slotlock 0.6.3 → 0.7.0

package/agent-store-backend.js

@@ -1,6 +1,9 @@
+import { SLOTLOCK_RESOURCE_PROFILE_FIELDS, SLOTLOCK_RECONCILE_TOLERANCE_PERCENT, slotlockResourceHasLabels, } from './resource-profile.js';
+import { SLOTLOCK_USAGE_RETENTION_DAYS, slotlockUsageDay, slotlockUsageMonthToDate, slotlockUsageSpanDays, summarizeSlotlockUsage, } from './usage.js';
 import { slotlockChangeFeedHead } from './event-feed.js';
 import { slotlockCloudEvent } from './webhooks.js';
 import { createHash } from 'node:crypto';
+import { SLOTLOCK_DEFAULT_APPROVAL_MINUTES, SLOTLOCK_KEY_APPROVAL_POLICY, SLOTLOCK_MAX_APPROVAL_MINUTES, SlotlockApprovalPolicyError, } from './approvals.js';
 import { SlotlockAgentOperationError, } from './agent-server.js';
 import { bookingSearch, bookingSearchBlocked, bookingSearchReach, } from './booking-rules.js';
 import { findNextAvailable, mergeIntervals } from './engine.js';
@@ -8,12 +11,40 @@ import { expandRules } from './rules.js';
 import { emitVAvailability, parseVAvailability, toJSCalendarEvent } from './interop.js';
 import { calendarEventRollingHorizon, } from './store.js';
 import { maintainSlotlockTenant } from './maintenance.js';
+import { fastForwardSlotlockSandbox, raceSlotlockSandbox, resetSlotlockSandbox, seedSlotlockSandbox, } from './sandbox.js';
+import { SLOTLOCK_TEST_TENANT_SUFFIX } from './api-keys.js';
+import { slotlockPartnerKeyOutput, slotlockPrincipalPartner, } from './partners.js';
+/** A partner's account as the partner API shows it. */
+function partnerAccountOutput(account) {
+    return {
+        account: account.account,
+        plan: account.plan,
+        status: account.status,
+        created_at: account.createdAt.toISOString(),
+        updated_at: account.updatedAt.toISOString(),
+        ...(account.resources !== undefined ? { resources: account.resources } : {}),
+        ...(account.apiKeys !== undefined ? { api_keys: account.apiKeys } : {}),
+    };
+}
 import { parseAvailabilityRules } from './weekly-hours.js';
 /**
  * Writes run under READ COMMITTED whatever the role's default: tenant limits are counted under a
  * lock that needs that level.
  */
 const WRITE = { isolation: 'read committed' };
+/**
+ * Keys a context carries only from inside this module: a request cannot set a symbol, and spreading
+ * a context (`{ ...context, operation }`) keeps them.
+ */
+const APPROVAL_GRANT = Symbol('slotlock.approvalGrant');
+const OCCUPANCY_PROBE = Symbol('slotlock.occupancyProbe');
+/** Thrown out of a dry run's transaction, with its answer, so the transaction rolls back. */
+class DryRunRollback {
+    value;
+    constructor(value) {
+        this.value = value;
+    }
+}
 // The UUIDs withTenant takes as a keyId (versions 1-5); any other from a custom authenticator is
 // left out, not refused.
 const KEY_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -35,15 +66,51 @@ async function withTenant(store, context, callback, options) {
     try {
         const actor = actorOf(context);
         const keyId = context.principal.keyId;
-        value = await store.withTenant(context.principal.tenantRef, callback, {
+        // A granted approval's write: its holds give way and it is marked granted in the same
+        // transaction, so the time passes from the approval to the booking with no gap between.
+        const grant = context[APPROVAL_GRANT];
+        const write = grant
+            ? async (tenantStore) => {
+                const tenantRef = context.principal.tenantRef;
+                const begun = await tenantStore.beginApprovalGrant({ tenantRef, id: grant.id });
+                if (!begun.ok) {
+                    throw new SlotlockAgentOperationError(begun.code, begun.code === 'approval_not_found' ? 404 : 409);
+                }
+                const value = await callback(tenantStore);
+                const booked = value.event?.resource_id;
+                if (grant.pool !== undefined && typeof booked === 'string') {
+                    await tenantStore.notePoolBooking({ tenantRef, pool: grant.pool, resourceId: booked });
+                }
+                await tenantStore.finishApprovalGrant({ tenantRef, id: grant.id, decidedBy: grant.decidedBy });
+                return value;
+            }
+            : callback;
+        // A dry run's transaction does everything, constraints included, then is undone: its answer
+        // is carried out of it by the rollback.
+        const probe = context[OCCUPANCY_PROBE];
+        const run = context.dryRun
+            ? async (tenantStore) => {
+                const value = await write(tenantStore);
+                if (probe)
+                    await probe(tenantStore);
+                throw new DryRunRollback(value);
+            }
+            : write;
+        value = await store.withTenant(context.principal.tenantRef, run, {
             ...options,
             signal: context.signal,
             ...(actor !== undefined ? { actor } : {}),
             ...(context.origin !== undefined ? { origin: context.origin } : {}),
             ...(typeof keyId === 'string' && KEY_ID.test(keyId) ? { keyId } : {}),
+            // A key limited to part of the tenant reaches only its resources, by the database's policies.
+            ...(context.principal.resourceScope ? { resourceScope: context.principal.resourceScope } : {}),
         });
     }
     catch (error) {
+        if (error instanceof DryRunRollback) {
+            assertActive(context);
+            return error.value;
+        }
         const code = error?.code;
         // A suspended tenant may read; a write it asks for is forbidden, not a server failure.
         if (code === 'tenant_suspended')
@@ -240,15 +307,38 @@ const BOOKING_RULE_CODES = Object.freeze({
     outside_hours: 'booking_rule_outside_hours',
     uncertain: 'booking_rule_uncertain',
 });
-function operationError(refusal) {
+function operationError(refusal, details) {
     const code = typeof refusal === 'string'
         ? refusal
         : refusal.code === 'booking_rule_violated' && refusal.rule
             ? (BOOKING_RULE_CODES[refusal.rule] ?? refusal.code)
             : refusal.code;
     const status = slotlockAgentErrorStatus(code);
-    // A gone hold (expired or another holder's) is named, so the agent holds again.
-    return new SlotlockAgentOperationError(status === 404 && code !== 'hold_not_found' ? 'not_found' : code, status);
+    // A gone hold (another holder's, released or reaped) is named, so the agent holds again.
+    return new SlotlockAgentOperationError(status === 404 && code !== 'hold_not_found' ? 'not_found' : code, status, details);
+}
+/**
+ * What an agent may be told about the booking in the way of its write: when that time is busy
+ * (as free/busy shows anyone who may read the resource), and the booking itself only when it is
+ * the agent's own hold or event, so it can release or move it. Nothing for another refusal, or for
+ * a booking the key may not see (its scope, or another tenant's).
+ */
+async function overlapDetails(tenantStore, context, refusal) {
+    if (refusal.code !== 'overlap' || typeof refusal.conflictingReservationId !== 'string')
+        return {};
+    const booking = await tenantStore.describeBooking({
+        tenantRef: context.principal.tenantRef,
+        id: refusal.conflictingReservationId,
+    });
+    if (!booking)
+        return {};
+    const owner = agentOwnerRef(context);
+    return {
+        busy_start: booking.start.toISOString(),
+        busy_end: booking.end.toISOString(),
+        ...(booking.status === 'held' && booking.holderRef === owner ? { conflicting_hold_id: booking.id } : {}),
+        ...(booking.eventRef !== null && booking.eventOwnerRef === owner ? { conflicting_event_id: booking.eventRef } : {}),
+    };
 }
 /** Resource and event ids: the UUIDs the store issues and validates. */
 const STORE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -329,11 +419,22 @@ export function createSlotlockStoreChangeSource(store, sql) {
 }
 /** Bind the protocol server to the production store without giving a request control of tenancy. */
 export function createSlotlockStoreAgentBackend(store, options) {
-    return {
+    const maxApprovalMinutes = options.maxApprovalMinutes ?? SLOTLOCK_MAX_APPROVAL_MINUTES;
+    if (!(Number.isSafeInteger(maxApprovalMinutes) && maxApprovalMinutes >= 1 && maxApprovalMinutes <= SLOTLOCK_MAX_APPROVAL_MINUTES)) {
+        throw new RangeError(`maxApprovalMinutes must be a whole number from 1 to ${SLOTLOCK_MAX_APPROVAL_MINUTES}`);
+    }
+    const backend = {
         async holdSlots(context, input) {
             const slots = input.slots;
             const key = input.idempotency_key;
             const holderRef = agentOwnerRef(context);
+            const limits = context.principal.limits;
+            const holderCaps = limits?.maxHolds !== undefined || limits?.maxHeldHours !== undefined
+                ? {
+                    ...(limits.maxHolds !== undefined ? { maxHolds: limits.maxHolds } : {}),
+                    ...(limits.maxHeldHours !== undefined ? { maxHeldHours: limits.maxHeldHours } : {}),
+                }
+                : undefined;
             // One group per agent and key, so a retry answers with the same holds and group.
             const groupId = uuidFromDigest(`slotlock-hold-group\0${holderRef}\0${key}`);
             return withTenant(store, context, async (tenantStore) => {
@@ -360,6 +461,8 @@ export function createSlotlockStoreAgentBackend(store, options) {
                         end: new Date(slot.end),
                         ttlMs: input.ttl_seconds * 1_000,
                         source: 'agent-server',
+                        // The key's own caps, below the server's (RFC 0004 A5).
