@seams/wallet-server 0.5.0

package/migrations/d1-signer/0022_r109c_multi_auth_email_cardinality.sql

@@ -0,0 +1,118 @@
+-- Refactor 109C: give Email OTP auth methods their canonical provider identity
+-- and enforce one active Email method per authority.
+--
+-- R103E's V2 Email branch stores `email_hash_hex` and a
+-- `registration_authority_id` — the OTP challenge that happened to create the
+-- method. That is provenance, not identity: `EmailOtpWalletAuthAuthority`
+-- needs `provider` and `providerUserId`, and R103E worked around their absence
+-- by inferring the subject from an installation's own Ed25519 lanes and
+-- requiring exactly one such subject per wallet. That inference cannot survive
+-- a wallet with more than one Email method, which is precisely what R109C and
+-- R109D create.
+--
+-- Forward-only. Migrations 0011 and 0012 are applied and are not rewritten;
+-- 0011 dropped the wallet-wide Email uniqueness index deliberately, so linked
+-- devices could share one verified address, and this migration replaces it
+-- with the per-authority constraint rather than restoring it.
+
+-- The provider identity, joined from the wallet's canonical enrollment.
+ALTER TABLE wallet_auth_methods ADD COLUMN provider TEXT;
+ALTER TABLE wallet_auth_methods ADD COLUMN provider_user_id TEXT;
+
+UPDATE wallet_auth_methods
+   SET provider_user_id = (
+         SELECT enrollment.provider_user_id
+           FROM email_otp_wallet_enrollments AS enrollment
+          WHERE enrollment.namespace = wallet_auth_methods.namespace
+            AND enrollment.org_id = wallet_auth_methods.org_id
+            AND enrollment.project_id = wallet_auth_methods.project_id
+            AND enrollment.env_id = wallet_auth_methods.env_id
+            AND enrollment.wallet_id = wallet_auth_methods.wallet_id
+       )
+ WHERE kind = 'email_otp';
+
+-- The current rule, stated once: a `google:` subject is Google, anything else
+-- is a plain verified address.
+UPDATE wallet_auth_methods
+   SET provider = CASE
+         WHEN provider_user_id LIKE 'google:%' THEN 'google'
+         ELSE 'email'
+       END
+ WHERE kind = 'email_otp'
+   AND provider_user_id IS NOT NULL;
+
+-- Revoked history that cannot resolve an enrollment is dropped: it is audit
+-- residue for a method nothing can authenticate, and keeping it would force a
+-- nullable provider identity on the live shape.
+DELETE FROM wallet_auth_methods
+ WHERE kind = 'email_otp'
+   AND status = 'revoked'
+   AND provider_user_id IS NULL;
+
+-- An active or pending Email method that cannot resolve its enrollment is a
+-- different matter: it is a method a user can still authenticate with, whose
+-- identity this schema can no longer express. Abort rather than guess.
+CREATE TABLE r109c_email_identity_backfill_guard (
+  guard_id INTEGER PRIMARY KEY CHECK (guard_id = 1)
+);
+INSERT INTO r109c_email_identity_backfill_guard (guard_id) VALUES (1);
+INSERT INTO r109c_email_identity_backfill_guard (guard_id)
+SELECT 1
+ WHERE EXISTS (
+   SELECT 1
+     FROM wallet_auth_methods
+    WHERE kind = 'email_otp'
+      AND status <> 'revoked'
+      AND provider_user_id IS NULL
+ );
+DROP TABLE r109c_email_identity_backfill_guard;
+
+-- Fold the provider identity into the canonical record.
+--
+-- `registration_authority_id` is deliberately NOT cleared here. The table's
+-- CHECK constraints require it non-null for an Email row and require
+-- `record_json.$.registrationAuthorityId` to equal it, so nulling either would
+-- fail the constraint on exactly the wallets this migration exists for — a
+-- fresh database has no Email rows, which is what would have hidden it. Dropping
+-- the column needs a table rebuild, and that is a separate decision from
+-- establishing provider identity; until then the column is vestigial and no
+-- reader consults it.
