slotlock 0.6.3 → 0.7.0

package/SECURITY.md

@@ -45,7 +45,10 @@ The [Acceptable Use Policy](ACCEPTABLE-USE.md) permits research within these rul
 Slotlock treats all external calendar content as untrusted. The parser has explicit size, component,
 occurrence, exception, work, and expansion-window bounds. Reservation conflicts are arbitrated by a
 PostgreSQL exclusion constraint. Tenant policies are forced and fail closed when their transaction
-context is missing. Embedding applications remain responsible for authentication, authorization,
+context is missing. A key limited to locations or groups is held to its resources by a second,
+restrictive policy (`resource_scope_v1`) on each table keyed by resource, which can only narrow what
+the tenant policy allows; the deployment check accepts exactly those two policies on those tables
+and the tenant policy alone on the rest. Embedding applications remain responsible for authentication, authorization,
 provider-secret storage, webhook verification, network egress, and erasure.
 
 Upgrading repairs data across tenants (expired holds in a turnaround buffer, duplicate resources,
@@ -163,7 +166,7 @@ it is not an authorization boundary. Scopes and `authorize` decide who may write
 
 ## API keys and the application API
 
-An API key is `slk_`, 40 base62 characters from the operating system's random source (about 238
+An API key is `slk_` (`slk_test_` in a test environment, `<tenant>~test`), 40 base62 characters from the operating system's random source (about 238
 bits) and a 6-character checksum, and the database keeps only its SHA-256. A slow password hash
 (bcrypt, scrypt, Argon2) defends a secret a person chose against offline guessing; nobody can guess
 238 random bits, so a fast hash

package/SPEC.md

@@ -341,7 +341,7 @@ at most 100 active keys and 1,000 in all. The digest of a rotated or erased key
 is never valid again. A server's own bearer token is never `admin`.
 
 A dashboard signs a person in with GitHub, asking for no scope, to the tenant `github:<user id>`,
-and manages that tenant's keys, resources (at most 100) and weekly hours.
+and manages that tenant's keys, resources (at most 500) and weekly hours.
 