+                        ...(holderCaps ? { holderCaps } : {}),
                     });
                     if (result.ok) {
                         holds.push({
@@ -419,15 +522,24 @@ export function createSlotlockStoreAgentBackend(store, options) {
                         throw operationError(replay);
                     return answer(replay);
                 }
-                const members = await tenantStore.listPoolMembers({ tenantRef, pool: input.pool, visibility: 'shared' });
+                // In the pool's order (stable, least booked first, or round robin).
+                const members = await tenantStore.listPoolMembers({
+                    tenantRef,
+                    pool: input.pool,
+                    visibility: 'shared',
+                    ordered: true,
+                    forBooking: true,
+                });
                 if (members.length === 0)
                     throw new SlotlockAgentOperationError('pool_not_found', 404);
                 // Each member in turn, each in its own savepoint: one taken or refused by its rules is
                 // passed over; the exclusion constraint still decides.
                 for (const member of members) {
                     const result = await put(member.id);
-                    if (result.ok)
+                    if (result.ok) {
+                        await tenantStore.notePoolBooking({ tenantRef, pool: input.pool, resourceId: member.id });
                         return answer(result);
+                    }
                     if (result.code !== 'overlap' && result.code !== 'booking_rule_violated') {
                         throw operationError(result);
                     }
@@ -572,7 +684,10 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     // Thrown, so the whole transaction rolls back with the events already put.
                     if (!result.ok) {
                         const refusal = operationError(result);
-                        throw new SlotlockAgentOperationError(refusal.code, refusal.status, { resource_id: resourceId });
+                        throw new SlotlockAgentOperationError(refusal.code, refusal.status, {
+                            resource_id: resourceId,
+                            ...(await overlapDetails(tenantStore, context, result)),
+                        });
                     }
                     const created = await tenantStore.getCalendarEvent({
                         tenantRef: context.principal.tenantRef,
@@ -587,6 +702,61 @@ export function createSlotlockStoreAgentBackend(store, options) {
                 return { events, replayed };
             }, WRITE);
         },
+        async confirmHold(context, rawInput) {
+            const input = rawInput;
+            // The holder's own hold, lapsed or live, and its resource's zone; then the booking exactly
+            // as create_event with its hold_id makes it, which judges the hold again under its lock.
+            const found = await withTenant(store, context, async (tenantStore) => {
+                const held = await tenantStore.getHolderHold({
+                    tenantRef: context.principal.tenantRef,
+                    holdId: input.hold_id,
+                    holderRef: agentOwnerRef(context),
+                });
+                if (!held)
+                    return null;
+                const resource = await requireAgentResource(tenantStore, context.principal.tenantRef, held.hold.resourceId);
+                return { ...held, timezone: resource.timezone };
+            });
+            if (!found) {
+                // Booked already: a retry answers the event this key made (the store compares the
+                // request, so another one with the same key is idempotency_conflict).
+                const booked = await withTenant(store, context, (tenantStore) => tenantStore.getCalendarEvent({
+                    tenantRef: context.principal.tenantRef,
+                    ownerRef: agentOwnerRef(context),
+                    externalRef: agentExternalRef(context, input.idempotency_key),
+                }));
+                if (!booked)
+                    throw new SlotlockAgentOperationError('hold_not_found', 404);
+                return this.createEvent({ ...context, operation: 'slotlock_create_event' }, {
+                    resource_id: booked.resourceId,
+                    starts_at: booked.start.toISOString(),
+                    ends_at: booked.end.toISOString(),
+                    timezone: input.timezone ?? booked.timezone,
+                    ...(input.title !== undefined ? { title: input.title } : {}),
+                    ...(input.description !== undefined ? { description: input.description } : {}),
+                    ...(input.location !== undefined ? { location: input.location } : {}),
+                    transparency: 'opaque',
+                    status: 'confirmed',
+                    hold_id: input.hold_id,
+                    idempotency_key: input.idempotency_key,
+                });
+            }
+            if (!found.live)
+                throw new SlotlockAgentOperationError('hold_expired', 409);
+            return this.createEvent({ ...context, operation: 'slotlock_create_event' }, {
+                resource_id: found.hold.resourceId,
+                starts_at: found.hold.start.toISOString(),
+                ends_at: found.hold.end.toISOString(),
+                timezone: input.timezone ?? found.timezone,
+                ...(input.title !== undefined ? { title: input.title } : {}),
+                ...(input.description !== undefined ? { description: input.description } : {}),
+                ...(input.location !== undefined ? { location: input.location } : {}),
+                transparency: 'opaque',
+                status: 'confirmed',
+                hold_id: input.hold_id,
+                idempotency_key: input.idempotency_key,
+            });
+        },
         async releaseSlots(context, input) {
             const id = input.hold_id;
             if (!STORE_ID_PATTERN.test(id))
@@ -596,7 +766,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
                 holderRef: agentOwnerRef(context),
             }).then(({ released }) => ({ released })));
             if (result.released)
-                await offerFreedTime(store, context.principal.tenantRef);
+                await offerFreedTime(store, context);
             return result;
         },
         async describeResource(context, resourceId) {
@@ -608,28 +778,87 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     id: resourceId,
                     visibility: 'shared',
                 });
+                // Its profile's name when it has one, as a person reading a confirmation knows it.
                 return resource
-                    ? { name: resource.externalRef ?? null, timezone: resource.timezone }
+                    ? { name: resource.name ?? resource.externalRef ?? null, timezone: resource.timezone }
                     : null;
             });
         },
+        async selectResources(context, selection) {
+            return withTenant(store, context, async (tenantStore) => {
+                let resources;
+                try {
+                    // Shared and in use, as an agent may search them, in the store's stable order.
+                    resources = await tenantStore.listResources({
+                        tenantRef: context.principal.tenantRef,
+                        visibility: 'shared',
+                        limit: selection.limit + 1,
+                        ...(selection.kind !== undefined ? { kind: selection.kind } : {}),
+                        ...(selection.labels !== undefined ? { labels: selection.labels } : {}),
+                        ...(selection.location !== undefined ? { location: selection.location } : {}),
+                        ...(selection.group !== undefined ? { group: selection.group } : {}),
+                        ...(selection.pool !== undefined ? { pool: selection.pool } : {}),
+                    });
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+                if (resources.length > selection.limit) {
+                    throw new SlotlockAgentOperationError('selection_too_large', 400, { limit: String(selection.limit) });
+                }
+                return resources.map((resource) => resource.id);
+            });
+        },
         async listResources(context, input) {
             const cursor = parseResourceCursor(input.cursor);
+            const kind = input.kind;
+            const labels = input.labels;
+            const location = input.location;
+            const group = input.group;
+            // What a resource says about itself, for an agent to show and choose by; its attributes are
+            // the integrator's, and stay on the application API.
             const output = (resource) => ({
                 id: resource.id,
                 external_ref: resource.externalRef,
                 timezone: resource.timezone,
                 ...(resource.pool !== undefined ? { pool: resource.pool } : {}),
+                ...(resource.name !== undefined ? { name: resource.name } : {}),
+                ...(resource.description !== undefined
+                    ? {
+                        description: [...resource.description].length > 500
+                            ? `${[...resource.description].slice(0, 500).join('')}…`
+                            : resource.description,
+                    }
+                    : {}),
+                ...(resource.kind !== undefined ? { kind: resource.kind } : {}),
+                ...(resource.capacity !== undefined ? { capacity: resource.capacity } : {}),
+                ...(resource.labels !== undefined ? { labels: resource.labels } : {}),
+                ...(resource.location !== undefined
+                    ? { location: { ref: resource.location, name: resource.locationName ?? resource.location } }
+                    : {}),
+                ...(resource.groups !== undefined ? { groups: resource.groups } : {}),
+                ...(resource.parentId !== undefined ? { part_of: resource.parentId } : {}),
             });
             if (typeof input.pool === 'string') {
-                return withTenant(store, context, async (tenantStore) => ({
-                    resources: (await tenantStore.listPoolMembers({
-                        tenantRef: context.principal.tenantRef,
-                        pool: input.pool,
-                        visibility: 'shared',
-                    })).map(output),
-                    next_cursor: null,
-                }));
+                return withTenant(store, context, async (tenantStore) => {
+                    // A pool's members are filtered here: a location filter takes the locations under it.
+                    const places = location === undefined
+                        ? null
+                        : locationAndBelow(await tenantStore.listLocations({ tenantRef: context.principal.tenantRef }), location);
+                    return {
+                        resources: (await tenantStore.listPoolMembers({
+                            tenantRef: context.principal.tenantRef,
+                            pool: input.pool,
+                            visibility: 'shared',
+                        }))
+                            .filter((resource) => (kind === undefined || (resource.kind ?? 'other') === kind) &&
+                            (labels === undefined || slotlockResourceHasLabels(resource.labels, labels)) &&
+                            (places === null || (resource.location !== undefined && places.has(resource.location))) &&
+                            (group === undefined || resource.groups?.includes(group) === true))
+                            .map(output),
+                        next_cursor: null,
+                    };
+                });
             }
             return withTenant(store, context, async (tenantStore) => {
                 const limit = input.limit;
@@ -638,6 +867,10 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     visibility: 'shared',
                     limit: limit + 1,
                     ...(cursor !== undefined ? { after: cursor } : {}),
+                    ...(kind !== undefined ? { kind } : {}),
+                    ...(labels !== undefined ? { labels } : {}),
+                    ...(location !== undefined ? { location } : {}),
+                    ...(group !== undefined ? { group } : {}),
                 });
                 const page = resources.slice(0, limit);
                 return {
@@ -677,6 +910,53 @@ export function createSlotlockStoreAgentBackend(store, options) {
                 return { resources };
             });
         },
+        async findNextSlots(context, input) {
+            const window = interval(input);
+            const durationMs = input.duration_minutes * 60_000;
+            const charge = busyBudget();
+            return withTenant(store, context, async (tenantStore) => {
+                const resource = await requireAgentResource(tenantStore, context.principal.tenantRef, input.resource_id);
+                const search = bookingSearch({
+                    rules: resource.effectiveBookingRules,
+                    timezone: resource.timezone,
+                    window,
+                    now: new Date(),
+                });
+                const sources = await requiredSources(options, context, resource);
+                const freeBusy = await readFreeBusy(tenantStore, {
+                    tenantRef: context.principal.tenantRef,
+                    resourceId: input.resource_id,
+                    window: search ? bookingSearchReach({ ...search, window }) : window,
+                    requiredSources: [...sources],
+                    ...(options.coverageMaxAgeMs !== undefined ? { coverageMaxAgeMs: options.coverageMaxAgeMs } : {}),
+                });
+                charge(freeBusy.busy.length);
+                if (freeBusy.coverage.state !== 'complete')
+                    return { slots: [], certain: false };
+                if (!search)
+                    return { slots: [], certain: true };
+                const rules = resource.availabilityRules ?? (await options.availabilityRules(context, resource));
+                const windows = expandRules(rules, search.window, resource.timezone);
+                if (windows.length > MAX_REQUEST_RULE_WINDOWS)
+                    throw new SlotlockAgentOperationError('calendar_work_limit', 400);
+                const busy = bookingSearchBlocked(freeBusy.busy, search);
+                // Each next slot as a search from where the last one ended would find it: the same busy
+                // time and hours, with the hours before that end left out.
