@seams/wallet-server 0.8.0 → 0.9.0

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorizationCleanup.js

@@ -0,0 +1,157 @@
+import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
+import { parseUnixMs } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { parseNonNegativeSafeInteger } from "../../../../shared-ts/src/device-linking/wireFields.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+import { evictWalletEd25519CapabilityCache } from "../ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js";
+import { AuthorizationSnapshotLayout } from "./authorizationSnapshotLayout.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletAuthorizationCleanup.ts
+const SCOPE = "namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND wallet_id = ?5";
+const TABLES = [
+	"linked_device_wallet_session_credential_deliveries_v1",
+	"linked_device_bootstrap_imports",
+	"linked_device_request_proof_nonces",
+	"linked_device_email_otp_grants",
+	"linked_device_ed25519_export_root_transfers",
+	"linked_device_session_transcripts",
+	"linked_device_target_commit_reservations",
+	"linked_device_target_credentials",
+	"linked_device_authority_installations",
+	"linked_device_authority_allocations",
+	"linked_device_sessions",
+	"wallet_email_otp_rate_limits",
+	"email_otp_wallet_enrollments",
+	"email_otp_auth_states",
+	"authorized_operation_audit_events",
+	"authorized_operations",
+	"verified_wallet_operation_evidence_sets",
+	"wallet_session_hosted_exchange_codes_v2",
+	"wallet_session_hosted_credentials_v2",
+	"wallet_session_authorizations_v2",
+	"router_ab_yao_versioned_json_records",
+	"webauthn_authenticators",
+	"webauthn_credential_bindings",
+	"wallet_signers",
+	"wallet_recovery_code_locators",
+	"wallets",
+	"wallet_auth_methods",
+	"wallet_relocation_approvals",
+	"wallet_authorities",
+	"wallet_relocation_authorization_import_receipts",
+	"wallet_relocation_authorization_chunks",
+	"wallet_relocation_authorization_intake_chunks"
+];
+var D1WalletAuthorizationCleanup = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	async advance(source, rawManifest, commandDigest, nowMs) {
+		parseUnixMs(nowMs, "authorization cleanup time");
+		const manifestJson = await this.manifest(source, rawManifest);
+		const prior = await this.read(source, manifestJson, commandDigest);
+		if (prior?.state === "cleaned") return prior;
+		const identity = [
+			source.walletId,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration
+		];
+		if (!prior) await prepareD1TenantStatement(this.database, this.scope, `
+        INSERT INTO wallet_relocation_authorization_cleanups
+          (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex,
+           source_generation, command_digest, manifest_json, state)
+        VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, 'cleaning')
+        ON CONFLICT DO NOTHING`, [
+			...identity,
+			commandDigest,
+			manifestJson
+		]).run();
+		const admitted = await this.read(source, manifestJson, commandDigest);
+		if (!admitted) throw new Error("Authorization cleanup admission disappeared");
+		if (admitted.state === "cleaned") return admitted;
+		for (const table of TABLES) {
+			const ownership = table === "authorized_operations" || table === "authorized_operation_audit_events" || table === "webauthn_authenticators" || table === "webauthn_credential_bindings" || table === "router_ab_yao_versioned_json_records" || table === "linked_device_sessions" || table === "linked_device_target_commit_reservations" || table === "linked_device_session_transcripts" || table === "linked_device_request_proof_nonces" || table === "linked_device_bootstrap_imports" ? AuthorizationSnapshotLayout.ownership(table) : "target.namespace = ?1 AND target.org_id = ?2 AND target.project_id = ?3 AND target.env_id = ?4 AND target.wallet_id = ?5";
+			const quota = table === "wallet_session_authorizations_v2" ? ", json_array(target.namespace, target.tenant_id, target.quota_id) AS quota_key" : "";
