slotlock 0.8.0 → 0.10.0

package/ddl.d.ts

@@ -4,16 +4,17 @@ export declare const SLOTLOCK_SCHEMA_CONTROL_REFUSAL = "Slotlock will not deploy
  * The schema version this release creates, recorded in `slotlock.schema_version`. Up to 0.2
  * recorded nothing (0.1 was 1, 0.2 was 2); 0.3 to 0.5 recorded 3. 0.6 is 4, so a 0.5 release
  * refuses it rather than restoring the trigger that names a coverage source by its guessable
- * digest.
+ * digest. 0.10 is 5, so a 0.9 release refuses it rather than putting back an erase_tenant that
+ * leaves team workspaces, their members and invitations behind.
  */
-export declare const SLOTLOCK_SCHEMA_VERSION = 4;
+export declare const SLOTLOCK_SCHEMA_VERSION = 5;
 /** The start of the message with which the deployment DDL refuses a schema a newer release migrated. */
 export declare const SLOTLOCK_SCHEMA_NEWER_REFUSAL = "Slotlock will not migrate a schema a newer release migrated";
 /**
  * What every migration checks before changing anything, even when it finds nothing to change: no
  * other role controls the schema, then server and schema version. Run with search_path pinned.
  */
-export declare const SLOTLOCK_DEPLOYMENT_CHECKS = "DO $slotlock_schema_control$\nDECLARE\n  refusals text[];\nBEGIN\n  SELECT pg_catalog.array_agg(refusal.reason ORDER BY refusal.reason)\n    INTO refusals\n    FROM (\n      SELECT 'schema slotlock is owned by ' || owned_by.rolname AS reason\n        FROM pg_catalog.pg_namespace ns\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = ns.nspowner\n       WHERE ns.nspname = 'slotlock'\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n      UNION\n      SELECT COALESCE(grantee_role.rolname, 'PUBLIC') || ' can create objects in schema slotlock'\n        FROM pg_catalog.pg_namespace ns\n       CROSS JOIN LATERAL pg_catalog.aclexplode(ns.nspacl) acl\n        LEFT JOIN pg_catalog.pg_roles grantee_role ON grantee_role.oid = acl.grantee\n       WHERE ns.nspname = 'slotlock'\n         AND acl.privilege_type = 'CREATE'\n         AND acl.grantee <> ns.nspowner\n         AND (acl.grantee = 0\n              OR (grantee_role.rolname <> CURRENT_USER AND NOT grantee_role.rolsuper))\n      UNION\n      SELECT ident.type || ' ' || ident.identity || ' is owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_shdepend owned\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = owned.refobjid\n       CROSS JOIN LATERAL pg_catalog.pg_identify_object(owned.classid, owned.objid, owned.objsubid) ident\n       WHERE owned.dbid = (SELECT db.oid FROM pg_catalog.pg_database db\n                            WHERE db.datname = pg_catalog.current_database())\n         AND owned.deptype = 'o'\n         AND owned.refclassid = 'pg_catalog.pg_authid'::pg_catalog.regclass\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n         AND ident.schema = 'slotlock'\n      UNION\n      SELECT 'trigger ' || trg.tgname || ' on slotlock.' || rel.relname || ' runs '\n             || trg.tgfoid::pg_catalog.regprocedure::pg_catalog.text\n             || ', owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_trigger trg\n        JOIN pg_catalog.pg_class rel ON rel.oid = trg.tgrelid\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = rel.relnamespace\n        JOIN pg_catalog.pg_proc fn ON fn.oid = trg.tgfoid\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = fn.proowner\n       WHERE ns.nspname = 'slotlock'\n         AND NOT trg.tgisinternal\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n      UNION\n      SELECT COALESCE(grantee_role.rolname, 'PUBLIC') || ' can create triggers on slotlock.'\n             || rel.relname\n        FROM pg_catalog.pg_class rel\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = rel.relnamespace\n       CROSS JOIN LATERAL pg_catalog.aclexplode(rel.relacl) acl\n        LEFT JOIN pg_catalog.pg_roles grantee_role ON grantee_role.oid = acl.grantee\n       WHERE ns.nspname = 'slotlock'\n         AND acl.privilege_type = 'TRIGGER'\n         AND acl.grantee <> rel.relowner\n         AND (acl.grantee = 0\n              OR (grantee_role.rolname <> CURRENT_USER AND NOT grantee_role.rolsuper))\n      UNION\n      SELECT 'extension ' || ext.extname || ' in schema slotlock is owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_extension ext\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = ext.extnamespace\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = ext.extowner\n       WHERE ns.nspname = 'slotlock'\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n    ) refusal;\n  IF refusals IS NOT NULL THEN\n    RAISE EXCEPTION 'Slotlock will not deploy into schema slotlock: another role controls it'\n      USING ERRCODE = 'insufficient_privilege',\n            DETAIL = pg_catalog.to_jsonb(refusals)::pg_catalog.text,\n            HINT = 'The deployment role must own schema slotlock and every object in it, and no other role may create objects in it.';\n  END IF;\nEND\n$slotlock_schema_control$;\nDO $slotlock_schema_preconditions$\nDECLARE\n  installed integer;\nBEGIN\n  IF pg_catalog.current_setting('server_version_num')::integer < 160000 THEN\n    RAISE EXCEPTION 'Slotlock needs PostgreSQL 16 or later; this server is %',\n      pg_catalog.current_setting('server_version')\n      USING ERRCODE = 'feature_not_supported';\n  END IF;\n  IF pg_catalog.to_regclass('slotlock.schema_version') IS NOT NULL THEN\n    EXECUTE 'SELECT version FROM slotlock.schema_version WHERE singleton' INTO installed;\n    IF installed > 4 THEN\n      RAISE EXCEPTION 'Slotlock will not migrate a schema a newer release migrated (version %; this release is version 4)', installed\n        USING ERRCODE = 'object_not_in_prerequisite_state',\n              HINT = 'Migrate and serve it with the release that migrated it, or a later one.';\n    END IF;\n  END IF;\nEND\n$slotlock_schema_preconditions$;\n";
+export declare const SLOTLOCK_DEPLOYMENT_CHECKS = "DO $slotlock_schema_control$\nDECLARE\n  refusals text[];\nBEGIN\n  SELECT pg_catalog.array_agg(refusal.reason ORDER BY refusal.reason)\n    INTO refusals\n    FROM (\n      SELECT 'schema slotlock is owned by ' || owned_by.rolname AS reason\n        FROM pg_catalog.pg_namespace ns\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = ns.nspowner\n       WHERE ns.nspname = 'slotlock'\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n      UNION\n      SELECT COALESCE(grantee_role.rolname, 'PUBLIC') || ' can create objects in schema slotlock'\n        FROM pg_catalog.pg_namespace ns\n       CROSS JOIN LATERAL pg_catalog.aclexplode(ns.nspacl) acl\n        LEFT JOIN pg_catalog.pg_roles grantee_role ON grantee_role.oid = acl.grantee\n       WHERE ns.nspname = 'slotlock'\n         AND acl.privilege_type = 'CREATE'\n         AND acl.grantee <> ns.nspowner\n         AND (acl.grantee = 0\n              OR (grantee_role.rolname <> CURRENT_USER AND NOT grantee_role.rolsuper))\n      UNION\n      SELECT ident.type || ' ' || ident.identity || ' is owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_shdepend owned\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = owned.refobjid\n       CROSS JOIN LATERAL pg_catalog.pg_identify_object(owned.classid, owned.objid, owned.objsubid) ident\n       WHERE owned.dbid = (SELECT db.oid FROM pg_catalog.pg_database db\n                            WHERE db.datname = pg_catalog.current_database())\n         AND owned.deptype = 'o'\n         AND owned.refclassid = 'pg_catalog.pg_authid'::pg_catalog.regclass\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n         AND ident.schema = 'slotlock'\n      UNION\n      SELECT 'trigger ' || trg.tgname || ' on slotlock.' || rel.relname || ' runs '\n             || trg.tgfoid::pg_catalog.regprocedure::pg_catalog.text\n             || ', owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_trigger trg\n        JOIN pg_catalog.pg_class rel ON rel.oid = trg.tgrelid\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = rel.relnamespace\n        JOIN pg_catalog.pg_proc fn ON fn.oid = trg.tgfoid\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = fn.proowner\n       WHERE ns.nspname = 'slotlock'\n         AND NOT trg.tgisinternal\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n      UNION\n      SELECT COALESCE(grantee_role.rolname, 'PUBLIC') || ' can create triggers on slotlock.'\n             || rel.relname\n        FROM pg_catalog.pg_class rel\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = rel.relnamespace\n       CROSS JOIN LATERAL pg_catalog.aclexplode(rel.relacl) acl\n        LEFT JOIN pg_catalog.pg_roles grantee_role ON grantee_role.oid = acl.grantee\n       WHERE ns.nspname = 'slotlock'\n         AND acl.privilege_type = 'TRIGGER'\n         AND acl.grantee <> rel.relowner\n         AND (acl.grantee = 0\n              OR (grantee_role.rolname <> CURRENT_USER AND NOT grantee_role.rolsuper))\n      UNION\n      SELECT 'extension ' || ext.extname || ' in schema slotlock is owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_extension