@seams/wallet-server 0.5.0

package/cloudflare-router-ab/migrations/deriver-a/0006_tenant_root_restore_import_keys.sql

@@ -0,0 +1,119 @@
+CREATE TABLE tenant_root_restore_import_sessions (
+    tenant_identity_digest_hex TEXT NOT NULL CHECK (
+        length(tenant_identity_digest_hex) = 64
+        AND tenant_identity_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    custody_lineage_b64u TEXT NOT NULL CHECK (length(custody_lineage_b64u) = 22),
+    restore_session_id_hex TEXT NOT NULL CHECK (
+        length(restore_session_id_hex) = 32
+        AND restore_session_id_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    closed_at_ms INTEGER NOT NULL CHECK (closed_at_ms > 0),
+    PRIMARY KEY (
+        tenant_identity_digest_hex,
+        custody_lineage_b64u,
+        restore_session_id_hex
+    )
+);
+
+CREATE TABLE tenant_root_restore_import_keys (
+    tenant_identity_digest_hex TEXT NOT NULL CHECK (
+        length(tenant_identity_digest_hex) = 64
+        AND tenant_identity_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    custody_lineage_b64u TEXT NOT NULL CHECK (length(custody_lineage_b64u) = 22),
+    restore_session_id_hex TEXT NOT NULL CHECK (
+        length(restore_session_id_hex) = 32
+        AND restore_session_id_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    role TEXT NOT NULL CHECK (role = 'deriver_a'),
+    generation INTEGER NOT NULL CHECK (generation > 0),
+    import_key_id TEXT NOT NULL CHECK (length(import_key_id) > 0),
+    replay_key_digest_hex TEXT NOT NULL CHECK (
+        length(replay_key_digest_hex) = 64
+        AND replay_key_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    command_digest_hex TEXT NOT NULL CHECK (
+        length(command_digest_hex) = 64
+        AND command_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    operation_digest_hex TEXT NOT NULL CHECK (
+        length(operation_digest_hex) = 64
+        AND operation_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    recovery_set_id_b64u TEXT NOT NULL CHECK (length(recovery_set_id_b64u) = 22),
+    manifest_digest_hex TEXT NOT NULL CHECK (
+        length(manifest_digest_hex) = 64
+        AND manifest_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    stable_root_commitment_b64u TEXT NOT NULL CHECK (length(stable_root_commitment_b64u) > 0),
+    share_commitment_b64u TEXT NOT NULL CHECK (length(share_commitment_b64u) = 46),
+    destination_fingerprint_hex TEXT NOT NULL CHECK (
+        length(destination_fingerprint_hex) = 64
+        AND destination_fingerprint_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    public_key_b64u TEXT NOT NULL CHECK (length(public_key_b64u) > 0),
+    encrypted_ikm_json TEXT CHECK (
+        encrypted_ikm_json IS NULL OR json_valid(encrypted_ikm_json)
+    ),
+    envelope_digest_hex TEXT CHECK (
+        envelope_digest_hex IS NULL OR (
+            length(envelope_digest_hex) = 64
+            AND envelope_digest_hex NOT GLOB '*[^0-9a-f]*'
+        )
+    ),
+    encrypted_imported_share_json TEXT CHECK (
+        encrypted_imported_share_json IS NULL OR json_valid(encrypted_imported_share_json)
+    ),
+    issued_at_ms INTEGER NOT NULL CHECK (issued_at_ms > 0),
+    expires_at_ms INTEGER NOT NULL CHECK (expires_at_ms > issued_at_ms),
+    lifecycle TEXT NOT NULL CHECK (
+        lifecycle IN ('issued', 'superseded', 'installed', 'expired', 'closed')
+    ),
+    installed_at_ms INTEGER,
+    receipt_digest_hex TEXT CHECK (
+        receipt_digest_hex IS NULL OR (
+            length(receipt_digest_hex) = 64
+            AND receipt_digest_hex NOT GLOB '*[^0-9a-f]*'
+        )
+    ),
+    created_at_ms INTEGER NOT NULL CHECK (created_at_ms > 0),
+    updated_at_ms INTEGER NOT NULL CHECK (updated_at_ms >= created_at_ms),
+    PRIMARY KEY (
+        tenant_identity_digest_hex,
+        custody_lineage_b64u,
+        restore_session_id_hex,
+        role,
+        generation
+    ),
+    UNIQUE (replay_key_digest_hex),
+    UNIQUE (
+        tenant_identity_digest_hex,
+        custody_lineage_b64u,
+        restore_session_id_hex,
+        role,
+        import_key_id
+    ),
+    CHECK (
+        (lifecycle IN ('issued', 'superseded', 'expired', 'closed')
+            AND installed_at_ms IS NULL AND receipt_digest_hex IS NULL
+            AND envelope_digest_hex IS NULL AND encrypted_imported_share_json IS NULL
+            AND (lifecycle = 'closed') = (encrypted_ikm_json IS NULL))
+        OR (lifecycle = 'installed'
+            AND installed_at_ms IS NOT NULL
+            AND installed_at_ms >= issued_at_ms
+            AND receipt_digest_hex IS NOT NULL
+            AND envelope_digest_hex IS NOT NULL
+            AND encrypted_imported_share_json IS NOT NULL
+            AND encrypted_ikm_json IS NOT NULL)
+    )
+);
+
+CREATE INDEX tenant_root_restore_import_keys_current
+    ON tenant_root_restore_import_keys (
+        tenant_identity_digest_hex,
+        custody_lineage_b64u,
+        restore_session_id_hex,
+        role,
+        generation DESC
+    );