+			const rows = await prepareD1TenantStatement(this.database, this.scope, `SELECT target.rowid AS row_id${quota} FROM ${table} AS target WHERE ${ownership} ORDER BY target.rowid LIMIT 16`, [source.walletId]).all();
+			const rowIds = [];
+			const quotaKeys = [];
+			for (const row of rows.results ?? []) {
+				rowIds.push(parseNonNegativeSafeInteger(row.row_id, "cleanup row id"));
+				if (table === "wallet_session_authorizations_v2") quotaKeys.push(requireCanonicalString(row.quota_key, "cleanup quota key"));
+			}
+			if (rowIds.length === 0) continue;
+			const statements = [
+				prepareD1TenantStatement(this.database, this.scope, `
+          UPDATE wallet_relocation_authorization_cleanups SET state = state
+          WHERE ${SCOPE} AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8
+            AND command_digest = ?9 AND state = 'cleaning'`, [...identity, commandDigest]),
+				this.database.prepare(D1_BATCH_CAS_GUARD_SQL),
+				prepareD1TenantStatement(this.database, this.scope, `DELETE FROM ${table} AS target WHERE ${ownership} AND target.rowid IN (SELECT value FROM json_each(?6))`, [source.walletId, JSON.stringify(rowIds)])
+			];
+			if (quotaKeys.length > 0) statements.push(this.database.prepare(`
+          DELETE FROM authorization_wallet_session_quotas
+          WHERE json_array(namespace, tenant_id, quota_id) IN (SELECT value FROM json_each(?1))`).bind(JSON.stringify(quotaKeys)));
+			await this.database.batch(statements);
+			return { state: "cleaning" };
+		}
+		await evictWalletEd25519CapabilityCache({
+			database: this.database,
+			scope: this.scope
+		}, source.walletId);
+		await this.database.batch([prepareD1TenantStatement(this.database, this.scope, `
+        UPDATE wallet_relocation_authorization_cleanups SET state = 'cleaned', completed_at_ms = ?10
+        WHERE ${SCOPE} AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8
+          AND command_digest = ?9 AND state = 'cleaning'`, [
+			...identity,
+			commandDigest,
+			nowMs
+		]), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)]);
+		const completed = await this.read(source, manifestJson, commandDigest);
+		if (completed?.state !== "cleaned") throw new Error("Authorization cleanup completion disappeared");
+		return completed;
+	}
+	async manifest(source, raw) {
+		const expected = requireRecord(raw, "cleanup manifest");
+		const row = await prepareD1TenantStatement(this.database, this.scope, `SELECT wallet_id, move_id, request_digest_hex, source_generation,
+          schema_json, chunk_count, record_count, digest_hex
+       FROM wallet_relocation_authorization_snapshots
+       WHERE ${SCOPE} AND move_id = ?6 AND state = 'sealed'
+       UNION ALL
+       SELECT wallet_id, move_id, request_digest_hex, source_generation,
+          json_extract(manifest_json, '$.schemaJson') AS schema_json,
+          json_extract(manifest_json, '$.chunkCount') AS chunk_count,
+          json_extract(manifest_json, '$.recordCount') AS record_count,
+          json_extract(manifest_json, '$.digestHex') AS digest_hex
+       FROM wallet_relocation_authorization_cleanups
+       WHERE ${SCOPE} AND move_id = ?6 AND state = 'cleaned'
+       LIMIT 1`, [source.walletId, source.moveId]).first();
+		if (!row || !source.matches(row)) throw new Error("Authorization cleanup snapshot conflicts");
+		const manifest = {
+			schemaJson: requireCanonicalString(row.schema_json, "cleanup snapshot schema"),
+			chunkCount: parseNonNegativeSafeInteger(row.chunk_count, "cleanup snapshot chunks"),
+			recordCount: parseNonNegativeSafeInteger(row.record_count, "cleanup snapshot records"),
+			digestHex: requireCanonicalString(row.digest_hex, "cleanup snapshot digest")
+		};
+		if (Object.keys(expected).length !== 4) throw new Error("Authorization cleanup manifest conflicts");
+		for (const [key, value] of Object.entries(manifest)) if (expected[key] !== value) throw new Error("Authorization cleanup manifest conflicts");
+		return JSON.stringify(manifest);
+	}
+	async read(source, manifestJson, commandDigest) {
