slotlock 0.5.1 → 0.5.3

package/ddl.js

@@ -11,6 +11,7 @@
 // the caller's search_path back at the end, so a caller that keeps going in the same transaction
 // resolves its own names as before. Apply it in one transaction: under autocommit every statement
 // is a transaction of its own, and the pin ends with the statement that sets it.
+import { SLOTLOCK_CHANGE_ORIGINS, slotlockCoverageSourceIdSql } from './event-feed.js';
 import { SLOTLOCK_MAX_AVAILABILITY_RULES } from './weekly-hours.js';
 const CALLER_SEARCH_PATH_SETTING = 'slotlock.caller_search_path';
 const DEPLOYMENT_SEARCH_PATH_PIN = `SELECT pg_catalog.set_config('${CALLER_SEARCH_PATH_SETTING}', pg_catalog.current_setting('search_path'), true);
@@ -239,6 +240,7 @@ export const SLOTLOCK_TENANT_ADMIN_TABLES = Object.freeze([
     'tenant_suspensions',
     'webhook_tenants',
     'rate_buckets',
+    'assistant_tenants',
 ]);
 /**
  * The SECURITY DEFINER functions through which a server checks a tenant's suspension and erases a
@@ -251,6 +253,8 @@ export const SLOTLOCK_TENANT_ADMIN_FUNCTIONS = Object.freeze([
     'slotlock.webhook_tenants(text)',
     'slotlock.unregister_webhook_tenant(text)',
     'slotlock.take_rate_token(text, double precision, double precision)',
+    'slotlock.register_assistant_tenant(text, timestamptz)',
+    'slotlock.sweep_assistant_conversations(integer)',
 ]);
 /**
  * Functions only the deployment role runs: suspending and lifting a suspension. No other role is
@@ -547,6 +551,55 @@ AS $slotlock_erase_api_keys$
   SELECT count(*) FROM erased;
 $slotlock_erase_api_keys$;
 REVOKE ALL ON FUNCTION ${SLOTLOCK_API_KEY_FUNCTIONS[5]} FROM PUBLIC;
+
+-- A key created, given a new secret or revoked appends to its tenant's feed (key.created,
+-- key.rotated, key.revoked): its id, scopes and expiry, never its digest, prefix or name. Only the
+-- functions above write keys, as the schema's owner, which forced row-level security on the feed
+-- binds too: the row is appended under the tenant's name in every setting a policy reads, and the
+-- caller's values are put back after. Who did it is the caller's actor, else the key's creator.
+CREATE OR REPLACE FUNCTION slotlock.outbox_api_key_change()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_outbox_api_key$
+DECLARE
+  kind text;
+  setting text;
+  previous jsonb := '{}'::jsonb;
+BEGIN
+  IF TG_OP = 'INSERT' THEN
+    kind := 'key.created';
+  ELSIF OLD.revoked_at IS NULL AND NEW.revoked_at IS NOT NULL THEN
+    kind := 'key.revoked';
+  ELSIF OLD.secret_hash IS DISTINCT FROM NEW.secret_hash THEN
+    kind := 'key.rotated';
+  ELSE
+    RETURN NULL;
+  END IF;
+  FOR setting IN
+    SELECT DISTINCT contract.tenant_context_setting FROM slotlock.rls_policy_contracts contract
+  LOOP
+    previous := previous || jsonb_build_object(setting, current_setting(setting, true));
+    PERFORM set_config(setting, NEW.tenant_ref, true);
+  END LOOP;
+  INSERT INTO slotlock.outbox (tenant_ref, type, subject, data, actor)
+  VALUES (
+    NEW.tenant_ref, kind, NEW.id::text,
+    jsonb_build_object(
+      'id', NEW.id, 'scopes', to_jsonb(NEW.scopes), 'expires_at', NEW.expires_at,
+      'revoked_at', NEW.revoked_at),
+    COALESCE(NULLIF(current_setting('slotlock.actor', true), ''),
+             CASE WHEN TG_OP = 'INSERT' THEN NEW.created_by END)
+  );
+  FOR setting IN SELECT jsonb_object_keys(previous) LOOP
+    PERFORM set_config(setting, COALESCE(previous ->> setting, ''), true);
+  END LOOP;
+  RETURN NULL;
+END
+$slotlock_outbox_api_key$;
+CREATE OR REPLACE TRIGGER slotlock_outbox_api_key_change
+  AFTER INSERT OR UPDATE OF revoked_at, secret_hash ON slotlock.api_keys
+  FOR EACH ROW EXECUTE FUNCTION slotlock.outbox_api_key_change();
 `;
 // The dashboard's records (dashboard.ts), shared by every server on this database: a finished sign-in
 // (its callback works once), a sent form (it runs once) and a signed-out session (a copied cookie
@@ -872,6 +925,18 @@ BEGIN
   DELETE FROM slotlock.waitlist_entries WHERE tenant_ref = requested_tenant_ref;
   GET DIAGNOSTICS erased_rows = ROW_COUNT;
   RETURN NEXT;
+  erased_table := 'booking_rule_defaults';
+  DELETE FROM slotlock.booking_rule_defaults WHERE tenant_ref = requested_tenant_ref;
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  RETURN NEXT;
+  erased_table := 'assistant_conversations';
+  DELETE FROM slotlock.assistant_conversations WHERE tenant_ref = requested_tenant_ref;
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  RETURN NEXT;
+  erased_table := 'assistant_settings';
+  DELETE FROM slotlock.assistant_settings WHERE tenant_ref = requested_tenant_ref;
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  RETURN NEXT;
   erased_table := 'resources';
   DELETE FROM slotlock.resources WHERE tenant_ref = requested_tenant_ref;
   GET DIAGNOSTICS erased_rows = ROW_COUNT;
@@ -889,6 +954,10 @@ BEGIN
   DELETE FROM slotlock.webhook_endpoints WHERE tenant_ref = requested_tenant_ref;
   GET DIAGNOSTICS erased_rows = ROW_COUNT;
   RETURN NEXT;
+  erased_table := 'assistant_tenants';
+  DELETE FROM slotlock.assistant_tenants WHERE tenant_ref = requested_tenant_ref;
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  RETURN NEXT;
   erased_table := 'webhook_tenants';
   DELETE FROM slotlock.webhook_tenants WHERE tenant_ref = requested_tenant_ref;
   GET DIAGNOSTICS erased_rows = ROW_COUNT;
@@ -1015,6 +1084,106 @@ BEGIN
 END
 $slotlock_take_rate_token$;
 REVOKE ALL ON FUNCTION ${SLOTLOCK_TENANT_ADMIN_FUNCTIONS[5]} FROM PUBLIC;
+
+-- The tenants with a dashboard assistant conversation, and when the first of them expires. Forced
+-- row-level security hides every other tenant's conversations, from the owner too, so this list
+-- (names and a time only) is how maintenance finds the tenants whose conversations have expired,
+-- whichever server stored them: one only the dashboard (or its Worker) ever used included. No role
+-- but its owner reads it.
