slotlock 0.6.2 → 0.7.0

package/agent-store-backend.js

@@ -1,6 +1,9 @@
+import { SLOTLOCK_RESOURCE_PROFILE_FIELDS, SLOTLOCK_RECONCILE_TOLERANCE_PERCENT, slotlockResourceHasLabels, } from './resource-profile.js';
+import { SLOTLOCK_USAGE_RETENTION_DAYS, slotlockUsageDay, slotlockUsageMonthToDate, slotlockUsageSpanDays, summarizeSlotlockUsage, } from './usage.js';
 import { slotlockChangeFeedHead } from './event-feed.js';
 import { slotlockCloudEvent } from './webhooks.js';
 import { createHash } from 'node:crypto';
+import { SLOTLOCK_DEFAULT_APPROVAL_MINUTES, SLOTLOCK_KEY_APPROVAL_POLICY, SLOTLOCK_MAX_APPROVAL_MINUTES, SlotlockApprovalPolicyError, } from './approvals.js';
 import { SlotlockAgentOperationError, } from './agent-server.js';
 import { bookingSearch, bookingSearchBlocked, bookingSearchReach, } from './booking-rules.js';
 import { findNextAvailable, mergeIntervals } from './engine.js';
@@ -8,15 +11,42 @@ import { expandRules } from './rules.js';
 import { emitVAvailability, parseVAvailability, toJSCalendarEvent } from './interop.js';
 import { calendarEventRollingHorizon, } from './store.js';
 import { maintainSlotlockTenant } from './maintenance.js';
+import { fastForwardSlotlockSandbox, raceSlotlockSandbox, resetSlotlockSandbox, seedSlotlockSandbox, } from './sandbox.js';
+import { SLOTLOCK_TEST_TENANT_SUFFIX } from './api-keys.js';
+import { slotlockPartnerKeyOutput, slotlockPrincipalPartner, } from './partners.js';
+/** A partner's account as the partner API shows it. */
+function partnerAccountOutput(account) {
+    return {
+        account: account.account,
+        plan: account.plan,
+        status: account.status,
+        created_at: account.createdAt.toISOString(),
+        updated_at: account.updatedAt.toISOString(),
+        ...(account.resources !== undefined ? { resources: account.resources } : {}),
+        ...(account.apiKeys !== undefined ? { api_keys: account.apiKeys } : {}),
+    };
+}
 import { parseAvailabilityRules } from './weekly-hours.js';
 /**
- * A write runs under READ COMMITTED whatever the role's default: a store given tenant limits (as
- * `slotlock serve`'s is) counts it against them under the tenant's lock, which needs that level,
- * and refuses it otherwise.
+ * Writes run under READ COMMITTED whatever the role's default: tenant limits are counted under a
+ * lock that needs that level.
  */
 const WRITE = { isolation: 'read committed' };
-// The UUIDs withTenant takes as a keyId (versions 1-5, as Slotlock's keys are): any other a custom
-// authenticator's principal carries is left out, not refused.
+/**
+ * Keys a context carries only from inside this module: a request cannot set a symbol, and spreading
+ * a context (`{ ...context, operation }`) keeps them.
+ */
+const APPROVAL_GRANT = Symbol('slotlock.approvalGrant');
+const OCCUPANCY_PROBE = Symbol('slotlock.occupancyProbe');
+/** Thrown out of a dry run's transaction, with its answer, so the transaction rolls back. */
+class DryRunRollback {
+    value;
+    constructor(value) {
+        this.value = value;
+    }
+}
+// The UUIDs withTenant takes as a keyId (versions 1-5); any other from a custom authenticator is
+// left out, not refused.
 const KEY_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 /** Who a call's changes are recorded as in the history: the principal's subject, kept short. */
 function actorOf(context) {
@@ -36,16 +66,51 @@ async function withTenant(store, context, callback, options) {
     try {
         const actor = actorOf(context);
         const keyId = context.principal.keyId;
-        value = await store.withTenant(context.principal.tenantRef, callback, {
+        // A granted approval's write: its holds give way and it is marked granted in the same
+        // transaction, so the time passes from the approval to the booking with no gap between.
+        const grant = context[APPROVAL_GRANT];
+        const write = grant
+            ? async (tenantStore) => {
+                const tenantRef = context.principal.tenantRef;
+                const begun = await tenantStore.beginApprovalGrant({ tenantRef, id: grant.id });
+                if (!begun.ok) {
+                    throw new SlotlockAgentOperationError(begun.code, begun.code === 'approval_not_found' ? 404 : 409);
+                }
+                const value = await callback(tenantStore);
+                const booked = value.event?.resource_id;
+                if (grant.pool !== undefined && typeof booked === 'string') {
+                    await tenantStore.notePoolBooking({ tenantRef, pool: grant.pool, resourceId: booked });
+                }
+                await tenantStore.finishApprovalGrant({ tenantRef, id: grant.id, decidedBy: grant.decidedBy });
+                return value;
+            }
+            : callback;
+        // A dry run's transaction does everything, constraints included, then is undone: its answer
+        // is carried out of it by the rollback.
+        const probe = context[OCCUPANCY_PROBE];
+        const run = context.dryRun
+            ? async (tenantStore) => {
+                const value = await write(tenantStore);
+                if (probe)
+                    await probe(tenantStore);
+                throw new DryRunRollback(value);
+            }
+            : write;
+        value = await store.withTenant(context.principal.tenantRef, run, {
             ...options,
             signal: context.signal,
             ...(actor !== undefined ? { actor } : {}),
             ...(context.origin !== undefined ? { origin: context.origin } : {}),
-            // An authenticator's own principal may carry something else there: then it is left out.
             ...(typeof keyId === 'string' && KEY_ID.test(keyId) ? { keyId } : {}),
+            // A key limited to part of the tenant reaches only its resources, by the database's policies.
+            ...(context.principal.resourceScope ? { resourceScope: context.principal.resourceScope } : {}),
         });
     }
     catch (error) {
+        if (error instanceof DryRunRollback) {
+            assertActive(context);
+            return error.value;
+        }
         const code = error?.code;
         // A suspended tenant may read; a write it asks for is forbidden, not a server failure.
         if (code === 'tenant_suspended')
@@ -60,22 +125,18 @@ async function withTenant(store, context, callback, options) {
     return value;
 }
 /**
- * Busy intervals one free/busy read or search may gather across all the resources it names: as many
- * as the store reads for one resource. Without it, a request naming 100 resources at that limit, or
- * one resource 100 times, did 100 times the work of one.
+ * Busy intervals one free/busy read or search may gather across all its resources: as many as the
+ * store reads for one, so naming many resources cannot multiply the work.
  */
 const MAX_REQUEST_BUSY_INTERVALS = 10_000;
 /**
- * Bookable windows one search may expand from its resources' availability rules in all: five
- * resources of 50 daily rules over a year, or a hundred of two. Without it, a search of 100 such
- * resources over a year expanded 1.8 million windows and held the process for seven seconds.
+ * Bookable windows one search may expand from its resources' rules in all (five resources of 50
+ * daily rules over a year, or a hundred of two), so a broad search cannot hold the process.
  */
 const MAX_REQUEST_RULE_WINDOWS = 100_000;
-/** The resources a request names, each once, in the order first named. */
 function distinctResourceIds(input) {
     return [...new Set(input.resource_ids)];
 }
-/** Counts a request's busy intervals against MAX_REQUEST_BUSY_INTERVALS, refusing past it. */
 function busyBudget() {
     let left = MAX_REQUEST_BUSY_INTERVALS;
     return (intervals) => {
@@ -169,12 +230,12 @@ function agentOwnerRef(context) {
         .digest('hex')}`;
 }
 function agentExternalRef(context, idempotencyKey) {
-    // This format is already a stable client-visible identity; keep it unchanged.
+    // Already a stable client-visible identity; keep it unchanged.
     return `agent:${agentPrincipalDigest(context, idempotencyKey)}`;
 }
 function agentCommandIdempotencyKey(context, idempotencyKey) {
-    // Keep the principal in the digest too so this remains safe with older tenant-only stores.
-    // Hashing keeps the authenticated subject and caller's raw retry key out of durable command rows.
+    // The principal stays in the digest so this remains safe with older tenant-only stores; hashing
+    // keeps the subject and raw retry key out of durable rows.
     return `agent-command:${agentPrincipalDigest(context, idempotencyKey)}`;
 }
 function attendeeProjection(attendee) {
@@ -192,8 +253,8 @@ function attendeeProjection(attendee) {
  */
 export function projectSlotlockCalendarEvent(event) {
     return {
-        // External references are the stable tenant-visible identity. Internal UUIDs never become an
-        // unscoped lookup capability at the protocol boundary.
+        // External references are the tenant-visible identity: internal UUIDs never become an unscoped
+        // lookup at the protocol boundary.
         id: event.externalRef,
         resource_id: event.resourceId,
         starts_at: event.start.toISOString(),
@@ -246,20 +307,41 @@ const BOOKING_RULE_CODES = Object.freeze({
     outside_hours: 'booking_rule_outside_hours',
     uncertain: 'booking_rule_uncertain',
 });
-function operationError(refusal) {
-    // A broken booking rule is named in the code, which is all an agent's error carries.
+function operationError(refusal, details) {
     const code = typeof refusal === 'string'
         ? refusal
         : refusal.code === 'booking_rule_violated' && refusal.rule
             ? (BOOKING_RULE_CODES[refusal.rule] ?? refusal.code)
             : refusal.code;
     const status = slotlockAgentErrorStatus(code);
-    // A gone hold is named, so the agent holds again; it covers expired and another holder's alike.
-    return new SlotlockAgentOperationError(status === 404 && code !== 'hold_not_found' ? 'not_found' : code, status);
+    // A gone hold (another holder's, released or reaped) is named, so the agent holds again.
+    return new SlotlockAgentOperationError(status === 404 && code !== 'hold_not_found' ? 'not_found' : code, status, details);
+}
+/**
+ * What an agent may be told about the booking in the way of its write: when that time is busy
+ * (as free/busy shows anyone who may read the resource), and the booking itself only when it is
+ * the agent's own hold or event, so it can release or move it. Nothing for another refusal, or for
+ * a booking the key may not see (its scope, or another tenant's).
+ */
+async function overlapDetails(tenantStore, context, refusal) {
+    if (refusal.code !== 'overlap' || typeof refusal.conflictingReservationId !== 'string')
+        return {};
+    const booking = await tenantStore.describeBooking({
+        tenantRef: context.principal.tenantRef,
+        id: refusal.conflictingReservationId,
+    });
+    if (!booking)
+        return {};
+    const owner = agentOwnerRef(context);
+    return {
+        busy_start: booking.start.toISOString(),
+        busy_end: booking.end.toISOString(),
+        ...(booking.status === 'held' && booking.holderRef === owner ? { conflicting_hold_id: booking.id } : {}),
+        ...(booking.eventRef !== null && booking.eventOwnerRef === owner ? { conflicting_event_id: booking.eventRef } : {}),
+    };
 }
 /** Resource and event ids: the UUIDs the store issues and validates. */
 const STORE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-/** A resource page's cursor is the last resource id of the previous page. */
 function parseResourceCursor(value) {
     if (value === undefined)
         return undefined;
@@ -299,12 +381,10 @@ function page(rows, limit) {
     return { shown, next: rows.length > limit && last ? encodeEventCursor(last) : null };
 }
 /**
- * The caller's resource with this id, or `resource_not_found`. The tools accept any id an agent may
- * send (an external reference such as `vehicle-42`, the nil UUID, a version 7 UUID). The store
- * issues version 4 UUIDs (gen_random_uuid) and refuses an id that is not a version 1 to 5 UUID as an
- * invalid identity, so such an id names no resource: it is not found, like a well-formed id that
- * names nothing or another tenant's resource. With `visibility`, a resource of the other is not
- * found either: agents ask for `shared`, so a private resource is invisible to them.
