slotlock 0.2.0 → 0.5.0

package/store.d.ts

@@ -1,6 +1,8 @@
+import { type SlotlockEventFeed } from './event-feed.js';
+import { type SlotlockBookingRules } from './booking-rules.js';
 import type { Sql, TransactionSql } from 'postgres';
 import { SLOTLOCK_CALENDAR_HORIZON_DAYS } from './rules.js';
-import type { AcquireHoldResult, CalendarCoverageCommand, CalendarCoverageResult, CalendarEventRetentionResult, CalendarFreeBusy, CalendarHorizonRollCursor, CalendarHorizonRollResult, CancelCalendarEventResult, CancelExternalReservationResult, ConfirmHoldResult, CreateReservationResult, ExternalReservationCommand, ExternalReservationResult, Interval, SlotlockCalendarEvent, SlotlockResource, PutCalendarEventCommand, PutCalendarEventResult, ReleaseHoldResult, WeeklyAvailabilityRule } from './types.js';
+import type { AcquireHoldResult, CalendarCoverageCommand, CalendarCoverageResult, CalendarEventContent, CalendarEventRetentionResult, BookingRetentionResult, SlotlockTenantErasure, CalendarFreeBusy, CalendarHorizonRollCursor, CalendarHorizonRollResult, CancelCalendarEventResult, CancelExternalReservationResult, ConfirmHoldResult, CreateReservationResult, DeleteResourceResult, ExternalReservationCommand, ExternalReservationResult, Interval, SlotlockCalendarEvent, SlotlockAgendaEntry, SlotlockHold, SlotlockReservation, SlotlockResource, PutCalendarEventCommand, PutCalendarEventResult, ReleaseHoldResult, WeeklyAvailabilityRule } from './types.js';
 export { SLOTLOCK_CALENDAR_HORIZON_DAYS };
 /**
  * Longest one-off event the store accepts (ten years and some leap days): long enough for any lease
@@ -8,8 +10,22 @@ export { SLOTLOCK_CALENDAR_HORIZON_DAYS };
  * series is bounded by its 367-day materialization window instead.
  */
 export declare const SLOTLOCK_MAX_EVENT_DURATION_DAYS = 3660;
+/**
+ * Longest window a recurring series is stored (materialized) for: the 367-day search window plus
+ * two days. The rolling horizon starts a day before the current UTC day and must reach 367 days
+ * past its end, so that a search of the full 367 days from any moment of the day is complete.
+ */
+export declare const SLOTLOCK_MATERIALIZATION_WINDOW_DAYS: number;
 /** Trusted provider/maintenance namespace used by backwards-compatible store callers. */
 export declare const SLOTLOCK_INTERNAL_EVENT_OWNER_REF = "internal";
+/** How many live holds one holder (a keyed hold's principal) may have in a tenant at once. */
+export declare const SLOTLOCK_MAX_HOLDS_PER_HOLDER = 20;
+/** Windows one holder may wait for at once (joinWaitlist). */
+export declare const SLOTLOCK_MAX_WAITLIST_PER_HOLDER = 20;
+/** Waiting entries one tenant may have. */
+export declare const SLOTLOCK_MAX_WAITLIST_PER_TENANT = 10000;
+/** How long before its start a booking may be checked in. */
+export declare const SLOTLOCK_CHECK_IN_OPENS_MINUTES = 60;
 /** Default hard ceiling for retained active + tombstoned identities per agent principal. */
 export declare const SLOTLOCK_AGENT_OWNER_EVENT_QUOTA = 1000;
 /** Hard retained command ceiling; includes reserved cancellation capacity for every identity. */
@@ -21,28 +37,85 @@ export declare const SLOTLOCK_AGENT_OWNER_COMMAND_QUOTA = 10000;
 export declare const SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS = 30;
 /** Store-owned coverage source for bounded, locally materialized recurring events. */
 export declare const SLOTLOCK_LOCAL_RECURRENCE_COVERAGE_SOURCE = "slotlock:local-recurrence-materialization";
-/** Stable daily target shared by the event writer, maintenance worker, and readiness proof. */
+/**
+ * Stable daily target shared by the event writer, maintenance worker, and readiness proof: from a
+ * day before the current UTC day to 367 days past its end (SLOTLOCK_MATERIALIZATION_WINDOW_DAYS).
+ */
 export declare function calendarEventRollingHorizon(now?: Date): Interval;
 /** What `createSlotlockStore` accepts: a `postgres` client, or a transaction/savepoint from one. */
 export type SlotlockSql = Sql | TransactionSql;
 type StoreSql = SlotlockSql;
-export interface SlotlockStore {
+/** How a migration (applySchema, applyTenantRls, grantApplicationRole) waits and how long it runs. */
+export interface SlotlockMigrationOptions {
+    /**
+     * The longest it waits for any one lock, in milliseconds (1-600,000; default 1,000). While a
+     * migration waits for a lock on a table, every query that comes after it on that table waits
+     * behind it; past this it gives up, lets them through, and tries again.
+     */
+    lockTimeoutMs?: number;
+    /** The longest any one of its statements runs, in milliseconds (1-86,400,000; default 900,000). */
+    statementTimeoutMs?: number;
+    /** How many times it tries in all (1-20; default 5) before refusing with `schema_lock_timeout`. */
+    attempts?: number;
+}
+/**
+ * The schema version recorded by the last migration, or `null` when there is none this role can
+ * read: no schema, a schema from 0.2 or earlier, or a role not yet granted the function (run
+ * `slotlock migrate`, which grants it).