+		const row = await prepareD1TenantStatement(this.database, this.scope, `SELECT * FROM wallet_relocation_authorization_cleanups WHERE ${SCOPE} AND move_id = ?6`, [source.walletId, source.moveId]).first();
+		if (!row) return null;
+		if (!source.matches(row) || row.manifest_json !== manifestJson || row.command_digest !== commandDigest) throw new Error("Authorization cleanup identity conflicts");
+		switch (row.state) {
+			case "cleaning": return { state: "cleaning" };
+			case "cleaned": return {
+				state: "cleaned",
+				completedAtMs: parseUnixMs(row.completed_at_ms, "cleanup completion time")
+			};
+			default: throw new Error("Authorization cleanup state is invalid");
+		}
+	}
+};
+//#endregion
+export { D1WalletAuthorizationCleanup };
+
+//# sourceMappingURL=d1WalletAuthorizationCleanup.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorizationFreeze.js

@@ -0,0 +1,56 @@
+import { parseUnixMs } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletAuthorizationFreeze.ts
+var D1WalletAuthorizationFreeze = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	async freeze(source, nowMs) {
+		parseUnixMs(nowMs, "authorization freeze time");
+		const existing = await this.read(source);
+		if (existing !== null) return existing;
+		await this.database.batch(this.freezeStatements(source, nowMs));
+		const frozenAtMs = await this.read(source);
+		if (frozenAtMs === null) throw new Error("Authorization freeze disappeared");
+		return frozenAtMs;
+	}
+	freezeStatements(source, nowMs) {
+		parseUnixMs(nowMs, "authorization freeze time");
+		const identity = [
+			source.walletId,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration
+		];
+		return [
+			prepareD1TenantStatement(this.database, this.scope, `
+        INSERT INTO wallet_relocation_authorization_fences
+          (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex, source_generation, frozen_at_ms)
+        SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9
+        WHERE NOT EXISTS (
+          SELECT 1 FROM wallet_relocation_authorization_fences
+          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND wallet_id = ?5
+        )`, [...identity, nowMs]),
+			prepareD1TenantStatement(this.database, this.scope, `
+        UPDATE wallet_relocation_authorization_fences SET frozen_at_ms = frozen_at_ms
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5 AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8`, identity),
+			this.database.prepare(D1_BATCH_CAS_GUARD_SQL)
+		];
+	}
+	async read(source) {
+		const row = await prepareD1TenantStatement(this.database, this.scope, `
+      SELECT wallet_id, move_id, request_digest_hex, source_generation, frozen_at_ms
+      FROM wallet_relocation_authorization_fences
+      WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND wallet_id = ?5`, [source.walletId]).first();
+		if (!row) return null;
+		if (!source.matches(row)) throw new Error("Authorization freeze identity conflicts");
+		return parseUnixMs(row.frozen_at_ms, "stored authorization freeze time");
+	}
+};
+//#endregion
+export { D1WalletAuthorizationFreeze };
+
+//# sourceMappingURL=d1WalletAuthorizationFreeze.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorizationHistory.js

@@ -0,0 +1,238 @@
+import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+import { AuthorizationSnapshotLayout } from "./authorizationSnapshotLayout.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletAuthorizationHistory.ts
+const MAX_RECORD_BYTES = 2097152;
+var D1WalletAuthorizationHistory = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	async prepare(source) {
+		if (await this.readImport(source)) return;
+		const empty = [];
+		for (const layout of await AuthorizationSnapshotLayout.read(this.database)) {
+			if (layout.table === "authorization_wallet_session_quotas") continue;
+			empty.push(`NOT EXISTS (SELECT 1 FROM ${layout.table} AS target
+        WHERE ${layout.expressions().ownership})`);
+		}
+		await this.database.batch([