+CREATE TABLE IF NOT EXISTS slotlock.assistant_tenants (
+  tenant_ref text PRIMARY KEY,
+  next_expiry timestamptz NOT NULL,
+  CONSTRAINT slotlock_assistant_tenants_tenant_ref_valid
+    CHECK (octet_length(tenant_ref) BETWEEN 1 AND 500)
+);
+CREATE INDEX IF NOT EXISTS slotlock_assistant_tenants_expiry_idx
+  ON slotlock.assistant_tenants (next_expiry);
+ALTER TABLE slotlock.assistant_tenants ENABLE ROW LEVEL SECURITY;
+REVOKE ALL ON slotlock.assistant_tenants FROM PUBLIC;
+
+-- Record that the tenant has a conversation expiring at expires (the earliest is kept).
+CREATE OR REPLACE FUNCTION slotlock.register_assistant_tenant(requested_tenant_ref text, expires timestamptz)
+RETURNS void
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_register_assistant_tenant$
+BEGIN
+  IF requested_tenant_ref IS NULL OR octet_length(requested_tenant_ref) NOT BETWEEN 1 AND 500
+     OR expires IS NULL THEN
+    RAISE EXCEPTION 'Slotlock assistant tenant arguments are invalid' USING ERRCODE = 'invalid_parameter_value';
+  END IF;
+  INSERT INTO slotlock.assistant_tenants AS kept (tenant_ref, next_expiry)
+  VALUES (requested_tenant_ref, expires)
+  ON CONFLICT (tenant_ref) DO UPDATE SET next_expiry = LEAST(kept.next_expiry, EXCLUDED.next_expiry);
+END
+$slotlock_register_assistant_tenant$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_TENANT_ADMIN_FUNCTIONS[6]} FROM PUBLIC;
+
+-- Delete expired assistant conversations across every tenant: up to max_rows of them, from the
+-- tenants whose earliest expiry has passed, longest overdue first, each under its own tenant
+-- context (forced row-level security binds the owner too), putting the caller's settings back
+-- after. A tenant left with none leaves the list; one with more is listed at its next expiry.
+-- Only a count comes back.
+CREATE OR REPLACE FUNCTION slotlock.sweep_assistant_conversations(max_rows integer)
+RETURNS bigint
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_sweep_assistant_conversations$
+DECLARE
+  setting text;
+  previous jsonb := '{}'::jsonb;
+  due record;
+  deleted bigint := 0;
+  step bigint;
+  upcoming timestamptz;
+BEGIN
+  IF max_rows IS NULL OR max_rows NOT BETWEEN 1 AND 100000 THEN
+    RAISE EXCEPTION 'Slotlock assistant sweep size must be 1-100,000' USING ERRCODE = 'invalid_parameter_value';
+  END IF;
+  FOR setting IN
+    SELECT DISTINCT contract.tenant_context_setting FROM slotlock.rls_policy_contracts contract
+  LOOP
+    previous := previous || jsonb_build_object(setting, current_setting(setting, true));
+  END LOOP;
+  FOR due IN
+    SELECT listed.tenant_ref FROM slotlock.assistant_tenants listed
+     WHERE listed.next_expiry <= now()
+     ORDER BY listed.next_expiry
+     LIMIT 1000
+       FOR UPDATE SKIP LOCKED
+  LOOP
+    EXIT WHEN deleted >= max_rows;
+    FOR setting IN SELECT jsonb_object_keys(previous) LOOP
+      PERFORM set_config(setting, due.tenant_ref, true);
+    END LOOP;
+    DELETE FROM slotlock.assistant_conversations gone
+     WHERE gone.tenant_ref = due.tenant_ref
+       AND gone.member_ref IN (
+         SELECT expired.member_ref FROM slotlock.assistant_conversations expired
+          WHERE expired.tenant_ref = due.tenant_ref AND expired.expires_at <= now()
+          LIMIT max_rows - deleted)
+       AND gone.expires_at <= now();
+    GET DIAGNOSTICS step = ROW_COUNT;
+    deleted := deleted + step;
+    SELECT min(live.expires_at) INTO upcoming FROM slotlock.assistant_conversations live
+     WHERE live.tenant_ref = due.tenant_ref;
+    IF upcoming IS NULL THEN
+      DELETE FROM slotlock.assistant_tenants WHERE tenant_ref = due.tenant_ref;
+    ELSE
+      UPDATE slotlock.assistant_tenants SET next_expiry = upcoming WHERE tenant_ref = due.tenant_ref;
+    END IF;
+  END LOOP;
+  FOR setting IN SELECT jsonb_object_keys(previous) LOOP
+    PERFORM set_config(setting, coalesce(previous ->> setting, ''), true);
+  END LOOP;
+  RETURN deleted;
+END
+$slotlock_sweep_assistant_conversations$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_TENANT_ADMIN_FUNCTIONS[7]} FROM PUBLIC;
 `;
 // A constraint an upgrade added NOT VALID (no table scan under its ACCESS EXCLUSIVE lock) is checked
 // here. applySchema runs this in a transaction of its own once the DDL has committed: inside the
@@ -1079,6 +1248,36 @@ CREATE TABLE IF NOT EXISTS slotlock.outbox (
 );
 -- Who made the change (withTenant's actor: an API key, an agent), for the history.
