slotlock 0.6.2 → 0.7.0

package/store.d.ts

@@ -1,19 +1,20 @@
+import { type SlotlockResourceKind, type SlotlockResourceProfileInput, type SlotlockLocation, type SlotlockPoolOrder, type SlotlockResourceGroup, type SlotlockResourceScope } from './resource-profile.js';
+import { type SlotlockUsageRow } from './usage.js';
 import { type SlotlockChangeOrigin, type SlotlockEventFeed } from './event-feed.js';
 import { type SlotlockBookingRules } from './booking-rules.js';
 import type { Sql, TransactionSql } from 'postgres';
 import { SLOTLOCK_CALENDAR_HORIZON_DAYS } from './rules.js';
-import type { AcquireHoldResult, CalendarCoverageCommand, CalendarCoverageResult, CalendarEventContent, CalendarEventRetentionResult, BookingRetentionResult, SlotlockTenantErasure, SlotlockBookingRuleDefaults, CalendarFreeBusy, CalendarHorizonRollCursor, CalendarHorizonRollResult, CancelCalendarEventResult, CancelExternalReservationResult, ConfirmHoldResult, CreateReservationResult, DeleteResourceResult, ExternalReservationCommand, ExternalReservationResult, Interval, SlotlockCalendarEvent, SlotlockAgendaEntry, SlotlockHold, SlotlockReservation, SlotlockResource, PutCalendarEventCommand, PutCalendarEventResult, ReleaseHoldResult, WeeklyAvailabilityRule } from './types.js';
+import type { AcquireHoldResult, CalendarCoverageCommand, CalendarCoverageResult, CalendarEventContent, CalendarEventRetentionResult, BookingRetentionResult, SlotlockTenantErasure, SlotlockBookingRuleDefaults, CalendarFreeBusy, CalendarHorizonRollCursor, CalendarHorizonRollResult, CancelCalendarEventResult, CancelExternalReservationResult, ConfirmHoldResult, CreateReservationResult, DeleteResourceResult, ExternalReservationCommand, ExternalReservationResult, Interval, SlotlockCalendarEvent, SlotlockAgendaEntry, SlotlockHold, SlotlockBookingDescription, SlotlockApproval, SlotlockApprovalPolicy, SlotlockReservation, SlotlockResource, PutCalendarEventCommand, PutCalendarEventResult, ReleaseHoldResult, WeeklyAvailabilityRule } from './types.js';
+import { type PutApprovalPolicyParams } from './approvals.js';
 export { SLOTLOCK_CALENDAR_HORIZON_DAYS };
 /**
- * Longest one-off event the store accepts (ten years and some leap days): long enough for any lease
- * or long-term rental, short enough that a unit error cannot occupy a resource for ever. A recurring
- * series is bounded by its 367-day materialization window instead.
+ * Longest one-off event (ten years and some leap days); a recurring series is bounded by its
+ * materialization window instead.
  */
 export declare const SLOTLOCK_MAX_EVENT_DURATION_DAYS = 3660;
 /**
- * Longest window a recurring series is stored (materialized) for: the 367-day search window plus
- * two days. The rolling horizon starts a day before the current UTC day and must reach 367 days
- * past its end, so that a search of the full 367 days from any moment of the day is complete.
+ * The 367-day search window plus two days: the rolling horizon starts a day before the current UTC
+ * day and must reach 367 days past its end.
  */
 export declare const SLOTLOCK_MATERIALIZATION_WINDOW_DAYS: number;
 /** Trusted provider/maintenance namespace used by backwards-compatible store callers. */
@@ -38,8 +39,8 @@ export declare const SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS = 30;
 /** Store-owned coverage source for bounded, locally materialized recurring events. */
 export declare const SLOTLOCK_LOCAL_RECURRENCE_COVERAGE_SOURCE = "slotlock:local-recurrence-materialization";
 /**
- * Stable daily target shared by the event writer, maintenance worker, and readiness proof: from a
- * day before the current UTC day to 367 days past its end (SLOTLOCK_MATERIALIZATION_WINDOW_DAYS).
+ * From a day before the current UTC day to SLOTLOCK_MATERIALIZATION_WINDOW_DAYS past its end;
+ * shared by the writer, maintenance and readiness.
  */
 export declare function calendarEventRollingHorizon(now?: Date): Interval;
 /** What `createSlotlockStore` accepts: a `postgres` client, or a transaction/savepoint from one. */
@@ -48,9 +49,9 @@ type StoreSql = SlotlockSql;
 /** How a migration (applySchema, applyTenantRls, grantApplicationRole) waits and how long it runs. */
 export interface SlotlockMigrationOptions {
     /**
-     * The longest it waits for any one lock, in milliseconds (1-600,000; default 1,000). While a
-     * migration waits for a lock on a table, every query that comes after it on that table waits
-     * behind it; past this it gives up, lets them through, and tries again.
+     * The longest it waits for any one lock, in milliseconds (1-600,000; default 1,000). Queries on a
+     * table queue behind a migration waiting for its lock, so past this it gives up, lets them
+     * through, and retries.
      */
     lockTimeoutMs?: number;
     /** The longest any one of its statements runs, in milliseconds (1-86,400,000; default 900,000). */
@@ -59,21 +60,18 @@ export interface SlotlockMigrationOptions {
     attempts?: number;
 }
 /**
- * The schema version recorded by the last migration, or `null` when there is none this role can
- * read: no schema, a schema from 0.2 or earlier, or a role not yet granted the function (run
- * `slotlock migrate`, which grants it).
+ * The recorded schema version, or `null` when this role cannot read one: no schema, 0.2 or earlier,
+ * or the function not yet granted (`slotlock migrate` grants it).
  */
 export declare function readSlotlockSchemaVersion(sql: SlotlockSql): Promise<number | null>;
 /**
- * Refuse to serve a schema another release migrated: `schema_outdated` when it is older than this
- * release (or unversioned), so `slotlock migrate` must run first; `schema_newer` when a newer release
- * migrated it, whose schema this release's code does not know. Both carry `installed` and `expected`.
+ * Refuse a schema another release migrated: `schema_outdated` (older or unversioned: run `slotlock
+ * migrate`) or `schema_newer`. Both carry `installed` and `expected`.
  */
 export declare function assertSlotlockSchemaCurrent(sql: SlotlockSql): Promise<void>;
 /**
- * What makes a put the same request: its identity and the event it asks for. Not the window its
- * occurrences are stored over, which for a series is the rolling horizon from the current UTC
- * midnight: with it in the hash, a retry after midnight was refused as a different request.
