@seams/wallet-server 0.7.3 → 0.9.0

package/migrations/d1-signer/0056_wallet_authorization_history_import.sql

@@ -0,0 +1,424 @@
+-- Standalone history imports cannot be upgraded into a different receipt protocol.
+-- Preserve them by refusing the upgrade if any exist.
+CREATE TABLE wallet_authorization_import_upgrade_guard (count INTEGER NOT NULL CHECK (count = 0));
+INSERT INTO wallet_authorization_import_upgrade_guard
+SELECT (SELECT COUNT(*) FROM wallet_relocation_hosted_imports)
+     + (SELECT COUNT(*) FROM wallet_relocation_hosted_import_context)
+     + (SELECT COUNT(*) FROM wallet_relocation_hosted_import_receipts);
+DROP TABLE wallet_authorization_import_upgrade_guard;
+DROP TRIGGER wallet_session_authorizations_v2_import_insert_guard;
+DROP TRIGGER wallet_session_authorizations_v2_import_update_guard;
+DROP TRIGGER wallet_session_hosted_credentials_v2_insert_lifecycle_guard;
+DROP TRIGGER wallet_session_hosted_credentials_v2_parent_guard;
+DROP TRIGGER wallet_session_hosted_exchange_codes_v2_insert_lifecycle_guard;
+DROP TRIGGER wallet_session_hosted_exchange_codes_v2_parent_guard;
+DROP TABLE wallet_relocation_hosted_import_receipts;
+DROP TABLE wallet_relocation_hosted_import_context;
+DROP TABLE wallet_relocation_hosted_imports;
+
+CREATE TABLE wallet_relocation_authorization_imports (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL, move_id TEXT NOT NULL, request_digest_hex TEXT NOT NULL,
+  source_generation INTEGER NOT NULL CHECK (source_generation > 0 AND source_generation < 9007199254740991),
+  state TEXT NOT NULL CHECK (state IN ('importing', 'closed', 'activated')),
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id)
+);
+
+CREATE TABLE wallet_relocation_authorization_import_context (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL, move_id TEXT NOT NULL, request_digest_hex TEXT NOT NULL, source_generation INTEGER NOT NULL,
+  table_name TEXT NOT NULL,
+  record_key TEXT NOT NULL CHECK (json_valid(record_key)),
+  record_digest TEXT NOT NULL CHECK (length(record_digest) = 64 AND record_digest NOT GLOB '*[^a-f0-9]*'),
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id)
+);
+
+CREATE TABLE wallet_relocation_authorization_import_receipts (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL, move_id TEXT NOT NULL, request_digest_hex TEXT NOT NULL, source_generation INTEGER NOT NULL,
+  table_name TEXT NOT NULL,
+  record_key TEXT NOT NULL CHECK (json_valid(record_key)),
+  record_digest TEXT NOT NULL CHECK (length(record_digest) = 64 AND record_digest NOT GLOB '*[^a-f0-9]*'),
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id, move_id, table_name, record_key)
+);
+
+CREATE TRIGGER wallet_relocation_authorization_import_identity_guard
+BEFORE UPDATE ON wallet_relocation_authorization_imports
+WHEN NEW.namespace IS NOT OLD.namespace OR NEW.org_id IS NOT OLD.org_id
+  OR NEW.project_id IS NOT OLD.project_id OR NEW.env_id IS NOT OLD.env_id
+  OR NEW.wallet_id IS NOT OLD.wallet_id OR NEW.move_id IS NOT OLD.move_id
+  OR NEW.request_digest_hex IS NOT OLD.request_digest_hex OR NEW.source_generation IS NOT OLD.source_generation
+  OR (OLD.state = 'closed' AND NEW.state = 'importing')
+  OR (OLD.state = 'activated' AND NEW.state != 'activated')
+  OR (OLD.state = 'importing' AND NEW.state = 'activated')
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_history_import_transition_rejected'); END;
+
+CREATE TRIGGER wallet_relocation_authorization_import_retain
+BEFORE DELETE ON wallet_relocation_authorization_imports
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_history_import_retained'); END;
+
+CREATE TRIGGER wallet_relocation_authorization_receipt_immutable
+BEFORE UPDATE ON wallet_relocation_authorization_import_receipts
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_history_receipt_immutable'); END;
+
+CREATE TRIGGER wallet_relocation_authorization_receipt_retain
+BEFORE DELETE ON wallet_relocation_authorization_import_receipts
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_history_receipt_retained'); END;
+
+
+CREATE TRIGGER wallet_session_hosted_credentials_v2_insert_lifecycle_guard
+BEFORE INSERT ON wallet_session_hosted_credentials_v2
+WHEN (NEW.lifecycle_kind != 'active' OR NEW.retired_at_ms IS NOT NULL) AND NOT (NEW.lifecycle_kind = 'retired' AND NEW.retired_at_ms IS NOT NULL AND EXISTS (SELECT 1 FROM wallet_relocation_authorization_import_context AS context
