@seams/wallet-server 0.8.0 → 0.9.1

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorizationIntake.js

@@ -0,0 +1,287 @@
+import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
+import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseUnixMs } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { parseNonNegativeSafeInteger } from "../../../../shared-ts/src/device-linking/wireFields.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+import { AuthorizationSnapshotLayout } from "./authorizationSnapshotLayout.js";
+import { D1WalletAuthorizationHistory } from "./d1WalletAuthorizationHistory.js";
+import "./d1WalletAuthorizationSnapshot.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletAuthorizationIntake.ts
+const SCOPE = "namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND wallet_id = ?5";
+var D1WalletAuthorizationIntake = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	async prepare(source, rawManifest) {
+		const manifest = parseManifest(rawManifest);
+		if (manifest.schemaJson !== JSON.stringify(await AuthorizationSnapshotLayout.read(this.database))) throw new Error("Authorization intake schema conflicts");
+		const json = JSON.stringify(manifest);
+		const existing = await this.read(source);
+		if (existing) {
+			if (JSON.stringify(existing.manifest) !== json) throw new Error("Authorization intake manifest conflicts");
+			return intakeProgress(existing);
+		}
+		await new D1WalletAuthorizationHistory(this.database, this.scope).prepare(source);
+		const digest = await sha256HexUtf8(JSON.stringify([
+			"seams/wallet-authorization-snapshot/v1",
+			this.scope.namespace,
+			this.scope.orgId,
+			this.scope.projectId,
+			this.scope.envId,
+			source.walletId,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration,
+			manifest.schemaJson
+		]));
+		await prepareD1TenantStatement(this.database, this.scope, `
+      INSERT INTO wallet_relocation_authorization_intakes
+      (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex,
+       source_generation, manifest_json, digest_hex)
+      VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)
+      ON CONFLICT DO NOTHING`, [
+			source.walletId,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration,
+			json,
+			digest
+		]).run();
+		const saved = await this.read(source);
+		if (!saved || JSON.stringify(saved.manifest) !== json) throw new Error("Authorization intake manifest conflicts");
+		return intakeProgress(saved);
+	}
+	async acceptSnapshot(source, raw) {
+		if (!Array.isArray(raw) || raw.length > 80 || new TextEncoder().encode(JSON.stringify(raw)).byteLength > 524288) throw new Error("Authorization snapshot exceeds supported capacity");
+		const state = await this.read(source);
+		if (!state) throw new Error("Authorization intake is absent");
+		const manifest = state.manifest;
+		if (raw.length !== manifest.chunkCount) throw new Error("Authorization snapshot count conflicts");
+		const layouts = AuthorizationSnapshotLayout.parse(JSON.parse(manifest.schemaJson));
+		let digest = await sha256HexUtf8(JSON.stringify([
+			"seams/wallet-authorization-snapshot/v1",
+			this.scope.namespace,
+			this.scope.orgId,
+			this.scope.projectId,
+			this.scope.envId,
+			source.walletId,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration,
+			manifest.schemaJson
+		]));
+		const records = [];
+		const completion = [];
+		let previous = null;
+		let recordHex = "";
+		for (const [index, value] of raw.entries()) {
+			const chunk = parseChunk(value, layouts);
+			const firstSegment = previous === null || previous.segmentIndex + 1 === previous.segmentCount;
+			if (chunk.index !== index || (firstSegment ? chunk.segmentIndex !== 0 : previous === null || chunk.segmentIndex !== previous.segmentIndex + 1 || chunk.segmentCount !== previous.segmentCount || chunk.recordKey !== previous.recordKey || chunk.table.table !== previous.table.table)) throw new Error("Authorization snapshot segments conflict");