ext\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = ext.extnamespace\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = ext.extowner\n       WHERE ns.nspname = 'slotlock'\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n    ) refusal;\n  IF refusals IS NOT NULL THEN\n    RAISE EXCEPTION 'Slotlock will not deploy into schema slotlock: another role controls it'\n      USING ERRCODE = 'insufficient_privilege',\n            DETAIL = pg_catalog.to_jsonb(refusals)::pg_catalog.text,\n            HINT = 'The deployment role must own schema slotlock and every object in it, and no other role may create objects in it.';\n  END IF;\nEND\n$slotlock_schema_control$;\nDO $slotlock_schema_preconditions$\nDECLARE\n  installed integer;\nBEGIN\n  IF pg_catalog.current_setting('server_version_num')::integer < 160000 THEN\n    RAISE EXCEPTION 'Slotlock needs PostgreSQL 16 or later; this server is %',\n      pg_catalog.current_setting('server_version')\n      USING ERRCODE = 'feature_not_supported';\n  END IF;\n  IF pg_catalog.to_regclass('slotlock.schema_version') IS NOT NULL THEN\n    EXECUTE 'SELECT version FROM slotlock.schema_version WHERE singleton' INTO installed;\n    IF installed > 5 THEN\n      RAISE EXCEPTION 'Slotlock will not migrate a schema a newer release migrated (version %; this release is version 5)', installed\n        USING ERRCODE = 'object_not_in_prerequisite_state',\n              HINT = 'Migrate and serve it with the release that migrated it, or a later one.';\n    END IF;\n  END IF;\nEND\n$slotlock_schema_preconditions$;\n";
 /** Active (unrevoked, unexpired) API keys one tenant may hold. */
 export declare const SLOTLOCK_API_KEY_ACTIVE_LIMIT = 100;
 /** API keys one tenant may hold in all, revoked and expired ones included, so lists stay bounded. */
@@ -32,10 +33,33 @@ export declare const SLOTLOCK_API_KEY_FUNCTIONS: readonly ["slotlock.create_api_
  * The table behind the dashboard's shared records (dashboard.ts). No role but its owner holds a
  * right on it; it is reached only through SLOTLOCK_DASHBOARD_FUNCTIONS.
  */
-export declare const SLOTLOCK_DASHBOARD_TABLES: readonly ["dashboard_tokens", "dashboard_organizations"];
+export declare const SLOTLOCK_DASHBOARD_TABLES: readonly ["dashboard_tokens", "dashboard_organizations", "dashboard_people", "workspace_memberships", "workspaces", "workspace_invitations", "dashboard_sessions", "workspace_domains", "workspace_join_requests", "workspace_join_blocks", "sso_connections", "sso_identities", "sso_role_mappings", "dashboard_session_sso", "sso_bypasses", "scim_tokens", "scim_users", "scim_groups", "scim_group_members"];
 /** The SECURITY DEFINER functions through which the serving role reaches the dashboard's records. */
-export declare const SLOTLOCK_DASHBOARD_FUNCTIONS: readonly ["slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)", "slotlock.dashboard_session_ended(bytea, timestamptz)", "slotlock.enabled_organizations(text)", "slotlock.enable_organization(text, text, text)", "slotlock.disable_organization(text, text)"];
+export declare const SLOTLOCK_DASHBOARD_FUNCTIONS: readonly ["slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)", "slotlock.dashboard_session_ended(bytea, timestamptz)", "slotlock.enabled_organizations(text)", "slotlock.enable_organization(text, text, text)", "slotlock.disable_organization(text, text)", "slotlock.dashboard_sign_in(text, text)", "slotlock.dashboard_standing(text, text, bytea)", "slotlock.dashboard_sign_out_everywhere(text)", "slotlock.prune_audit_events(text)", "slotlock.dashboard_display(text, text)", "slotlock.create_team(text, text, text, integer)", "slotlock.workspace_info(text)", "slotlock.person_workspaces(text)", "slotlock.workspace_members(text)", "slotlock.workspace_invitations_list(text)", "slotlock.invite_member(text, text, text, text, text, text, bytea, integer, integer, integer)", "slotlock.invitation_preview(bytea)", "slotlock.accept_invitation(bytea, uuid, text, text[], integer)", "slotlock.revoke_invitation(text, text, uuid)", "slotlock.resend_invitation(text, text, uuid, bytea, integer, integer, integer)", "slotlock.change_member_role(text, text, text, text)", "slotlock.remove_member(text, text, text)", "slotlock.pending_invitations_for(text, text[])", "slotlock.workspace_active(text)", "slotlock.prune_workspace_invitations()", "slotlock.dashboard_session_started(text, bytea, timestamptz, text, text)", "slotlock.dashboard_session_seen(text, bytea)", "slotlock.dashboard_sessions_of(text)", "slotlock.dashboard_session_end(text, bytea)", "slotlock.prune_dashboard_sessions()", "slotlock.schedule_team_deletion(text, text, text)", "slotlock.cancel_team_deletion(text, text)", "slotlock.erase_deleted_teams()", "slotlock.workspace_delete_after(text)", "slotlock.member_scope(text, text)", "slotlock.set_member_scope(text, text, text, jsonb)", "slotlock.member_scopes(text)", "slotlock.claim_domain(text, text, text, text, text)", "slotlock.workspace_domains_list(text)", "slotlock.record_domain_check(uuid, text, text, text, text, text)", "slotlock.domains_due(integer)", "slotlock.release_domain(text, text, uuid)", "slotlock.set_invite_domain_restriction(text, text, boolean)", "slotlock.set_domain_join_policy(text, text, uuid, text)", "slotlock.discoverable_workspaces(text, text[])", "slotlock.request_to_join(text, text, text[], text, integer)", "slotlock.workspace_join_requests_list(text)", "slotlock.decide_join_request(text, text, uuid, text, text, integer)", "slotlock.workspace_domain_members(text)", "slotlock.prune_workspace_domains()", "slotlock.workspace_invites_restricted(text)", "slotlock.save_sso_connection(text, text, uuid, text, text, text, text, text, text, text, text, text[], boolean, text)", "slotlock.sso_connection_of(text)", "slotlock.sso_connection_by_id(uuid)", "slotlock.sso_connection_route(text, text)", "slotlock.record_sso_test(text, text, uuid, integer, jsonb)", "slotlock.set_sso_connection_status(text, text, uuid, text)", "slotlock.delete_sso_connection(text, text, uuid)", "slotlock.set_sso_provisioning(text, text, boolean, text, text)", "slotlock.set_sso_role_mapping(text, text, text, text)", "slotlock.sso_role_mappings_of(text)", "slotlock.sso_sign_in(uuid, text, text, text, text, text, boolean, text[], boolean, boolean, text, integer)", "slotlock.record_sso_proof(bytea, text, uuid, boolean, integer)", "slotlock.set_require_sso(text, text, bytea, boolean, integer)", "slotlock.sso_owner_bypass(text, text, bytea)", "slotlock.prune_sso()", "slotlock.enable_scim(text, text, text)", "slotlock.disable_scim(text, text)", "slotlock.create_scim_token(text, text, bytea, text)", "slotlock.revoke_scim_token(text, text, uuid)", "slotlock.scim_state(text)", "slotlock.scim_authenticate(bytea, text)", "slotlock.scim_put_user(text, uuid, uuid, text, text, boolean, text, text, text, text)", "slotlock.scim_users_list(text, text, text, integer, integer, uuid)", "slotlock.scim_delete_user(text, uuid)", "slotlock.scim_put_group(text, uuid, uuid, text, text, uuid[])", "slotlock.scim_groups_list(text, text, text, integer, integer, uuid)", "slotlock.scim_delete_group(text, uuid)", "slotlock.map_scim_group_role(text, text, uuid, text)", "slotlock.scim_bind(text, text[], integer)"];
+/**
+ * A workspace's roles (workspace-roles.ts), as workspace_memberships keeps them; and how long the
+ * audit log keeps an event.
+ */
+export declare const SLOTLOCK_WORKSPACE_ROLE_VALUES: readonly ["owner", "admin", "developer", "member", "viewer", "billing"];
+export declare const SLOTLOCK_AUDIT_RETENTION_DAYS = 180;
+/**
+ * Days the change history (slotlock.outbox: the feed, and each booking's history) keeps a change on
+ * each hosted plan (RFC 0004 D2). A tenant with no plan keeps the store's `retentionDays` (default
+ * 30); one with a plan keeps its plan's days, or the store's if longer. A cancelled plan keeps Free's.
+ * The workspace audit log keeps SLOTLOCK_AUDIT_RETENTION_DAYS, or the plan's days if longer.
+ */
+export declare const SLOTLOCK_CHANGE_RETENTION_BY_PLAN: Readonly<{
+    readonly free: 30;
+    readonly developer: 90;
+    readonly team: 400;
+}>;
 /** Live form records one person may leave in the dashboard's records (12 hours of forms). */
+/**
+ * The invitations one address is sent in a day, from every team together, where invitations are
+ * limited (a deployment with plans): with sign-up open, many accounts each within their own daily
+ * limit could otherwise fill one inbox.
+ */
+export declare const SLOTLOCK_INVITATIONS_PER_ADDRESS = 5;
 export declare const SLOTLOCK_DASHBOARD_FORM_LIMIT = 1000;
 /** The table that records which release migrated the schema (SLOTLOCK_SCHEMA_VERSION). */
 export declare const SLOTLOCK_SCHEMA_TABLES: readonly ["schema_version"];
@@ -47,13 +71,17 @@ export declare const SLOTLOCK_TENANT_ADMIN_TABLES: readonly ["tenant_suspensions
  * The SECURITY DEFINER functions through which a server checks a tenant's suspension and erases a
  * tenant, by signature.