 ALTER TABLE slotlock.outbox ADD COLUMN IF NOT EXISTS actor text;
+-- Where it came from (withTenant's origin: mcp, a2a, rest, application, dashboard,
+-- dashboard-assistant, maintenance, library) and the API key that made it (withTenant's keyId).
+-- Added bare, so the rows already there keep null (an earlier release) and nothing is scanned under
+-- the lock; the defaults then bind only new rows. A write that names no origin (code calling the
+-- store outside withTenant, or SQL of its own) is \`library\`.
+ALTER TABLE slotlock.outbox ADD COLUMN IF NOT EXISTS origin text;
+ALTER TABLE slotlock.outbox ADD COLUMN IF NOT EXISTS key_id uuid;
+ALTER TABLE slotlock.outbox
+  ALTER COLUMN origin SET DEFAULT COALESCE(NULLIF(current_setting('slotlock.origin', true), ''), 'library'),
+  ALTER COLUMN key_id SET DEFAULT NULLIF(current_setting('slotlock.key_id', true), '')::uuid;
+-- The origins the API reads, and no other. NOT VALID, so adding it scans nothing under the lock;
+-- DEPLOYMENT_VALIDATE_CONSTRAINTS validates it after the migration commits. Its comment is the list
+-- it was built from: a release that changes the list replaces it, so an upgraded database never
+-- keeps refusing an origin the release writes.
+DO $slotlock_outbox_origin$
+BEGIN
+  ALTER TABLE slotlock.outbox DROP CONSTRAINT IF EXISTS slotlock_outbox_origin_valid;
+  IF (
+    SELECT pg_catalog.obj_description(oid, 'pg_constraint') FROM pg_catalog.pg_constraint
+     WHERE conrelid = 'slotlock.outbox'::regclass AND conname = 'slotlock_outbox_origin_known'
+  ) IS DISTINCT FROM '${SLOTLOCK_CHANGE_ORIGINS.join(' ')}' THEN
+    ALTER TABLE slotlock.outbox DROP CONSTRAINT IF EXISTS slotlock_outbox_origin_known;
+    ALTER TABLE slotlock.outbox
+      ADD CONSTRAINT slotlock_outbox_origin_known
+      CHECK (origin IN (${SLOTLOCK_CHANGE_ORIGINS.map((origin) => `'${origin}'`).join(', ')})) NOT VALID;
+    COMMENT ON CONSTRAINT slotlock_outbox_origin_known ON slotlock.outbox
+      IS '${SLOTLOCK_CHANGE_ORIGINS.join(' ')}';
+  END IF;
+END
+$slotlock_outbox_origin$;
 CREATE INDEX IF NOT EXISTS slotlock_outbox_tenant_resource_idx
   ON slotlock.outbox (tenant_ref, resource_id, id) WHERE resource_id IS NOT NULL;
 CREATE INDEX IF NOT EXISTS slotlock_outbox_tenant_subject_idx
@@ -1133,6 +1332,10 @@ $slotlock_outbox_mark_pruned$;
 CREATE OR REPLACE TRIGGER slotlock_outbox_mark_pruned
   AFTER DELETE ON slotlock.outbox REFERENCING OLD TABLE AS pruned
   FOR EACH STATEMENT EXECUTE FUNCTION slotlock.outbox_mark_pruned();
+-- Live updates poll each tenant's feed (change-watch.ts). A pre-release build woke readers with a
+-- notification trigger here, which made every outbox commit take the cluster-wide notify lock: drop it.
+DROP TRIGGER IF EXISTS slotlock_outbox_notify ON slotlock.outbox;
+DROP FUNCTION IF EXISTS slotlock.outbox_notify();
 
 CREATE TABLE IF NOT EXISTS slotlock.webhook_endpoints (
   id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -1160,14 +1363,31 @@ CREATE TABLE IF NOT EXISTS slotlock.webhook_endpoints (
     AND octet_length(url) BETWEEN 1 AND 2048
     AND secret ~ '^whsec_[A-Za-z0-9+/]{43}=$'
   ),
-  CONSTRAINT slotlock_webhook_endpoints_types_valid CHECK (
-    event_types IS NULL OR cardinality(event_types) BETWEEN 1 AND 20
+  CONSTRAINT slotlock_webhook_endpoints_type_count_valid CHECK (
+    event_types IS NULL OR cardinality(event_types) BETWEEN 1 AND 64
   ),
   CONSTRAINT slotlock_webhook_endpoints_error_valid CHECK (
     last_error IS NULL OR char_length(last_error) <= 500
   )
 );
 ALTER TABLE slotlock.webhook_endpoints ADD COLUMN IF NOT EXISTS changes_pruned boolean NOT NULL DEFAULT false;
+-- 0.5 allowed a filter of at most 20 types, fewer than there are now. The wider CHECK admits every
+-- row the old one did, so it is added NOT VALID (no scan under the lock), and the old one dropped.