+			digest = await sha256HexUtf8(JSON.stringify([
+				digest,
+				index,
+				chunk.chunkJson
+			]));
+			if (digest !== chunk.digestHex) throw new Error("Authorization snapshot digest conflicts");
+			recordHex += chunk.bytesHex;
+			const completed = chunk.segmentIndex + 1 === chunk.segmentCount;
+			if (completed) {
+				const bytes = new Uint8Array(recordHex.length / 2);
+				for (let offset = 0; offset < bytes.length; offset += 1) bytes[offset] = Number.parseInt(recordHex.slice(offset * 2, offset * 2 + 2), 16);
+				records.push({
+					table: chunk.table,
+					recordKey: chunk.recordKey,
+					recordJson: new TextDecoder("utf-8", { fatal: true }).decode(bytes)
+				});
+				recordHex = "";
+			}
+			completion.push(prepareD1TenantStatement(this.database, this.scope, `
+        INSERT INTO wallet_relocation_authorization_intake_chunks
+        (namespace, org_id, project_id, env_id, wallet_id, chunk_index, chunk_json, digest_hex)
+        VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)`, [
+				source.walletId,
+				index,
+				chunk.chunkJson,
+				chunk.digestHex
+			]), prepareD1TenantStatement(this.database, this.scope, `
+        UPDATE wallet_relocation_authorization_intakes SET next_index = next_index + 1,
+          record_count = record_count + ?8, digest_hex = ?7
+        WHERE ${SCOPE} AND next_index = ?6 AND state = 'receiving'`, [
+				source.walletId,
+				index,
+				chunk.digestHex,
+				completed ? 1 : 0
+			]), this.database.prepare(D1_BATCH_CAS_GUARD_SQL));
+			previous = chunk;
+		}
+		if (recordHex !== "" || records.length !== manifest.recordCount || digest !== manifest.digestHex) throw new Error("Authorization snapshot is incomplete");
+		if (state.state === "verified") return digest;
+		if (state.nextIndex !== 0) throw new Error("Authorization snapshot intake is not empty");
+		completion.push(prepareD1TenantStatement(this.database, this.scope, `
+      UPDATE wallet_relocation_authorization_intakes SET state = 'verified'
+      WHERE ${SCOPE} AND state = 'receiving' AND next_index = ?6 AND record_count = ?7 AND digest_hex = ?8`, [
+			source.walletId,
+			manifest.chunkCount,
+			manifest.recordCount,
+			digest
+		]), this.database.prepare(D1_BATCH_CAS_GUARD_SQL));
+		try {
+			await new D1WalletAuthorizationHistory(this.database, this.scope).restoreSnapshot(source, records, completion);
+		} catch (error) {
+			const concurrent = await this.read(source);
+			if (concurrent?.state === "verified" && concurrent.manifest.digestHex === digest) return digest;
+			throw error;
+		}
+		return digest;
+	}
+	async activate(source, rawManifest, commandDigest, nowMs) {
+		const manifest = parseManifest(rawManifest);
+		const manifestJson = JSON.stringify(manifest);
+		parseUnixMs(nowMs, "authorization activation time");
+		const existing = await this.readActivation(source, manifestJson, commandDigest);
+		if (existing !== null) return {
+			digestHex: manifest.digestHex,
+			activatedAtMs: existing
+		};
+		const identity = [
+			source.walletId,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration
+		];
+		await this.database.batch([
+			prepareD1TenantStatement(this.database, this.scope, `
+        INSERT INTO wallet_relocation_authorization_activations
+          (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex,
+           source_generation, command_digest, manifest_json, activated_at_ms)
+        SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11
+        WHERE NOT EXISTS (SELECT 1 FROM wallet_relocation_authorization_activations
+          WHERE ${SCOPE} AND move_id = ?6)
+        ON CONFLICT DO NOTHING`, [
+				...identity,
