@seams/wallet-server 0.7.3 → 0.9.0

package/migrations/d1-signer/0050_wallet_relocation_approvals.sql

@@ -0,0 +1,14 @@
+CREATE TABLE wallet_relocation_approvals (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  move_id TEXT NOT NULL,
+  binding_json TEXT NOT NULL CHECK (json_valid(binding_json)),
+  authority_digest_b64u TEXT NOT NULL,
+  authority_revocation_epoch INTEGER NOT NULL CHECK (authority_revocation_epoch >= 0),
+  approved_at_ms INTEGER NOT NULL CHECK (approved_at_ms > 0),
+  expires_at_ms INTEGER NOT NULL CHECK (expires_at_ms > approved_at_ms),
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id, move_id)
+);

package/migrations/d1-signer/0051_wallet_relocation_email_otp.sql

@@ -0,0 +1,92 @@
+-- Add the relocation-bound Email OTP challenge purpose.
+
+PRAGMA defer_foreign_keys = ON;
+
+DROP INDEX email_otp_challenges_context_idx;
+DROP INDEX email_otp_challenges_expires_idx;
+
+ALTER TABLE email_otp_challenges RENAME TO email_otp_challenges_previous;
+
+CREATE TABLE email_otp_challenges (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  challenge_id TEXT NOT NULL,
+  challenge_subject_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  record_org_id TEXT NOT NULL,
+  otp_channel TEXT NOT NULL,
+  owner_proof_binding_digest TEXT NOT NULL,
+  action TEXT NOT NULL,
+  operation TEXT NOT NULL,
+  otp_code TEXT NOT NULL,
+  record_json TEXT NOT NULL,
+  created_at_ms INTEGER NOT NULL,
+  expires_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),
+  CHECK (length(namespace) > 0),
+  CHECK (length(org_id) > 0),
+  CHECK (length(project_id) > 0),
+  CHECK (length(env_id) > 0),
+  CHECK (length(challenge_id) > 0),
+  CHECK (length(challenge_subject_id) > 0),
+  CHECK (length(wallet_id) > 0),
+  CHECK (length(record_org_id) > 0),
+  CHECK (otp_channel = 'email_otp'),
+  CHECK (length(owner_proof_binding_digest) > 0),
+  CHECK (
+    action IN (
+      'wallet_email_otp_login',
+      'wallet_email_otp_registration',
+      'wallet_email_otp_device_recovery',
+      'wallet_email_otp_device_link',
+      'wallet_email_otp_recovery_bootstrap',
+      'wallet_email_otp_relocation'
+    )
+  ),
+  CHECK (operation IN ('wallet_unlock', 'transaction_sign', 'export_key', 'registration', 'device_link', 'wallet_relocation')),
+  CHECK ((action = 'wallet_email_otp_relocation') = (operation = 'wallet_relocation')),
+  CHECK (length(otp_code) > 0),
+  CHECK (json_valid(record_json)),
+  CHECK (created_at_ms > 0),
+  CHECK (expires_at_ms > created_at_ms),
+  CHECK (COALESCE(json_extract(record_json, '$.version') = 'email_otp_challenge_v1', 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.challengeId') = challenge_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.challengeSubjectId') = challenge_subject_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.orgId') = record_org_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.otpChannel') = otp_channel, 0)),
+  CHECK (
+    COALESCE(json_extract(record_json, '$.ownerProofBindingDigest') = owner_proof_binding_digest, 0)
+  ),
+  CHECK (COALESCE(json_extract(record_json, '$.action') = action, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.operation') = operation, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.otpCode') = otp_code, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.createdAtMs') = created_at_ms, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.expiresAtMs') = expires_at_ms, 0))
+);
+
+INSERT INTO email_otp_challenges (
+  namespace, org_id, project_id, env_id, challenge_id, challenge_subject_id,
+  wallet_id, record_org_id, otp_channel, owner_proof_binding_digest, action,
+  operation, otp_code, record_json, created_at_ms, expires_at_ms
+)
+SELECT namespace, org_id, project_id, env_id, challenge_id, challenge_subject_id,
+       wallet_id, record_org_id, otp_channel, owner_proof_binding_digest, action,
+       operation, otp_code, record_json, created_at_ms, expires_at_ms
+  FROM email_otp_challenges_previous;