+UPDATE wallet_auth_methods
+   SET record_json = json_set(
+         json_set(record_json, '$.provider', provider),
+         '$.providerUserId',
+         provider_user_id
+       )
+ WHERE kind = 'email_otp';
+
+-- R109C cardinality: one active Email OTP method per authority, across
+-- providers. Passkeys are deliberately excluded — an authority may hold
+-- several, and their uniqueness is credential-scoped by
+-- wallet_auth_methods_v2_passkey_uidx.
+CREATE UNIQUE INDEX wallet_auth_methods_v2_authority_email_uidx
+  ON wallet_auth_methods (
+    namespace, org_id, project_id, env_id, wallet_id, wallet_authority_id
+  )
+  WHERE kind = 'email_otp' AND status = 'active';
+
+CREATE INDEX wallet_auth_methods_v2_email_provider_idx
+  ON wallet_auth_methods (
+    namespace, org_id, project_id, env_id, provider, provider_user_id
+  )
+  WHERE kind = 'email_otp' AND provider_user_id IS NOT NULL;
+
+-- Existing custody envelopes predate ownership. They are marked `unbound`, not
+-- upgraded: their ciphertext and AAD were sealed without a method, so calling
+-- them V3 here would make every one of them fail verification. Only a
+-- successful open followed by a reseal can produce V3 ciphertext, and that
+-- happens where the factor secret is — never in a migration.
+--
+-- This adds no ownership *claim*. The owner is resolved at open time from live
+-- records (a Passkey factor names its credential; an Email factor is resolvable
+-- only when exactly one active or pending method references its enrollment), so
+-- a row cannot carry a stale or fabricated binding written months earlier.
+UPDATE router_ab_yao_versioned_json_records
+   SET record_json = json_set(record_json, '$.ownership', json_object('kind', 'unbound'))
+ WHERE record_key LIKE 'passkey-envelope:%'
+   AND json_extract(record_json, '$.kind') = 'wallet_custody_envelope_v2'
+   AND json_extract(record_json, '$.ownership') IS NULL;

package/migrations/d1-signer/0023_r109d_first_email_linked_device.sql

@@ -0,0 +1,111 @@
+-- Refactor 109D: a linked Email OTP target may establish the wallet's first
+-- Email enrollment. The old grant shape required a base Email method and
+-- cannot represent that branch, so in-flight grants are discarded at the
+-- persistence boundary and the table is recreated with an explicit branch.
+
+DROP INDEX IF EXISTS linked_device_email_otp_grants_session_idx;
+DROP INDEX IF EXISTS linked_device_email_otp_grants_expiry_idx;
+DROP TABLE IF EXISTS linked_device_email_otp_grants;
+
+CREATE TABLE linked_device_email_otp_grants (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  grant_id TEXT NOT NULL,
+  grant_token_digest_b64u TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  link_session_id TEXT NOT NULL,
+  enrollment_id TEXT NOT NULL,
+  device_id TEXT NOT NULL,
+  target_factor TEXT NOT NULL,
+  target_preparation_digest_b64u TEXT NOT NULL,
+  target_email TEXT NOT NULL,
+  enrollment_kind TEXT NOT NULL,
+  email_hash_hex TEXT NOT NULL,
+  registration_authority_id TEXT NOT NULL,
+  provider_user_id TEXT NOT NULL,
+  base_wallet_auth_method_id TEXT,
+  linked_owner_auth_method_id TEXT NOT NULL,
+  authority_digest_b64u TEXT NOT NULL,
+  challenge_id TEXT NOT NULL,
+  state TEXT NOT NULL,
+  record_json TEXT NOT NULL,
+  issued_at_ms INTEGER NOT NULL,
+  expires_at_ms INTEGER NOT NULL,
+  consumed_at_ms INTEGER,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, grant_id),
+  FOREIGN KEY (namespace, org_id, project_id, env_id, link_session_id)
+    REFERENCES linked_device_sessions(namespace, org_id, project_id, env_id, link_session_id),
+  FOREIGN KEY (namespace, org_id, project_id, env_id, base_wallet_auth_method_id)
+    REFERENCES wallet_auth_methods(namespace, org_id, project_id, env_id, wallet_auth_method_id),
+  CHECK (length(namespace) > 0),
+  CHECK (length(org_id) > 0),
+  CHECK (length(project_id) > 0),
+  CHECK (length(env_id) > 0),
+  CHECK (length(grant_id) > 0),