+				commandDigest,
+				manifestJson,
+				nowMs
+			]),
+			prepareD1TenantStatement(this.database, this.scope, `
+        UPDATE wallet_relocation_authorization_imports SET state = 'activated'
+        WHERE ${SCOPE} AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8
+          AND state IN ('closed', 'activated')
+          AND EXISTS (SELECT 1 FROM wallet_relocation_authorization_activations AS receipt
+            WHERE receipt.namespace = ?1 AND receipt.org_id = ?2 AND receipt.project_id = ?3
+              AND receipt.env_id = ?4 AND receipt.wallet_id = ?5 AND receipt.move_id = ?6
+              AND receipt.command_digest = ?9 AND receipt.manifest_json = ?10)`, [
+				...identity,
+				commandDigest,
+				manifestJson
+			]),
+			this.database.prepare(D1_BATCH_CAS_GUARD_SQL)
+		]);
+		const activatedAtMs = await this.readActivation(source, manifestJson, commandDigest);
+		if (activatedAtMs === null) throw new Error("Authorization activation receipt disappeared");
+		return {
+			digestHex: manifest.digestHex,
+			activatedAtMs
+		};
+	}
+	async readActivation(source, manifestJson, commandDigest) {
+		const row = await prepareD1TenantStatement(this.database, this.scope, `
+      SELECT * FROM wallet_relocation_authorization_activations
+      WHERE ${SCOPE} AND move_id = ?6`, [source.walletId, source.moveId]).first();
+		if (!row) return null;
+		if (!source.matches(row) || row.command_digest !== commandDigest || row.manifest_json !== manifestJson) throw new Error("Authorization activation identity conflicts");
+		return parseUnixMs(row.activated_at_ms, "stored authorization activation time");
+	}
+	async read(source) {
+		const row = await prepareD1TenantStatement(this.database, this.scope, `
+      SELECT * FROM wallet_relocation_authorization_intakes WHERE ${SCOPE}`, [source.walletId]).first();
+		if (!row) return null;
+		if (!source.matches(row)) throw new Error("Authorization intake identity conflicts");
+		const manifest = parseManifest(JSON.parse(requireCanonicalString(row.manifest_json, "intake manifest")));
+		const nextIndex = parseNonNegativeSafeInteger(row.next_index, "intake next index");
+		const recordCount = parseNonNegativeSafeInteger(row.record_count, "intake record count");
+		const digest = digestHex(row.digest_hex);
+		switch (row.state) {
+			case "receiving": return {
+				state: "receiving",
+				manifest,
+				nextIndex,
+				recordCount,
+				digestHex: digest
+			};
+			case "verified":
+				if (nextIndex !== manifest.chunkCount || recordCount !== manifest.recordCount || digest !== manifest.digestHex) throw new Error("Authorization intake verified state conflicts");
+				return {
+					state: "verified",
+					manifest,
+					nextIndex,
+					recordCount,
+					digestHex: digest
+				};
+			default: throw new Error("Authorization intake state is invalid");
+		}
+	}
+};
+function parseManifest(raw) {
+	const value = requireRecord(raw, "authorization manifest");
+	if (Object.keys(value).length !== 4) throw new Error("Authorization manifest fields conflict");
+	const schemaJson = requireCanonicalString(value.schemaJson, "authorization schema");
+	AuthorizationSnapshotLayout.parse(JSON.parse(schemaJson));
+	return {
+		schemaJson,
+		chunkCount: parseNonNegativeSafeInteger(value.chunkCount, "manifest chunk count"),
+		recordCount: parseNonNegativeSafeInteger(value.recordCount, "manifest record count"),
+		digestHex: digestHex(value.digestHex)
+	};
+}
+function digestHex(raw) {
+	const value = requireCanonicalString(raw, "authorization digest");
+	if (!/^[a-f0-9]{64}$/u.test(value)) throw new Error("Authorization digest is invalid");
+	return value;
+}
+function parseChunk(raw, layouts) {
+	const value = requireRecord(raw, "authorization chunk");
+	if (Object.keys(value).length !== 3) throw new Error("Authorization chunk fields conflict");
