slotlock 0.6.2 → 0.7.0

package/ddl.d.ts

@@ -1,18 +1,17 @@
 /** The start of the message with which the deployment DDL refuses a `slotlock` schema. */
 export declare const SLOTLOCK_SCHEMA_CONTROL_REFUSAL = "Slotlock will not deploy into schema slotlock";
 /**
- * The version of the schema this release creates, recorded in `slotlock.schema_version` by every
- * migration. Releases up to 0.2 recorded nothing; 0.1 was version 1 and 0.2 version 2; 0.3 to 0.5
- * recorded 3. 0.6 is 4, so a 0.5 release refuses it before it changes anything: its DDL would put
- * back the trigger that names a coverage source by its guessable digest.
+ * The schema version this release creates, recorded in `slotlock.schema_version`. Up to 0.2
+ * recorded nothing (0.1 was 1, 0.2 was 2); 0.3 to 0.5 recorded 3. 0.6 is 4, so a 0.5 release
+ * refuses it rather than restoring the trigger that names a coverage source by its guessable
+ * digest.
  */
 export declare const SLOTLOCK_SCHEMA_VERSION = 4;
 /** The start of the message with which the deployment DDL refuses a schema a newer release migrated. */
 export declare const SLOTLOCK_SCHEMA_NEWER_REFUSAL = "Slotlock will not migrate a schema a newer release migrated";
 /**
- * What every migration checks before it changes anything, applySchema and applyTenantRls included
- * when they find nothing to change: that no other role controls the schema, then the server version
- * and the schema version. Run with search_path pinned, as the DDL pins it.
+ * What every migration checks before changing anything, even when it finds nothing to change: no
+ * other role controls the schema, then server and schema version. Run with search_path pinned.
  */
 export declare const SLOTLOCK_DEPLOYMENT_CHECKS = "DO $slotlock_schema_control$\nDECLARE\n  refusals text[];\nBEGIN\n  SELECT pg_catalog.array_agg(refusal.reason ORDER BY refusal.reason)\n    INTO refusals\n    FROM (\n      SELECT 'schema slotlock is owned by ' || owned_by.rolname AS reason\n        FROM pg_catalog.pg_namespace ns\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = ns.nspowner\n       WHERE ns.nspname = 'slotlock'\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n      UNION\n      SELECT COALESCE(grantee_role.rolname, 'PUBLIC') || ' can create objects in schema slotlock'\n        FROM pg_catalog.pg_namespace ns\n       CROSS JOIN LATERAL pg_catalog.aclexplode(ns.nspacl) acl\n        LEFT JOIN pg_catalog.pg_roles grantee_role ON grantee_role.oid = acl.grantee\n       WHERE ns.nspname = 'slotlock'\n         AND acl.privilege_type = 'CREATE'\n         AND acl.grantee <> ns.nspowner\n         AND (acl.grantee = 0\n              OR (grantee_role.rolname <> CURRENT_USER AND NOT grantee_role.rolsuper))\n      UNION\n      SELECT ident.type || ' ' || ident.identity || ' is owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_shdepend owned\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = owned.refobjid\n       CROSS JOIN LATERAL pg_catalog.pg_identify_object(owned.classid, owned.objid, owned.objsubid) ident\n       WHERE owned.dbid = (SELECT db.oid FROM pg_catalog.pg_database db\n                            WHERE db.datname = pg_catalog.current_database())\n         AND owned.deptype = 'o'\n         AND owned.refclassid = 'pg_catalog.pg_authid'::pg_catalog.regclass\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n         AND ident.schema = 'slotlock'\n      UNION\n      SELECT 'trigger ' || trg.tgname || ' on slotlock.' || rel.relname || ' runs '\n             || trg.tgfoid::pg_catalog.regprocedure::pg_catalog.text\n             || ', owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_trigger trg\n        JOIN pg_catalog.pg_class rel ON rel.oid = trg.tgrelid\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = rel.relnamespace\n        JOIN pg_catalog.pg_proc fn ON fn.oid = trg.tgfoid\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = fn.proowner\n       WHERE ns.nspname = 'slotlock'\n         AND NOT trg.tgisinternal\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n      UNION\n      SELECT COALESCE(grantee_role.rolname, 'PUBLIC') || ' can create triggers on slotlock.'\n             || rel.relname\n        FROM pg_catalog.pg_class rel\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = rel.relnamespace\n       CROSS JOIN LATERAL pg_catalog.aclexplode(rel.relacl) acl\n        LEFT JOIN pg_catalog.pg_roles grantee_role ON grantee_role.oid = acl.grantee\n       WHERE ns.nspname = 'slotlock'\n         AND acl.privilege_type = 'TRIGGER'\n         AND acl.grantee <> rel.relowner\n         AND (acl.grantee = 0\n              OR (grantee_role.rolname <> CURRENT_USER AND NOT grantee_role.rolsuper))\n      UNION\n      SELECT 'extension ' || ext.extname || ' in schema slotlock is owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_extension ext\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = ext.extnamespace\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = ext.extowner\n       WHERE ns.nspname = 'slotlock'\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n    ) refusal;\n  IF refusals IS NOT NULL THEN\n    RAISE EXCEPTION 'Slotlock will not deploy into schema slotlock: another role controls it'\n      USING ERRCODE = 'insufficient_privilege',\n            DETAIL = pg_catalog.to_jsonb(refusals)::pg_catalog.text,\n            HINT = 'The deployment role must own schema slotlock and every object in it, and no other role may create objects in it.';\n  END IF;\nEND\n$slotlock_schema_control$;\nDO $slotlock_schema_preconditions$\nDECLARE\n  installed integer;\nBEGIN\n  IF pg_catalog.current_setting('server_version_num')::integer < 160000 THEN\n    RAISE EXCEPTION 'Slotlock needs PostgreSQL 16 or later; this server is %',\n      pg_catalog.current_setting('server_version')\n      USING ERRCODE = 'feature_not_supported';\n  END IF;\n  IF pg_catalog.to_regclass('slotlock.schema_version') IS NOT NULL THEN\n    EXECUTE 'SELECT version FROM slotlock.schema_version WHERE singleton' INTO installed;\n    IF installed > 4 THEN\n      RAISE EXCEPTION 'Slotlock will not migrate a schema a newer release migrated (version %; this release is version 4)', installed\n        USING ERRCODE = 'object_not_in_prerequisite_state',\n              HINT = 'Migrate and serve it with the release that migrated it, or a later one.';\n    END IF;\n  END IF;\nEND\n$slotlock_schema_preconditions$;\n";
 /** Active (unrevoked, unexpired) API keys one tenant may hold. */
@@ -23,19 +22,19 @@ export declare const SLOTLOCK_API_KEY_RETAINED_LIMIT = 1000;
  * The tables behind API keys. No role but their owner holds a right on them; they are reached only
  * through SLOTLOCK_API_KEY_FUNCTIONS.
  */
-export declare const SLOTLOCK_API_KEY_TABLES: readonly ["api_keys", "api_key_retired_digests"];
+export declare const SLOTLOCK_API_KEY_TABLES: readonly ["api_keys", "api_key_retired_digests", "api_key_resource_scopes", "api_key_limits"];
 /**
  * The SECURITY DEFINER functions through which the serving role reaches API keys, by signature.
  * They run as the deployment role, which owns the tables.
