slotlock 0.2.0 → 0.3.0

package/config.js

@@ -136,3 +136,195 @@ export function readDashboardConfig(env) {
         allowedUsers: users === '*' ? '*' : [...new Set(users.split(','))],
     };
 }
+/** The token buckets `slotlock serve` keeps (SLOTLOCK_LIMITS), each counted per its own key. */
+export const SLOTLOCK_RATE_NAMES = Object.freeze([
+    'address',
+    'key_read',
+    'key_write',
+    'tenant_read',
+    'tenant_write',
+    'global_read',
+    'global_write',
+    'app_read',
+    'app_write',
+    'sign_in',
+]);
+/** The counts `slotlock serve` caps (SLOTLOCK_LIMITS), with the range each may be set to. */
+const CAP_RANGES = Object.freeze({
+    tenant_series_writes: [1, 100],
+    series_writes: [1, 100],
+    maintenance_runs: [1, 100],
+    subscriptions: [1, 10_000],
+    tenant_subscriptions: [1, 10_000],
+    key_subscriptions: [1, 64],
+    key_lookups: [1, 8],
+    key_lookup_queue: [0, 10_000],
+    // serve's pool has 10 connections: more than that bounds nothing.
+    tenant_transactions: [1, 10],
+    tenant_holds: [1, 10_000_000],
+    tenant_reservations: [1, 10_000_000],
+    tenant_events: [1, 10_000_000],
+    tenant_coverage: [1, 10_000_000],
+});
+export const SLOTLOCK_CAP_NAMES = Object.freeze(Object.keys(CAP_RANGES));
+/**
+ * What `slotlock serve` allows unless SLOTLOCK_LIMITS says otherwise, sized for one public server on
+ * one CPU (the 2026-10-24 readiness audit measured the database at about 900 writes a second):
+ * - `address`: every request from one client address, before any credential is looked up.
+ * - `key_*`, `tenant_*`, `global_*`: an authenticated request takes a read token from its key, its
+ *   tenant and the server; a write (a REST method other than GET or HEAD, or a write tool) takes a
+ *   write token from each as well.
+ * - `app_*`: a request to the application API (application-api.ts) from an admin key takes its
+ *   read and write tokens from its tenant's application buckets instead of the key and tenant ones,
+ *   so the application and the tenant's agents cannot use up each other's budget; one from any
+ *   other key takes them from that key's own. `global_*` counts it as well.
+ * - `sign_in`: dashboard sign-ins and their callbacks from one client network: an IPv4 address,
+ *   or an IPv6 client's /48 (slotlockClientNetwork in rate-limit.ts), as the dashboard Worker
+ *   counts them.
+ * - `tenant_series_writes` and `series_writes`: writes that may expand a recurring series (a
+ *   recurring create, any update) running at once in a tenant and in each server process.
+ * - `maintenance_runs`: the application API's maintenance runs at once in each server process, one
+ *   a tenant, in slots of their own. A freed slot of either kind rests for as long as the event
+ *   loop was busy while its write held it, up to a second, then goes to the tenant with the fewest
+ *   writes in flight and, among those, the least use lately. That keeps a tenant sending one write
+ *   at a time from waiting behind tenants with more, not behind many tenants with one each
+ *   (rate-limit.ts).
+ * - `subscriptions`: MCP live-update streams the server holds open. When it is full, a tenant
+ *   holding fewer than the tenant holding most, less one, ends that tenant's oldest stream.
+ * - `tenant_subscriptions`: of those, how many one tenant may hold.
+ * - `key_subscriptions`: of those, how many one key (or the server token) may hold, and always
+ *   fewer than its tenant's, so one key cannot lock the tenant's other keys out
+ *   (slotlockKeySubscriptions).
+ * - `key_lookups` and `key_lookup_queue`: API key lookups running at once and waiting.
+ * - `tenant_transactions`: store transactions one tenant runs at once on the server's pool of 10
+ *   connections; the rest wait their turn in the process, so a tenant's writes waiting on its own
+ *   locks leave the other connections to other tenants and key lookups. A server with one tenant
+ *   can set 10.
+ * - `tenant_holds`, `tenant_reservations`, `tenant_events` and `tenant_coverage`: what one tenant
+ *   may store, counted as the store's tenant limits count it (SlotlockTenantLimits), whichever key,
+ *   agent or application writes it. Every write surface of the server shares them, so no admin
+ *   key can grow the shared database without end; a write past one answers 409 with its
+ *   `*_limit_reached` code.