+DO $slotlock_webhook_type_count$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_catalog.pg_constraint
+     WHERE conrelid = 'slotlock.webhook_endpoints'::regclass
+       AND conname = 'slotlock_webhook_endpoints_type_count_valid'
+  ) THEN
+    ALTER TABLE slotlock.webhook_endpoints
+      ADD CONSTRAINT slotlock_webhook_endpoints_type_count_valid CHECK (
+        event_types IS NULL OR cardinality(event_types) BETWEEN 1 AND 64
+      ) NOT VALID;
+  END IF;
+  ALTER TABLE slotlock.webhook_endpoints DROP CONSTRAINT IF EXISTS slotlock_webhook_endpoints_types_valid;
+END
+$slotlock_webhook_type_count$;
 CREATE INDEX IF NOT EXISTS slotlock_webhook_endpoints_tenant_idx
   ON slotlock.webhook_endpoints (tenant_ref, created_at);
 
@@ -1206,6 +1426,71 @@ CREATE INDEX IF NOT EXISTS slotlock_waitlist_entries_queue_idx
 CREATE INDEX IF NOT EXISTS slotlock_waitlist_entries_tenant_idx
   ON slotlock.waitlist_entries (tenant_ref, starts_at);
 
+-- Default booking rules (booking-rules.ts), for the tenant (pool_ref '') or for one of its pools:
+-- a resource's rules are the tenant's, overlaid by its pool's, overlaid by its own.
+CREATE TABLE IF NOT EXISTS slotlock.booking_rule_defaults (
+  tenant_ref text NOT NULL,
+  pool_ref text NOT NULL DEFAULT '',
+  rules jsonb NOT NULL,
+  updated_at timestamptz NOT NULL DEFAULT statement_timestamp(),
+  CONSTRAINT slotlock_booking_rule_defaults_pkey PRIMARY KEY (tenant_ref, pool_ref),
+  CONSTRAINT slotlock_booking_rule_defaults_identity_valid CHECK (
+    octet_length(tenant_ref) BETWEEN 1 AND 500
+    AND (pool_ref = '' OR pool_ref ~ '^[a-z0-9][a-z0-9._-]{0,99}$')
+  ),
+  CONSTRAINT slotlock_booking_rule_defaults_rules_valid CHECK (
+    jsonb_typeof(rules) = 'object' AND octet_length(rules::text) <= 4096
+  )
+);
+
+-- The model a tenant's dashboard assistant uses (dashboard.ts, assistant.ts), one row a tenant.
+-- The API key is stored only sealed (AES-256-GCM under the deployment's SLOTLOCK_ASSISTANT_SECRET,
+-- bound to the tenant), with its last four characters to show.
+CREATE TABLE IF NOT EXISTS slotlock.assistant_settings (
+  tenant_ref text PRIMARY KEY,
+  provider text NOT NULL,
+  base_url text NOT NULL,
+  model text NOT NULL,
+  sealed_key text,
+  key_hint text,
+  updated_by text,
+  updated_at timestamptz NOT NULL DEFAULT statement_timestamp(),
+  CONSTRAINT slotlock_assistant_settings_tenant_ref_valid CHECK (octet_length(tenant_ref) BETWEEN 1 AND 500),
+  CONSTRAINT slotlock_assistant_settings_provider_valid CHECK (provider IN ('anthropic', 'openai')),
+  CONSTRAINT slotlock_assistant_settings_base_url_valid CHECK (octet_length(base_url) BETWEEN 1 AND 2048),
+  CONSTRAINT slotlock_assistant_settings_model_valid CHECK (octet_length(model) BETWEEN 1 AND 200),
+  CONSTRAINT slotlock_assistant_settings_key_valid CHECK (
+    (sealed_key IS NULL) = (key_hint IS NULL)
+    AND (sealed_key IS NULL OR octet_length(sealed_key) BETWEEN 1 AND 8192)
+    AND (key_hint IS NULL OR char_length(key_hint) BETWEEN 1 AND 4)
+  ),
+  CONSTRAINT slotlock_assistant_settings_updated_by_valid
+    CHECK (updated_by IS NULL OR octet_length(updated_by) BETWEEN 1 AND 200)
+);
+
+-- One member's short-lived conversation with the dashboard assistant, and the writes it proposed
+-- (actions, by id, each pending until the member approves or dismisses it).
+CREATE TABLE IF NOT EXISTS slotlock.assistant_conversations (
+  tenant_ref text NOT NULL,
+  member_ref text NOT NULL,
+  messages jsonb NOT NULL DEFAULT '[]'::jsonb,
+  actions jsonb NOT NULL DEFAULT '{}'::jsonb,
+  updated_at timestamptz NOT NULL DEFAULT statement_timestamp(),
+  expires_at timestamptz NOT NULL,
+  CONSTRAINT slotlock_assistant_conversations_pkey PRIMARY KEY (tenant_ref, member_ref),
+  CONSTRAINT slotlock_assistant_conversations_identity_valid CHECK (
+    octet_length(tenant_ref) BETWEEN 1 AND 500 AND octet_length(member_ref) BETWEEN 1 AND 500
+  ),
+  CONSTRAINT slotlock_assistant_conversations_messages_valid CHECK (
+    jsonb_typeof(messages) = 'array' AND octet_length(messages::text) <= 262144
+  ),
+  CONSTRAINT slotlock_assistant_conversations_actions_valid CHECK (
+    jsonb_typeof(actions) = 'object' AND octet_length(actions::text) <= 131072
+  )
+);
+CREATE INDEX IF NOT EXISTS slotlock_assistant_conversations_expiry_idx
+  ON slotlock.assistant_conversations (tenant_ref, expires_at);
+
 -- The tenant a reservation row belongs to: its own, or (a hold) its resource's.
 CREATE OR REPLACE FUNCTION slotlock.outbox_reservation_change()
 RETURNS trigger
@@ -1380,6 +1665,163 @@ ALTER TABLE slotlock.calendar_coverage ADD COLUMN IF NOT EXISTS last_error text;
 ALTER TABLE slotlock.calendar_coverage ADD COLUMN IF NOT EXISTS last_error_at timestamptz;
 ALTER TABLE slotlock.calendar_coverage ADD COLUMN IF NOT EXISTS stale_reported_at timestamptz;
 
+-- Configuration changes (RFC 0002 P1-6): a resource's own settings, the sources its coverage is
+-- read from, and the tenant's webhook endpoints. Each change that alters something appends one row,
+-- with what it was before and after for the fields it changed; writing the same value again appends
+-- none. Erasure is not reported, as above.