+ * A put's identity and the event it asks for, not its storage window: a series' window moves with
+ * the UTC day, so a retry after midnight must still match.
  */
 declare function putCommandHash(params: {
     command: PutCalendarEventCommand;
@@ -81,9 +79,8 @@ declare function putCommandHash(params: {
     event: CalendarEventContent;
 }): string;
 /**
- * The hash 0.3.0 and earlier stored, with the window in it, so a command stored before the upgrade
- * still replays: always for a one-off event, whose window is its own span, and on the same UTC day
- * for a series. Remove once no stored command can be that old (commands are pruned after 30 days).
+ * The hash 0.3.0 and earlier stored (window included), so an older stored command still replays.
+ * Remove once no stored command can be that old (pruned after 30 days).
  */
 export declare function legacyPutCommandHash(params: Parameters<typeof putCommandHash>[0] & {
     window: Interval;
@@ -95,52 +92,38 @@ export declare const SLOTLOCK_MAX_POOL_RULE_DEFAULTS = 1000;
 export declare function isPoolName(value: unknown): value is string;
 export interface SlotlockStore extends SlotlockEventFeed {
     /**
-     * Apply the Slotlock DDL (idempotent). Owns the `slotlock` schema on the connected DB. Refuses
-     * (`unsafe_slotlock_schema`, with the `reasons` found) a `slotlock` schema that a role other than the
-     * connected one (superusers aside) owns or can create objects in, that holds an object such a
-     * role owns (an extension included), or whose tables such a role may add triggers to or have a
-     * trigger running a function such a role owns. Ownership through a group role counts as another
-     * role's: deploy as the owning role itself (`SET ROLE`). Refuses (`schema_newer`) a schema a newer
-     * release migrated, changing nothing. Records SLOTLOCK_SCHEMA_VERSION. A schema this release
-     * already migrated, unchanged since, is left as it is without a lock on any table. Constraints an
-     * upgrade adds NOT VALID are validated in a second transaction, whose locks no serving read or
-     * write waits for (one inside a caller's transaction shares its locks until it ends); one that old
-     * rows still break stays NOT VALID, and each later migration validates it again. Each lock it
-     * waits for is bounded by `lockTimeoutMs`, after which it tries again (`schema_lock_timeout` once
+     * Apply the Slotlock DDL (idempotent). Refuses (`unsafe_slotlock_schema`, with `reasons`) a
+     * `slotlock` schema that another role (superusers aside) owns, can create objects in, owns an
+     * object in, or can add triggers to; ownership through a group role counts, so deploy as the
+     * owning role itself (`SET ROLE`). Refuses (`schema_newer`) a schema a newer release migrated. An
+     * unchanged schema is left without locking any table. Constraints added NOT VALID are validated
+     * in a second transaction; one old rows still break stays NOT VALID and is retried on each
+     * migration. Each lock wait is bounded by `lockTimeoutMs` and retried (`schema_lock_timeout` once
      * out of attempts).
      */
     applySchema(options?: SlotlockMigrationOptions): Promise<void>;
     /**
-     * Atomically enable forced tenant RLS using this store's configured context setting. Refuses the
-     * same `slotlock` schemas as `applySchema()`. Tables already forced under exactly the policies it
-     * installs, bound to this setting, are left as they are without a lock on any table.
+     * Atomically enable forced tenant RLS using the store's context setting. Refuses the same schemas
+     * as `applySchema()`. Tables already set up exactly so are left without a lock.
      */
     applyTenantRls(options?: {
         allowRebind?: boolean;
     } & SlotlockMigrationOptions): Promise<void>;
     /**
      * Grant an existing application role exactly what the store needs at runtime: USAGE on the
-     * `slotlock` schema and DML on its tables. Run as the deployment role after every `applySchema()`.
-     * Refuses (`unsafe_application_role`, with the `reasons` found) a role that has one of the known
-     * ways around forced tenant RLS or the exclusion arbiter, itself, through a role it belongs to or
-     * through PUBLIC: superuser, BYPASSRLS, REPLICATION or CREATEROLE, a server file or program role,
-     * ownership of the database, of anything in it (its temporary objects and its own default
-     * privileges aside) or of `btree_gist`, CREATE on the database or on any schema, TRUNCATE,
-     * REFERENCES or TRIGGER on a Slotlock table (or by default on new ones), or a right on a server
-     * setting. The check runs when the grant is made, so a right added later is not
-     * detected until it runs again, and it is not exhaustive (SECURITY.md lists what it does not read).
+     * `slotlock` schema and DML on its tables. Run as the deployment role after every
+     * `applySchema()`. Refuses (`unsafe_application_role`, with `reasons`) a role with a known way
+     * around forced RLS or the exclusion arbiter, directly, by membership or through PUBLIC
+     * (SECURITY.md lists the checks and what they do not cover). The check runs only at grant time.
      */
     grantApplicationRole(role: string, options?: SlotlockMigrationOptions): Promise<void>;
     /**
      * Run store operations with one transaction-local tenant context on the same connection. On a
-     * client it opens a READ COMMITTED transaction, whatever the role's default. Inside a caller's
-     * transaction of another level its writes are refused (`invalid_transaction_isolation`), since
-     * that snapshot can miss a suspension, and its reads go on; with `isolation: 'read committed'`
-     * such a transaction is refused outright. The serving role needs EXECUTE on
-     * slotlock.tenant_suspended(text): without it this refuses with `application_role_not_granted`
-     * (grantApplicationRole grants it), and on a schema without it with `schema_outdated`. With the
-     * store's `maxTenantTransactions`, an aborted `signal` takes a call still waiting for its turn out
-     * of the line, refused with the signal's reason.
+     * client it opens a READ COMMITTED transaction. Inside a caller's transaction of another level,
+     * writes are refused (`invalid_transaction_isolation`), since that snapshot can miss a
+     * suspension. Needs EXECUTE on slotlock.tenant_suspended(text) (`application_role_not_granted`
+     * without it; grantApplicationRole grants it). With `maxTenantTransactions`, an aborted `signal`
+     * removes a waiting call from the line.
      */
     withTenant<T>(tenantRef: string, callback: (store: SlotlockTenantStore) => Promise<T>, options?: {
         isolation?: 'read committed';
@@ -157,19 +140,23 @@ export interface SlotlockStore extends SlotlockEventFeed {
         origin?: SlotlockChangeOrigin;
         /** The id (a UUID) of the API key making these changes, recorded with each. */
         keyId?: string;
+        /**
+         * A key limited to part of its tenant (RFC 0003 G6): the transaction reaches only the
+         * resources at these locations (each with every location in it) or in these groups, as they
+         * are when it starts, by the database's resource_scope_v1 policies, on every table keyed by
+         * resource, for reads and writes. A resource outside it is not found.