  */
-export declare const SLOTLOCK_API_KEY_FUNCTIONS: readonly ["slotlock.create_api_key(text, text, text, bytea, text[], timestamptz, text)", "slotlock.list_api_keys(text)", "slotlock.rotate_api_key(text, uuid, text, bytea)", "slotlock.revoke_api_key(text, uuid)", "slotlock.authenticate_api_key(bytea)", "slotlock.erase_api_keys(text)"];
+export declare const SLOTLOCK_API_KEY_FUNCTIONS: readonly ["slotlock.create_api_key(text, text, text, bytea, text[], timestamptz, text)", "slotlock.list_api_keys(text)", "slotlock.rotate_api_key(text, uuid, text, bytea)", "slotlock.revoke_api_key(text, uuid)", "slotlock.authenticate_api_key(bytea)", "slotlock.erase_api_keys(text)", "slotlock.set_api_key_resource_scope(text, uuid, text[], text[])", "slotlock.authenticate_scoped_api_key(bytea)", "slotlock.list_api_key_resource_scopes(text)", "slotlock.set_api_key_limits(text, uuid, integer, integer, integer, boolean)", "slotlock.list_api_key_limits(text)", "slotlock.authenticate_limited_api_key(bytea)"];
 /**
  * The table behind the dashboard's shared records (dashboard.ts). No role but its owner holds a
  * right on it; it is reached only through SLOTLOCK_DASHBOARD_FUNCTIONS.
  */
-export declare const SLOTLOCK_DASHBOARD_TABLES: readonly ["dashboard_tokens"];
+export declare const SLOTLOCK_DASHBOARD_TABLES: readonly ["dashboard_tokens", "dashboard_organizations"];
 /** The SECURITY DEFINER functions through which the serving role reaches the dashboard's records. */
-export declare const SLOTLOCK_DASHBOARD_FUNCTIONS: readonly ["slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)", "slotlock.dashboard_session_ended(bytea, timestamptz)"];
+export declare const SLOTLOCK_DASHBOARD_FUNCTIONS: readonly ["slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)", "slotlock.dashboard_session_ended(bytea, timestamptz)", "slotlock.enabled_organizations(text)", "slotlock.enable_organization(text, text, text)", "slotlock.disable_organization(text, text)"];
 /** Live form records one person may leave in the dashboard's records (12 hours of forms). */
 export declare const SLOTLOCK_DASHBOARD_FORM_LIMIT = 1000;
 /** The table that records which release migrated the schema (SLOTLOCK_SCHEMA_VERSION). */
@@ -43,21 +42,49 @@ export declare const SLOTLOCK_SCHEMA_TABLES: readonly ["schema_version"];
 /** The SECURITY DEFINER function through which a server reads the version it is serving. */
 export declare const SLOTLOCK_SCHEMA_FUNCTIONS: readonly ["slotlock.installed_schema_version()"];
 /** The table of suspended tenants: they may read, and write nothing (store.ts withTenant). */
-export declare const SLOTLOCK_TENANT_ADMIN_TABLES: readonly ["tenant_suspensions", "webhook_tenants", "rate_buckets", "assistant_tenants"];
+export declare const SLOTLOCK_TENANT_ADMIN_TABLES: readonly ["tenant_suspensions", "tenant_plans", "plan_defaults", "usage_daily", "usage_flushes", "usage_cursors", "usage_meter_start", "usage_notices", "overage_reports", "webhook_tenants", "rate_buckets", "assistant_tenants", "maintenance_tenants"];
 /**
  * The SECURITY DEFINER functions through which a server checks a tenant's suspension and erases a
  * tenant, by signature.