+    JOIN wallet_relocation_authorization_imports AS destination
+      ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+      AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+      AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+      AND destination.request_digest_hex = context.request_digest_hex
+      AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+    WHERE context.namespace = NEW.namespace AND context.org_id = NEW.org_id
+      AND context.project_id = NEW.project_id AND context.env_id = NEW.env_id
+      AND context.wallet_id = NEW.wallet_id AND context.table_name = 'wallet_session_hosted_credentials_v2'
+      AND context.record_key = json_array(NEW.env_id, NEW.hosted_credential_id, NEW.namespace, NEW.org_id, NEW.project_id, NEW.tenant_id)))
+BEGIN SELECT RAISE(ABORT, 'wallet_session_hosted_credential_initial_state_rejected'); END;
+
+CREATE TRIGGER wallet_session_hosted_credentials_v2_parent_guard
+BEFORE INSERT ON wallet_session_hosted_credentials_v2
+WHEN NOT EXISTS (
+  SELECT 1 FROM wallet_session_authorizations_v2 AS session
+  WHERE session.namespace = NEW.namespace AND session.org_id = NEW.org_id
+    AND session.project_id = NEW.project_id AND session.env_id = NEW.env_id
+    AND session.tenant_id = NEW.tenant_id AND session.authorization_id = NEW.authorization_id
+    AND session.wallet_session_id = NEW.wallet_session_id AND session.quota_id = NEW.quota_id
+    AND session.principal_id = NEW.principal_id AND session.wallet_id = NEW.wallet_id
+    AND session.authority_id = NEW.authority_id AND session.wallet_auth_method_id = NEW.wallet_auth_method_id
+    AND session.operation_credential_hash IS NOT NULL AND session.expires_at_ms >= NEW.expires_at_ms
+    AND (session.retired_at_ms IS NULL OR (NEW.lifecycle_kind = 'retired' AND NEW.retired_at_ms IS NOT NULL AND EXISTS (SELECT 1 FROM wallet_relocation_authorization_import_context AS context
+    JOIN wallet_relocation_authorization_imports AS destination
+      ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+      AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+      AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+      AND destination.request_digest_hex = context.request_digest_hex
+      AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+    WHERE context.namespace = NEW.namespace AND context.org_id = NEW.org_id
+      AND context.project_id = NEW.project_id AND context.env_id = NEW.env_id
+      AND context.wallet_id = NEW.wallet_id AND context.table_name = 'wallet_session_hosted_credentials_v2'
+      AND context.record_key = json_array(NEW.env_id, NEW.hosted_credential_id, NEW.namespace, NEW.org_id, NEW.project_id, NEW.tenant_id))))
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_session_hosted_credential_parent_rejected'); END;
+
+CREATE TRIGGER wallet_session_hosted_exchange_codes_v2_insert_lifecycle_guard
+BEFORE INSERT ON wallet_session_hosted_exchange_codes_v2
+WHEN (NEW.lifecycle_kind != 'issued' OR NEW.hosted_credential_id IS NOT NULL OR NEW.consumed_at_ms IS NOT NULL) AND NOT ((NEW.lifecycle_kind = 'issued' OR (NEW.lifecycle_kind = 'consumed' AND EXISTS (
+      SELECT 1 FROM wallet_session_hosted_credentials_v2 AS child
+      WHERE child.namespace = NEW.namespace AND child.org_id = NEW.org_id
+        AND child.project_id = NEW.project_id AND child.env_id = NEW.env_id
+        AND child.tenant_id = NEW.tenant_id AND child.hosted_credential_id = NEW.hosted_credential_id
+        AND child.wallet_id = NEW.wallet_id AND child.lifecycle_kind = 'retired'))) AND EXISTS (SELECT 1 FROM wallet_relocation_authorization_import_context AS context
+    JOIN wallet_relocation_authorization_imports AS destination
+      ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+      AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+      AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+      AND destination.request_digest_hex = context.request_digest_hex
+      AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+    WHERE context.namespace = NEW.namespace AND context.org_id = NEW.org_id
+      AND context.project_id = NEW.project_id AND context.env_id = NEW.env_id
+      AND context.wallet_id = NEW.wallet_id AND context.table_name = 'wallet_session_hosted_exchange_codes_v2'
+      AND context.record_key = json_array(NEW.env_id, NEW.exchange_code_id, NEW.namespace, NEW.org_id, NEW.project_id, NEW.tenant_id)))