+ */
+export const SLOTLOCK_DEFAULT_LIMITS = Object.freeze({
+    rates: Object.freeze({
+        address: { perSecond: 50, burst: 100 },
+        key_read: { perSecond: 20, burst: 40 },
+        key_write: { perSecond: 5, burst: 20 },
+        tenant_read: { perSecond: 20, burst: 40 },
+        tenant_write: { perSecond: 5, burst: 20 },
+        global_read: { perSecond: 500, burst: 1_000 },
+        global_write: { perSecond: 50, burst: 100 },
+        app_read: { perSecond: 20, burst: 40 },
+        app_write: { perSecond: 5, burst: 20 },
+        sign_in: { perSecond: 20 / 60, burst: 20 },
+    }),
+    caps: Object.freeze({
+        tenant_series_writes: 1,
+        series_writes: 1,
+        maintenance_runs: 1,
+        subscriptions: 256,
+        tenant_subscriptions: 16,
+        key_subscriptions: 4,
+        key_lookups: 2,
+        key_lookup_queue: 256,
+        tenant_transactions: 2,
+        // Sized for the server's 10,000 resources a tenant: a live hold for every one, ten bookings and
+        // ten events a resource, and coverage from ten calendars a resource.
+        tenant_holds: 10_000,
+        tenant_reservations: 100_000,
+        tenant_events: 100_000,
+        tenant_coverage: 100_000,
+    }),
+});
+/**
+ * The live-update streams one key may hold open: `key_subscriptions`, but at least one fewer than
+ * its tenant may (unless the tenant may hold only one), so a key at its own limit leaves its
+ * tenant's other keys a stream however the two caps are set.
+ */
+export function slotlockKeySubscriptions(caps) {
+    return Math.max(1, Math.min(caps.key_subscriptions, caps.tenant_subscriptions - 1));
+}
+const RATE_PERIOD_SECONDS = { s: 1, m: 60, h: 3_600 };
+const MAX_RATE_COUNT = 1_000_000;
+/** A rate as SLOTLOCK_LIMITS and the `listening` log line write it: `<count>/<s|m|h>:<burst>`. */
+export function formatSlotlockRate(rate) {
+    if (rate === null)
+        return 'off';
+    // The smallest unit in which the count is whole: 50/s rather than 180000/h.
+    for (const [unit, seconds] of Object.entries(RATE_PERIOD_SECONDS)) {
+        const count = rate.perSecond * seconds;
+        if (Number.isInteger(Math.round(count * 1e9) / 1e9) && count >= 1) {
+            return `${Math.round(count)}/${unit}:${rate.burst}`;
+        }
+    }
+    return `${rate.perSecond}/s:${rate.burst}`;
+}
+/**
+ * SLOTLOCK_LIMITS: comma-separated `name=value` overrides of SLOTLOCK_DEFAULT_LIMITS. A rate is
+ * `<count>/<s|m|h>`, optionally `:<burst>` (default: the count), or `off`; a cap is a whole number.
+ * For example `tenant_write=2/s:10,global_write=30/s,address=off`.
