@seams/wallet-server 0.7.3 → 0.9.0

package/migrations/d1-signer/0073_wallet_recovery_relocation.sql

@@ -0,0 +1,86 @@
+-- Reject unfinished transfers. Completed receipts remain immutable.
+CREATE TABLE wallet_recovery_relocation_upgrade_guard (count INTEGER NOT NULL CHECK (count = 0));
+INSERT INTO wallet_recovery_relocation_upgrade_guard
+SELECT (SELECT COUNT(*) FROM wallet_relocation_authorization_snapshots AS snapshot
+        WHERE NOT EXISTS (
+          SELECT 1 FROM wallet_relocation_authorization_cleanups AS cleanup
+          WHERE cleanup.namespace = snapshot.namespace AND cleanup.org_id = snapshot.org_id
+            AND cleanup.project_id = snapshot.project_id AND cleanup.env_id = snapshot.env_id
+            AND cleanup.wallet_id = snapshot.wallet_id AND cleanup.move_id = snapshot.move_id
+            AND cleanup.request_digest_hex = snapshot.request_digest_hex
+            AND cleanup.source_generation = snapshot.source_generation
+            AND cleanup.state = 'cleaned'))
+     + (SELECT COUNT(*) FROM wallet_relocation_authorization_imports WHERE state != 'activated');
+DROP TABLE wallet_recovery_relocation_upgrade_guard;
+
+CREATE TRIGGER wallet_recovery_code_locators_relocation_frozen_insert
+BEFORE INSERT ON wallet_recovery_code_locators
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+  WHERE fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+    AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id
+    AND fence.wallet_id = NEW.wallet_id)
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_history_frozen'); END;
+
+CREATE TRIGGER wallet_recovery_code_locators_relocation_frozen_update
+BEFORE UPDATE ON wallet_recovery_code_locators
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+  WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+    AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+    AND fence.wallet_id = OLD.wallet_id)
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_history_frozen'); END;
+
+CREATE TRIGGER wallet_recovery_code_locators_relocation_frozen_delete
+BEFORE DELETE ON wallet_recovery_code_locators
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+  WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+    AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+    AND fence.wallet_id = OLD.wallet_id
+    AND NOT EXISTS (SELECT 1 FROM wallet_relocation_authorization_cleanups AS cleanup
+      WHERE cleanup.namespace = fence.namespace AND cleanup.org_id = fence.org_id
+        AND cleanup.project_id = fence.project_id AND cleanup.env_id = fence.env_id
+        AND cleanup.wallet_id = fence.wallet_id AND cleanup.move_id = fence.move_id
+        AND cleanup.request_digest_hex = fence.request_digest_hex
+        AND cleanup.source_generation = fence.source_generation AND cleanup.state = 'cleaning'))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_history_frozen'); END;
+
+CREATE TRIGGER wallet_recovery_code_locators_relocation_inactive_insert
+BEFORE INSERT ON wallet_recovery_code_locators
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+  WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+    AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+    AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated')
+  AND NOT EXISTS (SELECT 1 FROM wallet_relocation_authorization_import_context AS context
+    JOIN wallet_relocation_authorization_imports AS destination
+      ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+      AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+      AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+      AND destination.request_digest_hex = context.request_digest_hex
+      AND destination.source_generation = context.source_generation
+    WHERE context.namespace = NEW.namespace AND context.org_id = NEW.org_id
+    AND context.project_id = NEW.project_id AND context.env_id = NEW.env_id
+    AND context.wallet_id = NEW.wallet_id
+      AND destination.state = 'importing' AND context.table_name = 'wallet_recovery_code_locators'
+      AND context.record_key = json_array(NEW.env_id, NEW.locator_b64u, NEW.namespace, NEW.org_id, NEW.project_id))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER wallet_recovery_code_locators_relocation_inactive_update
+BEFORE UPDATE ON wallet_recovery_code_locators
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+  WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+    AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+    AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated')
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER wallet_recovery_code_locators_relocation_inactive_delete
+BEFORE DELETE ON wallet_recovery_code_locators
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+  WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+    AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+    AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated')
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER wallet_recovery_code_locators_relocation_owner_immutable
+BEFORE UPDATE ON wallet_recovery_code_locators
+WHEN NEW.namespace IS NOT OLD.namespace OR NEW.org_id IS NOT OLD.org_id OR NEW.project_id IS NOT OLD.project_id OR NEW.env_id IS NOT OLD.env_id OR NEW.wallet_id IS NOT OLD.wallet_id
+BEGIN SELECT RAISE(ABORT, 'wallet_record_owner_changed'); END;
+

package/migrations/d1-signer/0074_email_otp_relocation.sql

@@ -0,0 +1,158 @@
+-- Snapshot inventories must not change during an in-progress transfer.
