slotlock 0.5.2 → 0.6.0

package/dashboard.js

@@ -102,7 +102,8 @@ const CONTENT_SECURITY_POLICY = "default-src 'none'; script-src 'self'; style-sr
  * in the database (a READ COMMITTED transaction, under a per-tenant lock).
  */
 export function createSlotlockDashboardResources(store) {
-    const by = (actor) => (actor === undefined ? {} : { actor });
+    // Every change here is the dashboard's, made by the person signed in (actor) when known.
+    const by = (actor) => actor === undefined ? { origin: 'dashboard' } : { origin: 'dashboard', actor };
     return {
         list: (tenantRef) => store.withTenant(tenantRef, (tenant) => tenant.listResources({ tenantRef, limit: SLOTLOCK_DASHBOARD_MAX_RESOURCES + 1 })),
         add: (tenantRef, externalRef, timezone, actor) => store.withTenant(tenantRef, (tenant) => tenant.createResource({
@@ -120,6 +121,7 @@ export function createSlotlockDashboardResources(store) {
         agenda: (tenantRef, window, limit) => store.withTenant(tenantRef, (tenant) => tenant.listAgenda({ tenantRef, window, limit })),
         recentChanges: (tenantRef, limit) => store.withTenant(tenantRef, (tenant) => tenant.listRecentChanges({ tenantRef, limit })),
         setRules: (tenantRef, id, rules, actor) => store.withTenant(tenantRef, (tenant) => tenant.setResourceBookingRules({ tenantRef, id, rules }), by(actor)),
+        ruleDefaults: (tenantRef) => store.withTenant(tenantRef, (tenant) => tenant.getBookingRuleDefaults({ tenantRef })),
         setPool: (tenantRef, id, pool, actor) => store.withTenant(tenantRef, (tenant) => tenant.setResourcePool({ tenantRef, id, pool }), by(actor)),
         waitlist: {
             list: (tenantRef, limit) => store.withTenant(tenantRef, (tenant) => tenant.listWaitlist({ tenantRef, limit })),
@@ -128,7 +130,9 @@ export function createSlotlockDashboardResources(store) {
                 // An offered entry's hold went with it: offer that time to the next, as the API does.
                 if (left) {
                     await store
-                        .withTenant(tenantRef, (tenant) => tenant.offerWaitlist({ tenantRef, limit: 20 }))
+                        .withTenant(tenantRef, (tenant) => tenant.offerWaitlist({ tenantRef, limit: 20 }), {
+                        origin: 'maintenance',
+                    })
                         .catch(() => undefined);
                 }
                 return left;
@@ -311,6 +315,8 @@ const RULE_NAMES = Object.freeze({
     minNoticeMinutes: 'Minimum notice',
     maxAdvanceDays: 'Book up to',
     slotStepMinutes: 'Start step',
+    stepOffsetMinutes: 'Step offset',
+    bufferBeforeMinutes: 'Buffer before',
     turnaroundMinutes: 'Turnaround',
     checkInMinutes: 'Check-in release',
 });
@@ -319,12 +325,53 @@ const RULE_FIELDS = Object.freeze({
     minNoticeMinutes: 'min_notice_minutes',
     maxAdvanceDays: 'max_advance_days',
     slotStepMinutes: 'slot_step_minutes',
+    stepOffsetMinutes: 'step_offset_minutes',
+    bufferBeforeMinutes: 'buffer_before_minutes',
     turnaroundMinutes: 'turnaround_minutes',
     checkInMinutes: 'check_in_minutes',
 });
+/** How the inherited-rules note names each rule, with its unit. */
+const INHERITED_NAMES = Object.freeze({
+    ...RULE_NAMES,
+    maxAdvanceDays: 'Book up to (days ahead)',
+    enforceHours: 'Only inside bookable hours',
+    requireCertain: 'Only in time its calendar syncs have read today',
+});
+/**
+ * The rules a resource takes from defaults, each with where it comes from: a rule its pool's
+ * defaults set, else one the tenant's set, where its own rules do not. Without the defaults, the
+ * rules that apply less its own, from "defaults".