+ * The caller's resource with this id, or `resource_not_found`. Agents may send any id; one that is
+ * not a store-issued (v1-5) UUID names no resource and is not found, like another tenant's. With
+ * `visibility`, a resource of the other visibility is not found either, so private ones are
+ * invisible to agents.
  */
 async function requireResource(tenantStore, tenantRef, resourceId, visibility) {
     if (!STORE_ID_PATTERN.test(resourceId)) {
@@ -325,9 +405,8 @@ function requireAgentResource(tenantStore, tenantRef, resourceId) {
 }
 /**
  * The store's change feed for live updates (`subscriptions.changes`): each tenant's changes read
- * under its row-level security, one indexed query per read. Readers poll it (change-watch.ts:
- * every `SLOTLOCK_FEED_BUSY_MS` after a read that found changes, backing off to
- * `SLOTLOCK_FEED_IDLE_MS`); `sql` is the store's client, used for the feed's head.
+ * under its RLS, one indexed query per read. Readers poll it (change-watch.ts); `sql` is the
+ * store's client, used for the feed's head.
  */
 export function createSlotlockStoreChangeSource(store, sql) {
     return {
@@ -340,11 +419,22 @@ export function createSlotlockStoreChangeSource(store, sql) {
 }
 /** Bind the protocol server to the production store without giving a request control of tenancy. */
 export function createSlotlockStoreAgentBackend(store, options) {
-    return {
+    const maxApprovalMinutes = options.maxApprovalMinutes ?? SLOTLOCK_MAX_APPROVAL_MINUTES;
+    if (!(Number.isSafeInteger(maxApprovalMinutes) && maxApprovalMinutes >= 1 && maxApprovalMinutes <= SLOTLOCK_MAX_APPROVAL_MINUTES)) {
+        throw new RangeError(`maxApprovalMinutes must be a whole number from 1 to ${SLOTLOCK_MAX_APPROVAL_MINUTES}`);
+    }
+    const backend = {
         async holdSlots(context, input) {
             const slots = input.slots;
             const key = input.idempotency_key;
             const holderRef = agentOwnerRef(context);
+            const limits = context.principal.limits;
+            const holderCaps = limits?.maxHolds !== undefined || limits?.maxHeldHours !== undefined
+                ? {
+                    ...(limits.maxHolds !== undefined ? { maxHolds: limits.maxHolds } : {}),
+                    ...(limits.maxHeldHours !== undefined ? { maxHeldHours: limits.maxHeldHours } : {}),
+                }
+                : undefined;
             // One group per agent and key, so a retry answers with the same holds and group.
             const groupId = uuidFromDigest(`slotlock-hold-group\0${holderRef}\0${key}`);
             return withTenant(store, context, async (tenantStore) => {
@@ -371,6 +461,8 @@ export function createSlotlockStoreAgentBackend(store, options) {
                         end: new Date(slot.end),
                         ttlMs: input.ttl_seconds * 1_000,
                         source: 'agent-server',
+                        // The key's own caps, below the server's (RFC 0004 A5).
+                        ...(holderCaps ? { holderCaps } : {}),
                     });
                     if (result.ok) {
                         holds.push({
@@ -430,15 +522,24 @@ export function createSlotlockStoreAgentBackend(store, options) {
                         throw operationError(replay);
                     return answer(replay);
                 }
-                const members = await tenantStore.listPoolMembers({ tenantRef, pool: input.pool, visibility: 'shared' });
+                // In the pool's order (stable, least booked first, or round robin).
+                const members = await tenantStore.listPoolMembers({
+                    tenantRef,
+                    pool: input.pool,
+                    visibility: 'shared',
+                    ordered: true,
+                    forBooking: true,
+                });
                 if (members.length === 0)
                     throw new SlotlockAgentOperationError('pool_not_found', 404);
-                // Each member in turn, each try its own savepoint: a member that is taken or that the
-                // booking's rules refuse is passed over; the exclusion constraint still decides each one.
+                // Each member in turn, each in its own savepoint: one taken or refused by its rules is
+                // passed over; the exclusion constraint still decides.
                 for (const member of members) {
                     const result = await put(member.id);
-                    if (result.ok)
+                    if (result.ok) {
+                        await tenantStore.notePoolBooking({ tenantRef, pool: input.pool, resourceId: member.id });
                         return answer(result);
+                    }
                     if (result.code !== 'overlap' && result.code !== 'booking_rule_violated') {
                         throw operationError(result);
                     }
@@ -457,7 +558,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
                 const members = await tenantStore.listPoolMembers({ tenantRef, pool, visibility: 'shared' });
                 if (members.length === 0)
                     throw new SlotlockAgentOperationError('pool_not_found', 404);
-                // Each member's busy time, as edges: a count of busy members that rises and falls.
+                // Busy time as edges: a count of busy members that rises and falls.
                 const edges = new Map([
                     [window.start.getTime(), 0],
                     [window.end.getTime(), 0],
@@ -477,9 +578,9 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     charge(freeBusy.busy.length);
                     if (freeBusy.coverage.state !== 'complete')
                         complete = false;
-                    // Not free either where its booking rules refuse a booking: before its notice, past how
-                    // far ahead it books, and, when it enforces them, outside its bookable hours. Its slot
-                    // step is not counted: it moves when a booking may start, not whether the member is free.
+                    // Also not free where its booking rules refuse a booking (notice, advance, enforced
+                    // hours). Its slot step is not counted: it moves when a booking may start, not whether
+                    // the member is free.
                     const rules = member.effectiveBookingRules;
                     const search = bookingSearch({ rules, timezone: member.timezone, window, now });
                     const latestStart = rules?.maxAdvanceDays !== undefined
@@ -524,7 +625,6 @@ export function createSlotlockStoreAgentBackend(store, options) {
                         break;
                     const free = members.length - busy;
                     const last = intervals.at(-1);
-                    // Parts with the same count are one.
                     if (last && last.free === free)
                         last.end = new Date(next).toISOString();
                     else
@@ -540,8 +640,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
         },
         async bookTogether(context, rawInput) {
             const input = rawInput;
-            // In one order for every bundle, so two over the same resources wait on each other in turn
-            // and never deadlock.
+            // Sorted, so bundles over the same resources lock in one order and never deadlock.
             const resourceIds = [...new Set(input.resource_ids)].sort();
             if (resourceIds.length < 2)
                 throw new SlotlockAgentOperationError('invalid_arguments', 400);
@@ -582,10 +681,13 @@ export function createSlotlockStoreAgentBackend(store, options) {
                         materializationWindow: materializationWindow(content),
                         enforceBookingRules: true,
                     });
-                    // Thrown, so the whole transaction rolls back: the events already put go with it.
+                    // Thrown, so the whole transaction rolls back with the events already put.
                     if (!result.ok) {
                         const refusal = operationError(result);
-                        throw new SlotlockAgentOperationError(refusal.code, refusal.status, { resource_id: resourceId });
+                        throw new SlotlockAgentOperationError(refusal.code, refusal.status, {
+                            resource_id: resourceId,
+                            ...(await overlapDetails(tenantStore, context, result)),
+                        });
                     }
                     const created = await tenantStore.getCalendarEvent({
                         tenantRef: context.principal.tenantRef,
@@ -600,6 +702,61 @@ export function createSlotlockStoreAgentBackend(store, options) {
                 return { events, replayed };
             }, WRITE);
         },
+        async confirmHold(context, rawInput) {
+            const input = rawInput;
+            // The holder's own hold, lapsed or live, and its resource's zone; then the booking exactly
+            // as create_event with its hold_id makes it, which judges the hold again under its lock.
+            const found = await withTenant(store, context, async (tenantStore) => {
+                const held = await tenantStore.getHolderHold({
+                    tenantRef: context.principal.tenantRef,
+                    holdId: input.hold_id,
+                    holderRef: agentOwnerRef(context),
+                });
+                if (!held)
+                    return null;
+                const resource = await requireAgentResource(tenantStore, context.principal.tenantRef, held.hold.resourceId);
+                return { ...held, timezone: resource.timezone };
+            });
+            if (!found) {
+                // Booked already: a retry answers the event this key made (the store compares the
+                // request, so another one with the same key is idempotency_conflict).
+                const booked = await withTenant(store, context, (tenantStore) => tenantStore.getCalendarEvent({
+                    tenantRef: context.principal.tenantRef,
+                    ownerRef: agentOwnerRef(context),
+                    externalRef: agentExternalRef(context, input.idempotency_key),
+                }));
+                if (!booked)
+                    throw new SlotlockAgentOperationError('hold_not_found', 404);
+                return this.createEvent({ ...context, operation: 'slotlock_create_event' }, {
+                    resource_id: booked.resourceId,
+                    starts_at: booked.start.toISOString(),
+                    ends_at: booked.end.toISOString(),
+                    timezone: input.timezone ?? booked.timezone,
+                    ...(input.title !== undefined ? { title: input.title } : {}),
+                    ...(input.description !== undefined ? { description: input.description } : {}),
+                    ...(input.location !== undefined ? { location: input.location } : {}),
+                    transparency: 'opaque',
+                    status: 'confirmed',
+                    hold_id: input.hold_id,
+                    idempotency_key: input.idempotency_key,
+                });
+            }
+            if (!found.live)
+                throw new SlotlockAgentOperationError('hold_expired', 409);
+            return this.createEvent({ ...context, operation: 'slotlock_create_event' }, {
+                resource_id: found.hold.resourceId,
+                starts_at: found.hold.start.toISOString(),
+                ends_at: found.hold.end.toISOString(),
+                timezone: input.timezone ?? found.timezone,
+                ...(input.title !== undefined ? { title: input.title } : {}),
+                ...(input.description !== undefined ? { description: input.description } : {}),
+                ...(input.location !== undefined ? { location: input.location } : {}),
+                transparency: 'opaque',
+                status: 'confirmed',
+                hold_id: input.hold_id,
+                idempotency_key: input.idempotency_key,
+            });
+        },
         async releaseSlots(context, input) {
             const id = input.hold_id;
             if (!STORE_ID_PATTERN.test(id))
@@ -609,7 +766,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
                 holderRef: agentOwnerRef(context),
             }).then(({ released }) => ({ released })));
             if (result.released)
-                await offerFreedTime(store, context.principal.tenantRef);
+                await offerFreedTime(store, context);
             return result;
         },
         async describeResource(context, resourceId) {
@@ -621,29 +778,87 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     id: resourceId,
                     visibility: 'shared',
                 });
+                // Its profile's name when it has one, as a person reading a confirmation knows it.
                 return resource
-                    ? { name: resource.externalRef ?? null, timezone: resource.timezone }
+                    ? { name: resource.name ?? resource.externalRef ?? null, timezone: resource.timezone }
                     : null;
             });
         },
+        async selectResources(context, selection) {
+            return withTenant(store, context, async (tenantStore) => {
+                let resources;
+                try {
+                    // Shared and in use, as an agent may search them, in the store's stable order.