+BEGIN SELECT RAISE(ABORT, 'wallet_session_hosted_exchange_initial_state_rejected'); END;
+
+CREATE TRIGGER wallet_session_hosted_exchange_codes_v2_parent_guard
+BEFORE INSERT ON wallet_session_hosted_exchange_codes_v2
+WHEN NOT EXISTS (
+  SELECT 1 FROM wallet_session_authorizations_v2 AS session
+  WHERE session.namespace = NEW.namespace AND session.org_id = NEW.org_id
+    AND session.project_id = NEW.project_id AND session.env_id = NEW.env_id
+    AND session.tenant_id = NEW.tenant_id AND session.authorization_id = NEW.authorization_id
+    AND session.wallet_session_id = NEW.wallet_session_id AND session.quota_id = NEW.quota_id
+    AND session.principal_id = NEW.principal_id AND session.wallet_id = NEW.wallet_id
+    AND session.authority_id = NEW.authority_id AND session.wallet_auth_method_id = NEW.wallet_auth_method_id
+    AND session.operation_credential_hash IS NOT NULL AND session.expires_at_ms >= NEW.expires_at_ms
+    AND (session.retired_at_ms IS NULL OR ((NEW.lifecycle_kind = 'issued' OR (NEW.lifecycle_kind = 'consumed' AND EXISTS (
+      SELECT 1 FROM wallet_session_hosted_credentials_v2 AS child
+      WHERE child.namespace = NEW.namespace AND child.org_id = NEW.org_id
+        AND child.project_id = NEW.project_id AND child.env_id = NEW.env_id
+        AND child.tenant_id = NEW.tenant_id AND child.hosted_credential_id = NEW.hosted_credential_id
+        AND child.wallet_id = NEW.wallet_id AND child.lifecycle_kind = 'retired'))) AND EXISTS (SELECT 1 FROM wallet_relocation_authorization_import_context AS context
+    JOIN wallet_relocation_authorization_imports AS destination
+      ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+      AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+      AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+      AND destination.request_digest_hex = context.request_digest_hex
+      AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+    WHERE context.namespace = NEW.namespace AND context.org_id = NEW.org_id
+      AND context.project_id = NEW.project_id AND context.env_id = NEW.env_id
+      AND context.wallet_id = NEW.wallet_id AND context.table_name = 'wallet_session_hosted_exchange_codes_v2'
+      AND context.record_key = json_array(NEW.env_id, NEW.exchange_code_id, NEW.namespace, NEW.org_id, NEW.project_id, NEW.tenant_id))))
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_session_hosted_exchange_parent_rejected'); END;
+
+CREATE TRIGGER wallet_authorities_inactive_import_insert
+BEFORE INSERT ON wallet_authorities
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+      AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+      AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated') AND NOT EXISTS (
+      SELECT 1 FROM wallet_relocation_authorization_import_context AS context
+      JOIN wallet_relocation_authorization_imports AS destination
+        ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+        AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+        AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+        AND destination.request_digest_hex = context.request_digest_hex
+        AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+      WHERE context.namespace = NEW.namespace AND context.wallet_id = NEW.wallet_id
+        AND context.table_name = 'wallet_authorities'
+        AND context.record_key = json_array(NEW.authority_id, NEW.env_id, NEW.namespace, NEW.org_id, NEW.project_id)
+    ))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER wallet_authorities_inactive_import_update
+BEFORE UPDATE ON wallet_authorities
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+      AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+      AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated')) OR (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+      AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+      AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated'))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER wallet_authorities_inactive_import_delete
+BEFORE DELETE ON wallet_authorities
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+      AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+      AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated'))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER wallet_auth_methods_inactive_import_insert