package/cloudflare-router-ab/migrations/deriver-a/0007_tenant_root_restore_refresh_attempts.sql

@@ -0,0 +1,103 @@
+CREATE TABLE tenant_root_restore_refresh_attempts (
+    tenant_identity_digest_hex TEXT NOT NULL CHECK (
+        length(tenant_identity_digest_hex) = 64
+        AND tenant_identity_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    custody_lineage_b64u TEXT NOT NULL CHECK (length(custody_lineage_b64u) = 22),
+    restore_session_id_hex TEXT NOT NULL CHECK (
+        length(restore_session_id_hex) = 32
+        AND restore_session_id_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    role TEXT NOT NULL CHECK (role = 'deriver_a'),
+    generation INTEGER NOT NULL CHECK (generation > 0),
+    import_key_id TEXT NOT NULL CHECK (length(import_key_id) BETWEEN 1 AND 128),
+    import_replay_key_digest_hex TEXT NOT NULL CHECK (
+        length(import_replay_key_digest_hex) = 64
+        AND import_replay_key_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    import_command_digest_hex TEXT NOT NULL CHECK (
+        length(import_command_digest_hex) = 64
+        AND import_command_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    import_operation_digest_hex TEXT NOT NULL CHECK (
+        length(import_operation_digest_hex) = 64
+        AND import_operation_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    recovery_set_id_b64u TEXT NOT NULL CHECK (length(recovery_set_id_b64u) = 22),
+    manifest_digest_hex TEXT NOT NULL CHECK (
+        length(manifest_digest_hex) = 64
+        AND manifest_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    stable_root_commitment_b64u TEXT NOT NULL CHECK (length(stable_root_commitment_b64u) = 43),
+    share_commitment_b64u TEXT NOT NULL CHECK (length(share_commitment_b64u) = 46),
+    destination_fingerprint_hex TEXT NOT NULL CHECK (
+        length(destination_fingerprint_hex) = 64
+        AND destination_fingerprint_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    import_public_key_b64u TEXT NOT NULL CHECK (length(import_public_key_b64u) = 43),
+    import_issued_at_ms INTEGER NOT NULL CHECK (import_issued_at_ms > 0),
+    import_expires_at_ms INTEGER NOT NULL CHECK (import_expires_at_ms > import_issued_at_ms),
+    refresh_command_digest_hex TEXT NOT NULL CHECK (
+        length(refresh_command_digest_hex) = 64
+        AND refresh_command_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    refresh_issued_at_ms INTEGER NOT NULL CHECK (refresh_issued_at_ms > 0),
+    refresh_expires_at_ms INTEGER NOT NULL CHECK (refresh_expires_at_ms > refresh_issued_at_ms),
+    admitted_at_ms INTEGER NOT NULL CHECK (admitted_at_ms > 0),
+    encrypted_seed_json TEXT CHECK (
+        encrypted_seed_json IS NULL OR json_valid(encrypted_seed_json)
+    ),
+    encrypted_refreshed_share_json TEXT CHECK (
+        encrypted_refreshed_share_json IS NULL OR json_valid(encrypted_refreshed_share_json)
+    ),
+    installation_evidence_b64u TEXT CHECK (
+        installation_evidence_b64u IS NULL OR length(installation_evidence_b64u) BETWEEN 1 AND 8192
+    ),
+    installation_evidence_digest_hex TEXT CHECK (
+        installation_evidence_digest_hex IS NULL OR (
+            length(installation_evidence_digest_hex) = 64
+            AND installation_evidence_digest_hex NOT GLOB '*[^0-9a-f]*'
+        )
+    ),
+    lifecycle TEXT NOT NULL CHECK (lifecycle IN ('pending', 'refreshed', 'closed')),
+    refreshed_at_ms INTEGER CHECK (refreshed_at_ms IS NULL OR refreshed_at_ms >= admitted_at_ms),
+    created_at_ms INTEGER NOT NULL CHECK (created_at_ms > 0),
+    updated_at_ms INTEGER NOT NULL CHECK (updated_at_ms >= created_at_ms),
+    PRIMARY KEY (import_replay_key_digest_hex),
+    UNIQUE (
+        tenant_identity_digest_hex,
+        custody_lineage_b64u,
+        restore_session_id_hex,
+        role,
+        generation
+    ),
+    CHECK (
+        (lifecycle = 'pending'
+            AND encrypted_seed_json IS NOT NULL
+            AND encrypted_refreshed_share_json IS NULL
+            AND installation_evidence_b64u IS NULL
+            AND installation_evidence_digest_hex IS NULL
+            AND refreshed_at_ms IS NULL)
+        OR (lifecycle = 'refreshed'
+            AND encrypted_seed_json IS NOT NULL
+            AND encrypted_refreshed_share_json IS NOT NULL
+            AND installation_evidence_b64u IS NOT NULL
+            AND installation_evidence_digest_hex IS NOT NULL
+            AND refreshed_at_ms IS NOT NULL)
+        OR (lifecycle = 'closed'
+            AND encrypted_seed_json IS NULL
+            AND encrypted_refreshed_share_json IS NULL
+            AND installation_evidence_b64u IS NULL
+            AND installation_evidence_digest_hex IS NULL
+            AND refreshed_at_ms IS NULL)
+    )
+);
+
+CREATE INDEX tenant_root_restore_refresh_attempts_session
+    ON tenant_root_restore_refresh_attempts (
+        tenant_identity_digest_hex,
+        custody_lineage_b64u,
+        restore_session_id_hex,
+        role,
+        lifecycle
+    );