+	const chunkJson = requireCanonicalString(value.chunkJson, "authorization chunk JSON");
+	if (new TextEncoder().encode(chunkJson).byteLength > 131072) throw new Error("Authorization chunk exceeds its bound");
+	const payload = requireRecord(JSON.parse(chunkJson), "authorization chunk payload");
+	if (Object.keys(payload).length !== 5) throw new Error("Authorization chunk payload fields conflict");
+	let table = null;
+	for (const layout of layouts) if (layout.table === payload.table) table = layout;
+	if (!table) throw new Error("Authorization chunk table conflicts");
+	const segmentIndex = parseNonNegativeSafeInteger(payload.segmentIndex, "segment index");
+	const segmentCount = parseNonNegativeSafeInteger(payload.segmentCount, "segment count");
+	if (segmentIndex >= segmentCount) throw new Error("Authorization segment index conflicts");
+	const hex = requireCanonicalString(payload.bytesHex, "segment bytes");
+	if (!/^(?:[A-F0-9]{2})+$/u.test(hex) || hex.length > 65536 || segmentIndex + 1 < segmentCount && hex.length !== 65536) throw new Error("Authorization segment size conflicts");
+	return {
+		index: parseNonNegativeSafeInteger(value.index, "chunk index"),
+		chunkJson,
+		digestHex: digestHex(value.digestHex),
+		table,
+		recordKey: requireCanonicalString(payload.recordKey, "record key"),
+		segmentIndex,
+		segmentCount,
+		bytesHex: hex
+	};
+}
+function intakeProgress(state) {
+	switch (state.state) {
+		case "receiving": return {
+			state: "receiving",
+			nextIndex: state.nextIndex,
+			chunkCount: state.manifest.chunkCount
+		};
+		case "verified": return {
+			state: "verified",
+			digestHex: state.digestHex
+		};
+	}
+}
+//#endregion
+export { D1WalletAuthorizationIntake };
+
+//# sourceMappingURL=d1WalletAuthorizationIntake.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorizationSnapshot.js

@@ -0,0 +1,295 @@
+import { requireCanonicalString } from "../../../../shared-ts/src/utils/validation.js";
+import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseNonNegativeSafeInteger } from "../../../../shared-ts/src/device-linking/wireFields.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+import { AuthorizationSnapshotLayout } from "./authorizationSnapshotLayout.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletAuthorizationSnapshot.ts
+const CHUNK_BYTES = 32768;
+const AUTHORIZATION_SNAPSHOT_MAX_BYTES = 524288;
+const AUTHORIZATION_SNAPSHOT_MAX_CHUNKS = 80;
+var D1WalletAuthorizationSnapshot = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	async seal(source) {
+		const state = await this.prepare(source);
+		if (state.state === "sealed") return state.manifest;
+		const layout = AuthorizationSnapshotLayout.parse(JSON.parse(state.schemaJson));
+		const progress = await this.readProgress(source, layout, state.schemaJson);
+		let digestHex = progress.digestHex;
+		let chunkCount = progress.chunkCount;
+		let recordCount = progress.recordCount;
+		for (let tableIndex = progress.tableIndex; tableIndex < layout.length; tableIndex += 1) {
+			const table = layout[tableIndex];
+			let cursor = tableIndex === progress.tableIndex ? progress.cursor : {
+				kind: "after",
+				key: ""
+			};
+			while (true) {
+				const record = await this.nextRecord(source, table, cursor);
+				if (record === null) {
+					if (cursor.kind === "resume") throw new Error("Authorization snapshot partial record disappeared");
+					break;
+				}
+				const segmentCount = Math.ceil(record.byteLength / CHUNK_BYTES);
+				if (cursor.kind === "resume" && cursor.segmentCount !== segmentCount) throw new Error("Authorization snapshot partial record size changed");
+				const firstSegment = cursor.kind === "resume" ? cursor.nextSegment : 0;
+				for (let segmentIndex = firstSegment; segmentIndex < segmentCount; segmentIndex += 1) {