+BEFORE INSERT ON wallet_auth_methods
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+      AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+      AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated') AND NOT EXISTS (
+      SELECT 1 FROM wallet_relocation_authorization_import_context AS context
+      JOIN wallet_relocation_authorization_imports AS destination
+        ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+        AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+        AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+        AND destination.request_digest_hex = context.request_digest_hex
+        AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+      WHERE context.namespace = NEW.namespace AND context.wallet_id = NEW.wallet_id
+        AND context.table_name = 'wallet_auth_methods'
+        AND context.record_key = json_array(NEW.env_id, NEW.namespace, NEW.org_id, NEW.project_id, NEW.wallet_auth_method_id)
+    ))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER wallet_auth_methods_inactive_import_update
+BEFORE UPDATE ON wallet_auth_methods
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+      AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+      AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated')) OR (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+      AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+      AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated'))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER wallet_auth_methods_inactive_import_delete
+BEFORE DELETE ON wallet_auth_methods
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+      AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+      AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated'))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER authorization_wallet_session_quotas_inactive_import_insert
+BEFORE INSERT ON authorization_wallet_session_quotas
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = NEW.namespace AND (
+      EXISTS (SELECT 1 FROM wallet_relocation_authorization_import_receipts AS receipt
+        WHERE receipt.namespace = destination.namespace AND receipt.org_id = destination.org_id
+          AND receipt.project_id = destination.project_id AND receipt.env_id = destination.env_id
+          AND receipt.wallet_id = destination.wallet_id AND receipt.table_name = 'authorization_wallet_session_quotas'
+          AND receipt.record_key = json_array(NEW.namespace, NEW.quota_id, NEW.tenant_id))
+      OR EXISTS (SELECT 1 FROM wallet_session_authorizations_v2 AS session
+        WHERE session.namespace = destination.namespace AND session.org_id = destination.org_id
+          AND session.project_id = destination.project_id AND session.env_id = destination.env_id
+          AND session.wallet_id = destination.wallet_id AND session.namespace = NEW.namespace
+          AND session.tenant_id = NEW.tenant_id AND session.quota_id = NEW.quota_id
+          AND session.wallet_session_id = NEW.wallet_session_id)
+    ) AND destination.state != 'activated') AND NOT EXISTS (
+      SELECT 1 FROM wallet_relocation_authorization_import_context AS context
+      JOIN wallet_relocation_authorization_imports AS destination
+        ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+        AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+        AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+        AND destination.request_digest_hex = context.request_digest_hex
+        AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+      WHERE context.namespace = NEW.namespace AND context.table_name = 'authorization_wallet_session_quotas'
+        AND context.record_key = json_array(NEW.namespace, NEW.quota_id, NEW.tenant_id)
+    ))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER authorization_wallet_session_quotas_inactive_import_update
+BEFORE UPDATE ON authorization_wallet_session_quotas
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = OLD.namespace AND (
+      EXISTS (SELECT 1 FROM wallet_relocation_authorization_import_receipts AS receipt
+        WHERE receipt.namespace = destination.namespace AND receipt.org_id = destination.org_id
+          AND receipt.project_id = destination.project_id AND receipt.env_id = destination.env_id
+          AND receipt.wallet_id = destination.wallet_id AND receipt.table_name = 'authorization_wallet_session_quotas'