+CREATE OR REPLACE FUNCTION slotlock.outbox_erasing(owner text)
+RETURNS boolean
+LANGUAGE sql
+STABLE
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_outbox_erasing$
+  SELECT owner = current_setting('slotlock.erasing', true)
+     AND current_user = (SELECT pg_catalog.pg_get_userbyid(nspowner) FROM pg_catalog.pg_namespace
+                          WHERE nspname = 'slotlock');
+$slotlock_outbox_erasing$;
+
+CREATE OR REPLACE FUNCTION slotlock.outbox_resource_change()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_outbox_resource$
+DECLARE
+  changed slotlock.resources%ROWTYPE;
+  kind text;
+  before jsonb := '{}'::jsonb;
+  after jsonb := '{}'::jsonb;
+  details jsonb;
+BEGIN
+  changed := CASE WHEN TG_OP = 'DELETE' THEN OLD ELSE NEW END;
+  IF changed.tenant_ref IS NULL OR slotlock.outbox_erasing(changed.tenant_ref) THEN RETURN NULL; END IF;
+  IF TG_OP = 'INSERT' THEN
+    kind := 'resource.created';
+    details := jsonb_build_object(
+      'timezone', NEW.timezone, 'visibility', NEW.visibility, 'pool', NEW.pool_ref,
+      'availability', NEW.availability_rules, 'booking_rules', NEW.booking_rules);
+  ELSIF TG_OP = 'DELETE' THEN
+    kind := 'resource.deleted';
+    details := '{}'::jsonb;
+  ELSIF (OLD.archived_at IS NULL) <> (NEW.archived_at IS NULL) THEN
+    kind := CASE WHEN NEW.archived_at IS NULL THEN 'resource.restored' ELSE 'resource.archived' END;
+    details := jsonb_build_object('archived_at', NEW.archived_at);
+  ELSE
+    -- Only what changed, under the names the API gives it; a null is kept (no pool, no rules).
+    IF OLD.external_ref IS DISTINCT FROM NEW.external_ref THEN
+      before := before || jsonb_build_object('reference', OLD.external_ref);
+      after := after || jsonb_build_object('reference', NEW.external_ref);
+    END IF;
+    IF OLD.timezone IS DISTINCT FROM NEW.timezone THEN
+      before := before || jsonb_build_object('timezone', OLD.timezone);
+      after := after || jsonb_build_object('timezone', NEW.timezone);
+    END IF;
+    IF OLD.pool_ref IS DISTINCT FROM NEW.pool_ref THEN
+      before := before || jsonb_build_object('pool', OLD.pool_ref);
+      after := after || jsonb_build_object('pool', NEW.pool_ref);
+    END IF;
+    IF OLD.availability_rules IS DISTINCT FROM NEW.availability_rules THEN
+      before := before || jsonb_build_object('availability', OLD.availability_rules);
+      after := after || jsonb_build_object('availability', NEW.availability_rules);
+    END IF;
+    IF OLD.booking_rules IS DISTINCT FROM NEW.booking_rules THEN
+      before := before || jsonb_build_object('booking_rules', OLD.booking_rules);
+      after := after || jsonb_build_object('booking_rules', NEW.booking_rules);
+    END IF;
+    IF after = '{}'::jsonb THEN RETURN NULL; END IF;
+    kind := 'resource.updated';
+    details := jsonb_build_object('before', before, 'after', after);
+  END IF;
+  INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+  VALUES (
+    changed.tenant_ref, changed.id, kind, changed.id::text,
+    jsonb_build_object('id', changed.id, 'reference', changed.external_ref) || details,
+    NULLIF(current_setting('slotlock.actor', true), '')
+  );
+  RETURN NULL;
+END
+$slotlock_outbox_resource$;
+
+-- A source first recorded, and deleted. Reading it again (a new revision) is progress, not a change
+-- of what the resource is read from, and appends nothing; neither does a resource's deletion, which
+-- takes its coverage with it and is its own change. The source is named by its digest (source_id):
+-- it can be an iCalendar URL with a token in it, or an address.
+CREATE OR REPLACE FUNCTION slotlock.outbox_coverage_change()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_outbox_coverage$
+DECLARE
+  changed slotlock.calendar_coverage%ROWTYPE;
+BEGIN
+  changed := CASE WHEN TG_OP = 'DELETE' THEN OLD ELSE NEW END;
+  IF slotlock.outbox_erasing(changed.tenant_ref) THEN RETURN NULL; END IF;
+  IF TG_OP = 'DELETE'
+     AND NOT EXISTS (SELECT 1 FROM slotlock.resources resource WHERE resource.id = OLD.resource_id) THEN
+    RETURN NULL;
+  END IF;
+  INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+  VALUES (
+    changed.tenant_ref, changed.resource_id,
+    CASE WHEN TG_OP = 'DELETE' THEN 'coverage.deleted' ELSE 'coverage.recorded' END,
+    ${slotlockCoverageSourceIdSql('changed.tenant_ref', 'changed.source')},
+    jsonb_strip_nulls(jsonb_build_object(
+      'resource_id', changed.resource_id,
+      'source_id', ${slotlockCoverageSourceIdSql('changed.tenant_ref', 'changed.source')},
+      'start', CASE WHEN TG_OP = 'INSERT' THEN changed.starts_at END,
+      'end', CASE WHEN TG_OP = 'INSERT' THEN changed.ends_at END,
+      'revision', CASE WHEN TG_OP = 'INSERT' THEN changed.revision END)),
+    NULLIF(current_setting('slotlock.actor', true), '')
+  );
+  RETURN NULL;
+END
+$slotlock_outbox_coverage$;
+
+-- An endpoint added, enabled again or deleted (disabling is webhook.disabled, from the delivery that
+-- gave up). Its id and the types it takes, never its URL, which can carry a token, or its secret.