package/cloudflare-router-ab/migrations/deriver-a/0008_tenant_root_restore_promotion.sql

@@ -0,0 +1,40 @@
+ALTER TABLE tenant_root_restore_refresh_attempts ADD COLUMN promotion_lifecycle TEXT NOT NULL DEFAULT 'unstarted' CHECK (
+    promotion_lifecycle IN ('unstarted', 'reserved', 'completed')
+);
+ALTER TABLE tenant_root_restore_refresh_attempts ADD COLUMN promotion_reserved_at_ms INTEGER CHECK (
+    promotion_reserved_at_ms IS NULL OR promotion_reserved_at_ms > 0
+);
+ALTER TABLE tenant_root_restore_refresh_attempts ADD COLUMN encrypted_online_role_share_json TEXT CHECK (
+    encrypted_online_role_share_json IS NULL OR json_valid(encrypted_online_role_share_json)
+);
+ALTER TABLE tenant_root_restore_refresh_attempts ADD COLUMN provider_canary_receipt_b64u TEXT CHECK (
+    provider_canary_receipt_b64u IS NULL OR length(provider_canary_receipt_b64u) BETWEEN 1 AND 32768
+);
+ALTER TABLE tenant_root_restore_refresh_attempts ADD COLUMN promotion_completed_at_ms INTEGER CHECK (
+    promotion_completed_at_ms IS NULL OR promotion_completed_at_ms > 0
+);
+
+ALTER TABLE tenant_root_restore_import_sessions ADD COLUMN role TEXT NOT NULL DEFAULT 'deriver_a' CHECK (
+    role = 'deriver_a'
+);
+ALTER TABLE tenant_root_restore_import_sessions ADD COLUMN activation_operation TEXT CHECK (
+    activation_operation IS NULL OR activation_operation = 'initial_creation'
+);
+ALTER TABLE tenant_root_restore_import_sessions ADD COLUMN activation_receipt_b64u TEXT CHECK (
+    activation_receipt_b64u IS NULL OR length(activation_receipt_b64u) BETWEEN 1 AND 32768
+);
+ALTER TABLE tenant_root_restore_import_sessions ADD COLUMN activation_receipt_digest_hex TEXT CHECK (
+    activation_receipt_digest_hex IS NULL OR (
+        length(activation_receipt_digest_hex) = 64
+        AND activation_receipt_digest_hex NOT GLOB '*[^0-9a-f]*'
+    )
+);
+ALTER TABLE tenant_root_restore_import_sessions ADD COLUMN cleanup_receipt_b64u TEXT CHECK (
+    cleanup_receipt_b64u IS NULL OR length(cleanup_receipt_b64u) BETWEEN 1 AND 32768
+);
+ALTER TABLE tenant_root_restore_import_sessions ADD COLUMN cleanup_receipt_digest_hex TEXT CHECK (
+    cleanup_receipt_digest_hex IS NULL OR (
+        length(cleanup_receipt_digest_hex) = 64
+        AND cleanup_receipt_digest_hex NOT GLOB '*[^0-9a-f]*'
+    )
+);

package/cloudflare-router-ab/migrations/deriver-a/0009_tenant_root_restore_preactivation_cleanup.sql

