openclaw/dist/sqlite-MN_7y26V.js

Multi-channel AI gateway with extensible messaging integrations

import "./src-vebZIeLe.js";
import { t as safeParseJson } from "./json-coercion-AulM0PZ6.js";
import { c as resolveUserPath } from "./home-dir-BPhrG-aM.js";
import { t as hasErrnoCode } from "./errno-CkbDOfLk.js";
import { r as isPathInside } from "./path-guards-Cp-mGr3-.js";
import "./utils-P__uGsPB.js";
import { C as resolveOAuthDir, w as resolveStateDir } from "./paths-D2sRr1a_.js";
import { i as resolveRegisteredAgentIdForDir } from "./agent-dir-registry-Dkh28921.js";
import { h as clearNodeSqliteKyselyCacheForDatabase, t as openNodeSqliteDatabase } from "./node-sqlite-BpQX3W0e.js";
import { a as getNodeSqliteKysely, i as executeSqliteQueryTakeFirstSync, n as enableNodeSqliteKyselyStatementCache, r as executeSqliteQuerySync } from "./kysely-sync-COmh4HWh.js";
import { E as tableExists } from "./openclaw-state-db-cache-C7ljO0xP.js";
import { o as OPENCLAW_SQLITE_BUSY_TIMEOUT_MS } from "./openclaw-state-db-contract-DYCYxE4w.js";
import { a as readSqliteUserVersion } from "./sqlite-user-version-DFJCxX41.js";
import { r as withExistingOpenClawStateDatabaseReadOnly } from "./openclaw-state-db-readonly-BRgmrGHt.js";
import { dt as resolveSqliteDatabaseFilePaths, i as openOpenClawStateDatabase, s as runOpenClawStateWriteTransaction } from "./openclaw-state-db-BRTnL-D8.js";
import { o as sha256HexPrefixCore } from "./crypto-digest-C4hqTb_e.js";
import { i as registerSqliteCacheExitClose } from "./sqlite-wal-B4waQq_w.js";
import { o as writeConfigMachineState } from "./config-machine-state-BCereLZr.js";
import { c as resolveSharedMainAuthAgentDir, o as resolveSharedAuthStoreOwnership, r as noteCommittedSharedAuthStoreOwnership, s as resolveSharedAuthStorePath, t as SHARED_AUTH_STORE_STATE_KEY } from "./path-resolve-oRkRBkQd.js";
import "./openclaw-agent-db-contract-CGTyjij4.js";
import { g as runOpenClawAgentWriteTransaction, o as deferOpenClawAgentPostCommitPublication } from "./openclaw-agent-db-CWtDoRbC.js";
import fs from "node:fs";
import path from "node:path";
//#region src/agents/auth-profiles/legacy-source-files.ts
function resolveLegacyOAuthPath(env = process.env) {
	return path.join(resolveOAuthDir(env), "oauth.json");
}
function resolveLegacySourceAgentDir(agentDir, env = process.env) {
	return agentDir ? resolveUserPath(agentDir) : resolveSharedMainAuthAgentDir(env);
}
/** Capture the fixed legacy candidates before the producer's environment can change. */
function resolveLegacyAuthProfileSourceCandidates(params) {
	const agentDir = resolveLegacySourceAgentDir(params.agentDir, params.env);
	const candidates = [
		{
			kind: "auth-profiles",
			path: path.join(agentDir, "auth-profiles.json")
		},
		{
			kind: "auth-state",
			path: path.join(agentDir, "auth-state.json")
		},
		{
			kind: "legacy-auth",
			path: path.join(agentDir, "auth.json")
		}
	];
	const sharedMainDir = resolveSharedMainAuthAgentDir(params.env);