+
+DROP TABLE email_otp_challenges_previous;
+
+CREATE INDEX email_otp_challenges_context_idx
+  ON email_otp_challenges (
+    namespace, org_id, project_id, env_id, challenge_subject_id, wallet_id,
+    record_org_id, otp_channel, owner_proof_binding_digest, action, operation,
+    expires_at_ms, created_at_ms
+  );
+
+CREATE INDEX email_otp_challenges_expires_idx
+  ON email_otp_challenges (namespace, org_id, project_id, env_id, expires_at_ms);
+
+PRAGMA defer_foreign_keys = OFF;

package/migrations/d1-signer/0052_wallet_relocation_session_fences.sql

@@ -0,0 +1,91 @@
+CREATE TABLE wallet_relocation_session_fences (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  move_id TEXT NOT NULL,
+  request_digest_hex TEXT NOT NULL,
+  source_generation INTEGER NOT NULL CHECK (source_generation > 0 AND source_generation < 9007199254740991),
+  retired_at_ms INTEGER NOT NULL CHECK (retired_at_ms > 0),
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id),
+  CHECK (length(move_id) = 49 AND substr(move_id, 1, 6) = 'wmove_' AND substr(move_id, 7) NOT GLOB '*[^A-Za-z0-9_-]*'),
+  CHECK (length(request_digest_hex) = 64 AND request_digest_hex NOT GLOB '*[^a-f0-9]*')
+);
+
+CREATE TRIGGER wallet_relocation_session_fences_immutable
+BEFORE UPDATE ON wallet_relocation_session_fences
+WHEN NEW.namespace IS NOT OLD.namespace OR NEW.org_id IS NOT OLD.org_id
+  OR NEW.project_id IS NOT OLD.project_id OR NEW.env_id IS NOT OLD.env_id
+  OR NEW.wallet_id IS NOT OLD.wallet_id OR NEW.move_id IS NOT OLD.move_id
+  OR NEW.request_digest_hex IS NOT OLD.request_digest_hex
+  OR NEW.source_generation IS NOT OLD.source_generation OR NEW.retired_at_ms IS NOT OLD.retired_at_ms
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_relocation_session_fence_immutable');
+END;
+
+CREATE TRIGGER wallet_relocation_session_fences_retain
+BEFORE DELETE ON wallet_relocation_session_fences
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_relocation_session_fence_retained');
+END;
+
+CREATE TRIGGER wallet_session_authorizations_v2_relocation_insert_guard
+BEFORE INSERT ON wallet_session_authorizations_v2
+WHEN EXISTS (
+  SELECT 1 FROM wallet_relocation_session_fences AS fence
+  WHERE (fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id AND fence.wallet_id = NEW.wallet_id)
+)
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_relocation_session_admission_closed');
+END;
+
+CREATE TRIGGER wallet_session_authorizations_v2_relocation_update_guard
+BEFORE UPDATE ON wallet_session_authorizations_v2
+WHEN (NEW.retired_at_ms IS NULL) AND EXISTS (
+  SELECT 1 FROM wallet_relocation_session_fences AS fence
+  WHERE (fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id AND fence.wallet_id = OLD.wallet_id) OR (fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id AND fence.wallet_id = NEW.wallet_id)
+)
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_relocation_session_admission_closed');
+END;
+
+CREATE TRIGGER wallet_session_hosted_credentials_v2_relocation_insert_guard
+BEFORE INSERT ON wallet_session_hosted_credentials_v2
+WHEN EXISTS (
+  SELECT 1 FROM wallet_relocation_session_fences AS fence
+  WHERE (fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id AND fence.wallet_id = NEW.wallet_id)
+)
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_relocation_session_admission_closed');
+END;
+
+CREATE TRIGGER wallet_session_hosted_credentials_v2_relocation_update_guard
+BEFORE UPDATE ON wallet_session_hosted_credentials_v2
+WHEN (NEW.lifecycle_kind = 'active') AND EXISTS (
+  SELECT 1 FROM wallet_relocation_session_fences AS fence
+  WHERE (fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id AND fence.wallet_id = OLD.wallet_id) OR (fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id AND fence.wallet_id = NEW.wallet_id)
+)
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_relocation_session_admission_closed');
+END;
+
+CREATE TRIGGER wallet_session_hosted_exchange_codes_v2_relocation_insert_guard