+  CHECK (length(grant_token_digest_b64u) > 0),
+  CHECK (length(wallet_id) > 0),
+  CHECK (length(link_session_id) > 0),
+  CHECK (length(enrollment_id) > 0),
+  CHECK (length(device_id) > 0),
+  CHECK (target_factor = 'email_otp'),
+  CHECK (length(target_preparation_digest_b64u) > 0),
+  CHECK (length(target_email) > 0),
+  CHECK (enrollment_kind IN ('existing_enrollment', 'new_enrollment')),
+  CHECK (length(email_hash_hex) > 0),
+  CHECK (length(registration_authority_id) > 0),
+  CHECK (length(provider_user_id) > 0),
+  CHECK (enrollment_kind = 'new_enrollment' OR length(base_wallet_auth_method_id) > 0),
+  CHECK (enrollment_kind = 'new_enrollment' OR base_wallet_auth_method_id IS NOT NULL),
+  CHECK (enrollment_kind = 'existing_enrollment' OR base_wallet_auth_method_id IS NULL),
+  CHECK (length(linked_owner_auth_method_id) > 0),
+  CHECK (length(authority_digest_b64u) > 0),
+  CHECK (length(challenge_id) > 0),
+  CHECK (state IN ('issued', 'consumed')),
+  CHECK (json_valid(record_json)),
+  CHECK (issued_at_ms > 0),
+  CHECK (expires_at_ms > issued_at_ms),
+  CHECK (
+    (state = 'issued' AND consumed_at_ms IS NULL)
+    OR (state = 'consumed' AND consumed_at_ms >= issued_at_ms)
+  ),
+  CHECK (COALESCE(json_extract(record_json, '$.kind') = 'linked_device_email_otp_grant_record_v1', 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.grantId') = grant_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.grantTokenDigestB64u') = grant_token_digest_b64u, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.linkSessionId') = link_session_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.enrollmentId') = enrollment_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.deviceId') = device_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.targetFactor.kind') = target_factor, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.targetPreparationDigestB64u') = target_preparation_digest_b64u, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.targetEmail') = target_email, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.enrollment.kind') = enrollment_kind, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.emailHashHex') = email_hash_hex, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.registrationAuthorityId') = registration_authority_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.providerUserId') = provider_user_id, 0)),
+  CHECK (
+    (enrollment_kind = 'existing_enrollment'
+      AND COALESCE(json_extract(record_json, '$.baseWalletAuthMethodId') = base_wallet_auth_method_id, 0))
+    OR
+    (enrollment_kind = 'new_enrollment'
+      AND json_type(record_json, '$.baseWalletAuthMethodId') IS NULL)
+  ),
+  CHECK (COALESCE(json_extract(record_json, '$.linkedOwnerAuthMethodId') = linked_owner_auth_method_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.authorityDigestB64u') = authority_digest_b64u, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.challengeId') = challenge_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.state.kind') = state, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.issuedAtMs') = issued_at_ms, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.expiresAtMs') = expires_at_ms, 0)),
+  CHECK (
+    consumed_at_ms IS NULL
+    OR COALESCE(json_extract(record_json, '$.state.consumedAtMs') = consumed_at_ms, 0)
+  )
+);
+
+CREATE INDEX linked_device_email_otp_grants_session_idx
+  ON linked_device_email_otp_grants (
+    namespace, org_id, project_id, env_id, link_session_id, state, expires_at_ms
+  );
+CREATE INDEX linked_device_email_otp_grants_expiry_idx
+  ON linked_device_email_otp_grants (namespace, org_id, project_id, env_id, expires_at_ms);

package/migrations/d1-signer/0024_r103f_v2_authorized_operation_claim.sql

@@ -0,0 +1,99 @@
+-- R103F forwards authorized-operation owner claims to the exact Wallet Session
+-- authorization V2 record and its live authority/auth-method provenance.