 ### Maintenance
 

package/agent-server.d.ts

@@ -1,3 +1,4 @@
+import { z } from 'zod';
 import { type SlotlockTraceContext } from './mcp-modern.js';
 import { type SlotlockApplicationBackend, type SlotlockApplicationOperation } from './application-api.js';
 import { type SlotlockAgentChangeSource } from './change-watch.js';
@@ -38,11 +39,30 @@ export declare const SLOTLOCK_A2A_TASK_PAGE_SIZE: Readonly<{
 }>;
 /** The A2A 1.0 `TaskState` names, as a `ListTasks` status filter spells them in JSON. */
 export declare const SLOTLOCK_A2A_TASK_STATES: readonly ["TASK_STATE_UNSPECIFIED", "TASK_STATE_SUBMITTED", "TASK_STATE_WORKING", "TASK_STATE_COMPLETED", "TASK_STATE_FAILED", "TASK_STATE_CANCELED", "TASK_STATE_INPUT_REQUIRED", "TASK_STATE_REJECTED", "TASK_STATE_AUTH_REQUIRED"];
+/** The tools' copy of the profile's kinds and bounds, for the test that holds it to resource-profile.ts. */
+export declare const SLOTLOCK_AGENT_RESOURCE_PROFILE: Readonly<{
+    kinds: ("desk" | "equipment" | "machine" | "other" | "person" | "room" | "service" | "space" | "vehicle")[];
+    label: z.ZodString;
+    labels: 20;
+    name: 200;
+    groupingRef: z.ZodString;
+    groups: 20;
+}>;
+/** A free time offered with a refusal (RFC 0004 A1): a slot, not a hold. */
+export interface SlotlockAlternative {
+    resource_id: string;
+    start: string;
+    end: string;
+    /** For a bundle or a pool booking: the resources free together then. */
+    resource_ids?: string[];
+}
+/** At most this many alternatives, the earliest first. */
+export declare const SLOTLOCK_MAX_ALTERNATIVES = 3;
 /**
  * Operation (MCP tool / A2A skill) names. They use only `[a-z_]`, so they are valid tool names for the
  * Claude Messages API (`^[a-zA-Z0-9_-]{1,128}$`), OpenAI function calling and every MCP host.
  */
-export type SlotlockAgentOperation = 'slotlock_list_resources' | 'slotlock_get_free_busy' | 'slotlock_find_next_available' | 'slotlock_find_available_slots' | 'slotlock_hold_slots' | 'slotlock_release_slots' | 'slotlock_book_together' | 'slotlock_book_pool' | 'slotlock_get_pool_availability' | 'slotlock_create_event' | 'slotlock_get_event' | 'slotlock_list_events' | 'slotlock_update_event' | 'slotlock_delete_event';
+export type SlotlockAgentOperation = 'slotlock_list_resources' | 'slotlock_get_free_busy' | 'slotlock_find_next_available' | 'slotlock_find_available_slots' | 'slotlock_hold_slots' | 'slotlock_release_slots' | 'slotlock_confirm_slot' | 'slotlock_reschedule' | 'slotlock_cancel' | 'slotlock_book_together' | 'slotlock_book_pool' | 'slotlock_get_pool_availability' | 'slotlock_create_event' | 'slotlock_get_event' | 'slotlock_list_events' | 'slotlock_update_event' | 'slotlock_delete_event';
 /**
  * Names earlier builds published, which every entry point still accepts and dispatches as the same
  * operation; nothing advertises them. The dotted names came first, before tool names had to be
@@ -71,6 +91,36 @@ export interface SlotlockAgentPrincipal {
      * each change the principal makes (`createSlotlockApiKeyAuthenticator` sets it).
      */
     keyId?: string;
+    /**
+     * For a key limited to part of its tenant (RFC 0003 G6), the locations and groups it reaches: a
+     * backend runs its operations with the store's `resourceScope`, so nothing outside is found.
+     */
+    resourceScope?: {
+        readonly locations: readonly string[];
+        readonly groups: readonly string[];
+    };
+    /**
+     * For a key held below the server's limits (RFC 0004 A5): its live holds and held hours (the store
+     * backend lowers the store's caps to them), its requests a minute (`slotlock serve`'s limiter),
+     * and whether its bookings wait for a person (the store backend's approval policies).
+     */
+    limits?: {
+        readonly maxHolds?: number;
+        readonly maxHeldHours?: number;
+        readonly requestsPerMinute?: number;
+        readonly requiresApproval?: boolean;
+    };
+    /**
+     * For a partner key (RFC 0003 P1), its partner: with the `partner` scope, the partner API acts
+     * for this partner's accounts and no other (partners.ts).
+     */
+    partnerId?: string;
+    /**
+     * For a partner key acting for one of its accounts with `Slotlock-Account` (RFC 0003 P3, where the
+     * contract allows it), the partner: the principal is the account's tenant with the contract's key
+     * scopes, and never reaches the partner API.
+     */
+    onBehalfOf?: string;
 }
 export interface SlotlockAgentInvocationContext {
     principal: SlotlockAgentPrincipal;
@@ -86,6 +136,12 @@ export interface SlotlockAgentInvocationContext {
      * to record with its changes (withTenant's `origin`).
      */
     origin?: SlotlockChangeOrigin;
+    /**
+     * A dry run (RFC 0004 A3): make the write with every check, the database's constraints
+     * included, then roll it back, and answer what it would have done. A backend that cannot undo
+     * all it would write refuses with `dry_run_not_supported`.
+     */
+    dryRun?: boolean;
 }
 /** A bounded domain failure a backend may deliberately expose through a protocol tool result. */
 export declare class SlotlockAgentOperationError extends Error {