+ */
+export declare function readSlotlockSchemaVersion(sql: SlotlockSql): Promise<number | null>;
+/**
+ * Refuse to serve a schema another release migrated: `schema_outdated` when it is older than this
+ * release (or unversioned), so `slotlock migrate` must run first; `schema_newer` when a newer release
+ * migrated it, whose schema this release's code does not know. Both carry `installed` and `expected`.
+ */
+export declare function assertSlotlockSchemaCurrent(sql: SlotlockSql): Promise<void>;
+/**
+ * What makes a put the same request: its identity and the event it asks for. Not the window its
+ * occurrences are stored over, which for a series is the rolling horizon from the current UTC
+ * midnight: with it in the hash, a retry after midnight was refused as a different request.
+ */
+declare function putCommandHash(params: {
+    command: PutCalendarEventCommand;
+    ownerRef: string;
+    event: CalendarEventContent;
+}): string;
+/**
+ * The hash 0.3.0 and earlier stored, with the window in it, so a command stored before the upgrade
+ * still replays: always for a one-off event, whose window is its own span, and on the same UTC day
+ * for a series. Remove once no stored command can be that old (commands are pruned after 30 days).
+ */
+export declare function legacyPutCommandHash(params: Parameters<typeof putCommandHash>[0] & {
+    window: Interval;
+}): string;
+/** Members a pool booking or search considers at most, in id order. */
+export declare const SLOTLOCK_MAX_POOL_MEMBERS = 100;
+export declare function isPoolName(value: unknown): value is string;
+export interface SlotlockStore extends SlotlockEventFeed {
     /**
      * Apply the Slotlock DDL (idempotent). Owns the `slotlock` schema on the connected DB. Refuses
      * (`unsafe_slotlock_schema`, with the `reasons` found) a `slotlock` schema that a role other than the
      * connected one (superusers aside) owns or can create objects in, that holds an object such a
      * role owns (an extension included), or whose tables such a role may add triggers to or have a
      * trigger running a function such a role owns. Ownership through a group role counts as another
-     * role's: deploy as the owning role itself (`SET ROLE`).
+     * role's: deploy as the owning role itself (`SET ROLE`). Refuses (`schema_newer`) a schema a newer
+     * release migrated, changing nothing. Records SLOTLOCK_SCHEMA_VERSION. A schema this release
+     * already migrated, unchanged since, is left as it is without a lock on any table. Constraints an
+     * upgrade adds NOT VALID are validated in a second transaction, whose locks no serving read or
+     * write waits for (one inside a caller's transaction shares its locks until it ends); one that old
+     * rows still break stays NOT VALID, and each later migration validates it again. Each lock it
+     * waits for is bounded by `lockTimeoutMs`, after which it tries again (`schema_lock_timeout` once
+     * out of attempts).
      */
-    applySchema(): Promise<void>;
+    applySchema(options?: SlotlockMigrationOptions): Promise<void>;
     /**
      * Atomically enable forced tenant RLS using this store's configured context setting. Refuses the
-     * same `slotlock` schemas as `applySchema()`.
+     * same `slotlock` schemas as `applySchema()`. Tables already forced under exactly the policies it
+     * installs, bound to this setting, are left as they are without a lock on any table.
      */
     applyTenantRls(options?: {
         allowRebind?: boolean;
-    }): Promise<void>;
+    } & SlotlockMigrationOptions): Promise<void>;
     /**
      * Grant an existing application role exactly what the store needs at runtime: USAGE on the
      * `slotlock` schema and DML on its tables. Run as the deployment role after every `applySchema()`.
@@ -55,23 +128,35 @@ export interface SlotlockStore {
      * setting. The check runs when the grant is made, so a right added later is not
      * detected until it runs again, and it is not exhaustive (SECURITY.md lists what it does not read).
      */
-    grantApplicationRole(role: string): Promise<void>;
+    grantApplicationRole(role: string, options?: SlotlockMigrationOptions): Promise<void>;
     /**
-     * Run store operations with one transaction-local tenant context on the same connection. With
-     * `isolation: 'read committed'` the transaction is READ COMMITTED whatever the role's default (a
-     * capped `createResource` needs it); inside a caller's transaction of another level it refuses
-     * (`invalid_transaction_isolation`).
+     * Run store operations with one transaction-local tenant context on the same connection. On a
+     * client it opens a READ COMMITTED transaction, whatever the role's default. Inside a caller's
+     * transaction of another level its writes are refused (`invalid_transaction_isolation`), since
+     * that snapshot can miss a suspension, and its reads go on; with `isolation: 'read committed'`
+     * such a transaction is refused outright. The serving role needs EXECUTE on
+     * slotlock.tenant_suspended(text): without it this refuses with `application_role_not_granted`
+     * (grantApplicationRole grants it), and on a schema without it with `schema_outdated`. With the
+     * store's `maxTenantTransactions`, an aborted `signal` takes a call still waiting for its turn out
+     * of the line, refused with the signal's reason.
      */
     withTenant<T>(tenantRef: string, callback: (store: SlotlockTenantStore) => Promise<T>, options?: {
         isolation?: 'read committed';
+        signal?: AbortSignal;
+        /**
+         * Who is making these changes (an API key's id, an agent's subject), 1-200 characters
+         * without control characters: the history (listHistory) records it with each change.
+         */
+        actor?: string;
     }): Promise<T>;
     /**
      * INVARIANT (erasure completeness): a tenant integration must use a stable, erasable business
      * identifier for externalRef and include this schema in its own data-erasure workflow.