+CREATE TABLE wallet_email_auth_relocation_upgrade_guard (count INTEGER NOT NULL CHECK (count = 0));
+INSERT INTO wallet_email_auth_relocation_upgrade_guard
+SELECT (SELECT COUNT(*) FROM wallet_relocation_authorization_snapshots AS snapshot
+        WHERE NOT EXISTS (
+          SELECT 1 FROM wallet_relocation_authorization_cleanups AS cleanup
+          WHERE cleanup.namespace = snapshot.namespace AND cleanup.org_id = snapshot.org_id
+            AND cleanup.project_id = snapshot.project_id AND cleanup.env_id = snapshot.env_id
+            AND cleanup.wallet_id = snapshot.wallet_id AND cleanup.move_id = snapshot.move_id
+            AND cleanup.request_digest_hex = snapshot.request_digest_hex
+            AND cleanup.source_generation = snapshot.source_generation
+            AND cleanup.state = 'cleaned'))
+     + (SELECT COUNT(*) FROM wallet_relocation_authorization_imports WHERE state != 'activated');
+DROP TABLE wallet_email_auth_relocation_upgrade_guard;
+
+-- Enrollment and lockout state follow the wallet, including its sealed factor.
+
+CREATE TRIGGER email_otp_wallet_enrollments_relocation_frozen_insert
+BEFORE INSERT ON email_otp_wallet_enrollments
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+  WHERE fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+    AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id
+    AND fence.wallet_id = NEW.wallet_id)
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_history_frozen'); END;
+
+CREATE TRIGGER email_otp_wallet_enrollments_relocation_frozen_update
+BEFORE UPDATE ON email_otp_wallet_enrollments
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+  WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+    AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+    AND fence.wallet_id = OLD.wallet_id)
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_history_frozen'); END;
+
+CREATE TRIGGER email_otp_wallet_enrollments_relocation_frozen_delete
+BEFORE DELETE ON email_otp_wallet_enrollments
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+  WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+    AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+    AND fence.wallet_id = OLD.wallet_id
+    AND NOT EXISTS (SELECT 1 FROM wallet_relocation_authorization_cleanups AS cleanup
+      WHERE cleanup.namespace = fence.namespace AND cleanup.org_id = fence.org_id
+        AND cleanup.project_id = fence.project_id AND cleanup.env_id = fence.env_id
+        AND cleanup.wallet_id = fence.wallet_id AND cleanup.move_id = fence.move_id
+        AND cleanup.request_digest_hex = fence.request_digest_hex
+        AND cleanup.source_generation = fence.source_generation AND cleanup.state = 'cleaning'))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_history_frozen'); END;
+
+CREATE TRIGGER email_otp_wallet_enrollments_relocation_inactive_insert
+BEFORE INSERT ON email_otp_wallet_enrollments
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+  WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+    AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+    AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated')
+  AND NOT EXISTS (SELECT 1 FROM wallet_relocation_authorization_import_context AS context
+    JOIN wallet_relocation_authorization_imports AS destination
+      ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+      AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+      AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+      AND destination.request_digest_hex = context.request_digest_hex
+      AND destination.source_generation = context.source_generation
+    WHERE context.namespace = NEW.namespace AND context.org_id = NEW.org_id
+    AND context.project_id = NEW.project_id AND context.env_id = NEW.env_id
+    AND context.wallet_id = NEW.wallet_id
+      AND destination.state = 'importing' AND context.table_name = 'email_otp_wallet_enrollments'
+      AND context.record_key = json_array(NEW.env_id, NEW.namespace, NEW.org_id, NEW.project_id, NEW.wallet_id))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER email_otp_wallet_enrollments_relocation_inactive_update
+BEFORE UPDATE ON email_otp_wallet_enrollments
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+  WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+    AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+    AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated')
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER email_otp_wallet_enrollments_relocation_inactive_delete
+BEFORE DELETE ON email_otp_wallet_enrollments
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+  WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+    AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+    AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated')
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER email_otp_wallet_enrollments_relocation_owner_immutable
+BEFORE UPDATE ON email_otp_wallet_enrollments
+WHEN NEW.namespace IS NOT OLD.namespace OR NEW.org_id IS NOT OLD.org_id OR NEW.project_id IS NOT OLD.project_id OR NEW.env_id IS NOT OLD.env_id OR NEW.wallet_id IS NOT OLD.wallet_id