+         */
+        resourceScope?: SlotlockResourceScope;
     }): Promise<T>;
     /**
      * INVARIANT (erasure completeness): a tenant integration must use a stable, erasable business
      * identifier for externalRef and include this schema in its own data-erasure workflow.
      *
-     * With `maxTenantResources` (1-100,000, tenant-owned resources only), or the store's `resources`
-     * limit (the lower of the two when both are set), a new resource of a tenant is refused
-     * (`resource_limit_reached`, with the `limit`) once the tenant has that many; an existing
-     * `externalRef` is still updated. Capped creates for one tenant run one at a time under a database lock, so racing ones
-     * on any number of servers stop at the cap. The count needs READ COMMITTED: a capped create opens
-     * one itself, and inside a caller's transaction of another level it refuses
-     * (`invalid_transaction_isolation`). Uncapped creates do not wait for the lock and are not
-     * counted against a cap until they commit.
+     * With `maxTenantResources` (1-100,000) or the store's `resources` limit (the lower applies), a
+     * new resource is refused (`resource_limit_reached`) once the tenant has that many; an existing
+     * `externalRef` is still updated. Capped creates serialize on a database lock, so racing servers
+     * stop at the cap; this needs READ COMMITTED (`invalid_transaction_isolation` inside another
+     * level).
      */
     createResource(params: {
         externalRef?: string;
@@ -182,7 +169,103 @@ export interface SlotlockStore extends SlotlockEventFeed {
          * refused (`resource_visibility_conflict`).
          */
         visibility?: SlotlockResource['visibility'];
+        /**
+         * Its profile (resource-profile.ts): name, description, kind, capacity, labels and attributes,
+         * each optional. Creating an existing reference again sets the fields given and keeps the rest.
+         * Refused (`invalid_resource_profile`) outside its bounds, or for a resource with no tenant.
+         */
+        profile?: SlotlockResourceProfileInput;
+        /**
+         * The reference of the location it is at (`location_not_found` when the tenant has none such).
+         * Without a `timezone`, a new resource takes the nearest time zone its location, or one above
+         * it, has, else UTC.
+         */
+        location?: string;
     }): Promise<SlotlockResource>;
+    /**
+     * Change one of the tenant's resources' profile: the fields given, keeping the rest (`null`
+     * clears a name, description or capacity). Null for an id that is not the tenant's; refused
+     * (`invalid_resource_profile`) outside its bounds. The feed's `resource.updated` names the
+     * fields that changed (`profile_changed`), never their values.
+     */
+    updateResourceProfile(params: {
+        tenantRef: string;
+        id: string;
+        profile: SlotlockResourceProfileInput;
+        /** Move it to this location, or to none (`null`); left out, it stays (`location_not_found`). */
+        location?: string | null;
+    }): Promise<SlotlockResource | null>;
+    /**
+     * The tenant's locations, each under its parent, depth first (RFC 0003 G2), with how many
+     * resources are at each.
+     */
+    listLocations(params: {
+        tenantRef: string;
+    }): Promise<SlotlockLocation[]>;
+    /**
+     * Create the location with this reference, or change its name, and the parent and time zone
+     * given. Refused: `invalid_location` (naming the field), `location_not_found` (no such parent),
+     * `location_too_deep` (past SLOTLOCK_MAX_LOCATION_DEPTH levels), `location_cycle` (under itself),
+     * `location_limit_reached` (SLOTLOCK_MAX_LOCATIONS).
+     */
+    putLocation(params: {
+        tenantRef: string;
+        ref: string;
+        name: string;
+        parentRef?: string | null;
+        timezone?: string | null;
+    }): Promise<SlotlockLocation>;
+    /** Change a location's name, parent or time zone, as putLocation; null when it has none such. */
+    updateLocation(params: {
+        tenantRef: string;
+        ref: string;
+        name?: string;
+        parentRef?: string | null;
+        timezone?: string | null;
+    }): Promise<SlotlockLocation | null>;
+    /**
+     * Delete a location: false when it has none such; refused (`location_in_use`) while a resource is
+     * at it or a location is under it.
+     */
+    deleteLocation(params: {
+        tenantRef: string;
+        ref: string;
+    }): Promise<boolean>;
+    /** The tenant's groups (RFC 0003 G3), by reference, with how many resources are in each. */
+    listGroups(params: {
+        tenantRef: string;
+    }): Promise<SlotlockResourceGroup[]>;
+    /**
+     * Create the group with this reference, or change its name, and its description when given.
+     * Refused: `invalid_group` (naming the field), `group_limit_reached` (SLOTLOCK_MAX_RESOURCE_GROUPS).
+     */
+    putGroup(params: {
+        tenantRef: string;
+        ref: string;
+        name: string;
+        description?: string | null;
+    }): Promise<SlotlockResourceGroup>;
+    /** Delete a group, its resources left as they are: false when it has none such. */
+    deleteGroup(params: {
+        tenantRef: string;
+        ref: string;
+    }): Promise<boolean>;
+    /**
+     * Put one of the tenant's resources in a group: true when it was not in it. Refused:
+     * `group_not_found`, `resource_not_found`, `resource_group_limit_reached`
+     * (SLOTLOCK_MAX_GROUPS_PER_RESOURCE).
+     */
+    addGroupMember(params: {
+        tenantRef: string;
+        group: string;
+        resourceId: string;
+    }): Promise<boolean>;
+    /** Take a resource out of a group: true when it was in it. */
+    removeGroupMember(params: {
+        tenantRef: string;
+        group: string;
+        resourceId: string;
+    }): Promise<boolean>;
     /**
      * Resolve one tenant-owned resource without revealing another tenant's matching id. An archived
      * one is returned (with `archivedAt`); with `visibility`, only one of that visibility.
@@ -273,15 +356,55 @@ export interface SlotlockStore extends SlotlockEventFeed {
         tenantRef: string;
         pool: string;
         visibility?: 'shared';
+        /** In the pool's order (`setPoolOrder`) rather than by id. */
+        ordered?: boolean;
+        /**
+         * For a booking about to take one (with `ordered`): a round-robin pool's place is locked until
+         * the transaction ends, so bookings at once go round in turn instead of starting from one place.
