slotlock 0.6.3 → 0.7.0

package/ddl.d.ts

@@ -22,19 +22,19 @@ export declare const SLOTLOCK_API_KEY_RETAINED_LIMIT = 1000;
  * The tables behind API keys. No role but their owner holds a right on them; they are reached only
  * through SLOTLOCK_API_KEY_FUNCTIONS.
  */
-export declare const SLOTLOCK_API_KEY_TABLES: readonly ["api_keys", "api_key_retired_digests"];
+export declare const SLOTLOCK_API_KEY_TABLES: readonly ["api_keys", "api_key_retired_digests", "api_key_resource_scopes", "api_key_limits"];
 /**
  * The SECURITY DEFINER functions through which the serving role reaches API keys, by signature.
  * They run as the deployment role, which owns the tables.
  */
-export declare const SLOTLOCK_API_KEY_FUNCTIONS: readonly ["slotlock.create_api_key(text, text, text, bytea, text[], timestamptz, text)", "slotlock.list_api_keys(text)", "slotlock.rotate_api_key(text, uuid, text, bytea)", "slotlock.revoke_api_key(text, uuid)", "slotlock.authenticate_api_key(bytea)", "slotlock.erase_api_keys(text)"];
+export declare const SLOTLOCK_API_KEY_FUNCTIONS: readonly ["slotlock.create_api_key(text, text, text, bytea, text[], timestamptz, text)", "slotlock.list_api_keys(text)", "slotlock.rotate_api_key(text, uuid, text, bytea)", "slotlock.revoke_api_key(text, uuid)", "slotlock.authenticate_api_key(bytea)", "slotlock.erase_api_keys(text)", "slotlock.set_api_key_resource_scope(text, uuid, text[], text[])", "slotlock.authenticate_scoped_api_key(bytea)", "slotlock.list_api_key_resource_scopes(text)", "slotlock.set_api_key_limits(text, uuid, integer, integer, integer, boolean)", "slotlock.list_api_key_limits(text)", "slotlock.authenticate_limited_api_key(bytea)"];
 /**
  * The table behind the dashboard's shared records (dashboard.ts). No role but its owner holds a
  * right on it; it is reached only through SLOTLOCK_DASHBOARD_FUNCTIONS.
  */
-export declare const SLOTLOCK_DASHBOARD_TABLES: readonly ["dashboard_tokens"];
+export declare const SLOTLOCK_DASHBOARD_TABLES: readonly ["dashboard_tokens", "dashboard_organizations"];
 /** The SECURITY DEFINER functions through which the serving role reaches the dashboard's records. */
-export declare const SLOTLOCK_DASHBOARD_FUNCTIONS: readonly ["slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)", "slotlock.dashboard_session_ended(bytea, timestamptz)"];
+export declare const SLOTLOCK_DASHBOARD_FUNCTIONS: readonly ["slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)", "slotlock.dashboard_session_ended(bytea, timestamptz)", "slotlock.enabled_organizations(text)", "slotlock.enable_organization(text, text, text)", "slotlock.disable_organization(text, text)"];
 /** Live form records one person may leave in the dashboard's records (12 hours of forms). */
 export declare const SLOTLOCK_DASHBOARD_FORM_LIMIT = 1000;
 /** The table that records which release migrated the schema (SLOTLOCK_SCHEMA_VERSION). */
@@ -42,21 +42,49 @@ export declare const SLOTLOCK_SCHEMA_TABLES: readonly ["schema_version"];
 /** The SECURITY DEFINER function through which a server reads the version it is serving. */
 export declare const SLOTLOCK_SCHEMA_FUNCTIONS: readonly ["slotlock.installed_schema_version()"];
 /** The table of suspended tenants: they may read, and write nothing (store.ts withTenant). */
-export declare const SLOTLOCK_TENANT_ADMIN_TABLES: readonly ["tenant_suspensions", "webhook_tenants", "rate_buckets", "assistant_tenants", "maintenance_tenants"];
+export declare const SLOTLOCK_TENANT_ADMIN_TABLES: readonly ["tenant_suspensions", "tenant_plans", "plan_defaults", "usage_daily", "usage_flushes", "usage_cursors", "usage_meter_start", "usage_notices", "overage_reports", "webhook_tenants", "rate_buckets", "assistant_tenants", "maintenance_tenants"];
 /**
  * The SECURITY DEFINER functions through which a server checks a tenant's suspension and erases a
  * tenant, by signature.