  */
-export declare const SLOTLOCK_TENANT_ADMIN_FUNCTIONS: readonly ["slotlock.tenant_suspended(text)", "slotlock.erase_tenant(text)", "slotlock.register_webhook_tenant(text)", "slotlock.webhook_tenants(text)", "slotlock.unregister_webhook_tenant(text)", "slotlock.take_rate_token(text, double precision, double precision)", "slotlock.register_assistant_tenant(text, timestamptz)", "slotlock.sweep_assistant_conversations(integer)"];
+export declare const SLOTLOCK_TENANT_ADMIN_FUNCTIONS: readonly ["slotlock.tenant_suspended(text)", "slotlock.erase_tenant(text)", "slotlock.register_webhook_tenant(text)", "slotlock.webhook_tenants(text)", "slotlock.unregister_webhook_tenant(text)", "slotlock.take_rate_token(text, double precision, double precision)", "slotlock.register_assistant_tenant(text, timestamptz)", "slotlock.sweep_assistant_conversations(integer)", "slotlock.list_maintenance_tenant()", "slotlock.maintenance_tenants(text)", "slotlock.tenant_plan(text)", "slotlock.set_tenant_plan(text, text, text, integer, integer, integer, text, text, timestamptz)", "slotlock.plan_default()", "slotlock.enrol_tenant_plan(text)", "slotlock.record_usage(uuid, jsonb)", "slotlock.roll_up_usage(text, integer)", "slotlock.tenant_usage(text, date, date)", "slotlock.tenant_quota_usage(text, date)", "slotlock.note_usage_threshold(text, date, text, integer, bigint, bigint)", "slotlock.tenant_plan_quotas(text)", "slotlock.reset_test_tenant(text)"];
+/** The functions usage metering runs (SLOTLOCK_USAGE=on): serve checks it may, before it starts. */
+export declare const SLOTLOCK_USAGE_FUNCTIONS: readonly ["slotlock.record_usage(uuid, jsonb)", "slotlock.roll_up_usage(text, integer)", "slotlock.tenant_usage(text, date, date)"];
+/** The functions quotas run (SLOTLOCK_QUOTAS=on, quotas.ts): serve checks it may, before it starts. */
+export declare const SLOTLOCK_QUOTA_FUNCTIONS: readonly ["slotlock.tenant_plan(text)", "slotlock.tenant_quota_usage(text, date)", "slotlock.note_usage_threshold(text, date, text, integer, bigint, bigint)"];
+/** What a plan's monthly quotas count (quotas.ts): operations run and bookings made. */
+export declare const SLOTLOCK_QUOTA_METRICS: readonly ["operations", "bookings"];
+/** The shares of a quota, in percent, at which a tenant is told once a month (usage.threshold_reached). */
+export declare const SLOTLOCK_QUOTA_NOTICE_PERCENTS: readonly [80, 100];
+/** The most bookings past the roll-up cursor one quota read counts: more than any plan allows. */
+export declare const SLOTLOCK_QUOTA_UNROLLED_LIMIT = 100000;
 /**
- * Functions only the deployment role runs: suspending and lifting a suspension. No other role is
- * granted them, so a serving role cannot lift a suspension.
+ * What usage.ts meters, per tenant and day: operations run, bookings and holds committed, webhook
+ * deliveries accepted, messages to the dashboard assistant, and resources held (a count each day, not
+ * a sum).
  */
-export declare const SLOTLOCK_OPERATOR_FUNCTIONS: readonly ["slotlock.suspend_tenant(text, text)", "slotlock.unsuspend_tenant(text)"];
+export declare const SLOTLOCK_USAGE_METRICS: readonly ["operations", "bookings", "holds", "webhook_deliveries", "assistant_messages", "resources"];
+/** The metrics a server counts and records (slotlock.record_usage); the rest the database counts. */
+export declare const SLOTLOCK_RECORDED_USAGE_METRICS: readonly ["operations", "webhook_deliveries", "assistant_messages"];
+/** Days a tenant's daily usage is kept: a yearly plan, and a month for disputes after it. */
+export declare const SLOTLOCK_USAGE_RETENTION_DAYS = 400;
+/**
+ * Functions only the deployment role runs: suspending and lifting a suspension, and setting the
+ * hosted plan every tenant without one of its own is on. No other role is granted them, so a serving
+ * role cannot lift a suspension or change the default plan.