+         */
+        forBooking?: boolean;
     }): Promise<SlotlockResource[]>;
-    /** The tenant's pools by name, with how many members each has that may be booked (its capacity). */
+    /**
+     * The tenant's pools by name, with how many members each has that may be booked (its capacity)
+     * and the order a pool booking tries them in.
+     */
     listPools(params: {
         tenantRef: string;
         visibility?: 'shared';
     }): Promise<{
         pool: string;
         capacity: number;
+        order: SlotlockPoolOrder;
     }[]>;
+    /**
+     * Set the order a pool booking tries a pool's members in (RFC 0003 G7): `stable` (by id, the
+     * default), `least_booked` or `round_robin`: `invalid_pool` for a name that is not a pool's,
+     * `invalid_pool_order` for an order that is not one of these, `pool_order_limit_reached` past
+     * SLOTLOCK_MAX_POOL_SETTINGS pools a tenant.
+     */
+    setPoolOrder(params: {
+        tenantRef: string;
+        pool: string;
+        order: SlotlockPoolOrder;
+    }): Promise<SlotlockPoolOrder>;
+    /**
+     * Make a resource a part of another (RFC 0003 G8), or no part (`null`): a booking of the whole
+     * then conflicts with every part, two parts never with each other. Null for no such resource;
+     * `parent_not_found`, `composite_too_deep` (one level only), `composite_parts_limit`
+     * (SLOTLOCK_MAX_COMPOSITE_PARTS) and `composite_busy` (either side has a booking or live hold to
+     * come) refuse it.
+     */
+    setResourceParent(params: {
+        tenantRef: string;
+        id: string;
+        parentId: string | null;
+    }): Promise<SlotlockResource | null>;
+    /** Note the member a pool booking took, from which `round_robin` goes on. */
+    notePoolBooking(params: {
+        tenantRef: string;
+        pool: string;
+        resourceId: string;
+    }): Promise<void>;
     /** Set (or clear, with `null`) the bookable hours of every resource the tenant has; returns how many. */
     setTenantAvailability(params: {
         tenantRef: string;
@@ -296,15 +419,49 @@ export interface SlotlockStore extends SlotlockEventFeed {
         visibility?: SlotlockResource['visibility'];
         /** Archived resources too; omitted, only those in use. */
         includeArchived?: boolean;
+        /** Only resources of this kind (`other` for those that say none). */
+        kind?: SlotlockResourceKind;
+        /** Only resources with every one of these labels (at most 20). */
+        labels?: readonly string[];
+        /** Only resources at this location or a location under it. */
+        location?: string;
+        /** Only resources in this group. */
+        group?: string;
+        /** Only this pool's members. */
+        pool?: string;
     }): Promise<SlotlockResource[]>;
     /**
-     * Insert a confirmed reservation with the EXCLUDE constraint as the overlap arbiter. Never
-     * throws for the expected outcomes: an invalid window or a lost race come back structured.
-     * Expired holds overlapping the window are lazily reaped in the same transaction — an
-     * expired-but-unpurged hold can never block (no cron required). On a tenant's resource the
-     * booking takes the tenant, and its own id as reference, so cancel and reschedule reach it. With
-     * `tenantRef`, only a resource of that tenant (`resource_not_found` otherwise, whatever the
-     * connection's row-level security).
+     * How many resources the tenant has, archived ones included: the count a resource limit (a hosted
+     * plan's, `maxTenantResources`) is checked against.
+     */
+    countResources(params: {
+        tenantRef: string;
+    }): Promise<number>;
+    /**
+     * Roll the tenant's committed bookings and holds up from its feed into its daily usage
+     * (usage.ts, `slotlock.roll_up_usage`), up to `limit` changes (1-100,000, default 5,000): how
+     * many it read. Fewer than `limit` means it has caught up.
+     */
+    rollUpUsage(params: {
+        tenantRef: string;
+        limit?: number;
+    }): Promise<number>;
+    /**
+     * The tenant's usage from `from` to `to`, UTC days `YYYY-MM-DD` inclusive, at most
+     * SLOTLOCK_USAGE_RETENTION_DAYS apart (usage.ts, `slotlock.tenant_usage`): empty unless the
+     * deployment meters it.
+     */
+    readUsage(params: {
+        tenantRef: string;
+        from: string;
+        to: string;
+    }): Promise<SlotlockUsageRow[]>;
+    /**
+     * Insert a confirmed reservation with the EXCLUDE constraint as the overlap arbiter; expected
+     * outcomes (invalid window, lost race) come back structured. Expired holds overlapping the window
+     * are reaped in the same transaction, so they never block. On a tenant's resource the booking
+     * takes the tenant and its own id as reference. With `tenantRef`, only that tenant's resource
+     * (`resource_not_found` otherwise, whatever the connection's RLS).
      */
     createReservation(params: {
         resourceId: string;
@@ -328,11 +485,9 @@ export interface SlotlockStore extends SlotlockEventFeed {
         revision: number;
     }): Promise<CancelExternalReservationResult>;
     /**
-     * Occupy a window WITHOUT committing: the hold blocks rivals under the same EXCLUDE arbiter
-     * until `expiresAt` (DB clock — the statement's time + ttl, never the app clock), then frees via
-     * lazy reap.
-     * With `tenantRef`, only a resource of that tenant (`resource_not_found` otherwise, whatever the
-     * connection's row-level security).
+     * Occupy a window without committing: the hold blocks rivals under the same EXCLUDE arbiter until
+     * `expiresAt` (database clock: statement time + ttl), then frees via lazy reap. With `tenantRef`,
+     * only that tenant's resource (`resource_not_found` otherwise, whatever the connection's RLS).
      */
     acquireHold(params: {
         resourceId: string;
@@ -344,23 +499,28 @@ export interface SlotlockStore extends SlotlockEventFeed {
         /** Turnaround kept busy after `end`, 0 to 30 days; the confirmed booking keeps it. */
         bufferAfterMs?: number;
         /**
-         * A retry identity, 1-500 UTF-8 bytes, unique inside `tenantRef` and `principalRef` (both
-         * required with it): a request repeated with the same key and body answers the hold the first
-         * made (`idempotent: true`), and one with another body is `idempotency_conflict`. The answer is
-         * kept until the hold would have expired, released or confirmed; a retry after that makes a new
-         * hold.
+         * A retry identity, 1-500 UTF-8 bytes, unique within `tenantRef` and `principalRef` (both
+         * required): the same key and body answer the first hold (`idempotent: true`); another body is
+         * `idempotency_conflict`. Kept until the hold would have expired, released or confirmed.