  */
-export declare const SLOTLOCK_TENANT_ADMIN_FUNCTIONS: readonly ["slotlock.tenant_suspended(text)", "slotlock.erase_tenant(text)", "slotlock.register_webhook_tenant(text)", "slotlock.webhook_tenants(text)", "slotlock.unregister_webhook_tenant(text)", "slotlock.take_rate_token(text, double precision, double precision)", "slotlock.register_assistant_tenant(text, timestamptz)", "slotlock.sweep_assistant_conversations(integer)", "slotlock.list_maintenance_tenant()", "slotlock.maintenance_tenants(text)"];
+export declare const SLOTLOCK_TENANT_ADMIN_FUNCTIONS: readonly ["slotlock.tenant_suspended(text)", "slotlock.erase_tenant(text)", "slotlock.register_webhook_tenant(text)", "slotlock.webhook_tenants(text)", "slotlock.unregister_webhook_tenant(text)", "slotlock.take_rate_token(text, double precision, double precision)", "slotlock.register_assistant_tenant(text, timestamptz)", "slotlock.sweep_assistant_conversations(integer)", "slotlock.list_maintenance_tenant()", "slotlock.maintenance_tenants(text)", "slotlock.tenant_plan(text)", "slotlock.set_tenant_plan(text, text, text, integer, integer, integer, text, text, timestamptz)", "slotlock.plan_default()", "slotlock.enrol_tenant_plan(text)", "slotlock.record_usage(uuid, jsonb)", "slotlock.roll_up_usage(text, integer)", "slotlock.tenant_usage(text, date, date)", "slotlock.tenant_quota_usage(text, date)", "slotlock.note_usage_threshold(text, date, text, integer, bigint, bigint)", "slotlock.tenant_plan_quotas(text)", "slotlock.reset_test_tenant(text)"];
+/** The functions usage metering runs (SLOTLOCK_USAGE=on): serve checks it may, before it starts. */
+export declare const SLOTLOCK_USAGE_FUNCTIONS: readonly ["slotlock.record_usage(uuid, jsonb)", "slotlock.roll_up_usage(text, integer)", "slotlock.tenant_usage(text, date, date)"];
+/** The functions quotas run (SLOTLOCK_QUOTAS=on, quotas.ts): serve checks it may, before it starts. */
+export declare const SLOTLOCK_QUOTA_FUNCTIONS: readonly ["slotlock.tenant_plan(text)", "slotlock.tenant_quota_usage(text, date)", "slotlock.note_usage_threshold(text, date, text, integer, bigint, bigint)"];
+/** What a plan's monthly quotas count (quotas.ts): operations run and bookings made. */
+export declare const SLOTLOCK_QUOTA_METRICS: readonly ["operations", "bookings"];
+/** The shares of a quota, in percent, at which a tenant is told once a month (usage.threshold_reached). */
+export declare const SLOTLOCK_QUOTA_NOTICE_PERCENTS: readonly [80, 100];
+/** The most bookings past the roll-up cursor one quota read counts: more than any plan allows. */
+export declare const SLOTLOCK_QUOTA_UNROLLED_LIMIT = 100000;
 /**
- * Functions only the deployment role runs: suspending and lifting a suspension. No other role is
- * granted them, so a serving role cannot lift a suspension.
+ * What usage.ts meters, per tenant and day: operations run, bookings and holds committed, webhook
+ * deliveries accepted, messages to the dashboard assistant, and resources held (a count each day, not
+ * a sum).
  */
-export declare const SLOTLOCK_OPERATOR_FUNCTIONS: readonly ["slotlock.suspend_tenant(text, text)", "slotlock.unsuspend_tenant(text)"];
+export declare const SLOTLOCK_USAGE_METRICS: readonly ["operations", "bookings", "holds", "webhook_deliveries", "assistant_messages", "resources"];
+/** The metrics a server counts and records (slotlock.record_usage); the rest the database counts. */
+export declare const SLOTLOCK_RECORDED_USAGE_METRICS: readonly ["operations", "webhook_deliveries", "assistant_messages"];
+/** Days a tenant's daily usage is kept: a yearly plan, and a month for disputes after it. */
+export declare const SLOTLOCK_USAGE_RETENTION_DAYS = 400;
+/**
+ * Functions only the deployment role runs: suspending and lifting a suspension, and setting the
+ * hosted plan every tenant without one of its own is on. No other role is granted them, so a serving
+ * role cannot lift a suspension or change the default plan.