+
+DROP TRIGGER IF EXISTS authorized_operation_owner_grant_claim_atomic;
+
+CREATE TRIGGER authorized_operation_owner_grant_claim_atomic
+AFTER INSERT ON authorized_operations
+WHEN NEW.lifecycle_kind = 'claimed'
+  AND NEW.authorization_source_kind = 'authorization_grant'
+  AND NEW.authorization_grant_kind = 'wallet_session_authorization'
+BEGIN
+  SELECT CASE
+    WHEN NOT EXISTS (
+        SELECT 1
+          FROM wallet_session_authorizations_v2 AS session
+          JOIN wallet_authorities AS authority
+            ON authority.namespace = session.namespace
+           AND authority.org_id = session.org_id
+           AND authority.project_id = session.project_id
+           AND authority.env_id = session.env_id
+           AND authority.authority_id = session.authority_id
+           AND authority.wallet_id = session.wallet_id
+          JOIN wallet_auth_methods AS auth_method
+            ON auth_method.namespace = session.namespace
+           AND auth_method.org_id = session.org_id
+           AND auth_method.project_id = session.project_id
+           AND auth_method.env_id = session.env_id
+           AND auth_method.wallet_auth_method_id = session.wallet_auth_method_id
+           AND auth_method.wallet_id = session.wallet_id
+           AND auth_method.wallet_authority_id = session.authority_id
+         WHERE session.namespace = NEW.namespace
+           AND session.org_id = NEW.linked_scope_org_id
+           AND session.project_id = NEW.linked_scope_project_id
+           AND session.env_id = NEW.linked_scope_env_id
+           AND session.tenant_id = NEW.tenant_id
+           AND session.authorization_id = NEW.authorization_id
+           AND session.principal_id = NEW.principal_id
+           AND (NEW.quota_kind = 'quota_neutral' OR session.quota_id = NEW.quota_id)
+           AND session.retired_at_ms IS NULL
+           AND session.expires_at_ms > NEW.claimed_at_ms
+           AND authority.lifecycle_state = 'active'
+           AND authority.authority_digest_b64u = session.authority_digest_b64u
+           AND authority.revocation_epoch = session.authority_revocation_epoch
+           AND auth_method.status = 'active'
+      )
+    THEN RAISE(ABORT, 'authorization_wallet_session_rejected')
+  END;
+
+  UPDATE authorization_wallet_session_quotas
+     SET remaining_uses = remaining_uses - 1,
+         lifecycle_kind = CASE WHEN remaining_uses = 1 THEN 'exhausted' ELSE 'active' END
+   WHERE NEW.quota_kind = 'consume_reusable_wallet_session'
+     AND namespace = NEW.namespace
+     AND tenant_id = NEW.tenant_id
+     AND quota_id = NEW.quota_id
+     AND principal_id = NEW.principal_id
+     AND lifecycle_kind = 'active'
+     AND remaining_uses > 0
+     AND expires_at_ms > NEW.claimed_at_ms
+     AND wallet_session_id = (
+       SELECT session.wallet_session_id
+         FROM wallet_session_authorizations_v2 AS session
+         JOIN wallet_authorities AS authority
+           ON authority.namespace = session.namespace
+          AND authority.org_id = session.org_id
+          AND authority.project_id = session.project_id
+          AND authority.env_id = session.env_id
+          AND authority.authority_id = session.authority_id
+          AND authority.wallet_id = session.wallet_id
+         JOIN wallet_auth_methods AS auth_method
+           ON auth_method.namespace = session.namespace
+          AND auth_method.org_id = session.org_id
+          AND auth_method.project_id = session.project_id
+          AND auth_method.env_id = session.env_id
+          AND auth_method.wallet_auth_method_id = session.wallet_auth_method_id