+                    resources = await tenantStore.listResources({
+                        tenantRef: context.principal.tenantRef,
+                        visibility: 'shared',
+                        limit: selection.limit + 1,
+                        ...(selection.kind !== undefined ? { kind: selection.kind } : {}),
+                        ...(selection.labels !== undefined ? { labels: selection.labels } : {}),
+                        ...(selection.location !== undefined ? { location: selection.location } : {}),
+                        ...(selection.group !== undefined ? { group: selection.group } : {}),
+                        ...(selection.pool !== undefined ? { pool: selection.pool } : {}),
+                    });
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+                if (resources.length > selection.limit) {
+                    throw new SlotlockAgentOperationError('selection_too_large', 400, { limit: String(selection.limit) });
+                }
+                return resources.map((resource) => resource.id);
+            });
+        },
         async listResources(context, input) {
             const cursor = parseResourceCursor(input.cursor);
+            const kind = input.kind;
+            const labels = input.labels;
+            const location = input.location;
+            const group = input.group;
+            // What a resource says about itself, for an agent to show and choose by; its attributes are
+            // the integrator's, and stay on the application API.
             const output = (resource) => ({
                 id: resource.id,
                 external_ref: resource.externalRef,
                 timezone: resource.timezone,
                 ...(resource.pool !== undefined ? { pool: resource.pool } : {}),
+                ...(resource.name !== undefined ? { name: resource.name } : {}),
+                ...(resource.description !== undefined
+                    ? {
+                        description: [...resource.description].length > 500
+                            ? `${[...resource.description].slice(0, 500).join('')}…`
+                            : resource.description,
+                    }
+                    : {}),
+                ...(resource.kind !== undefined ? { kind: resource.kind } : {}),
+                ...(resource.capacity !== undefined ? { capacity: resource.capacity } : {}),
+                ...(resource.labels !== undefined ? { labels: resource.labels } : {}),
+                ...(resource.location !== undefined
+                    ? { location: { ref: resource.location, name: resource.locationName ?? resource.location } }
+                    : {}),
+                ...(resource.groups !== undefined ? { groups: resource.groups } : {}),
+                ...(resource.parentId !== undefined ? { part_of: resource.parentId } : {}),
             });
             if (typeof input.pool === 'string') {
-                // A pool's members, in the order a pool booking tries them; at most 100, one page.
-                return withTenant(store, context, async (tenantStore) => ({
-                    resources: (await tenantStore.listPoolMembers({
-                        tenantRef: context.principal.tenantRef,
-                        pool: input.pool,
-                        visibility: 'shared',
-                    })).map(output),
-                    next_cursor: null,
-                }));
+                return withTenant(store, context, async (tenantStore) => {
+                    // A pool's members are filtered here: a location filter takes the locations under it.
+                    const places = location === undefined
+                        ? null
+                        : locationAndBelow(await tenantStore.listLocations({ tenantRef: context.principal.tenantRef }), location);
+                    return {
+                        resources: (await tenantStore.listPoolMembers({
+                            tenantRef: context.principal.tenantRef,
+                            pool: input.pool,
+                            visibility: 'shared',
+                        }))
+                            .filter((resource) => (kind === undefined || (resource.kind ?? 'other') === kind) &&
+                            (labels === undefined || slotlockResourceHasLabels(resource.labels, labels)) &&
+                            (places === null || (resource.location !== undefined && places.has(resource.location))) &&
+                            (group === undefined || resource.groups?.includes(group) === true))
+                            .map(output),
+                        next_cursor: null,
+                    };
+                });
             }
             return withTenant(store, context, async (tenantStore) => {
                 const limit = input.limit;
@@ -652,6 +867,10 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     visibility: 'shared',
                     limit: limit + 1,
                     ...(cursor !== undefined ? { after: cursor } : {}),
+                    ...(kind !== undefined ? { kind } : {}),
+                    ...(labels !== undefined ? { labels } : {}),
+                    ...(location !== undefined ? { location } : {}),
+                    ...(group !== undefined ? { group } : {}),
                 });
                 const page = resources.slice(0, limit);
                 return {
@@ -691,6 +910,53 @@ export function createSlotlockStoreAgentBackend(store, options) {
                 return { resources };
             });
         },
+        async findNextSlots(context, input) {
+            const window = interval(input);
+            const durationMs = input.duration_minutes * 60_000;
+            const charge = busyBudget();
+            return withTenant(store, context, async (tenantStore) => {
+                const resource = await requireAgentResource(tenantStore, context.principal.tenantRef, input.resource_id);
+                const search = bookingSearch({
+                    rules: resource.effectiveBookingRules,
+                    timezone: resource.timezone,
+                    window,
+                    now: new Date(),
+                });
+                const sources = await requiredSources(options, context, resource);
+                const freeBusy = await readFreeBusy(tenantStore, {
+                    tenantRef: context.principal.tenantRef,
+                    resourceId: input.resource_id,
+                    window: search ? bookingSearchReach({ ...search, window }) : window,
+                    requiredSources: [...sources],
+                    ...(options.coverageMaxAgeMs !== undefined ? { coverageMaxAgeMs: options.coverageMaxAgeMs } : {}),
+                });
+                charge(freeBusy.busy.length);
+                if (freeBusy.coverage.state !== 'complete')
+                    return { slots: [], certain: false };
+                if (!search)
+                    return { slots: [], certain: true };
+                const rules = resource.availabilityRules ?? (await options.availabilityRules(context, resource));
+                const windows = expandRules(rules, search.window, resource.timezone);
+                if (windows.length > MAX_REQUEST_RULE_WINDOWS)
+                    throw new SlotlockAgentOperationError('calendar_work_limit', 400);
+                const busy = bookingSearchBlocked(freeBusy.busy, search);
+                // Each next slot as a search from where the last one ended would find it: the same busy
+                // time and hours, with the hours before that end left out.
+                const slots = [];
+                let from = search.window.start.getTime();
+                while (slots.length < input.limit) {
+                    const open = windows
+                        .map((hours) => ({ start: new Date(Math.max(hours.start.getTime(), from)), end: hours.end }))
+                        .filter((hours) => hours.end.getTime() - hours.start.getTime() >= durationMs);
+                    const found = findNextAvailable({ busy, windows: open, durationMs, ...(search.align ? { align: search.align } : {}) });
+                    if (!found)
+                        break;
+                    slots.push({ start: found.start.toISOString(), end: found.end.toISOString() });
+                    from = found.end.getTime();
+                }
+                return { slots, certain: true };
+            });
+        },
         async findNextAvailable(context, input) {
             const window = interval(input);
             const resourceIds = distinctResourceIds(input);
@@ -702,8 +968,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
                 let incomplete = false;
                 for (const resourceId of resourceIds) {
                     const resource = await requireAgentResource(tenantStore, context.principal.tenantRef, resourceId);
-                    // Only what a booking made now may take: the resource's booking rules bound the search,
-                    // as they bound the write that follows it.
+                    // The resource's booking rules bound the search, as they bound the write that follows.
                     const search = bookingSearch({
                         rules: resource.effectiveBookingRules,
                         timezone: resource.timezone,
@@ -747,8 +1012,8 @@ export function createSlotlockStoreAgentBackend(store, options) {
                         best = { resourceId, interval: candidate };
                     }
                 }
-                // A cross-resource answer is only certain when every requested resource is certain. A slot
-                // from one healthy calendar must not mask a stale provider or recurrence horizon on another.
+                // A cross-resource answer is only certain when every resource is: one healthy calendar must
+                // not mask a stale one.
                 const complete = !incomplete;
                 const certainBest = complete ? best : null;
                 return {
@@ -803,7 +1068,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
                         : {}),
                 });
                 if (!result.ok)
-                    throw operationError(result);
+                    throw operationError(result, await overlapDetails(tenantStore, context, result));
                 const created = await tenantStore.getCalendarEvent({
                     tenantRef: context.principal.tenantRef,
                     ownerRef: agentOwnerRef(context),
@@ -855,7 +1120,6 @@ export function createSlotlockStoreAgentBackend(store, options) {
         },
         async updateEvent(context, rawInput) {
             const input = rawInput;
-            // No event is on a resource the store never issued (an external reference, say).
             if (input.expected_resource_id !== undefined &&
                 !STORE_ID_PATTERN.test(input.expected_resource_id)) {
                 throw new SlotlockAgentOperationError('event_not_found', 404);
@@ -929,8 +1193,8 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     tenantRef: context.principal.tenantRef,
                     ownerRef: agentOwnerRef(context),
                     externalRef: current.externalRef,
-                    // The caller's fence when it sent one, checked under the event's lock; otherwise the
-                    // resource just read, so a move between that read and the write is not overwritten.
+                    // The caller's fence when sent, checked under the event's lock; otherwise the resource
+                    // just read, so a move in between is not overwritten.
                     expectedResourceId: input.expected_resource_id ?? current.resourceId,
                     resourceId,
                     expectedRevision: input.expected_revision,
@@ -942,7 +1206,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     enforceBookingRules: true,
                 });
                 if (!result.ok)
-                    throw operationError(result);
+                    throw operationError(result, await overlapDetails(tenantStore, context, result));
                 const updated = await tenantStore.getCalendarEvent({
                     tenantRef: context.principal.tenantRef,
                     ownerRef: agentOwnerRef(context),
@@ -952,9 +1216,8 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     throw new SlotlockAgentOperationError('store_inconsistent', 503);
                 return { event: projectSlotlockCalendarEvent(updated), replayed: result.idempotent };
             }, WRITE);
-            // A moved or shortened event may have freed the time it held.
             if (!moved.replayed)
-                await offerFreedTime(store, context.principal.tenantRef);
+                await offerFreedTime(store, context);
             return moved;
         },
         async deleteEvent(context, input) {
@@ -965,13 +1228,13 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     ownerRef: agentOwnerRef(context),
                     externalRef,
                 });
-                if (!current)
-                    throw new SlotlockAgentOperationError('event_not_found', 404);
+                // Gone already: a retry of a cancellation that succeeded, answered from its key, or
+                // event_not_found from the store when there was none.
                 const result = await tenantStore.cancelCalendarEvent({
                     tenantRef: context.principal.tenantRef,
                     ownerRef: agentOwnerRef(context),
                     externalRef,
-                    expectedResourceId: current.resourceId,
+                    ...(current ? { expectedResourceId: current.resourceId } : {}),
                     idempotencyKey: agentCommandIdempotencyKey(context, input.idempotency_key),
                     expectedRevision: input.expected_revision,
                 });
@@ -985,19 +1248,39 @@ export function createSlotlockStoreAgentBackend(store, options) {
                 };
             }, WRITE);
             if (!deleted.replayed)
-                await offerFreedTime(store, context.principal.tenantRef);
+                await offerFreedTime(store, context);
             return deleted;
         },
     };
+    return withApprovalPolicies(store, options, maxApprovalMinutes, backend);
 }
-/** A store failure thrown with a `code` the caller may see, or the error itself to report. */
 function storeRefusal(error) {
     const code = error?.code;
     if (typeof code !== 'string')
         return error;
+    if (code === 'invalid_resource_profile' || code === 'invalid_location' || code === 'invalid_group') {
+        // Which field, so a client can say what to change.