+CREATE OR REPLACE FUNCTION slotlock.outbox_webhook_change()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_outbox_webhook$
+DECLARE
+  changed slotlock.webhook_endpoints%ROWTYPE;
+  kind text;
+BEGIN
+  changed := CASE WHEN TG_OP = 'DELETE' THEN OLD ELSE NEW END;
+  IF slotlock.outbox_erasing(changed.tenant_ref) THEN RETURN NULL; END IF;
+  IF TG_OP = 'INSERT' THEN
+    kind := 'webhook.created';
+  ELSIF TG_OP = 'DELETE' THEN
+    kind := 'webhook.deleted';
+  ELSIF OLD.disabled_at IS NOT NULL AND NEW.disabled_at IS NULL THEN
+    kind := 'webhook.enabled';
+  ELSE
+    RETURN NULL;
+  END IF;
+  INSERT INTO slotlock.outbox (tenant_ref, type, subject, data, actor)
+  VALUES (
+    changed.tenant_ref, kind, changed.id::text,
+    jsonb_build_object('id', changed.id, 'event_types', to_jsonb(changed.event_types)),
+    NULLIF(current_setting('slotlock.actor', true), '')
+  );
+  RETURN NULL;
+END
+$slotlock_outbox_webhook$;
+
+CREATE OR REPLACE TRIGGER slotlock_outbox_resource_change
+  AFTER INSERT OR UPDATE OR DELETE ON slotlock.resources
+  FOR EACH ROW EXECUTE FUNCTION slotlock.outbox_resource_change();
+CREATE OR REPLACE TRIGGER slotlock_outbox_coverage_change
+  AFTER INSERT OR DELETE ON slotlock.calendar_coverage
+  FOR EACH ROW EXECUTE FUNCTION slotlock.outbox_coverage_change();
+CREATE OR REPLACE TRIGGER slotlock_outbox_webhook_change
+  AFTER INSERT OR DELETE ON slotlock.webhook_endpoints
+  FOR EACH ROW EXECUTE FUNCTION slotlock.outbox_webhook_change();
+-- Only an update that sets disabled_at: leases and deliveries, which do not, cost nothing here.
+CREATE OR REPLACE TRIGGER slotlock_outbox_webhook_enabled
+  AFTER UPDATE OF disabled_at ON slotlock.webhook_endpoints
+  FOR EACH ROW EXECUTE FUNCTION slotlock.outbox_webhook_change();
+
 DROP TRIGGER IF EXISTS slotlock_outbox_reservation_change ON slotlock.reservations;
 CREATE TRIGGER slotlock_outbox_reservation_change
   AFTER INSERT OR UPDATE OR DELETE ON slotlock.reservations
@@ -1421,6 +1863,8 @@ CREATE TABLE IF NOT EXISTS slotlock.reservations (
   ends_at timestamptz NOT NULL,
   buffer_after_ms bigint NOT NULL DEFAULT 0,
   occupied_ends_at timestamptz,
+  buffer_before_ms bigint NOT NULL DEFAULT 0,
+  occupied_starts_at timestamptz,
   revision bigint NOT NULL DEFAULT 1,
   status text NOT NULL DEFAULT 'confirmed',
   expires_at timestamptz,
@@ -1441,6 +1885,15 @@ CREATE TABLE IF NOT EXISTS slotlock.reservations (
       AND occupied_ends_at = ends_at + buffer_after_ms * interval '1 millisecond'
     )
   ),
+  CONSTRAINT slotlock_reservations_buffer_before_valid CHECK (
+    buffer_before_ms >= 0 AND buffer_before_ms <= 86400000
+  ),
+  -- NULL only without a leading buffer: a NULL occupied start reads as the start itself.
+  CONSTRAINT slotlock_reservations_occupied_start_valid CHECK (
+    (occupied_starts_at IS NULL AND buffer_before_ms = 0)
+    OR (occupied_starts_at IS NOT NULL
+        AND occupied_starts_at = starts_at - buffer_before_ms * interval '1 millisecond')
+  ),
   CONSTRAINT slotlock_reservations_status_valid CHECK (status IN ('held', 'confirmed')),
   -- A hold must carry its expiry; a confirmed reservation must not (expiry is hold-only state).
   CONSTRAINT slotlock_reservations_expiry_shape CHECK (
@@ -1449,7 +1902,7 @@ CREATE TABLE IF NOT EXISTS slotlock.reservations (
   ),
   CONSTRAINT slotlock_reservations_no_overlap EXCLUDE USING gist (
     resource_id WITH =,
-    tstzrange(starts_at, COALESCE(occupied_ends_at, ends_at), '[)') WITH &&
+    tstzrange(COALESCE(occupied_starts_at, starts_at), COALESCE(occupied_ends_at, ends_at), '[)') WITH &&
   )
 );
 
@@ -1481,6 +1934,11 @@ ALTER TABLE slotlock.reservations ADD COLUMN IF NOT EXISTS tenant_ref text;
 ALTER TABLE slotlock.reservations ADD COLUMN IF NOT EXISTS external_ref text;
 ALTER TABLE slotlock.reservations ADD COLUMN IF NOT EXISTS buffer_after_ms bigint NOT NULL DEFAULT 0;
 ALTER TABLE slotlock.reservations ADD COLUMN IF NOT EXISTS occupied_ends_at timestamptz;
+-- The leading buffer a booking keeps before its start (its resource's bufferBeforeMinutes when it
+-- was made), and where its occupied time starts: its start less that buffer. A row written before
+-- leading buffers has none, so its occupied time starts at its start (NULL reads as starts_at).