+			...prepareCleanedDestinationReturn(this.database, this.scope, source),
+			prepareD1TenantStatement(this.database, this.scope, `
+        INSERT INTO wallet_relocation_authorization_imports
+          (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex, source_generation, state)
+        SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'importing'
+        WHERE ${empty.join(" AND ")}
+          AND NOT EXISTS (SELECT 1 FROM wallet_relocation_session_fences
+            WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND wallet_id = ?5)
+        ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id) DO NOTHING`, [
+				source.walletId,
+				source.moveId,
+				source.requestDigestHex,
+				source.sourceGeneration
+			]),
+			prepareD1TenantStatement(this.database, this.scope, `
+        UPDATE wallet_relocation_authorization_imports SET state = state
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5 AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8`, [
+				source.walletId,
+				source.moveId,
+				source.requestDigestHex,
+				source.sourceGeneration
+			]),
+			this.database.prepare(D1_BATCH_CAS_GUARD_SQL)
+		]);
+	}
+	async restoreSnapshot(source, records, completion) {
+		const statements = [];
+		for (const record of records) {
+			const row = {
+				layout: record.table,
+				key: record.recordKey,
+				json: record.recordJson,
+				digest: await sha256HexUtf8(JSON.stringify([record.table.table, record.recordJson]))
+			};
+			statements.push(this.validateRow(source, row), this.database.prepare(D1_BATCH_CAS_GUARD_SQL), ...this.restoreStatements(source, row));
+		}
+		statements.push(...this.closeStatements(source), ...completion);
+		await this.database.batch(statements);
+	}
+	restoreStatements(source, row) {
+		const table = row.layout.table;
+		const identity = [
+			source.walletId,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration,
+			table,
+			row.key,
+			row.digest
+		];
+		const values = [];
+		for (const column of row.layout.columns) values.push(`json_extract(?6, '$.${column}')`);
+		const expressions = row.layout.expressions();
+		return [
+			prepareD1TenantStatement(this.database, this.scope, `
+          INSERT INTO wallet_relocation_authorization_import_context
+            (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex, source_generation,
+             table_name, record_key, record_digest)
+          SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11
+          FROM wallet_relocation_authorization_imports
+          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+            AND wallet_id = ?5 AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8
+            AND state = 'importing'
+            AND NOT EXISTS (SELECT 1 FROM wallet_relocation_authorization_import_receipts
+              WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+                AND wallet_id = ?5 AND move_id = ?6 AND table_name = ?9 AND record_key = ?10)`, identity),
+			this.database.prepare(D1_BATCH_CAS_GUARD_SQL),
+			prepareD1TenantStatement(this.database, this.scope, `INSERT INTO ${table} (${row.layout.columns.join(", ")}) SELECT ${values.join(", ")}`, [source.walletId, row.json]),
+			prepareD1TenantStatement(this.database, this.scope, `
+          INSERT INTO wallet_relocation_authorization_import_receipts
+            (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex, source_generation,
+             table_name, record_key, record_digest)
+          SELECT namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex, source_generation,
+            table_name, record_key, record_digest
+          FROM wallet_relocation_authorization_import_context
+          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+            AND wallet_id = ?5 AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8
+            AND table_name = ?9 AND record_key = ?10 AND record_digest = ?11
+            AND EXISTS (SELECT 1 FROM ${table} AS target