+BEGIN SELECT RAISE(ABORT, 'wallet_record_owner_changed'); END;
+
+CREATE TRIGGER email_otp_auth_states_relocation_frozen_insert
+BEFORE INSERT ON email_otp_auth_states
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+  WHERE fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+    AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id
+    AND fence.wallet_id = NEW.wallet_id)
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_history_frozen'); END;
+
+CREATE TRIGGER email_otp_auth_states_relocation_frozen_update
+BEFORE UPDATE ON email_otp_auth_states
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+  WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+    AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+    AND fence.wallet_id = OLD.wallet_id)
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_history_frozen'); END;
+
+CREATE TRIGGER email_otp_auth_states_relocation_frozen_delete
+BEFORE DELETE ON email_otp_auth_states
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+  WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+    AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+    AND fence.wallet_id = OLD.wallet_id
+    AND NOT EXISTS (SELECT 1 FROM wallet_relocation_authorization_cleanups AS cleanup
+      WHERE cleanup.namespace = fence.namespace AND cleanup.org_id = fence.org_id
+        AND cleanup.project_id = fence.project_id AND cleanup.env_id = fence.env_id
+        AND cleanup.wallet_id = fence.wallet_id AND cleanup.move_id = fence.move_id
+        AND cleanup.request_digest_hex = fence.request_digest_hex
+        AND cleanup.source_generation = fence.source_generation AND cleanup.state = 'cleaning'))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_history_frozen'); END;
+
+CREATE TRIGGER email_otp_auth_states_relocation_inactive_insert
+BEFORE INSERT ON email_otp_auth_states
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+  WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+    AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+    AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated')
+  AND NOT EXISTS (SELECT 1 FROM wallet_relocation_authorization_import_context AS context
+    JOIN wallet_relocation_authorization_imports AS destination
+      ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+      AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+      AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+      AND destination.request_digest_hex = context.request_digest_hex
+      AND destination.source_generation = context.source_generation
+    WHERE context.namespace = NEW.namespace AND context.org_id = NEW.org_id
+    AND context.project_id = NEW.project_id AND context.env_id = NEW.env_id
+    AND context.wallet_id = NEW.wallet_id
+      AND destination.state = 'importing' AND context.table_name = 'email_otp_auth_states'
+      AND context.record_key = json_array(NEW.env_id, NEW.namespace, NEW.org_id, NEW.project_id, NEW.wallet_id))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER email_otp_auth_states_relocation_inactive_update
+BEFORE UPDATE ON email_otp_auth_states
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+  WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+    AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+    AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated')
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER email_otp_auth_states_relocation_inactive_delete
+BEFORE DELETE ON email_otp_auth_states
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+  WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+    AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+    AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated')
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER email_otp_auth_states_relocation_owner_immutable
+BEFORE UPDATE ON email_otp_auth_states
+WHEN NEW.namespace IS NOT OLD.namespace OR NEW.org_id IS NOT OLD.org_id OR NEW.project_id IS NOT OLD.project_id OR NEW.env_id IS NOT OLD.env_id OR NEW.wallet_id IS NOT OLD.wallet_id
+BEGIN SELECT RAISE(ABORT, 'wallet_record_owner_changed'); END;

package/migrations/d1-signer/0075_wallet_authorization_return.sql

@@ -0,0 +1,107 @@
+-- A cleaned location can host a later generation without erasing old cleanup receipts.
+CREATE TABLE wallet_relocation_authorization_returns (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL, move_id TEXT NOT NULL, request_digest_hex TEXT NOT NULL,
+  source_generation INTEGER NOT NULL,
+  previous_move_id TEXT NOT NULL, previous_request_digest_hex TEXT NOT NULL,
+  retired_generation INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id, move_id),
+  UNIQUE (namespace, org_id, project_id, env_id, wallet_id, retired_generation),
+  CHECK (retired_generation > 0 AND source_generation > retired_generation)
+);
+
+CREATE TRIGGER wallet_authorization_return_cleaned
+BEFORE INSERT ON wallet_relocation_authorization_returns
+WHEN NOT EXISTS (
+  SELECT 1 FROM wallet_relocation_authorization_cleanups AS cleanup