+          AND receipt.record_key = json_array(OLD.namespace, OLD.quota_id, OLD.tenant_id))
+      OR EXISTS (SELECT 1 FROM wallet_session_authorizations_v2 AS session
+        WHERE session.namespace = destination.namespace AND session.org_id = destination.org_id
+          AND session.project_id = destination.project_id AND session.env_id = destination.env_id
+          AND session.wallet_id = destination.wallet_id AND session.namespace = OLD.namespace
+          AND session.tenant_id = OLD.tenant_id AND session.quota_id = OLD.quota_id
+          AND session.wallet_session_id = OLD.wallet_session_id)
+    ) AND destination.state != 'activated')) OR (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = NEW.namespace AND (
+      EXISTS (SELECT 1 FROM wallet_relocation_authorization_import_receipts AS receipt
+        WHERE receipt.namespace = destination.namespace AND receipt.org_id = destination.org_id
+          AND receipt.project_id = destination.project_id AND receipt.env_id = destination.env_id
+          AND receipt.wallet_id = destination.wallet_id AND receipt.table_name = 'authorization_wallet_session_quotas'
+          AND receipt.record_key = json_array(NEW.namespace, NEW.quota_id, NEW.tenant_id))
+      OR EXISTS (SELECT 1 FROM wallet_session_authorizations_v2 AS session
+        WHERE session.namespace = destination.namespace AND session.org_id = destination.org_id
+          AND session.project_id = destination.project_id AND session.env_id = destination.env_id
+          AND session.wallet_id = destination.wallet_id AND session.namespace = NEW.namespace
+          AND session.tenant_id = NEW.tenant_id AND session.quota_id = NEW.quota_id
+          AND session.wallet_session_id = NEW.wallet_session_id)
+    ) AND destination.state != 'activated'))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER authorization_wallet_session_quotas_inactive_import_delete
+BEFORE DELETE ON authorization_wallet_session_quotas
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = OLD.namespace AND (
+      EXISTS (SELECT 1 FROM wallet_relocation_authorization_import_receipts AS receipt
+        WHERE receipt.namespace = destination.namespace AND receipt.org_id = destination.org_id
+          AND receipt.project_id = destination.project_id AND receipt.env_id = destination.env_id
+          AND receipt.wallet_id = destination.wallet_id AND receipt.table_name = 'authorization_wallet_session_quotas'
+          AND receipt.record_key = json_array(OLD.namespace, OLD.quota_id, OLD.tenant_id))
+      OR EXISTS (SELECT 1 FROM wallet_session_authorizations_v2 AS session
+        WHERE session.namespace = destination.namespace AND session.org_id = destination.org_id
+          AND session.project_id = destination.project_id AND session.env_id = destination.env_id
+          AND session.wallet_id = destination.wallet_id AND session.namespace = OLD.namespace
+          AND session.tenant_id = OLD.tenant_id AND session.quota_id = OLD.quota_id
+          AND session.wallet_session_id = OLD.wallet_session_id)
+    ) AND destination.state != 'activated'))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER wallet_session_authorizations_v2_inactive_import_insert
+BEFORE INSERT ON wallet_session_authorizations_v2
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+      AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+      AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated') AND NOT EXISTS (
+      SELECT 1 FROM wallet_relocation_authorization_import_context AS context
+      JOIN wallet_relocation_authorization_imports AS destination
+        ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+        AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+        AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+        AND destination.request_digest_hex = context.request_digest_hex
+        AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+      WHERE context.namespace = NEW.namespace AND context.wallet_id = NEW.wallet_id
+        AND context.table_name = 'wallet_session_authorizations_v2'
+        AND context.record_key = json_array(NEW.authorization_id, NEW.env_id, NEW.namespace, NEW.org_id, NEW.project_id, NEW.tenant_id)
+    ))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER wallet_session_authorizations_v2_inactive_import_update
+BEFORE UPDATE ON wallet_session_authorizations_v2