+ALTER TABLE slotlock.reservations ADD COLUMN IF NOT EXISTS buffer_before_ms bigint NOT NULL DEFAULT 0;
+ALTER TABLE slotlock.reservations ADD COLUMN IF NOT EXISTS occupied_starts_at timestamptz;
 -- A keyed hold's holder (its principal) and the group of alternatives it was taken in: an agent
 -- releases or books only its own holds, and booking one releases the rest of its group.
 ALTER TABLE slotlock.reservations ADD COLUMN IF NOT EXISTS holder_ref text;
@@ -1518,6 +1976,31 @@ BEGIN
   END IF;
 END $$;
 
+-- The occupied start, materialized for the same reason as the occupied end.
+CREATE OR REPLACE FUNCTION slotlock.set_reservation_occupied_start()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $$
+BEGIN
+  NEW.occupied_starts_at := NEW.starts_at - NEW.buffer_before_ms * interval '1 millisecond';
+  RETURN NEW;
+END $$;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_trigger
+     WHERE tgname = 'slotlock_reservations_set_occupied_start'
+       AND tgrelid = 'slotlock.reservations'::regclass
+       AND NOT tgisinternal
+  ) THEN
+    CREATE TRIGGER slotlock_reservations_set_occupied_start
+    BEFORE INSERT OR UPDATE OF starts_at, buffer_before_ms ON slotlock.reservations
+    FOR EACH ROW EXECUTE FUNCTION slotlock.set_reservation_occupied_start();
+  END IF;
+END $$;
+
 -- Cancellation is an idempotency fact, not the absence of a reservation. Keeping a tombstone
 -- prevents delayed at-least-once create delivery from resurrecting a cancelled booking key.
 CREATE TABLE IF NOT EXISTS slotlock.reservation_tombstones (
@@ -1812,6 +2295,34 @@ BEGIN
         buffer_after_ms >= 0 AND buffer_after_ms <= 2592000000
       ) NOT VALID;
   END IF;
+  -- Every existing row has no leading buffer, so both hold of it; added NOT VALID (no scan under
+  -- the lock) and validated after the migration commits.
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+     WHERE conname = 'slotlock_reservations_buffer_before_valid'
+       AND conrelid = 'slotlock.reservations'::regclass
+  ) THEN
+    ALTER TABLE slotlock.reservations
+      ADD CONSTRAINT slotlock_reservations_buffer_before_valid CHECK (
+        buffer_before_ms >= 0 AND buffer_before_ms <= 86400000
+      ) NOT VALID;
+  END IF;
+  -- A first form of this check let a NULL occupied start through with a leading buffer (the
+  -- comparison is NULL, which a CHECK passes): replaced wherever it lacks the IS NOT NULL guard.
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+     WHERE conname = 'slotlock_reservations_occupied_start_valid'
+       AND conrelid = 'slotlock.reservations'::regclass
+       AND pg_catalog.pg_get_constraintdef(oid) LIKE '%occupied_starts_at IS NOT NULL%'
+  ) THEN
+    ALTER TABLE slotlock.reservations DROP CONSTRAINT IF EXISTS slotlock_reservations_occupied_start_valid;
+    ALTER TABLE slotlock.reservations
+      ADD CONSTRAINT slotlock_reservations_occupied_start_valid CHECK (
+        (occupied_starts_at IS NULL AND buffer_before_ms = 0)
+        OR (occupied_starts_at IS NOT NULL
+            AND occupied_starts_at = starts_at - buffer_before_ms * interval '1 millisecond')
+      ) NOT VALID;
+  END IF;
 END $$;
 
 -- Every row occupies from its start to its occupied end: its end plus its turnaround buffer. Up to
@@ -1862,13 +2373,35 @@ BEGIN
     ALTER TABLE slotlock.reservations
       ADD CONSTRAINT slotlock_reservations_no_overlap EXCLUDE USING gist (
         resource_id WITH =,
-        tstzrange(starts_at, COALESCE(occupied_ends_at, ends_at), '[)') WITH &&
+        tstzrange(COALESCE(occupied_starts_at, starts_at), COALESCE(occupied_ends_at, ends_at), '[)') WITH &&
       );
   END IF;
   ALTER TABLE slotlock.reservations DROP CONSTRAINT IF EXISTS slotlock_reservations_buffered_no_overlap;
 END
 $slotlock_occupied_overlap$;
 
+-- A row occupies from its occupied start too: its start less its leading buffer. Every row an
+-- upgrade finds was written before leading buffers and keeps none, so its range is the one the old
+-- constraint already kept apart and none can conflict: the constraint is replaced in place, its
+-- index built once under the migration's lock.
+DO $slotlock_occupied_start_overlap$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+     WHERE conname = 'slotlock_reservations_no_overlap'
+       AND conrelid = 'slotlock.reservations'::regclass
+       AND pg_catalog.pg_get_constraintdef(oid) LIKE '%occupied_starts_at%'
+  ) THEN
+    ALTER TABLE slotlock.reservations DROP CONSTRAINT IF EXISTS slotlock_reservations_no_overlap;
+    ALTER TABLE slotlock.reservations
+      ADD CONSTRAINT slotlock_reservations_no_overlap EXCLUDE USING gist (
+        resource_id WITH =,
+        tstzrange(COALESCE(occupied_starts_at, starts_at), COALESCE(occupied_ends_at, ends_at), '[)') WITH &&
+      );
+  END IF;
+END
+$slotlock_occupied_start_overlap$;
+
 CREATE INDEX IF NOT EXISTS slotlock_reservations_resource_time_idx
   ON slotlock.reservations (resource_id, starts_at, ends_at);
 
@@ -2068,6 +2601,10 @@ ALTER TABLE slotlock.calendar_events ADD COLUMN IF NOT EXISTS recurrence_ends_by
 ALTER TABLE slotlock.calendar_events
   ADD COLUMN IF NOT EXISTS buffer_after_ms integer NOT NULL DEFAULT 0
   CONSTRAINT slotlock_calendar_events_buffer_valid CHECK (buffer_after_ms BETWEEN 0 AND 86400000);
+-- The leading buffer a booked event keeps before each occurrence, kept for a later roll alike.