+ */
+export function readLimits(env) {
+    const rates = { ...SLOTLOCK_DEFAULT_LIMITS.rates };
+    const caps = { ...SLOTLOCK_DEFAULT_LIMITS.caps };
+    const value = optional(env, 'SLOTLOCK_LIMITS');
+    if (value === undefined)
+        return { rates, caps };
+    const invalid = (detail) => new SlotlockConfigError(`SLOTLOCK_LIMITS must be comma-separated name=value settings, rates as <count>/<s|m|h>[:<burst>] or off (${SLOTLOCK_RATE_NAMES.join(', ')}) and caps as whole numbers (${SLOTLOCK_CAP_NAMES.join(', ')}): ${detail}`);
+    const seen = new Set();
+    for (const entry of value.split(',').map((part) => part.trim())) {
+        const match = /^([a-z_]+)=(\S+)$/.exec(entry);
+        if (!match)
+            throw invalid(`"${entry.slice(0, 40)}" is not name=value`);
+        const [, name, setting] = match;
+        if (seen.has(name))
+            throw invalid(`${name} is set twice`);
+        seen.add(name);
+        if (SLOTLOCK_RATE_NAMES.includes(name)) {
+            if (setting === 'off') {
+                rates[name] = null;
+                continue;
+            }
+            const rate = /^(\d{1,7})\/([smh])(?::(\d{1,7}))?$/.exec(setting);
+            const count = Number(rate?.[1]);
+            const burst = rate?.[3] === undefined ? count : Number(rate[3]);
+            if (!rate || count < 1 || count > MAX_RATE_COUNT || burst < 1 || burst > MAX_RATE_COUNT) {
+                throw invalid(`${name} must be <count>/<s|m|h>[:<burst>] with each 1-${MAX_RATE_COUNT}, or off`);
+            }
+            rates[name] = {
+                perSecond: count / RATE_PERIOD_SECONDS[rate[2]],
+                burst,
+            };
+        }
+        else if (Object.hasOwn(CAP_RANGES, name)) {
+            const [minimum, maximum] = CAP_RANGES[name];
+            const cap = /^\d{1,8}$/.test(setting) ? Number(setting) : Number.NaN;
+            if (!(cap >= minimum && cap <= maximum)) {
+                throw invalid(`${name} must be a whole number from ${minimum} to ${maximum}`);
+            }
+            caps[name] = cap;
+        }
+        else {
+            throw invalid(`${name.slice(0, 40)} is not a limit`);
+        }
+    }
+    return { rates, caps };
+}
+/** Fields a proxy cannot be trusted to set, because the client sends them to every server. */
+const UNTRUSTABLE_FIELDS = new Set(['authorization', 'cookie', 'host', 'origin', 'content-type']);
+/**
+ * SLOTLOCK_TRUSTED_PROXY_HEADER: the request field holding the client's address, set (and
+ * overwritten) by a proxy every request passes through, such as `CF-Connecting-IP` behind
+ * Cloudflare. Unset, the client address is the connection's. A client can send any field, so set it
+ * only when nothing reaches the server except through that proxy.
+ */
+export function readTrustedProxyHeader(env) {
+    const value = optional(env, 'SLOTLOCK_TRUSTED_PROXY_HEADER');
+    if (value === undefined)
+        return undefined;
+    if (!/^[A-Za-z0-9-]{1,64}$/.test(value) || UNTRUSTABLE_FIELDS.has(value.toLowerCase())) {
+        throw new SlotlockConfigError('SLOTLOCK_TRUSTED_PROXY_HEADER must be the name of a request field your proxy sets to the client address, such as CF-Connecting-IP');
+    }
+    return value.toLowerCase();
+}

package/dashboard.d.ts

@@ -76,6 +76,12 @@ export interface SlotlockDashboardOptions {
     availability?: readonly WeeklyAvailabilityRule[];
     fetch?: typeof fetch;
     now?: () => number;
+    /**
+     * The address a request came from, as the server counts its clients (the socket's, or a trusted
+     * proxy's field such as CF-Connecting-IP), so one client's sign-ins in flight are capped below
+     * every client's. Without it, or when it returns undefined, only the cap on every client applies.
+     */
+    clientAddress?: (request: Request) => string | undefined;
     /**
      * Called with whatever a request handler throws; the person sees a generic error page. Not
      * awaited; what it throws, or its promise rejects with, is ignored.

package/dashboard.js

@@ -26,6 +26,8 @@ const MAX_FORM_BYTES = 8_192;
  * This also bounds how fast unauthenticated callbacks can write sign-in records.
  */
 const MAX_SIGN_INS_IN_FLIGHT = 8;
+/** Of those, how many one client address may run at once, so one client cannot take every slot. */
+const MAX_SIGN_INS_IN_FLIGHT_PER_CLIENT = 2;
 /** Entries each in-memory record keeps (createSlotlockMemoryDashboardState); past this the oldest go first. */
 const MAX_REMEMBERED = 10_000;
 /** A form's single-use value: 18 random bytes, then a MAC binding them to the session. */
@@ -432,6 +434,8 @@ export function createSlotlockDashboard(options) {
     const allowed = (uid) => options.allowedUsers === '*' ||
         (Array.isArray(options.allowedUsers) && options.allowedUsers.includes(uid));
     let signInsInFlight = 0;
+    /** Sign-ins in flight by client address. */
+    const signInsByClient = new Map();
     function report(message) {
         try {
             ignoreRejection(options.onError?.(new Error(message)));
@@ -861,11 +865,16 @@ ${state.unshown
             !safeEqual(state, pending.state)) {
             return signedOutPage(400, SIGN_IN_AGAIN, [clearSignIn]);
         }
-        if (signInsInFlight >= MAX_SIGN_INS_IN_FLIGHT) {
+        const client = options.clientAddress?.(request);
+        const fromClient = client === undefined ? 0 : (signInsByClient.get(client) ?? 0);
+        if (signInsInFlight >= MAX_SIGN_INS_IN_FLIGHT ||
+            fromClient >= MAX_SIGN_INS_IN_FLIGHT_PER_CLIENT) {
             return signedOutPage(503, 'Too many people are signing in at once. Sign in again in a moment.', [clearSignIn]);
         }
         const verifier = pending.verifier;
         signInsInFlight += 1;
+        if (client !== undefined)
+            signInsByClient.set(client, fromClient + 1);
         let user;
         try {
             // Recorded before GitHub is asked, so a replayed callback is refused on every server unasked.