+BEFORE INSERT ON wallet_session_hosted_exchange_codes_v2
+WHEN EXISTS (
+  SELECT 1 FROM wallet_relocation_session_fences AS fence
+  WHERE (fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id AND fence.wallet_id = NEW.wallet_id)
+)
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_relocation_session_admission_closed');
+END;
+
+CREATE TRIGGER wallet_session_hosted_exchange_codes_v2_relocation_update_guard
+BEFORE UPDATE ON wallet_session_hosted_exchange_codes_v2
+WHEN (NEW.lifecycle_kind IN ('issued', 'consumed')) AND EXISTS (
+  SELECT 1 FROM wallet_relocation_session_fences AS fence
+  WHERE (fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id AND fence.wallet_id = OLD.wallet_id) OR (fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id AND fence.wallet_id = NEW.wallet_id)
+)
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_relocation_session_admission_closed');
+END;

package/migrations/d1-signer/0053_wallet_hosted_history_import.sql

@@ -0,0 +1,164 @@
+CREATE TABLE wallet_relocation_hosted_imports (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL, move_id TEXT NOT NULL, request_digest_hex TEXT NOT NULL,
+  source_generation INTEGER NOT NULL CHECK (source_generation > 0 AND source_generation < 9007199254740991),
+  state TEXT NOT NULL CHECK (state IN ('importing', 'closed', 'activated')),
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id)
+);
+
+CREATE TABLE wallet_relocation_hosted_import_context (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL, move_id TEXT NOT NULL, request_digest_hex TEXT NOT NULL,
+  source_generation INTEGER NOT NULL,
+  kind TEXT NOT NULL CHECK (kind IN ('credential', 'exchange')),
+  tenant_id TEXT NOT NULL, record_id TEXT NOT NULL,
+  record_digest TEXT NOT NULL CHECK (length(record_digest) = 64 AND record_digest NOT GLOB '*[^a-f0-9]*'),
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id, kind, tenant_id, record_id)
+);
+
+CREATE TABLE wallet_relocation_hosted_import_receipts (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL, move_id TEXT NOT NULL, request_digest_hex TEXT NOT NULL,
+  source_generation INTEGER NOT NULL,
+  kind TEXT NOT NULL CHECK (kind IN ('credential', 'exchange')),
+  tenant_id TEXT NOT NULL, record_id TEXT NOT NULL,
+  record_digest TEXT NOT NULL CHECK (length(record_digest) = 64 AND record_digest NOT GLOB '*[^a-f0-9]*'),
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id, move_id, kind, tenant_id, record_id)
+);
+
+CREATE TRIGGER wallet_relocation_hosted_import_identity_guard
+BEFORE UPDATE ON wallet_relocation_hosted_imports
+WHEN NEW.namespace IS NOT OLD.namespace OR NEW.org_id IS NOT OLD.org_id
+  OR NEW.project_id IS NOT OLD.project_id OR NEW.env_id IS NOT OLD.env_id
+  OR NEW.wallet_id IS NOT OLD.wallet_id OR NEW.move_id IS NOT OLD.move_id
+  OR NEW.request_digest_hex IS NOT OLD.request_digest_hex OR NEW.source_generation IS NOT OLD.source_generation
+  OR (OLD.state = 'closed' AND NEW.state = 'importing')
+  OR (OLD.state = 'activated' AND NEW.state != 'activated')
+  OR (OLD.state = 'importing' AND NEW.state = 'activated')
+BEGIN SELECT RAISE(ABORT, 'wallet_hosted_history_import_transition_rejected'); END;
+
+CREATE TRIGGER wallet_relocation_hosted_import_retain
+BEFORE DELETE ON wallet_relocation_hosted_imports
+BEGIN SELECT RAISE(ABORT, 'wallet_hosted_history_import_retained'); END;
+
+CREATE TRIGGER wallet_relocation_hosted_receipt_immutable
+BEFORE UPDATE ON wallet_relocation_hosted_import_receipts
+BEGIN SELECT RAISE(ABORT, 'wallet_hosted_history_receipt_immutable'); END;
+
+CREATE TRIGGER wallet_relocation_hosted_receipt_retain
+BEFORE DELETE ON wallet_relocation_hosted_import_receipts
+BEGIN SELECT RAISE(ABORT, 'wallet_hosted_history_receipt_retained'); END;
+
+CREATE TRIGGER wallet_session_authorizations_v2_import_insert_guard
+BEFORE INSERT ON wallet_session_authorizations_v2
+WHEN NEW.retired_at_ms IS NULL AND EXISTS (
+  SELECT 1 FROM wallet_relocation_hosted_imports AS destination