+  JOIN wallet_execution_generations AS execution USING (namespace, org_id, project_id, env_id, wallet_id)
+  WHERE cleanup.namespace = NEW.namespace AND cleanup.org_id = NEW.org_id
+    AND cleanup.project_id = NEW.project_id AND cleanup.env_id = NEW.env_id
+    AND cleanup.wallet_id = NEW.wallet_id AND cleanup.move_id = NEW.previous_move_id
+    AND cleanup.request_digest_hex = NEW.previous_request_digest_hex
+    AND cleanup.source_generation = NEW.retired_generation AND cleanup.state = 'cleaned'
+    AND execution.generation = NEW.retired_generation AND execution.state = 'retired'
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_return_requires_cleanup'); END;
+
+CREATE TRIGGER wallet_authorization_return_immutable
+BEFORE UPDATE ON wallet_relocation_authorization_returns
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_return_immutable'); END;
+CREATE TRIGGER wallet_authorization_return_retained
+BEFORE DELETE ON wallet_relocation_authorization_returns
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_return_retained'); END;
+
+DROP TRIGGER wallet_relocation_authorization_import_retain;
+CREATE TRIGGER wallet_relocation_authorization_import_retain
+BEFORE DELETE ON wallet_relocation_authorization_imports
+WHEN NOT EXISTS (
+  SELECT 1 FROM wallet_relocation_authorization_returns AS returned
+  WHERE returned.namespace = OLD.namespace AND returned.org_id = OLD.org_id
+    AND returned.project_id = OLD.project_id AND returned.env_id = OLD.env_id
+    AND returned.wallet_id = OLD.wallet_id
+    AND OLD.source_generation + 1 = returned.retired_generation AND OLD.state = 'activated'
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_history_import_retained'); END;
+
+DROP TRIGGER wallet_authorization_intake_retained;
+CREATE TRIGGER wallet_authorization_intake_retained
+BEFORE DELETE ON wallet_relocation_authorization_intakes
+WHEN NOT EXISTS (
+  SELECT 1 FROM wallet_relocation_authorization_returns AS returned
+  WHERE returned.namespace = OLD.namespace AND returned.org_id = OLD.org_id
+    AND returned.project_id = OLD.project_id AND returned.env_id = OLD.env_id
+    AND returned.wallet_id = OLD.wallet_id
+    AND OLD.source_generation + 1 = returned.retired_generation AND OLD.state = 'verified'
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_intake_retained'); END;
+
+DROP TRIGGER wallet_authorization_snapshot_delete;
+CREATE TRIGGER wallet_authorization_snapshot_delete
+BEFORE DELETE ON wallet_relocation_authorization_snapshots
+WHEN NOT EXISTS (
+  SELECT 1 FROM wallet_relocation_authorization_returns AS returned
+  WHERE returned.namespace = OLD.namespace AND returned.org_id = OLD.org_id
+    AND returned.project_id = OLD.project_id AND returned.env_id = OLD.env_id
+    AND returned.wallet_id = OLD.wallet_id AND OLD.source_generation = returned.retired_generation
+    AND OLD.move_id = returned.previous_move_id
+    AND OLD.request_digest_hex = returned.previous_request_digest_hex
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_snapshot_retained'); END;
+
+DROP TRIGGER wallet_relocation_authorization_fences_retain;
+CREATE TRIGGER wallet_relocation_authorization_fences_retain
+BEFORE DELETE ON wallet_relocation_authorization_fences
+WHEN NOT EXISTS (
+  SELECT 1 FROM wallet_relocation_authorization_returns AS returned
+  WHERE returned.namespace = OLD.namespace AND returned.org_id = OLD.org_id
+    AND returned.project_id = OLD.project_id AND returned.env_id = OLD.env_id
+    AND returned.wallet_id = OLD.wallet_id AND OLD.source_generation = returned.retired_generation
+    AND OLD.move_id = returned.previous_move_id
+    AND OLD.request_digest_hex = returned.previous_request_digest_hex
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_fence_retained'); END;
+
+DROP TRIGGER wallet_relocation_session_fences_retain;
+CREATE TRIGGER wallet_relocation_session_fences_retain
+BEFORE DELETE ON wallet_relocation_session_fences
+WHEN NOT EXISTS (
+  SELECT 1 FROM wallet_relocation_authorization_returns AS returned
+  WHERE returned.namespace = OLD.namespace AND returned.org_id = OLD.org_id
+    AND returned.project_id = OLD.project_id AND returned.env_id = OLD.env_id
+    AND returned.wallet_id = OLD.wallet_id AND OLD.source_generation = returned.retired_generation
+    AND OLD.move_id = returned.previous_move_id
+    AND OLD.request_digest_hex = returned.previous_request_digest_hex
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_relocation_session_fence_retained'); END;
+
+DROP TRIGGER wallet_execution_retained;
+CREATE TRIGGER wallet_execution_retained
+BEFORE DELETE ON wallet_execution_generations
+WHEN NOT EXISTS (
+  SELECT 1 FROM wallet_relocation_authorization_returns AS returned
+  WHERE returned.namespace = OLD.namespace AND returned.org_id = OLD.org_id
+    AND returned.project_id = OLD.project_id AND returned.env_id = OLD.env_id
+    AND returned.wallet_id = OLD.wallet_id
+    AND OLD.generation = returned.retired_generation AND OLD.state = 'retired'
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_execution_identity_retained'); END;