+          AND auth_method.wallet_id = session.wallet_id
+          AND auth_method.wallet_authority_id = session.authority_id
+        WHERE session.namespace = NEW.namespace
+          AND session.org_id = NEW.linked_scope_org_id
+          AND session.project_id = NEW.linked_scope_project_id
+          AND session.env_id = NEW.linked_scope_env_id
+          AND session.tenant_id = NEW.tenant_id
+          AND session.authorization_id = NEW.authorization_id
+          AND session.principal_id = NEW.principal_id
+          AND session.quota_id = NEW.quota_id
+          AND session.retired_at_ms IS NULL
+          AND session.expires_at_ms > NEW.claimed_at_ms
+          AND authority.lifecycle_state = 'active'
+          AND authority.authority_digest_b64u = session.authority_digest_b64u
+          AND authority.revocation_epoch = session.authority_revocation_epoch
+          AND auth_method.status = 'active'
+        LIMIT 1
+     );
+
+  SELECT CASE
+    WHEN NEW.quota_kind = 'consume_reusable_wallet_session' AND changes() != 1
+    THEN RAISE(ABORT, 'authorization_wallet_session_quota_rejected')
+  END;
+END;

package/migrations/d1-signer/0025_r109d_email_enrollment_wallet_cardinality.sql

@@ -0,0 +1,57 @@
+-- Refactor 109D: the same verified Email identity may authenticate methods on
+-- multiple wallets. Custody enrollment material remains isolated per wallet.
+
+DROP INDEX IF EXISTS email_otp_wallet_enrollments_provider_idx;
+
+CREATE TABLE email_otp_wallet_enrollments_v2 (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  provider_user_id TEXT NOT NULL,
+  record_org_id TEXT NOT NULL,
+  verified_email TEXT NOT NULL,
+  record_json TEXT NOT NULL,
+  created_at_ms INTEGER NOT NULL,
+  updated_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id),
+  CHECK (length(namespace) > 0),
+  CHECK (length(org_id) > 0),
+  CHECK (length(project_id) > 0),
+  CHECK (length(env_id) > 0),
+  CHECK (length(wallet_id) > 0),
+  CHECK (length(provider_user_id) > 0),
+  CHECK (length(record_org_id) > 0),
+  CHECK (length(verified_email) > 0),
+  CHECK (json_valid(record_json)),
+  CHECK (created_at_ms > 0),
+  CHECK (updated_at_ms >= created_at_ms),
+  CHECK (
+    COALESCE(json_extract(record_json, '$.version') = 'email_otp_wallet_enrollment_v1', 0)
+  ),
+  CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.providerUserId') = provider_user_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.orgId') = record_org_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.verifiedEmail') = verified_email, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.createdAtMs') = created_at_ms, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.updatedAtMs') = updated_at_ms, 0))
+);
+
+INSERT INTO email_otp_wallet_enrollments_v2 (
+  namespace, org_id, project_id, env_id, wallet_id, provider_user_id,
+  record_org_id, verified_email, record_json, created_at_ms, updated_at_ms
+)
+SELECT
+  namespace, org_id, project_id, env_id, wallet_id, provider_user_id,
+  record_org_id, verified_email, record_json, created_at_ms, updated_at_ms
+FROM email_otp_wallet_enrollments;
+
+DROP TABLE email_otp_wallet_enrollments;
+ALTER TABLE email_otp_wallet_enrollments_v2 RENAME TO email_otp_wallet_enrollments;
+
+CREATE INDEX email_otp_wallet_enrollments_provider_idx
+  ON email_otp_wallet_enrollments (
+    namespace, org_id, project_id, env_id, record_org_id,
+    provider_user_id, updated_at_ms
+  );

package/migrations/d1-signer/0026_r115_wallet_recovery_authority_provenance.sql

@@ -0,0 +1,253 @@
+-- Refactor 115: admit authorities created by wallet recovery.