+					const bytesHex = await this.readSegment(source, table, record.key, segmentIndex);
+					const expectedBytes = Math.min(CHUNK_BYTES, record.byteLength - segmentIndex * CHUNK_BYTES);
+					if (!/^[A-F0-9]+$/u.test(bytesHex) || bytesHex.length !== expectedBytes * 2) throw new Error("Authorization snapshot record changed during capture");
+					const chunkJson = JSON.stringify({
+						table: table.table,
+						recordKey: record.key,
+						segmentIndex,
+						segmentCount,
+						bytesHex
+					});
+					digestHex = await sha256HexUtf8(JSON.stringify([
+						digestHex,
+						chunkCount,
+						chunkJson
+					]));
+					const completedRecords = recordCount + (segmentIndex + 1 === segmentCount ? 1 : 0);
+					await this.storeChunk(source, chunkCount, chunkJson, digestHex, completedRecords);
+					chunkCount += 1;
+				}
+				recordCount += 1;
+				cursor = {
+					kind: "after",
+					key: record.key
+				};
+			}
+		}
+		await this.database.batch([prepareD1TenantStatement(this.database, this.scope, `
+        UPDATE wallet_relocation_authorization_snapshots
+        SET state = 'sealed', chunk_count = ?9, record_count = ?10, digest_hex = ?11
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5 AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8`, [
+			source.walletId,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration,
+			chunkCount,
+			recordCount,
+			digestHex
+		]), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)]);
+		const sealed = await this.read(source);
+		if (sealed?.state !== "sealed") throw new Error("Authorization snapshot seal disappeared");
+		return sealed.manifest;
+	}
+	async exportSnapshot(source) {
+		const state = await this.read(source);
+		if (state?.state !== "sealed") throw new Error("Authorization snapshot is not sealed");
+		const result = await prepareD1TenantStatement(this.database, this.scope, `
+      SELECT chunk_index, chunk_json, digest_hex FROM wallet_relocation_authorization_chunks
+      WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+        AND wallet_id = ?5 ORDER BY chunk_index`, [source.walletId]).all();
+		const chunks = [];
+		for (const row of result.results ?? []) chunks.push({
+			index: parseNonNegativeSafeInteger(row.chunk_index, "snapshot chunk index"),
+			chunkJson: requireCanonicalString(row.chunk_json, "snapshot chunk"),
+			digestHex: requireCanonicalString(row.digest_hex, "snapshot chunk digest")
+		});
+		if (chunks.length !== state.manifest.chunkCount || chunks.length > 80 || new TextEncoder().encode(JSON.stringify(chunks)).byteLength > 524288) throw new Error("Authorization snapshot exceeds supported capacity");
+		return chunks;
+	}
+	async assertCapacity(walletId) {
+		const statements = [];
+		for (const layout of await AuthorizationSnapshotLayout.read(this.database)) {
+			const expressions = layout.expressions();
+			statements.push(prepareD1TenantStatement(this.database, this.scope, `
+        SELECT COALESCE(SUM(length(CAST(${expressions.record} AS BLOB))), 0) AS bytes,
+          COALESCE(SUM((length(CAST(${expressions.record} AS BLOB)) + 512 + 32767) / 32768), 0) AS chunks
+        FROM ${layout.table} AS target WHERE ${expressions.ownership}`, [walletId]));
+		}
+		const results = await this.database.batch(statements);
+		let bytes = 0;
+		let chunks = 0;
+		for (const result of results) {
+			const row = result.results[0];
+			if (!row) throw new Error("Authorization capacity observation is absent");
+			bytes += parseNonNegativeSafeInteger(row.bytes, "authorization bytes");
+			chunks += parseNonNegativeSafeInteger(row.chunks, "authorization chunks");
+		}
+		if (chunks > 80 || bytes * 2 + chunks * 2048 > 524288) throw new Error("Authorization snapshot exceeds supported capacity");
+	}