	if (path.resolve(agentDir) === path.resolve(sharedMainDir)) candidates.push({
		kind: "legacy-oauth",
		path: resolveLegacyOAuthPath(params.env)
	});
	return candidates;
}
/** Detects retired auth files by name only; runtime code must never read their contents. */
function listLegacyAuthProfileSources(params) {
	return resolveLegacyAuthProfileSourceCandidates(params).filter((candidate) => fs.existsSync(candidate.path));
}
function listLegacyAuthProfileArchives(params) {
	const candidates = /* @__PURE__ */ new Map();
	for (const agentDir of params.agentDirs) {
		candidates.set(path.join(agentDir, "auth-profiles.json"), "auth-profiles");
		candidates.set(path.join(agentDir, "auth-state.json"), "auth-state");
		candidates.set(path.join(agentDir, "auth.json"), "legacy-auth");
	}
	candidates.set(resolveLegacyOAuthPath(params.env), "legacy-oauth");
	const archives = [];
	for (const [sourcePath, kind] of candidates) {
		const directory = path.dirname(sourcePath);
		const baseName = path.basename(sourcePath);
		const migratedPrefix = `${baseName}.migrated-`;
		const priorImportPrefix = `${baseName}.sqlite-import.`;
		let entries;
		try {
			entries = fs.readdirSync(directory);
		} catch {
			continue;
		}
		for (const entry of entries) if (entry.startsWith(migratedPrefix) || entry.startsWith(priorImportPrefix) && entry.endsWith(".bak")) archives.push({
			kind,
			path: path.join(directory, entry)
		});
	}
	return archives;
}
//#endregion
//#region src/agents/auth-profiles/shared-store-bootstrap.ts
const PRIMARY_ROW_KEY$1 = "primary";
const SHARED_AUTH_STORE_MIGRATION_KIND = "shared-auth-store-state-db";
const inspectedLegacySharedAuthOwnerships = /* @__PURE__ */ new WeakSet();
var SharedAuthStoreSourceInspectionError = class extends Error {
	constructor(sourcePath, operation, cause) {
		const detail = cause instanceof Error ? cause.message : String(cause);
		super(`Cannot ${operation} legacy shared auth database ${sourcePath}: ${detail}`, { cause });
		this.code = "SHARED_AUTH_STORE_SOURCE_UNREADABLE";
		this.action = "openclaw doctor --fix";
		this.name = "SharedAuthStoreSourceInspectionError";
		this.sourcePath = sourcePath;
	}
};
function inspectSharedAuthLegacySourceFile(sourcePath) {
	let entry;
	try {
		entry = fs.lstatSync(sourcePath);
	} catch (error) {
		if (hasErrnoCode(error, "ENOENT")) return { status: "missing" };
		throw new SharedAuthStoreSourceInspectionError(sourcePath, "inspect", error);
	}
	let target = entry;
	if (entry.isSymbolicLink()) try {
		target = fs.statSync(sourcePath);
	} catch (error) {
		throw new SharedAuthStoreSourceInspectionError(sourcePath, "resolve", error);
	}
	if (!target.isFile()) throw new SharedAuthStoreSourceInspectionError(sourcePath, "open", /* @__PURE__ */ new Error("path is not a regular file"));
	return {
		status: "present",
		size: target.size
	};
}
function readSharedAuthLegacyRowsFromDatabase(database) {
	const db = getNodeSqliteKysely(database);
	return {