@@ -0,0 +1,8 @@
+ALTER TABLE tenant_root_restore_import_sessions ADD COLUMN cleanup_grant_b64u TEXT CHECK (
+    cleanup_grant_b64u IS NULL OR (
+        length(cleanup_grant_b64u) BETWEEN 1 AND 32768
+        AND activation_operation IS NULL
+        AND activation_receipt_b64u IS NULL
+        AND activation_receipt_digest_hex IS NULL
+    )
+);

package/cloudflare-router-ab/migrations/deriver-a/0010_tenant_root_recovery_attempts.sql

@@ -0,0 +1,26 @@
+CREATE TABLE tenant_root_recovery_attempts (
+    recovery_set_id_b64u TEXT PRIMARY KEY CHECK (length(recovery_set_id_b64u) = 22),
+    tenant_identity_digest_hex TEXT NOT NULL CHECK (length(tenant_identity_digest_hex) = 64),
+    custody_lineage_b64u TEXT NOT NULL CHECK (length(custody_lineage_b64u) = 22),
+    role TEXT NOT NULL CHECK (role = 'deriver_a'),
+    command_b64u TEXT NOT NULL CHECK (length(command_b64u) BETWEEN 1 AND 21846),
+    admitted_at_ms INTEGER NOT NULL CHECK (admitted_at_ms > 0),
+    lifecycle TEXT NOT NULL CHECK (lifecycle IN ('provisioning', 'pending', 'packaged', 'destroying', 'destruction_scheduled', 'destroyed')),
+    encrypted_material_b64u TEXT,
+    encrypted_package_b64u TEXT,
+    package_digest_b64u TEXT,
+    destruction_receipt TEXT,
+    descriptor_b64u TEXT,
+    package_length INTEGER,
+    CHECK (
+        (lifecycle = 'packaged' AND descriptor_b64u IS NOT NULL AND length(descriptor_b64u) BETWEEN 1 AND 21846 AND package_length IS NOT NULL AND package_length BETWEEN 1 AND 16384)
+        OR (lifecycle <> 'packaged' AND descriptor_b64u IS NULL AND package_length IS NULL)
+    ),
+    CHECK (
+        (lifecycle IN ('provisioning', 'destroying') AND encrypted_material_b64u IS NULL AND encrypted_package_b64u IS NULL AND package_digest_b64u IS NULL AND destruction_receipt IS NULL)
+        OR (lifecycle = 'pending' AND encrypted_material_b64u IS NOT NULL AND encrypted_package_b64u IS NULL AND package_digest_b64u IS NULL AND destruction_receipt IS NULL)
+        OR (lifecycle = 'packaged' AND encrypted_material_b64u IS NULL AND encrypted_package_b64u IS NOT NULL AND package_digest_b64u IS NOT NULL AND length(package_digest_b64u) = 43 AND destruction_receipt IS NULL)
+        OR (lifecycle IN ('destruction_scheduled', 'destroyed') AND encrypted_material_b64u IS NULL AND encrypted_package_b64u IS NULL AND package_digest_b64u IS NULL AND destruction_receipt IS NOT NULL)
+    )
+);
+CREATE INDEX tenant_root_recovery_attempts_lineage ON tenant_root_recovery_attempts (tenant_identity_digest_hex, custody_lineage_b64u);

package/cloudflare-router-ab/migrations/deriver-a/0011_tenant_root_source_retirement.sql