+ */
+export declare const SLOTLOCK_OPERATOR_FUNCTIONS: readonly ["slotlock.suspend_tenant(text, text)", "slotlock.unsuspend_tenant(text)", "slotlock.set_plan_default(text, integer, integer, integer, timestamptz)"];
 /** Every SECURITY DEFINER function the serving role may execute, by signature. */
-export declare const SLOTLOCK_DEFINER_FUNCTIONS: readonly ("slotlock.authenticate_api_key(bytea)" | "slotlock.create_api_key(text, text, text, bytea, text[], timestamptz, text)" | "slotlock.dashboard_session_ended(bytea, timestamptz)" | "slotlock.erase_api_keys(text)" | "slotlock.erase_tenant(text)" | "slotlock.installed_schema_version()" | "slotlock.list_api_keys(text)" | "slotlock.register_assistant_tenant(text, timestamptz)" | "slotlock.register_webhook_tenant(text)" | "slotlock.revoke_api_key(text, uuid)" | "slotlock.rotate_api_key(text, uuid, text, bytea)" | "slotlock.sweep_assistant_conversations(integer)" | "slotlock.take_rate_token(text, double precision, double precision)" | "slotlock.tenant_suspended(text)" | "slotlock.unregister_webhook_tenant(text)" | "slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)" | "slotlock.webhook_tenants(text)")[];
+/**
+ * Partner accounts (RFC 0003 part 4): what the serving role may call for a partner key and the
+ * partner API. A partner, its keys and its contract are made by the schema owner (`slotlock partner`).
+ */
+export declare const SLOTLOCK_PARTNER_FUNCTIONS: readonly ["slotlock.partner_tenant_blocked(text)", "slotlock.authenticate_partner_key(bytea)", "slotlock.partner_contract(text)", "slotlock.put_partner_account(text, text, text)", "slotlock.list_partner_accounts(text)", "slotlock.get_partner_account(text, text)", "slotlock.set_partner_account_suspended(text, text, boolean, text)", "slotlock.partner_usage(text, date, date, text)", "slotlock.partner_account_tenant(text, text)", "slotlock.record_partner_reconciliation(text, date, integer, integer, numeric)"];
+/** The partner tables: owner-only, reached through SLOTLOCK_PARTNER_FUNCTIONS. */
+export declare const SLOTLOCK_PARTNER_TABLES: readonly ["partners", "partner_keys", "partner_accounts", "partner_invoices", "partner_month_closes", "partner_erased_usage", "partner_reconciliations"];
+export declare const SLOTLOCK_DEFINER_FUNCTIONS: readonly ("slotlock.authenticate_api_key(bytea)" | "slotlock.authenticate_limited_api_key(bytea)" | "slotlock.authenticate_partner_key(bytea)" | "slotlock.authenticate_scoped_api_key(bytea)" | "slotlock.create_api_key(text, text, text, bytea, text[], timestamptz, text)" | "slotlock.dashboard_session_ended(bytea, timestamptz)" | "slotlock.disable_organization(text, text)" | "slotlock.enable_organization(text, text, text)" | "slotlock.enabled_organizations(text)" | "slotlock.enrol_tenant_plan(text)" | "slotlock.erase_api_keys(text)" | "slotlock.erase_tenant(text)" | "slotlock.get_partner_account(text, text)" | "slotlock.installed_schema_version()" | "slotlock.list_api_key_limits(text)" | "slotlock.list_api_key_resource_scopes(text)" | "slotlock.list_api_keys(text)" | "slotlock.list_maintenance_tenant()" | "slotlock.list_partner_accounts(text)" | "slotlock.maintenance_tenants(text)" | "slotlock.note_usage_threshold(text, date, text, integer, bigint, bigint)" | "slotlock.partner_account_tenant(text, text)" | "slotlock.partner_contract(text)" | "slotlock.partner_tenant_blocked(text)" | "slotlock.partner_usage(text, date, date, text)" | "slotlock.plan_default()" | "slotlock.put_partner_account(text, text, text)" | "slotlock.record_partner_reconciliation(text, date, integer, integer, numeric)" | "slotlock.record_usage(uuid, jsonb)" | "slotlock.register_assistant_tenant(text, timestamptz)" | "slotlock.register_webhook_tenant(text)" | "slotlock.reset_test_tenant(text)" | "slotlock.revoke_api_key(text, uuid)" | "slotlock.roll_up_usage(text, integer)" | "slotlock.rotate_api_key(text, uuid, text, bytea)" | "slotlock.set_api_key_limits(text, uuid, integer, integer, integer, boolean)" | "slotlock.set_api_key_resource_scope(text, uuid, text[], text[])" | "slotlock.set_partner_account_suspended(text, text, boolean, text)" | "slotlock.set_tenant_plan(text, text, text, integer, integer, integer, text, text, timestamptz)" | "slotlock.sweep_assistant_conversations(integer)" | "slotlock.take_rate_token(text, double