@@ -876,6 +885,13 @@ ${state.unshown
         }
         finally {
             signInsInFlight -= 1;
+            if (client !== undefined) {
+                const left = (signInsByClient.get(client) ?? 1) - 1;
+                if (left === 0)
+                    signInsByClient.delete(client);
+                else
+                    signInsByClient.set(client, left);
+            }
         }
         if (!user) {
             return signedOutPage(502, 'GitHub did not complete the sign-in. Try again.', [clearSignIn]);

package/ddl.d.ts

@@ -1,5 +1,18 @@
 /** The start of the message with which the deployment DDL refuses a `slotlock` schema. */
 export declare const SLOTLOCK_SCHEMA_CONTROL_REFUSAL = "Slotlock will not deploy into schema slotlock";
+/**
+ * The version of the schema this release creates, recorded in `slotlock.schema_version` by every
+ * migration. Releases up to 0.2 recorded nothing; 0.1 was version 1 and 0.2 version 2.
+ */
+export declare const SLOTLOCK_SCHEMA_VERSION = 3;
+/** The start of the message with which the deployment DDL refuses a schema a newer release migrated. */
+export declare const SLOTLOCK_SCHEMA_NEWER_REFUSAL = "Slotlock will not migrate a schema a newer release migrated";
+/**
+ * What every migration checks before it changes anything, applySchema and applyTenantRls included
+ * when they find nothing to change: that no other role controls the schema, then the server version
+ * and the schema version. Run with search_path pinned, as the DDL pins it.
+ */
+export declare const SLOTLOCK_DEPLOYMENT_CHECKS = "DO $slotlock_schema_control$\nDECLARE\n  refusals text[];\nBEGIN\n  SELECT pg_catalog.array_agg(refusal.reason ORDER BY refusal.reason)\n    INTO refusals\n    FROM (\n      SELECT 'schema slotlock is owned by ' || owned_by.rolname AS reason\n        FROM pg_catalog.pg_namespace ns\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = ns.nspowner\n       WHERE ns.nspname = 'slotlock'\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n      UNION\n      SELECT COALESCE(grantee_role.rolname, 'PUBLIC') || ' can create objects in schema slotlock'\n        FROM pg_catalog.pg_namespace ns\n       CROSS JOIN LATERAL pg_catalog.aclexplode(ns.nspacl) acl\n        LEFT JOIN pg_catalog.pg_roles grantee_role ON grantee_role.oid = acl.grantee\n       WHERE ns.nspname = 'slotlock'\n         AND acl.privilege_type = 'CREATE'\n         AND acl.grantee <> ns.nspowner\n         AND (acl.grantee = 0\n              OR (grantee_role.rolname <> CURRENT_USER AND NOT grantee_role.rolsuper))\n      UNION\n      SELECT ident.type || ' ' || ident.identity || ' is owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_shdepend owned\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = owned.refobjid\n       CROSS JOIN LATERAL pg_catalog.pg_identify_object(owned.classid, owned.objid, owned.objsubid) ident\n       WHERE owned.dbid = (SELECT db.oid FROM pg_catalog.pg_database db\n                            WHERE db.datname = pg_catalog.current_database())\n         AND owned.deptype = 'o'\n         AND owned.refclassid = 'pg_catalog.pg_authid'::pg_catalog.regclass\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n         AND ident.schema = 'slotlock'\n      UNION\n      SELECT 'trigger ' || trg.tgname || ' on slotlock.' || rel.relname || ' runs '\n             || trg.tgfoid::pg_catalog.regprocedure::pg_catalog.text\n             || ', owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_trigger trg\n        JOIN pg_catalog.pg_class rel ON rel.oid = trg.tgrelid\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = rel.relnamespace\n        JOIN pg_catalog.pg_proc fn ON fn.oid = trg.tgfoid\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = fn.proowner\n       WHERE ns.nspname = 'slotlock'\n         AND NOT trg.tgisinternal\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n      UNION\n      SELECT COALESCE(grantee_role.rolname, 'PUBLIC') || ' can create triggers on slotlock.'