@@ -0,0 +1,100 @@
+CREATE TABLE tenant_root_source_retirements (
+    tenant_identity_digest_hex TEXT NOT NULL CHECK (length(tenant_identity_digest_hex) = 64),
+    custody_lineage_b64u TEXT NOT NULL CHECK (length(custody_lineage_b64u) = 22),
+    role TEXT NOT NULL CHECK (role = 'deriver_a'),
+    active_receipt_digest_b64u TEXT NOT NULL CHECK (length(active_receipt_digest_b64u) = 43),
+    destination_receipt_digest_b64u TEXT NOT NULL CHECK (length(destination_receipt_digest_b64u) = 43),
+    retired_at_ms INTEGER NOT NULL CHECK (retired_at_ms > 0),
+    PRIMARY KEY (tenant_identity_digest_hex, custody_lineage_b64u)
+);
+
+CREATE TRIGGER tenant_root_role_shares_source_retired_insert
+BEFORE INSERT ON tenant_root_role_shares
+WHEN EXISTS (SELECT 1 FROM tenant_root_source_retirements
+    WHERE tenant_identity_digest_hex = NEW.tenant_identity_digest_hex
+      AND custody_lineage_b64u = NEW.custody_lineage_b64u)
+BEGIN
+    SELECT RAISE(ABORT, 'tenant root source lineage is retired');
+END;
+
+CREATE TRIGGER tenant_root_role_shares_source_retired_update
+BEFORE UPDATE ON tenant_root_role_shares
+WHEN EXISTS (SELECT 1 FROM tenant_root_source_retirements
+    WHERE tenant_identity_digest_hex = NEW.tenant_identity_digest_hex
+      AND custody_lineage_b64u = NEW.custody_lineage_b64u)
+BEGIN
+    SELECT RAISE(ABORT, 'tenant root source lineage is retired');
+END;
+
+CREATE TRIGGER tenant_root_command_replays_source_retired_insert
+BEFORE INSERT ON tenant_root_command_replays
+WHEN EXISTS (SELECT 1 FROM tenant_root_source_retirements
+    WHERE tenant_identity_digest_hex = NEW.tenant_identity_digest_hex
+      AND custody_lineage_b64u = NEW.custody_lineage_b64u)
+BEGIN
+    SELECT RAISE(ABORT, 'tenant root source lineage is retired');
+END;
+
+CREATE TRIGGER tenant_root_command_replays_source_retired_update
+BEFORE UPDATE ON tenant_root_command_replays
+WHEN EXISTS (SELECT 1 FROM tenant_root_source_retirements
+    WHERE tenant_identity_digest_hex = NEW.tenant_identity_digest_hex
+      AND custody_lineage_b64u = NEW.custody_lineage_b64u)
+BEGIN
+    SELECT RAISE(ABORT, 'tenant root source lineage is retired');
+END;
+
+CREATE TRIGGER tenant_root_restore_import_keys_source_retired_insert
+BEFORE INSERT ON tenant_root_restore_import_keys
+WHEN EXISTS (SELECT 1 FROM tenant_root_source_retirements
+    WHERE tenant_identity_digest_hex = NEW.tenant_identity_digest_hex
+      AND custody_lineage_b64u = NEW.custody_lineage_b64u)
+BEGIN
+    SELECT RAISE(ABORT, 'tenant root source lineage is retired');
+END;
+
+CREATE TRIGGER tenant_root_restore_import_keys_source_retired_update
+BEFORE UPDATE ON tenant_root_restore_import_keys
+WHEN EXISTS (SELECT 1 FROM tenant_root_source_retirements
+    WHERE tenant_identity_digest_hex = NEW.tenant_identity_digest_hex
+      AND custody_lineage_b64u = NEW.custody_lineage_b64u)
+BEGIN
+    SELECT RAISE(ABORT, 'tenant root source lineage is retired');
+END;
+
+CREATE TRIGGER tenant_root_restore_refresh_attempts_source_retired_insert
+BEFORE INSERT ON tenant_root_restore_refresh_attempts
+WHEN EXISTS (SELECT 1 FROM tenant_root_source_retirements
+    WHERE tenant_identity_digest_hex = NEW.tenant_identity_digest_hex
+      AND custody_lineage_b64u = NEW.custody_lineage_b64u)
+BEGIN
+    SELECT RAISE(ABORT, 'tenant root source lineage is retired');
+END;
+
+CREATE TRIGGER tenant_root_restore_refresh_attempts_source_retired_update
+BEFORE UPDATE ON tenant_root_restore_refresh_attempts
+WHEN EXISTS (SELECT 1 FROM tenant_root_source_retirements
+    WHERE tenant_identity_digest_hex = NEW.tenant_identity_digest_hex
+      AND custody_lineage_b64u = NEW.custody_lineage_b64u)
+BEGIN
+    SELECT RAISE(ABORT, 'tenant root source lineage is retired');
+END;
+
+CREATE TRIGGER tenant_root_recovery_attempts_source_retired_insert
+BEFORE INSERT ON tenant_root_recovery_attempts
+WHEN EXISTS (SELECT 1 FROM tenant_root_source_retirements
+    WHERE tenant_identity_digest_hex = NEW.tenant_identity_digest_hex
+      AND custody_lineage_b64u = NEW.custody_lineage_b64u) AND NEW.lifecycle IN ('provisioning','pending','packaged')
+BEGIN
+    SELECT RAISE(ABORT, 'tenant root source lineage is retired');
+END;
+
+CREATE TRIGGER tenant_root_recovery_attempts_source_retired_update
+BEFORE UPDATE ON tenant_root_recovery_attempts
+WHEN EXISTS (SELECT 1 FROM tenant_root_source_retirements
+    WHERE tenant_identity_digest_hex = NEW.tenant_identity_digest_hex
+      AND custody_lineage_b64u = NEW.custody_lineage_b64u) AND NEW.lifecycle IN ('provisioning','pending','packaged')
+BEGIN
+    SELECT RAISE(ABORT, 'tenant root source lineage is retired');
+END;
+