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+      AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+      AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated')) OR (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+      AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+      AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated'))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER wallet_session_authorizations_v2_inactive_import_delete
+BEFORE DELETE ON wallet_session_authorizations_v2
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+      AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+      AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated'))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER wallet_session_hosted_credentials_v2_inactive_import_insert
+BEFORE INSERT ON wallet_session_hosted_credentials_v2
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+      AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+      AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated') AND NOT EXISTS (
+      SELECT 1 FROM wallet_relocation_authorization_import_context AS context
+      JOIN wallet_relocation_authorization_imports AS destination
+        ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+        AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+        AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+        AND destination.request_digest_hex = context.request_digest_hex
+        AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+      WHERE context.namespace = NEW.namespace AND context.wallet_id = NEW.wallet_id
+        AND context.table_name = 'wallet_session_hosted_credentials_v2'
+        AND context.record_key = json_array(NEW.env_id, NEW.hosted_credential_id, NEW.namespace, NEW.org_id, NEW.project_id, NEW.tenant_id)
+    ))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER wallet_session_hosted_credentials_v2_inactive_import_update
+BEFORE UPDATE ON wallet_session_hosted_credentials_v2
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+      AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+      AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated')) OR (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+      AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+      AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated'))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER wallet_session_hosted_credentials_v2_inactive_import_delete
+BEFORE DELETE ON wallet_session_hosted_credentials_v2
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+      AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+      AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated'))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER wallet_session_hosted_exchange_codes_v2_inactive_import_insert
+BEFORE INSERT ON wallet_session_hosted_exchange_codes_v2
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+      AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+      AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated') AND NOT EXISTS (
+      SELECT 1 FROM wallet_relocation_authorization_import_context AS context
+      JOIN wallet_relocation_authorization_imports AS destination
+        ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+        AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+        AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+        AND destination.request_digest_hex = context.request_digest_hex
+        AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+      WHERE context.namespace = NEW.namespace AND context.wallet_id = NEW.wallet_id
+        AND context.table_name = 'wallet_session_hosted_exchange_codes_v2'
+        AND context.record_key = json_array(NEW.env_id, NEW.exchange_code_id, NEW.namespace, NEW.org_id, NEW.project_id, NEW.tenant_id)
+    ))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER wallet_session_hosted_exchange_codes_v2_inactive_import_update
+BEFORE UPDATE ON wallet_session_hosted_exchange_codes_v2
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+      AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+      AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated')) OR (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+      AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+      AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated'))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER wallet_session_hosted_exchange_codes_v2_inactive_import_delete