+                const slots = [];
+                let from = search.window.start.getTime();
+                while (slots.length < input.limit) {
+                    const open = windows
+                        .map((hours) => ({ start: new Date(Math.max(hours.start.getTime(), from)), end: hours.end }))
+                        .filter((hours) => hours.end.getTime() - hours.start.getTime() >= durationMs);
+                    const found = findNextAvailable({ busy, windows: open, durationMs, ...(search.align ? { align: search.align } : {}) });
+                    if (!found)
+                        break;
+                    slots.push({ start: found.start.toISOString(), end: found.end.toISOString() });
+                    from = found.end.getTime();
+                }
+                return { slots, certain: true };
+            });
+        },
         async findNextAvailable(context, input) {
             const window = interval(input);
             const resourceIds = distinctResourceIds(input);
@@ -788,7 +1068,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
                         : {}),
                 });
                 if (!result.ok)
-                    throw operationError(result);
+                    throw operationError(result, await overlapDetails(tenantStore, context, result));
                 const created = await tenantStore.getCalendarEvent({
                     tenantRef: context.principal.tenantRef,
                     ownerRef: agentOwnerRef(context),
@@ -926,7 +1206,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     enforceBookingRules: true,
                 });
                 if (!result.ok)
-                    throw operationError(result);
+                    throw operationError(result, await overlapDetails(tenantStore, context, result));
                 const updated = await tenantStore.getCalendarEvent({
                     tenantRef: context.principal.tenantRef,
                     ownerRef: agentOwnerRef(context),
@@ -937,7 +1217,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
                 return { event: projectSlotlockCalendarEvent(updated), replayed: result.idempotent };
             }, WRITE);
             if (!moved.replayed)
-                await offerFreedTime(store, context.principal.tenantRef);
+                await offerFreedTime(store, context);
             return moved;
         },
         async deleteEvent(context, input) {
@@ -948,13 +1228,13 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     ownerRef: agentOwnerRef(context),
                     externalRef,
                 });
-                if (!current)
-                    throw new SlotlockAgentOperationError('event_not_found', 404);
+                // Gone already: a retry of a cancellation that succeeded, answered from its key, or
+                // event_not_found from the store when there was none.
                 const result = await tenantStore.cancelCalendarEvent({
                     tenantRef: context.principal.tenantRef,
                     ownerRef: agentOwnerRef(context),
                     externalRef,
-                    expectedResourceId: current.resourceId,
+                    ...(current ? { expectedResourceId: current.resourceId } : {}),
                     idempotencyKey: agentCommandIdempotencyKey(context, input.idempotency_key),
                     expectedRevision: input.expected_revision,
                 });
@@ -968,18 +1248,39 @@ export function createSlotlockStoreAgentBackend(store, options) {
                 };
             }, WRITE);
             if (!deleted.replayed)
-                await offerFreedTime(store, context.principal.tenantRef);
+                await offerFreedTime(store, context);
             return deleted;
         },
     };
+    return withApprovalPolicies(store, options, maxApprovalMinutes, backend);
 }
 function storeRefusal(error) {
     const code = error?.code;
     if (typeof code !== 'string')
         return error;
+    if (code === 'invalid_resource_profile' || code === 'invalid_location' || code === 'invalid_group') {
+        // Which field, so a client can say what to change.
+        const field = error.field;
+        return new SlotlockAgentOperationError(code, 400, typeof field === 'string' ? { field } : undefined);
+    }
+    if (code === 'location_not_found' || code === 'group_not_found' || code === 'resource_not_found' || code === 'parent_not_found') {
+        return new SlotlockAgentOperationError(code, 404);
+    }
+    if (code === 'location_in_use' ||
+        code === 'location_too_deep' ||
+        code === 'location_cycle' ||
+        code === 'location_limit_reached' ||
+        code === 'group_limit_reached' ||
+        code === 'resource_group_limit_reached') {
+        return new SlotlockAgentOperationError(code, 409);
+    }
     if (code === 'resource_limit_reached' ||
         code === 'resource_visibility_conflict' ||
-        code === 'pool_rules_limit_reached') {
+        code === 'pool_rules_limit_reached' ||
+        code === 'pool_order_limit_reached' ||
+        code === 'composite_too_deep' ||
+        code === 'composite_parts_limit' ||
+        code === 'composite_busy') {
         return new SlotlockAgentOperationError(code, 409);
     }
     if (code.startsWith('invalid_') && code !== 'invalid_transaction_isolation') {
@@ -987,6 +1288,88 @@ function storeRefusal(error) {
     }
     return error;
 }
+/** A key's limits as the API takes them (snake_case), as the key store takes them. */
+function keyLimitsFromInput(value) {
+    const given = value;
+    return {
+        ...(given.max_holds !== undefined ? { maxHolds: given.max_holds } : {}),
+        ...(given.max_held_hours !== undefined ? { maxHeldHours: given.max_held_hours } : {}),
+        ...(given.requests_per_minute !== undefined ? { requestsPerMinute: given.requests_per_minute } : {}),
+        ...(given.requires_approval === true ? { requiresApproval: true } : {}),
+    };
+}
+/** A sandbox refusal as the API answers it: 403 for a live tenant, 409 for one not empty. */
+function sandboxRefusal(error) {
+    const code = error?.code;
+    if (code === 'sandbox_test_only')
+        return new SlotlockAgentOperationError(code, 403);
+    if (code === 'sandbox_not_empty')
+        return new SlotlockAgentOperationError(code, 409);
+    return error;
+}
+/** An approval decision refused: 404 for none, 409 for one decided or past its wait. */
+function approvalRefusal(code) {
+    return new SlotlockAgentOperationError(code, code === 'approval_not_found' ? 404 : 409);
+}
+function approvalPolicyOutput(policy) {
+    const applies = policy.appliesTo;
+    const conditions = policy.conditions;
+    return {
+        policy_ref: policy.ref,
+        name: policy.name,
+        applies_to: {
+            ...(applies.resourceIds ? { resource_ids: applies.resourceIds } : {}),
+            ...(applies.pools ? { pools: applies.pools } : {}),
+            ...(applies.locations ? { locations: applies.locations } : {}),
+            ...(applies.groups ? { groups: applies.groups } : {}),
+        },
+        conditions: {
+            ...(conditions.longerThanMinutes !== undefined ? { longer_than_minutes: conditions.longerThanMinutes } : {}),
+            ...(conditions.outsideHours !== undefined ? { outside_hours: conditions.outsideHours } : {}),
+            ...(conditions.kinds ? { kinds: conditions.kinds } : {}),
+        },
+        outcome: policy.outcome,
+        approval_ttl_minutes: policy.approvalTtlMinutes,
+        lead_minutes: policy.leadMinutes,
+        created_at: policy.createdAt.toISOString(),
+        updated_at: policy.updatedAt.toISOString(),
+    };
+}
+function approvalAppliesTo(value) {
+    const given = value;
+    return {
+        ...(given.resource_ids ? { resourceIds: given.resource_ids } : {}),
+        ...(given.pools ? { pools: given.pools } : {}),
+        ...(given.locations ? { locations: given.locations } : {}),
+        ...(given.groups ? { groups: given.groups } : {}),
+    };
+}
+function approvalConditions(value) {
+    const given = value;
+    return {
+        ...(given.longer_than_minutes !== undefined ? { longerThanMinutes: given.longer_than_minutes } : {}),
+        ...(given.outside_hours !== undefined ? { outsideHours: given.outside_hours } : {}),
+        ...(given.kinds ? { kinds: given.kinds } : {}),
+    };
+}
+function approvalOutput(approval) {
+    return {
+        approval_id: approval.id,
+        policy_ref: approval.policyRef,
+        status: approval.status,
+        operation: approval.operation,
+        request: approval.request,
+        requested_by: approval.requestedBy,
+        resource_ids: approval.resourceIds,
+        starts_at: approval.start.toISOString(),
+        ends_at: approval.end.toISOString(),
+        expires_at: approval.expiresAt.toISOString(),
+        decided_by: approval.decidedBy,
+        decided_at: approval.decidedAt?.toISOString() ?? null,
+        reason: approval.reason,
+        created_at: approval.createdAt.toISOString(),
+    };
+}
 function applicationRefusal(code) {
     if (code === 'resource_tenant_mismatch') {
         return new SlotlockAgentOperationError('resource_not_found', 404);
@@ -1013,11 +1396,380 @@ function waitlistOutput(entry) {
         created_at: entry.createdAt.toISOString(),
     };
 }
+/**
+ * The policy a key whose bookings wait for a person (`requiresApproval`, RFC 0004 A5) is held by:
+ * every resource, a day's wait. A tenant cannot name a policy of its own `api-key`.