      *
-     * With `maxTenantResources` (1-100,000, tenant-owned resources only) a new resource is refused
-     * (`resource_limit_reached`) once the tenant has that many; an existing `externalRef` is still
-     * updated. Capped creates for one tenant run one at a time under a database lock, so racing ones
+     * With `maxTenantResources` (1-100,000, tenant-owned resources only), or the store's `resources`
+     * limit (the lower of the two when both are set), a new resource of a tenant is refused
+     * (`resource_limit_reached`, with the `limit`) once the tenant has that many; an existing
+     * `externalRef` is still updated. Capped creates for one tenant run one at a time under a database lock, so racing ones
      * on any number of servers stop at the cap. The count needs READ COMMITTED: a capped create opens
      * one itself, and inside a caller's transaction of another level it refuses
      * (`invalid_transaction_isolation`). Uncapped creates do not wait for the lock and are not
@@ -82,12 +167,46 @@ export interface SlotlockStore {
         tenantRef?: string;
         timezone?: string;
         maxTenantResources?: number;
+        /**
+         * `shared` (the default) or `private`, which agents never see. Fixed at creation: creating an
+         * existing reference again with none named returns it as it is, and with another visibility is
+         * refused (`resource_visibility_conflict`).
+         */
+        visibility?: SlotlockResource['visibility'];
     }): Promise<SlotlockResource>;
-    /** Resolve one tenant-owned resource without revealing another tenant's matching id. */
+    /**
+     * Resolve one tenant-owned resource without revealing another tenant's matching id. An archived
+     * one is returned (with `archivedAt`); with `visibility`, only one of that visibility.
+     */
     getResource(params: {
         tenantRef: string;
         id: string;
+        visibility?: SlotlockResource['visibility'];
     }): Promise<SlotlockResource | null>;
+    /**
+     * Archive one of the tenant's resources: no list shows it and it takes no new booking, hold or
+     * event (`resource_archived`), while what is on it stays and can still be cancelled or released.
+     * Archiving it again keeps the first time. Null for an id that is not the tenant's.
+     */
+    archiveResource(params: {
+        tenantRef: string;
+        id: string;
+    }): Promise<SlotlockResource | null>;
+    /** Put an archived resource back in use. Null for an id that is not the tenant's. */
+    restoreResource(params: {
+        tenantRef: string;
+        id: string;
+    }): Promise<SlotlockResource | null>;
+    /**
+     * Delete one of the tenant's resources with its history (its past bookings, coverage and the
+     * occupation of cancelled events), freeing its place under the resource cap. Refused
+     * (`resource_in_use`) while a booking on it has not ended, a hold on it is live, or a calendar
+     * event (one-off not yet over, or recurring) is on it: cancel or move those first.
+     */
+    deleteResource(params: {
+        tenantRef: string;
+        id: string;
+    }): Promise<DeleteResourceResult>;
     /**
      * Set one resource's own weekly bookable hours, or clear them (`null`) so it uses the default;
      * `[]` makes it never bookable. Null for an id that is not the tenant's. Refuses rules Slotlock
@@ -98,6 +217,44 @@ export interface SlotlockStore {
         id: string;
         rules: readonly WeeklyAvailabilityRule[] | null;
     }): Promise<SlotlockResource | null>;
+    /**
+     * Set one resource's booking rules (`SlotlockBookingRules`), or clear them (`null`). They apply to
+     * bookings made from then on: holds, reservations, moves, and events written with
+     * `enforceBookingRules`. Null for an id that is not the tenant's. Refuses rules outside their
+     * bounds (`invalid_booking_rules`).
+     */
+    setResourceBookingRules(params: {
+        tenantRef: string;
+        id: string;
+        rules: SlotlockBookingRules | null;
+    }): Promise<SlotlockResource | null>;
+    /**
+     * Put one resource in a pool, or take it out (`null`): `pool` is 1-100 characters of a-z, 0-9,
+     * `.`, `_` and `-`, starting with a letter or digit (`invalid_pool` otherwise). A resource is in
+     * one pool at most. Null for an id that is not the tenant's.
+     */
+    setResourcePool(params: {
+        tenantRef: string;
+        id: string;
+        pool: string | null;
+    }): Promise<SlotlockResource | null>;
+    /**
+     * The members of one of the tenant's pools that may be booked, in the order a pool booking tries
+     * them (by id): archived ones left out, and with `visibility: 'shared'` private ones too.
+     */
+    listPoolMembers(params: {
+        tenantRef: string;
+        pool: string;
+        visibility?: 'shared';
+    }): Promise<SlotlockResource[]>;
+    /** The tenant's pools by name, with how many members each has that may be booked (its capacity). */
+    listPools(params: {
+        tenantRef: string;
+        visibility?: 'shared';
+    }): Promise<{
+        pool: string;
+        capacity: number;
+    }[]>;
     /** Set (or clear, with `null`) the bookable hours of every resource the tenant has; returns how many. */
     setTenantAvailability(params: {
         tenantRef: string;
@@ -108,18 +265,26 @@ export interface SlotlockStore {
         tenantRef: string;
         limit?: number;
         after?: string;
+        /** Only resources of this visibility; omitted, both. */
+        visibility?: SlotlockResource['visibility'];
+        /** Archived resources too; omitted, only those in use. */
+        includeArchived?: boolean;
     }): Promise<SlotlockResource[]>;
     /**
      * Insert a confirmed reservation with the EXCLUDE constraint as the overlap arbiter. Never
      * throws for the expected outcomes: an invalid window or a lost race come back structured.
