slotlock 0.8.0 → 0.10.0

package/agent-store-backend.js

@@ -5,11 +5,15 @@ import { slotlockCloudEvent } from './webhooks.js';
 import { createHash } from 'node:crypto';
 import { SLOTLOCK_DEFAULT_APPROVAL_MINUTES, SLOTLOCK_KEY_APPROVAL_POLICY, SLOTLOCK_MAX_APPROVAL_MINUTES, SlotlockApprovalPolicyError, } from './approvals.js';
 import { SlotlockAgentOperationError, } from './agent-server.js';
-import { bookingSearch, bookingSearchBlocked, bookingSearchReach, } from './booking-rules.js';
+import { bookingSearch, hoursApplyOf, bookingSearchBlocked, bookingSearchReach, } from './booking-rules.js';
 import { findNextAvailable, mergeIntervals } from './engine.js';
-import { expandRules } from './rules.js';
+import { applicableHours, coveredByOpenWindows, dayToDate, epochDay, exceptionDays, exceptionRanges, openWindows, } from './hours.js';
+import { readSlotlockHolidayCalendar } from './holiday-import.js';
+import { SLOTLOCK_OVERRIDE_RESOURCES, } from './availability-store.js';
+import { findEarliestRange } from './ranges.js';
 import { emitVAvailability, parseVAvailability, toJSCalendarEvent } from './interop.js';
-import { calendarEventRollingHorizon, } from './store.js';
+import { buildSlotlockTenantExport, slotlockAuditEventRecord, SLOTLOCK_INTERNAL_EVENT_OWNER_REF, calendarEventRollingHorizon, } from './store.js';
+import { slotlockResourceSearchWords, slotlockSearchResources } from './resource-search.js';
 import { maintainSlotlockTenant } from './maintenance.js';
 import { fastForwardSlotlockSandbox, raceSlotlockSandbox, resetSlotlockSandbox, seedSlotlockSandbox, } from './sandbox.js';
 import { SLOTLOCK_TEST_TENANT_SUFFIX } from './api-keys.js';
@@ -38,6 +42,20 @@ const WRITE = { isolation: 'read committed' };
  */
 const APPROVAL_GRANT = Symbol('slotlock.approvalGrant');
 const OCCUPANCY_PROBE = Symbol('slotlock.occupancyProbe');
+/**
+ * A booking the tenant's own systems make through the application API (RFC 0004 B7), not an
+ * agent's: its events are the tenant's (owner `internal`), outside any key's quota and kept when the
+ * key is revoked, and only approval policies that include the application hold it.
+ */
+const TENANT_ACTOR = Symbol('slotlock.tenantActor');
+/** Whether the call books for the tenant's own systems (TENANT_ACTOR), not an agent. */
+function forTenant(context) {
+    return context[TENANT_ACTOR] === true;
+}
+/** The tenant's own identity for a retry key: per tenant, so any of its keys replays it. */
+function tenantDigest(context, idempotencyKey) {
+    return createHash('sha256').update(`${context.principal.tenantRef}\0tenant\0${idempotencyKey}`).digest('hex');
+}
 /** Thrown out of a dry run's transaction, with its answer, so the transaction rolls back. */
 class DryRunRollback {
     value;
@@ -60,6 +78,52 @@ function assertActive(context) {
     if (context.signal.aborted)
         throw new SlotlockAgentOperationError('request_aborted', 503);
 }
+/** A tenant export as the API gives it. */
+function tenantExportOutput(made) {
+    return {
+        id: made.id,
+        status: made.status,
+        requested_by: made.requestedBy,
+        created_at: made.createdAt.toISOString(),
+        finished_at: made.finishedAt?.toISOString() ?? null,
+        expires_at: made.expiresAt.toISOString(),
+        parts: made.parts,
+        rows: made.rows,
+        bytes: made.bytes,
+        tables: made.tables,
+        error: made.error,
+    };
+}
+/** A key's own caps on what its agent holds (RFC 0004 A5), or undefined when it has none. */
+function keyHoldCaps(context) {
+    const limits = context.principal.limits;
+    return limits?.maxHolds !== undefined || limits?.maxHeldHours !== undefined
+        ? {
+            ...(limits.maxHolds !== undefined ? { maxHolds: limits.maxHolds } : {}),