+ */
+function keyApprovalPolicy() {
+    return {
+        ref: SLOTLOCK_KEY_APPROVAL_POLICY,
+        name: 'Bookings by this API key',
+        appliesTo: {},
+        conditions: {},
+        outcome: 'require_approval',
+        approvalTtlMinutes: SLOTLOCK_DEFAULT_APPROVAL_MINUTES,
+        leadMinutes: 0,
+        createdAt: new Date(0),
+        updatedAt: new Date(0),
+    };
+}
+/** A JSON value with its object keys sorted, so two requests compare by content. */
+function canonical(value) {
+    if (Array.isArray(value))
+        return value.map(canonical);
+    if (value !== null && typeof value === 'object') {
+        return Object.fromEntries(Object.keys(value)
+            .sort()
+            .map((key) => [key, canonical(value[key])]));
+    }
+    return value;
+}
+/** Each interval of `wanted` less the parts `kept` already covers on the same resource. */
+function uncovered(wanted, kept) {
+    const pieces = [];
+    for (const want of wanted) {
+        let open = [{ start: want.start, end: want.end }];
+        for (const own of kept) {
+            if (own.resourceId !== want.resourceId)
+                continue;
+            open = open.flatMap((piece) => {
+                if (own.end <= piece.start || own.start >= piece.end)
+                    return [piece];
+                return [
+                    ...(own.start > piece.start ? [{ start: piece.start, end: own.start }] : []),
+                    ...(own.end < piece.end ? [{ start: own.end, end: piece.end }] : []),
+                ];
+            });
+        }
+        pieces.push(...open.map((piece) => ({ ...piece, resourceId: want.resourceId })));
+    }
+    return pieces;
+}
+/** How a request already put to a person answers its retry: waiting, declined or expired. */
+function approvalAnswer(approval) {
+    const id = { approval_id: approval.id, policy_ref: approval.policyRef };
+    if (approval.status === 'declined') {
+        return new SlotlockAgentOperationError('approval_declined', 403, {
+            ...id,
+            ...(approval.reason ? { reason: approval.reason.slice(0, 200) } : {}),
+        });
+    }
+    if (approval.status === 'expired' || approval.expiresAt.getTime() <= Date.now()) {
+        return new SlotlockAgentOperationError('approval_expired', 409, id);
+    }
+    return new SlotlockAgentOperationError('approval_pending', 409, {
+        ...id,
+        expires_at: approval.expiresAt.toISOString(),
+    });
+}
+/**
+ * Approval policies (RFC 0004 A4) in front of the backend's writes. A write a policy covers is
+ * tried first as a dry run, so it meets every check and the database's constraints as it would;
+ * a `refuse` policy then refuses it, and a `require_approval` one holds the exact time it would
+ * occupy for the approval and answers `approval_pending`. A retry with the same idempotency key
+ * answers as the request stands, and once granted, with the booking itself. Tenants with no policy
+ * pay one indexed read per write.
+ */
+function withApprovalPolicies(store, options, maxApprovalMinutes, backend) {
+    const requestKeyOf = (context, stored, key) => createHash('sha256')
+        .update(JSON.stringify(['slotlock-approval', context.principal.tenantRef, agentOwnerRef(context), stored, key]))
+        .digest('hex');
+    /** Whether [start, end) on the resource falls outside its bookable hours. */
+    async function outsideHours(tenantStore, context, resourceId, start, end) {
+        const resource = await requireAgentResource(tenantStore, context.principal.tenantRef, resourceId);
+        const hours = resource.availabilityRules ?? (await options.availabilityRules(context, resource));
+        const windows = mergeIntervals(expandRules(hours, { start: new Date(start.getTime() - 86_400_000), end: new Date(end.getTime() + 86_400_000) }, resource.timezone));
+        return !windows.some((window) => window.start <= start && window.end >= end);
+    }
+    /** The write's ask and the policies that may cover it, or null when none can. */
+    async function plan(tenantStore, context, operation, input) {
+        const tenantRef = context.principal.tenantRef;
+        const ownerRef = agentOwnerRef(context);
+        const key = input.idempotency_key;
+        // A key whose bookings all wait for a person (RFC 0004 A5) is a policy of its own.
+        const keyPolicy = context.principal.limits?.requiresApproval === true ? keyApprovalPolicy() : undefined;
+        // Most tenants have none: one small indexed read, and nothing else looked up.
+        if (!keyPolicy && (await tenantStore.listApprovalPolicies({ tenantRef })).length === 0)
+            return null;
+        let asked;
+        if (operation === 'slotlock_create_event') {
+            asked = {
+                kind: 'single',
+                stored: 'slotlock_create_event',
+                resourceIds: [input.resource_id],
+                externalRefs: [agentExternalRef(context, key)],
+                start: new Date(input.starts_at),
+                end: new Date(input.ends_at),
+                series: typeof input.recurrence_rule === 'string',
+                before: [],
+                ...(typeof input.hold_id === 'string' ? { consumeHold: { holdId: input.hold_id, holderRef: ownerRef } } : {}),
+            };
+        }
+        else if (operation === 'slotlock_book_pool') {
+            const members = await tenantStore.listPoolMembers({ tenantRef, pool: input.pool, visibility: 'shared' });
+            if (members.length === 0)
+                return null;
+            asked = {
+                kind: 'pool',
+                stored: 'slotlock_create_event',
+                resourceIds: members.map((member) => member.id),
+                externalRefs: [agentExternalRef(context, key)],
+                start: new Date(input.starts_at),
+                end: new Date(input.ends_at),
+                series: false,
+                before: [],
+                pool: input.pool,
+            };
+        }
+        else if (operation === 'slotlock_book_together') {
+            const resourceIds = [...new Set(input.resource_ids)].sort();
+            asked = {
+                kind: 'bundle',
+                stored: 'slotlock_book_together',
+                resourceIds,
+                externalRefs: resourceIds.map((resourceId) => agentExternalRef(context, `${key}\0${resourceId}`)),
+                start: new Date(input.starts_at),
+                end: new Date(input.ends_at),
+                series: false,
+                before: [],
+            };
+        }
+        else {
+            const current = await tenantStore.getCalendarEvent({ tenantRef, ownerRef, externalRef: input.event_id });
+            if (!current)
+                return null;
+            const resourceId = input.resource_id ?? current.resourceId;
+            const start = input.starts_at ? new Date(input.starts_at) : current.start;
+            const end = input.ends_at ? new Date(input.ends_at) : current.end;
+            // Only a move to another time or resource is a booking a policy can be about.
+            if (resourceId === current.resourceId && start.getTime() === current.start.getTime() && end.getTime() === current.end.getTime()) {
+                return null;
+            }
+            asked = {
+                kind: 'move',
+                stored: 'slotlock_update_event',
+                resourceIds: [resourceId],
+                externalRefs: [current.externalRef],
+                start,
+                end,
+                series: input.recurrence_rule !== undefined ? typeof input.recurrence_rule === 'string' : current.recurrence !== undefined,
+                before: await tenantStore.eventOccupancy({ tenantRef, ownerRef, externalRefs: [current.externalRef] }),
+            };
+        }
+        const minutes = (asked.end.getTime() - asked.start.getTime()) / 60_000;
+        // What the ask alone decides; hours wait for the resource the write takes.
+        const policies = (await tenantStore.approvalPoliciesFor({ tenantRef, resourceIds: asked.resourceIds })).filter((policy) => (policy.conditions.kinds === undefined || policy.conditions.kinds.includes(asked.kind)) &&
+            (policy.conditions.longerThanMinutes === undefined || minutes > policy.conditions.longerThanMinutes));
+        if (policies.length === 0 && !keyPolicy)
+            return null;
+        return { ...asked, policies, ...(keyPolicy ? { keyPolicy } : {}) };
+    }
+    function gated(operation, method) {
+        return async function (context, input) {
+            // The grant itself, or a write a person already approved and its retries.
+            if (context[APPROVAL_GRANT])
+                return method.call(this, context, input);
+            const tenantRef = context.principal.tenantRef;
+            const stored = operation === 'slotlock_book_together' || operation === 'slotlock_update_event' ? operation : 'slotlock_create_event';
+            const requestKey = requestKeyOf(context, stored, input.idempotency_key);
+            const asked = await withTenant(store, { ...context, dryRun: false }, async (tenantStore) => {
+                const prior = await tenantStore.findApproval({ tenantRef, requestKey });
+                if (prior)
+                    return { prior };
+                return { plan: await plan(tenantStore, context, operation, input) };
+            });
+            if (asked.prior) {
+                const { hold_id: _held, ...request } = input;
+                // Granted: the booking was made with this key, so the write answers it as a replay (and
+                // the store refuses another request with it). Without the hold the approval took over,
+                // as the grant made it.
+                if (asked.prior.status === 'granted')
+                    return method.call(this, context, request);
+                const kept = { ...asked.prior.request };
+                // A pool booking is kept as the member it would take.
+                if (operation === 'slotlock_book_pool')
+                    delete kept.resource_id;
+                if (JSON.stringify(canonical(kept)) !== JSON.stringify(canonical(request))) {
+                    throw new SlotlockAgentOperationError('idempotency_conflict', 409);
+                }
+                throw approvalAnswer(asked.prior);
+            }
+            const ask = asked.plan;
+            if (!ask)
+                return method.call(this, context, input);
+            // Tried as a dry run, reading what it would occupy before it is undone: a write that would be
+            // refused is refused as it would be.