@@ -119,6 +175,15 @@ export interface SlotlockAgentCalendarBackend {
         name: string | null;
         timezone: string | null;
     } | null>;
+    /**
+     * Optional. The ids of the resources a search selects instead of naming them (RFC 0003 G4): the
+     * principal's shared, unarchived resources that match every criterion given, in a stable order (by
+     * id). More than `limit` is refused with `selection_too_large`, so a search is never silently
+     * partial. Without it, a search by selection answers `selection_not_supported`.
+     */
+    selectResources?(context: SlotlockAgentInvocationContext, selection: SlotlockResourceSelection & {
+        limit: number;
+    }): Promise<string[]>;
     /**
      * Optional. Hold up to five candidate slots for this principal, as alternatives in one group
      * (`slotlock_hold_slots`); a tool without it answers `holds_unavailable`.
@@ -138,6 +203,31 @@ export interface SlotlockAgentCalendarBackend {
     bookTogether?(context: SlotlockAgentInvocationContext, input: Record<string, unknown>): Promise<Record<string, unknown>>;
     /** Optional. Release one of this principal's holds with its group (`slotlock_release_slots`). */
     releaseSlots?(context: SlotlockAgentInvocationContext, input: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /**
+     * Optional. Book the resource and time one of this principal's holds holds, as
+     * `slotlock_create_event` with its `hold_id` does (`slotlock_confirm_slot`), else
+     * `holds_unavailable`.
+     */
+    confirmHold?(context: SlotlockAgentInvocationContext, input: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /**
+     * Optional. Up to `limit` successive free slots of one resource from `start`, each the earliest
+     * after the last one ends, as as many `findNextAvailable` calls would find them, from one read.
+     * `certain` false when coverage is incomplete. `slotlock_find_available_slots` and refusals'
+     * alternatives use it where present.
+     */
+    findNextSlots?(context: SlotlockAgentInvocationContext, input: {
+        resource_id: string;
+        start: string;
+        end: string;
+        duration_minutes: number;
+        limit: number;
+    }): Promise<{
+        slots: {
+            start: string;
+            end: string;
+        }[];
+        certain: boolean;
+    }>;
 }
 /**
  * OAuth 2.0 discovery for the MCP endpoint (MCP 2025-11-25 authorization, RFC 9728). Slotlock only
@@ -286,6 +376,8 @@ export interface SlotlockAgentServerOptions {
     consumeRateLimit?: (args: {
         principal: SlotlockAgentPrincipal;
         operation: SlotlockAgentOperation | 'protocol';
+        /** A dry run of a write: charged as a read (RFC 0004 A3). */
+        dryRun?: boolean;
     }) => Promise<boolean>;
     allowInsecureLocalhost?: boolean;
     maxRequestBytes?: number;
@@ -332,6 +424,22 @@ export interface SlotlockAgentServerOptions {
      * rejects with, is ignored.
      */
     onEvent?: (event: SlotlockAgentServerEvent) => void;
+    /**
+     * For tracing only (otel.ts): called with a call's event and the caller's span from its valid
+     * `traceparent`, so the call's own span can be its child. Kept apart from `onEvent`, whose events
+     * go to logs and never carry the caller's span. A throw is ignored.
+     */
+    onCallTrace?: (event: Extract<SlotlockAgentServerEvent, {
+        type: 'call' | 'rest';
+    }>, trace: {
+        parentSpanId: string;
+    }) => void;
+    /**
+     * Called for each operation a principal ran (MCP, A2A or REST, the application API included), as
+     * it reaches the backend, with the principal: for metering a tenant's use (usage.ts). Unlike
+     * `onEvent`, it names the tenant and key, so it must not feed a public metric. A throw is ignored.
+     */
+    onUsage?: (usage: SlotlockAgentUsage) => void;
     /**
      * Called with a failure no client is told about: an operation's backend threw something other
      * than a `SlotlockAgentOperationError`, or returned a result outside the operation's schema. The
@@ -346,6 +454,17 @@ export interface SlotlockAgentErrorContext {
     /** The operation that failed; `null` when the failure came before one was resolved. */
     operation: SlotlockAgentOperation | SlotlockApplicationOperation | null;
 }
+/**
+ * One operation a principal ran, for usage metering (`onUsage`): reported as it reaches the backend,
+ * once its arguments, scopes, authorization, rate limit and any confirmation have passed, whatever it
+ * then returns. Never its arguments or its result.
+ */
+export interface SlotlockAgentUsage {
+    principal: SlotlockAgentPrincipal;
+    operation: SlotlockAgentOperation | SlotlockApplicationOperation;
+    /** The surface it came through (`library` when the caller named none). */
+    origin: SlotlockChangeOrigin;
+}
 export interface SlotlockAgentOperationDispatchOptions {
     backend: SlotlockAgentCalendarBackend;
     authenticate(request: Request): Promise<SlotlockAgentPrincipal | null>;
@@ -357,6 +476,8 @@ export interface SlotlockAgentOperationDispatchOptions {
     consumeRateLimit?: (args: {