+            ...(limits.maxHeldHours !== undefined ? { maxHeldHours: limits.maxHeldHours } : {}),
+        }
+        : undefined;
+}
+/** The agent an approval holds time for, and its key's caps. */
+function approvalHolder(context) {
+    const caps = keyHoldCaps(context);
+    return caps ? { ref: agentOwnerRef(context), caps } : { ref: agentOwnerRef(context) };
+}
+/** The person an access or erasure request names (RFC 0004 D3), as the schema checked it. */
+function subjectOf(input) {
+    for (const kind of ['email', 'holder', 'contact', 'reference']) {
+        const value = input[kind];
+        if (typeof value === 'string')
+            return { [kind]: value };
+    }
+    throw new SlotlockAgentOperationError('invalid_subject', 400);
+}
+function subjectRefusal(error) {
+    if (error?.code === 'invalid_subject') {
+        throw new SlotlockAgentOperationError('invalid_subject', 400);
+    }
+    throw error;
+}
 async function withTenant(store, context, callback, options) {
     assertActive(context);
     let value;
@@ -225,15 +289,21 @@ function uuidFromDigest(value) {
     return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-${variant}${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
 }
 function agentOwnerRef(context) {
+    if (forTenant(context))
+        return SLOTLOCK_INTERNAL_EVENT_OWNER_REF;
     return `agent:${createHash('sha256')
         .update(`${context.principal.tenantRef}\0${context.principal.subject}`)
         .digest('hex')}`;
 }
 function agentExternalRef(context, idempotencyKey) {
+    if (forTenant(context))
+        return `tenant:${tenantDigest(context, idempotencyKey)}`;
     // Already a stable client-visible identity; keep it unchanged.
     return `agent:${agentPrincipalDigest(context, idempotencyKey)}`;
 }
 function agentCommandIdempotencyKey(context, idempotencyKey) {
+    if (forTenant(context))
+        return `tenant-command:${tenantDigest(context, idempotencyKey)}`;
     // The principal stays in the digest so this remains safe with older tenant-only stores; hashing
     // keeps the subject and raw retry key out of durable rows.
     return `agent-command:${agentPrincipalDigest(context, idempotencyKey)}`;
@@ -293,7 +363,7 @@ export function projectSlotlockCalendarEvent(event) {
 export function slotlockAgentErrorStatus(code) {
     if (code === 'resource_tenant_mismatch' || code.endsWith('_not_found'))
         return 404;
-    if (code.startsWith('invalid_'))
+    if (code.startsWith('invalid_') || code === 'duration_required')
         return 400;
     if (code === 'owner_event_quota_exceeded' || code === 'owner_command_quota_exceeded')
         return 429;
@@ -306,6 +376,13 @@ const BOOKING_RULE_CODES = Object.freeze({
     slot_step: 'booking_rule_slot_step',
     outside_hours: 'booking_rule_outside_hours',
     uncertain: 'booking_rule_uncertain',
+    min_duration: 'booking_rule_min_duration',
+    max_duration: 'booking_rule_max_duration',
+    duration_not_allowed: 'booking_rule_duration_not_allowed',
+    pickup_time: 'booking_rule_pickup_time',
+    return_time: 'booking_rule_return_time',
+    cancel_cutoff: 'booking_rule_cancel_cutoff',
+    reschedule_cutoff: 'booking_rule_reschedule_cutoff',
 });
 function operationError(refusal, details) {
     const code = typeof refusal === 'string'
@@ -340,6 +417,43 @@ async function overlapDetails(tenantStore, context, refusal) {
         ...(booking.eventRef !== null && booking.eventOwnerRef === owner ? { conflicting_event_id: booking.eventRef } : {}),
     };
 }
+/**
+ * Slots on a resource whose hours hold a hire only at its ends (`hoursApply`): up to `limit` of
+ * `durationMs` from `from` to the window's end, each the range search's earliest after the last,
+ * so a slot may run from one local day to another and is judged as a write of it is.