          */
         idempotencyKey?: string;
         /** Whose keys `idempotencyKey` is among, 1-500 UTF-8 bytes (an API key's subject, say). */
         principalRef?: string;
         /**
-         * Who the hold belongs to, 1-500 UTF-8 bytes, inside `tenantRef` (required with it): an agent
-         * acting for one person, say. `releaseHold` and `putCalendarEvent`'s `fromHold` with a
-         * `holderRef` take only their own, and a holder may have `maxHoldsPerHolder` (20) live at once,
-         * holding at most `maxHeldHoursPerHolder` together when that is set. Without it the hold has no
-         * holder and no cap: an application holding for its customers.
+         * Who the hold belongs to, 1-500 UTF-8 bytes, within `tenantRef` (required): `releaseHold` and
+         * `fromHold` with a `holderRef` take only their own, and a holder may have `maxHoldsPerHolder`
+         * live at once (and `maxHeldHoursPerHolder` together, when set). Without it the hold has no
+         * holder and no cap.
          */
         holderRef?: string;
+        /**
+         * Lower the holder's caps for this hold (an API key's own limits, RFC 0004 A5): never above
+         * `maxHoldsPerHolder` and `maxHeldHoursPerHolder`, which win where they are lower.
+         */
+        holderCaps?: {
+            maxHolds?: number;
+            maxHeldHours?: number;
+        };
         /**
          * Holds taken as alternatives for one booking share a group (a UUID): booking one with
          * `fromHold` releases the rest, and releasing one with a holder releases them all.
@@ -372,6 +532,18 @@ export interface SlotlockStore extends SlotlockEventFeed {
         tenantRef: string;
         holdId: string;
     }): Promise<SlotlockHold | null>;
+    /**
+     * One holder's own hold by id, lapsed or live (`live`), so a confirm can say `hold_expired`
+     * rather than not found. Null when it is gone, booked, or another holder's.
+     */
+    getHolderHold(params: {
+        tenantRef: string;
+        holdId: string;
+        holderRef: string;
+    }): Promise<{
+        hold: SlotlockHold;
+        live: boolean;
+    } | null>;
     /** The tenant's live holds on one resource, by start then id, keyset-paginated like events. */
     listHolds(params: {
         tenantRef: string;
@@ -401,6 +573,156 @@ export interface SlotlockStore extends SlotlockEventFeed {
         tenantRef: string;
         externalRef: string;
     }): Promise<SlotlockReservation | null>;
+    /**
+     * Any booking, hold or event occurrence of the tenant's by its row id (the id a refused write's
+     * `conflictingReservationId` names): the time it occupies, buffers included, and whose it is.
+     * Null when the tenant has none, or the transaction's key may not see it.
+     */
+    describeBooking(params: {
+        tenantRef: string;
+        id: string;
+    }): Promise<SlotlockBookingDescription | null>;
+    /**
+     * The time an owner's calendar events occupy now, buffers included, one row per occupation: what
+     * an approval (RFC 0004 A4) holds for a write, read in the write's own rolled-back transaction.
+     */
+    eventOccupancy(params: {
+        tenantRef: string;
+        ownerRef: string;
+        externalRefs: readonly string[];
+    }): Promise<{
+        resourceId: string;
+        start: Date;
+        end: Date;
+        recurring: boolean;
+    }[]>;
+    /** Create or replace an approval policy; null when the tenant has its 50 already. */
+    putApprovalPolicy(params: PutApprovalPolicyParams): Promise<SlotlockApprovalPolicy | null>;
+    listApprovalPolicies(params: {
+        tenantRef: string;
+    }): Promise<SlotlockApprovalPolicy[]>;
+    deleteApprovalPolicy(params: {
+        tenantRef: string;
+        ref: string;
+    }): Promise<{
+        deleted: boolean;
+    }>;
+    /** The tenant's policies that apply to any of these resources (by id, pool, location, group, or all). */
+    approvalPoliciesFor(params: {
+        tenantRef: string;
+        resourceIds: readonly string[];
+    }): Promise<SlotlockApprovalPolicy[]>;
+    /**
+     * A write waiting for a person: its time held by holds the approval owns, until `expiresAt`, and
+     * the request kept to run as its requester when granted. A retry with the same `requestKey`
+     * answers the same approval (`replayed`), or `idempotency_conflict` for another request. With
+     * `consumeHold`, the requester's own hold of that time gives way to the approval's in the same
+     * transaction. `overlap` when the time is taken; `approval_limit_reached` past the pending caps.
+     */
+    requestApproval(params: {
+        tenantRef: string;
+        policyRef: string;
+        operation: SlotlockApproval['operation'];
+        request: Record<string, unknown>;
+        requester: Record<string, unknown>;
+        requesterRef: string;
+        requestKey: string;
+        holds: readonly {
+            resourceId: string;
+            start: Date;
+            end: Date;
+        }[];
+        start: Date;
+        end: Date;
+        expiresAt: Date;
+        consumeHold?: {
+            holdId: string;
+            holderRef: string;
+        };
+    }): Promise<{
+        ok: true;
+        approval: SlotlockApproval;
+        replayed: boolean;
+    } | {
+        ok: false;
+        code: 'overlap' | 'approval_limit_reached' | 'idempotency_conflict';
+        limit?: number;
+    }>;
+    /** The approval a request key made, or null. */
+    findApproval(params: {
+        tenantRef: string;
+        requestKey: string;
+    }): Promise<SlotlockApproval | null>;
+    getApproval(params: {
+        tenantRef: string;
+        id: string;
+    }): Promise<(SlotlockApproval & {
+        requester: Record<string, unknown>;
+    }) | null>;
+    listApprovals(params: {
+        tenantRef: string;
+        status?: SlotlockApproval['status'];
+        limit?: number;
+    }): Promise<SlotlockApproval[]>;
+    /**
+     * Lock a pending, unexpired approval and let its holds go, so its write can take their time in
+     * the same transaction; finishApprovalGrant then marks it granted.