		store: tableExists(database, "auth_profile_store") ? executeSqliteQueryTakeFirstSync(database, db.selectFrom("auth_profile_store").select(["store_json", "updated_at"]).where("store_key", "=", PRIMARY_ROW_KEY$1)) ?? null : null,
		state: tableExists(database, "auth_profile_state") ? executeSqliteQueryTakeFirstSync(database, db.selectFrom("auth_profile_state").select(["state_json", "updated_at"]).where("state_key", "=", PRIMARY_ROW_KEY$1)) ?? null : null
	};
}
function inspectSharedAuthLegacyRowsReadOnly(sourcePath) {
	if (inspectSharedAuthLegacySourceFile(sourcePath).status === "missing") return {
		store: null,
		state: null
	};
	let database;
	try {
		database = openNodeSqliteDatabase(sourcePath, { readOnly: true });
	} catch (error) {
		throw new SharedAuthStoreSourceInspectionError(sourcePath, "open", error);
	}
	try {
		return readSharedAuthLegacyRowsFromDatabase(database);
	} catch (error) {
		throw new SharedAuthStoreSourceInspectionError(sourcePath, "read", error);
	} finally {
		database.close();
	}
}
function hasPendingSharedAuthCleanup(env, sourcePath) {
	return withExistingOpenClawStateDatabaseReadOnly(({ db: database }) => {
		const db = getNodeSqliteKysely(database);
		const row = executeSqliteQueryTakeFirstSync(database, db.selectFrom("migration_sources").select("source_key").where("migration_kind", "=", SHARED_AUTH_STORE_MIGRATION_KIND).where("source_path", "=", sourcePath).where("removed_source", "=", 0).limit(1));
		return Boolean(row);
	}, { env }) ?? false;
}
function initializeFreshSharedAuthStore(env) {
	const ownership = resolveSharedAuthStoreOwnership(env);
	if (ownership.location === "state-db" || inspectedLegacySharedAuthOwnerships.has(ownership)) return;
	const sourcePath = path.join(resolveSharedMainAuthAgentDir(env), "openclaw-agent.sqlite");
	try {
		if (listLegacyAuthProfileSources({ env }).length > 0) {
			inspectedLegacySharedAuthOwnerships.add(ownership);
			return;
		}
		const rows = inspectSharedAuthLegacyRowsReadOnly(sourcePath);
		if (rows.store || rows.state || hasPendingSharedAuthCleanup(env, sourcePath)) {
			inspectedLegacySharedAuthOwnerships.add(ownership);
			return;
		}
	} catch {
		inspectedLegacySharedAuthOwnerships.add(ownership);
		return;
	}
	writeConfigMachineState(SHARED_AUTH_STORE_STATE_KEY, { location: "state-db" }, { env });
	noteCommittedSharedAuthStoreOwnership({ location: "state-db" }, env);
}
function prepareFreshSharedAuthStoreWrite(params) {
	const isSharedWrite = params.agentDir === void 0 || params.allowExplicitMain && path.resolve(resolveUserPath(params.agentDir, params.env)) === path.resolve(resolveSharedMainAuthAgentDir(params.env));
	if (isSharedWrite) initializeFreshSharedAuthStore(params.env);
	return isSharedWrite;
}
//#endregion
//#region src/agents/auth-profiles/sqlite.ts
/**
* SQLite persistence adapter for auth profile secrets and runtime state.
* The public helpers expose raw JSON payloads so normalization stays in the
* store/state layers that own compatibility rules.