+--
+-- SQLite cannot alter the provenance CHECK constraint. Rebuild the authority
+-- table while preserving every existing registration and device-link row.
+
+PRAGMA defer_foreign_keys = ON;
+
+DROP TRIGGER IF EXISTS authorized_operation_owner_grant_claim_atomic;
+
+DROP INDEX IF EXISTS wallet_authorities_active_device_uidx;
+DROP INDEX IF EXISTS wallet_authorities_enrollment_uidx;
+DROP INDEX IF EXISTS wallet_authorities_inventory_idx;
+DROP INDEX IF EXISTS wallet_authorities_wallet_identity_uidx;
+
+CREATE TABLE wallet_authorities_next (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  authority_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  device_id TEXT NOT NULL,
+  provenance_kind TEXT NOT NULL,
+  enrollment_id TEXT,
+  source_authority_id TEXT,
+  link_session_id TEXT,
+  recovery_operation_id TEXT,
+  continuity_authority_id TEXT,
+  lifecycle_state TEXT NOT NULL,
+  permissions_json TEXT NOT NULL,
+  signer_activations_json TEXT NOT NULL,
+  local_install_package_set_digest_b64u TEXT,
+  signer_activation_set_digest_b64u TEXT NOT NULL,
+  authority_digest_b64u TEXT NOT NULL,
+  revocation_epoch INTEGER NOT NULL,
+  record_json TEXT NOT NULL,
+  created_at_ms INTEGER NOT NULL,
+  updated_at_ms INTEGER NOT NULL,
+  activated_at_ms INTEGER,
+  revoked_at_ms INTEGER,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, authority_id),
+  CHECK (length(authority_id) > 0),
+  CHECK (length(wallet_id) > 0),
+  CHECK (length(device_id) > 0),
+  CHECK (provenance_kind IN ('wallet_registration', 'device_link', 'wallet_recovery')),
+  CHECK (lifecycle_state IN ('pending_local_install', 'active', 'revoked')),
+  CHECK (length(permissions_json) > 0 AND json_valid(permissions_json)),
+  CHECK (length(signer_activations_json) > 0 AND json_valid(signer_activations_json)),
+  CHECK (length(record_json) > 0 AND json_valid(record_json)),
+  CHECK (length(signer_activation_set_digest_b64u) > 0),
+  CHECK (length(authority_digest_b64u) > 0),
+  CHECK (revocation_epoch >= 0),
+  CHECK (created_at_ms >= 0),
+  CHECK (updated_at_ms >= created_at_ms),
+  CHECK (
+    (provenance_kind = 'wallet_registration'
+      AND enrollment_id IS NULL
+      AND source_authority_id IS NULL
+      AND link_session_id IS NULL
+      AND recovery_operation_id IS NULL
+      AND continuity_authority_id IS NULL)
+    OR
+    (provenance_kind = 'device_link'
+      AND enrollment_id IS NOT NULL AND length(enrollment_id) > 0
+      AND source_authority_id IS NOT NULL AND length(source_authority_id) > 0
+      AND link_session_id IS NOT NULL AND length(link_session_id) > 0
+      AND recovery_operation_id IS NULL
+      AND continuity_authority_id IS NULL)
+    OR
+    (provenance_kind = 'wallet_recovery'
+      AND enrollment_id IS NULL
+      AND source_authority_id IS NULL
+      AND link_session_id IS NULL
+      AND recovery_operation_id IS NOT NULL
+      AND length(recovery_operation_id) > 0
+      AND continuity_authority_id IS NOT NULL
+      AND length(continuity_authority_id) > 0)
+  ),
+  CHECK (
+    (lifecycle_state = 'pending_local_install'
+      AND local_install_package_set_digest_b64u IS NOT NULL
+      AND length(local_install_package_set_digest_b64u) > 0
+      AND activated_at_ms IS NULL
+      AND revoked_at_ms IS NULL
+      AND revocation_epoch = 0)
+    OR
+    (lifecycle_state = 'active'
+      AND local_install_package_set_digest_b64u IS NULL
+      AND activated_at_ms IS NOT NULL
+      AND revoked_at_ms IS NULL)
+    OR
+    (lifecycle_state = 'revoked'
+      AND local_install_package_set_digest_b64u IS NULL
