slotlock 0.2.0 → 0.5.0

package/agent-store-backend.js

@@ -1,22 +1,93 @@
+import { slotlockCloudEvent } from './webhooks.js';
 import { createHash } from 'node:crypto';
 import { SlotlockAgentOperationError, } from './agent-server.js';
-import { findNextAvailable } from './engine.js';
+import { bookingSearch } from './booking-rules.js';
+import { findNextAvailable, mergeIntervals } from './engine.js';
 import { expandRules } from './rules.js';
-import { calendarEventRollingHorizon } from './store.js';
+import { emitVAvailability, parseVAvailability, toJSCalendarEvent } from './interop.js';
+import { calendarEventRollingHorizon, } from './store.js';
 import { maintainSlotlockTenant } from './maintenance.js';
 import { parseAvailabilityRules } from './weekly-hours.js';
+/**
+ * A write runs under READ COMMITTED whatever the role's default: a store given tenant limits (as
+ * `slotlock serve`'s is) counts it against them under the tenant's lock, which needs that level,
+ * and refuses it otherwise.
+ */
+const WRITE = { isolation: 'read committed' };
+/** Who a call's changes are recorded as in the history: the principal's subject, kept short. */
+function actorOf(context) {
+    const subject = context.principal.subject;
+    if (typeof subject !== 'string' || subject.length === 0)
+        return undefined;
+    const clean = subject.replace(/[\u0000-\u001f\u007f]/g, '');
+    return clean.length === 0 ? undefined : clean.slice(0, 200);
+}
 function assertActive(context) {
     if (context.signal.aborted)
         throw new SlotlockAgentOperationError('request_aborted', 503);
 }
 async function withTenant(store, context, callback, options) {
     assertActive(context);
-    const value = options === undefined
-        ? await store.withTenant(context.principal.tenantRef, callback)
-        : await store.withTenant(context.principal.tenantRef, callback, options);
+    let value;
+    try {
+        const actor = actorOf(context);
+        value = await store.withTenant(context.principal.tenantRef, callback, {
+            ...options,
+            signal: context.signal,
+            ...(actor !== undefined ? { actor } : {}),
+        });
+    }
+    catch (error) {
+        const code = error?.code;
+        // A suspended tenant may read; a write it asks for is forbidden, not a server failure.
+        if (code === 'tenant_suspended')
+            throw new SlotlockAgentOperationError('tenant_suspended', 403);
+        // Waited past the store's lock timeout behind the tenant's own writes: retry later.
+        if (code === 'lock_timeout')
+            throw new SlotlockAgentOperationError('server_busy', 503);
+        assertActive(context);
+        throw error;
+    }
     assertActive(context);
     return value;
 }
+/**
+ * Busy intervals one free/busy read or search may gather across all the resources it names: as many
+ * as the store reads for one resource. Without it, a request naming 100 resources at that limit, or
+ * one resource 100 times, did 100 times the work of one.
+ */
+const MAX_REQUEST_BUSY_INTERVALS = 10_000;
+/**
+ * Bookable windows one search may expand from its resources' availability rules in all: five
+ * resources of 50 daily rules over a year, or a hundred of two. Without it, a search of 100 such
+ * resources over a year expanded 1.8 million windows and held the process for seven seconds.
+ */
+const MAX_REQUEST_RULE_WINDOWS = 100_000;
+/** The resources a request names, each once, in the order first named. */
+function distinctResourceIds(input) {
+    return [...new Set(input.resource_ids)];
+}
+/** Counts a request's busy intervals against MAX_REQUEST_BUSY_INTERVALS, refusing past it. */
+function busyBudget() {
+    let left = MAX_REQUEST_BUSY_INTERVALS;
+    return (intervals) => {
+        left -= intervals;
+        if (left < 0)
+            throw new SlotlockAgentOperationError('calendar_work_limit', 400);
+    };
+}
+/** The store's free/busy read, its refusal to read past its limit answered as the caller's to narrow. */
+async function readFreeBusy(tenantStore, params) {
+    try {
+        return await tenantStore.getFreeBusy(params);
+    }
+    catch (error) {
+        if (error?.code === 'calendar_work_limit') {
+            throw new SlotlockAgentOperationError('calendar_work_limit', 400);
+        }
+        throw error;
+    }
+}
 function interval(input) {
     return { start: new Date(input.start), end: new Date(input.end) };
 }
@@ -78,6 +149,12 @@ function agentPrincipalDigest(context, idempotencyKey) {
         .update(`${context.principal.tenantRef}\0${context.principal.subject}\0${idempotencyKey}`)
         .digest('hex');
 }
+/** A version-4-shaped UUID from a digest: a stable id for a value that names one thing. */
+function uuidFromDigest(value) {
+    const hex = createHash('sha256').update(value).digest('hex');
+    const variant = ((Number.parseInt(hex[16], 16) & 0x3) | 0x8).toString(16);
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-${variant}${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
+}
 function agentOwnerRef(context) {
     return `agent:${createHash('sha256')
         .update(`${context.principal.tenantRef}\0${context.principal.subject}`)
@@ -139,16 +216,38 @@ export function projectSlotlockCalendarEvent(event) {
         recurrence_id: null,
     };
 }
-function operationError(code) {
-    if (code === 'resource_tenant_mismatch' || code.endsWith('_not_found')) {
-        return new SlotlockAgentOperationError('not_found', 404);
-    }
+/**
+ * The HTTP status a store refusal answers with on every agent surface: a missing or foreign
+ * record 404, a malformed request 400, a full agent quota 429, and any other conflict with what is
+ * stored 409. rest-api.ts declares the 404 and 409 each route can answer from this.
+ */
+export function slotlockAgentErrorStatus(code) {
+    if (code === 'resource_tenant_mismatch' || code.endsWith('_not_found'))
+        return 404;
     if (code.startsWith('invalid_'))
-        return new SlotlockAgentOperationError(code, 400);
-    if (code === 'owner_event_quota_exceeded' || code === 'owner_command_quota_exceeded') {
-        return new SlotlockAgentOperationError(code, 429);
-    }
-    return new SlotlockAgentOperationError(code, 409);
+        return 400;
+    if (code === 'owner_event_quota_exceeded' || code === 'owner_command_quota_exceeded')
+        return 429;
+    return 409;
+}
+/** The code an agent's error carries for each booking rule a write breaks. */
+const BOOKING_RULE_CODES = Object.freeze({
+    min_notice: 'booking_rule_min_notice',
+    max_advance: 'booking_rule_max_advance',
+    slot_step: 'booking_rule_slot_step',
+    outside_hours: 'booking_rule_outside_hours',
+    uncertain: 'booking_rule_uncertain',
+});
+function operationError(refusal) {
+    // A broken booking rule is named in the code, which is all an agent's error carries.
+    const code = typeof refusal === 'string'
+        ? refusal
+        : refusal.code === 'booking_rule_violated' && refusal.rule
+            ? (BOOKING_RULE_CODES[refusal.rule] ?? refusal.code)
+            : refusal.code;
+    const status = slotlockAgentErrorStatus(code);
+    // A gone hold is named, so the agent holds again; it covers expired and another holder's alike.
+    return new SlotlockAgentOperationError(status === 404 && code !== 'hold_not_found' ? 'not_found' : code, status);
 }
 /** Resource and event ids: the UUIDs the store issues and validates. */
 const STORE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -181,28 +280,315 @@ function parseEventCursor(value) {
         throw new SlotlockAgentOperationError('invalid_cursor', 400);
     }
 }
-function encodeEventCursor(event) {
-    return Buffer.from(JSON.stringify({ start: event.start.toISOString(), id: event.id }), 'utf8').toString('base64url');
+/** The cursor after one row of a page ordered by start then id: an event, a hold or a booking. */
+function encodeEventCursor(row) {
+    return Buffer.from(JSON.stringify({ start: row.start.toISOString(), id: row.id }), 'utf8').toString('base64url');
+}
+/** One page of rows read with one more than `limit`, and the cursor to the next when there is one. */
+function page(rows, limit) {
+    const shown = rows.slice(0, limit);
+    const last = shown.at(-1);
+    return { shown, next: rows.length > limit && last ? encodeEventCursor(last) : null };
 }
 /**
  * The caller's resource with this id, or `resource_not_found`. The tools accept any id an agent may
  * send (an external reference such as `vehicle-42`, the nil UUID, a version 7 UUID). The store
  * issues version 4 UUIDs (gen_random_uuid) and refuses an id that is not a version 1 to 5 UUID as an
  * invalid identity, so such an id names no resource: it is not found, like a well-formed id that
- * names nothing or another tenant's resource.