+ */
+async function rangedSlots(tenantStore, context, resource, window, from, durationMs, busy, limit, availabilityRules) {
+    const fallback = resource.availabilityRules === undefined && resource.inheritedAvailability === undefined
+        ? await availabilityRules(context, resource)
+        : [];
+    const exceptions = (await tenantStore.availabilityExceptionsFor({
+        tenantRef: context.principal.tenantRef,
+        resourceIds: [resource.id],
+        window: { start: new Date(window.start.getTime() - 86_400_000), end: new Date(window.end.getTime() + 86_400_000) },
+    })).get(resource.id) ?? [];
+    const rules = { ...resource.effectiveBookingRules, allowedDurations: [Math.round(durationMs / 60_000)] };
+    const hours = applicableHours(resource, fallback).rules;
+    const now = new Date();
+    const lastStart = window.end.getTime() - durationMs;
+    const slots = [];
+    for (let start = from; slots.length < limit && start <= lastStart;) {
+        const range = findEarliestRange({
+            busy,
+            rules,
+            timezone: resource.timezone,
+            hours,
+            exceptions,
+            now,
+            pickup: { start: new Date(start), end: new Date(lastStart) },
+            return: { start: new Date(start + durationMs), end: window.end },
+        });
+        if (!range)
+            break;
+        slots.push(range);
+        start = range.end.getTime();
+    }
+    return slots;
+}
 /** Resource and event ids: the UUIDs the store issues and validates. */
 const STORE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function parseResourceCursor(value) {
@@ -400,8 +514,59 @@ async function requireResource(tenantStore, tenantRef, resourceId, visibility) {
     return resource;
 }
 /** The caller's shared resource with this id: what an agent may see and book. */
-function requireAgentResource(tenantStore, tenantRef, resourceId) {
-    return requireResource(tenantStore, tenantRef, resourceId, 'shared');
+/** The most resources a search or a not-found's candidates look through: more than a tenant may have. */
+const MAX_SEARCHED_RESOURCES = 5_000;
+/** A tenant's resources agents may see, in pages, up to MAX_SEARCHED_RESOURCES. */
+async function sharedResources(tenantStore, tenantRef, filter = {}) {
+    const all = [];
+    let after;
+    while (all.length < MAX_SEARCHED_RESOURCES) {
+        const page = await tenantStore.listResources({
+            tenantRef,
+            visibility: 'shared',
+            limit: 1_000,
+            ...(after !== undefined ? { after } : {}),
+            ...filter,
+        });
+        all.push(...page);
+        if (page.length < 1_000)
+            break;
+        after = page.at(-1)?.id;
+    }
+    return all.slice(0, MAX_SEARCHED_RESOURCES);
+}
+/**
+ * The refusal for an id that names no resource the caller can see. When what was given is not an
+ * id at all (a name or a reference, as a model will pass), it names up to three resources that best
+ * match it, so the caller can try again with the right id.
+ */
+async function resourceNotFound(tenantStore, tenantRef, given) {
+    if (STORE_ID_PATTERN.test(given) || typeof given !== 'string' || given.trim() === '') {
+        return new SlotlockAgentOperationError('resource_not_found', 404);
+    }
+    let words;
+    try {
+        words = slotlockResourceSearchWords(given);
+    }
+    catch {
+        return new SlotlockAgentOperationError('resource_not_found', 404);
+    }
+    const best = slotlockSearchResources(await sharedResources(tenantStore, tenantRef), words).slice(0, 3);
+    const details = Object.fromEntries(best.map((match, index) => [
+        `candidate_${String(index + 1)}`,
+        `${match.resource.id} ${match.resource.name ?? match.resource.externalRef ?? ''}`.trim().slice(0, 200),
+    ]));
+    return new SlotlockAgentOperationError('resource_not_found', 404, details);
+}
+async function requireAgentResource(tenantStore, tenantRef, resourceId) {
+    try {
+        return await requireResource(tenantStore, tenantRef, resourceId, 'shared');
+    }
+    catch (error) {
+        if (error.code !== 'resource_not_found')
+            throw error;
+        throw await resourceNotFound(tenantStore, tenantRef, resourceId);
+    }
 }
 /**
  * The store's change feed for live updates (`subscriptions.changes`): each tenant's changes read
@@ -418,6 +583,31 @@ export function createSlotlockStoreChangeSource(store, sql) {
     };
 }
 /** Bind the protocol server to the production store without giving a request control of tenancy. */
+/**
+ * Each resource's open hours within `window` (RFC 0004 B1, B2): its own weekly hours, else what it
+ * inherits from its location or tenant, else the server's, with the exceptions that reach it applied.