package/cloudflare-router-ab/migrations/deriver-b/0001_role_private_storage.sql

@@ -0,0 +1,14 @@
+CREATE TABLE yao_pair_sessions (
+    session_hex TEXT PRIMARY KEY,
+    pair_digest_hex TEXT NOT NULL,
+    lifecycle TEXT NOT NULL CHECK (
+        lifecycle IN ('prepared', 'running', 'completed', 'burned', 'expired')
+    ),
+    ciphertext_json TEXT NOT NULL,
+    revision INTEGER NOT NULL CHECK (revision > 0),
+    expires_at_ms INTEGER NOT NULL,
+    updated_at_ms INTEGER NOT NULL
+);
+
+CREATE INDEX yao_pair_sessions_expiry
+    ON yao_pair_sessions (lifecycle, expires_at_ms);

package/cloudflare-router-ab/migrations/deriver-b/0002_tenant_root_role_shares.sql

@@ -0,0 +1,32 @@
+CREATE TABLE tenant_root_role_shares (
+    tenant_identity_digest_hex TEXT NOT NULL CHECK (
+        length(tenant_identity_digest_hex) = 64
+        AND tenant_identity_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    custody_lineage_b64u TEXT NOT NULL CHECK (length(custody_lineage_b64u) = 22),
+    tenant_root_share_epoch INTEGER NOT NULL CHECK (tenant_root_share_epoch > 0),
+    role TEXT NOT NULL CHECK (role = 'deriver_b'),
+    lifecycle TEXT NOT NULL CHECK (lifecycle IN ('pending', 'active', 'retired')),
+    ciphertext_json TEXT NOT NULL CHECK (json_valid(ciphertext_json)),
+    revision INTEGER NOT NULL CHECK (revision > 0),
+    created_at_ms INTEGER NOT NULL CHECK (created_at_ms > 0),
+    updated_at_ms INTEGER NOT NULL CHECK (updated_at_ms >= created_at_ms),
+    PRIMARY KEY (
+        tenant_identity_digest_hex,
+        custody_lineage_b64u,
+        tenant_root_share_epoch,
+        role
+    )
+);
+
+CREATE UNIQUE INDEX tenant_root_role_shares_active
+    ON tenant_root_role_shares (tenant_identity_digest_hex, role)
+    WHERE lifecycle = 'active';
+
+CREATE INDEX tenant_root_role_shares_lifecycle
+    ON tenant_root_role_shares (
+        tenant_identity_digest_hex,
+        role,
+        lifecycle,
+        tenant_root_share_epoch
+    );

package/cloudflare-router-ab/migrations/deriver-b/0003_tenant_root_command_replays.sql