+ * names nothing or another tenant's resource. With `visibility`, a resource of the other is not
+ * found either: agents ask for `shared`, so a private resource is invisible to them.
  */
-async function requireResource(tenantStore, tenantRef, resourceId) {
+async function requireResource(tenantStore, tenantRef, resourceId, visibility) {
     if (!STORE_ID_PATTERN.test(resourceId)) {
         throw new SlotlockAgentOperationError('resource_not_found', 404);
     }
-    const resource = await tenantStore.getResource({ tenantRef, id: resourceId });
+    const resource = await tenantStore.getResource({
+        tenantRef,
+        id: resourceId,
+        ...(visibility !== undefined ? { visibility } : {}),
+    });
     if (!resource)
         throw new SlotlockAgentOperationError('resource_not_found', 404);
     return resource;
 }
+/** The caller's shared resource with this id: what an agent may see and book. */
+function requireAgentResource(tenantStore, tenantRef, resourceId) {
+    return requireResource(tenantStore, tenantRef, resourceId, 'shared');
+}
 /** Bind the protocol server to the production store without giving a request control of tenancy. */
 export function createSlotlockStoreAgentBackend(store, options) {
     return {
+        async holdSlots(context, input) {
+            const slots = input.slots;
+            const key = input.idempotency_key;
+            const holderRef = agentOwnerRef(context);
+            // One group per agent and key, so a retry answers with the same holds and group.
+            const groupId = uuidFromDigest(`slotlock-hold-group\0${holderRef}\0${key}`);
+            return withTenant(store, context, async (tenantStore) => {
+                const holds = [];
+                const refused = [];
+                for (const [index, slot] of slots.entries()) {
+                    try {
+                        await requireAgentResource(tenantStore, context.principal.tenantRef, slot.resource_id);
+                    }
+                    catch (error) {
+                        if (!(error instanceof SlotlockAgentOperationError))
+                            throw error;
+                        refused.push({ index, code: error.code });
+                        continue;
+                    }
+                    const result = await tenantStore.acquireHold({
+                        tenantRef: context.principal.tenantRef,
+                        principalRef: holderRef,
+                        holderRef,
+                        idempotencyKey: agentCommandIdempotencyKey(context, `${key}\0${index}`),
+                        groupId,
+                        resourceId: slot.resource_id,
+                        start: new Date(slot.start),
+                        end: new Date(slot.end),
+                        ttlMs: input.ttl_seconds * 1_000,
+                        source: 'agent-server',
+                    });
+                    if (result.ok) {
+                        holds.push({
+                            hold_id: result.hold.id,
+                            resource_id: result.hold.resourceId,
+                            start: result.hold.start.toISOString(),
+                            end: result.hold.end.toISOString(),
+                            expires_at: result.hold.expiresAt.toISOString(),
+                        });
+                    }
+                    else {
+                        refused.push({ index, code: operationError(result).code });
+                    }
+                }
+                return { group_id: groupId, holds, refused };
+            });
+        },
+        async bookPool(context, rawInput) {
+            const input = rawInput;
+            const content = {
+                start: new Date(input.starts_at),
+                end: new Date(input.ends_at),
+                timezone: input.timezone,
+                summary: eventSummary(input.title),
+                status: 'confirmed',
+                transparency: 'opaque',
+                attendees: [],
+                reminders: [],
+            };
+            const tenantRef = context.principal.tenantRef;
+            const ownerRef = agentOwnerRef(context);
+            const externalRef = agentExternalRef(context, input.idempotency_key);
+            return withTenant(store, context, async (tenantStore) => {
+                const put = (resourceId) => tenantStore.putCalendarEvent({
+                    tenantRef,
+                    ownerRef,
+                    externalRef,
+                    resourceId,
+                    expectedRevision: 0,
+                    idempotencyKey: agentCommandIdempotencyKey(context, input.idempotency_key),
+                    source: 'agent-server',
+                    ...content,
+                    materializationWindow: materializationWindow(content),
+                    enforceBookingRules: true,
+                });
+                const answer = async (result) => {
+                    const created = await tenantStore.getCalendarEvent({ tenantRef, ownerRef, externalRef: result.externalRef });
+                    if (!created)
+                        throw new SlotlockAgentOperationError('store_inconsistent', 503);
+                    return { event: projectSlotlockCalendarEvent(created), replayed: result.idempotent };
+                };
+                // A retry answers the member the first call booked, whichever it was.
+                const earlier = await tenantStore.getCalendarEvent({ tenantRef, ownerRef, externalRef });
+                if (earlier) {
+                    const replay = await put(earlier.resourceId);
+                    if (!replay.ok)
+                        throw operationError(replay);
+                    return answer(replay);
+                }
+                const members = await tenantStore.listPoolMembers({ tenantRef, pool: input.pool, visibility: 'shared' });
+                if (members.length === 0)
+                    throw new SlotlockAgentOperationError('pool_not_found', 404);
+                // Each member in turn, each try its own savepoint: a member that is taken or that the
+                // booking's rules refuse is passed over; the exclusion constraint still decides each one.
+                for (const member of members) {
+                    const result = await put(member.id);
+                    if (result.ok)
+                        return answer(result);
+                    if (result.code !== 'overlap' && result.code !== 'booking_rule_violated') {
+                        throw operationError(result);
+                    }
+                }
+                throw new SlotlockAgentOperationError('pool_full', 409);
+            }, WRITE);
+        },
+        async getPoolAvailability(context, input) {
+            const window = interval(input);
+            const pool = input.pool;
+            const charge = busyBudget();
+            let windowsLeft = MAX_REQUEST_RULE_WINDOWS;
+            const now = new Date();
+            return withTenant(store, context, async (tenantStore) => {
+                const tenantRef = context.principal.tenantRef;
+                const members = await tenantStore.listPoolMembers({ tenantRef, pool, visibility: 'shared' });
+                if (members.length === 0)
+                    throw new SlotlockAgentOperationError('pool_not_found', 404);
+                // Each member's busy time, as edges: a count of busy members that rises and falls.
+                const edges = new Map([
+                    [window.start.getTime(), 0],
+                    [window.end.getTime(), 0],
+                ]);
+                let complete = true;
+                for (const member of members) {
+                    const sources = await requiredSources(options, context, member);
+                    const freeBusy = await readFreeBusy(tenantStore, {
+                        tenantRef,
+                        resourceId: member.id,
+                        window,
+                        requiredSources: [...sources],
+                        ...(options.coverageMaxAgeMs !== undefined
+                            ? { coverageMaxAgeMs: options.coverageMaxAgeMs }
+                            : {}),
+                    });
+                    charge(freeBusy.busy.length);
+                    if (freeBusy.coverage.state !== 'complete')
+                        complete = false;
+                    // Not free either where its booking rules refuse a booking: before its notice, past how
+                    // far ahead it books, and, when it enforces them, outside its bookable hours. Its slot
+                    // step is not counted: it moves when a booking may start, not whether the member is free.