+        const field = error.field;
+        return new SlotlockAgentOperationError(code, 400, typeof field === 'string' ? { field } : undefined);
+    }
+    if (code === 'location_not_found' || code === 'group_not_found' || code === 'resource_not_found' || code === 'parent_not_found') {
+        return new SlotlockAgentOperationError(code, 404);
+    }
+    if (code === 'location_in_use' ||
+        code === 'location_too_deep' ||
+        code === 'location_cycle' ||
+        code === 'location_limit_reached' ||
+        code === 'group_limit_reached' ||
+        code === 'resource_group_limit_reached') {
+        return new SlotlockAgentOperationError(code, 409);
+    }
     if (code === 'resource_limit_reached' ||
         code === 'resource_visibility_conflict' ||
-        code === 'pool_rules_limit_reached') {
+        code === 'pool_rules_limit_reached' ||
+        code === 'pool_order_limit_reached' ||
+        code === 'composite_too_deep' ||
+        code === 'composite_parts_limit' ||
+        code === 'composite_busy') {
         return new SlotlockAgentOperationError(code, 409);
     }
     if (code.startsWith('invalid_') && code !== 'invalid_transaction_isolation') {
@@ -1005,7 +1288,88 @@ function storeRefusal(error) {
     }
     return error;
 }
-/** The status an application refusal answers with; the resource of another tenant is not found. */
+/** A key's limits as the API takes them (snake_case), as the key store takes them. */
+function keyLimitsFromInput(value) {
+    const given = value;
+    return {
+        ...(given.max_holds !== undefined ? { maxHolds: given.max_holds } : {}),
+        ...(given.max_held_hours !== undefined ? { maxHeldHours: given.max_held_hours } : {}),
+        ...(given.requests_per_minute !== undefined ? { requestsPerMinute: given.requests_per_minute } : {}),
+        ...(given.requires_approval === true ? { requiresApproval: true } : {}),
+    };
+}
+/** A sandbox refusal as the API answers it: 403 for a live tenant, 409 for one not empty. */
+function sandboxRefusal(error) {
+    const code = error?.code;
+    if (code === 'sandbox_test_only')
+        return new SlotlockAgentOperationError(code, 403);
+    if (code === 'sandbox_not_empty')
+        return new SlotlockAgentOperationError(code, 409);
+    return error;
+}
+/** An approval decision refused: 404 for none, 409 for one decided or past its wait. */
+function approvalRefusal(code) {
+    return new SlotlockAgentOperationError(code, code === 'approval_not_found' ? 404 : 409);
+}
+function approvalPolicyOutput(policy) {
+    const applies = policy.appliesTo;
+    const conditions = policy.conditions;
+    return {
+        policy_ref: policy.ref,
+        name: policy.name,
+        applies_to: {
+            ...(applies.resourceIds ? { resource_ids: applies.resourceIds } : {}),
+            ...(applies.pools ? { pools: applies.pools } : {}),
+            ...(applies.locations ? { locations: applies.locations } : {}),
+            ...(applies.groups ? { groups: applies.groups } : {}),
+        },
+        conditions: {
+            ...(conditions.longerThanMinutes !== undefined ? { longer_than_minutes: conditions.longerThanMinutes } : {}),
+            ...(conditions.outsideHours !== undefined ? { outside_hours: conditions.outsideHours } : {}),
+            ...(conditions.kinds ? { kinds: conditions.kinds } : {}),
+        },
+        outcome: policy.outcome,
+        approval_ttl_minutes: policy.approvalTtlMinutes,
+        lead_minutes: policy.leadMinutes,
+        created_at: policy.createdAt.toISOString(),
+        updated_at: policy.updatedAt.toISOString(),
+    };
+}
+function approvalAppliesTo(value) {
+    const given = value;
+    return {
+        ...(given.resource_ids ? { resourceIds: given.resource_ids } : {}),
+        ...(given.pools ? { pools: given.pools } : {}),
+        ...(given.locations ? { locations: given.locations } : {}),
+        ...(given.groups ? { groups: given.groups } : {}),
+    };
+}
+function approvalConditions(value) {
+    const given = value;
+    return {
+        ...(given.longer_than_minutes !== undefined ? { longerThanMinutes: given.longer_than_minutes } : {}),
+        ...(given.outside_hours !== undefined ? { outsideHours: given.outside_hours } : {}),
+        ...(given.kinds ? { kinds: given.kinds } : {}),
+    };
+}
+function approvalOutput(approval) {
+    return {
+        approval_id: approval.id,
+        policy_ref: approval.policyRef,
+        status: approval.status,
+        operation: approval.operation,
+        request: approval.request,
+        requested_by: approval.requestedBy,
+        resource_ids: approval.resourceIds,
+        starts_at: approval.start.toISOString(),
+        ends_at: approval.end.toISOString(),
+        expires_at: approval.expiresAt.toISOString(),
+        decided_by: approval.decidedBy,
+        decided_at: approval.decidedAt?.toISOString() ?? null,
+        reason: approval.reason,
+        created_at: approval.createdAt.toISOString(),
+    };
+}
 function applicationRefusal(code) {
     if (code === 'resource_tenant_mismatch') {
         return new SlotlockAgentOperationError('resource_not_found', 404);
@@ -1033,11 +1397,379 @@ function waitlistOutput(entry) {
     };
 }
 /**
- * Offer what a cancel or release just freed to the tenant's waitlist now, rather than at the next
- * maintenance pass. Best effort, after the freeing transaction committed: maintenance offers
- * whatever this misses.
+ * The policy a key whose bookings wait for a person (`requiresApproval`, RFC 0004 A5) is held by:
+ * every resource, a day's wait. A tenant cannot name a policy of its own `api-key`.
+ */
+function keyApprovalPolicy() {
+    return {
+        ref: SLOTLOCK_KEY_APPROVAL_POLICY,
+        name: 'Bookings by this API key',
+        appliesTo: {},
+        conditions: {},
+        outcome: 'require_approval',
+        approvalTtlMinutes: SLOTLOCK_DEFAULT_APPROVAL_MINUTES,
+        leadMinutes: 0,
+        createdAt: new Date(0),
+        updatedAt: new Date(0),
+    };
+}
+/** A JSON value with its object keys sorted, so two requests compare by content. */
+function canonical(value) {
+    if (Array.isArray(value))
+        return value.map(canonical);
+    if (value !== null && typeof value === 'object') {
+        return Object.fromEntries(Object.keys(value)
+            .sort()
+            .map((key) => [key, canonical(value[key])]));
+    }
+    return value;
+}
+/** Each interval of `wanted` less the parts `kept` already covers on the same resource. */
+function uncovered(wanted, kept) {
+    const pieces = [];
+    for (const want of wanted) {
+        let open = [{ start: want.start, end: want.end }];
+        for (const own of kept) {
+            if (own.resourceId !== want.resourceId)
+                continue;
+            open = open.flatMap((piece) => {
+                if (own.end <= piece.start || own.start >= piece.end)
+                    return [piece];
+                return [
+                    ...(own.start > piece.start ? [{ start: piece.start, end: own.start }] : []),
+                    ...(own.end < piece.end ? [{ start: own.end, end: piece.end }] : []),
+                ];
+            });
+        }
+        pieces.push(...open.map((piece) => ({ ...piece, resourceId: want.resourceId })));
+    }
+    return pieces;
+}
+/** How a request already put to a person answers its retry: waiting, declined or expired. */
+function approvalAnswer(approval) {
+    const id = { approval_id: approval.id, policy_ref: approval.policyRef };
+    if (approval.status === 'declined') {
+        return new SlotlockAgentOperationError('approval_declined', 403, {
+            ...id,
+            ...(approval.reason ? { reason: approval.reason.slice(0, 200) } : {}),
+        });
+    }
+    if (approval.status === 'expired' || approval.expiresAt.getTime() <= Date.now()) {
+        return new SlotlockAgentOperationError('approval_expired', 409, id);
+    }
+    return new SlotlockAgentOperationError('approval_pending', 409, {
+        ...id,
+        expires_at: approval.expiresAt.toISOString(),
+    });
+}
+/**
+ * Approval policies (RFC 0004 A4) in front of the backend's writes. A write a policy covers is
+ * tried first as a dry run, so it meets every check and the database's constraints as it would;
+ * a `refuse` policy then refuses it, and a `require_approval` one holds the exact time it would
+ * occupy for the approval and answers `approval_pending`. A retry with the same idempotency key
+ * answers as the request stands, and once granted, with the booking itself. Tenants with no policy
+ * pay one indexed read per write.
+ */
+function withApprovalPolicies(store, options, maxApprovalMinutes, backend) {
+    const requestKeyOf = (context, stored, key) => createHash('sha256')
+        .update(JSON.stringify(['slotlock-approval', context.principal.tenantRef, agentOwnerRef(context), stored, key]))
+        .digest('hex');
+    /** Whether [start, end) on the resource falls outside its bookable hours. */
+    async function outsideHours(tenantStore, context, resourceId, start, end) {
+        const resource = await requireAgentResource(tenantStore, context.principal.tenantRef, resourceId);
+        const hours = resource.availabilityRules ?? (await options.availabilityRules(context, resource));
+        const windows = mergeIntervals(expandRules(hours, { start: new Date(start.getTime() - 86_400_000), end: new Date(end.getTime() + 86_400_000) }, resource.timezone));
+        return !windows.some((window) => window.start <= start && window.end >= end);
+    }
+    /** The write's ask and the policies that may cover it, or null when none can. */
+    async function plan(tenantStore, context, operation, input) {
+        const tenantRef = context.principal.tenantRef;
+        const ownerRef = agentOwnerRef(context);
+        const key = input.idempotency_key;
+        // A key whose bookings all wait for a person (RFC 0004 A5) is a policy of its own.
+        const keyPolicy = context.principal.limits?.requiresApproval === true ? keyApprovalPolicy() : undefined;
+        // Most tenants have none: one small indexed read, and nothing else looked up.
+        if (!keyPolicy && (await tenantStore.listApprovalPolicies({ tenantRef })).length === 0)
+            return null;
+        let asked;
+        if (operation === 'slotlock_create_event') {
+            asked = {
+                kind: 'single',
+                stored: 'slotlock_create_event',
+                resourceIds: [input.resource_id],
+                externalRefs: [agentExternalRef(context, key)],
+                start: new Date(input.starts_at),
+                end: new Date(input.ends_at),
+                series: typeof input.recurrence_rule === 'string',
+                before: [],
+                ...(typeof input.hold_id === 'string' ? { consumeHold: { holdId: input.hold_id, holderRef: ownerRef } } : {}),
+            };
+        }
+        else if (operation === 'slotlock_book_pool') {
+            const members = await tenantStore.listPoolMembers({ tenantRef, pool: input.pool, visibility: 'shared' });
+            if (members.length === 0)
+                return null;
+            asked = {
+                kind: 'pool',
+                stored: 'slotlock_create_event',
+                resourceIds: members.map((member) => member.id),
+                externalRefs: [agentExternalRef(context, key)],
+                start: new Date(input.starts_at),
+                end: new Date(input.ends_at),
+                series: false,
+                before: [],
+                pool: input.pool,
+            };
+        }
+        else if (operation === 'slotlock_book_together') {
+            const resourceIds = [...new Set(input.resource_ids)].sort();
+            asked = {
+                kind: 'bundle',
+                stored: 'slotlock_book_together',
+                resourceIds,
+                externalRefs: resourceIds.map((resourceId) => agentExternalRef(context, `${key}\0${resourceId}`)),
+                start: new Date(input.starts_at),
+                end: new Date(input.ends_at),
+                series: false,
+                before: [],
+            };
+        }
+        else {
+            const current = await tenantStore.getCalendarEvent({ tenantRef, ownerRef, externalRef: input.event_id });
+            if (!current)
+                return null;
+            const resourceId = input.resource_id ?? current.resourceId;
+            const start = input.starts_at ? new Date(input.starts_at) : current.start;
+            const end = input.ends_at ? new Date(input.ends_at) : current.end;
+            // Only a move to another time or resource is a booking a policy can be about.
+            if (resourceId === current.resourceId && start.getTime() === current.start.getTime() && end.getTime() === current.end.getTime()) {
+                return null;
+            }
+            asked = {
+                kind: 'move',
+                stored: 'slotlock_update_event',
+                resourceIds: [resourceId],
+                externalRefs: [current.externalRef],
+                start,
+                end,
+                series: input.recurrence_rule !== undefined ? typeof input.recurrence_rule === 'string' : current.recurrence !== undefined,
+                before: await tenantStore.eventOccupancy({ tenantRef, ownerRef, externalRefs: [current.externalRef] }),
+            };
+        }
+        const minutes = (asked.end.getTime() - asked.start.getTime()) / 60_000;
+        // What the ask alone decides; hours wait for the resource the write takes.
+        const policies = (await tenantStore.approvalPoliciesFor({ tenantRef, resourceIds: asked.resourceIds })).filter((policy) => (policy.conditions.kinds === undefined || policy.conditions.kinds.includes(asked.kind)) &&
+            (policy.conditions.longerThanMinutes === undefined || minutes > policy.conditions.longerThanMinutes));
+        if (policies.length === 0 && !keyPolicy)
+            return null;
+        return { ...asked, policies, ...(keyPolicy ? { keyPolicy } : {}) };
+    }
+    function gated(operation, method) {
+        return async function (context, input) {
+            // The grant itself, or a write a person already approved and its retries.
+            if (context[APPROVAL_GRANT])
+                return method.call(this, context, input);
+            const tenantRef = context.principal.tenantRef;
+            const stored = operation === 'slotlock_book_together' || operation === 'slotlock_update_event' ? operation : 'slotlock_create_event';
+            const requestKey = requestKeyOf(context, stored, input.idempotency_key);
+            const asked = await withTenant(store, { ...context, dryRun: false }, async (tenantStore) => {
+                const prior = await tenantStore.findApproval({ tenantRef, requestKey });
+                if (prior)
+                    return { prior };
+                return { plan: await plan(tenantStore, context, operation, input) };
+            });
+            if (asked.prior) {
+                const { hold_id: _held, ...request } = input;
+                // Granted: the booking was made with this key, so the write answers it as a replay (and
+                // the store refuses another request with it). Without the hold the approval took over,
+                // as the grant made it.
+                if (asked.prior.status === 'granted')
+                    return method.call(this, context, request);
+                const kept = { ...asked.prior.request };
+                // A pool booking is kept as the member it would take.
+                if (operation === 'slotlock_book_pool')
+                    delete kept.resource_id;
+                if (JSON.stringify(canonical(kept)) !== JSON.stringify(canonical(request))) {
+                    throw new SlotlockAgentOperationError('idempotency_conflict', 409);
+                }
+                throw approvalAnswer(asked.prior);
+            }
+            const ask = asked.plan;
+            if (!ask)
+                return method.call(this, context, input);
+            // Tried as a dry run, reading what it would occupy before it is undone: a write that would be
+            // refused is refused as it would be.
+            let occupied = [];
+            const probed = await method.call(this, {
+                ...context,
+                dryRun: true,
+                [OCCUPANCY_PROBE]: async (tenantStore) => {
+                    occupied = await tenantStore.eventOccupancy({
+                        tenantRef,
+                        ownerRef: agentOwnerRef(context),
+                        externalRefs: ask.externalRefs,
+                    });
+                },
+            }, input);
+            // Made already (before the policy, say), or takes no time (a transparent event): nothing to hold.
+            if (probed.replayed === true || occupied.length === 0) {
+                return context.dryRun ? probed : method.call(this, context, input);
+            }
+            const written = [...new Set(occupied.map((occupation) => occupation.resourceId))];
+            const decided = await withTenant(store, { ...context, dryRun: false }, async (tenantStore) => {
+                // A pool's policies are those of the member the write would take, and its pool.
+                const candidates = [
+                    ...(ask.pool
+                        ? (await tenantStore.approvalPoliciesFor({ tenantRef, resourceIds: written })).filter((policy) => ask.policies.some((known) => known.ref === policy.ref))
+                        : ask.policies),
+                    ...(ask.keyPolicy ? [ask.keyPolicy] : []),
+                ];
+                const applying = [];
+                for (const policy of candidates) {
+                    if (policy.conditions.outsideHours === true) {
+                        let outside = false;
+                        for (const resourceId of written) {
+                            if (await outsideHours(tenantStore, context, resourceId, ask.start, ask.end))
+                                outside = true;
+                        }
+                        if (!outside)
+                            continue;
+                    }
+                    applying.push(policy);
+                }
+                return applying;
+            });
+            if (decided.length === 0)
+                return context.dryRun ? probed : method.call(this, context, input);
+            const refusing = decided.find((policy) => policy.outcome === 'refuse');
+            if (refusing)
+                throw new SlotlockAgentOperationError('approval_policy_refused', 403, { policy_ref: refusing.ref });
+            // The strictest wait: the earliest a person must decide by, under each policy's own wait, its
+            // lead before the start, and the server's ceiling.
+            const now = Date.now();
+            const deadline = (policy) => Math.min(now + Math.min(policy.approvalTtlMinutes, maxApprovalMinutes) * 60_000, ask.start.getTime() - policy.leadMinutes * 60_000);
+            const policy = [...decided].sort((left, right) => deadline(left) - deadline(right) || left.ref.localeCompare(right.ref))[0];
+            const expiresAt = new Date(deadline(policy));
+            if (ask.series || occupied.some((occupation) => occupation.recurring)) {
+                throw new SlotlockAgentOperationError('approval_series_unsupported', 409, { policy_ref: policy.ref });
+            }
+            if (expiresAt.getTime() < now + 60_000) {
+                throw new SlotlockAgentOperationError('approval_too_late', 409, { policy_ref: policy.ref });
+            }
+            if (context.dryRun) {
+                throw new SlotlockAgentOperationError('approval_required', 409, {
+                    policy_ref: policy.ref,
+                    expires_at: expiresAt.toISOString(),
+                });
+            }
+            const holds = uncovered(occupied, ask.before);
+            if (holds.length === 0)
+                return method.call(this, context, input);
+            const chosen = ask.pool ? written[0] : undefined;
+            const { hold_id: _hold, ...request } = input;
+            const principal = context.principal;
+            const result = await withTenant(store, context, (tenantStore) => tenantStore.requestApproval({
+                tenantRef,
+                policyRef: policy.ref,
+                operation: ask.stored,
+                request: canonical(chosen ? { ...request, resource_id: chosen } : request),
+                requester: {
+                    subject: principal.subject,
+                    ...(principal.scopes ? { scopes: [...principal.scopes] } : {}),
+                    ...(principal.keyId !== undefined ? { key_id: principal.keyId } : {}),
+                    ...(principal.resourceScope
+                        ? { resource_scope: { locations: [...principal.resourceScope.locations], groups: [...principal.resourceScope.groups] } }
+                        : {}),
+                    ...(context.origin !== undefined ? { origin: context.origin } : {}),
+                    ...(ask.pool !== undefined ? { pool: ask.pool } : {}),
+                },
+                requesterRef: principal.subject,
+                requestKey,
+                holds,
+                start: ask.start,
+                end: ask.end,
+                expiresAt,
+                ...(ask.consumeHold ? { consumeHold: ask.consumeHold } : {}),
+            }), WRITE);
+            if (!result.ok) {
+                if (result.code === 'approval_limit_reached') {
+                    throw new SlotlockAgentOperationError('approval_limit_reached', 429, { limit: String(result.limit ?? '') });
+                }
+                throw new SlotlockAgentOperationError(result.code, 409);
+            }
+            throw approvalAnswer(result.approval);
+        };
+    }
+    const wrapped = { ...backend };
+    wrapped.createEvent = gated('slotlock_create_event', backend.createEvent);
+    wrapped.updateEvent = gated('slotlock_update_event', backend.updateEvent);
+    if (backend.bookPool)
+        wrapped.bookPool = gated('slotlock_book_pool', backend.bookPool);
+    if (backend.bookTogether)
+        wrapped.bookTogether = gated('slotlock_book_together', backend.bookTogether);
+    if (backend.confirmHold) {
+        const confirm = backend.confirmHold;
+        // A confirm already put to a person answers as it stands, before its hold (now the
+        // approval's) is looked for; otherwise it books through createEvent, policies and all.
+        wrapped.confirmHold = async function (context, input) {
+            if (!context[APPROVAL_GRANT]) {
+                const requestKey = requestKeyOf(context, 'slotlock_create_event', input.idempotency_key);
+                const prior = await withTenant(store, { ...context, dryRun: false }, (tenantStore) => tenantStore.findApproval({ tenantRef: context.principal.tenantRef, requestKey }));
+                if (prior && prior.status !== 'granted')
+                    throw approvalAnswer(prior);
+            }
+            return confirm.call(this, context, input);
+        };
+    }
+    return wrapped;
+}
+/**
+ * Run a granted approval's write as the agent that asked for it, in one transaction with the grant:
+ * its holds give way, the write is made, and the approval is marked granted.
+ */
+export async function runSlotlockApprovalGrant(agentBackend, approval, grant) {
+    const requester = approval.requester;
+    if (typeof requester.subject !== 'string')
+        throw new SlotlockAgentOperationError('store_inconsistent', 503);
+    const scope = requester.resource_scope;
+    const context = {
+        principal: {
+            subject: requester.subject,
+            tenantRef: grant.tenantRef,
+            ...(Array.isArray(requester.scopes) ? { scopes: requester.scopes } : {}),
+            ...(typeof requester.key_id === 'string' ? { keyId: requester.key_id } : {}),
+            ...(scope && Array.isArray(scope.locations) && Array.isArray(scope.groups)
+                ? { resourceScope: { locations: scope.locations, groups: scope.groups } }
+                : {}),
+        },
+        operation: approval.operation,
+        signal: grant.signal,
+        ...(grant.origin !== undefined ? { origin: grant.origin } : {}),
+        ...(grant.dryRun ? { dryRun: true } : {}),
+        [APPROVAL_GRANT]: {
+            id: approval.id,
+            decidedBy: grant.decidedBy,
+            ...(typeof requester.pool === 'string' ? { pool: requester.pool } : {}),
+        },
+    };
+    const method = approval.operation === 'slotlock_book_together'
+        ? agentBackend.bookTogether
+        : approval.operation === 'slotlock_update_event'
+            ? agentBackend.updateEvent
+            : agentBackend.createEvent;
+    if (!method)
+        throw new SlotlockAgentOperationError('approvals_unavailable', 409);
+    return method.call(agentBackend, context, approval.request);
+}
+/**
+ * Offer what a cancel or release just freed to the waitlist now. Best effort, after commit:
+ * maintenance offers whatever this misses.