         principal: SlotlockAgentPrincipal;
         operation: SlotlockAgentOperation;
+        /** A dry run of a write: charged as a read (RFC 0004 A3). */
+        dryRun?: boolean;
     }) => Promise<boolean>;
     /**
      * A gate after authorization and the rate limit (so every round of a guarded write is charged):
@@ -373,6 +494,21 @@ export interface SlotlockAgentOperationDispatchOptions {
     } | null>;
     /** As `SlotlockAgentServerOptions.onError`: a failure the result reports only as internal. */
     onError?: (error: unknown, context: SlotlockAgentErrorContext) => void;
+    /** As `SlotlockAgentServerOptions.onUsage`: each operation that reaches the backend. */
+    onUsage?: (usage: SlotlockAgentUsage) => void;
+}
+/** What a search may select resources by, in place of naming them (RFC 0003 G4). */
+export interface SlotlockResourceSelection {
+    /** At this location or one in it. */
+    location?: string;
+    /** In this group. */
+    group?: string;
+    /** With every one of these labels. */
+    labels?: string[];
+    /** Of this kind. */
+    kind?: string;
+    /** In this pool. */
+    pool?: string;
 }
 /** One reason `invalid_arguments` refused a call: where in the arguments, and what is wrong there. */
 export interface SlotlockArgumentIssue {
@@ -390,6 +526,12 @@ export type SlotlockAgentOperationDispatchResult = {
     details?: Readonly<Record<string, string>>;
     /** With `invalid_arguments` from argument validation: the fields it refused. */
     issues?: readonly SlotlockArgumentIssue[];
+    /**
+     * With a refusal another time can answer (`overlap`, `pool_full`, a booking rule): the
+     * earliest free times of the same length, at most three (RFC 0004 A1). Empty when none was
+     * found within seven days.
+     */
+    alternatives?: readonly SlotlockAlternative[];
 };
 /** Runtime type guard for the current operation names (legacy dotted names are not included). */
 export declare function isSlotlockAgentOperation(name: unknown): name is SlotlockAgentOperation;
@@ -428,14 +570,16 @@ export declare function slotlockMcpToolResult(outcome: {
     code: string;
     details?: Readonly<Record<string, string | number | boolean | null>>;
     issues?: readonly SlotlockArgumentIssue[];
+    alternatives?: readonly SlotlockAlternative[];
 }): SlotlockMcpToolResult;
 /** The application operations with their input and output as JSON Schema, as REST serves them. */
 export declare function slotlockApplicationOperations(): {
     name: SlotlockApplicationOperation;
     title: string;
     description: string;
-    method: "DELETE" | "GET" | "POST" | "PUT";
+    method: "DELETE" | "GET" | "PATCH" | "POST" | "PUT";
     path: string;
+    scope?: "partner";
     inputSchema: Readonly<Record<string, unknown>>;
     outputSchema: Readonly<Record<string, unknown>>;
 }[];
@@ -449,13 +593,11 @@ export declare function slotlockOpenApi(options?: {
     application?: boolean;
 }): Record<string, unknown>;
 export declare function slotlockAgentTools(): {
-    name: "slotlock_book_pool" | "slotlock_book_together" | "slotlock_create_event" | "slotlock_delete_event" | "slotlock_find_available_slots" | "slotlock_find_next_available" | "slotlock_get_event" | "slotlock_get_free_busy" | "slotlock_get_pool_availability" | "slotlock_hold_slots" | "slotlock_list_events" | "slotlock_list_resources" | "slotlock_release_slots" | "slotlock_update_event";
-    title: "Book from a pool" | "Book resources together" | "Create resource event" | "Delete resource event" | "Find available slots" | "Find next available interval" | "Get free-busy" | "Get pool availability" | "Get resource event" | "Hold candidate slots" | "List calendar resources" | "List resource events" | "Release held slots" | "Update resource event";
-    description: "Apply an expected-revision event patch and rematerialize occupancy atomically. With expected_resource_id, the resource you read the event on, an event since moved elsewhere is not found." | "Book any one member of a pool (a vehicle class, a room type) for a time: members are tried in a fixed order and the first that is free and allows the booking is booked, in one transaction, so a class sells out exactly at its number of members. The event names the member booked. 409 pool_full when none is free; 404 pool_not_found when the pool has no member you may book. A retry with the same idempotency_key answers the same event." | "Book the same time on 2-20 resources at once, all or none: a van with its driver, a room with its projector. If any of them is taken, nothing is booked, and the refusal names that resource_id. Find such a time with slotlock_find_available_slots and require_free. A retry with the same idempotency_key answers the same events." | "Create an event of up to 3,660 days (a booking, lease or long rental); opaque occurrences use the database overlap arbiter." | "Find the earliest certain interval that satisfies the requested duration (up to the 367-day search window, so a multi-month rental slot can be found)." | "Hold up to five candidate slots for a short time (30-900 seconds) while a person chooses, as alternatives in