+ALTER TABLE slotlock.calendar_events
+  ADD COLUMN IF NOT EXISTS buffer_before_ms integer NOT NULL DEFAULT 0
+  CONSTRAINT slotlock_calendar_events_buffer_before_valid CHECK (buffer_before_ms BETWEEN 0 AND 86400000);
 ALTER TABLE slotlock.calendar_events
   DROP CONSTRAINT IF EXISTS slotlock_calendar_events_recurrence_cursor_bounded;
 DO $slotlock_calendar_event_recurrence_cursor$
@@ -2633,6 +3170,9 @@ export const SLOTLOCK_TENANT_TABLES = Object.freeze([
     'outbox_pruned',
     'webhook_endpoints',
     'waitlist_entries',
+    'booking_rule_defaults',
+    'assistant_settings',
+    'assistant_conversations',
 ]);
 const POSTGRES_SETTING_NAME = /^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+$/;
 const POSTGRES_ROLE_NAME = /^[a-z_][a-z0-9_]{0,62}$/;
@@ -2702,6 +3242,12 @@ ALTER TABLE slotlock.webhook_endpoints ENABLE ROW LEVEL SECURITY;
 ALTER TABLE slotlock.webhook_endpoints FORCE ROW LEVEL SECURITY;
 ALTER TABLE slotlock.waitlist_entries ENABLE ROW LEVEL SECURITY;
 ALTER TABLE slotlock.waitlist_entries FORCE ROW LEVEL SECURITY;
+ALTER TABLE slotlock.booking_rule_defaults ENABLE ROW LEVEL SECURITY;
+ALTER TABLE slotlock.booking_rule_defaults FORCE ROW LEVEL SECURITY;
+ALTER TABLE slotlock.assistant_settings ENABLE ROW LEVEL SECURITY;
+ALTER TABLE slotlock.assistant_settings FORCE ROW LEVEL SECURITY;
+ALTER TABLE slotlock.assistant_conversations ENABLE ROW LEVEL SECURITY;
+ALTER TABLE slotlock.assistant_conversations FORCE ROW LEVEL SECURITY;
 
 -- One database must have one tenant-context contract. Re-applying with an adapter-specific
 -- setting deliberately rebinds the stable policies instead of silently keeping a prior setting.
@@ -2730,7 +3276,10 @@ BEGIN
          'outbox',
          'outbox_pruned',
          'webhook_endpoints',
-         'waitlist_entries'
+         'waitlist_entries',
+         'booking_rule_defaults',
+         'assistant_settings',
+         'assistant_conversations'
        )
   LOOP
     EXECUTE format(
@@ -2941,6 +3490,36 @@ BEGIN
       USING (tenant_ref = NULLIF(current_setting('${tenantContextSetting}', true), ''))
       WITH CHECK (tenant_ref = NULLIF(current_setting('${tenantContextSetting}', true), ''));
   END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies
+     WHERE schemaname = 'slotlock' AND tablename = 'booking_rule_defaults'
+       AND policyname = 'tenant_isolation_v1'
+  ) THEN
+    CREATE POLICY tenant_isolation_v1 ON slotlock.booking_rule_defaults
+      USING (tenant_ref = NULLIF(current_setting('${tenantContextSetting}', true), ''))
+      WITH CHECK (tenant_ref = NULLIF(current_setting('${tenantContextSetting}', true), ''));
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies
+     WHERE schemaname = 'slotlock' AND tablename = 'assistant_settings'
+       AND policyname = 'tenant_isolation_v1'
+  ) THEN
+    CREATE POLICY tenant_isolation_v1 ON slotlock.assistant_settings
+      USING (tenant_ref = NULLIF(current_setting('${tenantContextSetting}', true), ''))
+      WITH CHECK (tenant_ref = NULLIF(current_setting('${tenantContextSetting}', true), ''));
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies
+     WHERE schemaname = 'slotlock' AND tablename = 'assistant_conversations'
+       AND policyname = 'tenant_isolation_v1'
+  ) THEN
+    CREATE POLICY tenant_isolation_v1 ON slotlock.assistant_conversations
+      USING (tenant_ref = NULLIF(current_setting('${tenantContextSetting}', true), ''))
+      WITH CHECK (tenant_ref = NULLIF(current_setting('${tenantContextSetting}', true), ''));
+  END IF;
 END
 $slotlock_rls$;
 
@@ -2978,6 +3557,12 @@ COMMENT ON POLICY tenant_isolation_v1 ON slotlock.webhook_endpoints
   IS 'slotlock:tenant-context:${tenantContextSetting}';
 COMMENT ON POLICY tenant_isolation_v1 ON slotlock.waitlist_entries
   IS 'slotlock:tenant-context:${tenantContextSetting}';
+COMMENT ON POLICY tenant_isolation_v1 ON slotlock.booking_rule_defaults
+  IS 'slotlock:tenant-context:${tenantContextSetting}';
+COMMENT ON POLICY tenant_isolation_v1 ON slotlock.assistant_settings
+  IS 'slotlock:tenant-context:${tenantContextSetting}';
+COMMENT ON POLICY tenant_isolation_v1 ON slotlock.assistant_conversations
+  IS 'slotlock:tenant-context:${tenantContextSetting}';
 
 INSERT INTO slotlock.rls_policy_contracts (
   table_name, tenant_context_setting, policy_fingerprint, installed_at
@@ -3017,7 +3602,10 @@ WHERE schemaname = 'slotlock'
     'outbox',
     'outbox_pruned',
     'webhook_endpoints',
-    'waitlist_entries'
+    'waitlist_entries',
+    'booking_rule_defaults',
+    'assistant_settings',
+    'assistant_conversations'
   )
   AND policyname = 'tenant_isolation_v1'
 ON CONFLICT (table_name) DO UPDATE