*/
function resolveAuthProfileStoreOwner(database, env = process.env) {
	const prepared = authProfileTransactions.get(database)?.owner;
	if (prepared) return prepared;
	if (!("agentId" in database)) return {
		databasePath: database.path,
		sharedDatabasePath: database.path,
		location: "state-db"
	};
	return {
		...prepareAuthProfileSharedOwner(env),
		databasePath: database.path
	};
}
function prepareAuthProfileSharedOwner(env) {
	const preparedEnv = {
		...env,
		OPENCLAW_STATE_DIR: resolveStateDir(env)
	};
	return {
		env: preparedEnv,
		sharedDatabasePath: resolveSharedAuthStorePath(preparedEnv),
		location: resolveSharedAuthStoreOwnership(preparedEnv).location
	};
}
const PRIMARY_ROW_KEY = "primary";
const SHARED_STORE_STATE_KEY = "authProfiles.store";
const SHARED_STATE_STATE_KEY = "authProfiles.state";
function readSharedAuthKvCell(db, stateKey) {
	return executeSqliteQueryTakeFirstSync(db, getSharedAuthProfileKysely(db).selectFrom("config_machine_state").select("value_json").where("state_key", "=", stateKey))?.value_json;
}
function writeSharedAuthKvCell(db, stateKey, valueJson) {
	executeSqliteQuerySync(db, getSharedAuthProfileKysely(db).insertInto("config_machine_state").values({
		state_key: stateKey,
		value_json: valueJson,
		updated_at_ms: Date.now()
	}).onConflict((conflict) => conflict.column("state_key").doUpdateSet({
		value_json: valueJson,
		updated_at_ms: Date.now()
	})));
}
function deleteSharedAuthKvCell(db, stateKey) {
	executeSqliteQuerySync(db, getSharedAuthProfileKysely(db).deleteFrom("config_machine_state").where("state_key", "=", stateKey));
}
const AUTH_PROFILE_READ_HANDLE_CAP = 8;
const authProfileReadDatabases = /* @__PURE__ */ new Map();
const authProfileTransactions = /* @__PURE__ */ new WeakMap();
let unregisterReadHandleExitClose = null;
/** Queue runtime publication on the transaction edge owned by this database. */
function deferAuthProfilePostCommitPublication(database, publish) {
	if ("agentId" in database) return deferOpenClawAgentPostCommitPublication(database, publish);
	const publications = authProfileTransactions.get(database)?.publications;
	if (!publications) return false;
	publications.push(publish);
	return true;
}
function inferAgentIdFromDir(agentDir) {
	const normalized = path.normalize(agentDir);
	if (path.basename(normalized) === "agent") {
		const parent = path.basename(path.dirname(normalized));
		if (parent) return parent;
	}
	return `custom-${sha256HexPrefixCore(normalized, 12)}`;
}
function resolveAuthProfileDatabaseOptions(agentDir, env = process.env) {
	const pathname = agentDir ? resolveAuthProfileDatabasePath(agentDir) : resolveSharedAuthStorePath(env);
	if (!agentDir && resolveSharedAuthStoreOwnership(env).location === "state-db") return {
		kind: "shared-state",
		path: pathname,
		env
	};
	const dir = path.dirname(pathname);
	return {
		kind: "agent",
		agentId: resolveRegisteredAgentIdForDir(dir) ?? inferAgentIdFromDir(dir),
		path: pathname,
		env
	};
}
/** Filename-only consumers do not need reverse agent ownership discovery. */
function resolveAuthProfileDatabasePath(agentDir) {
	return agentDir ? path.join(resolveUserPath(agentDir), "openclaw-agent.sqlite") : resolveSharedAuthStorePath();
}
/** Resolves the durable agent owner expected for an auth-profile database. */
function resolveAuthProfileDatabaseOwnerId(agentDir) {
	const target = resolveAuthProfileDatabaseOptions(agentDir);
	if (target.kind !== "agent") throw new Error("agent auth database unexpectedly resolved to shared state");
	return target.agentId;
}
/** Resolves the SQLite database and sidecar paths used by auth profiles. */