+ */
+export declare const SLOTLOCK_OPERATOR_FUNCTIONS: readonly ["slotlock.suspend_tenant(text, text)", "slotlock.unsuspend_tenant(text)", "slotlock.set_plan_default(text, integer, integer, integer, timestamptz)"];
 /** Every SECURITY DEFINER function the serving role may execute, by signature. */
-export declare const SLOTLOCK_DEFINER_FUNCTIONS: readonly ("slotlock.authenticate_api_key(bytea)" | "slotlock.create_api_key(text, text, text, bytea, text[], timestamptz, text)" | "slotlock.dashboard_session_ended(bytea, timestamptz)" | "slotlock.erase_api_keys(text)" | "slotlock.erase_tenant(text)" | "slotlock.installed_schema_version()" | "slotlock.list_api_keys(text)" | "slotlock.list_maintenance_tenant()" | "slotlock.maintenance_tenants(text)" | "slotlock.register_assistant_tenant(text, timestamptz)" | "slotlock.register_webhook_tenant(text)" | "slotlock.revoke_api_key(text, uuid)" | "slotlock.rotate_api_key(text, uuid, text, bytea)" | "slotlock.sweep_assistant_conversations(integer)" | "slotlock.take_rate_token(text, double precision, double precision)" | "slotlock.tenant_suspended(text)" | "slotlock.unregister_webhook_tenant(text)" | "slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)" | "slotlock.webhook_tenants(text)")[];
+/**
+ * Partner accounts (RFC 0003 part 4): what the serving role may call for a partner key and the
+ * partner API. A partner, its keys and its contract are made by the schema owner (`slotlock partner`).
+ */
+export declare const SLOTLOCK_PARTNER_FUNCTIONS: readonly ["slotlock.partner_tenant_blocked(text)", "slotlock.authenticate_partner_key(bytea)", "slotlock.partner_contract(text)", "slotlock.put_partner_account(text, text, text)", "slotlock.list_partner_accounts(text)", "slotlock.get_partner_account(text, text)", "slotlock.set_partner_account_suspended(text, text, boolean, text)", "slotlock.partner_usage(text, date, date, text)", "slotlock.partner_account_tenant(text, text)", "slotlock.record_partner_reconciliation(text, date, integer, integer, numeric)"];
+/** The partner tables: owner-only, reached through SLOTLOCK_PARTNER_FUNCTIONS. */
+export declare const SLOTLOCK_PARTNER_TABLES: readonly ["partners", "partner_keys", "partner_accounts", "partner_invoices", "partner_month_closes", "partner_erased_usage", "partner_reconciliations"];
+export declare const SLOTLOCK_DEFINER_FUNCTIONS: readonly ("slotlock.authenticate_api_key(bytea)" | "slotlock.authenticate_limited_api_key(bytea)" | "slotlock.authenticate_partner_key(bytea)" | "slotlock.authenticate_scoped_api_key(bytea)" | "slotlock.create_api_key(text, text, text, bytea, text[], timestamptz, text)" | "slotlock.dashboard_session_ended(bytea, timestamptz)" | "slotlock.disable_organization(text, text)" | "slotlock.enable_organization(text, text, text)" | "slotlock.enabled_organizations(text)" | "slotlock.enrol_tenant_plan(text)" | "slotlock.erase_api_keys(text)" | "slotlock.erase_tenant(text)" | "slotlock.get_partner_account(text, text)" | "slotlock.installed_schema_version()" | "slotlock.list_api_key_limits(text)" | "slotlock.list_api_key_resource_scopes(text)" | "slotlock.list_api_keys(text)" | "slotlock.list_maintenance_tenant()" | "slotlock.list_partner_accounts(text)" | "slotlock.maintenance_tenants(text)" | "slotlock.note_usage_threshold(text, date, text, integer, bigint, bigint)" | "slotlock.partner_account_tenant(text, text)" | "slotlock.partner_contract(text)" | "slotlock.partner_tenant_blocked(text)" | "slotlock.partner_usage(text, date, date, text)" | "slotlock.plan_default()" | "slotlock.put_partner_account(text, text, text)" | "slotlock.record_partner_reconciliation(text, date, integer, integer, numeric)" | "slotlock.record_usage(uuid, jsonb)" | "slotlock.register_assistant_tenant(text, timestamptz)" | "slotlock.register_webhook_tenant(text)" | "slotlock.reset_test_tenant(text)" | "slotlock.revoke_api_key(text, uuid)" | "slotlock.roll_up_usage(text, integer)" | "slotlock.rotate_api_key(text, uuid, text, bytea)" | "slotlock.set_api_key_limits(text, uuid, integer, integer, integer, boolean)" | "slotlock.set_api_key_resource_scope(text, uuid, text[], text[])" | "slotlock.set_partner_account_suspended(text, text, boolean, text)" | "slotlock.set_tenant_plan(text, text, text, integer, integer, integer, text, text, timestamptz)" | "slotlock.sweep_assistant_conversations(integer)" | "slotlock.take_rate_token(text, double precision, double precision)" | "slotlock.tenant_plan(text)" | "slotlock.tenant_plan_quotas(text)" | "slotlock.tenant_quota_usage(text, date)" | "slotlock.tenant_suspended(text)" | "slotlock.tenant_usage(text, date, date)" | "slotlock.unregister_webhook_tenant(text)" | "slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)" | "slotlock.webhook_tenants(text)")[];