+                    const rules = member.bookingRules;
+                    const search = bookingSearch({ rules, timezone: member.timezone, window, now });
+                    const latestStart = rules?.maxAdvanceDays !== undefined
+                        ? now.getTime() + rules.maxAdvanceDays * 86_400_000
+                        : window.end.getTime();
+                    let open = search
+                        ? [{ start: search.window.start, end: new Date(Math.min(search.window.end.getTime(), latestStart)) }]
+                        : [];
+                    if (rules?.enforceHours === true && open.length > 0) {
+                        const hours = member.availabilityRules ?? (await options.availabilityRules(context, member));
+                        const windows = expandRules(hours, window, member.timezone);
+                        windowsLeft -= windows.length;
+                        if (windowsLeft < 0)
+                            throw new SlotlockAgentOperationError('calendar_work_limit', 400);
+                        open = windows.flatMap((hoursWindow) => {
+                            const start = Math.max(hoursWindow.start.getTime(), open[0].start.getTime());
+                            const end = Math.min(hoursWindow.end.getTime(), open[0].end.getTime());
+                            return end > start ? [{ start: new Date(start), end: new Date(end) }] : [];
+                        });
+                    }
+                    const closed = [];
+                    let from = window.start.getTime();
+                    for (const part of mergeIntervals(open.filter((part) => part.end > part.start))) {
+                        if (part.start.getTime() > from)
+                            closed.push({ start: new Date(from), end: part.start });
+                        from = Math.max(from, part.end.getTime());
+                    }
+                    if (from < window.end.getTime())
+                        closed.push({ start: new Date(from), end: window.end });
+                    for (const taken of mergeIntervals([...freeBusy.busy, ...closed])) {
+                        edges.set(taken.start.getTime(), (edges.get(taken.start.getTime()) ?? 0) + 1);
+                        edges.set(taken.end.getTime(), (edges.get(taken.end.getTime()) ?? 0) - 1);
+                    }
+                }
+                const times = [...edges.keys()].sort((a, b) => a - b);
+                const intervals = [];
+                let busy = 0;
+                for (const [index, at] of times.entries()) {
+                    busy += edges.get(at) ?? 0;
+                    const next = times[index + 1];
+                    if (next === undefined || at >= window.end.getTime())
+                        break;
+                    const free = members.length - busy;
+                    const last = intervals.at(-1);
+                    // Parts with the same count are one.
+                    if (last && last.free === free)
+                        last.end = new Date(next).toISOString();
+                    else
+                        intervals.push({ start: new Date(at).toISOString(), end: new Date(next).toISOString(), free });
+                }
+                return {
+                    pool,
+                    members: members.length,
+                    intervals,
+                    coverage: coverageProjection(window, complete),
+                };
+            });
+        },
+        async bookTogether(context, rawInput) {
+            const input = rawInput;
+            // In one order for every bundle, so two over the same resources wait on each other in turn
+            // and never deadlock.
+            const resourceIds = [...new Set(input.resource_ids)].sort();
+            if (resourceIds.length < 2)
+                throw new SlotlockAgentOperationError('invalid_arguments', 400);
+            const content = {
+                start: new Date(input.starts_at),
+                end: new Date(input.ends_at),
+                timezone: input.timezone,
+                summary: eventSummary(input.title),
+                status: 'confirmed',
+                transparency: 'opaque',
+                attendees: [],
+                reminders: [],
+            };
+            return withTenant(store, context, async (tenantStore) => {
+                for (const resourceId of resourceIds) {
+                    try {
+                        await requireAgentResource(tenantStore, context.principal.tenantRef, resourceId);
+                    }
+                    catch (error) {
+                        if (!(error instanceof SlotlockAgentOperationError))
+                            throw error;
+                        throw new SlotlockAgentOperationError(error.code, error.status, { resource_id: resourceId });
+                    }
+                }
+                const events = [];
+                let replayed = true;
+                for (const resourceId of resourceIds) {
+                    const key = `${input.idempotency_key}\0${resourceId}`;
+                    const result = await tenantStore.putCalendarEvent({
+                        tenantRef: context.principal.tenantRef,
+                        ownerRef: agentOwnerRef(context),
+                        externalRef: agentExternalRef(context, key),
+                        resourceId,
+                        expectedRevision: 0,
+                        idempotencyKey: agentCommandIdempotencyKey(context, key),
+                        source: 'agent-server',
+                        ...content,
+                        materializationWindow: materializationWindow(content),
+                        enforceBookingRules: true,
+                    });
+                    // Thrown, so the whole transaction rolls back: the events already put go with it.
+                    if (!result.ok) {
+                        const refusal = operationError(result);
+                        throw new SlotlockAgentOperationError(refusal.code, refusal.status, { resource_id: resourceId });
+                    }
+                    const created = await tenantStore.getCalendarEvent({
+                        tenantRef: context.principal.tenantRef,
+                        ownerRef: agentOwnerRef(context),
+                        externalRef: result.externalRef,
+                    });
+                    if (!created)
+                        throw new SlotlockAgentOperationError('store_inconsistent', 503);
+                    events.push(projectSlotlockCalendarEvent(created));
+                    replayed &&= result.idempotent;
+                }
+                return { events, replayed };
+            }, WRITE);
+        },
+        async releaseSlots(context, input) {
+            const id = input.hold_id;
+            if (!STORE_ID_PATTERN.test(id))
+                return { released: false };
+            const result = await withTenant(store, context, async (tenantStore) => tenantStore.releaseHold(id, {
+                tenantRef: context.principal.tenantRef,
+                holderRef: agentOwnerRef(context),
+            }).then(({ released }) => ({ released })));
+            if (result.released)
+                await offerFreedTime(store, context.principal.tenantRef);
+            return result;
+        },
         async describeResource(context, resourceId) {
             if (!STORE_ID_PATTERN.test(resourceId))
                 return null;
@@ -210,6 +596,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
                 const resource = await tenantStore.getResource({
                     tenantRef: context.principal.tenantRef,
                     id: resourceId,
+                    visibility: 'shared',
                 });
                 return resource
                     ? { name: resource.externalRef ?? null, timezone: resource.timezone }
@@ -218,33 +605,48 @@ export function createSlotlockStoreAgentBackend(store, options) {
         },
         async listResources(context, input) {
             const cursor = parseResourceCursor(input.cursor);
+            const output = (resource) => ({
+                id: resource.id,
+                external_ref: resource.externalRef,
+                timezone: resource.timezone,
+                ...(resource.pool !== undefined ? { pool: resource.pool } : {}),
+            });
+            if (typeof input.pool === 'string') {
+                // A pool's members, in the order a pool booking tries them; at most 100, one page.
+                return withTenant(store, context, async (tenantStore) => ({
+                    resources: (await tenantStore.listPoolMembers({
+                        tenantRef: context.principal.tenantRef,
+                        pool: input.pool,
+                        visibility: 'shared',
+                    })).map(output),
+                    next_cursor: null,
+                }));
+            }
             return withTenant(store, context, async (tenantStore) => {
                 const limit = input.limit;
                 const resources = await tenantStore.listResources({
                     tenantRef: context.principal.tenantRef,
+                    visibility: 'shared',
                     limit: limit + 1,
                     ...(cursor !== undefined ? { after: cursor } : {}),
                 });
                 const page = resources.slice(0, limit);
                 return {
-                    resources: page.map((resource) => ({
-                        id: resource.id,
-                        external_ref: resource.externalRef,
-                        timezone: resource.timezone,
-                    })),
+                    resources: page.map(output),
                     next_cursor: resources.length > limit ? (page.at(-1)?.id ?? null) : null,
                 };
             });
         },
         async getFreeBusy(context, input) {
             const window = interval(input);
-            const resourceIds = input.resource_ids;
+            const resourceIds = distinctResourceIds(input);
+            const charge = busyBudget();
             return withTenant(store, context, async (tenantStore) => {
                 const resources = [];
                 for (const resourceId of resourceIds) {
-                    const resource = await requireResource(tenantStore, context.principal.tenantRef, resourceId);
+                    const resource = await requireAgentResource(tenantStore, context.principal.tenantRef, resourceId);
                     const sources = await requiredSources(options, context, resource);
-                    const result = await tenantStore.getFreeBusy({
+                    const result = await readFreeBusy(tenantStore, {
                         tenantRef: context.principal.tenantRef,
                         resourceId,
                         window,
@@ -253,6 +655,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
                             ? { coverageMaxAgeMs: options.coverageMaxAgeMs }
                             : {}),
                     });
+                    charge(result.busy.length);
                     resources.push({
                         resource_id: resourceId,
                         busy: result.busy.map((busy) => ({
@@ -267,32 +670,58 @@ export function createSlotlockStoreAgentBackend(store, options) {
         },
         async findNextAvailable(context, input) {
             const window = interval(input);
-            const resourceIds = input.resource_ids;
+            const resourceIds = distinctResourceIds(input);
             const durationMs = input.duration_minutes * 60_000;
+            const charge = busyBudget();
+            let windowsLeft = MAX_REQUEST_RULE_WINDOWS;
             return withTenant(store, context, async (tenantStore) => {
                 let best = null;
                 let incomplete = false;
                 for (const resourceId of resourceIds) {
-                    const resource = await requireResource(tenantStore, context.principal.tenantRef, resourceId);
+                    const resource = await requireAgentResource(tenantStore, context.principal.tenantRef, resourceId);
+                    // Only what a booking made now may take: the resource's booking rules bound the search,
+                    // as they bound the write that follows it.