\n             || rel.relname\n        FROM pg_catalog.pg_class rel\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = rel.relnamespace\n       CROSS JOIN LATERAL pg_catalog.aclexplode(rel.relacl) acl\n        LEFT JOIN pg_catalog.pg_roles grantee_role ON grantee_role.oid = acl.grantee\n       WHERE ns.nspname = 'slotlock'\n         AND acl.privilege_type = 'TRIGGER'\n         AND acl.grantee <> rel.relowner\n         AND (acl.grantee = 0\n              OR (grantee_role.rolname <> CURRENT_USER AND NOT grantee_role.rolsuper))\n      UNION\n      SELECT 'extension ' || ext.extname || ' in schema slotlock is owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_extension ext\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = ext.extnamespace\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = ext.extowner\n       WHERE ns.nspname = 'slotlock'\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n    ) refusal;\n  IF refusals IS NOT NULL THEN\n    RAISE EXCEPTION 'Slotlock will not deploy into schema slotlock: another role controls it'\n      USING ERRCODE = 'insufficient_privilege',\n            DETAIL = pg_catalog.to_jsonb(refusals)::pg_catalog.text,\n            HINT = 'The deployment role must own schema slotlock and every object in it, and no other role may create objects in it.';\n  END IF;\nEND\n$slotlock_schema_control$;\nDO $slotlock_schema_preconditions$\nDECLARE\n  installed integer;\nBEGIN\n  IF pg_catalog.current_setting('server_version_num')::integer < 160000 THEN\n    RAISE EXCEPTION 'Slotlock needs PostgreSQL 16 or later; this server is %',\n      pg_catalog.current_setting('server_version')\n      USING ERRCODE = 'feature_not_supported';\n  END IF;\n  IF pg_catalog.to_regclass('slotlock.schema_version') IS NOT NULL THEN\n    EXECUTE 'SELECT version FROM slotlock.schema_version WHERE singleton' INTO installed;\n    IF installed > 3 THEN\n      RAISE EXCEPTION 'Slotlock will not migrate a schema a newer release migrated (version %; this release is version 3)', installed\n        USING ERRCODE = 'object_not_in_prerequisite_state',\n              HINT = 'Migrate and serve it with the release that migrated it, or a later one.';\n    END IF;\n  END IF;\nEND\n$slotlock_schema_preconditions$;\n";
 /** Active (unrevoked, unexpired) API keys one tenant may hold. */
 export declare const SLOTLOCK_API_KEY_ACTIVE_LIMIT = 100;
 /** API keys one tenant may hold in all, revoked and expired ones included, so lists stay bounded. */
@@ -23,18 +36,47 @@ export declare const SLOTLOCK_DASHBOARD_TABLES: readonly ["dashboard_tokens"];
 export declare const SLOTLOCK_DASHBOARD_FUNCTIONS: readonly ["slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)", "slotlock.dashboard_session_ended(bytea, timestamptz)"];
 /** Live form records one person may leave in the dashboard's records (12 hours of forms). */
 export declare const SLOTLOCK_DASHBOARD_FORM_LIMIT = 1000;
+/** The table that records which release migrated the schema (SLOTLOCK_SCHEMA_VERSION). */
+export declare const SLOTLOCK_SCHEMA_TABLES: readonly ["schema_version"];
+/** The SECURITY DEFINER function through which a server reads the version it is serving. */
+export declare const SLOTLOCK_SCHEMA_FUNCTIONS: readonly ["slotlock.installed_schema_version()"];
+/** The table of suspended tenants: they may read, and write nothing (store.ts withTenant). */
+export declare const SLOTLOCK_TENANT_ADMIN_TABLES: readonly ["tenant_suspensions"];
+/**
+ * The SECURITY DEFINER functions through which a server checks a tenant's suspension and erases a
+ * tenant, by signature.