+            let occupied = [];
+            const probed = await method.call(this, {
+                ...context,
+                dryRun: true,
+                [OCCUPANCY_PROBE]: async (tenantStore) => {
+                    occupied = await tenantStore.eventOccupancy({
+                        tenantRef,
+                        ownerRef: agentOwnerRef(context),
+                        externalRefs: ask.externalRefs,
+                    });
+                },
+            }, input);
+            // Made already (before the policy, say), or takes no time (a transparent event): nothing to hold.
+            if (probed.replayed === true || occupied.length === 0) {
+                return context.dryRun ? probed : method.call(this, context, input);
+            }
+            const written = [...new Set(occupied.map((occupation) => occupation.resourceId))];
+            const decided = await withTenant(store, { ...context, dryRun: false }, async (tenantStore) => {
+                // A pool's policies are those of the member the write would take, and its pool.
+                const candidates = [
+                    ...(ask.pool
+                        ? (await tenantStore.approvalPoliciesFor({ tenantRef, resourceIds: written })).filter((policy) => ask.policies.some((known) => known.ref === policy.ref))
+                        : ask.policies),
+                    ...(ask.keyPolicy ? [ask.keyPolicy] : []),
+                ];
+                const applying = [];
+                for (const policy of candidates) {
+                    if (policy.conditions.outsideHours === true) {
+                        let outside = false;
+                        for (const resourceId of written) {
+                            if (await outsideHours(tenantStore, context, resourceId, ask.start, ask.end))
+                                outside = true;
+                        }
+                        if (!outside)
+                            continue;
+                    }
+                    applying.push(policy);
+                }
+                return applying;
+            });
+            if (decided.length === 0)
+                return context.dryRun ? probed : method.call(this, context, input);
+            const refusing = decided.find((policy) => policy.outcome === 'refuse');
+            if (refusing)
+                throw new SlotlockAgentOperationError('approval_policy_refused', 403, { policy_ref: refusing.ref });
+            // The strictest wait: the earliest a person must decide by, under each policy's own wait, its
+            // lead before the start, and the server's ceiling.
+            const now = Date.now();
+            const deadline = (policy) => Math.min(now + Math.min(policy.approvalTtlMinutes, maxApprovalMinutes) * 60_000, ask.start.getTime() - policy.leadMinutes * 60_000);
+            const policy = [...decided].sort((left, right) => deadline(left) - deadline(right) || left.ref.localeCompare(right.ref))[0];
+            const expiresAt = new Date(deadline(policy));
+            if (ask.series || occupied.some((occupation) => occupation.recurring)) {
+                throw new SlotlockAgentOperationError('approval_series_unsupported', 409, { policy_ref: policy.ref });
+            }
+            if (expiresAt.getTime() < now + 60_000) {
+                throw new SlotlockAgentOperationError('approval_too_late', 409, { policy_ref: policy.ref });
+            }
+            if (context.dryRun) {
+                throw new SlotlockAgentOperationError('approval_required', 409, {
+                    policy_ref: policy.ref,
+                    expires_at: expiresAt.toISOString(),
+                });
+            }
+            const holds = uncovered(occupied, ask.before);
+            if (holds.length === 0)
+                return method.call(this, context, input);
+            const chosen = ask.pool ? written[0] : undefined;
+            const { hold_id: _hold, ...request } = input;
+            const principal = context.principal;
+            const result = await withTenant(store, context, (tenantStore) => tenantStore.requestApproval({
+                tenantRef,
+                policyRef: policy.ref,
+                operation: ask.stored,
+                request: canonical(chosen ? { ...request, resource_id: chosen } : request),
+                requester: {
+                    subject: principal.subject,
+                    ...(principal.scopes ? { scopes: [...principal.scopes] } : {}),
+                    ...(principal.keyId !== undefined ? { key_id: principal.keyId } : {}),
+                    ...(principal.resourceScope
+                        ? { resource_scope: { locations: [...principal.resourceScope.locations], groups: [...principal.resourceScope.groups] } }
+                        : {}),
+                    ...(context.origin !== undefined ? { origin: context.origin } : {}),
+                    ...(ask.pool !== undefined ? { pool: ask.pool } : {}),
+                },
+                requesterRef: principal.subject,
+                requestKey,
+                holds,
+                start: ask.start,
+                end: ask.end,
+                expiresAt,
+                ...(ask.consumeHold ? { consumeHold: ask.consumeHold } : {}),
+            }), WRITE);
+            if (!result.ok) {
+                if (result.code === 'approval_limit_reached') {
+                    throw new SlotlockAgentOperationError('approval_limit_reached', 429, { limit: String(result.limit ?? '') });
+                }
+                throw new SlotlockAgentOperationError(result.code, 409);
+            }
+            throw approvalAnswer(result.approval);
+        };
+    }
+    const wrapped = { ...backend };
+    wrapped.createEvent = gated('slotlock_create_event', backend.createEvent);
+    wrapped.updateEvent = gated('slotlock_update_event', backend.updateEvent);
+    if (backend.bookPool)
+        wrapped.bookPool = gated('slotlock_book_pool', backend.bookPool);
+    if (backend.bookTogether)
+        wrapped.bookTogether = gated('slotlock_book_together', backend.bookTogether);
+    if (backend.confirmHold) {
+        const confirm = backend.confirmHold;
+        // A confirm already put to a person answers as it stands, before its hold (now the
+        // approval's) is looked for; otherwise it books through createEvent, policies and all.
+        wrapped.confirmHold = async function (context, input) {
+            if (!context[APPROVAL_GRANT]) {
+                const requestKey = requestKeyOf(context, 'slotlock_create_event', input.idempotency_key);
+                const prior = await withTenant(store, { ...context, dryRun: false }, (tenantStore) => tenantStore.findApproval({ tenantRef: context.principal.tenantRef, requestKey }));
+                if (prior && prior.status !== 'granted')
+                    throw approvalAnswer(prior);
+            }
+            return confirm.call(this, context, input);
+        };
+    }
+    return wrapped;
+}
+/**
+ * Run a granted approval's write as the agent that asked for it, in one transaction with the grant:
+ * its holds give way, the write is made, and the approval is marked granted.
+ */
+export async function runSlotlockApprovalGrant(agentBackend, approval, grant) {
+    const requester = approval.requester;
+    if (typeof requester.subject !== 'string')
+        throw new SlotlockAgentOperationError('store_inconsistent', 503);
+    const scope = requester.resource_scope;
+    const context = {
+        principal: {
+            subject: requester.subject,
+            tenantRef: grant.tenantRef,
+            ...(Array.isArray(requester.scopes) ? { scopes: requester.scopes } : {}),
+            ...(typeof requester.key_id === 'string' ? { keyId: requester.key_id } : {}),
+            ...(scope && Array.isArray(scope.locations) && Array.isArray(scope.groups)
+                ? { resourceScope: { locations: scope.locations, groups: scope.groups } }
+                : {}),
+        },
+        operation: approval.operation,
+        signal: grant.signal,
+        ...(grant.origin !== undefined ? { origin: grant.origin } : {}),
+        ...(grant.dryRun ? { dryRun: true } : {}),
+        [APPROVAL_GRANT]: {
+            id: approval.id,
+            decidedBy: grant.decidedBy,
+            ...(typeof requester.pool === 'string' ? { pool: requester.pool } : {}),
+        },
+    };
+    const method = approval.operation === 'slotlock_book_together'
+        ? agentBackend.bookTogether
+        : approval.operation === 'slotlock_update_event'
+            ? agentBackend.updateEvent
+            : agentBackend.createEvent;
+    if (!method)
+        throw new SlotlockAgentOperationError('approvals_unavailable', 409);
+    return method.call(agentBackend, context, approval.request);
+}
 /**
  * Offer what a cancel or release just freed to the waitlist now. Best effort, after commit:
  * maintenance offers whatever this misses.
  */
-async function offerFreedTime(store, tenantRef) {
+async function offerFreedTime(store, context) {
+    // A dry run freed nothing.