+                    const search = bookingSearch({
+                        rules: resource.bookingRules,
+                        timezone: resource.timezone,
+                        window,
+                        now: new Date(),
+                    });
                     const sources = await requiredSources(options, context, resource);
-                    const freeBusy = await tenantStore.getFreeBusy({
+                    const freeBusy = await readFreeBusy(tenantStore, {
                         tenantRef: context.principal.tenantRef,
                         resourceId,
-                        window,
+                        // A slot's turnaround may run past the window: what it reaches must be free too.
+                        window: {
+                            start: window.start,
+                            end: new Date(window.end.getTime() + (search?.bufferAfterMs ?? 0)),
+                        },
                         requiredSources: [...sources],
                         ...(options.coverageMaxAgeMs !== undefined
                             ? { coverageMaxAgeMs: options.coverageMaxAgeMs }
                             : {}),
                     });
+                    charge(freeBusy.busy.length);
                     if (freeBusy.coverage.state !== 'complete') {
                         incomplete = true;
                         continue;
                     }
+                    if (!search)
+                        continue;
                     const rules = resource.availabilityRules ?? (await options.availabilityRules(context, resource));
+                    const windows = expandRules(rules, search.window, resource.timezone);
+                    windowsLeft -= windows.length;
+                    if (windowsLeft < 0)
+                        throw new SlotlockAgentOperationError('calendar_work_limit', 400);
+                    // A slot [s, s + d) with its turnaround meets busy [b, e) when [s, s + d) meets [b - t, e).
                     const candidate = findNextAvailable({
-                        busy: freeBusy.busy,
-                        windows: expandRules(rules, window, resource.timezone),
+                        busy: freeBusy.busy.map((busy) => ({
+                            start: new Date(busy.start.getTime() - search.bufferAfterMs),
+                            end: busy.end,
+                        })),
+                        windows,
                         durationMs,
+                        ...(search.align ? { align: search.align } : {}),
                     });
                     if (candidate &&
                         (!best ||
@@ -317,7 +746,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
         async createEvent(context, rawInput) {
             const input = rawInput;
             return withTenant(store, context, async (tenantStore) => {
-                await requireResource(tenantStore, context.principal.tenantRef, input.resource_id);
+                await requireAgentResource(tenantStore, context.principal.tenantRef, input.resource_id);
                 const recurrence = recurrenceFromInput(input.recurrence_rule, input.recurrence_exceptions);
                 const content = {
                     start: new Date(input.starts_at),
@@ -350,9 +779,15 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     source: 'agent-server',
                     ...content,
                     materializationWindow: materializationWindow(content),
+                    // An agent's event is a booking made now: the resource's booking rules apply.
+                    enforceBookingRules: true,
+                    // Booking a held time: only this agent's hold, which gives way in the same transaction.
+                    ...(typeof input.hold_id === 'string'
+                        ? { fromHold: { holdId: input.hold_id, holderRef: agentOwnerRef(context) } }
+                        : {}),
                 });
                 if (!result.ok)
-                    throw operationError(result.code);
+                    throw operationError(result);
                 const created = await tenantStore.getCalendarEvent({
                     tenantRef: context.principal.tenantRef,
                     ownerRef: agentOwnerRef(context),
@@ -361,7 +796,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
                 if (!created)
                     throw new SlotlockAgentOperationError('store_inconsistent', 503);
                 return { event: projectSlotlockCalendarEvent(created), replayed: result.idempotent };
-            });
+            }, WRITE);
         },
         async getEvent(context, input) {
             return withTenant(store, context, async (tenantStore) => {
@@ -377,13 +812,13 @@ export function createSlotlockStoreAgentBackend(store, options) {
         },
         async listEvents(context, input) {
             const window = interval(input);
-            const resourceIds = input.resource_ids;
+            const resourceIds = distinctResourceIds(input);
             const limit = input.limit;
             const after = parseEventCursor(input.cursor);
             return withTenant(store, context, async (tenantStore) => {
                 const combined = [];
                 for (const resourceId of resourceIds) {
-                    await requireResource(tenantStore, context.principal.tenantRef, resourceId);
+                    await requireAgentResource(tenantStore, context.principal.tenantRef, resourceId);
                     combined.push(...(await tenantStore.listCalendarEvents({
                         tenantRef: context.principal.tenantRef,
                         ownerRef: agentOwnerRef(context),
@@ -404,7 +839,12 @@ export function createSlotlockStoreAgentBackend(store, options) {
         },
         async updateEvent(context, rawInput) {
             const input = rawInput;
-            return withTenant(store, context, async (tenantStore) => {
+            // No event is on a resource the store never issued (an external reference, say).
+            if (input.expected_resource_id !== undefined &&
+                !STORE_ID_PATTERN.test(input.expected_resource_id)) {
+                throw new SlotlockAgentOperationError('event_not_found', 404);
+            }
+            const moved = await withTenant(store, context, async (tenantStore) => {
                 const current = await tenantStore.getCalendarEvent({
                     tenantRef: context.principal.tenantRef,
                     ownerRef: agentOwnerRef(context),
@@ -414,7 +854,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     throw new SlotlockAgentOperationError('event_not_found', 404);
                 const resourceId = input.resource_id ?? current.resourceId;
                 if (resourceId !== current.resourceId) {
-                    await requireResource(tenantStore, context.principal.tenantRef, resourceId);
+                    await requireAgentResource(tenantStore, context.principal.tenantRef, resourceId);
                 }
                 const recurrence = input.recurrence_rule === null
                     ? undefined
@@ -473,15 +913,20 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     tenantRef: context.principal.tenantRef,
                     ownerRef: agentOwnerRef(context),
                     externalRef: current.externalRef,
+                    // The caller's fence when it sent one, checked under the event's lock; otherwise the
+                    // resource just read, so a move between that read and the write is not overwritten.
+                    expectedResourceId: input.expected_resource_id ?? current.resourceId,
                     resourceId,
                     expectedRevision: input.expected_revision,
                     idempotencyKey: agentCommandIdempotencyKey(context, input.idempotency_key),
                     source: current.source ?? 'agent-server',
                     ...content,
                     materializationWindow: materializationWindow(content),
+                    // An agent's event is a booking made now: the resource's booking rules apply.