+      AND activated_at_ms IS NOT NULL
+      AND revoked_at_ms IS NOT NULL
+      AND revocation_epoch >= 1)
+  ),
+  CHECK (json_extract(record_json, '$.authorityId') = authority_id),
+  CHECK (json_extract(record_json, '$.walletId') = wallet_id),
+  CHECK (json_extract(record_json, '$.state') = lifecycle_state),
+  CHECK (json_extract(record_json, '$.revocationEpoch') = revocation_epoch),
+  CHECK (json_extract(record_json, '$.authorityDigestB64u') = authority_digest_b64u),
+  CHECK (
+    json_extract(record_json, '$.signerActivationSetDigestB64u')
+      = signer_activation_set_digest_b64u
+  )
+);
+
+INSERT INTO wallet_authorities_next (
+  namespace, org_id, project_id, env_id,
+  authority_id, wallet_id, device_id, provenance_kind,
+  enrollment_id, source_authority_id, link_session_id,
+  recovery_operation_id, continuity_authority_id,
+  lifecycle_state, permissions_json, signer_activations_json,
+  local_install_package_set_digest_b64u,
+  signer_activation_set_digest_b64u, authority_digest_b64u,
+  revocation_epoch, record_json, created_at_ms, updated_at_ms,
+  activated_at_ms, revoked_at_ms
+)
+SELECT
+  namespace, org_id, project_id, env_id,
+  authority_id, wallet_id, device_id, provenance_kind,
+  enrollment_id, source_authority_id, link_session_id,
+  NULL, NULL,
+  lifecycle_state, permissions_json, signer_activations_json,
+  local_install_package_set_digest_b64u,
+  signer_activation_set_digest_b64u, authority_digest_b64u,
+  revocation_epoch, record_json, created_at_ms, updated_at_ms,
+  activated_at_ms, revoked_at_ms
+FROM wallet_authorities;
+
+DROP TABLE wallet_authorities;
+ALTER TABLE wallet_authorities_next RENAME TO wallet_authorities;
+
+CREATE UNIQUE INDEX wallet_authorities_active_device_uidx
+  ON wallet_authorities (
+    namespace, org_id, project_id, env_id, wallet_id, device_id
+  )
+  WHERE lifecycle_state <> 'revoked';
+
+CREATE UNIQUE INDEX wallet_authorities_enrollment_uidx
+  ON wallet_authorities (
+    namespace, org_id, project_id, env_id, wallet_id, enrollment_id
+  )
+  WHERE enrollment_id IS NOT NULL;
+
+CREATE INDEX wallet_authorities_inventory_idx
+  ON wallet_authorities (
+    namespace, org_id, project_id, env_id, wallet_id, lifecycle_state,
+    updated_at_ms, authority_id
+  );
+
+CREATE UNIQUE INDEX wallet_authorities_wallet_identity_uidx
+  ON wallet_authorities (
+    namespace, org_id, project_id, env_id, authority_id, wallet_id
+  );
+
+CREATE TRIGGER authorized_operation_owner_grant_claim_atomic
+AFTER INSERT ON authorized_operations
+WHEN NEW.lifecycle_kind = 'claimed'
+  AND NEW.authorization_source_kind = 'authorization_grant'
+  AND NEW.authorization_grant_kind = 'wallet_session_authorization'
+BEGIN
+  SELECT CASE
+    WHEN NOT EXISTS (
+        SELECT 1
+          FROM wallet_session_authorizations_v2 AS session
+          JOIN wallet_authorities AS authority
+            ON authority.namespace = session.namespace
+           AND authority.org_id = session.org_id
+           AND authority.project_id = session.project_id
+           AND authority.env_id = session.env_id
+           AND authority.authority_id = session.authority_id
+           AND authority.wallet_id = session.wallet_id
+          JOIN wallet_auth_methods AS auth_method
+            ON auth_method.namespace = session.namespace
+           AND auth_method.org_id = session.org_id
+           AND auth_method.project_id = session.project_id
+           AND auth_method.env_id = session.env_id
+           AND auth_method.wallet_auth_method_id = session.wallet_auth_method_id