+	async prepare(source) {
+		const existing = await this.read(source);
+		if (existing) return existing;
+		const schemaJson = JSON.stringify(await AuthorizationSnapshotLayout.read(this.database));
+		await this.database.batch([
+			prepareD1TenantStatement(this.database, this.scope, `
+        INSERT INTO wallet_relocation_authorization_snapshots
+          (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex, source_generation, schema_json, state)
+        SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, 'building'
+        WHERE NOT EXISTS (SELECT 1 FROM wallet_relocation_authorization_snapshots
+          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND wallet_id = ?5)`, [
+				source.walletId,
+				source.moveId,
+				source.requestDigestHex,
+				source.sourceGeneration,
+				schemaJson
+			]),
+			prepareD1TenantStatement(this.database, this.scope, `
+        UPDATE wallet_relocation_authorization_snapshots SET schema_json = schema_json
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5 AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8
+          AND schema_json = ?9`, [
+				source.walletId,
+				source.moveId,
+				source.requestDigestHex,
+				source.sourceGeneration,
+				schemaJson
+			]),
+			this.database.prepare(D1_BATCH_CAS_GUARD_SQL)
+		]);
+		const state = await this.read(source);
+		if (!state) throw new Error("Authorization snapshot preparation disappeared");
+		return state;
+	}
+	async read(source) {
+		const row = await prepareD1TenantStatement(this.database, this.scope, `
+      SELECT wallet_id, move_id, request_digest_hex, source_generation, schema_json,
+        state, chunk_count, record_count, digest_hex FROM wallet_relocation_authorization_snapshots
+      WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND wallet_id = ?5`, [source.walletId]).first();
+		if (!row) return null;
+		if (!source.matches(row)) throw new Error("Authorization snapshot identity conflicts");
+		const schemaJson = requireCanonicalString(row.schema_json, "snapshot schema");
+		switch (row.state) {
+			case "building":
+				if (row.chunk_count !== null || row.record_count !== null || row.digest_hex !== null) throw new Error("Authorization snapshot building state conflicts");
+				return {
+					state: "building",
+					schemaJson
+				};
+			case "sealed": return {
+				state: "sealed",
+				schemaJson,
+				manifest: Object.freeze({
+					schemaJson,
+					chunkCount: parseNonNegativeSafeInteger(row.chunk_count, "snapshot chunk count"),
+					recordCount: parseNonNegativeSafeInteger(row.record_count, "snapshot record count"),
+					digestHex: requireCanonicalString(row.digest_hex, "snapshot digest")
+				})
+			};
+			default: throw new Error("Authorization snapshot state is invalid");
+		}
+	}
+	async readProgress(source, layout, schemaJson) {
+		const row = await prepareD1TenantStatement(this.database, this.scope, `
+      SELECT chunk_index, digest_hex,
+        json_extract(chunk_json, '$.table') AS table_name,
+        json_extract(chunk_json, '$.recordKey') AS record_key,
+        json_extract(chunk_json, '$.segmentIndex') AS segment_index,
+        json_extract(chunk_json, '$.segmentCount') AS segment_count, record_count
+      FROM wallet_relocation_authorization_chunks
+      WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND wallet_id = ?5
+      ORDER BY chunk_index DESC LIMIT 1`, [source.walletId]).first();
+		if (!row) return {
+			tableIndex: 0,
+			cursor: {
+				kind: "after",
+				key: ""
+			},
+			chunkCount: 0,
+			recordCount: 0,
+			digestHex: await sha256HexUtf8(JSON.stringify([
+				"seams/wallet-authorization-snapshot/v1",
+				this.scope.namespace,
+				this.scope.orgId,
+				this.scope.projectId,
+				this.scope.envId,
+				source.walletId,
+				source.moveId,
+				source.requestDigestHex,