+                    enforceBookingRules: true,
                 });
                 if (!result.ok)
-                    throw operationError(result.code);
+                    throw operationError(result);
                 const updated = await tenantStore.getCalendarEvent({
                     tenantRef: context.principal.tenantRef,
                     ownerRef: agentOwnerRef(context),
@@ -490,10 +935,14 @@ export function createSlotlockStoreAgentBackend(store, options) {
                 if (!updated)
                     throw new SlotlockAgentOperationError('store_inconsistent', 503);
                 return { event: projectSlotlockCalendarEvent(updated), replayed: result.idempotent };
-            });
+            }, WRITE);
+            // A moved or shortened event may have freed the time it held.
+            if (!moved.replayed)
+                await offerFreedTime(store, context.principal.tenantRef);
+            return moved;
         },
         async deleteEvent(context, input) {
-            return withTenant(store, context, async (tenantStore) => {
+            const deleted = await withTenant(store, context, async (tenantStore) => {
                 const externalRef = input.event_id;
                 const current = await tenantStore.getCalendarEvent({
                     tenantRef: context.principal.tenantRef,
@@ -506,18 +955,22 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     tenantRef: context.principal.tenantRef,
                     ownerRef: agentOwnerRef(context),
                     externalRef,
+                    expectedResourceId: current.resourceId,
                     idempotencyKey: agentCommandIdempotencyKey(context, input.idempotency_key),
                     expectedRevision: input.expected_revision,
                 });
                 if (!result.ok)
-                    throw operationError(result.code);
+                    throw operationError(result);
                 return {
                     event_id: externalRef,
                     revision: result.revision,
                     deleted: true,
                     replayed: result.idempotent,
                 };
-            });
+            }, WRITE);
+            if (!deleted.replayed)
+                await offerFreedTime(store, context.principal.tenantRef);
+            return deleted;
         },
     };
 }
@@ -526,8 +979,9 @@ function storeRefusal(error) {
     const code = error?.code;
     if (typeof code !== 'string')
         return error;
-    if (code === 'resource_limit_reached')
+    if (code === 'resource_limit_reached' || code === 'resource_visibility_conflict') {
         return new SlotlockAgentOperationError(code, 409);
+    }
     if (code.startsWith('invalid_') && code !== 'invalid_transaction_isolation') {
         return new SlotlockAgentOperationError(code, 400);
     }
@@ -544,6 +998,49 @@ function applicationRefusal(code) {
         return new SlotlockAgentOperationError(code, 400);
     return new SlotlockAgentOperationError(code, 409);
 }
+function waitlistOutput(entry) {
+    return {
+        id: entry.id,
+        resource_id: entry.resourceId,
+        pool: entry.pool,
+        start: entry.start.toISOString(),
+        end: entry.end.toISOString(),
+        holder_ref: entry.holderRef,
+        offer_ttl_seconds: Math.round(entry.offerTtlMs / 1000),
+        status: entry.status,
+        hold_id: entry.holdId,
+        offered_resource_id: entry.offeredResourceId,
+        offered_at: entry.offeredAt?.toISOString() ?? null,
+        created_at: entry.createdAt.toISOString(),
+    };
+}
+/**
+ * Offer what a cancel or release just freed to the tenant's waitlist now, rather than at the next
+ * maintenance pass. Best effort, after the freeing transaction committed: maintenance offers
+ * whatever this misses.
+ */
+async function offerFreedTime(store, tenantRef) {
+    try {
+        await store.withTenant(tenantRef, (tenant) => tenant.offerWaitlist({ tenantRef, limit: 20 }));
+    }
+    catch {
+        // Left to maintenance.
+    }
+}
+function webhookOutput(endpoint) {
+    return {
+        id: endpoint.id,
+        url: endpoint.url,
+        event_types: endpoint.eventTypes,
+        created_at: endpoint.createdAt.toISOString(),
+        attempts: endpoint.attempts,
+        failing_since: endpoint.failingSince?.toISOString() ?? null,
+        last_status: endpoint.lastStatus,
+        last_error: endpoint.lastError,
+        disabled_at: endpoint.disabledAt?.toISOString() ?? null,
+        disabled_reason: endpoint.disabledReason,
+    };
+}
 function rulesOutput(rules) {
     if (!rules)
         return null;
@@ -568,12 +1065,60 @@ function rulesInput(value) {
         throw storeRefusal(error);
     }
 }
+/** Booking rules as the application API writes them, snake_case; `null` for none. */
+function bookingRulesOutput(rules) {
+    if (!rules)
+        return null;
+    return {
+        ...(rules.minNoticeMinutes !== undefined ? { min_notice_minutes: rules.minNoticeMinutes } : {}),
+        ...(rules.maxAdvanceDays !== undefined ? { max_advance_days: rules.maxAdvanceDays } : {}),
+        ...(rules.slotStepMinutes !== undefined ? { slot_step_minutes: rules.slotStepMinutes } : {}),
+        ...(rules.turnaroundMinutes !== undefined ? { turnaround_minutes: rules.turnaroundMinutes } : {}),
+        ...(rules.enforceHours !== undefined ? { enforce_hours: rules.enforceHours } : {}),
+        ...(rules.checkInMinutes !== undefined ? { check_in_minutes: rules.checkInMinutes } : {}),
+        ...(rules.requireCertain !== undefined ? { require_certain: rules.requireCertain } : {}),
+    };
+}
+function bookingRulesInput(value) {
+    if (value === null || value === undefined)
+        return null;
+    const input = value;
+    const rules = {};
+    if (input.min_notice_minutes !== undefined)
+        rules.minNoticeMinutes = input.min_notice_minutes;
+    if (input.max_advance_days !== undefined)
+        rules.maxAdvanceDays = input.max_advance_days;
+    if (input.slot_step_minutes !== undefined)
+        rules.slotStepMinutes = input.slot_step_minutes;
+    if (input.turnaround_minutes !== undefined)
+        rules.turnaroundMinutes = input.turnaround_minutes;
+    if (input.enforce_hours !== undefined)
+        rules.enforceHours = input.enforce_hours;
+    if (input.check_in_minutes !== undefined)
+        rules.checkInMinutes = input.check_in_minutes;
+    if (input.require_certain !== undefined)
+        rules.requireCertain = input.require_certain;
+    return rules;
+}
 function resourceOutput(resource) {
     return {
         id: resource.id,
         external_ref: resource.externalRef,
         timezone: resource.timezone,
         availability: rulesOutput(resource.availabilityRules),
+        booking_rules: bookingRulesOutput(resource.bookingRules),
+        visibility: resource.visibility ?? 'shared',
+        archived_at: resource.archivedAt?.toISOString() ?? null,
+        pool: resource.pool ?? null,
+    };
+}
+/** Any of a tenant's events: the store's id, which the tenant-event routes take, and its owner's. */
+function tenantEventOutput(event) {
+    return {
+        ...projectSlotlockCalendarEvent(event),
+        id: event.id,
+        event_ref: event.externalRef,
+        owner_ref: event.ownerRef,
     };
 }
 function holdOutput(hold) {
@@ -599,6 +1144,26 @@ function reservationOutput(reservation) {
         source: reservation.source,
     };
 }
+/**
+ * The namespace an application caller's idempotency keys live in: a digest of its tenant and
+ * subject, so the authenticated subject never lands in a durable row.
+ */
+function applicationPrincipalRef(context) {
+    return `application:${createHash('sha256')
+        .update(`${context.principal.tenantRef}\0${context.principal.subject}`)
+        .digest('hex')}`;
+}
+/**
+ * An application caller's event command key: its tenant, subject and own key, digested, so one
+ * caller's key never replays another's command and neither the subject nor the raw key is stored.