precision, double precision)" | "slotlock.tenant_plan(text)" | "slotlock.tenant_plan_quotas(text)" | "slotlock.tenant_quota_usage(text, date)" | "slotlock.tenant_suspended(text)" | "slotlock.tenant_usage(text, date, date)" | "slotlock.unregister_webhook_tenant(text)" | "slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)" | "slotlock.webhook_tenants(text)")[];
 /** Tables no role but their owner reads or writes, reached only through SLOTLOCK_DEFINER_FUNCTIONS. */
-export declare const SLOTLOCK_DEFINER_TABLES: readonly ("api_key_retired_digests" | "api_keys" | "assistant_tenants" | "dashboard_tokens" | "rate_buckets" | "schema_version" | "tenant_suspensions" | "webhook_tenants")[];
+export declare const SLOTLOCK_DEFINER_TABLES: readonly ("api_key_limits" | "api_key_resource_scopes" | "api_key_retired_digests" | "api_keys" | "assistant_tenants" | "dashboard_organizations" | "dashboard_tokens" | "maintenance_tenants" | "overage_reports" | "partner_accounts" | "partner_erased_usage" | "partner_invoices" | "partner_keys" | "partner_month_closes" | "partner_reconciliations" | "partners" | "plan_defaults" | "rate_buckets" | "schema_version" | "tenant_plans" | "tenant_suspensions" | "usage_cursors" | "usage_daily" | "usage_flushes" | "usage_meter_start" | "usage_notices" | "webhook_tenants")[];
 /**
  * The advisory lock every server transaction for a tenant holds shared (store.ts withTenant), and
  * suspension and erasure take exclusively, keyed by this text's hashtextextended(…, 0).
@@ -68,16 +95,12 @@ export declare const SLOTLOCK_VALIDATION_DDL: string;
 /** Outbox ids one batch of the coverage-change rename reads (by primary key) in one transaction. */
 export declare const SLOTLOCK_COVERAGE_CHANGE_RENAME_BATCH = 5000;
 /**
- * One batch of the rename of coverage changes an earlier release wrote: of the outbox rows with ids
- * after `after` up to `head` (SQL expressions, bigint), the first `batch` by id, each `coverage.*`
- * one not yet in this release's shape gets its source's source_id as subject and `data.source_id`,
- * and loses `source` and `last_error`. Before 0.5.3 coverage.stale carried the source itself (an
- * iCalendar URL with a token, an address) and the error read from it; 0.5.3 named it by an unkeyed
- * digest anyone could confirm a guess against. A source deleted since is `src_redacted`: nothing
- * can match it any more, and a made-up id would look like a source the tenant could find. Selects
- * the last id read (`last`, null when there was none) and how many it renamed (`renamed`), `INTO`
- * `into` when given (PL/pgSQL). Rows in the new shape are left alone, so a batch run again changes
- * nothing.
+ * One batch of the rename of coverage changes an earlier release wrote: of the outbox rows after
+ * `after` up to `head` (bigint SQL expressions), the first `batch` by id; each `coverage.*` row not
+ * yet in shape gets its source_id as subject and `data.source_id`, and loses `source` and
+ * `last_error` (before 0.5.3 these carried the source itself, a URL with a token; 0.5.3's unkeyed
+ * digest could confirm a guess). A deleted source becomes `src_redacted`. Selects `last` (null when
+ * none) and `renamed`, `INTO` `into` when given. Idempotent.