@@ -0,0 +1,76 @@
+CREATE TABLE tenant_root_command_replays (
+    replay_key_digest_hex TEXT PRIMARY KEY CHECK (
+        length(replay_key_digest_hex) = 64
+        AND replay_key_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    tenant_identity_digest_hex TEXT NOT NULL CHECK (
+        length(tenant_identity_digest_hex) = 64
+        AND tenant_identity_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    custody_lineage_b64u TEXT NOT NULL CHECK (length(custody_lineage_b64u) = 22),
+    session_id_hex TEXT NOT NULL CHECK (
+        length(session_id_hex) = 32
+        AND session_id_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    nonce_hex TEXT NOT NULL CHECK (
+        length(nonce_hex) = 64
+        AND nonce_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    role TEXT NOT NULL CHECK (role = 'deriver_b'),
+    command_digest_hex TEXT NOT NULL CHECK (
+        length(command_digest_hex) = 64
+        AND command_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    status TEXT NOT NULL CHECK (status IN ('reserved', 'executed', 'completed', 'failed')),
+    receipt_b64u TEXT,
+    receipt_digest_hex TEXT CHECK (
+        receipt_digest_hex IS NULL OR (
+            length(receipt_digest_hex) = 64
+            AND receipt_digest_hex NOT GLOB '*[^0-9a-f]*'
+        )
+    ),
+    reserved_at_ms INTEGER NOT NULL CHECK (reserved_at_ms > 0),
+    executed_at_ms INTEGER,
+    terminal_at_ms INTEGER,
+    CHECK (
+        (status = 'reserved' AND receipt_b64u IS NULL
+            AND receipt_digest_hex IS NULL AND executed_at_ms IS NULL
+            AND terminal_at_ms IS NULL)
+        OR (status = 'executed' AND receipt_b64u IS NULL
+            AND receipt_digest_hex IS NULL AND executed_at_ms IS NOT NULL
+            AND executed_at_ms >= reserved_at_ms
+            AND terminal_at_ms IS NULL)
+        OR (status = 'completed' AND receipt_b64u IS NOT NULL
+            AND length(receipt_b64u) > 0
+            AND receipt_digest_hex IS NOT NULL
+            AND executed_at_ms IS NOT NULL
+            AND executed_at_ms >= reserved_at_ms
+            AND terminal_at_ms IS NOT NULL
+            AND terminal_at_ms >= executed_at_ms)
+        OR (status = 'failed' AND receipt_b64u IS NOT NULL
+            AND length(receipt_b64u) > 0
+            AND receipt_digest_hex IS NOT NULL AND executed_at_ms IS NULL
+            AND terminal_at_ms IS NOT NULL
+            AND terminal_at_ms >= reserved_at_ms)
+    )
+);
+
+CREATE TABLE tenant_root_command_cas_guard (
+    guard_id INTEGER PRIMARY KEY CHECK (guard_id = 1)
+);
+
+INSERT INTO tenant_root_command_cas_guard (guard_id) VALUES (1);
+
+CREATE TRIGGER tenant_root_command_cas_guard_immutable
+BEFORE DELETE ON tenant_root_command_cas_guard
+BEGIN
+    SELECT RAISE(ABORT, 'tenant_root_command_cas_guard is immutable');
+END;
+
+CREATE INDEX tenant_root_command_replays_tenant_status
+    ON tenant_root_command_replays (
+        tenant_identity_digest_hex,
+        custody_lineage_b64u,
+        role,
+        status
+    );

package/cloudflare-router-ab/migrations/deriver-b/0004_tenant_root_creation_admission.sql

@@ -0,0 +1,7 @@
+ALTER TABLE tenant_root_command_replays
+    ADD COLUMN admission_digest_hex TEXT CHECK (
+        admission_digest_hex IS NULL OR (
+            length(admission_digest_hex) = 64
+            AND admission_digest_hex NOT GLOB '*[^0-9a-f]*'
+        )
+    );

package/cloudflare-router-ab/migrations/deriver-b/0005_tenant_root_refresh_state.sql

@@ -0,0 +1,15 @@
+ALTER TABLE tenant_root_command_replays
+    ADD COLUMN refresh_state_b64u TEXT CHECK (
+        refresh_state_b64u IS NULL OR (
+            length(refresh_state_b64u) > 0
+            AND length(refresh_state_b64u) <= 174764
+            AND refresh_state_b64u NOT GLOB '*[^A-Za-z0-9_-]*'
+        )
+    );
+ALTER TABLE tenant_root_command_replays
+    ADD COLUMN refresh_state_digest_hex TEXT CHECK (
+        refresh_state_digest_hex IS NULL OR (
+            length(refresh_state_digest_hex) = 64
+            AND refresh_state_digest_hex NOT GLOB '*[^0-9a-f]*'
+        )
+    );

package/cloudflare-router-ab/migrations/deriver-b/0006_tenant_root_restore_import_keys.sql