+ */
+function inheritedRules(resource, defaults) {
+    const own = resource.bookingRules ?? {};
+    const levels = defaults
+        ? [
+            ['every resource', defaults.tenant],
+            [`pool ${resource.pool ?? ''}`, resource.pool === undefined ? undefined : defaults.pools[resource.pool]],
+        ]
+        : [['defaults', resource.effectiveBookingRules]];
+    const inherited = new Map();
+    for (const [from, rules] of levels) {
+        for (const [name, value] of Object.entries(rules ?? {})) {
+            if (own[name] === undefined)
+                inherited.set(name, { value, from });
+        }
+    }
+    return inherited;
+}
+function inheritedNote(inherited) {
+    if (inherited.size === 0)
+        return html ``;
+    const parts = [...inherited].map(([name, { value, from }]) => typeof value === 'boolean'
+        ? `${INHERITED_NAMES[name]}${value ? '' : ': off'} (${from})`
+        : `${INHERITED_NAMES[name]} ${value.toLocaleString('en')} (${from})`);
+    return html `<p class="fine">Inherited: ${parts.join('; ')}.</p>`;
+}
 const icon = (paths) => new Html(`<svg class="icon" viewBox="0 0 24 24" aria-hidden="true" focusable="false">${paths}</svg>`);
 const ICONS = Object.freeze({
-    mark: new Html('<svg class="mark" viewBox="0 0 64 64" aria-hidden="true" focusable="false"><path d="M8 46 L26 14 L56 44"></path></svg>'),
+    mark: new Html(
+    // The Slotlock mark: a padlock whose body holds one booked slot (the site's logo, without the wordmark).
+    '<svg class="mark" viewBox="0 0 85.32 77.12" aria-hidden="true" focusable="false"><path class="mark-ink" d="M13.13 34.46L72.2 34.46C79.45 34.46 85.32 40.33 85.32 47.58L85.32 63.99C85.32 71.24 79.45 77.12 72.2 77.12L13.13 77.12C5.88 77.12 0 71.24 0 63.99L0 47.58C0 40.33 5.88 34.46 13.13 34.46ZM22.97 39.38L22.97 19.69C22.97 8.82 31.79 0 42.66 0C53.54 0 62.35 8.82 62.35 19.69L62.35 39.38L56.61 39.38L56.61 19.69C56.61 11.99 50.36 5.74 42.66 5.74C34.96 5.74 28.71 11.99 28.71 19.69L28.71 39.38Z"></path><path class="mark-slot" d="M19.69 52.51L65.63 52.51C67.45 52.51 68.91 53.98 68.91 55.79C68.91 57.6 67.45 59.07 65.63 59.07L19.69 59.07C17.88 59.07 16.41 57.6 16.41 55.79C16.41 53.98 17.88 52.51 19.69 52.51Z"></path></svg>'),
     overview: icon('<path d="M4 13h6V4H4zM14 20h6v-9h-6zM4 20h6v-3H4zM14 7h6V4h-6z"/>'),
     resources: icon('<rect x="3" y="5" width="18" height="16" rx="2"/><path d="M3 10h18M8 3v4M16 3v4"/>'),
     keys: icon('<circle cx="8" cy="15" r="4"/><path d="M11 12l9-9M16 7l3 3"/>'),
@@ -1011,17 +1058,33 @@ ${current ? html `<p class="fine">Membership is read from GitHub when you sign i
             return notFound(session);
         const start = new Date(now());
         const window = { start, end: new Date(start.getTime() + AGENDA_DAYS * DAY_MS) };
-        const [agenda, changes, keys] = await Promise.all([
+        const [agenda, changes, keys, defaults] = await Promise.all([
             options.resources.agenda?.(tenantRef, window, AGENDA_LIMIT),
             options.resources.recentChanges?.(tenantRef, 100),
             options.keys.list({ tenantRef }),
+            options.resources.ruleDefaults?.(tenantRef),
         ]);
         const byId = new Map([[resource.id, resource]]);
         const mine = agenda?.filter((entry) => entry.resourceId === resource.id);
         const activity = changes?.filter((change) => change.resourceId === resource.id).slice(0, 10);
         const token = csrfToken(session);
         const rules = resource.bookingRules ?? {};
-        const field = (name, label, unit) => html `<label>${label}<span class="unit-input"><input type="number" inputmode="numeric" min="${String(RULE_LIMITS[name][0])}" max="${String(RULE_LIMITS[name][1])}" name="${RULE_FIELDS[name]}" value="${rules[name] === undefined ? '' : String(rules[name])}"><span>${unit}</span></span></label>`;
+        const inherited = inheritedRules(resource, defaults);
+        const field = (name, label, unit) => {
+            const from = inherited.get(name);
+            return html `<label>${label}<span class="unit-input"><input type="number" inputmode="numeric" min="${String(RULE_LIMITS[name][0])}" max="${String(RULE_LIMITS[name][1])}" name="${RULE_FIELDS[name]}" value="${rules[name] === undefined ? '' : String(rules[name])}"${from ? html ` placeholder="${String(from.value)}"` : html ``}><span>${unit}</span></span></label>`;
+        };
+        // On or off: a checkbox, or, once a default sets it (or the resource turned it off), a choice
+        // of the default, on or off, so a resource can turn an inherited rule off.