+     */
+    beginApprovalGrant(params: {
+        tenantRef: string;
+        id: string;
+    }): Promise<{
+        ok: true;
+        approval: SlotlockApproval;
+    } | {
+        ok: false;
+        code: 'approval_not_found' | 'approval_not_pending' | 'approval_expired';
+    }>;
+    finishApprovalGrant(params: {
+        tenantRef: string;
+        id: string;
+        decidedBy: string;
+    }): Promise<SlotlockApproval>;
+    declineApproval(params: {
+        tenantRef: string;
+        id: string;
+        decidedBy: string;
+        reason?: string;
+    }): Promise<{
+        ok: true;
+        approval: SlotlockApproval;
+    } | {
+        ok: false;
+        code: 'approval_not_found' | 'approval_not_pending' | 'approval_expired';
+    }>;
+    /** Maintenance: up to `limit` pending approvals past their wait expire and free their time. */
+    expireApprovals(params: {
+        tenantRef: string;
+        limit?: number;
+    }): Promise<{
+        expired: number;
+    }>;
+    /**
+     * Empty a test environment (RFC 0004 A6): its resources, locations, groups, bookings, events,
+     * holds, waitlist, approval policies and feed; its keys, webhooks, plan and usage stay. Refused
+     * (`sandbox_test_only`) for a tenant that is not a test environment (`~test`). Rows removed, by
+     * table.
+     */
+    resetTestTenant(params: {
+        tenantRef: string;
+    }): Promise<Record<string, number>>;
+    /**
+     * In a test environment, make what would lapse within `minutes` lapse now (RFC 0004 A6): holds
+     * (a waitlist offer's and an approval's among them) and pending approvals. Maintenance then
+     * reaps them as it would have. Refused (`sandbox_test_only`) elsewhere.
+     */
+    fastForwardTestTenant(params: {
+        tenantRef: string;
+        minutes: number;
+    }): Promise<{
+        holds: number;
+        approvals: number;
+    }>;
     /**
      * The tenant's bookings on one resource whose occupied time meets `window` (at most 367 days),
      * by start then id, keyset-paginated: pass the last one's `{ start, id }` as `after`.
@@ -416,12 +738,10 @@ export interface SlotlockStore extends SlotlockEventFeed {
         };
     }): Promise<SlotlockReservation[]>;
     /**
-     * Flip an unexpired hold to a confirmed booking (expiry cleared). On a tenant's resource the
-     * booking takes the tenant, and the hold's id as its reference at revision 1, so cancel and
-     * reschedule reach it like any other (`reservation_cancelled` when a cancel of that reference
-     * came first). Confirming it again answers the booking as it now is. With `tenantRef`, only a
-     * hold on one of that tenant's resources counts: another tenant's is `hold_not_found` whatever
-     * the connection's row-level security.
+     * Turn an unexpired hold into a confirmed booking. On a tenant's resource the booking takes the
+     * tenant and the hold's id as reference at revision 1 (`reservation_cancelled` when a cancel of
+     * that reference came first). Confirming again answers the booking as it now is. With
+     * `tenantRef`, another tenant's hold is `hold_not_found` whatever the connection's RLS.
      */
     confirmHold(holdId: string, options?: SlotlockHoldTenantOptions): Promise<ConfirmHoldResult>;
     /**
@@ -511,12 +831,10 @@ export interface SlotlockStore extends SlotlockEventFeed {
         expectedResourceId?: string;
     }): Promise<CancelCalendarEventResult>;
     /**
-     * Atomically rematerialize due recurring masters into one rolling window without changing their
-     * semantic revision. A collision rolls back that master and leaves its old coverage untouched.
-     * A master is rolled from the window's start through the later of its stored end and the
-     * window's, so its end never moves back. One that already covers the window, or whose end lies
-     * too far past it for the 367-day cap from the window's start, is not due: it is left as it is
-     * and not counted.
+     * Rematerialize due recurring masters into one rolling window without changing their revision. A
+     * collision rolls back that master and keeps its old coverage. A master is rolled from the
+     * window's start through the later of its stored end and the window's; one already covering the
+     * window, or too far past it for the 367-day cap, is not due and not counted.
      */
     rollCalendarEventHorizon(params: {
         tenantRef: string;
@@ -526,12 +844,10 @@ export interface SlotlockStore extends SlotlockEventFeed {
         after?: CalendarHorizonRollCursor;
     }): Promise<CalendarHorizonRollResult>;
     /**
-     * Delete one bounded batch of expired event bookkeeping for a tenant, which is what returns agent
-     * quota: idempotency commands older than the replay window (every owner), then agent-owned
-     * cancellation tombstones older than it with no remaining command. Active events and `internal`
-     * (provider/sync) tombstones are never deleted. Rows another transaction holds are skipped, not
-     * waited on. After the window a retried command is evaluated afresh under its expected revision,
-     * and a pruned agent identity can be created again. Call until `hasMore` is false.
+     * Delete one bounded batch of expired event bookkeeping, which returns agent quota: commands
+     * older than the replay window (every owner), then agent-owned tombstones older than it with no
+     * remaining command. Active events and `internal` tombstones are never deleted. Locked rows are
+     * skipped. Afterwards a retried command is evaluated afresh. Call until `hasMore` is false.
      */
     pruneCalendarEventRetention(params: {
         tenantRef: string;
@@ -541,21 +857,17 @@ export interface SlotlockStore extends SlotlockEventFeed {
         retentionDays?: number;
     }): Promise<CalendarEventRetentionResult>;
     /**
-     * Delete one bounded batch of a tenant's dead booking rows: holds past their expiry and the
-     * answers kept for keyed ones (at once), and references retired by a cancel no booking held,
-     * older than the retention window. A cancelled booking's tombstone is never deleted here (only by
-     * erasing the tenant), so its reference is never booked again. Rows another transaction holds
-     * are skipped, not waited on. It also gives a confirmed booking a 0.2 server wrote without its
-     * tenant the tenant and its own id as reference, as the migration does. Call until `hasMore` is
-     * false.
+     * Delete one bounded batch of a tenant's dead booking rows: expired holds and their keyed
+     * answers, and references retired with no booking past retention. A cancelled booking's tombstone
+     * is only deleted by erasure, so its reference is never booked again. Locked rows are skipped.
+     * Also gives a confirmed booking a 0.2 server wrote without a tenant its tenant and reference, as
+     * the migration does. Call until `hasMore` is false.
      */
     /**
-     * Time zone rules that changed since an event was booked (a new tzdata): a future one-off event
-     * whose wall-clock time in its zone now falls at another instant. Each is reported once on the
-     * feed (`event.timezone_shifted`, with the instant it has and the one its wall time now means).
-     * With `move`, it is moved there instead (a new revision, `event.updated` naming `slotlock:tzdata`),
-     * unless that overlaps another booking: then it stays and `event.timezone_conflict` reports it,
-     * for a person or an agent to decide. Up to `limit` (1-1,000, default 100) events a call.