  */
-export declare const SLOTLOCK_TENANT_ADMIN_FUNCTIONS: readonly ["slotlock.tenant_suspended(text)", "slotlock.erase_tenant(text)", "slotlock.register_webhook_tenant(text)", "slotlock.webhook_tenants(text)", "slotlock.unregister_webhook_tenant(text)", "slotlock.take_rate_token(text, double precision, double precision)", "slotlock.register_assistant_tenant(text, timestamptz)", "slotlock.sweep_assistant_conversations(integer)", "slotlock.list_maintenance_tenant()", "slotlock.maintenance_tenants(text)", "slotlock.tenant_plan(text)", "slotlock.set_tenant_plan(text, text, text, integer, integer, integer, text, text, timestamptz)", "slotlock.plan_default()", "slotlock.enrol_tenant_plan(text)", "slotlock.record_usage(uuid, jsonb)", "slotlock.roll_up_usage(text, integer)", "slotlock.tenant_usage(text, date, date)", "slotlock.tenant_quota_usage(text, date)", "slotlock.note_usage_threshold(text, date, text, integer, bigint, bigint)", "slotlock.tenant_plan_quotas(text)", "slotlock.reset_test_tenant(text)"];
+export declare const SLOTLOCK_TENANT_ADMIN_FUNCTIONS: readonly ["slotlock.tenant_suspended(text)", "slotlock.erase_tenant(text)", "slotlock.register_webhook_tenant(text)", "slotlock.webhook_tenants(text)", "slotlock.unregister_webhook_tenant(text)", "slotlock.take_rate_token(text, double precision, double precision)", "slotlock.register_assistant_tenant(text, timestamptz)", "slotlock.sweep_assistant_conversations(integer)", "slotlock.list_maintenance_tenant()", "slotlock.maintenance_tenants(text)", "slotlock.tenant_plan(text)", "slotlock.set_tenant_plan(text, text, text, integer, integer, integer, text, text, timestamptz)", "slotlock.plan_default()", "slotlock.enrol_tenant_plan(text)", "slotlock.record_usage(uuid, jsonb)", "slotlock.roll_up_usage(text, integer)", "slotlock.tenant_usage(text, date, date)", "slotlock.tenant_quota_usage(text, date)", "slotlock.note_usage_threshold(text, date, text, integer, bigint, bigint)", "slotlock.tenant_plan_quotas(text)", "slotlock.reset_test_tenant(text)", "slotlock.prune_changes(text, integer, integer)", "slotlock.erase_subject_changes(text, text, text, text)"];
 /** The functions usage metering runs (SLOTLOCK_USAGE=on): serve checks it may, before it starts. */
 export declare const SLOTLOCK_USAGE_FUNCTIONS: readonly ["slotlock.record_usage(uuid, jsonb)", "slotlock.roll_up_usage(text, integer)", "slotlock.tenant_usage(text, date, date)"];
 /** The functions quotas run (SLOTLOCK_QUOTAS=on, quotas.ts): serve checks it may, before it starts. */
 export declare const SLOTLOCK_QUOTA_FUNCTIONS: readonly ["slotlock.tenant_plan(text)", "slotlock.tenant_quota_usage(text, date)", "slotlock.note_usage_threshold(text, date, text, integer, bigint, bigint)"];
 /** What a plan's monthly quotas count (quotas.ts): operations run and bookings made. */
 export declare const SLOTLOCK_QUOTA_METRICS: readonly ["operations", "bookings"];
+/** The most conversations a member keeps with the dashboard assistant: past it, the least recent goes. */
+export declare const SLOTLOCK_ASSISTANT_MAX_CHATS = 100;
+/** How a conversation with the assistant is named: 16 URL-safe characters. */
+export declare const SLOTLOCK_ASSISTANT_CHAT_ID: RegExp;
 /** The shares of a quota, in percent, at which a tenant is told once a month (usage.threshold_reached). */
 export declare const SLOTLOCK_QUOTA_NOTICE_PERCENTS: readonly [80, 100];
 /** The most bookings past the roll-up cursor one quota read counts: more than any plan allows. */
@@ -82,9 +110,16 @@ export declare const SLOTLOCK_OPERATOR_FUNCTIONS: readonly ["slotlock.suspend_te
 export declare const SLOTLOCK_PARTNER_FUNCTIONS: readonly ["slotlock.partner_tenant_blocked(text)", "slotlock.authenticate_partner_key(bytea)", "slotlock.partner_contract(text)", "slotlock.put_partner_account(text, text, text)", "slotlock.list_partner_accounts(text)", "slotlock.get_partner_account(text, text)", "slotlock.set_partner_account_suspended(text, text, boolean, text)", "slotlock.partner_usage(text, date, date, text)", "slotlock.partner_account_tenant(text, text)", "slotlock.record_partner_reconciliation(text, date, integer, integer, numeric)"];
 /** The partner tables: owner-only, reached through SLOTLOCK_PARTNER_FUNCTIONS. */
 export declare const SLOTLOCK_PARTNER_TABLES: readonly ["partners", "partner_keys", "partner_accounts", "partner_invoices", "partner_month_closes", "partner_erased_usage", "partner_reconciliations"];