 /** Tables no role but their owner reads or writes, reached only through SLOTLOCK_DEFINER_FUNCTIONS. */
-export declare const SLOTLOCK_DEFINER_TABLES: readonly ("api_key_retired_digests" | "api_keys" | "assistant_tenants" | "dashboard_tokens" | "maintenance_tenants" | "rate_buckets" | "schema_version" | "tenant_suspensions" | "webhook_tenants")[];
+export declare const SLOTLOCK_DEFINER_TABLES: readonly ("api_key_limits" | "api_key_resource_scopes" | "api_key_retired_digests" | "api_keys" | "assistant_tenants" | "dashboard_organizations" | "dashboard_tokens" | "maintenance_tenants" | "overage_reports" | "partner_accounts" | "partner_erased_usage" | "partner_invoices" | "partner_keys" | "partner_month_closes" | "partner_reconciliations" | "partners" | "plan_defaults" | "rate_buckets" | "schema_version" | "tenant_plans" | "tenant_suspensions" | "usage_cursors" | "usage_daily" | "usage_flushes" | "usage_meter_start" | "usage_notices" | "webhook_tenants")[];
 /**
  * The advisory lock every server transaction for a tenant holds shared (store.ts withTenant), and
  * suspension and erasure take exclusively, keyed by this text's hashtextextended(…, 0).
@@ -88,7 +116,7 @@ export declare const SLOTLOCK_TENANT_CONTEXT_SETTING = "slotlock.tenant_ref";
  * `slotlock.rls_policy_contracts` and `slotlock.deployment_lifted_row_security` are
  * deployment-only and deliberately absent.
  */
-export declare const SLOTLOCK_TENANT_TABLES: readonly ["resources", "reservations", "reservation_tombstones", "reservation_conflict_archive", "calendar_events", "calendar_event_attendees", "calendar_event_reminders", "calendar_event_exceptions", "calendar_event_occurrences", "calendar_event_tombstones", "calendar_event_commands", "calendar_coverage", "hold_commands", "outbox", "outbox_pruned", "webhook_endpoints", "waitlist_entries", "booking_rule_defaults", "assistant_settings", "assistant_conversations"];
+export declare const SLOTLOCK_TENANT_TABLES: readonly ["resources", "reservations", "reservation_tombstones", "reservation_conflict_archive", "calendar_events", "calendar_event_attendees", "calendar_event_reminders", "calendar_event_exceptions", "calendar_event_occurrences", "calendar_event_tombstones", "calendar_event_commands", "calendar_coverage", "hold_commands", "outbox", "outbox_pruned", "webhook_endpoints", "waitlist_entries", "booking_rule_defaults", "assistant_settings", "assistant_conversations", "locations", "resource_groups", "resource_group_members", "pool_settings", "composite_claims", "approval_policies", "approvals"];
 /**
  * Build the grants for the application role: USAGE on the schema, DML on the store's tables and
  * EXECUTE on the API key and dashboard functions, nothing else. The role must not be able to leave
@@ -101,5 +129,16 @@ export declare function createSlotlockApplicationRoleGrantsDdl(role: string): st
  * `slotlock.tenant_ref`; adapters may supply an established transaction-local setting name.
  * Every policy fails closed when the setting is absent or empty, and FORCE binds the table owner.
  */
+/**
+ * The transaction-local setting withTenant sets for a key limited to part of its tenant (RFC 0003
+ * G6): the ids of the resources it reaches, as a uuid[] literal; empty for every other caller.
+ */
+export declare const SLOTLOCK_RESOURCE_SCOPE_SETTING = "slotlock.resource_scope";
+/**
+ * The tables a key limited to part of its tenant is held to, and how each row names its resource:
+ * the resource itself, or the event it belongs to. Tombstones and archives name none and stay as the
+ * tenant policy leaves them.
+ */
+export declare const SLOTLOCK_RESOURCE_SCOPED_TABLES: Readonly<Record<string, string>>;
 export declare function createSlotlockTenantRlsDdl(tenantContextSetting?: string): string;
 export declare const SLOTLOCK_TENANT_RLS_DDL: string;