+              WHERE ${expressions.key} = ?10 AND ${expressions.record} = ?12)`, [...identity, row.json]),
+			this.database.prepare(D1_BATCH_CAS_GUARD_SQL),
+			prepareD1TenantStatement(this.database, this.scope, `
+          DELETE FROM wallet_relocation_authorization_import_context
+          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+            AND wallet_id = ?5 AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8
+            AND table_name = ?9 AND record_key = ?10 AND record_digest = ?11`, identity)
+		];
+	}
+	closeStatements(source) {
+		return [prepareD1TenantStatement(this.database, this.scope, `
+        UPDATE wallet_relocation_authorization_imports
+        SET state = CASE WHEN state = 'importing' THEN 'closed' ELSE state END
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5 AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8
+          AND NOT EXISTS (SELECT 1 FROM wallet_relocation_authorization_import_receipts AS receipt
+            WHERE receipt.namespace = ?1 AND receipt.org_id = ?2 AND receipt.project_id = ?3 AND receipt.env_id = ?4
+              AND receipt.wallet_id = ?5 AND receipt.table_name = 'authorization_wallet_session_quotas'
+              AND NOT EXISTS (SELECT 1 FROM authorization_wallet_session_quotas AS quota
+                JOIN wallet_session_authorizations_v2 AS session ON session.namespace = quota.namespace
+                  AND session.tenant_id = quota.tenant_id AND session.quota_id = quota.quota_id
+                  AND session.wallet_session_id = quota.wallet_session_id
+                WHERE json_array(quota.namespace, quota.quota_id, quota.tenant_id) = receipt.record_key
+                  AND session.namespace = ?1 AND session.org_id = ?2 AND session.project_id = ?3 AND session.env_id = ?4
+                  AND session.wallet_id = ?5 AND session.retired_at_ms IS NOT NULL))`, [
+			source.walletId,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration
+		]), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
+	}
+	async readImport(source) {
+		const row = await prepareD1TenantStatement(this.database, this.scope, `
+      SELECT wallet_id, move_id, request_digest_hex, source_generation
+      FROM wallet_relocation_authorization_imports
+      WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND wallet_id = ?5`, [source.walletId]).first();
+		if (!row) return false;
+		if (source.matches(row)) return true;
+		if (typeof row.source_generation === "number" && row.source_generation + 1 < source.sourceGeneration) return false;
+		throw new Error("Authorization history import identity conflicts");
+	}
+	validateRow(source, row) {
+		const layout = row.layout;
+		const raw = row.json;
+		if (typeof raw !== "string" || new TextEncoder().encode(raw).byteLength > MAX_RECORD_BYTES) throw new Error("Authorization history requires a bounded assembled record");
+		const table = layout.table;
+		const fields = [];
+		const keys = [];
+		for (const column of layout.columns) fields.push(`'${column}', json_extract(?6, '$.${column}')`);
+		for (const column of layout.keyColumns) keys.push(`json_extract(?6, '$.${column}')`);
+		const ownership = table === "authorization_wallet_session_quotas" ? "target.namespace = ?1" : layout.expressions().ownership;
+		const projectedColumns = [];
+		for (const column of layout.columns) projectedColumns.push(`json_extract(?6, '$.${column}') AS ${column}`);
+		let lifecycle = "1";
+		if (table === "wallet_session_authorizations_v2") lifecycle = `json_type(?6, '$.retired_at_ms') = 'integer'`;
+		if (table === "wallet_session_hosted_credentials_v2") lifecycle = `json_type(?6, '$.retired_at_ms') = 'integer' AND json_extract(?6, '$.lifecycle_kind') = 'retired'`;
+		if (table === "authorized_operations") lifecycle = "target.lifecycle_kind = 'completed'";
+		if (table === "authorized_operation_audit_events") lifecycle = "target.result_kind != 'pending'";
+		return prepareD1TenantStatement(this.database, this.scope, `
+      UPDATE wallet_relocation_authorization_imports SET state = state