+				source.sourceGeneration,
+				schemaJson
+			]))
+		};
+		let tableIndex = -1;
+		for (const [index, table] of layout.entries()) if (table.table === row.table_name) tableIndex = index;
+		const segmentIndex = parseNonNegativeSafeInteger(row.segment_index, "snapshot last segment");
+		const segmentCount = parseNonNegativeSafeInteger(row.segment_count, "snapshot segment count");
+		if (tableIndex < 0 || segmentIndex >= segmentCount) throw new Error("Authorization snapshot checkpoint is invalid");
+		const key = requireCanonicalString(row.record_key, "snapshot checkpoint key");
+		const cursor = segmentIndex + 1 === segmentCount ? {
+			kind: "after",
+			key
+		} : {
+			kind: "resume",
+			key,
+			nextSegment: segmentIndex + 1,
+			segmentCount
+		};
+		return {
+			tableIndex,
+			cursor,
+			chunkCount: parseNonNegativeSafeInteger(row.chunk_index, "snapshot last chunk") + 1,
+			recordCount: parseNonNegativeSafeInteger(row.record_count, "snapshot completed records"),
+			digestHex: requireCanonicalString(row.digest_hex, "snapshot checkpoint digest")
+		};
+	}
+	async nextRecord(source, table, cursor) {
+		const sql = table.expressions();
+		const comparison = cursor.kind === "resume" ? "=" : ">";
+		const row = await prepareD1TenantStatement(this.database, this.scope, `
+      SELECT ${sql.key} AS record_key, length(CAST(${sql.record} AS BLOB)) AS byte_length
+      FROM ${table.table} AS target WHERE ${table.snapshotSelection()} AND ${sql.key} ${comparison} ?6
+      ORDER BY record_key COLLATE BINARY LIMIT 1`, [source.walletId, cursor.key]).first();
+		if (!row) return null;
+		const byteLength = parseNonNegativeSafeInteger(row.byte_length, "snapshot record length");
+		if (byteLength === 0) throw new Error("Authorization snapshot record is empty");
+		return {
+			key: requireCanonicalString(row.record_key, "snapshot record key"),
+			byteLength
+		};
+	}
+	async readSegment(source, table, key, segmentIndex) {
+		const sql = table.expressions();
+		const row = await prepareD1TenantStatement(this.database, this.scope, `
+      SELECT hex(substr(CAST(${sql.record} AS BLOB), ?7, ?8)) AS bytes_hex
+      FROM ${table.table} AS target WHERE ${table.snapshotSelection()} AND ${sql.key} = ?6`, [
+			source.walletId,
+			key,
+			segmentIndex * CHUNK_BYTES + 1,
+			CHUNK_BYTES
+		]).first();
+		if (!row) throw new Error("Authorization snapshot record disappeared");
+		return requireCanonicalString(row.bytes_hex, "snapshot bytes");
+	}
+	async storeChunk(source, index, chunkJson, digestHex, recordCount) {
+		await this.database.batch([
+			prepareD1TenantStatement(this.database, this.scope, `
+        INSERT INTO wallet_relocation_authorization_chunks
+          (namespace, org_id, project_id, env_id, wallet_id, chunk_index, chunk_json, digest_hex, record_count)
+        SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9
+        WHERE NOT EXISTS (SELECT 1 FROM wallet_relocation_authorization_chunks
+          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+            AND wallet_id = ?5 AND chunk_index = ?6)`, [
+				source.walletId,
+				index,
+				chunkJson,
+				digestHex,
+				recordCount
+			]),
+			prepareD1TenantStatement(this.database, this.scope, `
+        UPDATE wallet_relocation_authorization_chunks SET digest_hex = digest_hex
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5 AND chunk_index = ?6 AND chunk_json = ?7 AND digest_hex = ?8 AND record_count = ?9`, [
+				source.walletId,
+				index,
+				chunkJson,
+				digestHex,
+				recordCount
+			]),
+			this.database.prepare(D1_BATCH_CAS_GUARD_SQL)
+		]);
+	}
+};
+//#endregion
+export { AUTHORIZATION_SNAPSHOT_MAX_BYTES, AUTHORIZATION_SNAPSHOT_MAX_CHUNKS, D1WalletAuthorizationSnapshot };
+
+//# sourceMappingURL=d1WalletAuthorizationSnapshot.js.map