function resolveAuthProfileDatabaseFilePaths(agentDir) {
	return resolveSqliteDatabaseFilePaths(resolveAuthProfileDatabasePath(agentDir));
}
function parseJsonCell(raw) {
	if (!raw) return null;
	return safeParseJson(raw) ?? null;
}
function getAgentAuthProfileKysely(db) {
	return getNodeSqliteKysely(db);
}
function getSharedAuthProfileKysely(db) {
	return getNodeSqliteKysely(db);
}
function resolveAuthProfileDatabaseKind(agentDir, database) {
	if (database && "agentId" in database) return "agent";
	if (database && "path" in database) return "shared-state";
	return resolveAuthProfileDatabaseOptions(agentDir).kind;
}
function inspectAuthProfileTable(db, target, databaseKind) {
	const tableName = databaseKind === "shared-state" ? "config_machine_state" : target === "store" ? "auth_profile_store" : "auth_profile_state";
	const schemaObject = db.prepare("SELECT type FROM sqlite_master WHERE name = ?").get(tableName);
	if (!schemaObject) return {
		status: "missing",
		reason: "table"
	};
	return schemaObject.type === "table" ? null : { status: "unreadable" };
}
function inspectAuthProfileJsonCell(db, target, databaseKind) {
	const tableInspection = inspectAuthProfileTable(db, target, databaseKind);
	if (tableInspection) return tableInspection;
	let raw;
	if (databaseKind === "shared-state") {
		const cell = readSharedAuthKvCell(db, target === "store" ? SHARED_STORE_STATE_KEY : SHARED_STATE_STATE_KEY);
		if (cell === void 0) return {
			status: "missing",
			reason: "row"
		};
		raw = cell;
	} else if (target === "store") {
		const row = executeSqliteQueryTakeFirstSync(db, getAgentAuthProfileKysely(db).selectFrom("auth_profile_store").select("store_json").where("store_key", "=", PRIMARY_ROW_KEY));
		if (!row) return {
			status: "missing",
			reason: "row"
		};
		raw = row.store_json;
	} else {
		const row = executeSqliteQueryTakeFirstSync(db, getAgentAuthProfileKysely(db).selectFrom("auth_profile_state").select("state_json").where("state_key", "=", PRIMARY_ROW_KEY));
		if (!row) return {
			status: "missing",
			reason: "row"
		};
		raw = row.state_json;
	}
	try {
		return {
			status: "readable",
			raw: JSON.parse(raw)
		};
	} catch {
		return { status: "unreadable" };
	}
}
function closeAuthProfileReadDatabase(databasePath) {
	const pathname = path.resolve(databasePath);
	const db = authProfileReadDatabases.get(pathname);
	if (!db) return;
	clearNodeSqliteKyselyCacheForDatabase(db);
	if (db.isOpen) db.close();
	authProfileReadDatabases.delete(pathname);
	if (authProfileReadDatabases.size === 0) {
		unregisterReadHandleExitClose?.();
		unregisterReadHandleExitClose = null;
	}
}
/** Internal lifecycle close for scoped or all process-local pooled auth-profile readers. */
function closeAuthProfileReadPool(scope) {
	if (scope?.kind === "database") {
		closeAuthProfileReadDatabase(scope.databasePath);
		return;
	}
	if (scope?.kind === "root") {
		for (const pathname of authProfileReadDatabases.keys()) if (isPathInside(scope.rootPath, pathname)) closeAuthProfileReadDatabase(pathname);
		return;
	}
	unregisterReadHandleExitClose?.();
	unregisterReadHandleExitClose = null;
	for (const pathname of authProfileReadDatabases.keys()) closeAuthProfileReadDatabase(pathname);
}
function isMissingDatabasePath(pathname) {
	try {
		fs.statSync(pathname);
		return false;
	} catch (error) {
		return error.code === "ENOENT";
	}
}
function acquireAuthProfileReadDatabase(pathname) {
	const resolvedPath = path.resolve(pathname);
	const cached = authProfileReadDatabases.get(resolvedPath);
	if (cached?.isOpen) {
		authProfileReadDatabases.delete(resolvedPath);