+     * Find future one-off events whose wall-clock time now falls at another instant (new tzdata),
+     * each reported once (`event.timezone_shifted`). With `move`, it is moved (a new revision,
+     * `event.updated` by `slotlock:tzdata`) unless that overlaps another booking, which
+     * `event.timezone_conflict` reports instead. Up to `limit` (1-1,000, default 100) a call.
      */
     followZoneRules(params: {
         tenantRef: string;
@@ -644,6 +956,11 @@ export interface SlotlockStore extends SlotlockEventFeed {
         end: Date;
         holderRef: string;
         offerTtlMs?: number;
+        /**
+         * A retry identity, kept as long as the entry: the same key and request answer the entry the
+         * first made (`replayed`), another request `idempotency_conflict`.
+         */
+        idempotencyKey?: string;
     }): Promise<JoinWaitlistResult>;
     /** The tenant's waitlist entries, oldest first, optionally of one resource, pool or holder. */
     listWaitlist(params: {
@@ -690,6 +1007,17 @@ export interface SlotlockStore extends SlotlockEventFeed {
     deleteAssistantSettings(params: {
         tenantRef: string;
     }): Promise<boolean>;
+    /**
+     * Replace the tenant's sealed assistant key `from` with `to`, the same key sealed under a newer
+     * secret (SLOTLOCK_ASSISTANT_PREVIOUS_SECRETS), only while `from` is still the one stored: a key an
+     * owner saved since is never overwritten. Nothing else changes, its hint and who set it included.
+     * True when it was replaced.
+     */
+    resealAssistantKey(params: {
+        tenantRef: string;
+        from: string;
+        to: string;
+    }): Promise<boolean>;
     /** A member's live assistant conversation, or null when none is (or it expired). */
     getAssistantConversation(params: {
         tenantRef: string;
@@ -740,12 +1068,11 @@ export interface SlotlockStore extends SlotlockEventFeed {
         limit?: number;
     }): Promise<number>;
     /**
-     * Offer freed time to the waitlist, in the order entries joined: each waiting entry whose window
-     * is free (on its resource, or on the first free member of its pool) gets a hold for its holder
-     * and the feed says so (`waitlist.offered`, with the hold). Entries whose window has started are
-     * expired (`waitlist.expired`); finished ones older than the change feed's retention are deleted.
-     * One tenant's offers run one at a time. One page of `limit` (1-100, default 50) entries: pass
-     * `next` back as `after` for the next, until it is null.
+     * Offer freed time to the waitlist in join order: each waiting entry whose window is free (on its
+     * resource, or the first free pool member) gets a hold for its holder (`waitlist.offered`).
+     * Started windows expire (`waitlist.expired`); finished entries past retention are deleted. One
+     * tenant's offers run one at a time. Pages of `limit` (1-100, default 50): pass `next` back as
+     * `after` until null.
      */
     offerWaitlist(params: {
         tenantRef: string;
@@ -773,11 +1100,10 @@ export interface SlotlockStore extends SlotlockEventFeed {
         retentionDays?: number;
     }): Promise<BookingRetentionResult>;
     /**
-     * Suspend a tenant: from when this returns, every withTenant transaction for it (as every server
-     * runs its requests) may read, and its writes are refused (`tenant_suspended`); one in flight is
-     * waited for. Its keys still authenticate, but it gets no new key or secret. Maintenance and
-     * erasure go on. True when it was not suspended already. Only the deployment role, which owns the
-     * schema, may suspend (`tenant_suspension_not_permitted` for another).
+     * Suspend a tenant: from when this returns, its withTenant transactions may read but writes are
+     * refused (`tenant_suspended`); one in flight is waited for. Its keys still authenticate but it
+     * gets no new key. Maintenance and erasure go on. True when it was not suspended already.
+     * Deployment role only (`tenant_suspension_not_permitted`).
      */
     suspendTenant(params: {
         tenantRef: string;
@@ -797,11 +1123,9 @@ export interface SlotlockStore extends SlotlockEventFeed {
         tenantRef: string;
     }): Promise<boolean>;
     /**
-     * Erase a tenant: delete every row it owns (resources, holds, bookings, events with their
-     * attendees and reminders, cancellations, idempotency records, coverage, API keys, and a personal
-     * tenant's dashboard records) in one transaction, waiting for its transactions in flight. API key
-     * digests are retired so no erased key works again; a suspension stays. Erasing again deletes
-     * nothing.
+     * Erase a tenant: delete every row it owns in one transaction, waiting for its transactions in
+     * flight. API key digests are retired so no erased key works again; a suspension stays. Erasing
+     * again deletes nothing.
      */
     eraseTenant(params: {
         tenantRef: string;
@@ -817,12 +1141,11 @@ export interface SlotlockStore extends SlotlockEventFeed {
         coverageMaxAgeMs?: number;
     }): Promise<CalendarFreeBusy>;
     /**
-     * The first slot of `durationMs` inside the hours, whose time and turnaround buffer are free:
-     * getFreeBusy × expandRules (in the resource's stored timezone) → findNextAvailable. Null when no
-     * slot is free, and when one cannot be proven free: the coverage of the window (with the buffer's
-     * tail) is not complete, because a recurring series is not stored that far or a required provider
-     * calendar is not read that far. Another tenant's resource, an unknown id or one the store never
-     * issues is `resource_not_found`. A search window longer than 367 days is `invalid_window`.
+     * The first slot of `durationMs` inside the hours whose time and turnaround buffer are free
+     * (getFreeBusy × expandRules in the resource's timezone → findNextAvailable). Null when no slot
+     * is free or one cannot be proven free (coverage incomplete: a series not stored that far, or a
+     * required provider not read that far). Unknown or another tenant's resource is
+     * `resource_not_found`; a window over 367 days is `invalid_window`.
      */
     findNextAvailableFor(params: {
         /** The resource's tenant; `null` for a resource that has none (the legacy namespace). */
@@ -882,9 +1205,10 @@ export interface SlotlockWaitlistEntry {
 export type JoinWaitlistResult = {
     ok: true;
     entry: SlotlockWaitlistEntry;
+    replayed: boolean;
 } | {
     ok: false;
-    code: 'invalid_identity' | 'invalid_window' | 'invalid_ttl' | 'invalid_pool' | 'resource_not_found' | 'resource_archived' | 'pool_not_found' | 'waitlist_limit_reached';
+    code: 'invalid_identity' | 'invalid_window' | 'invalid_ttl' | 'invalid_pool' | 'resource_not_found' | 'resource_archived' | 'pool_not_found' | 'waitlist_limit_reached' | 'idempotency_conflict';
 };
 export type CheckInReservationResult = {
     ok: true;
@@ -926,20 +1250,16 @@ export interface SlotlockStoreOptions {
     /** Hard retained-command ceiling per non-internal owner. Defaults to 10,000; cannot be disabled. */
     agentOwnerCommandQuota?: number;
     /**
-     * What one tenant may store, for a database tenants share (none by default). A write that would
-     * pass a limit is refused with it (`*_limit_reached`); what the tenant has can still be revised
-     * (a move adds no booking or event, so it is not refused), cancelled and released. Counted under
-     * a lock per tenant and limit, so racing writers never pass it, in READ COMMITTED transactions
-     * only (`invalid_transaction_isolation` otherwise). Bookings and events count while they are still
-     * to come, and for 30 days after they were made, whatever time they hold; history older than that
-     * does not count, and a count stops reading at the limit.