-export declare const SLOTLOCK_DEFINER_FUNCTIONS: readonly ("slotlock.authenticate_api_key(bytea)" | "slotlock.authenticate_limited_api_key(bytea)" | "slotlock.authenticate_partner_key(bytea)" | "slotlock.authenticate_scoped_api_key(bytea)" | "slotlock.create_api_key(text, text, text, bytea, text[], timestamptz, text)" | "slotlock.dashboard_session_ended(bytea, timestamptz)" | "slotlock.disable_organization(text, text)" | "slotlock.enable_organization(text, text, text)" | "slotlock.enabled_organizations(text)" | "slotlock.enrol_tenant_plan(text)" | "slotlock.erase_api_keys(text)" | "slotlock.erase_tenant(text)" | "slotlock.get_partner_account(text, text)" | "slotlock.installed_schema_version()" | "slotlock.list_api_key_limits(text)" | "slotlock.list_api_key_resource_scopes(text)" | "slotlock.list_api_keys(text)" | "slotlock.list_maintenance_tenant()" | "slotlock.list_partner_accounts(text)" | "slotlock.maintenance_tenants(text)" | "slotlock.note_usage_threshold(text, date, text, integer, bigint, bigint)" | "slotlock.partner_account_tenant(text, text)" | "slotlock.partner_contract(text)" | "slotlock.partner_tenant_blocked(text)" | "slotlock.partner_usage(text, date, date, text)" | "slotlock.plan_default()" | "slotlock.put_partner_account(text, text, text)" | "slotlock.record_partner_reconciliation(text, date, integer, integer, numeric)" | "slotlock.record_usage(uuid, jsonb)" | "slotlock.register_assistant_tenant(text, timestamptz)" | "slotlock.register_webhook_tenant(text)" | "slotlock.reset_test_tenant(text)" | "slotlock.revoke_api_key(text, uuid)" | "slotlock.roll_up_usage(text, integer)" | "slotlock.rotate_api_key(text, uuid, text, bytea)" | "slotlock.set_api_key_limits(text, uuid, integer, integer, integer, boolean)" | "slotlock.set_api_key_resource_scope(text, uuid, text[], text[])" | "slotlock.set_partner_account_suspended(text, text, boolean, text)" | "slotlock.set_tenant_plan(text, text, text, integer, integer, integer, text, text, timestamptz)" | "slotlock.sweep_assistant_conversations(integer)" | "slotlock.take_rate_token(text, double precision, double precision)" | "slotlock.tenant_plan(text)" | "slotlock.tenant_plan_quotas(text)" | "slotlock.tenant_quota_usage(text, date)" | "slotlock.tenant_suspended(text)" | "slotlock.tenant_usage(text, date, date)" | "slotlock.unregister_webhook_tenant(text)" | "slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)" | "slotlock.webhook_tenants(text)")[];
+export declare const SLOTLOCK_DEFINER_FUNCTIONS: readonly ("slotlock.accept_invitation(bytea, uuid, text, text[], integer)" | "slotlock.authenticate_api_key(bytea)" | "slotlock.authenticate_limited_api_key(bytea)" | "slotlock.authenticate_partner_key(bytea)" | "slotlock.authenticate_scoped_api_key(bytea)" | "slotlock.cancel_team_deletion(text, text)" | "slotlock.change_member_role(text, text, text, text)" | "slotlock.claim_domain(text, text, text, text, text)" | "slotlock.create_api_key(text, text, text, bytea, text[], timestamptz, text)" | "slotlock.create_scim_token(text, text, bytea, text)" | "slotlock.create_team(text, text, text, integer)" | "slotlock.dashboard_display(text, text)" | "slotlock.dashboard_session_end(text, bytea)" | "slotlock.dashboard_session_ended(bytea, timestamptz)" | "slotlock.dashboard_session_seen(text, bytea)" | "slotlock.dashboard_session_started(text, bytea, timestamptz, text, text)" | "slotlock.dashboard_sessions_of(text)" | "slotlock.dashboard_sign_in(text, text)" | "slotlock.dashboard_sign_out_everywhere(text)" | "slotlock.dashboard_standing(text, text, bytea)" | "slotlock.decide_join_request(text, text, uuid, text, text, integer)" | "slotlock.delete_sso_connection(text, text, uuid)" | "slotlock.disable_organization(text, text)" | "slotlock.disable_scim(text, text)" | "slotlock.discoverable_workspaces(text, text[])" | "slotlock.domains_due(integer)" | "slotlock.enable_organization(text, text, text)" | "slotlock.enable_scim(text, text, text)" | "slotlock.enabled_organizations(text)" | "slotlock.enrol_tenant_plan(text)" | "slotlock.erase_api_keys(text)" | "slotlock.erase_deleted_teams()" | "slotlock.erase_subject_changes(text, text, text, text)" | "slotlock.erase_tenant(text)" | "slotlock.get_partner_account(text, text)" | "slotlock.installed_schema_version()" | "slotlock.invitation_preview(bytea)" | "slotlock.invite_member(text, text, text, text, text, text, bytea, integer, integer, integer)" | "slotlock.list_api_key_limits(text)" | "slotlock.list_api_key_resource_scopes(text)" | "slotlock.list_api_keys(text)" | "slotlock.list_maintenance_tenant()" | "slotlock.list_partner_accounts(text)" | "slotlock.maintenance_tenants(text)" | "slotlock.map_scim_group_role(text, text, uuid, text)" | "slotlock.member_