+        const toggle = (name, key, label) => {
+            const from = inherited.get(name);
+            if (from === undefined && rules[name] !== false) {
+                return html `<label class="choice"><input type="checkbox" name="${key}" value="1"${rules[name] ? html ` checked` : html ``}> ${label}</label>`;
+            }
+            const chosen = (value) => (rules[name] === value ? html ` selected` : html ``);
+            const fallback = from ? `As its default (${from.value ? 'on' : 'off'}, ${from.from})` : 'Off';
+            return html `<label>${label}<select name="${key}"><option value=""${chosen(undefined)}>${fallback}</option><option value="1"${chosen(true)}>On</option><option value="0"${chosen(false)}>Off</option></select></label>`;
+        };
         const content = html `${noticeOf(notice)}
 <p><a class="back" href="${root}/resources">Resources</a></p>
 ${pageHead(resourceName(resource, resource.id))}
@@ -1039,12 +1102,15 @@ ${options.resources.setRules
 ${field('minNoticeMinutes', 'Minimum notice', 'min')}
 ${field('maxAdvanceDays', 'Book up to', 'days ahead')}
 ${field('slotStepMinutes', 'Start on a step of', 'min')}
+${field('stepOffsetMinutes', 'Steps start past each step by', 'min')}
+${field('bufferBeforeMinutes', 'Kept free before each booking', 'min')}
 ${field('turnaroundMinutes', 'Turnaround after each booking', 'min')}
 ${field('checkInMinutes', 'Release if not checked in after', 'min')}
 </div>
-<label class="choice"><input type="checkbox" name="enforce_hours" value="1"${rules.enforceHours ? html ` checked` : html ``}> Only inside bookable hours</label>
-<label class="choice"><input type="checkbox" name="require_certain" value="1"${rules.requireCertain ? html ` checked` : html ``}> Only in time its calendar syncs have read today</label>
-<p class="fine">Leave a field empty for no rule.</p>
+${toggle('enforceHours', 'enforce_hours', 'Only inside bookable hours')}
+${toggle('requireCertain', 'require_certain', 'Only in time its calendar syncs have read today')}
+${inheritedNote(inherited)}
+<p class="fine">Leave a field empty for no rule${inherited.size > 0 ? ' of its own' : ''}.</p>
 <button class="primary" type="submit">Save rules</button>
 </form>
 </section>`
@@ -1086,10 +1152,17 @@ ${activity ? html `<section class="panel"><h2>Activity</h2>${activityPanel(activ
             }
             rules[name] = Number(value);
         }
-        if (form.get('enforce_hours') === '1')
-            rules.enforceHours = true;
-        if (form.get('require_certain') === '1')
-            rules.requireCertain = true;
+        // '1' on, '0' off (over a default that is on), anything else not set.
