handle is needed. */
function captureOpenClawAgentDatabaseValidationTransfer(database) {
	const receive = captureValidationTransfer(database, false);
	return (identity, received) => receive(identity, received) === "accepted";
}
function captureValidationTransfer(database, schemaRequired) {
	const pathname = resolveDatabasePathKey(database.path);
	const existing = validatedPaths.get(pathname);
	const captured = existing?.agentId === database.agentId ? existing : {
		...existing,
		agentId: database.agentId,
		integrityVerified: existing?.integrityVerified ?? false
	};
	validatedPaths.set(pathname, captured);
	const capturedValidation = captured.validation;
	const capturedSchemaCell = capturedValidation?.schema?.valid;
	const wasValid = capturedValidation ? Atomics.load(new Int32Array(capturedValidation.valid), 0) : void 0;
	return (identity, received) => {
		if (!isRecord(received) || received.agentId !== database.agentId || received.identity !== identity || typeof received.receiptId !== "string" || received.receiptId.length === 0 || !(received.valid instanceof SharedArrayBuffer) || received.valid.byteLength !== Int32Array.BYTES_PER_ELEMENT || !(received.canonicalReady instanceof SharedArrayBuffer) || received.canonicalReady.byteLength !== Int32Array.BYTES_PER_ELEMENT) return "invalid";
		const schema = readTransferredSchema(received.schema);
		const valid = Atomics.load(new Int32Array(received.valid), 0);
		const schemaValid = schema && Atomics.load(new Int32Array(schema.valid), 0);
		if (valid !== 0 && valid !== 1 || schemaRequired && (!schema || schemaValid !== 0 && schemaValid !== 1)) return "invalid";
		const currentSchemaCell = captured.validation?.schema?.valid;
		if (schemaValid === 1 && currentSchemaCell !== void 0 && currentSchemaCell !== capturedSchemaCell && Atomics.load(new Int32Array(currentSchemaCell), 0) !== 1) return "stale";
		if (schemaRequired && schemaValid !== 1 || validatedPaths.get(pathname) !== captured || capturedValidation && wasValid === 1 && Atomics.load(new Int32Array(capturedValidation.valid), 0) !== 1 || captured.validation !== capturedValidation && captured.validation && (captured.validation.identity !== identity || Atomics.load(new Int32Array(captured.validation.valid), 0) !== 1) || Atomics.load(new Int32Array(received.valid), 0) !== 1) return "stale";
		if (captured.integrityVerified && captured.validation?.agentId === database.agentId && captured.validation.identity === identity && Atomics.load(new Int32Array(captured.validation.valid), 0) === 1) {
			const currentSchema = captured.validation.schema;
			if (currentSchema && schema && schemaValid === 1 && Atomics.load(new Int32Array(currentSchema.valid), 0) === 1 && currentSchema.facts.schemaVersion === schema.facts.schemaVersion && currentSchema.facts.userVersion === schema.facts.userVersion) return "accepted";
			if (currentSchema) Atomics.store(new Int32Array(currentSchema.valid), 0, 0);
			captured.validation.schema = schema;
			return "accepted";
		}
		const validation = {
			agentId: database.agentId,
			identity,
			receiptId: received.receiptId,
			valid: received.valid,
			canonicalReady: received.canonicalReady,
			schema
		};
		if (hasRevokedOpenClawAgentDatabaseValidation(pathname)) Atomics.store(new Int32Array(validation.canonicalReady), 0, 0);
		const aliases = captured.validation?.identity === identity ? [...validatedPaths].flatMap(([candidate, entry]) => entry.validation?.agentId === database.agentId && entry.validation.identity === identity ? [candidate] : []) : [];
		if (wasValid !== 0) invalidateOpenClawAgentDatabaseValidation(pathname);
		else for (const alias of aliases) {
			const superseded = validatedPaths.get(alias)?.validation;
			if (superseded && superseded.receiptId !== validation.receiptId) Atomics.store(new Int32Array(superseded.valid), 0, 0);
		}
		validatedPaths.set(pathname, {
			validation,
			integrityVerified: true
		});
		recordValidationReceiptSpelling(validation, database.path);
		for (const alias of aliases) validatedPaths.set(alias, {
			validation,
			integrityVerified: true
		});
		return "accepted";
	};
}
/** An admitted runtime acquisition must receive a current schema, never fall back to host scans. */
function captureOpenClawAgentDatabaseAdmissionPublication(database) {
	const receive = captureValidationTransfer(database, true);
	return (identity, received) => {
		const result = receive(identity, received);
		if (result === "invalid") throw new AgentDatabaseSchemaAdmissionInvalidError();
		const schema = getOpenClawAgentDatabaseValidationForTransfer(database)?.schema;