scope(text, text)" | "slotlock.member_scopes(text)" | "slotlock.note_usage_threshold(text, date, text, integer, bigint, bigint)" | "slotlock.partner_account_tenant(text, text)" | "slotlock.partner_contract(text)" | "slotlock.partner_tenant_blocked(text)" | "slotlock.partner_usage(text, date, date, text)" | "slotlock.pending_invitations_for(text, text[])" | "slotlock.person_workspaces(text)" | "slotlock.plan_default()" | "slotlock.prune_audit_events(text)" | "slotlock.prune_changes(text, integer, integer)" | "slotlock.prune_dashboard_sessions()" | "slotlock.prune_sso()" | "slotlock.prune_workspace_domains()" | "slotlock.prune_workspace_invitations()" | "slotlock.put_partner_account(text, text, text)" | "slotlock.record_domain_check(uuid, text, text, text, text, text)" | "slotlock.record_partner_reconciliation(text, date, integer, integer, numeric)" | "slotlock.record_sso_proof(bytea, text, uuid, boolean, integer)" | "slotlock.record_sso_test(text, text, uuid, integer, jsonb)" | "slotlock.record_usage(uuid, jsonb)" | "slotlock.register_assistant_tenant(text, timestamptz)" | "slotlock.register_webhook_tenant(text)" | "slotlock.release_domain(text, text, uuid)" | "slotlock.remove_member(text, text, text)" | "slotlock.request_to_join(text, text, text[], text, integer)" | "slotlock.resend_invitation(text, text, uuid, bytea, integer, integer, integer)" | "slotlock.reset_test_tenant(text)" | "slotlock.revoke_api_key(text, uuid)" | "slotlock.revoke_invitation(text, text, uuid)" | "slotlock.revoke_scim_token(text, text, uuid)" | "slotlock.roll_up_usage(text, integer)" | "slotlock.rotate_api_key(text, uuid, text, bytea)" | "slotlock.save_sso_connection(text, text, uuid, text, text, text, text, text, text, text, text, text[], boolean, text)" | "slotlock.schedule_team_deletion(text, text, text)" | "slotlock.scim_authenticate(bytea, text)" | "slotlock.scim_bind(text, text[], integer)" | "slotlock.scim_delete_group(text, uuid)" | "slotlock.scim_delete_user(text, uuid)" | "slotlock.scim_groups_list(text, text, text, integer, integer, uuid)" | "slotlock.scim_put_group(text, uuid, uuid, text, text, uuid[])" | "slotlock.scim_put_user(text, uuid, uuid, text, text, boolean, text, text, text, text)" | "slotlock.scim_state(text)" | "slotlock.scim_users_list(text, text, text, integer, integer, uuid)" | "slotlock.set_api_key_limits(text, uuid, integer, integer, integer, boolean)" | "slotlock.set_api_key_resource_scope(text, uuid, text[], text[])" | "slotlock.set_domain_join_policy(text, text, uuid, text)" | "slotlock.set_invite_domain_restriction(text, text, boolean)" | "slotlock.set_member_scope(text, text, text, jsonb)" | "slotlock.set_partner_account_suspended(text, text, boolean, text)" | "slotlock.set_require_sso(text, text, bytea, boolean, integer)" | "slotlock.set_sso_connection_status(text, text, uuid, text)" | "slotlock.set_sso_provisioning(text, text, boolean, text, text)" | "slotlock.set_sso_role_mapping(text, text, text, text)" | "slotlock.set_tenant_plan(text, text, text, integer, integer, integer, text, text, timestamptz)" | "slotlock.sso_connection_by_id(uuid)" | "slotlock.sso_connection_of(text)" | "slotlock.sso_connection_route(text, text)" | "slotlock.sso_owner_bypass(text, text, bytea)" | "slotlock.sso_role_mappings_of(text)" | "slotlock.sso_sign_in(uuid, text, text, text, text, text, boolean, text[], boolean, boolean, text, integer)" | "slotlock.sweep_assistant_conversations(integer)" | "slotlock.take_rate_token(text, double precision, double precision)" | "slotlock.tenant_plan(text)" | "slotlock.tenant_plan_quotas(text)" | "slotlock.tenant_quota_usage(text, date)" | "slotlock.tenant_suspended(text)" | "slotlock.tenant_usage(text, date, date)" | "slotlock.unregister_webhook_tenant(text)" | "slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)" | "slotlock.webhook_tenants(text)" | "slotlock.workspace_active(text)" | "slotlock.workspace_delete_after(text)" | "slotlock.workspace_domain_members(text)" | "slotlock.workspace_domains_list(text)" | "slotlock.workspace_info(text)" | "slotlock.workspace_invitations_list(text)" | "slotlock.workspace_invites_restricted(text)" | "slotlock.workspace_join_requests_list(text)" | "slotlock.workspace_members(text)")[];
+/**
+ * Tenant tables the serving role may only add to and read (no UPDATE or DELETE): the audit log,
+ * whose rows go only through slotlock.prune_audit_events and erasure, and the change history,
+ * whose rows go only through slotlock.prune_changes and erasure, and whose one edit is taking a
+ * person out of it (slotlock.erase_subject_changes).