      * Expired holds overlapping the window are lazily reaped in the same transaction — an
-     * expired-but-unpurged hold can never block (no cron required).
+     * expired-but-unpurged hold can never block (no cron required). On a tenant's resource the
+     * booking takes the tenant, and its own id as reference, so cancel and reschedule reach it. With
+     * `tenantRef`, only a resource of that tenant (`resource_not_found` otherwise, whatever the
+     * connection's row-level security).
      */
     createReservation(params: {
         resourceId: string;
         start: Date;
         end: Date;
         source?: string;
+        tenantRef?: string;
     }): Promise<CreateReservationResult>;
     /**
      * Idempotently create a tenant-owned booking reservation by its stable business identity. The
@@ -137,7 +302,10 @@ export interface SlotlockStore {
     }): Promise<CancelExternalReservationResult>;
     /**
      * Occupy a window WITHOUT committing: the hold blocks rivals under the same EXCLUDE arbiter
-     * until `expiresAt` (DB clock — now() + ttl, never the app clock), then frees via lazy reap.
+     * until `expiresAt` (DB clock — the statement's time + ttl, never the app clock), then frees via
+     * lazy reap.
+     * With `tenantRef`, only a resource of that tenant (`resource_not_found` otherwise, whatever the
+     * connection's row-level security).
      */
     acquireHold(params: {
         resourceId: string;
@@ -145,20 +313,111 @@ export interface SlotlockStore {
         end: Date;
         ttlMs: number;
         source?: string;
+        tenantRef?: string;
+        /** Turnaround kept busy after `end`, 0 to 30 days; the confirmed booking keeps it. */
+        bufferAfterMs?: number;
+        /**
+         * A retry identity, 1-500 UTF-8 bytes, unique inside `tenantRef` and `principalRef` (both
+         * required with it): a request repeated with the same key and body answers the hold the first
+         * made (`idempotent: true`), and one with another body is `idempotency_conflict`. The answer is
+         * kept until the hold would have expired, released or confirmed; a retry after that makes a new
+         * hold.
+         */
+        idempotencyKey?: string;
+        /** Whose keys `idempotencyKey` is among, 1-500 UTF-8 bytes (an API key's subject, say). */
+        principalRef?: string;
+        /**
+         * Who the hold belongs to, 1-500 UTF-8 bytes, inside `tenantRef` (required with it): an agent
+         * acting for one person, say. `releaseHold` and `putCalendarEvent`'s `fromHold` with a
+         * `holderRef` take only their own, and a holder may have `maxHoldsPerHolder` (20) live at once,
+         * holding at most `maxHeldHoursPerHolder` together when that is set. Without it the hold has no
+         * holder and no cap: an application holding for its customers.
+         */
+        holderRef?: string;
+        /**
+         * Holds taken as alternatives for one booking share a group (a UUID): booking one with
+         * `fromHold` releases the rest, and releasing one with a holder releases them all.
+         */
+        groupId?: string;
     }): Promise<AcquireHoldResult>;
+    /** One of the tenant's live holds, or null (none, expired, confirmed, or another tenant's). */
+    getHold(params: {
+        tenantRef: string;
+        holdId: string;
+    }): Promise<SlotlockHold | null>;
+    /** The tenant's live holds on one resource, by start then id, keyset-paginated like events. */
+    listHolds(params: {
+        tenantRef: string;
+        resourceId: string;
+        limit?: number;
+        after?: {
+            start: Date;
+            id: string;
+        };
+    }): Promise<SlotlockHold[]>;
     /**
-     * Flip an unexpired hold to a confirmed reservation (expiry cleared). Confirming it again answers
-     * the same reservation. With `tenantRef`, only a hold on one of that tenant's resources counts:
-     * another tenant's is `hold_not_found` whatever the connection's row-level security.
+     * What occupies the tenant's resources in `window` (at most 367 days), every resource at once, by
+     * start then id: bookings, calendar events' occurrences and live holds, up to `limit` (1-1000,
+     * default 100). An agenda for people to read; listReservations, listCalendarEvents and listHolds
+     * page through each.
+     */
+    listAgenda(params: {
+        tenantRef: string;
+        window: Interval;
+        limit?: number;
+    }): Promise<SlotlockAgendaEntry[]>;
+    /**
+     * The tenant's booking with this reference as it now is (its current revision), or null: none,
+     * cancelled, or a calendar event's occupation, which is not a booking.
+     */
+    getReservation(params: {
+        tenantRef: string;
+        externalRef: string;
+    }): Promise<SlotlockReservation | null>;
+    /**
+     * The tenant's bookings on one resource whose occupied time meets `window` (at most 367 days),
+     * by start then id, keyset-paginated: pass the last one's `{ start, id }` as `after`.
+     */
+    listReservations(params: {
+        tenantRef: string;
+        resourceId: string;
+        window: Interval;
+        limit?: number;
+        after?: {
+            start: Date;
+            id: string;
+        };
+    }): Promise<SlotlockReservation[]>;
+    /**
+     * Flip an unexpired hold to a confirmed booking (expiry cleared). On a tenant's resource the
+     * booking takes the tenant, and the hold's id as its reference at revision 1, so cancel and
+     * reschedule reach it like any other (`reservation_cancelled` when a cancel of that reference
+     * came first). Confirming it again answers the booking as it now is. With `tenantRef`, only a
+     * hold on one of that tenant's resources counts: another tenant's is `hold_not_found` whatever
+     * the connection's row-level security.