+ */
+export declare const SLOTLOCK_TENANT_ADMIN_FUNCTIONS: readonly ["slotlock.tenant_suspended(text)", "slotlock.erase_tenant(text)"];
+/**
+ * Functions only the deployment role runs: suspending and lifting a suspension. No other role is
+ * granted them, so a serving role cannot lift a suspension.
+ */
+export declare const SLOTLOCK_OPERATOR_FUNCTIONS: readonly ["slotlock.suspend_tenant(text, text)", "slotlock.unsuspend_tenant(text)"];
 /** Every SECURITY DEFINER function the serving role may execute, by signature. */
-export declare const SLOTLOCK_DEFINER_FUNCTIONS: readonly ("slotlock.authenticate_api_key(bytea)" | "slotlock.create_api_key(text, text, text, bytea, text[], timestamptz, text)" | "slotlock.dashboard_session_ended(bytea, timestamptz)" | "slotlock.erase_api_keys(text)" | "slotlock.list_api_keys(text)" | "slotlock.revoke_api_key(text, uuid)" | "slotlock.rotate_api_key(text, uuid, text, bytea)" | "slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)")[];
+export declare const SLOTLOCK_DEFINER_FUNCTIONS: readonly ("slotlock.authenticate_api_key(bytea)" | "slotlock.create_api_key(text, text, text, bytea, text[], timestamptz, text)" | "slotlock.dashboard_session_ended(bytea, timestamptz)" | "slotlock.erase_api_keys(text)" | "slotlock.erase_tenant(text)" | "slotlock.installed_schema_version()" | "slotlock.list_api_keys(text)" | "slotlock.revoke_api_key(text, uuid)" | "slotlock.rotate_api_key(text, uuid, text, bytea)" | "slotlock.tenant_suspended(text)" | "slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)")[];
 /** Tables no role but their owner reads or writes, reached only through SLOTLOCK_DEFINER_FUNCTIONS. */
-export declare const SLOTLOCK_DEFINER_TABLES: readonly ("api_key_retired_digests" | "api_keys" | "dashboard_tokens")[];
+export declare const SLOTLOCK_DEFINER_TABLES: readonly ("api_key_retired_digests" | "api_keys" | "dashboard_tokens" | "schema_version" | "tenant_suspensions")[];
+/**
+ * The advisory lock every server transaction for a tenant holds shared (store.ts withTenant), and
+ * suspension and erasure take exclusively, keyed by this text's hashtextextended(…, 0).
+ */
+export declare function slotlockTenantLockKey(tenantRef: string): string;
+/** The constraint validation applySchema runs after the rest of SLOTLOCK_CORE_DDL has committed. */
+export declare const SLOTLOCK_VALIDATION_DDL: string;
+/** The whole deployment DDL, run in one transaction: the schema, then its constraints validated. */
 export declare const SLOTLOCK_CORE_DDL: string;
+/**
+ * SLOTLOCK_CORE_DDL without the validation, which applySchema runs as a step of its own after this
+ * commits (SLOTLOCK_VALIDATION_DDL).
+ */
+export declare const SLOTLOCK_STRUCTURE_DDL: string;
 export declare const SLOTLOCK_TENANT_CONTEXT_SETTING = "slotlock.tenant_ref";
 /**
  * Every table the store reads or writes at runtime, each under forced tenant RLS.
  * `slotlock.rls_policy_contracts` and `slotlock.deployment_lifted_row_security` are
  * deployment-only and deliberately absent.
  */
-export declare const SLOTLOCK_TENANT_TABLES: readonly ["resources", "reservations", "reservation_tombstones", "reservation_conflict_archive", "calendar_events", "calendar_event_attendees", "calendar_event_reminders", "calendar_event_exceptions", "calendar_event_occurrences", "calendar_event_tombstones", "calendar_event_commands", "calendar_coverage"];
+export declare const SLOTLOCK_TENANT_TABLES: readonly ["resources", "reservations", "reservation_tombstones", "reservation_conflict_archive", "calendar_events", "calendar_event_attendees", "calendar_event_reminders", "calendar_event_exceptions", "calendar_event_occurrences", "calendar_event_tombstones", "calendar_event_commands", "calendar_coverage", "hold_commands"];
 /**
  * Build the grants for the application role: USAGE on the `slotlock` schema, DML on the store's
  * tables and EXECUTE on the API key and dashboard functions. Nothing else: no ownership, DDL,