+    if (context.dryRun)
+        return;
+    const tenantRef = context.principal.tenantRef;
     try {
         await store.withTenant(tenantRef, (tenant) => tenant.offerWaitlist({ tenantRef, limit: 20 }), {
             origin: 'maintenance',
@@ -1039,6 +1791,14 @@ function webhookOutput(endpoint) {
         last_error: endpoint.lastError,
         disabled_at: endpoint.disabledAt?.toISOString() ?? null,
         disabled_reason: endpoint.disabledReason,
+        filter: endpoint.filter
+            ? {
+                ...(endpoint.filter.resourceIds ? { resource_ids: endpoint.filter.resourceIds } : {}),
+                ...(endpoint.filter.pools ? { pools: endpoint.filter.pools } : {}),
+                ...(endpoint.filter.locations ? { locations: endpoint.filter.locations } : {}),
+                ...(endpoint.filter.groups ? { groups: endpoint.filter.groups } : {}),
+            }
+            : null,
     };
 }
 function rulesOutput(rules) {
@@ -1117,8 +1877,53 @@ function resourceOutput(resource) {
         visibility: resource.visibility ?? 'shared',
         archived_at: resource.archivedAt?.toISOString() ?? null,
         pool: resource.pool ?? null,
+        name: resource.name ?? null,
+        description: resource.description ?? null,
+        kind: resource.kind ?? 'other',
+        capacity: resource.capacity ?? null,
+        labels: resource.labels ?? [],
+        attributes: resource.attributes ?? {},
+        location: resource.location ?? null,
+        groups: resource.groups ?? [],
+        parent_id: resource.parentId ?? null,
+        part_index: resource.partIndex ?? null,
     };
 }
+function locationOutput(location) {
+    return {
+        ref: location.ref,
+        name: location.name,
+        parent_ref: location.parentRef,
+        timezone: location.timezone,
+        resources: location.resources,
+    };
+}
+function groupOutput(group) {
+    return { ref: group.ref, name: group.name, description: group.description, members: group.members };
+}
+/** The references of a location and every location under it, from the tenant's whole tree. */
+function locationAndBelow(locations, ref) {
+    const found = new Set([ref]);
+    for (let grew = true; grew;) {
+        grew = false;
+        for (const location of locations) {
+            if (location.parentRef !== null && found.has(location.parentRef) && !found.has(location.ref)) {
+                found.add(location.ref);
+                grew = true;
+            }
+        }
+    }
+    return found;
+}
+/** The profile fields of an operation's input, as the store takes them; absent ones left out. */
+function profileInput(input) {
+    const profile = {};
+    for (const field of SLOTLOCK_RESOURCE_PROFILE_FIELDS) {
+        if (input[field] !== undefined)
+            profile[field] = input[field];
+    }
+    return profile;
+}
 /** Any of a tenant's events: the store's id, which the tenant-event routes take, and its owner's. */
 function tenantEventOutput(event) {
     return {
@@ -1218,6 +2023,23 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
             };
         });
     }
+    /** The partner store and the partner a partner key names; any other caller is forbidden. */
+    function partnerOf(context) {
+        assertActive(context);
+        const partners = options.partners;
+        if (!partners)
+            throw new SlotlockAgentOperationError('partner_api_not_served', 404);
+        return { partners, partner: slotlockPrincipalPartner(context.principal) };
+    }
+    /** As partnerOf, with the account's tenant: 404 account_not_found for one the partner lacks. */
+    async function partnerAccount(context, input) {
+        const { partners, partner } = partnerOf(context);
+        const tenantRef = await partners.tenantOf(partner, input.account);
+        if (!tenantRef)
+            throw new SlotlockAgentOperationError('account_not_found', 404);
+        // Its test environment (RFC 0003 G9): a tenant of its own, on the same plan, never billed.
+        return { partners, partner, tenantRef: input.environment === 'test' ? `${tenantRef}${SLOTLOCK_TEST_TENANT_SUFFIX}` : tenantRef };
+    }
     return {
         async createResource(context, input) {
             // A capped create counts under READ COMMITTED; withTenant opens it for the call.
@@ -1226,11 +2048,15 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                     const resource = await tenant.createResource({
                         tenantRef: tenantOf(context),
                         externalRef: input.external_ref,
-                        timezone: input.timezone,
+                        ...(input.timezone !== undefined ? { timezone: input.timezone } : {}),
+                        ...(input.location !== undefined ? { location: input.location } : {}),
                         ...(input.visibility !== undefined
                             ? { visibility: input.visibility }
                             : {}),
                         ...(max !== undefined ? { maxTenantResources: max } : {}),
+                        ...(SLOTLOCK_RESOURCE_PROFILE_FIELDS.some((field) => input[field] !== undefined)
+                            ? { profile: profileInput(input) }
+                            : {}),
                     });
                     return { resource: resourceOutput(resource) };
                 }
@@ -1239,6 +2065,151 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 }
             }, max !== undefined ? { isolation: 'read committed' } : undefined);
         },
+        async updateResource(context, input) {
+            const id = input.resource_id;
+            if (!STORE_ID_PATTERN.test(id))
+                throw new SlotlockAgentOperationError('resource_not_found', 404);
+            return withTenant(store, context, async (tenant) => {
+                let resource;
+                try {
+                    resource = await tenant.updateResourceProfile({
+                        tenantRef: tenantOf(context),
+                        id,
+                        profile: profileInput(input),
+                        ...(input.location !== undefined ? { location: input.location } : {}),
+                    });
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+                if (!resource)
+                    throw new SlotlockAgentOperationError('resource_not_found', 404);
+                return { resource: resourceOutput(resource) };
+            }, WRITE);
+        },
+        async listLocations(context) {
+            return withTenant(store, context, async (tenant) => ({
+                locations: (await tenant.listLocations({ tenantRef: tenantOf(context) })).map(locationOutput),
+            }));
+        },
+        async createLocation(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                try {
+                    const location = await tenant.putLocation({
+                        tenantRef: tenantOf(context),
+                        ref: input.ref,
+                        name: input.name,
+                        ...(input.parent_ref !== undefined ? { parentRef: input.parent_ref } : {}),
+                        ...(input.timezone !== undefined ? { timezone: input.timezone } : {}),
+                    });
+                    return { location: locationOutput(location) };
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+            }, WRITE);
+        },
+        async updateLocation(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                let location;
+                try {
+                    location = await tenant.updateLocation({
+                        tenantRef: tenantOf(context),
+                        ref: input.location_ref,
+                        ...(input.name !== undefined ? { name: input.name } : {}),
+                        ...(input.parent_ref !== undefined ? { parentRef: input.parent_ref } : {}),
+                        ...(input.timezone !== undefined ? { timezone: input.timezone } : {}),
+                    });
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+                if (!location)
+                    throw new SlotlockAgentOperationError('location_not_found', 404);
+                return { location: locationOutput(location) };
+            }, WRITE);
+        },
+        async deleteLocation(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                try {
+                    return {
+                        deleted: await tenant.deleteLocation({ tenantRef: tenantOf(context), ref: input.location_ref }),
+                    };
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+            }, WRITE);
+        },
+        async listGroups(context) {
+            return withTenant(store, context, async (tenant) => ({
+                groups: (await tenant.listGroups({ tenantRef: tenantOf(context) })).map(groupOutput),
+            }));
+        },
+        async createGroup(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                try {
+                    const group = await tenant.putGroup({
+                        tenantRef: tenantOf(context),
+                        ref: input.ref,
+                        name: input.name,
+                        ...(input.description !== undefined ? { description: input.description } : {}),
+                    });
+                    return { group: groupOutput(group) };
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+            }, WRITE);
+        },
+        async deleteGroup(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                try {
+                    return { deleted: await tenant.deleteGroup({ tenantRef: tenantOf(context), ref: input.group_ref }) };
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+            }, WRITE);
+        },
+        async addGroupMember(context, input) {
+            const resourceId = input.resource_id;
+            if (!STORE_ID_PATTERN.test(resourceId))
+                throw new SlotlockAgentOperationError('resource_not_found', 404);
+            return withTenant(store, context, async (tenant) => {
+                try {
+                    return {
+                        added: await tenant.addGroupMember({
+                            tenantRef: tenantOf(context),
+                            group: input.group_ref,
+                            resourceId,
+                        }),
+                    };
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+            }, WRITE);
+        },
+        async removeGroupMember(context, input) {
+            const resourceId = input.resource_id;
+            if (!STORE_ID_PATTERN.test(resourceId))
+                return { removed: false };
+            return withTenant(store, context, async (tenant) => {
+                try {
+                    return {
+                        removed: await tenant.removeGroupMember({
+                            tenantRef: tenantOf(context),
+                            group: input.group_ref,
+                            resourceId,
+                        }),
+                    };
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+            }, WRITE);
+        },
         async getResource(context, input) {
             return withTenant(store, context, async (tenant) => ({
                 resource: resourceOutput(await requireResource(tenant, tenantOf(context), input.resource_id)),
@@ -1399,6 +2370,26 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 return { resource: resourceOutput(resource) };
             }, WRITE);
         },
+        async setResourceParent(context, input) {
+            const id = input.resource_id;
+            const parentId = input.parent_id;
+            if (!STORE_ID_PATTERN.test(id))
+                throw new SlotlockAgentOperationError('resource_not_found', 404);
+            if (parentId !== null && !STORE_ID_PATTERN.test(parentId))
+                throw new SlotlockAgentOperationError('parent_not_found', 404);
+            return withTenant(store, context, async (tenant) => {
+                let resource;
+                try {
+                    resource = await tenant.setResourceParent({ tenantRef: tenantOf(context), id, parentId });
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+                if (!resource)
+                    throw new SlotlockAgentOperationError('resource_not_found', 404);
+                return { resource: resourceOutput(resource) };
+            }, WRITE);
+        },
         async getResourceHistory(context, input) {
             return history(context, input);
         },
@@ -1413,6 +2404,21 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 pools: await tenant.listPools({ tenantRef: tenantOf(context) }),
             }));
         },
+        async setPoolOrder(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                try {
+                    const order = await tenant.setPoolOrder({
+                        tenantRef: tenantOf(context),
+                        pool: input.pool,
+                        order: input.order,
+                    });
+                    return { pool: input.pool, order };
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+            }, WRITE);
+        },
         async getBookingRuleDefaults(context) {
             return withTenant(store, context, async (tenant) => {
                 const defaults = await tenant.getBookingRuleDefaults({ tenantRef: tenantOf(context) });
@@ -1536,7 +2542,7 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 released: (await tenant.releaseHold(id, { tenantRef: tenantOf(context) })).released,
             }));
             if (released.released)
-                await offerFreedTime(store, tenantOf(context));
+                await offerFreedTime(store, context);
             return released;
         },
         async getReservation(context, input) {
@@ -1586,7 +2592,7 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 return { reservation: reservationOutput(result.reservation), replayed: result.idempotent };
             }, WRITE);
             if (input.revision > 1 && !put.replayed) {
-                await offerFreedTime(store, tenantOf(context));
+                await offerFreedTime(store, context);
             }
             return put;
         },
@@ -1602,7 +2608,7 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 return { cancelled: result.cancelled, revision: result.revision };
             }, WRITE);
             if (cancelled.cancelled)
-                await offerFreedTime(store, tenantOf(context));
+                await offerFreedTime(store, context);
             return cancelled;
         },
         async checkInReservation(context, input) {
@@ -1627,10 +2633,11 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                     end: new Date(input.end),
                     holderRef: input.holder_ref,
                     ...(ttl !== undefined ? { offerTtlMs: ttl * 1000 } : {}),
+                    ...(input.idempotency_key !== undefined ? { idempotencyKey: input.idempotency_key } : {}),
                 });
                 if (!result.ok)
                     throw applicationRefusal(result.code);
-                return { entry: waitlistOutput(result.entry) };
+                return { entry: waitlistOutput(result.entry), replayed: result.replayed };
             });
         },
         async listWaitlist(context, input) {
@@ -1649,7 +2656,7 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 left: await tenant.leaveWaitlist({ tenantRef: tenantOf(context), id: input.entry_id }),
             }));
             if (left.left)
-                await offerFreedTime(store, tenantOf(context));
+                await offerFreedTime(store, context);
             return left;
         },
         async getCoverage(context, input) {
@@ -1776,7 +2783,7 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 };
             }, WRITE);
             if (!cancelled.replayed)
-                await offerFreedTime(store, tenantOf(context));
+                await offerFreedTime(store, context);
             return cancelled;
         },
         async getTenant(context) {
@@ -1800,7 +2807,13 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 if (await tenant.isTenantSuspended({ tenantRef: tenantOf(context) })) {
                     throw new SlotlockAgentOperationError('tenant_suspended', 403);
                 }
-                const erased = await tenant.eraseTenant({ tenantRef: tenantOf(context) });
+                const erased = await tenant.eraseTenant({ tenantRef: tenantOf(context) }).catch((error) => {
+                    // A paid hosted plan is cancelled first, so it does not renew for an erased tenant.