+        const choice = (key) => {
+            const value = form.get(key);
+            return value === '1' ? true : value === '0' ? false : undefined;
+        };
+        const enforceHours = choice('enforce_hours');
+        if (enforceHours !== undefined)
+            rules.enforceHours = enforceHours;
+        const requireCertain = choice('require_certain');
+        if (requireCertain !== undefined)
+            rules.requireCertain = requireCertain;
         try {
             await options.resources.setRules(tenantOf(session), id, Object.keys(rules).length === 0 ? null : rules, personOf(session));
         }
@@ -1371,6 +1444,7 @@ ${entries.length === 0
         const principal = assistantPrincipal(session);
         return invokeSlotlockAgentOperation({
             operation,
+            origin: 'dashboard-assistant',
             input,
             request: new Request(`${origin}${root}/assistant`, {
                 signal: AbortSignal.timeout(assistantTimeout),
@@ -2195,6 +2269,7 @@ ${org ? html `<p>For the organization <strong>${org.login}</strong>.</p>` : html
                 name: form.get('name') ?? '',
                 scopes,
                 createdBy: personOf(session),
+                origin: 'dashboard',
                 ...(typeof days === 'number' ? { expiresAt: new Date(now() + days * DAY_MS) } : {}),
             });
             return shownOncePage(session, created.key, created.apiKey, false);
@@ -2210,17 +2285,23 @@ ${org ? html `<p>For the organization <strong>${org.login}</strong>.</p>` : html
             throw error;
         }
     }
+    /** A key change in the session's tenant, recorded as the person's, from the dashboard. */
+    const asPerson = (session) => ({
+        tenantRef: tenantOf(session),
+        actor: personOf(session),
+        origin: 'dashboard',
+    });
     async function changeKey(session, form, change) {
         const id = form.get('id') ?? '';
         if (!UUID_PATTERN.test(id))
             return keysPage(session, 404, 'That key is not one of yours.');
         if (change === 'rotate') {
-            const rotated = await options.keys.rotate({ tenantRef: tenantOf(session), id });
+            const rotated = await options.keys.rotate({ ...asPerson(session), id });
             if (!rotated)
                 return keysPage(session, 404, 'That key is not an active key of yours.');
             return shownOncePage(session, rotated.key, rotated.apiKey, true);
         }
-        const revoked = await options.keys.revoke({ tenantRef: tenantOf(session), id });
+        const revoked = await options.keys.revoke({ ...asPerson(session), id });
         if (!revoked)
             return keysPage(session, 404, 'That key is not one of yours.');
         return redirect(303, `${root}/keys`);
@@ -2467,7 +2548,9 @@ a:hover { text-decoration: underline; }
 code, pre, input[readonly] { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 12.5px; }
 .icon { width: 16px; height: 16px; flex: none; fill: none; stroke: currentColor; stroke-width: 1.75; stroke-linecap: round; stroke-linejoin: round; }
 .icon .fill { fill: currentColor; stroke: none; }
-.mark { width: 18px; height: 18px; flex: none; fill: none; stroke: var(--accent); stroke-width: 7; stroke-linecap: round; stroke-linejoin: round; }
+.mark { width: 20px; height: 18px; flex: none; }
+.mark-ink { fill: currentColor; }
+.mark-slot { fill: #FF5B2E; }
 .brand { display: inline-flex; align-items: center; gap: 8px; color: var(--ink); font-weight: 650; font-size: 15px; letter-spacing: -0.01em; }
 .brand:hover { text-decoration: none; }
 .app { display: grid; grid-template-columns: 240px minmax(0, 1fr); min-height: 100vh; background: linear-gradient(to right, var(--side) 239px, var(--line) 239px, var(--line) 240px, var(--paper) 240px); }

package/ddl.d.ts

@@ -2,9 +2,11 @@
 export declare const SLOTLOCK_SCHEMA_CONTROL_REFUSAL = "Slotlock will not deploy into schema slotlock";
 /**
  * The version of the schema this release creates, recorded in `slotlock.schema_version` by every
- * migration. Releases up to 0.2 recorded nothing; 0.1 was version 1 and 0.2 version 2.
+ * migration. Releases up to 0.2 recorded nothing; 0.1 was version 1 and 0.2 version 2; 0.3 to 0.5
+ * recorded 3. 0.6 is 4, so a 0.5 release refuses it before it changes anything: its DDL would put
+ * back the trigger that names a coverage source by its guessable digest.
  */
-export declare const SLOTLOCK_SCHEMA_VERSION = 3;
+export declare const SLOTLOCK_SCHEMA_VERSION = 4;
 /** The start of the message with which the deployment DDL refuses a schema a newer release migrated. */
 export declare const SLOTLOCK_SCHEMA_NEWER_REFUSAL = "Slotlock will not migrate a schema a newer release migrated";
 /**
@@ -12,7 +14,7 @@ export declare const SLOTLOCK_SCHEMA_NEWER_REFUSAL = "Slotlock will not migrate
  * when they find nothing to change: that no other role controls the schema, then the server version
  * and the schema version. Run with search_path pinned, as the DDL pins it.