+BEFORE DELETE ON wallet_session_hosted_exchange_codes_v2
+WHEN (EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+    WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+      AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+      AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated'))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;

package/migrations/d1-signer/0057_wallet_authorization_intake.sql

@@ -0,0 +1,44 @@
+CREATE TABLE wallet_relocation_authorization_intakes (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL, move_id TEXT NOT NULL, request_digest_hex TEXT NOT NULL,
+  source_generation INTEGER NOT NULL, manifest_json TEXT NOT NULL CHECK(json_valid(manifest_json)),
+  next_index INTEGER NOT NULL DEFAULT 0 CHECK(next_index >= 0),
+  record_count INTEGER NOT NULL DEFAULT 0 CHECK(record_count >= 0),
+  digest_hex TEXT NOT NULL,
+  state TEXT NOT NULL DEFAULT 'receiving' CHECK(state IN ('receiving', 'verified')),
+  PRIMARY KEY(namespace, org_id, project_id, env_id, wallet_id)
+);
+CREATE TABLE wallet_relocation_authorization_intake_chunks (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL, chunk_index INTEGER NOT NULL CHECK(chunk_index >= 0),
+  chunk_json TEXT NOT NULL CHECK(json_valid(chunk_json) AND length(CAST(chunk_json AS BLOB)) <= 131072),
+  digest_hex TEXT NOT NULL,
+  PRIMARY KEY(namespace, org_id, project_id, env_id, wallet_id, chunk_index)
+);
+CREATE TRIGGER wallet_authorization_intake_identity_immutable
+BEFORE UPDATE ON wallet_relocation_authorization_intakes
+WHEN NEW.namespace IS NOT OLD.namespace OR NEW.org_id IS NOT OLD.org_id
+  OR NEW.project_id IS NOT OLD.project_id OR NEW.env_id IS NOT OLD.env_id
+  OR NEW.wallet_id IS NOT OLD.wallet_id OR NEW.move_id IS NOT OLD.move_id
+  OR NEW.request_digest_hex IS NOT OLD.request_digest_hex OR NEW.source_generation IS NOT OLD.source_generation
+  OR NEW.manifest_json IS NOT OLD.manifest_json OR OLD.state = 'verified'
+  OR NEW.next_index < OLD.next_index OR NEW.next_index > OLD.next_index + 1
+  OR NEW.record_count < OLD.record_count OR NEW.record_count > OLD.record_count + 1
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_intake_immutable'); END;
+CREATE TRIGGER wallet_authorization_intake_retained
+BEFORE DELETE ON wallet_relocation_authorization_intakes
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_intake_retained'); END;
+CREATE TRIGGER wallet_authorization_intake_chunk_immutable
+BEFORE UPDATE ON wallet_relocation_authorization_intake_chunks
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_intake_chunk_immutable'); END;
+CREATE TRIGGER wallet_authorization_intake_chunk_retained
+BEFORE DELETE ON wallet_relocation_authorization_intake_chunks
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_intake_chunk_retained'); END;
+CREATE TRIGGER wallet_authorization_intake_chunk_admission
+BEFORE INSERT ON wallet_relocation_authorization_intake_chunks
+WHEN NOT EXISTS (SELECT 1 FROM wallet_relocation_authorization_intakes AS intake
+  WHERE intake.namespace = NEW.namespace AND intake.org_id = NEW.org_id
+    AND intake.project_id = NEW.project_id AND intake.env_id = NEW.env_id
+    AND intake.wallet_id = NEW.wallet_id AND intake.state = 'receiving'
+    AND intake.next_index = NEW.chunk_index)
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_intake_chunk_out_of_order'); END;

package/migrations/d1-signer/0058_wallet_ceremony_activity.sql

@@ -0,0 +1,59 @@
+-- Ceremony state and its wallet activity projection commit in one transaction.
+CREATE TABLE wallet_ceremony_activity (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  record_key TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  settled INTEGER NOT NULL CHECK (settled IN (0, 1)),
+  PRIMARY KEY (namespace, org_id, project_id, env_id, record_key),
+  FOREIGN KEY (namespace, org_id, project_id, env_id, record_key)
+    REFERENCES router_ab_yao_versioned_json_records (namespace, org_id, project_id, env_id, record_key)
+    ON DELETE CASCADE
+);
+CREATE INDEX wallet_ceremony_activity_by_wallet
+  ON wallet_ceremony_activity (namespace, org_id, project_id, env_id, wallet_id, settled);
+
+CREATE TRIGGER wallet_ceremony_activity_owner_immutable
+BEFORE UPDATE ON wallet_ceremony_activity