  */
-async function offerFreedTime(store, tenantRef) {
+async function offerFreedTime(store, context) {
+    // A dry run freed nothing.
+    if (context.dryRun)
+        return;
+    const tenantRef = context.principal.tenantRef;
     try {
         await store.withTenant(tenantRef, (tenant) => tenant.offerWaitlist({ tenantRef, limit: 20 }), {
             origin: 'maintenance',
@@ -1059,6 +1791,14 @@ function webhookOutput(endpoint) {
         last_error: endpoint.lastError,
         disabled_at: endpoint.disabledAt?.toISOString() ?? null,
         disabled_reason: endpoint.disabledReason,
+        filter: endpoint.filter
+            ? {
+                ...(endpoint.filter.resourceIds ? { resource_ids: endpoint.filter.resourceIds } : {}),
+                ...(endpoint.filter.pools ? { pools: endpoint.filter.pools } : {}),
+                ...(endpoint.filter.locations ? { locations: endpoint.filter.locations } : {}),
+                ...(endpoint.filter.groups ? { groups: endpoint.filter.groups } : {}),
+            }
+            : null,
     };
 }
 function rulesOutput(rules) {
@@ -1085,7 +1825,6 @@ function rulesInput(value) {
         throw storeRefusal(error);
     }
 }
-/** Booking rules as the application API writes them, snake_case; `null` for none. */
 function bookingRulesOutput(rules) {
     if (!rules)
         return null;
@@ -1138,8 +1877,53 @@ function resourceOutput(resource) {
         visibility: resource.visibility ?? 'shared',
         archived_at: resource.archivedAt?.toISOString() ?? null,
         pool: resource.pool ?? null,
+        name: resource.name ?? null,
+        description: resource.description ?? null,
+        kind: resource.kind ?? 'other',
+        capacity: resource.capacity ?? null,
+        labels: resource.labels ?? [],
+        attributes: resource.attributes ?? {},
+        location: resource.location ?? null,
+        groups: resource.groups ?? [],
+        parent_id: resource.parentId ?? null,
+        part_index: resource.partIndex ?? null,
     };
 }
+function locationOutput(location) {
+    return {
+        ref: location.ref,
+        name: location.name,
+        parent_ref: location.parentRef,
+        timezone: location.timezone,
+        resources: location.resources,
+    };
+}
+function groupOutput(group) {
+    return { ref: group.ref, name: group.name, description: group.description, members: group.members };
+}
+/** The references of a location and every location under it, from the tenant's whole tree. */
+function locationAndBelow(locations, ref) {
+    const found = new Set([ref]);
+    for (let grew = true; grew;) {
+        grew = false;
+        for (const location of locations) {
+            if (location.parentRef !== null && found.has(location.parentRef) && !found.has(location.ref)) {
+                found.add(location.ref);
+                grew = true;
+            }
+        }
+    }
+    return found;
+}
+/** The profile fields of an operation's input, as the store takes them; absent ones left out. */
+function profileInput(input) {
+    const profile = {};
+    for (const field of SLOTLOCK_RESOURCE_PROFILE_FIELDS) {
+        if (input[field] !== undefined)
+            profile[field] = input[field];
+    }
+    return profile;
+}
 /** Any of a tenant's events: the store's id, which the tenant-event routes take, and its owner's. */
 function tenantEventOutput(event) {
     return {
@@ -1166,7 +1950,7 @@ function reservationOutput(reservation) {
         reservation_ref: reservation.externalRef,
         start: reservation.start.toISOString(),
         end: reservation.end.toISOString(),
-        // The store keeps milliseconds; a buffer set in seconds through the library still shows as busy.
+        // The store keeps milliseconds; round up so a sub-minute buffer still shows as busy.
         buffer_after_minutes: Math.ceil(reservation.bufferAfterMs / 60_000),
         revision: reservation.revision,
         source: reservation.source,
@@ -1193,9 +1977,9 @@ function applicationCommandKey(context, idempotencyKey) {
 /** The most busy intervals one slotlock_list_busy answers, as one free/busy request reads. */
 const MAX_LISTED_BUSY = MAX_REQUEST_BUSY_INTERVALS;
 /**
- * Serve the application API (application-api.ts) from the production store, in the principal's
- * tenant. Every resource an operation names must be the tenant's, or it is not found; holds are
- * reservations under the tenant's row-level security, so another tenant's hold is not found either.
+ * Serve the application API (application-api.ts) from the store in the principal's tenant. Every
+ * resource named must be the tenant's, or it is not found; holds are under the tenant's RLS, so
+ * another tenant's is not found either.
  */
 export function createSlotlockStoreApplicationBackend(store, options = {}) {
     const max = options.maxTenantResources;
@@ -1239,6 +2023,23 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
             };
         });
     }
+    /** The partner store and the partner a partner key names; any other caller is forbidden. */
+    function partnerOf(context) {
+        assertActive(context);
+        const partners = options.partners;
+        if (!partners)
+            throw new SlotlockAgentOperationError('partner_api_not_served', 404);
+        return { partners, partner: slotlockPrincipalPartner(context.principal) };
+    }
+    /** As partnerOf, with the account's tenant: 404 account_not_found for one the partner lacks. */
+    async function partnerAccount(context, input) {
+        const { partners, partner } = partnerOf(context);
+        const tenantRef = await partners.tenantOf(partner, input.account);
+        if (!tenantRef)
+            throw new SlotlockAgentOperationError('account_not_found', 404);
+        // Its test environment (RFC 0003 G9): a tenant of its own, on the same plan, never billed.
+        return { partners, partner, tenantRef: input.environment === 'test' ? `${tenantRef}${SLOTLOCK_TEST_TENANT_SUFFIX}` : tenantRef };
+    }
     return {
         async createResource(context, input) {
             // A capped create counts under READ COMMITTED; withTenant opens it for the call.
@@ -1247,11 +2048,15 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                     const resource = await tenant.createResource({
                         tenantRef: tenantOf(context),
                         externalRef: input.external_ref,
-                        timezone: input.timezone,
+                        ...(input.timezone !== undefined ? { timezone: input.timezone } : {}),
+                        ...(input.location !== undefined ? { location: input.location } : {}),
                         ...(input.visibility !== undefined
                             ? { visibility: input.visibility }
                             : {}),
                         ...(max !== undefined ? { maxTenantResources: max } : {}),
+                        ...(SLOTLOCK_RESOURCE_PROFILE_FIELDS.some((field) => input[field] !== undefined)
+                            ? { profile: profileInput(input) }
+                            : {}),
                     });
                     return { resource: resourceOutput(resource) };
                 }
@@ -1260,6 +2065,151 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 }
             }, max !== undefined ? { isolation: 'read committed' } : undefined);
         },
+        async updateResource(context, input) {
+            const id = input.resource_id;
+            if (!STORE_ID_PATTERN.test(id))
+                throw new SlotlockAgentOperationError('resource_not_found', 404);
+            return withTenant(store, context, async (tenant) => {
+                let resource;
+                try {
+                    resource = await tenant.updateResourceProfile({
+                        tenantRef: tenantOf(context),
+                        id,
+                        profile: profileInput(input),
+                        ...(input.location !== undefined ? { location: input.location } : {}),
+                    });
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+                if (!resource)
+                    throw new SlotlockAgentOperationError('resource_not_found', 404);
+                return { resource: resourceOutput(resource) };
+            }, WRITE);
+        },
+        async listLocations(context) {
+            return withTenant(store, context, async (tenant) => ({
+                locations: (await tenant.listLocations({ tenantRef: tenantOf(context) })).map(locationOutput),
+            }));
+        },
+        async createLocation(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                try {
+                    const location = await tenant.putLocation({
+                        tenantRef: tenantOf(context),
+                        ref: input.ref,
+                        name: input.name,
+                        ...(input.parent_ref !== undefined ? { parentRef: input.parent_ref } : {}),
+                        ...(input.timezone !== undefined ? { timezone: input.timezone } : {}),
+                    });
+                    return { location: locationOutput(location) };
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+            }, WRITE);
+        },
+        async updateLocation(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                let location;
+                try {
+                    location = await tenant.updateLocation({
+                        tenantRef: tenantOf(context),
+                        ref: input.location_ref,
+                        ...(input.name !== undefined ? { name: input.name } : {}),
+                        ...(input.parent_ref !== undefined ? { parentRef: input.parent_ref } : {}),
+                        ...(input.timezone !== undefined ? { timezone: input.timezone } : {}),
+                    });
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+                if (!location)
+                    throw new SlotlockAgentOperationError('location_not_found', 404);
+                return { location: locationOutput(location) };
+            }, WRITE);
+        },
+        async deleteLocation(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                try {
+                    return {
+                        deleted: await tenant.deleteLocation({ tenantRef: tenantOf(context), ref: input.location_ref }),
+                    };
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+            }, WRITE);
+        },
+        async listGroups(context) {
+            return withTenant(store, context, async (tenant) => ({
+                groups: (await tenant.listGroups({ tenantRef: tenantOf(context) })).map(groupOutput),
+            }));
+        },
+        async createGroup(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                try {
+                    const group = await tenant.putGroup({
+                        tenantRef: tenantOf(context),
+                        ref: input.ref,
+                        name: input.name,
+                        ...(input.description !== undefined ? { description: input.description } : {}),
+                    });
+                    return { group: groupOutput(group) };
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+            }, WRITE);
+        },
+        async deleteGroup(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                try {
+                    return { deleted: await tenant.deleteGroup({ tenantRef: tenantOf(context), ref: input.group_ref }) };
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+            }, WRITE);
+        },
+        async addGroupMember(context, input) {
+            const resourceId = input.resource_id;
+            if (!STORE_ID_PATTERN.test(resourceId))
+                throw new SlotlockAgentOperationError('resource_not_found', 404);
+            return withTenant(store, context, async (tenant) => {
+                try {
+                    return {
+                        added: await tenant.addGroupMember({
+                            tenantRef: tenantOf(context),
+                            group: input.group_ref,
+                            resourceId,
+                        }),
+                    };
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+            }, WRITE);
+        },
+        async removeGroupMember(context, input) {
+            const resourceId = input.resource_id;
+            if (!STORE_ID_PATTERN.test(resourceId))
+                return { removed: false };
+            return withTenant(store, context, async (tenant) => {
+                try {
+                    return {
+                        removed: await tenant.removeGroupMember({
+                            tenantRef: tenantOf(context),
+                            group: input.group_ref,
+                            resourceId,
+                        }),
+                    };
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+            }, WRITE);
+        },
         async getResource(context, input) {
             return withTenant(store, context, async (tenant) => ({
                 resource: resourceOutput(await requireResource(tenant, tenantOf(context), input.resource_id)),
@@ -1289,7 +2239,6 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
         },
         async deleteResource(context, input) {
             const id = input.resource_id;
-            // An id the store never issues names no resource: there is nothing to delete.