+      WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND wallet_id = ?5
+        AND move_id = ?7 AND request_digest_hex = ?8 AND source_generation = ?9 AND state = 'importing'
+        AND EXISTS (SELECT 1 FROM (SELECT ${projectedColumns.join(", ")}) AS target
+      WHERE json_valid(?6) AND json_type(?6) = 'object' AND ${ownership} AND ${lifecycle}
+        AND (SELECT COUNT(*) FROM json_each(?6)) = ${layout.columns.length}
+        AND (SELECT COUNT(DISTINCT key) FROM json_each(?6)) = ${layout.columns.length}
+        AND NOT EXISTS (SELECT 1 FROM json_each(?6) AS value
+          LEFT JOIN pragma_table_info('${table}') AS field ON field.name = value.key
+          WHERE field.name IS NULL OR NOT (value.type = 'null'
+            OR (field.type = 'TEXT' AND value.type = 'text')
+            OR (field.type = 'INTEGER' AND value.type = 'integer' AND typeof(value.atom) = 'integer')))
+        AND json_object(${fields.join(", ")}) = ?6
+        AND json_array(${keys.join(", ")}) = ?10)`, [
+			source.walletId,
+			raw,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration,
+			row.key
+		]);
+	}
+};
+function prepareCleanedDestinationReturn(database, scope, source) {
+	const identity = [
+		source.walletId,
+		source.moveId,
+		source.requestDigestHex,
+		source.sourceGeneration
+	];
+	const statements = [prepareD1TenantStatement(database, scope, `
+    INSERT INTO wallet_relocation_authorization_returns
+      (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex,
+       source_generation, previous_move_id, previous_request_digest_hex, retired_generation)
+    SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, cleanup.move_id, cleanup.request_digest_hex, execution.generation
+    FROM wallet_relocation_authorization_cleanups AS cleanup
+    JOIN wallet_execution_generations AS execution USING (namespace, org_id, project_id, env_id, wallet_id)
+    WHERE cleanup.namespace = ?1 AND cleanup.org_id = ?2 AND cleanup.project_id = ?3
+      AND cleanup.env_id = ?4 AND cleanup.wallet_id = ?5 AND cleanup.state = 'cleaned'
+      AND execution.state = 'retired' AND execution.generation = cleanup.source_generation
+      AND execution.generation < ?8
+    ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id, move_id) DO NOTHING`, identity)];
+	for (const table of [
+		"wallet_relocation_authorization_imports",
+		"wallet_relocation_authorization_intakes",
+		"wallet_relocation_authorization_snapshots",
+		"wallet_relocation_authorization_fences",
+		"wallet_relocation_session_fences",
+		"wallet_execution_generations"
+	]) {
+		let priorIdentity;
+		switch (table) {
+			case "wallet_relocation_authorization_imports":
+			case "wallet_relocation_authorization_intakes":
+				priorIdentity = "target.source_generation + 1 = returned.retired_generation";
+				break;
+			case "wallet_execution_generations":
+				priorIdentity = "target.generation = returned.retired_generation AND target.state = 'retired'";
+				break;
+			default: priorIdentity = `target.source_generation = returned.retired_generation
+          AND target.move_id = returned.previous_move_id
+          AND target.request_digest_hex = returned.previous_request_digest_hex`;
+		}
+		statements.push(prepareD1TenantStatement(database, scope, `
+      DELETE FROM ${table} AS target
+      WHERE target.namespace = ?1 AND target.org_id = ?2 AND target.project_id = ?3
+        AND target.env_id = ?4 AND target.wallet_id = ?5 AND EXISTS (
+          SELECT 1 FROM wallet_relocation_authorization_returns AS returned
+          WHERE returned.namespace = ?1 AND returned.org_id = ?2 AND returned.project_id = ?3
+            AND returned.env_id = ?4 AND returned.wallet_id = ?5 AND returned.move_id = ?6
+            AND returned.request_digest_hex = ?7 AND returned.source_generation = ?8
+            AND ${priorIdentity})`, identity));
+	}
+	return statements;
+}
+//#endregion
+export { D1WalletAuthorizationHistory };
+
+//# sourceMappingURL=d1WalletAuthorizationHistory.js.map