		if (result === "stale" || !schema || Atomics.load(new Int32Array(schema.valid), 0) !== 1) throw new AgentDatabaseSchemaAdmissionChangedError();
	};
}
/** An alias may consume the exact acknowledged physical receipt without revoking it again. */
function captureOpenClawAgentDatabaseAliasPublication(database) {
	const publish = captureOpenClawAgentDatabaseAdmissionPublication(database);
	return (identity, received) => {
		const current = getOpenClawAgentDatabaseValidationForTransfer(database);
		if (isRecord(received) && received.agentId === database.agentId && received.identity === identity && current?.identity === identity && typeof received.receiptId === "string" && received.receiptId.length > 0 && current.receiptId === received.receiptId && current.valid === received.valid && current.schema && isRecord(received.schema) && current.schema.valid === received.schema.valid && Atomics.load(new Int32Array(current.schema.valid), 0) === 1) return;
		publish(identity, received);
	};
}
function canonicalValidationReceipt(database) {
	if (!database.db.isOpen || !findOpenClawAgentDatabaseIdentity(database)) return;
	const pathname = database.path ?? database.db.location();
	if (!pathname) return;
	const validation = validatedPaths.get(resolveDatabasePathKey(pathname))?.validation;
	if (!validation || !matchesValidation({
		...database,
		path: pathname
	}, validation)) return;
	bindValidationLifetime({
		...database,
		path: pathname
	}, validation);
	return validation;
}
/** A clean pending table needs proof from this admitted physical generation. */
function hasOpenClawAgentCanonicalValidation(database) {
	const validation = canonicalValidationReceipt(database);
	if (validation) return Atomics.load(new Int32Array(validation.canonicalReady), 0) === 1 && Atomics.load(new Int32Array(validation.valid), 0) === 1;
	const pathname = database.path ?? findOpenClawAgentDatabaseIdentity(database)?.filename;
	if (!pathname || database.db.isTransaction || validatedPaths.get(resolveDatabasePathKey(pathname))?.validation !== void 0 || hasRevokedOpenClawAgentDatabaseValidation(pathname) || !hasPersistedOpenClawAgentCanonicalValidation(database)) return false;
	const canonical = createValidationReceipt({
		...database,
		path: pathname
	}, true);
	const entry = validatedPaths.get(resolveDatabasePathKey(pathname)) ?? { integrityVerified: false };
	entry.validation = canonical;
	validatedPaths.set(resolveDatabasePathKey(pathname), entry);
	bindValidationLifetime({
		...database,
		path: pathname
	}, canonical);
	return true;
}
/** Offline import/repair owns exclusive custody; rollback may conservatively require validation. */
function invalidateOpenClawAgentCanonicalValidation(database) {
	const validation = canonicalValidationReceipt(database);
	if (validation) Atomics.store(new Int32Array(validation.canonicalReady), 0, 0);
	clearPersistedOpenClawAgentCanonicalValidation(database);
}
/** Publish successful canonical proof only when its outer transaction has committed. */
function markOpenClawAgentCanonicalValidation(database) {
	const validation = canonicalValidationReceipt(database);
	if (!validation) return false;
	const publish = () => {
		if (Atomics.load(new Int32Array(validation.valid), 0) === 1) Atomics.store(new Int32Array(validation.canonicalReady), 0, 1);
	};
	if (database.db.isTransaction) return stageSqliteTransactionState(database.db, {
		stage: () => {},
		rollback: () => {},
		commit: publish
	});
	publish();
	return Atomics.load(new Int32Array(validation.valid), 0) === 1;
}
function adoptOpenClawAgentDatabaseValidation(database, validation) {
	if (!matchesValidation(database, validation)) return false;
	if (getOpenClawAgentDatabaseValidation(database)) return true;
	if (hasRevokedOpenClawAgentDatabaseValidation(database.path)) Atomics.store(new Int32Array(validation.canonicalReady), 0, 0);
	invalidateOpenClawAgentDatabaseValidation(database.path);
	validatedPaths.set(resolveDatabasePathKey(database.path), {
		validation,
		integrityVerified: true
	});
	recordValidationReceiptSpelling(validation, database.path);
	bindValidationLifetime(database, validation);
	return true;
}
function isOpenClawAgentCanonicalStoreEmpty(database) {
	if (database.db.isTransaction || readSqliteUserVersion(database.db) < 21) return false;
	assertCanonicalSessionValidationSchema(database.db);
	return database.db.prepare(`SELECT
    EXISTS(SELECT 1 FROM session_nodes) OR
    EXISTS(SELECT 1 FROM session_canonical_validation_pending) AS populated`).get()?.populated === 0;
}