+WHEN NEW.wallet_id IS NOT OLD.wallet_id
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_ceremony_owner_changed');
+END;
+
+CREATE TRIGGER wallet_ceremony_activity_retired_insert
+BEFORE INSERT ON wallet_ceremony_activity
+WHEN NEW.settled = 0 AND EXISTS (
+  SELECT 1 FROM wallet_relocation_session_fences AS fence
+  WHERE fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+    AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id
+    AND fence.wallet_id = NEW.wallet_id
+)
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_ceremony_admission_closed');
+END;
+
+CREATE TRIGGER wallet_ceremony_activity_retired_update
+BEFORE UPDATE ON wallet_ceremony_activity
+WHEN NEW.settled = 0 AND EXISTS (
+  SELECT 1 FROM wallet_relocation_session_fences AS fence
+  WHERE fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+    AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id
+    AND fence.wallet_id = NEW.wallet_id
+)
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_ceremony_admission_closed');
+END;
+
+CREATE TRIGGER wallet_relocation_sessions_require_settled_ceremonies
+BEFORE INSERT ON wallet_relocation_session_fences
+WHEN EXISTS (
+  SELECT 1 FROM wallet_ceremony_activity AS activity
+  WHERE activity.namespace = NEW.namespace AND activity.org_id = NEW.org_id
+    AND activity.project_id = NEW.project_id AND activity.env_id = NEW.env_id
+    AND activity.wallet_id = NEW.wallet_id AND activity.settled = 0
+)
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_ceremonies_unsettled');
+END;

package/migrations/d1-signer/0059_wallet_authorization_activation.sql

@@ -0,0 +1,45 @@
+CREATE TABLE wallet_relocation_authorization_activations (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL, move_id TEXT NOT NULL, request_digest_hex TEXT NOT NULL,
+  source_generation INTEGER NOT NULL,
+  command_digest TEXT NOT NULL CHECK(length(command_digest) = 64 AND command_digest NOT GLOB '*[^a-f0-9]*'),
+  manifest_json TEXT NOT NULL CHECK(json_valid(manifest_json)),
+  activated_at_ms INTEGER NOT NULL CHECK(activated_at_ms > 0),
+  PRIMARY KEY(namespace, org_id, project_id, env_id, wallet_id, move_id)
+);
+
+CREATE TRIGGER wallet_authorization_activation_verified
+BEFORE INSERT ON wallet_relocation_authorization_activations
+WHEN NOT EXISTS (
+  SELECT 1 FROM wallet_relocation_authorization_intakes AS intake
+  JOIN wallet_relocation_authorization_imports AS imported
+    USING(namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex, source_generation)
+  WHERE intake.namespace = NEW.namespace AND intake.org_id = NEW.org_id
+    AND intake.project_id = NEW.project_id AND intake.env_id = NEW.env_id
+    AND intake.wallet_id = NEW.wallet_id AND intake.move_id = NEW.move_id
+    AND intake.request_digest_hex = NEW.request_digest_hex AND intake.source_generation = NEW.source_generation
+    AND intake.state = 'verified' AND imported.state = 'closed' AND intake.manifest_json = NEW.manifest_json
+) OR EXISTS (
+  SELECT 1 FROM wallet_relocation_session_fences AS fence
+  WHERE fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+    AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id AND fence.wallet_id = NEW.wallet_id
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_activation_requires_verified_destination'); END;
+
+CREATE TRIGGER wallet_authorization_activation_immutable
+BEFORE UPDATE ON wallet_relocation_authorization_activations
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_activation_immutable'); END;
+CREATE TRIGGER wallet_authorization_activation_retained
+BEFORE DELETE ON wallet_relocation_authorization_activations
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_activation_retained'); END;
+
+CREATE TRIGGER wallet_authorization_import_activation_receipt
+BEFORE UPDATE ON wallet_relocation_authorization_imports
+WHEN NEW.state = 'activated' AND OLD.state != 'activated' AND NOT EXISTS (
+  SELECT 1 FROM wallet_relocation_authorization_activations AS receipt
+  WHERE receipt.namespace = NEW.namespace AND receipt.org_id = NEW.org_id
+    AND receipt.project_id = NEW.project_id AND receipt.env_id = NEW.env_id
+    AND receipt.wallet_id = NEW.wallet_id AND receipt.move_id = NEW.move_id
+    AND receipt.request_digest_hex = NEW.request_digest_hex AND receipt.source_generation = NEW.source_generation
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_activation_receipt_required'); END;