		authProfileReadDatabases.set(resolvedPath, cached);
		return {
			status: "readable",
			db: cached
		};
	}
	if (cached) closeAuthProfileReadDatabase(resolvedPath);
	while (authProfileReadDatabases.size >= AUTH_PROFILE_READ_HANDLE_CAP) {
		const oldestPath = authProfileReadDatabases.keys().next().value;
		if (oldestPath === void 0) break;
		closeAuthProfileReadDatabase(oldestPath);
	}
	let db;
	try {
		db = openNodeSqliteDatabase(resolvedPath, { readOnly: true });
	} catch {
		return isMissingDatabasePath(resolvedPath) ? { status: "missing" } : { status: "unreadable" };
	}
	try {
		enableNodeSqliteKyselyStatementCache(db);
		db.exec(`PRAGMA busy_timeout = ${OPENCLAW_SQLITE_BUSY_TIMEOUT_MS};`);
		if (readSqliteUserVersion(db) > 19) {
			clearNodeSqliteKyselyCacheForDatabase(db);
			db.close();
			return { status: "unreadable" };
		}
	} catch {
		clearNodeSqliteKyselyCacheForDatabase(db);
		db.close();
		return { status: "unreadable" };
	}
	authProfileReadDatabases.set(resolvedPath, db);
	unregisterReadHandleExitClose ??= registerSqliteCacheExitClose(closeAuthProfileReadPool);
	return {
		status: "readable",
		db
	};
}
function inspectAuthProfileJsonCellReadOnly(databaseTarget, target) {
	if (databaseTarget.kind === "shared-state") try {
		return withExistingOpenClawStateDatabaseReadOnly(({ db }) => inspectAuthProfileJsonCell(db, target, "shared-state"), { path: databaseTarget.path }) ?? {
			status: "missing",
			reason: "database"
		};
	} catch {
		return isMissingDatabasePath(databaseTarget.path) ? {
			status: "missing",
			reason: "database"
		} : { status: "unreadable" };
	}
	const acquired = acquireAuthProfileReadDatabase(databaseTarget.path);
	if (acquired.status === "missing") return {
		status: "missing",
		reason: "database"
	};
	if (acquired.status === "unreadable") return { status: "unreadable" };
	try {
		return inspectAuthProfileJsonCell(acquired.db, target, "agent");
	} catch {
		closeAuthProfileReadDatabase(databaseTarget.path);
		return { status: "unreadable" };
	}
}
/** Distinguishes an absent auth row from a present store that could not be read. */
function inspectPersistedAuthProfileStoreRaw(agentDir, database) {
	if (database) return inspectAuthProfileJsonCell(database.db, "store", resolveAuthProfileDatabaseKind(agentDir, database));
	return inspectAuthProfileJsonCellReadOnly(resolveAuthProfileDatabaseOptions(agentDir), "store");
}
/** Distinguishes an absent auth-state row from state that could not be read. */
function inspectPersistedAuthProfileStateRaw(agentDir, database) {
	if (database) return inspectAuthProfileJsonCell(database.db, "state", resolveAuthProfileDatabaseKind(agentDir, database));
	return inspectAuthProfileJsonCellReadOnly(resolveAuthProfileDatabaseOptions(agentDir), "state");
}
/** Inspect the shared store for an explicit state root without projecting it to an agent dir. */
function inspectPersistedSharedAuthProfileStoreRaw(env) {
	return inspectAuthProfileJsonCellReadOnly(resolveAuthProfileDatabaseOptions(void 0, env), "store");
}
/** Inspect shared runtime state for an explicit state root. */
function inspectPersistedSharedAuthProfileStateRaw(env) {
	return inspectAuthProfileJsonCellReadOnly(resolveAuthProfileDatabaseOptions(void 0, env), "state");
}
/** Reads the raw persisted secrets-store payload without coercing the schema. */
function readPersistedAuthProfileStoreRaw(agentDir, database) {
	if (database) {
		if (resolveAuthProfileDatabaseKind(agentDir, database) === "shared-state") return parseJsonCell(readSharedAuthKvCell(database.db, SHARED_STORE_STATE_KEY));