      */
     confirmHold(holdId: string, options?: SlotlockHoldTenantOptions): Promise<ConfirmHoldResult>;
     /**
      * Delete a live hold; released=false when it was already gone (expired-reaped or confirmed). With
      * `tenantRef`, only a hold on one of that tenant's resources, as for confirmHold.
      */
-    releaseHold(holdId: string, options?: SlotlockHoldTenantOptions): Promise<ReleaseHoldResult>;
-    /** Reservations overlapping `window` for one resource, as merged-ready half-open intervals. */
-    listBusy(resourceId: string, window: Interval): Promise<Interval[]>;
+    releaseHold(holdId: string, options?: SlotlockHoldTenantOptions & {
+        /**
+         * Only a hold this holder took (`acquireHold`'s `holderRef`), with the rest of its group:
+         * released=false for another holder's.
+         */
+        holderRef?: string;
+    }): Promise<ReleaseHoldResult>;
+    /**
+     * Reservations overlapping `window` for one resource, as merged-ready half-open intervals. With
+     * `tenantRef`, only a resource of that tenant (`resource_not_found` otherwise, whatever the
+     * connection's row-level security). An id the store never issues is `invalid_identity`. With
+     * `limit`, at most that many, the first by start.
+     */
+    listBusy(resourceId: string, window: Interval, options?: {
+        tenantRef?: string;
+        limit?: number;
+    }): Promise<Interval[]>;
     /** Create or revise one trusted event under expected-revision + tenant idempotency guards. */
     putCalendarEvent(params: PutCalendarEventCommand): Promise<PutCalendarEventResult>;
     /** Read one active event. A cancelled/tombstoned identity reads as absent. */
@@ -168,11 +427,24 @@ export interface SlotlockStore {
         ownerRef?: string;
         externalRef: string;
     }): Promise<SlotlockCalendarEvent | null>;
+    /**
+     * One of the tenant's active events by id, whichever owner (the tenant itself or an agent key)
+     * wrote it: null when there is none, it was cancelled, or it is another tenant's.
+     */
+    getCalendarEventById(params: {
+        tenantRef: string;
+        eventId: string;
+    }): Promise<SlotlockCalendarEvent | null>;
     /** List active events with at least one materialized occurrence intersecting the window. */
     listCalendarEvents(params: {
         tenantRef: string;
         /** Defaults to the trusted `internal` namespace. */
         ownerRef?: string;
+        /**
+         * Every owner's events, each with its `ownerRef`, so a tenant reaches what any of its keys
+         * booked, a revoked one's included. Not with `ownerRef`.
+         */
+        allOwners?: boolean;
         resourceId: string;
         window: Interval;
         limit?: number;
@@ -190,6 +462,26 @@ export interface SlotlockStore {
         externalRef: string;
         idempotencyKey: string;
         expectedRevision: number;
+        /**
+         * The resource the writer read the event on: `event_not_found` when the stored event is on
+         * another, checked under the event's lock.
+         */
+        expectedResourceId?: string;
+    }): Promise<CancelCalendarEventResult>;
+    /**
+     * The tenant's cancellation of one of its events by id, whichever owner wrote it: an agent key's
+     * included, after the key is revoked and when it has spent its command quota. The event's
+     * identity is cancelled (its tombstone is its owner's, so that key cannot re-create it), and the
+     * command is the tenant's own: its idempotency key is in the trusted `internal` namespace, where
+     * it replays. A cancelled event, an unknown id or another tenant's is `event_not_found`.
+     */
+    cancelCalendarEventById(params: {
+        tenantRef: string;
+        eventId: string;
+        idempotencyKey: string;
+        expectedRevision: number;
+        /** As for cancelCalendarEvent: `event_not_found` when the event is on another resource. */
+        expectedResourceId?: string;
     }): Promise<CancelCalendarEventResult>;
     /**
      * Atomically rematerialize due recurring masters into one rolling window without changing their
@@ -218,9 +510,198 @@ export interface SlotlockStore {
         tenantRef: string;
         /** Rows per class per call, 1-1000. Defaults to 100. */
         limit?: number;
-        /** Replay window in whole days, 1-3650. Defaults to `SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS`. */
+        /** Replay window in whole days, 1-3650. Defaults to the store's `retentionDays`, at least 30. */
         retentionDays?: number;
     }): Promise<CalendarEventRetentionResult>;
+    /**
+     * Delete one bounded batch of a tenant's dead booking rows: holds past their expiry and the
+     * answers kept for keyed ones (at once), and references retired by a cancel no booking held,
+     * older than the retention window. A cancelled booking's tombstone is never deleted here (only by
+     * erasing the tenant), so its reference is never booked again. Rows another transaction holds
+     * are skipped, not waited on. It also gives a confirmed booking a 0.2 server wrote without its
+     * tenant the tenant and its own id as reference, as the migration does. Call until `hasMore` is
+     * false.
+     */
+    /**
+     * Time zone rules that changed since an event was booked (a new tzdata): a future one-off event
+     * whose wall-clock time in its zone now falls at another instant. Each is reported once on the
+     * feed (`event.timezone_shifted`, with the instant it has and the one its wall time now means).
+     * With `move`, it is moved there instead (a new revision, `event.updated` naming `slotlock:tzdata`),
+     * unless that overlaps another booking: then it stays and `event.timezone_conflict` reports it,
+     * for a person or an agent to decide. Up to `limit` (1-1,000, default 100) events a call.