+                    if (error?.code === 'billing_active') {
+                        throw new SlotlockAgentOperationError('billing_active', 409);
+                    }
+                    throw error;
+                });
                 return { total: erased.total, rows: erased.rows };
             }, WRITE);
         },
@@ -1823,11 +2836,26 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                     tenantRef: tenantOf(context),
                     url: input.url,
                     ...(input.event_types !== undefined ? { eventTypes: input.event_types } : {}),
+                    ...(['resource_ids', 'pools', 'locations', 'groups'].some((field) => input[field] !== undefined)
+                        ? {
+                            filter: {
+                                ...(input.resource_ids !== undefined ? { resourceIds: input.resource_ids } : {}),
+                                ...(input.pools !== undefined ? { pools: input.pools } : {}),
+                                ...(input.locations !== undefined ? { locations: input.locations } : {}),
+                                ...(input.groups !== undefined ? { groups: input.groups } : {}),
+                            },
+                        }
+                        : {}),
+                    ...(input.idempotency_key !== undefined ? { idempotencyKey: input.idempotency_key } : {}),
                 });
                 if (!created.ok) {
-                    throw new SlotlockAgentOperationError(created.code, created.code === 'webhook_limit_reached' ? 409 : 400);
+                    throw new SlotlockAgentOperationError(created.code, created.code === 'webhook_limit_reached' || created.code === 'idempotency_conflict' ? 409 : 400);
                 }
-                return { webhook: webhookOutput(created.endpoint), secret: created.secret };
+                return {
+                    webhook: webhookOutput(created.endpoint),
+                    secret: created.secret,
+                    replayed: created.replayed === true,
+                };
             }, WRITE);
         },
         async listWebhooks(context) {
@@ -1838,6 +2866,196 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
         async deleteWebhook(context, input) {
             return withTenant(store, context, async (tenant) => tenant.deleteWebhookEndpoint({ tenantRef: tenantOf(context), id: input.webhook_id }), WRITE);
         },
+        // The partner API (RFC 0003 P3): the partner the key names, its own accounts only.
+        async partnerPutAccount(context, input) {
+            const { partners, partner } = partnerOf(context);
+            const put = await partners.putAccount(partner, input.account, input.plan);
+            if (!put)
+                throw new SlotlockAgentOperationError('forbidden', 403);
+            return { account: partnerAccountOutput(put.account), created: put.created };
+        },
+        async partnerListAccounts(context) {
+            const { partners, partner } = partnerOf(context);
+            return { accounts: (await partners.listAccounts(partner)).map(partnerAccountOutput) };
+        },
+        async partnerGetAccount(context, input) {
+            const { partners, partner } = partnerOf(context);
+            const found = await partners.getAccount(partner, input.account);
+            if (!found)
+                throw new SlotlockAgentOperationError('account_not_found', 404);
+            return { account: partnerAccountOutput(found) };
+        },
+        async partnerListKeys(context, input) {
+            const { partners, tenantRef } = await partnerAccount(context, input);
+            return { keys: (await partners.keys.list({ tenantRef })).map(slotlockPartnerKeyOutput) };
+        },
+        async partnerCreateKey(context, input) {
+            const { partners, partner, tenantRef } = await partnerAccount(context, input);
+            const contract = await partners.contract(partner);
+            if (!contract)
+                throw new SlotlockAgentOperationError('forbidden', 403);
+            const scopes = input.scopes ?? [...contract.keyScopes];
+            if (scopes.some((scope) => !contract.keyScopes.includes(scope))) {
+                throw new SlotlockAgentOperationError('scope_not_in_contract', 403);
+            }
+            const days = input.expires_in_days;
+            try {
+                const created = await partners.keys.create({
+                    tenantRef,
+                    name: input.name,
+                    scopes,
+                    createdBy: `partner:${partner}`,
+                    actor: context.principal.subject,
+                    origin: 'application',
+                    ...(days !== undefined ? { expiresAt: new Date(Date.now() + days * 86_400_000) } : {}),
+                    ...(input.limits !== undefined ? { limits: keyLimitsFromInput(input.limits) } : {}),
+                });
+                return { key: created.key, api_key: slotlockPartnerKeyOutput(created.apiKey) };
+            }
+            catch (error) {
+                const code = error.code;
+                if (code === 'api_key_limit_reached')
+                    throw new SlotlockAgentOperationError(code, 409);
+                if (code === 'tenant_suspended')
+                    throw new SlotlockAgentOperationError(code, 403);
+                throw error;
+            }
+        },
+        async partnerRotateKey(context, input) {
+            const { partners, tenantRef } = await partnerAccount(context, input);
+            const rotated = await partners.keys
+                .rotate({ tenantRef, id: input.key_id, actor: context.principal.subject, origin: 'application' })
+                .catch((error) => {
+                if (error.code === 'tenant_suspended') {
+                    throw new SlotlockAgentOperationError('tenant_suspended', 403);
+                }
+                throw error;
+            });
+            if (!rotated)
+                throw new SlotlockAgentOperationError('key_not_found', 404);
+            return { key: rotated.key, api_key: slotlockPartnerKeyOutput(rotated.apiKey) };
+        },
+        async partnerRevokeKey(context, input) {
+            const { partners, tenantRef } = await partnerAccount(context, input);
+            const revoked = await partners.keys.revoke({
+                tenantRef,
+                id: input.key_id,
+                actor: context.principal.subject,
+                origin: 'application',
+            });
+            if (!revoked)
+                throw new SlotlockAgentOperationError('key_not_found', 404);
+            return { api_key: slotlockPartnerKeyOutput(revoked) };
+        },
+        async partnerSuspendAccount(context, input) {
+            const { partners, partner } = partnerOf(context);
+            const changed = await partners.setSuspended(partner, input.account, true, input.reason);
+            if (changed === null)
+                throw new SlotlockAgentOperationError('account_not_found', 404);
+            return { suspended: changed };
+        },
+        async partnerUnsuspendAccount(context, input) {
+            const { partners, partner } = partnerOf(context);
+            const changed = await partners.setSuspended(partner, input.account, false);
+            if (changed === null)
+                throw new SlotlockAgentOperationError('account_not_found', 404);
+            return { unsuspended: changed };
+        },
+        async partnerEraseAccount(context, input) {
+            const { partners, partner } = partnerOf(context);
+            if (input.confirm !== input.account)
+                throw new SlotlockAgentOperationError('confirmation_mismatch', 400);
+            const erased = await partners.eraseAccount(partner, input.account);
+            if (!erased.erased)
+                throw new SlotlockAgentOperationError('account_not_found', 404);
+            return { erased: true, rows: erased.total };
+        },
+        async partnerGetUsage(context, input) {
+            const { partners, partner } = partnerOf(context);
+            const now = Date.now();
+            const range = slotlockUsageMonthToDate(now);
+            const from = input.from ?? range.from;
+            const to = input.to ?? range.to;
+            const span = slotlockUsageSpanDays(from, to);
+            if (span < 0 || span > SLOTLOCK_USAGE_RETENTION_DAYS || slotlockUsageSpanDays(to, slotlockUsageDay(now)) < 0) {
+                throw new SlotlockAgentOperationError('invalid_usage_range', 400);
+            }
+            const rows = await partners.usage(partner, from, to, input.account);
+            return { from, to, usage: rows };
+        },
+        async partnerReconcileUsage(context, input) {
+            const { partners, partner } = partnerOf(context);
+            const day = input.day;
+            // An ended day: today's counts are still arriving.