  */
 export declare function slotlockCoverageChangeRenameSql(after: string, head: string, batch: string, into?: string): string;
 /** The whole deployment DDL, run in one transaction: the schema, then its constraints validated. */
@@ -93,14 +116,12 @@ export declare const SLOTLOCK_TENANT_CONTEXT_SETTING = "slotlock.tenant_ref";
  * `slotlock.rls_policy_contracts` and `slotlock.deployment_lifted_row_security` are
  * deployment-only and deliberately absent.
  */
-export declare const SLOTLOCK_TENANT_TABLES: readonly ["resources", "reservations", "reservation_tombstones", "reservation_conflict_archive", "calendar_events", "calendar_event_attendees", "calendar_event_reminders", "calendar_event_exceptions", "calendar_event_occurrences", "calendar_event_tombstones", "calendar_event_commands", "calendar_coverage", "hold_commands", "outbox", "outbox_pruned", "webhook_endpoints", "waitlist_entries", "booking_rule_defaults", "assistant_settings", "assistant_conversations"];
+export declare const SLOTLOCK_TENANT_TABLES: readonly ["resources", "reservations", "reservation_tombstones", "reservation_conflict_archive", "calendar_events", "calendar_event_attendees", "calendar_event_reminders", "calendar_event_exceptions", "calendar_event_occurrences", "calendar_event_tombstones", "calendar_event_commands", "calendar_coverage", "hold_commands", "outbox", "outbox_pruned", "webhook_endpoints", "waitlist_entries", "booking_rule_defaults", "assistant_settings", "assistant_conversations", "locations", "resource_groups", "resource_group_members", "pool_settings", "composite_claims", "approval_policies", "approvals"];
 /**
- * Build the grants for the application role: USAGE on the `slotlock` schema, DML on the store's
- * tables and EXECUTE on the API key and dashboard functions. Nothing else: no ownership, DDL,
- * sequence, RLS-contract, API key or dashboard table access. The role must not be
- * able to leave forced RLS, itself or through a role it belongs to (`grantApplicationRole` refuses
- * the known ways out; these statements check nothing). Rerun after every `applySchema()`, since a
- * release may add a table.
+ * Build the grants for the application role: USAGE on the schema, DML on the store's tables and
+ * EXECUTE on the API key and dashboard functions, nothing else. The role must not be able to leave
+ * forced RLS (`grantApplicationRole` checks; these statements do not). Rerun after every
+ * `applySchema()`, since a release may add a table.
  */
 export declare function createSlotlockApplicationRoleGrantsDdl(role: string): string;
 /**
@@ -108,5 +129,16 @@ export declare function createSlotlockApplicationRoleGrantsDdl(role: string): st
  * `slotlock.tenant_ref`; adapters may supply an established transaction-local setting name.
  * Every policy fails closed when the setting is absent or empty, and FORCE binds the table owner.
  */
+/**
+ * The transaction-local setting withTenant sets for a key limited to part of its tenant (RFC 0003
+ * G6): the ids of the resources it reaches, as a uuid[] literal; empty for every other caller.
+ */
+export declare const SLOTLOCK_RESOURCE_SCOPE_SETTING = "slotlock.resource_scope";
+/**
+ * The tables a key limited to part of its tenant is held to, and how each row names its resource:
+ * the resource itself, or the event it belongs to. Tombstones and archives name none and stay as the
+ * tenant policy leaves them.
+ */
+export declare const SLOTLOCK_RESOURCE_SCOPED_TABLES: Readonly<Record<string, string>>;
 export declare function createSlotlockTenantRlsDdl(tenantContextSetting?: string): string;
 export declare const SLOTLOCK_TENANT_RLS_DDL: string;