		return parseJsonCell(executeSqliteQueryTakeFirstSync(database.db, getAgentAuthProfileKysely(database.db).selectFrom("auth_profile_store").select("store_json").where("store_key", "=", PRIMARY_ROW_KEY))?.store_json);
	}
	const result = inspectAuthProfileJsonCellReadOnly(resolveAuthProfileDatabaseOptions(agentDir), "store");
	return result.status === "readable" ? result.raw : null;
}
/** Reads the raw persisted runtime-state payload without coercing the schema. */
function readPersistedAuthProfileStateRaw(agentDir, database) {
	if (database) {
		if (resolveAuthProfileDatabaseKind(agentDir, database) === "shared-state") return parseJsonCell(readSharedAuthKvCell(database.db, SHARED_STATE_STATE_KEY));
		return parseJsonCell(executeSqliteQueryTakeFirstSync(database.db, getAgentAuthProfileKysely(database.db).selectFrom("auth_profile_state").select("state_json").where("state_key", "=", PRIMARY_ROW_KEY))?.state_json);
	}
	const result = inspectAuthProfileJsonCellReadOnly(resolveAuthProfileDatabaseOptions(agentDir), "state");
	return result.status === "readable" ? result.raw : null;
}
/** Read the shared credential row for an explicit state root. */
function readPersistedSharedAuthProfileStoreRaw(env) {
	const result = inspectPersistedSharedAuthProfileStoreRaw(env);
	return result.status === "readable" ? result.raw : null;
}
/** Read the shared runtime-state row for an explicit state root. */
function readPersistedSharedAuthProfileStateRaw(env) {
	const result = inspectPersistedSharedAuthProfileStateRaw(env);
	return result.status === "readable" ? result.raw : null;
}
/** Writes the raw persisted secrets-store payload inside the auth database. */
function writePersistedAuthProfileStoreRaw(payload, agentDir, database) {
	const databaseKind = resolveAuthProfileDatabaseKind(agentDir, database);
	const write = (target) => {
		if (databaseKind === "shared-state") {
			writeSharedAuthKvCell(target.db, SHARED_STORE_STATE_KEY, JSON.stringify(payload));
			return;
		}
		executeSqliteQuerySync(target.db, getAgentAuthProfileKysely(target.db).insertInto("auth_profile_store").values({
			store_key: PRIMARY_ROW_KEY,
			store_json: JSON.stringify(payload),
			updated_at: Date.now()
		}).onConflict((conflict) => conflict.column("store_key").doUpdateSet({
			store_json: JSON.stringify(payload),
			updated_at: Date.now()
		})));
	};
	if (database) {
		write(database);
		return;
	}
	runAuthProfileWriteTransaction(agentDir, write);
}
/** Deletes the persisted secrets-store row while leaving runtime state intact. */
function deletePersistedAuthProfileStoreRaw(agentDir, database) {
	const databaseKind = resolveAuthProfileDatabaseKind(agentDir, database);
	const remove = (target) => {
		if (databaseKind === "shared-state") {
			deleteSharedAuthKvCell(target.db, SHARED_STORE_STATE_KEY);
			return;
		}
		executeSqliteQuerySync(target.db, getAgentAuthProfileKysely(target.db).deleteFrom("auth_profile_store").where("store_key", "=", PRIMARY_ROW_KEY));
	};
	if (database) {
		remove(database);
		return;
	}
	runAuthProfileWriteTransaction(agentDir, remove);
}
/** Writes or deletes the persisted runtime-state payload. */
function writePersistedAuthProfileStateRaw(payload, agentDir, database) {
	const databaseKind = resolveAuthProfileDatabaseKind(agentDir, database);
	const write = (target) => {
		if (databaseKind === "shared-state") {
			if (!payload) {
				deleteSharedAuthKvCell(target.db, SHARED_STATE_STATE_KEY);
				return;
			}
			writeSharedAuthKvCell(target.db, SHARED_STATE_STATE_KEY, JSON.stringify(payload));
			return;
		}
		const db = getAgentAuthProfileKysely(target.db);
		if (!payload) {