             if (!STORE_ID_PATTERN.test(id))
                 return { deleted: false };
             return withTenant(store, context, async (tenant) => {
@@ -1421,6 +2370,26 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 return { resource: resourceOutput(resource) };
             }, WRITE);
         },
+        async setResourceParent(context, input) {
+            const id = input.resource_id;
+            const parentId = input.parent_id;
+            if (!STORE_ID_PATTERN.test(id))
+                throw new SlotlockAgentOperationError('resource_not_found', 404);
+            if (parentId !== null && !STORE_ID_PATTERN.test(parentId))
+                throw new SlotlockAgentOperationError('parent_not_found', 404);
+            return withTenant(store, context, async (tenant) => {
+                let resource;
+                try {
+                    resource = await tenant.setResourceParent({ tenantRef: tenantOf(context), id, parentId });
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+                if (!resource)
+                    throw new SlotlockAgentOperationError('resource_not_found', 404);
+                return { resource: resourceOutput(resource) };
+            }, WRITE);
+        },
         async getResourceHistory(context, input) {
             return history(context, input);
         },
@@ -1435,6 +2404,21 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 pools: await tenant.listPools({ tenantRef: tenantOf(context) }),
             }));
         },
+        async setPoolOrder(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                try {
+                    const order = await tenant.setPoolOrder({
+                        tenantRef: tenantOf(context),
+                        pool: input.pool,
+                        order: input.order,
+                    });
+                    return { pool: input.pool, order };
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+            }, WRITE);
+        },
         async getBookingRuleDefaults(context) {
             return withTenant(store, context, async (tenant) => {
                 const defaults = await tenant.getBookingRuleDefaults({ tenantRef: tenantOf(context) });
@@ -1552,14 +2536,13 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
         },
         async releaseHold(context, input) {
             const id = input.hold_id;
-            // An id that is not one the store issues names no hold: there is nothing to release.
             if (!STORE_ID_PATTERN.test(id))
                 return { released: false };
             const released = await withTenant(store, context, async (tenant) => ({
                 released: (await tenant.releaseHold(id, { tenantRef: tenantOf(context) })).released,
             }));
             if (released.released)
-                await offerFreedTime(store, tenantOf(context));
+                await offerFreedTime(store, context);
             return released;
         },
         async getReservation(context, input) {
@@ -1608,9 +2591,8 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                     throw applicationRefusal(result.code);
                 return { reservation: reservationOutput(result.reservation), replayed: result.idempotent };
             }, WRITE);
-            // A move frees the time the booking held.
             if (input.revision > 1 && !put.replayed) {
-                await offerFreedTime(store, tenantOf(context));
+                await offerFreedTime(store, context);
             }
             return put;
         },
@@ -1626,7 +2608,7 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 return { cancelled: result.cancelled, revision: result.revision };
             }, WRITE);
             if (cancelled.cancelled)
-                await offerFreedTime(store, tenantOf(context));
+                await offerFreedTime(store, context);
             return cancelled;
         },
         async checkInReservation(context, input) {
@@ -1651,10 +2633,11 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                     end: new Date(input.end),
                     holderRef: input.holder_ref,
                     ...(ttl !== undefined ? { offerTtlMs: ttl * 1000 } : {}),
+                    ...(input.idempotency_key !== undefined ? { idempotencyKey: input.idempotency_key } : {}),
                 });
                 if (!result.ok)
                     throw applicationRefusal(result.code);
-                return { entry: waitlistOutput(result.entry) };
+                return { entry: waitlistOutput(result.entry), replayed: result.replayed };
             });
         },
         async listWaitlist(context, input) {
@@ -1673,7 +2656,7 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 left: await tenant.leaveWaitlist({ tenantRef: tenantOf(context), id: input.entry_id }),
             }));
             if (left.left)
-                await offerFreedTime(store, tenantOf(context));
+                await offerFreedTime(store, context);
             return left;
         },
         async getCoverage(context, input) {
@@ -1778,7 +2761,6 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
         async cancelTenantEvent(context, input) {
             const id = input.event_id;
             const expectedResourceId = input.expected_resource_id;
-            // An id the store never issues names no event, and no event is on a resource it never issued.
             if (!STORE_ID_PATTERN.test(id) ||
                 (expectedResourceId !== undefined && !STORE_ID_PATTERN.test(expectedResourceId))) {
                 throw new SlotlockAgentOperationError('event_not_found', 404);
@@ -1801,7 +2783,7 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 };
             }, WRITE);
             if (!cancelled.replayed)
-                await offerFreedTime(store, tenantOf(context));
+                await offerFreedTime(store, context);
             return cancelled;
         },
         async getTenant(context) {
@@ -1820,12 +2802,18 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 throw new SlotlockAgentOperationError('invalid_confirmation', 400);
             }
             return withTenant(store, context, async (tenant) => {
-                // Read under the tenant's lock, which a suspension waits for: a suspended tenant's data is
-                // kept for its operator, who erases it (slotlock tenant erase) when they decide to.
+                // Read under the tenant's lock: a suspended tenant's data is kept for its operator to
+                // erase.
                 if (await tenant.isTenantSuspended({ tenantRef: tenantOf(context) })) {
                     throw new SlotlockAgentOperationError('tenant_suspended', 403);
                 }
-                const erased = await tenant.eraseTenant({ tenantRef: tenantOf(context) });
+                const erased = await tenant.eraseTenant({ tenantRef: tenantOf(context) }).catch((error) => {
+                    // A paid hosted plan is cancelled first, so it does not renew for an erased tenant.
+                    if (error?.code === 'billing_active') {
+                        throw new SlotlockAgentOperationError('billing_active', 409);
+                    }
+                    throw error;
+                });
                 return { total: erased.total, rows: erased.rows };
             }, WRITE);
         },
@@ -1848,11 +2836,26 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                     tenantRef: tenantOf(context),
                     url: input.url,
                     ...(input.event_types !== undefined ? { eventTypes: input.event_types } : {}),
+                    ...(['resource_ids', 'pools', 'locations', 'groups'].some((field) => input[field] !== undefined)
+                        ? {
+                            filter: {
+                                ...(input.resource_ids !== undefined ? { resourceIds: input.resource_ids } : {}),
+                                ...(input.pools !== undefined ? { pools: input.pools } : {}),
+                                ...(input.locations !== undefined ? { locations: input.locations } : {}),
+                                ...(input.groups !== undefined ? { groups: input.groups } : {}),
+                            },
+                        }
+                        : {}),
+                    ...(input.idempotency_key !== undefined ? { idempotencyKey: input.idempotency_key } : {}),
                 });
                 if (!created.ok) {
-                    throw new SlotlockAgentOperationError(created.code, created.code === 'webhook_limit_reached' ? 409 : 400);
+                    throw new SlotlockAgentOperationError(created.code, created.code === 'webhook_limit_reached' || created.code === 'idempotency_conflict' ? 409 : 400);
                 }
-                return { webhook: webhookOutput(created.endpoint), secret: created.secret };
+                return {
+                    webhook: webhookOutput(created.endpoint),
+                    secret: created.secret,
+                    replayed: created.replayed === true,
+                };
             }, WRITE);
         },
         async listWebhooks(context) {
@@ -1863,6 +2866,196 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
         async deleteWebhook(context, input) {
             return withTenant(store, context, async (tenant) => tenant.deleteWebhookEndpoint({ tenantRef: tenantOf(context), id: input.webhook_id }), WRITE);
         },
+        // The partner API (RFC 0003 P3): the partner the key names, its own accounts only.
+        async partnerPutAccount(context, input) {
+            const { partners, partner } = partnerOf(context);
+            const put = await partners.putAccount(partner, input.account, input.plan);
+            if (!put)
+                throw new SlotlockAgentOperationError('forbidden', 403);
+            return { account: partnerAccountOutput(put.account), created: put.created };
+        },
+        async partnerListAccounts(context) {
+            const { partners, partner } = partnerOf(context);
+            return { accounts: (await partners.listAccounts(partner)).map(partnerAccountOutput) };
+        },
+        async partnerGetAccount(context, input) {
+            const { partners, partner } = partnerOf(context);
+            const found = await partners.getAccount(partner, input.account);
+            if (!found)
+                throw new SlotlockAgentOperationError('account_not_found', 404);
+            return { account: partnerAccountOutput(found) };
+        },
+        async partnerListKeys(context, input) {
+            const { partners, tenantRef } = await partnerAccount(context, input);
+            return { keys: (await partners.keys.list({ tenantRef })).map(slotlockPartnerKeyOutput) };
+        },
+        async partnerCreateKey(context, input) {
+            const { partners, partner, tenantRef } = await partnerAccount(context, input);
+            const contract = await partners.contract(partner);
+            if (!contract)
+                throw new SlotlockAgentOperationError('forbidden', 403);
+            const scopes = input.scopes ?? [...contract.keyScopes];
+            if (scopes.some((scope) => !contract.keyScopes.includes(scope))) {
+                throw new SlotlockAgentOperationError('scope_not_in_contract', 403);
+            }
+            const days = input.expires_in_days;
+            try {
+                const created = await partners.keys.create({
+                    tenantRef,
+                    name: input.name,
+                    scopes,
+                    createdBy: `partner:${partner}`,
+                    actor: context.principal.subject,
+                    origin: 'application',
+                    ...(days !== undefined ? { expiresAt: new Date(Date.now() + days * 86_400_000) } : {}),
+                    ...(input.limits !== undefined ? { limits: keyLimitsFromInput(input.limits) } : {}),
+                });
+                return { key: created.key, api_key: slotlockPartnerKeyOutput(created.apiKey) };
+            }
+            catch (error) {
+                const code = error.code;
+                if (code === 'api_key_limit_reached')
+                    throw new SlotlockAgentOperationError(code, 409);
+                if (code === 'tenant_suspended')
+                    throw new SlotlockAgentOperationError(code, 403);
+                throw error;
+            }
+        },
+        async partnerRotateKey(context, input) {
+            const { partners, tenantRef } = await partnerAccount(context, input);
+            const rotated = await partners.keys
+                .rotate({ tenantRef, id: input.key_id, actor: context.principal.subject, origin: 'application' })
+                .catch((error) => {
+                if (error.code === 'tenant_suspended') {
+                    throw new SlotlockAgentOperationError('tenant_suspended', 403);
+                }
+                throw error;
+            });
+            if (!rotated)
+                throw new SlotlockAgentOperationError('key_not_found', 404);
+            return { key: rotated.key, api_key: slotlockPartnerKeyOutput(rotated.apiKey) };
+        },
+        async partnerRevokeKey(context, input) {
+            const { partners, tenantRef } = await partnerAccount(context, input);
+            const revoked = await partners.keys.revoke({
+                tenantRef,
+                id: input.key_id,
+                actor: context.principal.subject,
+                origin: 'application',
+            });
+            if (!revoked)
+                throw new SlotlockAgentOperationError('key_not_found', 404);
+            return { api_key: slotlockPartnerKeyOutput(revoked) };
+        },
+        async partnerSuspendAccount(context, input) {
+            const { partners, partner } = partnerOf(context);
+            const changed = await partners.setSuspended(partner, input.account, true, input.reason);
+            if (changed === null)
+                throw new SlotlockAgentOperationError('account_not_found', 404);
+            return { suspended: changed };
+        },
+        async partnerUnsuspendAccount(context, input) {
+            const { partners, partner } = partnerOf(context);
+            const changed = await partners.setSuspended(partner, input.account, false);
+            if (changed === null)
+                throw new SlotlockAgentOperationError('account_not_found', 404);
+            return { unsuspended: changed };
+        },
+        async partnerEraseAccount(context, input) {
+            const { partners, partner } = partnerOf(context);
+            if (input.confirm !== input.account)
+                throw new SlotlockAgentOperationError('confirmation_mismatch', 400);
+            const erased = await partners.eraseAccount(partner, input.account);
+            if (!erased.erased)
+                throw new SlotlockAgentOperationError('account_not_found', 404);
+            return { erased: true, rows: erased.total };
+        },
+        async partnerGetUsage(context, input) {
+            const { partners, partner } = partnerOf(context);
+            const now = Date.now();
+            const range = slotlockUsageMonthToDate(now);
+            const from = input.from ?? range.from;
+            const to = input.to ?? range.to;
+            const span = slotlockUsageSpanDays(from, to);
+            if (span < 0 || span > SLOTLOCK_USAGE_RETENTION_DAYS || slotlockUsageSpanDays(to, slotlockUsageDay(now)) < 0) {
+                throw new SlotlockAgentOperationError('invalid_usage_range', 400);
+            }
+            const rows = await partners.usage(partner, from, to, input.account);
+            return { from, to, usage: rows };
+        },
+        async partnerReconcileUsage(context, input) {
+            const { partners, partner } = partnerOf(context);
+            const day = input.day;
+            // An ended day: today's counts are still arriving.