function setOpenClawAgentDatabaseValidation(database) {
	const revoked = hasRevokedOpenClawAgentDatabaseValidation(database.path);
	let validation = createValidationReceipt(database, isOpenClawAgentCanonicalStoreEmpty(database) || !revoked && !database.db.isTransaction && hasPersistedOpenClawAgentCanonicalValidation(database));
	const entry = validatedPaths.get(resolveDatabasePathKey(database.path));
	if (!revoked && entry && (entry.agentId === void 0 || entry.agentId === database.agentId) && (!entry.validation || matchesValidation(database, entry.validation))) {
		if (entry.validation) {
			Atomics.store(new Int32Array(entry.validation.canonicalReady), 0, Atomics.load(new Int32Array(validation.canonicalReady), 0));
			validation = entry.validation;
		}
		entry.validation = validation;
		entry.integrityVerified = true;
	} else {
		invalidateOpenClawAgentDatabaseValidation(database.path);
		validatedPaths.set(resolveDatabasePathKey(database.path), {
			validation,
			integrityVerified: true
		});
	}
	recordValidationReceiptSpelling(validation, database.path);
	bindValidationLifetime(database, validation);
	publishOpenClawAgentDatabaseSchema(database);
	return validation;
}
/** The open/migration owner calls this only after complete canonical schema validation. */
function publishOpenClawAgentDatabaseSchema(database) {
	const validation = getOpenClawAgentDatabaseValidation(database);
	const facts = getAdmittedSqliteSchemaFacts(database.db);
	if (validation && facts && !database.db.isTransaction) {
		invalidateOpenClawAgentDatabaseSchema(database);
		const valid = new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT);
		Atomics.store(new Int32Array(valid), 0, 1);
		validation.schema = {
			facts,
			valid
		};
	}
}
function invalidateOpenClawAgentDatabaseValidation(pathname, identity = validatedPaths.get(resolveDatabasePathKey(pathname))?.validation?.identity) {
	const paths = /* @__PURE__ */ new Set([resolveDatabasePathKey(pathname)]);
	if (identity) {
		for (const [candidate, entry] of validatedPaths) if (entry.validation?.identity === identity) paths.add(candidate);
	}
	for (const candidate of paths) {
		const entry = validatedPaths.get(candidate);
		const validation = entry?.validation;
		if (validation) Atomics.store(new Int32Array(validation.valid), 0, 0);
		validatedPaths.set(candidate, {
			agentId: entry?.agentId,
			validation,
			integrityVerified: false,
			revoked: true
		});
	}
}
function invalidateOpenClawAgentDatabaseValidationsForAgent(agentId, removedPaths) {
	for (const pathname of removedPaths) invalidateOpenClawAgentDatabaseValidation(pathname);
	for (const [pathname, entry] of validatedPaths) if (entry.validation?.agentId === agentId || entry.agentId === agentId) invalidateOpenClawAgentDatabaseValidation(pathname);
}
function clearOpenClawAgentDatabaseValidationCache(rootPath) {
	for (const pathname of validatedPaths.keys()) if (rootPath === void 0 || isPathInside(resolveDatabasePathKey(rootPath), pathname)) {
		invalidateOpenClawAgentDatabaseValidation(pathname);
		validatedPaths.delete(pathname);
	}
}
/** Reader cleanup releases local metadata without revoking its parent's shared proof. */
function releaseOpenClawAgentDatabaseReadValidation(candidates, retainedPaths = []) {
	for (const pathname of validatedPaths.keys()) if (!retainedPaths.some((retained) => matchesAgentDatabaseReadCandidatePath({ path: retained }, pathname)) && candidates.some((candidate) => matchesAgentDatabaseReadCandidatePath(candidate, pathname))) validatedPaths.delete(pathname);
}
//#endregion
export { recordOpenClawAgentCanonicalValidation as S, markOpenClawAgentCanonicalValidation as _, captureOpenClawAgentDatabaseReadValidation as a, retireReplacedAgentValidation as b, getOpenClawAgentDatabaseValidation as c, hasOpenClawAgentDatabaseValidationSpelling as d, hasRevokedOpenClawAgentDatabaseValidation as f, invalidateOpenClawAgentDatabaseValidationsForAgent as g, invalidateOpenClawAgentDatabaseValidation as h, captureOpenClawAgentDatabaseAliasPublication as i, getOpenClawAgentDatabaseValidationForTransfer as l, invalidateOpenClawAgentDatabaseSchema as m, adoptOpenClawAgentDatabaseValidation as n, captureOpenClawAgentDatabaseValidationTransfer as o, invalidateOpenClawAgentCanonicalValidation as p, captureOpenClawAgentDatabaseAdmissionPublication as r, clearOpenClawAgentDatabaseValidationCache as s, adoptOpenClawAgentDatabaseSchema as t, hasOpenClawAgentCanonicalValidation as u, publishOpenClawAgentDatabaseSchema as v, setOpenClawAgentDatabaseValidation as x, releaseOpenClawAgentDatabaseReadValidation as y };