+     */
+    followZoneRules(params: {
+        tenantRef: string;
+        move?: boolean;
+        limit?: number;
+    }): Promise<{
+        shifted: number;
+        moved: number;
+        conflicts: number;
+    }>;
+    /**
+     * A source failed to read (a feed answered 500, a token expired): kept as its last error, at most
+     * 500 characters, beside its coverage, which stays as it was. `coverage_not_found` for a source
+     * that has never recorded coverage on the resource.
+     */
+    recordCoverageFailure(params: {
+        tenantRef: string;
+        resourceId: string;
+        source: string;
+        error: string;
+    }): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        code: 'coverage_not_found' | 'invalid_identity';
+    }>;
+    /**
+     * Retire a source (a sync disconnected or replaced): its coverage of the resource is forgotten, so
+     * free/busy and the booking rule `requireCertain` stop waiting on it. False when there was none.
+     */
+    deleteCoverage(params: {
+        tenantRef: string;
+        resourceId: string;
+        source: string;
+    }): Promise<boolean>;
+    /**
+     * Each source's coverage of one resource and how healthy it is: when it was last read, its last
+     * error, and whether it is `stale` (not read for `maxAgeMs`, default a day, as free/busy judges).
+     */
+    listCoverage(params: {
+        tenantRef: string;
+        resourceId: string;
+        maxAgeMs?: number;
+    }): Promise<SlotlockCoverageHealth[]>;
+    /**
+     * Put each source that has gone stale (not read for `maxAgeMs`, default a day) on the feed once
+     * (`coverage.stale`), until it is read again. Up to `limit` (default 100); how many.
+     */
+    reportStaleCoverage(params: {
+        tenantRef: string;
+        maxAgeMs?: number;
+        limit?: number;
+    }): Promise<number>;
+    /**
+     * Claim a booking by its reference (check-in), so a resource whose booking rules ask for check-in
+     * (`checkInMinutes`) does not release it. Check-in opens `SLOTLOCK_CHECK_IN_OPENS_MINUTES` before
+     * the start (`check_in_not_open` sooner), and a move to another start clears it. Checking in again
+     * keeps the first time. Refused once the booking has ended (`reservation_ended`); a reference with
+     * no live booking is `reservation_not_found`. The feed says so (`reservation.checked_in`).
+     */
+    checkInReservation(params: {
+        tenantRef: string;
+        externalRef: string;
+    }): Promise<CheckInReservationResult>;
+    /**
+     * Release up to `limit` (default 100) bookings left unclaimed: on a resource whose booking rules
+     * ask for check-in, made since they did, not checked in `checkInMinutes` after the start, and not
+     * yet ended. Each is cancelled as `cancelExternalReservation` would (its reference retired at the
+     * next revision) and the feed says why (`reservation.no_show`). How many.
+     */
+    releaseNoShows(params: {
+        tenantRef: string;
+        limit?: number;
+    }): Promise<number>;
+    /**
+     * Wait for a window on one resource (`resourceId`) or any member of a pool (`pool`): when it comes
+     * free, `offerWaitlist` holds it for `holderRef` for `offerTtlMs` (1 minute to a day, default 15
+     * minutes), first come first offered. A holder may wait for `SLOTLOCK_MAX_WAITLIST_PER_HOLDER`
+     * windows at once and a tenant `SLOTLOCK_MAX_WAITLIST_PER_TENANT`.
+     */
+    joinWaitlist(params: {
+        tenantRef: string;
+        resourceId?: string;
+        pool?: string;
+        start: Date;
+        end: Date;
+        holderRef: string;
+        offerTtlMs?: number;
+    }): Promise<JoinWaitlistResult>;
+    /** The tenant's waitlist entries, oldest first, optionally of one resource, pool or holder. */
+    listWaitlist(params: {
+        tenantRef: string;
+        resourceId?: string;
+        pool?: string;
+        holderRef?: string;
+        limit?: number;
+    }): Promise<SlotlockWaitlistEntry[]>;
+    /**
+     * Stop waiting; with `holderRef`, only that holder's entry. A hold offered and not yet confirmed is
+     * released with it. False when there was none.
+     */
+    leaveWaitlist(params: {
+        tenantRef: string;
+        id: string;
+        holderRef?: string;
+    }): Promise<boolean>;
+    /**
+     * Offer freed time to the waitlist, in the order entries joined: each waiting entry whose window
+     * is free (on its resource, or on the first free member of its pool) gets a hold for its holder
+     * and the feed says so (`waitlist.offered`, with the hold). Entries whose window has started are
+     * expired (`waitlist.expired`); finished ones older than the change feed's retention are deleted.
+     * One tenant's offers run one at a time. One page of `limit` (1-100, default 50) entries: pass
+     * `next` back as `after` for the next, until it is null.
+     */
+    offerWaitlist(params: {
+        tenantRef: string;
+        limit?: number;
+        after?: {
+            createdAt: Date;
+            id: string;
+        };
+    }): Promise<{
+        offered: number;
+        expired: number;
+        next: {
+            createdAt: Date;
+            id: string;
+        } | null;
+    }>;
+    pruneBookingRetention(params: {
+        tenantRef: string;
+        /** Rows per class per call, 1-1000. Defaults to 100. */
+        limit?: number;
+        /**
+         * How long a stray retirement is kept, in whole days, 1-3650. Defaults to the store's
+         * `retentionDays`, at least 30.