+ */
+function applicationCommandKey(context, idempotencyKey) {
+    return `application-command:${createHash('sha256')
+        .update(`${context.principal.tenantRef}\0${context.principal.subject}\0${idempotencyKey}`)
+        .digest('hex')}`;
+}
+/** The most busy intervals one slotlock_list_busy answers, as one free/busy request reads. */
+const MAX_LISTED_BUSY = MAX_REQUEST_BUSY_INTERVALS;
 /**
  * Serve the application API (application-api.ts) from the production store, in the principal's
  * tenant. Every resource an operation names must be the tenant's, or it is not found; holds are
@@ -613,7 +1178,37 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
     if (!(Number.isSafeInteger(batches) && batches >= 1 && batches <= 100)) {
         throw new RangeError('maintenanceBatches must be a whole number from 1 to 100');
     }
+    const tenantErasure = options.tenantErasure === true;
     const tenantOf = (context) => context.principal.tenantRef;
+    async function history(context, input) {
+        const page = {
+            tenantRef: tenantOf(context),
+            limit: input.limit,
+            ...(input.before !== undefined ? { before: input.before } : {}),
+        };
+        return withTenant(store, context, async (tenant) => {
+            let entries;
+            if (typeof input.resource_id === 'string') {
+                await requireResource(tenant, tenantOf(context), input.resource_id);
+                entries = await tenant.listHistory({ ...page, resourceId: input.resource_id });
+            }
+            else {
+                const subject = (input.reservation_ref ?? input.event_id);
+                entries = await tenant.listHistory({ ...page, subject });
+            }
+            const limit = input.limit;
+            return {
+                history: entries.map((entry) => ({
+                    id: entry.id,
+                    type: entry.type,
+                    time: entry.occurredAt.toISOString(),
+                    actor: entry.actor,
+                    data: entry.data,
+                })),
+                next_before: entries.length === limit ? (entries.at(-1)?.id ?? null) : null,
+            };
+        });
+    }
     return {
         async createResource(context, input) {
             // A capped create counts under READ COMMITTED; withTenant opens it for the call.
@@ -623,6 +1218,9 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                         tenantRef: tenantOf(context),
                         externalRef: input.external_ref,
                         timezone: input.timezone,
+                        ...(input.visibility !== undefined
+                            ? { visibility: input.visibility }
+                            : {}),
                         ...(max !== undefined ? { maxTenantResources: max } : {}),
                     });
                     return { resource: resourceOutput(resource) };
@@ -637,6 +1235,59 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 resource: resourceOutput(await requireResource(tenant, tenantOf(context), input.resource_id)),
             }));
         },
+        async archiveResource(context, input) {
+            const id = input.resource_id;
+            if (!STORE_ID_PATTERN.test(id))
+                throw new SlotlockAgentOperationError('resource_not_found', 404);
+            return withTenant(store, context, async (tenant) => {
+                const resource = await tenant.archiveResource({ tenantRef: tenantOf(context), id });
+                if (!resource)
+                    throw new SlotlockAgentOperationError('resource_not_found', 404);
+                return { resource: resourceOutput(resource) };
+            }, WRITE);
+        },
+        async restoreResource(context, input) {
+            const id = input.resource_id;
+            if (!STORE_ID_PATTERN.test(id))
+                throw new SlotlockAgentOperationError('resource_not_found', 404);
+            return withTenant(store, context, async (tenant) => {
+                const resource = await tenant.restoreResource({ tenantRef: tenantOf(context), id });
+                if (!resource)
+                    throw new SlotlockAgentOperationError('resource_not_found', 404);
+                return { resource: resourceOutput(resource) };
+            }, WRITE);
+        },
+        async deleteResource(context, input) {
+            const id = input.resource_id;
+            // An id the store never issues names no resource: there is nothing to delete.
+            if (!STORE_ID_PATTERN.test(id))
+                return { deleted: false };
+            return withTenant(store, context, async (tenant) => {
+                const result = await tenant.deleteResource({ tenantRef: tenantOf(context), id });
+                if (!result.ok)
+                    throw applicationRefusal(result.code);
+                return { deleted: result.deleted };
+            }, WRITE);
+        },
+        async listBusy(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                const resource = await requireResource(tenant, tenantOf(context), input.resource_id);
+                // One row past the cap is enough to refuse: the rest is never read.
+                const busy = await tenant.listBusy(resource.id, interval(input), {
+                    tenantRef: tenantOf(context),
+                    limit: MAX_LISTED_BUSY + 1,
+                });
+                if (busy.length > MAX_LISTED_BUSY) {
+                    throw new SlotlockAgentOperationError('calendar_work_limit', 400);
+                }
+                return {
+                    busy: busy.map((occupied) => ({
+                        start: occupied.start.toISOString(),
+                        end: occupied.end.toISOString(),
+                    })),
+                };
+            });
+        },
         async setResourceAvailability(context, input) {
             const rules = rulesInput(input.rules);
             const id = input.resource_id;
@@ -655,6 +1306,105 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 return { resource: resourceOutput(resource) };
             });
         },
+        async exportResourceAvailability(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                const resource = await requireResource(tenant, tenantOf(context), input.resource_id);
+                if (resource.availabilityRules === undefined)
+                    return { icalendar: null };
+                return {
+                    icalendar: emitVAvailability({
+                        rules: resource.availabilityRules,
+                        timezone: resource.timezone,
+                        uid: `${resource.id}-hours`,
+                    }),
+                };
+            });
+        },
+        async importResourceAvailability(context, input) {
+            let parsed;
+            try {
+                parsed = parseVAvailability(input.icalendar);
+            }
+            catch (error) {
+                throw storeRefusal(error);
+            }
+            const id = input.resource_id;
+            if (!STORE_ID_PATTERN.test(id))
+                throw new SlotlockAgentOperationError('resource_not_found', 404);
+            return withTenant(store, context, async (tenant) => {
+                const current = await requireResource(tenant, tenantOf(context), id);
+                // Rules are read in the resource's zone: times written in another would land elsewhere.
+                if (parsed.timezone !== null && parsed.timezone !== current.timezone) {
+                    throw new SlotlockAgentOperationError('invalid_availability', 400, {
+                        timezone: parsed.timezone,
+                        resource_timezone: current.timezone,
+                    });
+                }
+                let resource;
+                try {
+                    resource = await tenant.setResourceAvailability({
+                        tenantRef: tenantOf(context),
+                        id,
+                        rules: parsed.rules,
+                    });
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+                if (!resource)
+                    throw new SlotlockAgentOperationError('resource_not_found', 404);
+                return { resource: resourceOutput(resource) };
+            });
+        },
+        async setResourceBookingRules(context, input) {
+            const rules = bookingRulesInput(input.rules);
+            const id = input.resource_id;
+            if (!STORE_ID_PATTERN.test(id))
+                throw new SlotlockAgentOperationError('resource_not_found', 404);
+            return withTenant(store, context, async (tenant) => {
+                let resource;
+                try {
+                    resource = await tenant.setResourceBookingRules({ tenantRef: tenantOf(context), id, rules });
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+                if (!resource)
+                    throw new SlotlockAgentOperationError('resource_not_found', 404);
+                return { resource: resourceOutput(resource) };
+            });
+        },
+        async setResourcePool(context, input) {
+            const id = input.resource_id;
+            if (!STORE_ID_PATTERN.test(id))
+                throw new SlotlockAgentOperationError('resource_not_found', 404);
+            return withTenant(store, context, async (tenant) => {
+                let resource;
+                try {
+                    resource = await tenant.setResourcePool({ tenantRef: tenantOf(context), id, pool: input.pool });
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+                if (!resource)
+                    throw new SlotlockAgentOperationError('resource_not_found', 404);
+                return { resource: resourceOutput(resource) };
+            }, WRITE);
+        },
+        async getResourceHistory(context, input) {
+            return history(context, input);
+        },
+        async getReservationHistory(context, input) {
+            return history(context, input);
+        },
+        async getTenantEventHistory(context, input) {
+            return history(context, input);
+        },
+        async listPools(context) {
+            return withTenant(store, context, async (tenant) => ({
+                pools: await tenant.listPools({ tenantRef: tenantOf(context) }),
+            }));
+        },
         async setTenantAvailability(context, input) {
             const rules = rulesInput(input.rules);
             return withTenant(store, context, async (tenant) => {
@@ -675,15 +1425,51 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
             return withTenant(store, context, async (tenant) => {
                 const resource = await requireResource(tenant, tenantOf(context), input.resource_id);
                 const result = await tenant.acquireHold({
+                    tenantRef: tenantOf(context),
                     resourceId: resource.id,
                     start: new Date(input.start),
                     end: new Date(input.end),
                     ttlMs: input.ttl_seconds * 1_000,
                     ...(input.source !== undefined ? { source: input.source } : {}),
+                    ...(input.buffer_after_minutes !== undefined
+                        ? { bufferAfterMs: input.buffer_after_minutes * 60_000 }
+                        : {}),
+                    // A retried request with the caller's key answers the hold the first one made.