  */
-export declare const SLOTLOCK_DEPLOYMENT_CHECKS = "DO $slotlock_schema_control$\nDECLARE\n  refusals text[];\nBEGIN\n  SELECT pg_catalog.array_agg(refusal.reason ORDER BY refusal.reason)\n    INTO refusals\n    FROM (\n      SELECT 'schema slotlock is owned by ' || owned_by.rolname AS reason\n        FROM pg_catalog.pg_namespace ns\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = ns.nspowner\n       WHERE ns.nspname = 'slotlock'\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n      UNION\n      SELECT COALESCE(grantee_role.rolname, 'PUBLIC') || ' can create objects in schema slotlock'\n        FROM pg_catalog.pg_namespace ns\n       CROSS JOIN LATERAL pg_catalog.aclexplode(ns.nspacl) acl\n        LEFT JOIN pg_catalog.pg_roles grantee_role ON grantee_role.oid = acl.grantee\n       WHERE ns.nspname = 'slotlock'\n         AND acl.privilege_type = 'CREATE'\n         AND acl.grantee <> ns.nspowner\n         AND (acl.grantee = 0\n              OR (grantee_role.rolname <> CURRENT_USER AND NOT grantee_role.rolsuper))\n      UNION\n      SELECT ident.type || ' ' || ident.identity || ' is owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_shdepend owned\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = owned.refobjid\n       CROSS JOIN LATERAL pg_catalog.pg_identify_object(owned.classid, owned.objid, owned.objsubid) ident\n       WHERE owned.dbid = (SELECT db.oid FROM pg_catalog.pg_database db\n                            WHERE db.datname = pg_catalog.current_database())\n         AND owned.deptype = 'o'\n         AND owned.refclassid = 'pg_catalog.pg_authid'::pg_catalog.regclass\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n         AND ident.schema = 'slotlock'\n      UNION\n      SELECT 'trigger ' || trg.tgname || ' on slotlock.' || rel.relname || ' runs '\n             || trg.tgfoid::pg_catalog.regprocedure::pg_catalog.text\n             || ', owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_trigger trg\n        JOIN pg_catalog.pg_class rel ON rel.oid = trg.tgrelid\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = rel.relnamespace\n        JOIN pg_catalog.pg_proc fn ON fn.oid = trg.tgfoid\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = fn.proowner\n       WHERE ns.nspname = 'slotlock'\n         AND NOT trg.tgisinternal\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n      UNION\n      SELECT COALESCE(grantee_role.rolname, 'PUBLIC') || ' can create triggers on slotlock.'\n             || rel.relname\n        FROM pg_catalog.pg_class rel\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = rel.relnamespace\n       CROSS JOIN LATERAL pg_catalog.aclexplode(rel.relacl) acl\n        LEFT JOIN pg_catalog.pg_roles grantee_role ON grantee_role.oid = acl.grantee\n       WHERE ns.nspname = 'slotlock'\n         AND acl.privilege_type = 'TRIGGER'\n         AND acl.grantee <> rel.relowner\n         AND (acl.grantee = 0\n              OR (grantee_role.rolname <> CURRENT_USER AND NOT grantee_role.rolsuper))\n      UNION\n      SELECT 'extension ' || ext.extname || ' in schema slotlock is owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_extension ext\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = ext.extnamespace\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = ext.extowner\n       WHERE ns.nspname = 'slotlock'\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n    ) refusal;\n  IF refusals IS NOT NULL THEN\n    RAISE EXCEPTION 'Slotlock will not deploy into schema slotlock: another role controls it'\n      USING ERRCODE = 'insufficient_privilege',\n            DETAIL = pg_catalog.to_jsonb(refusals)::pg_catalog.text,\n            HINT = 'The deployment role must own schema slotlock and every object in it, and no other role may create objects in it.';\n  END IF;\nEND\n$slotlock_schema_control$;\nDO $slotlock_schema_preconditions$\nDECLARE\n  installed integer;\nBEGIN\n  IF pg_catalog.current_setting('server_version_num')::integer < 160000 THEN\n    RAISE EXCEPTION 'Slotlock needs PostgreSQL 16 or later; this server is %',\n      pg_catalog.current_setting('server_version')\n      USING ERRCODE = 'feature_not_supported';\n  END IF;\n  IF pg_catalog.to_regclass('slotlock.schema_version') IS NOT NULL THEN\n    EXECUTE 'SELECT version FROM slotlock.schema_version WHERE singleton' INTO installed;\n    IF installed > 3 THEN\n      RAISE EXCEPTION 'Slotlock will not migrate a schema a newer release migrated (version %; this release is version 3)', installed\n        USING ERRCODE = 'object_not_in_prerequisite_state',\n              HINT = 'Migrate and serve it with the release that migrated it, or a later one.';\n    END IF;\n  END IF;\nEND\n$slotlock_schema_preconditions$;\n";