one group: each free one is held, the others are listed with why not. Book one by passing its hold_id to slotlock_create_event, which releases the rest; unbooked holds expire on their own. A hold is yours alone, and you may have 20 live at once." | "How many members of a pool (a vehicle class, a room type) are free across a window, each only where its booking rules let a booking start: the window split where that number changes, each part with how many are free, and coverage certainty. Book one with slotlock_book_pool. 404 pool_not_found when the pool has no member you may book." | "List bounded events intersecting a time window." | "List resources visible to the authenticated tenant principal, with the pool each belongs to (a vehicle class, a room type). With pool, only that pool's members, in the order slotlock_book_pool tries them." | "List up to `limit` certain slots of the requested duration, earliest first across the resources, each one free of busy time and inside the resource's hours, to offer a person a choice. With require_free, only times when at least that many of the resources are free together, each slot naming them in resource_ids: every resource for a booking that needs them all (book it with slotlock_book_together), or any n of them. No slot is listed unless every resource's coverage is certain." | "Read one tenant-scoped event by stable identifier." | "Release one of your holds, and the rest of its group, at once instead of letting them expire. `released` is false when it was already gone." | "Return privacy-minimized busy intervals and explicit coverage certainty." | "Tombstone an event at an expected revision so stale sync cannot resurrect it.";
-    inputSchema: Readonly<Record<string, unknown>>;
-    outputSchema: Readonly<Record<string, unknown>>;
+    name: "slotlock_book_pool" | "slotlock_book_together" | "slotlock_cancel" | "slotlock_confirm_slot" | "slotlock_create_event" | "slotlock_delete_event" | "slotlock_find_available_slots" | "slotlock_find_next_available" | "slotlock_get_event" | "slotlock_get_free_busy" | "slotlock_get_pool_availability" | "slotlock_hold_slots" | "slotlock_list_events" | "slotlock_list_resources" | "slotlock_release_slots" | "slotlock_reschedule" | "slotlock_update_event";
+    title: "Book from a pool" | "Book resources together" | "Cancel an event" | "Confirm a held slot" | "Create resource event" | "Delete resource event" | "Find available slots" | "Find next available interval" | "Get free-busy" | "Get pool availability" | "Get resource event" | "Hold candidate slots" | "List calendar resources" | "List resource events" | "Release held slots" | "Reschedule an event" | "Update resource event";
+    description: "Book a resource for a time, as an event of up to 3,660 days (a booking, lease or long rental). The database refuses a time already taken: 409 overlap, with alternatives (the earliest free times of the same length) and, when the booking in the way is yours, its id. A booking rule that refuses the time answers booking_rule_… with alternatives too. To book a time you hold, pass its hold_id, or use slotlock_confirm_slot. A retry with the same idempotency_key answers the same event." | "Book a time you hold (a hold_id from slotlock_hold_slots): the held resource and time exactly, with the title and details you give, and the rest of its group released. 409 hold_expired when the hold lapsed first; 404 hold_not_found when it was released, booked or is not yours. A retry answers the same event (replayed)." | "Book any one member of a pool (a vehicle class, a room type) for a time: members are tried in the pool's order (by id, fewest bookings in the last 30 days first, or in turn, as the tenant sets it) and the first that is free and allows the booking is booked, in one transaction, so a class sells out exactly at its number of members. The event names the member booked. 409 pool_full when none is free; 404 pool_not_found when the pool has no member you may book. A retry with the same idempotency_key answers the same event." | "Book the same time on 2-20 resources at once, all or none: a van with its driver, a room with its projector. If any of them is taken, nothing is booked, and the refusal names that resource_id. Find such a time with slotlock_find_available_slots and require_free. A retry with the same idempotency_key answers the same events." | "Cancel one of your events at the revision you last read (expected_revision); a stale one is 409 revision_conflict. It cannot come back at that revision, so an old copy synced later does not restore it. slotlock_cancel does the same with fewer fields." | "Cancel one of your events at the revision you last read (expected_revision); a stale one is 409 revision_conflict. Its time is free at once. A retry answers the same cancellation (replayed)." | "Change one of your events at the revision you last read (expected_revision): its time, resource or details, all or nothing. A time already taken is 409 overlap with alternatives; a stale revision is 409 revision_conflict (read the event again). With expected_resource_id, the resource you read it on, an event since moved elsewhere is