+            if (slotlockUsageSpanDays(day, slotlockUsageDay(Date.now())) < 1) {
+                throw new SlotlockAgentOperationError('invalid_usage_range', 400);
+            }
+            const theirs = new Map();
+            for (const row of input.accounts) {
+                theirs.set(row.account, { operations: row.operations, ...(row.bookings !== undefined ? { bookings: row.bookings } : {}) });
+            }
+            const ours = new Map();
+            for (const row of await partners.usage(partner, day, day)) {
+                if (row.metric !== 'operations' && row.metric !== 'bookings')
+                    continue;
+                const counted = ours.get(row.account) ?? { operations: 0, bookings: 0 };
+                counted[row.metric] += row.count;
+                ours.set(row.account, counted);
+            }
+            const accounts = [...new Set([...ours.keys(), ...theirs.keys()])].sort();
+            const lines = [];
+            const mismatched = new Set();
+            let worst = 0;
+            for (const account of accounts) {
+                for (const metric of ['operations', 'bookings']) {
+                    const mine = ours.get(account)?.[metric] ?? 0;
+                    const told = theirs.get(account)?.[metric];
+                    if (told === undefined && (metric === 'bookings' || !theirs.has(account)) && mine === 0)
+                        continue;
+                    // Not sent by them, where we counted some: a difference of all of it.
+                    const theirCount = told ?? null;
+                    const difference = theirCount === null
+                        ? mine === 0 ? 0 : 100
+                        : Math.max(mine, theirCount) === 0 ? 0 : (Math.abs(mine - theirCount) * 100) / Math.max(mine, theirCount);
+                    if (theirCount === null && metric === 'bookings') {
+                        lines.push({ account, metric, ours: mine, theirs: null, difference_percent: null });
+                        continue;
+                    }
+                    const rounded = Math.round(difference * 100) / 100;
+                    if (difference > SLOTLOCK_RECONCILE_TOLERANCE_PERCENT)
+                        mismatched.add(account);
+                    worst = Math.max(worst, rounded);
+                    lines.push({ account, metric, ours: mine, theirs: theirCount, difference_percent: rounded });
+                }
+            }
+            await partners.recordReconciliation(partner, day, accounts.length, mismatched.size, worst);
+            return {
+                day,
+                within_tolerance: mismatched.size === 0,
+                tolerance_percent: SLOTLOCK_RECONCILE_TOLERANCE_PERCENT,
+                accounts: lines,
+            };
+        },
+        async getUsage(context, input) {
+            const now = Date.now();
+            const range = slotlockUsageMonthToDate(now);
+            const from = input.from ?? range.from;
+            const to = input.to ?? range.to;
+            const span = slotlockUsageSpanDays(from, to);
+            if (span < 0 || span > SLOTLOCK_USAGE_RETENTION_DAYS || slotlockUsageSpanDays(to, slotlockUsageDay(now)) < 0) {
+                throw new SlotlockAgentOperationError('invalid_usage_range', 400);
+            }
+            const rows = await withTenant(store, context, (tenant) => tenant.readUsage({ tenantRef: tenantOf(context), from, to }));
+            const summary = summarizeSlotlockUsage(rows);
+            return {
+                from,
+                to,
+                totals: summary.totals,
+                days: summary.days,
+                keys: summary.keys.map(({ keyId, ...totals }) => ({ key_id: keyId, ...totals })),
+                surfaces: summary.surfaces,
+            };
+        },
         async enableWebhook(context, input) {
             return withTenant(store, context, async (tenant) => {
                 const enabled = await tenant.enableWebhookEndpoint({
@@ -1876,11 +3069,152 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 return { webhook: webhookOutput(enabled) };
             }, WRITE);
         },
+        async listApprovalPolicies(context) {
+            return withTenant(store, context, async (tenant) => ({
+                policies: (await tenant.listApprovalPolicies({ tenantRef: tenantOf(context) })).map(approvalPolicyOutput),
+            }));
+        },
+        async putApprovalPolicy(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                let policy;
+                try {
+                    policy = await tenant.putApprovalPolicy({
+                        tenantRef: tenantOf(context),
+                        ref: input.policy_ref,
+                        name: input.name,
+                        outcome: input.outcome,
+                        ...(input.applies_to !== undefined ? { appliesTo: approvalAppliesTo(input.applies_to) } : {}),
+                        ...(input.conditions !== undefined ? { conditions: approvalConditions(input.conditions) } : {}),
+                        ...(input.approval_ttl_minutes !== undefined ? { approvalTtlMinutes: input.approval_ttl_minutes } : {}),
+                        ...(input.lead_minutes !== undefined ? { leadMinutes: input.lead_minutes } : {}),
+                    });
+                }
+                catch (error) {
+                    if (error instanceof SlotlockApprovalPolicyError) {
+                        throw new SlotlockAgentOperationError(error.code, 400, { reason: error.message.slice(0, 200) });
+                    }
+                    throw error;
+                }
+                if (!policy)
+                    throw new SlotlockAgentOperationError('approval_policy_limit_reached', 409);
+                return { policy: approvalPolicyOutput(policy) };
+            }, WRITE);
+        },
+        async deleteApprovalPolicy(context, input) {
+            return withTenant(store, context, (tenant) => tenant.deleteApprovalPolicy({ tenantRef: tenantOf(context), ref: input.policy_ref }));
+        },
+        async listApprovals(context, input) {
+            return withTenant(store, context, async (tenant) => ({
+                approvals: (await tenant.listApprovals({
+                    tenantRef: tenantOf(context),
+                    limit: input.limit,
+                    ...(input.status !== undefined ? { status: input.status } : {}),
+                })).map(approvalOutput),
+            }));
+        },
+        async getApproval(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                const approval = await tenant.getApproval({ tenantRef: tenantOf(context), id: input.approval_id });
+                if (!approval)
+                    throw new SlotlockAgentOperationError('approval_not_found', 404);
+                return { approval: approvalOutput(approval) };
+            });
+        },
+        async decideApproval(context, input) {
+            const tenantRef = tenantOf(context);
+            const id = input.approval_id;
+            const decidedBy = actorOf(context) ?? 'unknown';
+            if (input.decision === 'decline') {
+                const declined = await withTenant(store, context, (tenant) => tenant.declineApproval({
+                    tenantRef,
+                    id,
+                    decidedBy,
+                    ...(input.reason !== undefined ? { reason: input.reason } : {}),
+                }), WRITE);
+                if (!declined.ok)
+                    throw approvalRefusal(declined.code);
+                await offerFreedTime(store, context);
+                return { approval: approvalOutput(declined.approval), booking: null };
+            }
+            if (!options.agentBackend)
+                throw new SlotlockAgentOperationError('approvals_unavailable', 409);
+            const approval = await withTenant(store, context, (tenant) => tenant.getApproval({ tenantRef, id }));
+            if (!approval)
+                throw approvalRefusal('approval_not_found');
+            if (approval.status !== 'pending')
+                throw approvalRefusal('approval_not_pending');
+            // A dry run's grant is a dry run of the booking: rolled back with it.
+            const booking = await runSlotlockApprovalGrant(options.agentBackend, approval, {
+                tenantRef,
+                decidedBy,
+                signal: context.signal,
+                ...(context.origin !== undefined ? { origin: context.origin } : {}),
+                ...(context.dryRun ? { dryRun: true } : {}),
+            });
+            const granted = context.dryRun
+                ? { ...approval, status: 'granted', decidedBy, decidedAt: new Date() }
+                : await withTenant(store, context, (tenant) => tenant.getApproval({ tenantRef, id }));
+            if (!granted)
+                throw new SlotlockAgentOperationError('store_inconsistent', 503);
+            return { approval: approvalOutput(granted), booking };
+        },
+        async sandboxSeed(context, input) {
+            try {
+                return { ...(await seedSlotlockSandbox(store, tenantOf(context), input.scenario)) };
+            }
+            catch (error) {
+                throw sandboxRefusal(error);
+            }
+        },
+        async sandboxReset(context) {
+            try {
+                return { removed: await resetSlotlockSandbox(store, tenantOf(context)) };
+            }
+            catch (error) {
+                throw sandboxRefusal(error);
+            }
+        },
+        async sandboxFastForward(context, input) {
+            try {
+                const forward = await fastForwardSlotlockSandbox(store, tenantOf(context), input.minutes);
+                const { rollPending: _, ...maintenance } = forward.maintenance;
+                return { minutes: forward.minutes, holds: forward.holds, approvals: forward.approvals, maintenance };
+            }
+            catch (error) {
+                throw sandboxRefusal(error);
+            }
+        },
+        async sandboxRace(context, input) {
+            if (!options.agentBackend)
+                throw new SlotlockAgentOperationError('sandbox_unavailable', 409);
+            try {
+                const raced = await raceSlotlockSandbox({
+                    backend: options.agentBackend,
+                    tenantRef: tenantOf(context),
+                    resourceId: input.resource_id,
+                    start: new Date(input.starts_at),
+                    end: new Date(input.ends_at),
+                    ...(input.agents !== undefined ? { agents: input.agents } : {}),
+                });
+                return {
+                    agents: raced.agents,
+                    booked: raced.booked,
+                    refused: raced.refused,
+                    with_alternatives: raced.withAlternatives,
+                    server_errors: raced.serverErrors,
+                    p50_ms: raced.p50Ms,
+                    p99_ms: raced.p99Ms,
+                    max_ms: raced.maxMs,
+                };
+            }
+            catch (error) {
+                throw sandboxRefusal(error);
+            }
+        },
         async runMaintenance(context) {
             assertActive(context);
             try {
-                // A caller goes round again while `capped`; when to do so at once is the scheduler's.
-                const { rollPending: _, zoneShifts, staleSources, noShows, waitlistOffers, ...result } = await maintainSlotlockTenant(store, tenantOf(context), {
+                const { rollPending: _, zoneShifts, staleSources, noShows, waitlistOffers, approvalsExpired, ...result } = await maintainSlotlockTenant(store, tenantOf(context), {
                     batches,
                     signal: context.signal,
                 });
@@ -1890,6 +3224,7 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                     stale_sources: staleSources,
                     no_shows: noShows,
                     waitlist_offers: waitlistOffers,
+                    approvals_expired: approvalsExpired,
                 };
             }
             catch (error) {