+            if (slotlockUsageSpanDays(day, slotlockUsageDay(Date.now())) < 1) {
+                throw new SlotlockAgentOperationError('invalid_usage_range', 400);
+            }
+            const theirs = new Map();
+            for (const row of input.accounts) {
+                theirs.set(row.account, { operations: row.operations, ...(row.bookings !== undefined ? { bookings: row.bookings } : {}) });
+            }
+            const ours = new Map();
+            for (const row of await partners.usage(partner, day, day)) {
+                if (row.metric !== 'operations' && row.metric !== 'bookings')
+                    continue;
+                const counted = ours.get(row.account) ?? { operations: 0, bookings: 0 };
+                counted[row.metric] += row.count;
+                ours.set(row.account, counted);
+            }
+            const accounts = [...new Set([...ours.keys(), ...theirs.keys()])].sort();
+            const lines = [];
+            const mismatched = new Set();
+            let worst = 0;
+            for (const account of accounts) {
+                for (const metric of ['operations', 'bookings']) {
+                    const mine = ours.get(account)?.[metric] ?? 0;
+                    const told = theirs.get(account)?.[metric];
+                    if (told === undefined && (metric === 'bookings' || !theirs.has(account)) && mine === 0)
+                        continue;
+                    // Not sent by them, where we counted some: a difference of all of it.
+                    const theirCount = told ?? null;
+                    const difference = theirCount === null
+                        ? mine === 0 ? 0 : 100
+                        : Math.max(mine, theirCount) === 0 ? 0 : (Math.abs(mine - theirCount) * 100) / Math.max(mine, theirCount);
+                    if (theirCount === null && metric === 'bookings') {
+                        lines.push({ account, metric, ours: mine, theirs: null, difference_percent: null });
+                        continue;
+                    }
+                    const rounded = Math.round(difference * 100) / 100;
+                    if (difference > SLOTLOCK_RECONCILE_TOLERANCE_PERCENT)
+                        mismatched.add(account);
+                    worst = Math.max(worst, rounded);
+                    lines.push({ account, metric, ours: mine, theirs: theirCount, difference_percent: rounded });
+                }
+            }
+            await partners.recordReconciliation(partner, day, accounts.length, mismatched.size, worst);
+            return {
+                day,
+                within_tolerance: mismatched.size === 0,
+                tolerance_percent: SLOTLOCK_RECONCILE_TOLERANCE_PERCENT,
+                accounts: lines,
+            };
+        },
+        async getUsage(context, input) {
+            const now = Date.now();
+            const range = slotlockUsageMonthToDate(now);
+            const from = input.from ?? range.from;
+            const to = input.to ?? range.to;
+            const span = slotlockUsageSpanDays(from, to);
+            if (span < 0 || span > SLOTLOCK_USAGE_RETENTION_DAYS || slotlockUsageSpanDays(to, slotlockUsageDay(now)) < 0) {
+                throw new SlotlockAgentOperationError('invalid_usage_range', 400);
+            }
+            const rows = await withTenant(store, context, (tenant) => tenant.readUsage({ tenantRef: tenantOf(context), from, to }));
+            const summary = summarizeSlotlockUsage(rows);
+            return {
+                from,
+                to,
+                totals: summary.totals,
+                days: summary.days,
+                keys: summary.keys.map(({ keyId, ...totals }) => ({ key_id: keyId, ...totals })),
+                surfaces: summary.surfaces,
+            };
+        },
         async enableWebhook(context, input) {
             return withTenant(store, context, async (tenant) => {
                 const enabled = await tenant.enableWebhookEndpoint({
@@ -1851,10 +3069,152 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 return { webhook: webhookOutput(enabled) };
             }, WRITE);
         },
+        async listApprovalPolicies(context) {
+            return withTenant(store, context, async (tenant) => ({
+                policies: (await tenant.listApprovalPolicies({ tenantRef: tenantOf(context) })).map(approvalPolicyOutput),
+            }));
+        },
+        async putApprovalPolicy(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                let policy;
+                try {
+                    policy = await tenant.putApprovalPolicy({
+                        tenantRef: tenantOf(context),
+                        ref: input.policy_ref,
+                        name: input.name,
+                        outcome: input.outcome,
+                        ...(input.applies_to !== undefined ? { appliesTo: approvalAppliesTo(input.applies_to) } : {}),
+                        ...(input.conditions !== undefined ? { conditions: approvalConditions(input.conditions) } : {}),
+                        ...(input.approval_ttl_minutes !== undefined ? { approvalTtlMinutes: input.approval_ttl_minutes } : {}),
+                        ...(input.lead_minutes !== undefined ? { leadMinutes: input.lead_minutes } : {}),
+                    });
+                }
+                catch (error) {
+                    if (error instanceof SlotlockApprovalPolicyError) {
+                        throw new SlotlockAgentOperationError(error.code, 400, { reason: error.message.slice(0, 200) });
+                    }
+                    throw error;
+                }
+                if (!policy)
+                    throw new SlotlockAgentOperationError('approval_policy_limit_reached', 409);
+                return { policy: approvalPolicyOutput(policy) };
+            }, WRITE);
+        },
+        async deleteApprovalPolicy(context, input) {
+            return withTenant(store, context, (tenant) => tenant.deleteApprovalPolicy({ tenantRef: tenantOf(context), ref: input.policy_ref }));
+        },
+        async listApprovals(context, input) {
+            return withTenant(store, context, async (tenant) => ({
+                approvals: (await tenant.listApprovals({
+                    tenantRef: tenantOf(context),
+                    limit: input.limit,
+                    ...(input.status !== undefined ? { status: input.status } : {}),
+                })).map(approvalOutput),
+            }));
+        },
+        async getApproval(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                const approval = await tenant.getApproval({ tenantRef: tenantOf(context), id: input.approval_id });
+                if (!approval)
+                    throw new SlotlockAgentOperationError('approval_not_found', 404);
+                return { approval: approvalOutput(approval) };
+            });
+        },
+        async decideApproval(context, input) {
+            const tenantRef = tenantOf(context);
+            const id = input.approval_id;
+            const decidedBy = actorOf(context) ?? 'unknown';
+            if (input.decision === 'decline') {
+                const declined = await withTenant(store, context, (tenant) => tenant.declineApproval({
+                    tenantRef,
+                    id,
+                    decidedBy,
+                    ...(input.reason !== undefined ? { reason: input.reason } : {}),
+                }), WRITE);
+                if (!declined.ok)
+                    throw approvalRefusal(declined.code);
+                await offerFreedTime(store, context);
+                return { approval: approvalOutput(declined.approval), booking: null };
+            }
+            if (!options.agentBackend)
+                throw new SlotlockAgentOperationError('approvals_unavailable', 409);
+            const approval = await withTenant(store, context, (tenant) => tenant.getApproval({ tenantRef, id }));
+            if (!approval)
+                throw approvalRefusal('approval_not_found');
+            if (approval.status !== 'pending')
+                throw approvalRefusal('approval_not_pending');
+            // A dry run's grant is a dry run of the booking: rolled back with it.
+            const booking = await runSlotlockApprovalGrant(options.agentBackend, approval, {
+                tenantRef,
+                decidedBy,
+                signal: context.signal,
+                ...(context.origin !== undefined ? { origin: context.origin } : {}),
+                ...(context.dryRun ? { dryRun: true } : {}),
+            });
+            const granted = context.dryRun
+                ? { ...approval, status: 'granted', decidedBy, decidedAt: new Date() }
+                : await withTenant(store, context, (tenant) => tenant.getApproval({ tenantRef, id }));
+            if (!granted)
+                throw new SlotlockAgentOperationError('store_inconsistent', 503);
+            return { approval: approvalOutput(granted), booking };
+        },
+        async sandboxSeed(context, input) {
+            try {
+                return { ...(await seedSlotlockSandbox(store, tenantOf(context), input.scenario)) };
+            }
+            catch (error) {
+                throw sandboxRefusal(error);
+            }
+        },
+        async sandboxReset(context) {
+            try {
+                return { removed: await resetSlotlockSandbox(store, tenantOf(context)) };
+            }
+            catch (error) {
+                throw sandboxRefusal(error);
+            }
+        },
+        async sandboxFastForward(context, input) {
+            try {
+                const forward = await fastForwardSlotlockSandbox(store, tenantOf(context), input.minutes);
+                const { rollPending: _, ...maintenance } = forward.maintenance;
+                return { minutes: forward.minutes, holds: forward.holds, approvals: forward.approvals, maintenance };
+            }
+            catch (error) {
+                throw sandboxRefusal(error);
+            }
+        },
+        async sandboxRace(context, input) {
+            if (!options.agentBackend)
+                throw new SlotlockAgentOperationError('sandbox_unavailable', 409);
+            try {
+                const raced = await raceSlotlockSandbox({
+                    backend: options.agentBackend,
+                    tenantRef: tenantOf(context),
+                    resourceId: input.resource_id,
+                    start: new Date(input.starts_at),
+                    end: new Date(input.ends_at),
+                    ...(input.agents !== undefined ? { agents: input.agents } : {}),
+                });
+                return {
+                    agents: raced.agents,
+                    booked: raced.booked,
+                    refused: raced.refused,
+                    with_alternatives: raced.withAlternatives,
+                    server_errors: raced.serverErrors,
+                    p50_ms: raced.p50Ms,
+                    p99_ms: raced.p99Ms,
+                    max_ms: raced.maxMs,
+                };
+            }
+            catch (error) {
+                throw sandboxRefusal(error);
+            }
+        },
         async runMaintenance(context) {
             assertActive(context);
             try {
-                const { rollPending: _, zoneShifts, staleSources, noShows, waitlistOffers, ...result } = await maintainSlotlockTenant(store, tenantOf(context), {
+                const { rollPending: _, zoneShifts, staleSources, noShows, waitlistOffers, approvalsExpired, ...result } = await maintainSlotlockTenant(store, tenantOf(context), {
                     batches,
                     signal: context.signal,
                 });
@@ -1864,6 +3224,7 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                     stale_sources: staleSources,
                     no_shows: noShows,
                     waitlist_offers: waitlistOffers,
+                    approvals_expired: approvalsExpired,
                 };
             }
             catch (error) {