+         */
+        retentionDays?: number;
+    }): Promise<BookingRetentionResult>;
+    /**
+     * Suspend a tenant: from when this returns, every withTenant transaction for it (as every server
+     * runs its requests) may read, and its writes are refused (`tenant_suspended`); one in flight is
+     * waited for. Its keys still authenticate, but it gets no new key or secret. Maintenance and
+     * erasure go on. True when it was not suspended already. Only the deployment role, which owns the
+     * schema, may suspend (`tenant_suspension_not_permitted` for another).
+     */
+    suspendTenant(params: {
+        tenantRef: string;
+        /** Why, for the operator: 1-500 characters without control characters. */
+        reason?: string;
+    }): Promise<{
+        suspended: boolean;
+    }>;
+    /** Lift a suspension; true when the tenant was suspended. The deployment role only. */
+    unsuspendTenant(params: {
+        tenantRef: string;
+    }): Promise<{
+        unsuspended: boolean;
+    }>;
+    /** Whether the tenant is suspended. */
+    isTenantSuspended(params: {
+        tenantRef: string;
+    }): Promise<boolean>;
+    /**
+     * Erase a tenant: delete every row it owns (resources, holds, bookings, events with their
+     * attendees and reminders, cancellations, idempotency records, coverage, API keys, and a personal
+     * tenant's dashboard records) in one transaction, waiting for its transactions in flight. API key
+     * digests are retired so no erased key works again; a suspension stays. Erasing again deletes
+     * nothing.
+     */
+    eraseTenant(params: {
+        tenantRef: string;
+    }): Promise<SlotlockTenantErasure>;
     /** Record the bounded, complete source window represented by a provider cursor/revision. */
     recordCalendarCoverage(params: CalendarCoverageCommand): Promise<CalendarCoverageResult>;
     /** Return merged busy intervals plus explicit completeness for caller-required provider sources. */
@@ -232,27 +713,165 @@ export interface SlotlockStore {
         coverageMaxAgeMs?: number;
     }): Promise<CalendarFreeBusy>;
     /**
-     * Convenience composition: listBusy × expandRules (in the resource's stored timezone) →
-     * findNextAvailable. A search window longer than 367 days is refused (`invalid_window`).
+     * The first slot of `durationMs` inside the hours, whose time and turnaround buffer are free:
+     * getFreeBusy × expandRules (in the resource's stored timezone) → findNextAvailable. Null when no
+     * slot is free, and when one cannot be proven free: the coverage of the window (with the buffer's
+     * tail) is not complete, because a recurring series is not stored that far or a required provider
+     * calendar is not read that far. Another tenant's resource, an unknown id or one the store never
+     * issues is `resource_not_found`. A search window longer than 367 days is `invalid_window`.
      */
     findNextAvailableFor(params: {
+        /** The resource's tenant; `null` for a resource that has none (the legacy namespace). */
+        tenantRef: string | null;
         resourceId: string;
-        rules: WeeklyAvailabilityRule[];
+        /** The hours to search; omitted, the resource's own (none: no slot). */
+        rules?: WeeklyAvailabilityRule[];
         searchWindow: Interval;
         durationMs: number;
+        /** Turnaround after the slot that must be free too (it may run past the hours), 0-30 days. */
+        bufferAfterMs?: number;
+        /** Provider sources that must prove complete coverage, as for getFreeBusy. */
+        requiredSources?: string[];
+        coverageMaxAgeMs?: number;
     }): Promise<Interval | null>;
 }
+/** One entry of a tenant's waitlist (joinWaitlist). */
+export interface SlotlockWaitlistEntry {
+    id: string;
+    /** The resource it waits on, or null when it waits on a pool. */
+    resourceId: string | null;
+    pool: string | null;
+    start: Date;
+    end: Date;
+    holderRef: string;
+    offerTtlMs: number;
+    /** `waiting`, `offered` (a hold was made: `holdId` on `offeredResourceId`) or `expired`. */
+    status: 'waiting' | 'offered' | 'expired';
+    holdId: string | null;
+    offeredResourceId: string | null;
+    offeredAt: Date | null;
+    createdAt: Date;
+}
+export type JoinWaitlistResult = {
+    ok: true;
+    entry: SlotlockWaitlistEntry;
+} | {
+    ok: false;
+    code: 'invalid_identity' | 'invalid_window' | 'invalid_ttl' | 'invalid_pool' | 'resource_not_found' | 'resource_archived' | 'pool_not_found' | 'waitlist_limit_reached';
+};
+export type CheckInReservationResult = {
+    ok: true;
+    reference: string;
+    checkedInAt: Date;
+} | {
+    ok: false;
+    code: 'invalid_identity' | 'reservation_not_found' | 'reservation_ended' | 'check_in_not_open';
+};
+/** One source's coverage of a resource, with its health (listCoverage). */
+export interface SlotlockCoverageHealth {
+    source: string;
+    start: Date;
+    end: Date;
+    revision: number;
+    /** When it was last read. */
+    observedAt: Date;
+    lastError: string | null;
+    lastErrorAt: Date | null;
+    /** Not read for longer than free/busy trusts: time it covers is unproven, not free. */
+    stale: boolean;
+}
 export type SlotlockTenantStore = Omit<SlotlockStore, 'applySchema' | 'applyTenantRls' | 'grantApplicationRole' | 'withTenant'>;
 export interface SlotlockStoreOptions {
     /** Namespaced PostgreSQL setting installed by applyTenantRls. Defaults to `slotlock.tenant_ref`. */
     tenantContextSetting?: string;
+    /**
+     * The bookable hours of a resource without its own, where its booking rules enforce hours
+     * (`enforceHours`). None by default: such a resource is then never bookable.