+           AND auth_method.wallet_id = session.wallet_id
+           AND auth_method.wallet_authority_id = session.authority_id
+         WHERE session.namespace = NEW.namespace
+           AND session.org_id = NEW.linked_scope_org_id
+           AND session.project_id = NEW.linked_scope_project_id
+           AND session.env_id = NEW.linked_scope_env_id
+           AND session.tenant_id = NEW.tenant_id
+           AND session.authorization_id = NEW.authorization_id
+           AND session.principal_id = NEW.principal_id
+           AND (NEW.quota_kind = 'quota_neutral' OR session.quota_id = NEW.quota_id)
+           AND session.retired_at_ms IS NULL
+           AND session.expires_at_ms > NEW.claimed_at_ms
+           AND authority.lifecycle_state = 'active'
+           AND authority.authority_digest_b64u = session.authority_digest_b64u
+           AND authority.revocation_epoch = session.authority_revocation_epoch
+           AND auth_method.status = 'active'
+      )
+    THEN RAISE(ABORT, 'authorization_wallet_session_rejected')
+  END;
+
+  UPDATE authorization_wallet_session_quotas
+     SET remaining_uses = remaining_uses - 1,
+         lifecycle_kind = CASE WHEN remaining_uses = 1 THEN 'exhausted' ELSE 'active' END
+   WHERE NEW.quota_kind = 'consume_reusable_wallet_session'
+     AND namespace = NEW.namespace
+     AND tenant_id = NEW.tenant_id
+     AND quota_id = NEW.quota_id
+     AND principal_id = NEW.principal_id
+     AND lifecycle_kind = 'active'
+     AND remaining_uses > 0
+     AND expires_at_ms > NEW.claimed_at_ms
+     AND wallet_session_id = (
+       SELECT session.wallet_session_id
+         FROM wallet_session_authorizations_v2 AS session
+         JOIN wallet_authorities AS authority
+           ON authority.namespace = session.namespace
+          AND authority.org_id = session.org_id
+          AND authority.project_id = session.project_id
+          AND authority.env_id = session.env_id
+          AND authority.authority_id = session.authority_id
+          AND authority.wallet_id = session.wallet_id
+         JOIN wallet_auth_methods AS auth_method
+           ON auth_method.namespace = session.namespace
+          AND auth_method.org_id = session.org_id
+          AND auth_method.project_id = session.project_id
+          AND auth_method.env_id = session.env_id
+          AND auth_method.wallet_auth_method_id = session.wallet_auth_method_id
+          AND auth_method.wallet_id = session.wallet_id
+          AND auth_method.wallet_authority_id = session.authority_id
+        WHERE session.namespace = NEW.namespace
+          AND session.org_id = NEW.linked_scope_org_id
+          AND session.project_id = NEW.linked_scope_project_id
+          AND session.env_id = NEW.linked_scope_env_id
+          AND session.tenant_id = NEW.tenant_id
+          AND session.authorization_id = NEW.authorization_id
+          AND session.principal_id = NEW.principal_id
+          AND session.quota_id = NEW.quota_id
+          AND session.retired_at_ms IS NULL
+          AND session.expires_at_ms > NEW.claimed_at_ms
+          AND authority.lifecycle_state = 'active'
+          AND authority.authority_digest_b64u = session.authority_digest_b64u
+          AND authority.revocation_epoch = session.authority_revocation_epoch
+          AND auth_method.status = 'active'
+        LIMIT 1
+     );
+
+  SELECT CASE
+    WHEN NEW.quota_kind = 'consume_reusable_wallet_session' AND changes() != 1
+    THEN RAISE(ABORT, 'authorization_wallet_session_quota_rejected')
+  END;
+END;
+
+PRAGMA defer_foreign_keys = OFF;