@@ -0,0 +1,119 @@
+CREATE TABLE tenant_root_restore_import_sessions (
+    tenant_identity_digest_hex TEXT NOT NULL CHECK (
+        length(tenant_identity_digest_hex) = 64
+        AND tenant_identity_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    custody_lineage_b64u TEXT NOT NULL CHECK (length(custody_lineage_b64u) = 22),
+    restore_session_id_hex TEXT NOT NULL CHECK (
+        length(restore_session_id_hex) = 32
+        AND restore_session_id_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    closed_at_ms INTEGER NOT NULL CHECK (closed_at_ms > 0),
+    PRIMARY KEY (
+        tenant_identity_digest_hex,
+        custody_lineage_b64u,
+        restore_session_id_hex
+    )
+);
+
+CREATE TABLE tenant_root_restore_import_keys (
+    tenant_identity_digest_hex TEXT NOT NULL CHECK (
+        length(tenant_identity_digest_hex) = 64
+        AND tenant_identity_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    custody_lineage_b64u TEXT NOT NULL CHECK (length(custody_lineage_b64u) = 22),
+    restore_session_id_hex TEXT NOT NULL CHECK (
+        length(restore_session_id_hex) = 32
+        AND restore_session_id_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    role TEXT NOT NULL CHECK (role = 'deriver_b'),
+    generation INTEGER NOT NULL CHECK (generation > 0),
+    import_key_id TEXT NOT NULL CHECK (length(import_key_id) > 0),
+    replay_key_digest_hex TEXT NOT NULL CHECK (
+        length(replay_key_digest_hex) = 64
+        AND replay_key_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    command_digest_hex TEXT NOT NULL CHECK (
+        length(command_digest_hex) = 64
+        AND command_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    operation_digest_hex TEXT NOT NULL CHECK (
+        length(operation_digest_hex) = 64
+        AND operation_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    recovery_set_id_b64u TEXT NOT NULL CHECK (length(recovery_set_id_b64u) = 22),
+    manifest_digest_hex TEXT NOT NULL CHECK (
+        length(manifest_digest_hex) = 64
+        AND manifest_digest_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    stable_root_commitment_b64u TEXT NOT NULL CHECK (length(stable_root_commitment_b64u) > 0),
+    share_commitment_b64u TEXT NOT NULL CHECK (length(share_commitment_b64u) = 46),
+    destination_fingerprint_hex TEXT NOT NULL CHECK (
+        length(destination_fingerprint_hex) = 64
+        AND destination_fingerprint_hex NOT GLOB '*[^0-9a-f]*'
+    ),
+    public_key_b64u TEXT NOT NULL CHECK (length(public_key_b64u) > 0),
+    encrypted_ikm_json TEXT CHECK (
+        encrypted_ikm_json IS NULL OR json_valid(encrypted_ikm_json)
+    ),
+    envelope_digest_hex TEXT CHECK (
+        envelope_digest_hex IS NULL OR (
+            length(envelope_digest_hex) = 64
+            AND envelope_digest_hex NOT GLOB '*[^0-9a-f]*'
+        )
+    ),
+    encrypted_imported_share_json TEXT CHECK (
+        encrypted_imported_share_json IS NULL OR json_valid(encrypted_imported_share_json)
+    ),
+    issued_at_ms INTEGER NOT NULL CHECK (issued_at_ms > 0),
+    expires_at_ms INTEGER NOT NULL CHECK (expires_at_ms > issued_at_ms),
+    lifecycle TEXT NOT NULL CHECK (
+        lifecycle IN ('issued', 'superseded', 'installed', 'expired', 'closed')
+    ),
+    installed_at_ms INTEGER,
+    receipt_digest_hex TEXT CHECK (
+        receipt_digest_hex IS NULL OR (
+            length(receipt_digest_hex) = 64
+            AND receipt_digest_hex NOT GLOB '*[^0-9a-f]*'
+        )
+    ),
+    created_at_ms INTEGER NOT NULL CHECK (created_at_ms > 0),
+    updated_at_ms INTEGER NOT NULL CHECK (updated_at_ms >= created_at_ms),
+    PRIMARY KEY (
+        tenant_identity_digest_hex,
+        custody_lineage_b64u,
+        restore_session_id_hex,
+        role,
+        generation
+    ),
+    UNIQUE (replay_key_digest_hex),
+    UNIQUE (
+        tenant_identity_digest_hex,
+        custody_lineage_b64u,
+        restore_session_id_hex,
+        role,
+        import_key_id
+    ),
+    CHECK (
+        (lifecycle IN ('issued', 'superseded', 'expired', 'closed')
+            AND installed_at_ms IS NULL AND receipt_digest_hex IS NULL
+            AND envelope_digest_hex IS NULL AND encrypted_imported_share_json IS NULL
+            AND (lifecycle = 'closed') = (encrypted_ikm_json IS NULL))
+        OR (lifecycle = 'installed'
+            AND installed_at_ms IS NOT NULL
+            AND installed_at_ms >= issued_at_ms
+            AND receipt_digest_hex IS NOT NULL
+            AND envelope_digest_hex IS NOT NULL
+            AND encrypted_imported_share_json IS NOT NULL
+            AND encrypted_ikm_json IS NOT NULL)
+    )
+);
+
+CREATE INDEX tenant_root_restore_import_keys_current
+    ON tenant_root_restore_import_keys (
+        tenant_identity_digest_hex,
+        custody_lineage_b64u,
+        restore_session_id_hex,
+        role,
+        generation DESC
+    );