not found. To change only the time, slotlock_reschedule is simpler." | "Find the earliest certain interval that satisfies the requested duration (up to the 367-day search window, so a multi-month rental slot can be found). Name the resources with resource_ids, or select them as slotlock_get_free_busy does: at most 100." | "Hold up to five candidate slots for a short time (30-900 seconds) while a person chooses, as alternatives in one group: each free one is held, the others are listed with why not. Book one by passing its hold_id to slotlock_create_event, which releases the rest; unbooked holds expire on their own. A hold is yours alone, and you may have 20 live at once. A candidate refused for its time comes with alternatives (the earliest free times of its length). slotlock_confirm_slot books a held time." | "How many members of a pool (a vehicle class, a room type) are free across a window, each only where its booking rules let a booking start: the window split where that number changes, each part with how many are free, and coverage certainty. Book one with slotlock_book_pool. 404 pool_not_found when the pool has no member you may book." | "List resources visible to the authenticated tenant principal, with what each says about itself: its name (show it rather than the reference), description, kind, capacity and labels, where it is (location), the groups it is in (a team, a department), and the pool it belongs to (a vehicle class, a room type). With kind, only resources of that kind; with labels, only those with every label given; with location, only those there or at a location in it; with group, only that group's. With pool, only that pool's members, in the order slotlock_book_pool tries them." | "List up to `limit` certain slots of the requested duration, earliest first across the resources, each one free of busy time and inside the resource's hours, to offer a person a choice. With require_free, only times when at least that many of the resources are free together, each slot naming them in resource_ids: every resource for a booking that needs them all (book it with slotlock_book_together), or any n of them. No slot is listed unless every resource's coverage is certain. Name the resources with resource_ids, or select them as slotlock_get_free_busy does: at most 20." | "List your events that meet a time window, earliest first." | "Move one of your events to a new time, and to another resource if you give one, at the revision you last read (expected_revision). A time already taken is 409 overlap with alternatives; a stale revision 409 revision_conflict. A retry answers the same move (replayed)." | "Read one of your events by its id, with its revision (pass it as expected_revision to change or cancel it)." | "Release one of your holds, and the rest of its group, at once instead of letting them expire. `released` is false when it was already gone." | "When each resource is busy in a window, as busy intervals only (never whose or what), and whether that is certain (coverage: \"uncertain\" where a calendar feeding it has not been read lately). Name the resources with resource_ids, or select them instead by location (and every location in it), group, labels (every one), kind or pool: at most 100 (more answers selection_too_large, none selection_empty), named in selected_resource_ids.";
     annotations: {
-        title: "Book from a pool" | "Book resources together" | "Create resource event" | "Delete resource event" | "Find available slots" | "Find next available interval" | "Get free-busy" | "Get pool availability" | "Get resource event" | "Hold candidate slots" | "List calendar resources" | "List resource events" | "Release held slots" | "Update resource event";
+        title: "Book from a pool" | "Book resources together" | "Cancel an event" | "Confirm a held slot" | "Create resource event" | "Delete resource event" | "Find available slots" | "Find next available interval" | "Get free-busy" | "Get pool availability" | "Get resource event" | "Hold candidate slots" | "List calendar resources" | "List resource events" | "Release held slots" | "Reschedule an event" | "Update resource event";
         readOnlyHint: boolean;
         destructiveHint: boolean;
         idempotentHint: true;
@@ -472,7 +614,17 @@ export declare function slotlockAgentTools(): {
             visibility: readonly ["model"];
         };
     };
+    inputSchema: Readonly<Record<string, unknown>>;
+    outputSchema: Readonly<Record<string, unknown>>;
 }[];
+/**
+ * A write's input and output schemas with `dry_run` (RFC 0004 A3): an optional flag in, and
+ * `dry_run: true` on a dry run's answer. Other operations' are as they are.
+ */
+export declare function slotlockDryRunSchemas(dryRunnable: boolean, inputSchema: Readonly<Record<string, unknown>>, outputSchema: Readonly<Record<string, unknown>>): {
+    inputSchema: Readonly<Record<string, unknown>>;
+    outputSchema: Readonly<Record<string, unknown>>;
+};
 /**
  * Canonical transport-neutral operation boundary. Every host shares the package's schemas,
  * principal validation, authorization, per-operation limiter and bounded backend error mapping.