DROP TRIGGER IF EXISTS `provisioning_queue_guard`;--> statement-breakpoint

CREATE TRIGGER `provisioning_queue_guard`
BEFORE INSERT ON `provisioning_operations`
WHEN NEW.`status` = 'requested'
BEGIN
  SELECT CASE WHEN NOT EXISTS (
    SELECT 1
    FROM `tenant_instances`
    WHERE `id` = NEW.`tenant_id`
      AND `desired_generation` + 1 = NEW.`target_generation`
      AND `credential_revision` = NEW.`credential_revision`
      AND `tombstoned_at` IS NULL
      AND (
        (NEW.`operation` = 'ensure' AND `lifecycle` IN ('requested', 'ready', 'failed', 'degraded'))
        OR (NEW.`operation` = 'suspend' AND `lifecycle` IN ('ready', 'degraded'))
        OR (NEW.`operation` = 'resume' AND `lifecycle` IN ('suspended', 'failed'))
        OR (NEW.`operation` = 'deprovision' AND `lifecycle` IN ('requested', 'ready', 'suspended', 'failed', 'degraded'))
      )
  ) THEN RAISE(ABORT, 'invalid_provisioning_transition') END;
END;