			executeSqliteQuerySync(target.db, db.deleteFrom("auth_profile_state").where("state_key", "=", PRIMARY_ROW_KEY));
			return;
		}
		executeSqliteQuerySync(target.db, db.insertInto("auth_profile_state").values({
			state_key: PRIMARY_ROW_KEY,
			state_json: JSON.stringify(payload),
			updated_at: Date.now()
		}).onConflict((conflict) => conflict.column("state_key").doUpdateSet({
			state_json: JSON.stringify(payload),
			updated_at: Date.now()
		})));
	};
	if (database) {
		write(database);
		return;
	}
	runAuthProfileWriteTransaction(agentDir, write);
}
/** Runs an auth-profile database write transaction for store/state updates. */
function runAuthProfileWriteTransaction(agentDir, operation, options = {}) {
	const env = {
		...options.env ?? process.env,
		...!options.env && options.stateDir ? {
			OPENCLAW_STATE_DIR: options.stateDir,
			OPENCLAW_AGENT_DIR: void 0
		} : {}
	};
	const databaseTarget = resolveAuthProfileDatabaseOptions(prepareFreshSharedAuthStoreWrite({
		agentDir,
		allowExplicitMain: options.sharedStoreWrite === true,
		env
	}) ? void 0 : agentDir, env);
	const sharedOwner = prepareAuthProfileSharedOwner(env);
	if (databaseTarget.kind === "agent") return runOpenClawAgentWriteTransaction((database) => {
		const previous = authProfileTransactions.get(database);
		const context = previous ?? {
			owner: {
				...sharedOwner,
				databasePath: database.path
			},
			publications: []
		};
		authProfileTransactions.set(database, context);
		try {
			return operation(database, context.owner);
		} finally {
			if (!previous) authProfileTransactions.delete(database);
		}
	}, databaseTarget);
	const database = openOpenClawStateDatabase({
		env,
		path: databaseTarget.path
	});
	const enteredNestedTransaction = database.db.isTransaction;
	const context = authProfileTransactions.get(database) ?? {
		owner: {
			...sharedOwner,
			databasePath: database.path
		},
		publications: []
	};
	const publicationStart = context.publications.length;
	if (!enteredNestedTransaction) authProfileTransactions.set(database, context);
	let result;
	try {
		const owner = context.owner;
		result = runOpenClawStateWriteTransaction((transaction) => operation(transaction, owner), {
			env,
			database
		});
	} catch (error) {
		context.publications.splice(publicationStart);
		throw error;
	} finally {
		if (!enteredNestedTransaction) authProfileTransactions.delete(database);
	}
	if (!enteredNestedTransaction) for (const publish of context.publications) publish();
	return result;
}
//#endregion
export { inspectSharedAuthLegacySourceFile as C, resolveLegacyAuthProfileSourceCandidates as D, listLegacyAuthProfileSources as E, resolveLegacyOAuthPath as O, inspectSharedAuthLegacyRowsReadOnly as S, listLegacyAuthProfileArchives as T, runAuthProfileWriteTransaction as _, inspectPersistedAuthProfileStateRaw as a, SharedAuthStoreSourceInspectionError as b, inspectPersistedSharedAuthProfileStoreRaw as c, readPersistedSharedAuthProfileStateRaw as d, readPersistedSharedAuthProfileStoreRaw as f, resolveAuthProfileStoreOwner as g, resolveAuthProfileDatabasePath as h, inspectAuthProfileJsonCellReadOnly as i, readPersistedAuthProfileStateRaw as l, resolveAuthProfileDatabaseOwnerId as m, deferAuthProfilePostCommitPublication as n, inspectPersistedAuthProfileStoreRaw as o, resolveAuthProfileDatabaseFilePaths as p, deletePersistedAuthProfileStoreRaw as r, inspectPersistedSharedAuthProfileStateRaw as s, closeAuthProfileReadPool as t, readPersistedAuthProfileStoreRaw as u, writePersistedAuthProfileStateRaw as v, readSharedAuthLegacyRowsFromDatabase as w, hasPendingSharedAuthCleanup as x, writePersistedAuthProfileStoreRaw as y };