+                    ...(input.idempotency_key !== undefined
+                        ? {
+                            idempotencyKey: input.idempotency_key,
+                            principalRef: applicationPrincipalRef(context),
+                        }
+                        : {}),
                 });
                 if (!result.ok)
                     throw applicationRefusal(result.code);
                 return { hold: holdOutput(result.hold) };
+            }, WRITE);
+        },
+        async getHold(context, input) {
+            const id = input.hold_id;
+            if (!STORE_ID_PATTERN.test(id))
+                throw new SlotlockAgentOperationError('hold_not_found', 404);
+            return withTenant(store, context, async (tenant) => {
+                const hold = await tenant.getHold({ tenantRef: tenantOf(context), holdId: id });
+                if (!hold)
+                    throw new SlotlockAgentOperationError('hold_not_found', 404);
+                return { hold: holdOutput(hold) };
+            });
+        },
+        async listHolds(context, input) {
+            const limit = input.limit;
+            const after = parseEventCursor(input.cursor);
+            return withTenant(store, context, async (tenant) => {
+                const resource = await requireResource(tenant, tenantOf(context), input.resource_id);
+                const { shown, next } = page(await tenant.listHolds({
+                    tenantRef: tenantOf(context),
+                    resourceId: resource.id,
+                    limit: limit + 1,
+                    ...(after ? { after } : {}),
+                }), limit);
+                return { holds: shown.map(holdOutput), next_cursor: next };
             });
         },
         async confirmHold(context, input) {
@@ -695,19 +1481,48 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 if (!result.ok)
                     throw applicationRefusal(result.code);
                 return { reservation: reservationOutput(result.reservation) };
-            });
+            }, WRITE);
         },
         async releaseHold(context, input) {
             const id = input.hold_id;
             // An id that is not one the store issues names no hold: there is nothing to release.
             if (!STORE_ID_PATTERN.test(id))
                 return { released: false };
-            return withTenant(store, context, async (tenant) => ({
+            const released = await withTenant(store, context, async (tenant) => ({
                 released: (await tenant.releaseHold(id, { tenantRef: tenantOf(context) })).released,
             }));
+            if (released.released)
+                await offerFreedTime(store, tenantOf(context));
+            return released;
         },
-        async putReservation(context, input) {
+        async getReservation(context, input) {
             return withTenant(store, context, async (tenant) => {
+                const reservation = await tenant.getReservation({
+                    tenantRef: tenantOf(context),
+                    externalRef: input.reservation_ref,
+                });
+                if (!reservation)
+                    throw new SlotlockAgentOperationError('reservation_not_found', 404);
+                return { reservation: reservationOutput(reservation) };
+            });
+        },
+        async listReservations(context, input) {
+            const limit = input.limit;
+            const after = parseEventCursor(input.cursor);
+            return withTenant(store, context, async (tenant) => {
+                const resource = await requireResource(tenant, tenantOf(context), input.resource_id);
+                const { shown, next } = page(await tenant.listReservations({
+                    tenantRef: tenantOf(context),
+                    resourceId: resource.id,
+                    window: interval(input),
+                    limit: limit + 1,
+                    ...(after ? { after } : {}),
+                }), limit);
+                return { reservations: shown.map(reservationOutput), next_cursor: next };
+            });
+        },
+        async putReservation(context, input) {
+            const put = await withTenant(store, context, async (tenant) => {
                 const resource = await requireResource(tenant, tenantOf(context), input.resource_id);
                 const command = {
                     tenantRef: tenantOf(context),
@@ -725,10 +1540,15 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 if (!result.ok)
                     throw applicationRefusal(result.code);
                 return { reservation: reservationOutput(result.reservation), replayed: result.idempotent };
-            });
+            }, WRITE);
+            // A move frees the time the booking held.
+            if (input.revision > 1 && !put.replayed) {
+                await offerFreedTime(store, tenantOf(context));
+            }
+            return put;
         },
         async cancelReservation(context, input) {
-            return withTenant(store, context, async (tenant) => {
+            const cancelled = await withTenant(store, context, async (tenant) => {
                 const result = await tenant.cancelExternalReservation({
                     tenantRef: tenantOf(context),
                     externalRef: input.reservation_ref,
@@ -737,8 +1557,103 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 if (!result.ok)
                     throw applicationRefusal(result.code);
                 return { cancelled: result.cancelled, revision: result.revision };
+            }, WRITE);
+            if (cancelled.cancelled)
+                await offerFreedTime(store, tenantOf(context));
+            return cancelled;
+        },
+        async checkInReservation(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                const result = await tenant.checkInReservation({
+                    tenantRef: tenantOf(context),
+                    externalRef: input.reservation_ref,
+                });
+                if (!result.ok)
+                    throw applicationRefusal(result.code);
+                return { reference: result.reference, checked_in_at: result.checkedInAt.toISOString() };
             });
         },
+        async joinWaitlist(context, input) {
+            const ttl = input.offer_ttl_seconds;
+            return withTenant(store, context, async (tenant) => {
+                const result = await tenant.joinWaitlist({
+                    tenantRef: tenantOf(context),
+                    ...(input.resource_id !== undefined ? { resourceId: input.resource_id } : {}),
+                    ...(input.pool !== undefined ? { pool: input.pool } : {}),
+                    start: new Date(input.start),
+                    end: new Date(input.end),
+                    holderRef: input.holder_ref,
+                    ...(ttl !== undefined ? { offerTtlMs: ttl * 1000 } : {}),
+                });
+                if (!result.ok)
+                    throw applicationRefusal(result.code);
+                return { entry: waitlistOutput(result.entry) };
+            });
+        },
+        async listWaitlist(context, input) {
+            return withTenant(store, context, async (tenant) => ({
+                entries: (await tenant.listWaitlist({
+                    tenantRef: tenantOf(context),
+                    limit: input.limit,
+                    ...(input.resource_id !== undefined ? { resourceId: input.resource_id } : {}),
+                    ...(input.pool !== undefined ? { pool: input.pool } : {}),
+                    ...(input.holder_ref !== undefined ? { holderRef: input.holder_ref } : {}),
+                })).map(waitlistOutput),
+            }));
+        },
+        async leaveWaitlist(context, input) {
+            const left = await withTenant(store, context, async (tenant) => ({
+                left: await tenant.leaveWaitlist({ tenantRef: tenantOf(context), id: input.entry_id }),
+            }));
+            if (left.left)
+                await offerFreedTime(store, tenantOf(context));
+            return left;
+        },
+        async getCoverage(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                const resource = await requireResource(tenant, tenantOf(context), input.resource_id);
+                const sources = await tenant.listCoverage({ tenantRef: tenantOf(context), resourceId: resource.id });
+                return {
+                    sources: sources.map((source) => ({
+                        source: source.source,
+                        start: source.start.toISOString(),
+                        end: source.end.toISOString(),
+                        revision: source.revision,
+                        observed_at: source.observedAt.toISOString(),
+                        last_error: source.lastError,
+                        last_error_at: source.lastErrorAt?.toISOString() ?? null,
+                        stale: source.stale,
+                    })),
+                };
+            });
+        },
+        async recordCoverageFailure(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                const resource = await requireResource(tenant, tenantOf(context), input.resource_id);
+                const result = await tenant.recordCoverageFailure({
+                    tenantRef: tenantOf(context),
+                    resourceId: resource.id,
+                    source: input.source,
+                    error: input.error,