+ */
+export declare const SLOTLOCK_APPEND_ONLY_TABLES: readonly ["outbox", "audit_events"];
 /** Tables no role but their owner reads or writes, reached only through SLOTLOCK_DEFINER_FUNCTIONS. */
-export declare const SLOTLOCK_DEFINER_TABLES: readonly ("api_key_limits" | "api_key_resource_scopes" | "api_key_retired_digests" | "api_keys" | "assistant_tenants" | "dashboard_organizations" | "dashboard_tokens" | "maintenance_tenants" | "overage_reports" | "partner_accounts" | "partner_erased_usage" | "partner_invoices" | "partner_keys" | "partner_month_closes" | "partner_reconciliations" | "partners" | "plan_defaults" | "rate_buckets" | "schema_version" | "tenant_plans" | "tenant_suspensions" | "usage_cursors" | "usage_daily" | "usage_flushes" | "usage_meter_start" | "usage_notices" | "webhook_tenants")[];
+export declare const SLOTLOCK_DEFINER_TABLES: readonly ("api_key_limits" | "api_key_resource_scopes" | "api_key_retired_digests" | "api_keys" | "assistant_tenants" | "dashboard_organizations" | "dashboard_people" | "dashboard_session_sso" | "dashboard_sessions" | "dashboard_tokens" | "maintenance_tenants" | "overage_reports" | "partner_accounts" | "partner_erased_usage" | "partner_invoices" | "partner_keys" | "partner_month_closes" | "partner_reconciliations" | "partners" | "plan_defaults" | "rate_buckets" | "schema_version" | "scim_group_members" | "scim_groups" | "scim_tokens" | "scim_users" | "sso_bypasses" | "sso_connections" | "sso_identities" | "sso_role_mappings" | "tenant_plans" | "tenant_suspensions" | "usage_cursors" | "usage_daily" | "usage_flushes" | "usage_meter_start" | "usage_notices" | "webhook_tenants" | "workspace_domains" | "workspace_invitations" | "workspace_join_blocks" | "workspace_join_requests" | "workspace_memberships" | "workspaces")[];
 /**
  * The advisory lock every server transaction for a tenant holds shared (store.ts withTenant), and
  * suspension and erasure take exclusively, keyed by this text's hashtextextended(…, 0).
@@ -116,7 +151,7 @@ export declare const SLOTLOCK_TENANT_CONTEXT_SETTING = "slotlock.tenant_ref";
  * `slotlock.rls_policy_contracts` and `slotlock.deployment_lifted_row_security` are
  * deployment-only and deliberately absent.
  */
-export declare const SLOTLOCK_TENANT_TABLES: readonly ["resources", "reservations", "reservation_tombstones", "reservation_conflict_archive", "calendar_events", "calendar_event_attendees", "calendar_event_reminders", "calendar_event_exceptions", "calendar_event_occurrences", "calendar_event_tombstones", "calendar_event_commands", "calendar_coverage", "hold_commands", "outbox", "outbox_pruned", "webhook_endpoints", "waitlist_entries", "booking_rule_defaults", "assistant_settings", "assistant_conversations", "locations", "resource_groups", "resource_group_members", "pool_settings", "composite_claims", "approval_policies", "approvals"];
+export declare const SLOTLOCK_TENANT_TABLES: readonly ["resources", "reservations", "reservation_tombstones", "reservation_conflict_archive", "calendar_events", "calendar_event_attendees", "calendar_event_reminders", "calendar_event_exceptions", "calendar_event_occurrences", "calendar_event_tombstones", "calendar_event_commands", "calendar_coverage", "hold_commands", "outbox", "outbox_pruned", "webhook_endpoints", "waitlist_entries", "booking_rule_defaults", "assistant_settings", "assistant_conversations", "assistant_chats", "audit_events", "locations", "resource_groups", "resource_group_members", "pool_settings", "composite_claims", "approval_policies", "approvals", "availability_defaults", "availability_exceptions", "holiday_calendars", "contacts", "reminder_dispatches", "reservation_reminder_dispatches", "hold_payments", "source_busy", "tenant_exports", "tenant_export_parts"];
 /**
  * Build the grants for the application role: USAGE on the schema, DML on the store's tables and
  * EXECUTE on the API key and dashboard functions, nothing else. The role must not be able to leave