+export declare const SLOTLOCK_DEPLOYMENT_CHECKS = "DO $slotlock_schema_control$\nDECLARE\n  refusals text[];\nBEGIN\n  SELECT pg_catalog.array_agg(refusal.reason ORDER BY refusal.reason)\n    INTO refusals\n    FROM (\n      SELECT 'schema slotlock is owned by ' || owned_by.rolname AS reason\n        FROM pg_catalog.pg_namespace ns\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = ns.nspowner\n       WHERE ns.nspname = 'slotlock'\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n      UNION\n      SELECT COALESCE(grantee_role.rolname, 'PUBLIC') || ' can create objects in schema slotlock'\n        FROM pg_catalog.pg_namespace ns\n       CROSS JOIN LATERAL pg_catalog.aclexplode(ns.nspacl) acl\n        LEFT JOIN pg_catalog.pg_roles grantee_role ON grantee_role.oid = acl.grantee\n       WHERE ns.nspname = 'slotlock'\n         AND acl.privilege_type = 'CREATE'\n         AND acl.grantee <> ns.nspowner\n         AND (acl.grantee = 0\n              OR (grantee_role.rolname <> CURRENT_USER AND NOT grantee_role.rolsuper))\n      UNION\n      SELECT ident.type || ' ' || ident.identity || ' is owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_shdepend owned\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = owned.refobjid\n       CROSS JOIN LATERAL pg_catalog.pg_identify_object(owned.classid, owned.objid, owned.objsubid) ident\n       WHERE owned.dbid = (SELECT db.oid FROM pg_catalog.pg_database db\n                            WHERE db.datname = pg_catalog.current_database())\n         AND owned.deptype = 'o'\n         AND owned.refclassid = 'pg_catalog.pg_authid'::pg_catalog.regclass\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n         AND ident.schema = 'slotlock'\n      UNION\n      SELECT 'trigger ' || trg.tgname || ' on slotlock.' || rel.relname || ' runs '\n             || trg.tgfoid::pg_catalog.regprocedure::pg_catalog.text\n             || ', owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_trigger trg\n        JOIN pg_catalog.pg_class rel ON rel.oid = trg.tgrelid\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = rel.relnamespace\n        JOIN pg_catalog.pg_proc fn ON fn.oid = trg.tgfoid\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = fn.proowner\n       WHERE ns.nspname = 'slotlock'\n         AND NOT trg.tgisinternal\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n      UNION\n      SELECT COALESCE(grantee_role.rolname, 'PUBLIC') || ' can create triggers on slotlock.'\n             || rel.relname\n        FROM pg_catalog.pg_class rel\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = rel.relnamespace\n       CROSS JOIN LATERAL pg_catalog.aclexplode(rel.relacl) acl\n        LEFT JOIN pg_catalog.pg_roles grantee_role ON grantee_role.oid = acl.grantee\n       WHERE ns.nspname = 'slotlock'\n         AND acl.privilege_type = 'TRIGGER'\n         AND acl.grantee <> rel.relowner\n         AND (acl.grantee = 0\n              OR (grantee_role.rolname <> CURRENT_USER AND NOT grantee_role.rolsuper))\n      UNION\n      SELECT 'extension ' || ext.extname || ' in schema slotlock is owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_extension ext\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = ext.extnamespace\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = ext.extowner\n       WHERE ns.nspname = 'slotlock'\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n    ) refusal;\n  IF refusals IS NOT NULL THEN\n    RAISE EXCEPTION 'Slotlock will not deploy into schema slotlock: another role controls it'\n      USING ERRCODE = 'insufficient_privilege',\n            DETAIL = pg_catalog.to_jsonb(refusals)::pg_catalog.text,\n            HINT = 'The deployment role must own schema slotlock and every object in it, and no other role may create objects in it.';\n  END IF;\nEND\n$slotlock_schema_control$;\nDO $slotlock_schema_preconditions$\nDECLARE\n  installed integer;\nBEGIN\n  IF pg_catalog.current_setting('server_version_num')::integer < 160000 THEN\n    RAISE EXCEPTION 'Slotlock needs PostgreSQL 16 or later; this server is %',\n      pg_catalog.current_setting('server_version')\n      USING ERRCODE = 'feature_not_supported';\n  END IF;\n  IF pg_catalog.to_regclass('slotlock.schema_version') IS NOT NULL THEN\n    EXECUTE 'SELECT version FROM slotlock.schema_version WHERE singleton' INTO installed;\n    IF installed > 4 THEN\n      RAISE EXCEPTION 'Slotlock will not migrate a schema a newer release migrated (version %; this release is version 4)', installed\n        USING ERRCODE = 'object_not_in_prerequisite_state',\n              HINT = 'Migrate and serve it with the release that migrated it, or a later one.';\n    END IF;\n  END IF;\nEND\n$slotlock_schema_preconditions$;\n";
 /** Active (unrevoked, unexpired) API keys one tenant may hold. */
 export declare const SLOTLOCK_API_KEY_ACTIVE_LIMIT = 100;
 /** API keys one tenant may hold in all, revoked and expired ones included, so lists stay bounded. */
@@ -63,6 +65,21 @@ export declare const SLOTLOCK_DEFINER_TABLES: readonly ("api_key_retired_digests
 export declare function slotlockTenantLockKey(tenantRef: string): string;
 /** The constraint validation applySchema runs after the rest of SLOTLOCK_CORE_DDL has committed. */
 export declare const SLOTLOCK_VALIDATION_DDL: string;
+/** Outbox ids one batch of the coverage-change rename reads (by primary key) in one transaction. */
+export declare const SLOTLOCK_COVERAGE_CHANGE_RENAME_BATCH = 5000;
+/**
+ * One batch of the rename of coverage changes an earlier release wrote: of the outbox rows with ids
+ * after `after` up to `head` (SQL expressions, bigint), the first `batch` by id, each `coverage.*`
+ * one not yet in this release's shape gets its source's source_id as subject and `data.source_id`,
+ * and loses `source` and `last_error`. Before 0.5.3 coverage.stale carried the source itself (an
+ * iCalendar URL with a token, an address) and the error read from it; 0.5.3 named it by an unkeyed
+ * digest anyone could confirm a guess against. A source deleted since is `src_redacted`: nothing
+ * can match it any more, and a made-up id would look like a source the tenant could find. Selects
+ * the last id read (`last`, null when there was none) and how many it renamed (`renamed`), `INTO`
+ * `into` when given (PL/pgSQL). Rows in the new shape are left alone, so a batch run again changes
+ * nothing.
+ */
+export declare function slotlockCoverageChangeRenameSql(after: string, head: string, batch: string, into?: string): string;
 /** The whole deployment DDL, run in one transaction: the schema, then its constraints validated. */
 export declare const SLOTLOCK_CORE_DDL: string;
 /**
@@ -76,7 +93,7 @@ export declare const SLOTLOCK_TENANT_CONTEXT_SETTING = "slotlock.tenant_ref";
  * `slotlock.rls_policy_contracts` and `slotlock.deployment_lifted_row_security` are
  * deployment-only and deliberately absent.
  */
-export declare const SLOTLOCK_TENANT_TABLES: readonly ["resources", "reservations", "reservation_tombstones", "reservation_conflict_archive", "calendar_events", "calendar_event_attendees", "calendar_event_reminders", "calendar_event_exceptions", "calendar_event_occurrences", "calendar_event_tombstones", "calendar_event_commands", "calendar_coverage", "hold_commands", "outbox", "outbox_pruned", "webhook_endpoints", "waitlist_entries", "assistant_settings", "assistant_conversations"];
+export declare const SLOTLOCK_TENANT_TABLES: readonly ["resources", "reservations", "reservation_tombstones", "reservation_conflict_archive", "calendar_events", "calendar_event_attendees", "calendar_event_reminders", "calendar_event_exceptions", "calendar_event_occurrences", "calendar_event_tombstones", "calendar_event_commands", "calendar_coverage", "hold_commands", "outbox", "outbox_pruned", "webhook_endpoints", "waitlist_entries", "booking_rule_defaults", "assistant_settings", "assistant_conversations"];
 /**
  * Build the grants for the application role: USAGE on the `slotlock` schema, DML on the store's
  * tables and EXECUTE on the API key and dashboard functions. Nothing else: no ownership, DDL,