+                });
+                if (!result.ok)
+                    throw applicationRefusal(result.code);
+                return { recorded: true };
+            }, WRITE);
+        },
+        async deleteCoverage(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                const resource = await requireResource(tenant, tenantOf(context), input.resource_id);
+                const deleted = await tenant.deleteCoverage({
+                    tenantRef: tenantOf(context),
+                    resourceId: resource.id,
+                    source: input.source,
+                });
+                if (!deleted)
+                    throw applicationRefusal('coverage_not_found');
+                return { deleted: true };
+            }, WRITE);
+        },
         async recordCoverage(context, input) {
             return withTenant(store, context, async (tenant) => {
                 const resource = await requireResource(tenant, tenantOf(context), input.resource_id);
@@ -752,16 +1667,161 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 if (!result.ok)
                     throw applicationRefusal(result.code);
                 return { revision: result.revision, replayed: result.idempotent };
+            }, WRITE);
+        },
+        async listTenantEvents(context, input) {
+            const limit = input.limit;
+            const after = parseEventCursor(input.cursor);
+            return withTenant(store, context, async (tenant) => {
+                const resource = await requireResource(tenant, tenantOf(context), input.resource_id);
+                const { shown, next } = page(await tenant.listCalendarEvents({
+                    tenantRef: tenantOf(context),
+                    allOwners: true,
+                    resourceId: resource.id,
+                    window: interval(input),
+                    limit: limit + 1,
+                    ...(after ? { after } : {}),
+                }), limit);
+                return { events: shown.map(tenantEventOutput), next_cursor: next };
             });
         },
+        async getTenantEvent(context, input) {
+            const id = input.event_id;
+            if (!STORE_ID_PATTERN.test(id))
+                throw new SlotlockAgentOperationError('event_not_found', 404);
+            return withTenant(store, context, async (tenant) => {
+                const event = await tenant.getCalendarEventById({ tenantRef: tenantOf(context), eventId: id });
+                if (!event)
+                    throw new SlotlockAgentOperationError('event_not_found', 404);
+                return { event: tenantEventOutput(event) };
+            });
+        },
+        async exportTenantEvent(context, input) {
+            const id = input.event_id;
+            if (!STORE_ID_PATTERN.test(id))
+                throw new SlotlockAgentOperationError('event_not_found', 404);
+            return withTenant(store, context, async (tenant) => {
+                const event = await tenant.getCalendarEventById({ tenantRef: tenantOf(context), eventId: id });
+                if (!event)
+                    throw new SlotlockAgentOperationError('event_not_found', 404);
+                return { event: toJSCalendarEvent(event) };
+            });
+        },
+        async cancelTenantEvent(context, input) {
+            const id = input.event_id;
+            const expectedResourceId = input.expected_resource_id;
+            // An id the store never issues names no event, and no event is on a resource it never issued.
+            if (!STORE_ID_PATTERN.test(id) ||
+                (expectedResourceId !== undefined && !STORE_ID_PATTERN.test(expectedResourceId))) {
+                throw new SlotlockAgentOperationError('event_not_found', 404);
+            }
+            const cancelled = await withTenant(store, context, async (tenant) => {
+                const result = await tenant.cancelCalendarEventById({
+                    tenantRef: tenantOf(context),
+                    eventId: id,
+                    idempotencyKey: applicationCommandKey(context, input.idempotency_key),
+                    expectedRevision: input.expected_revision,
+                    ...(expectedResourceId !== undefined ? { expectedResourceId } : {}),
+                });
+                if (!result.ok)
+                    throw applicationRefusal(result.code);
+                return {
+                    event_id: result.eventId,
+                    revision: result.revision,
+                    cancelled: true,
+                    replayed: result.idempotent,
+                };
+            }, WRITE);
+            if (!cancelled.replayed)
+                await offerFreedTime(store, tenantOf(context));
+            return cancelled;
+        },
+        async getTenant(context) {
+            return withTenant(store, context, async (tenant) => ({
+                tenant: {
+                    ref: tenantOf(context),
+                    suspended: await tenant.isTenantSuspended({ tenantRef: tenantOf(context) }),
+                },
+            }));
+        },
+        async eraseTenant(context, input) {
+            if (!tenantErasure)
+                throw new SlotlockAgentOperationError('tenant_erasure_disabled', 403);
+            // The reference, not a yes: a key of another tenant than the caller believes cannot erase it.
+            if (input.confirm_tenant_ref !== tenantOf(context)) {
+                throw new SlotlockAgentOperationError('invalid_confirmation', 400);
+            }
+            return withTenant(store, context, async (tenant) => {
+                // Read under the tenant's lock, which a suspension waits for: a suspended tenant's data is
+                // kept for its operator, who erases it (slotlock tenant erase) when they decide to.
+                if (await tenant.isTenantSuspended({ tenantRef: tenantOf(context) })) {
+                    throw new SlotlockAgentOperationError('tenant_suspended', 403);
+                }
+                const erased = await tenant.eraseTenant({ tenantRef: tenantOf(context) });
+                return { total: erased.total, rows: erased.rows };
+            }, WRITE);
+        },
+        async listChanges(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                const page = await tenant.listChanges({
+                    tenantRef: tenantOf(context),
+                    limit: input.limit,
+                    ...(input.cursor !== undefined ? { after: input.cursor } : {}),
+                });
+                if (!page.ok) {
+                    throw new SlotlockAgentOperationError(page.code, page.code === 'cursor_expired' ? 410 : 400);
+                }
+                return { changes: page.changes.map(slotlockCloudEvent), next_cursor: page.next };
+            });
+        },
+        async createWebhook(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                const created = await tenant.createWebhookEndpoint({
+                    tenantRef: tenantOf(context),
+                    url: input.url,
+                    ...(input.event_types !== undefined ? { eventTypes: input.event_types } : {}),
+                });
+                if (!created.ok) {
+                    throw new SlotlockAgentOperationError(created.code, created.code === 'webhook_limit_reached' ? 409 : 400);
+                }
+                return { webhook: webhookOutput(created.endpoint), secret: created.secret };
+            }, WRITE);
+        },
+        async listWebhooks(context) {
+            return withTenant(store, context, async (tenant) => ({
+                webhooks: (await tenant.listWebhookEndpoints({ tenantRef: tenantOf(context) })).map(webhookOutput),
+            }));
+        },
+        async deleteWebhook(context, input) {
+            return withTenant(store, context, async (tenant) => tenant.deleteWebhookEndpoint({ tenantRef: tenantOf(context), id: input.webhook_id }), WRITE);
+        },
+        async enableWebhook(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                const enabled = await tenant.enableWebhookEndpoint({
+                    tenantRef: tenantOf(context),
+                    id: input.webhook_id,
+                });
+                if (!enabled)
+                    throw new SlotlockAgentOperationError('webhook_not_found', 404);
+                if ('code' in enabled)
+                    throw new SlotlockAgentOperationError(enabled.code, 409);
+                return { webhook: webhookOutput(enabled) };
+            }, WRITE);
+        },
         async runMaintenance(context) {
             assertActive(context);
             try {
+                // A caller goes round again while `capped`; when to do so at once is the scheduler's.
+                const { rollPending: _, zoneShifts, staleSources, noShows, waitlistOffers, ...result } = await maintainSlotlockTenant(store, tenantOf(context), {
+                    batches,
+                    signal: context.signal,
+                });
                 return {
-                    ...(await maintainSlotlockTenant(store, tenantOf(context), {
-                        batches,
-                        signal: context.signal,
-                    })),
+                    ...result,
+                    zone_shifts: zoneShifts,
+                    stale_sources: staleSources,
+                    no_shows: noShows,
+                    waitlist_offers: waitlistOffers,
                 };
             }
             catch (error) {