+     * What one tenant may store, for a shared database (none by default). A write that would pass a
+     * limit is refused (`*_limit_reached`); existing rows can still be revised, cancelled and
+     * released. Counted under a per-tenant lock in READ COMMITTED transactions only. Bookings and
+     * events count while still to come and for 30 days after they were made.
      */
     tenantLimits?: SlotlockTenantLimits;
     /**
-     * How many withTenant transactions of one tenant run at once on this store (1-1,000; no limit by
-     * default). The rest wait in this process, in order, so one tenant's transactions waiting on its
-     * own locks hold at most this many of a pool's connections. Not counted inside a caller's
-     * transaction, which holds its connection already.
+     * How many withTenant transactions of one tenant run at once on this store (1-1,000; unlimited by
+     * default). The rest wait in order, so one tenant waiting on its own locks holds at most this
+     * many pool connections. Not counted inside a caller's transaction.
      */
     maxTenantTransactions?: number;
     /**
@@ -949,11 +1269,9 @@ export interface SlotlockStoreOptions {
      */
     tenantLockTimeoutMs?: number;
     /**
-     * How many days history is kept, 1-3,650 (default 30): the change feed (and how far back a cursor
-     * reaches) and waitlist entries that ended; and, when longer than 30 days, retired idempotency
-     * answers, booking references and past events' commands (never shorter, so a delayed retry is still
-     * answered as the first try was). Maintenance prunes what is older. A cursor before a change any
-     * store has pruned answers `cursor_expired`, so stores set differently never skip a change.
+     * Days history is kept, 1-3,650 (default 30): the change feed (and cursor reach) and ended
+     * waitlist entries; and, when longer than 30 days, retired idempotency answers, booking
+     * references and past events' commands. A cursor before a pruned change answers `cursor_expired`.
      */
     retentionDays?: number;
     /**
@@ -972,10 +1290,9 @@ export interface SlotlockTenantLimits {
     /** Resources, archived ones included; the lower of this and a call's `maxTenantResources`. */
     resources?: number;
     /**
-     * Holds on the tenant's resources, expired ones included until they are deleted. A keyed hold
-     * keeps its place until it would have expired, released or confirmed, while its answer is kept
-     * for retries. A hold at the limit first deletes the tenant's expired holds and forgets their
-     * answers, as maintenance does, so only live holds keep a new one out.
+     * Holds, expired ones included until deleted; a keyed hold keeps its place while its answer is
+     * kept. At the limit, expired holds and their answers are deleted first, so only live holds keep
+     * a new one out.
      */
     holds?: number;
     /**
@@ -984,9 +1301,9 @@ export interface SlotlockTenantLimits {
      */
     reservations?: number;
     /**
-     * Calendar events of every owner still to come (a series until it is known to have ended) or made
-     * in the last 30 days, cancellations of every owner made in the last 30 days, and agent-owned
-     * cancellations until maintenance prunes them. Each event stores at most 2,000 occurrences.
+     * Events of every owner still to come (a series until known to have ended) or made in the last 30
+     * days, cancellations made in the last 30 days, and agent cancellations until pruned. Each event
+     * stores at most 2,000 occurrences.
      */
     events?: number;
     /** Provider coverage rows: one per resource and source. */
@@ -1006,4 +1323,4 @@ export declare function createSlotlockStore(sql: StoreSql, options?: SlotlockSto
  * Every store method that writes for a tenant: what a suspended tenant's withTenant store refuses.
  * Maintenance (rolling series, pruning, purging) and erasure are not among them.
  */
-export declare const SLOTLOCK_TENANT_WRITE_METHODS: readonly ["createResource", "archiveResource", "restoreResource", "deleteResource", "setResourceAvailability", "setResourceBookingRules", "setBookingRuleDefaults", "setResourcePool", "setTenantAvailability", "createReservation", "createExternalReservation", "rescheduleExternalReservation", "cancelExternalReservation", "acquireHold", "confirmHold", "releaseHold", "putCalendarEvent", "cancelCalendarEvent", "cancelCalendarEventById", "recordCalendarCoverage", "createWebhookEndpoint", "deleteWebhookEndpoint", "enableWebhookEndpoint", "recordCoverageFailure", "deleteCoverage", "checkInReservation", "joinWaitlist", "leaveWaitlist", "putAssistantSettings", "deleteAssistantSettings", "putAssistantConversation", "settleAssistantAction", "deleteAssistantConversation"];
+export declare const SLOTLOCK_TENANT_WRITE_METHODS: readonly ["createResource", "updateResourceProfile", "putLocation", "updateLocation", "deleteLocation", "putGroup", "deleteGroup", "addGroupMember", "removeGroupMember", "archiveResource", "restoreResource", "deleteResource", "setResourceAvailability", "setResourceBookingRules", "setBookingRuleDefaults", "setResourcePool", "setResourceParent", "setPoolOrder", "notePoolBooking", "putApprovalPolicy", "deleteApprovalPolicy", "requestApproval", "beginApprovalGrant", "finishApprovalGrant", "declineApproval", "resetTestTenant", "fastForwardTestTenant", "setTenantAvailability", "createReservation", "createExternalReservation", "rescheduleExternalReservation", "cancelExternalReservation", "acquireHold", "confirmHold", "releaseHold", "putCalendarEvent", "cancelCalendarEvent", "cancelCalendarEventById", "recordCalendarCoverage", "createWebhookEndpoint", "deleteWebhookEndpoint", "enableWebhookEndpoint", "recordCoverageFailure", "deleteCoverage", "checkInReservation", "joinWaitlist", "leaveWaitlist", "putAssistantSettings", "deleteAssistantSettings", "resealAssistantKey", "putAssistantConversation", "settleAssistantAction", "deleteAssistantConversation"];