+  WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+    AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+    AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated'
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_hosted_history_destination_inactive'); END;
+
+CREATE TRIGGER wallet_session_authorizations_v2_import_update_guard
+BEFORE UPDATE ON wallet_session_authorizations_v2
+WHEN NEW.retired_at_ms IS NULL AND EXISTS (
+  SELECT 1 FROM wallet_relocation_hosted_imports AS destination
+  WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+    AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+    AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated'
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_hosted_history_destination_inactive'); END;
+
+DROP TRIGGER wallet_session_hosted_credentials_v2_insert_lifecycle_guard;
+CREATE TRIGGER wallet_session_hosted_credentials_v2_insert_lifecycle_guard
+BEFORE INSERT ON wallet_session_hosted_credentials_v2
+WHEN (NEW.lifecycle_kind != 'active' OR NEW.retired_at_ms IS NOT NULL) AND NOT (NEW.lifecycle_kind = 'retired' AND NEW.retired_at_ms IS NOT NULL AND EXISTS (SELECT 1 FROM wallet_relocation_hosted_import_context AS context
+    JOIN wallet_relocation_hosted_imports AS destination
+      ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+      AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+      AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+      AND destination.request_digest_hex = context.request_digest_hex
+      AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+    WHERE context.namespace = NEW.namespace AND context.org_id = NEW.org_id
+      AND context.project_id = NEW.project_id AND context.env_id = NEW.env_id
+      AND context.wallet_id = NEW.wallet_id AND context.tenant_id = NEW.tenant_id
+      AND context.kind = 'credential' AND context.record_id = NEW.hosted_credential_id))
+BEGIN SELECT RAISE(ABORT, 'wallet_session_hosted_credential_initial_state_rejected'); END;
+
+DROP TRIGGER wallet_session_hosted_credentials_v2_parent_guard;
+CREATE TRIGGER wallet_session_hosted_credentials_v2_parent_guard
+BEFORE INSERT ON wallet_session_hosted_credentials_v2
+WHEN NOT EXISTS (
+  SELECT 1 FROM wallet_session_authorizations_v2 AS session
+  WHERE session.namespace = NEW.namespace AND session.org_id = NEW.org_id
+    AND session.project_id = NEW.project_id AND session.env_id = NEW.env_id
+    AND session.tenant_id = NEW.tenant_id AND session.authorization_id = NEW.authorization_id
+    AND session.wallet_session_id = NEW.wallet_session_id AND session.quota_id = NEW.quota_id
+    AND session.principal_id = NEW.principal_id AND session.wallet_id = NEW.wallet_id
+    AND session.authority_id = NEW.authority_id AND session.wallet_auth_method_id = NEW.wallet_auth_method_id
+    AND session.operation_credential_hash IS NOT NULL AND session.expires_at_ms >= NEW.expires_at_ms
+    AND (session.retired_at_ms IS NULL OR (NEW.lifecycle_kind = 'retired' AND NEW.retired_at_ms IS NOT NULL AND EXISTS (SELECT 1 FROM wallet_relocation_hosted_import_context AS context
+    JOIN wallet_relocation_hosted_imports AS destination
+      ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+      AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+      AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+      AND destination.request_digest_hex = context.request_digest_hex
+      AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+    WHERE context.namespace = NEW.namespace AND context.org_id = NEW.org_id
+      AND context.project_id = NEW.project_id AND context.env_id = NEW.env_id
+      AND context.wallet_id = NEW.wallet_id AND context.tenant_id = NEW.tenant_id
+      AND context.kind = 'credential' AND context.record_id = NEW.hosted_credential_id)))
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_session_hosted_credential_parent_rejected'); END;
+
