-- Run only by the admitted migration role in its existing owner schema.
-- Does not create a database/schema/credential, admit an epoch or clear quarantine.
CREATE TABLE identity_provisioner.group_journal_meta (
    singleton boolean PRIMARY KEY CHECK (singleton = true),
    epoch uuid NOT NULL,
    directory text NOT NULL CHECK (octet_length(directory) BETWEEN 1 AND 1024),
    head bigint NOT NULL CHECK (head >= 0),
    head_digest text NOT NULL CHECK (head_digest ~ '^[0-9a-f]{64}$'),
    quarantined boolean NOT NULL DEFAULT true
);
CREATE TABLE identity_provisioner.group_receipts (
    context_digest text NOT NULL CHECK (context_digest ~ '^[0-9a-f]{64}$'),
    context_json text NOT NULL CHECK (octet_length(context_json) <= 16384),
    key text NOT NULL CHECK (char_length(key) BETWEEN 1 AND 256),
    binding text NOT NULL CHECK (binding ~ '^[0-9a-f]{64}$'),
    version bigint NOT NULL CHECK (version >= 1),
    state text NOT NULL CHECK (state IN ('pending','ensured','revoking','revoked','uncertain','refused')),
    active boolean UNIQUE CHECK (active IS NULL OR active = true),
    body text NOT NULL CHECK (octet_length(body) <= 1048576),
    PRIMARY KEY (context_digest, key)
);
-- Epoch insertion, initial continuity checkpoint and admission are separate
-- owner actions; this migration leaves all operations refused without them.