+     */
+    defaultAvailabilityRules?: readonly WeeklyAvailabilityRule[];
     /** Hard active + tombstone identity ceiling per non-internal owner. Defaults to 1,000. */
     agentOwnerEventQuota?: number;
     /** Hard retained-command ceiling per non-internal owner. Defaults to 10,000; cannot be disabled. */
     agentOwnerCommandQuota?: number;
+    /**
+     * What one tenant may store, for a database tenants share (none by default). A write that would
+     * pass a limit is refused with it (`*_limit_reached`); what the tenant has can still be revised
+     * (a move adds no booking or event, so it is not refused), cancelled and released. Counted under
+     * a lock per tenant and limit, so racing writers never pass it, in READ COMMITTED transactions
+     * only (`invalid_transaction_isolation` otherwise). Bookings and events count while they are still
+     * to come, and for 30 days after they were made, whatever time they hold; history older than that
+     * does not count, and a count stops reading at the limit.
+     */
+    tenantLimits?: SlotlockTenantLimits;
+    /**
+     * How many withTenant transactions of one tenant run at once on this store (1-1,000; no limit by
+     * default). The rest wait in this process, in order, so one tenant's transactions waiting on its
+     * own locks hold at most this many of a pool's connections. Not counted inside a caller's
+     * transaction, which holds its connection already.
+     */
+    maxTenantTransactions?: number;
+    /**
+     * The longest a withTenant transaction waits for any one lock, in milliseconds (1-600,000; none by
+     * default). Past it the transaction is rolled back and refused with `lock_timeout`, which is safe
+     * to retry. Not set inside a caller's transaction.
+     */
+    tenantLockTimeoutMs?: number;
+    /**
+     * How many days history is kept, 1-3,650 (default 30): the change feed (and how far back a cursor
+     * reaches) and waitlist entries that ended; and, when longer than 30 days, retired idempotency
+     * answers, booking references and past events' commands (never shorter, so a delayed retry is still
+     * answered as the first try was). Maintenance prunes what is older. A cursor before a change any
+     * store has pruned answers `cursor_expired`, so stores set differently never skip a change.
+     */
+    retentionDays?: number;
+    /**
+     * Live holds one holder (`acquireHold`'s `holderRef`) may have at once, 1-10,000. Defaults to
+     * SLOTLOCK_MAX_HOLDS_PER_HOLDER (20).
+     */
+    maxHoldsPerHolder?: number;
+    /**
+     * Hours one holder's live holds may hold together, 1-876,000 (none by default): past it a hold is
+     * refused with `held_time_limit_reached`, however few holds it has.
+     */
+    maxHeldHoursPerHolder?: number;
+}
+/** Per-tenant row limits, each a whole number from 1 to 10,000,000 (resources: to 100,000). */
+export interface SlotlockTenantLimits {
+    /** Resources, archived ones included; the lower of this and a call's `maxTenantResources`. */
+    resources?: number;
+    /**
+     * Holds on the tenant's resources, expired ones included until they are deleted. A keyed hold
+     * keeps its place until it would have expired, released or confirmed, while its answer is kept
+     * for retries. A hold at the limit first deletes the tenant's expired holds and forgets their
+     * answers, as maintenance does, so only live holds keep a new one out.
+     */
+    holds?: number;
+    /**
+     * Bookings still to come or made in the last 30 days, cancellations made in the last 30 days,
+     * and references a cancel retired with no booking until maintenance prunes them.
+     */
+    reservations?: number;
+    /**
+     * Calendar events of every owner still to come (a series until it is known to have ended) or made
+     * in the last 30 days, cancellations of every owner made in the last 30 days, and agent-owned
+     * cancellations until maintenance prunes them. Each event stores at most 2,000 occurrences.
+     */
+    events?: number;
+    /** Provider coverage rows: one per resource and source. */
+    coverage?: number;
 }
 export interface SlotlockHoldTenantOptions {
     /** Only a hold on one of this tenant's resources: 1-500 UTF-8 bytes. */
     tenantRef?: string;
 }
+/**
+ * At most `max` holders per tenant at once; the rest wait in order. An aborted signal takes a
+ * waiter out of the line, rejecting with its reason. Each holder calls the release it gets once.
+ */
+export declare function createTenantSlots(max: number): (tenantRef: string, signal?: AbortSignal) => Promise<() => void>;
 export declare function createSlotlockStore(sql: StoreSql, options?: SlotlockStoreOptions): SlotlockStore;
+/**
+ * Every store method that writes for a tenant: what a suspended tenant's withTenant store refuses.
+ * Maintenance (rolling series, pruning, purging) and erasure are not among them.
+ */
+export declare const SLOTLOCK_TENANT_WRITE_METHODS: readonly ["createResource", "archiveResource", "restoreResource", "deleteResource", "setResourceAvailability", "setResourceBookingRules", "setResourcePool", "setTenantAvailability", "createReservation", "createExternalReservation", "rescheduleExternalReservation", "cancelExternalReservation", "acquireHold", "confirmHold", "releaseHold", "putCalendarEvent", "cancelCalendarEvent", "cancelCalendarEventById", "recordCalendarCoverage", "createWebhookEndpoint", "deleteWebhookEndpoint", "enableWebhookEndpoint", "recordCoverageFailure", "deleteCoverage", "checkInReservation", "joinWaitlist", "leaveWaitlist"];