+DROP TRIGGER wallet_session_hosted_exchange_codes_v2_insert_lifecycle_guard;
+CREATE TRIGGER wallet_session_hosted_exchange_codes_v2_insert_lifecycle_guard
+BEFORE INSERT ON wallet_session_hosted_exchange_codes_v2
+WHEN (NEW.lifecycle_kind != 'issued' OR NEW.hosted_credential_id IS NOT NULL OR NEW.consumed_at_ms IS NOT NULL) AND NOT ((NEW.lifecycle_kind = 'issued' OR (NEW.lifecycle_kind = 'consumed' AND EXISTS (
+      SELECT 1 FROM wallet_session_hosted_credentials_v2 AS child
+      WHERE child.namespace = NEW.namespace AND child.org_id = NEW.org_id
+        AND child.project_id = NEW.project_id AND child.env_id = NEW.env_id
+        AND child.tenant_id = NEW.tenant_id AND child.hosted_credential_id = NEW.hosted_credential_id
+        AND child.wallet_id = NEW.wallet_id AND child.lifecycle_kind = 'retired'))) AND EXISTS (SELECT 1 FROM wallet_relocation_hosted_import_context AS context
+    JOIN wallet_relocation_hosted_imports AS destination
+      ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+      AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+      AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+      AND destination.request_digest_hex = context.request_digest_hex
+      AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+    WHERE context.namespace = NEW.namespace AND context.org_id = NEW.org_id
+      AND context.project_id = NEW.project_id AND context.env_id = NEW.env_id
+      AND context.wallet_id = NEW.wallet_id AND context.tenant_id = NEW.tenant_id
+      AND context.kind = 'exchange' AND context.record_id = NEW.exchange_code_id))
+BEGIN SELECT RAISE(ABORT, 'wallet_session_hosted_exchange_initial_state_rejected'); END;
+
+DROP TRIGGER wallet_session_hosted_exchange_codes_v2_parent_guard;
+CREATE TRIGGER wallet_session_hosted_exchange_codes_v2_parent_guard
+BEFORE INSERT ON wallet_session_hosted_exchange_codes_v2
+WHEN NOT EXISTS (
+  SELECT 1 FROM wallet_session_authorizations_v2 AS session
+  WHERE session.namespace = NEW.namespace AND session.org_id = NEW.org_id
+    AND session.project_id = NEW.project_id AND session.env_id = NEW.env_id
+    AND session.tenant_id = NEW.tenant_id AND session.authorization_id = NEW.authorization_id
+    AND session.wallet_session_id = NEW.wallet_session_id AND session.quota_id = NEW.quota_id
+    AND session.principal_id = NEW.principal_id AND session.wallet_id = NEW.wallet_id
+    AND session.authority_id = NEW.authority_id AND session.wallet_auth_method_id = NEW.wallet_auth_method_id
+    AND session.operation_credential_hash IS NOT NULL AND session.expires_at_ms >= NEW.expires_at_ms
+    AND (session.retired_at_ms IS NULL OR ((NEW.lifecycle_kind = 'issued' OR (NEW.lifecycle_kind = 'consumed' AND EXISTS (
+      SELECT 1 FROM wallet_session_hosted_credentials_v2 AS child
+      WHERE child.namespace = NEW.namespace AND child.org_id = NEW.org_id
+        AND child.project_id = NEW.project_id AND child.env_id = NEW.env_id
+        AND child.tenant_id = NEW.tenant_id AND child.hosted_credential_id = NEW.hosted_credential_id
+        AND child.wallet_id = NEW.wallet_id AND child.lifecycle_kind = 'retired'))) AND EXISTS (SELECT 1 FROM wallet_relocation_hosted_import_context AS context
+    JOIN wallet_relocation_hosted_imports AS destination
+      ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+      AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+      AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+      AND destination.request_digest_hex = context.request_digest_hex
+      AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+    WHERE context.namespace = NEW.namespace AND context.org_id = NEW.org_id
+      AND context.project_id = NEW.project_id AND context.env_id = NEW.env_id
+      AND context.wallet_id = NEW.wallet_id AND context.tenant_id = NEW.tenant_id
+      AND context.kind = 'exchange' AND context.record_id = NEW.exchange_code_id)))
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_session_hosted_exchange_parent_rejected'); END;