+ * One query reads every resource's exceptions.
+ */
+async function hoursWithin(tenantStore, context, resources, window, options) {
+    const exceptions = await tenantStore.availabilityExceptionsFor({
+        tenantRef: context.principal.tenantRef,
+        resourceIds: resources.map((resource) => resource.id),
+        window,
+    });
+    const open = new Map();
+    for (const resource of resources) {
+        const fallback = resource.availabilityRules === undefined && resource.inheritedAvailability === undefined
+            ? await options.availabilityRules(context, resource)
+            : [];
+        open.set(resource.id, openWindows({
+            hours: applicableHours(resource, fallback).rules,
+            exceptions: exceptions.get(resource.id) ?? [],
+            timezone: resource.timezone,
+            window,
+        }));
+    }
+    return open;
+}
 export function createSlotlockStoreAgentBackend(store, options) {
     const maxApprovalMinutes = options.maxApprovalMinutes ?? SLOTLOCK_MAX_APPROVAL_MINUTES;
     if (!(Number.isSafeInteger(maxApprovalMinutes) && maxApprovalMinutes >= 1 && maxApprovalMinutes <= SLOTLOCK_MAX_APPROVAL_MINUTES)) {
@@ -463,6 +653,11 @@ export function createSlotlockStoreAgentBackend(store, options) {
                         source: 'agent-server',
                         // The key's own caps, below the server's (RFC 0004 A5).
                         ...(holderCaps ? { holderCaps } : {}),
+                        // Its price is the tenant's (holdPrice), never the agent's own (RFC 0004 C3).
+                        priceFromRules: true,
+                        // Booked only once your system records its payment (RFC 0004 C3).
+                        ...(input.payment_required === true ? { paymentRequired: true } : {}),
+                        ...(input.payment !== undefined ? { payment: amountInput(input.payment) } : {}),
                     });
                     if (result.ok) {
                         holds.push({
@@ -471,6 +666,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
                             start: result.hold.start.toISOString(),
                             end: result.hold.end.toISOString(),
                             expires_at: result.hold.expiresAt.toISOString(),
+                            ...(result.hold.paymentRequired ? { payment_required: true, payment_amount: amountOutput(result.hold.paymentAmount) } : {}),
                         });
                     }
                     else {
@@ -480,6 +676,74 @@ export function createSlotlockStoreAgentBackend(store, options) {
                 return { group_id: groupId, holds, refused };
             });
         },
+        async holdTogether(context, rawInput) {
+            const input = rawInput;
+            const holderRef = agentOwnerRef(context);
+            const limits = context.principal.limits;
+            const holderCaps = limits?.maxHolds !== undefined || limits?.maxHeldHours !== undefined
+                ? {
+                    ...(limits.maxHolds !== undefined ? { maxHolds: limits.maxHolds } : {}),
+                    ...(limits.maxHeldHours !== undefined ? { maxHeldHours: limits.maxHeldHours } : {}),
+                }
+                : undefined;
+            // Sorted, so sets over the same resources lock in one order; one group per agent and key.
+            const resourceIds = [...new Set(input.resource_ids)].sort();
+            if (resourceIds.length < 2)
+                throw new SlotlockAgentOperationError('invalid_arguments', 400);
+            const groupId = uuidFromDigest(`slotlock-hold-together\0${holderRef}\0${input.idempotency_key}`);
+            return withTenant(store, context, async (tenantStore) => {
+                for (const resourceId of resourceIds) {
+                    try {
+                        await requireAgentResource(tenantStore, context.principal.tenantRef, resourceId);
+                    }
+                    catch (error) {
+                        if (!(error instanceof SlotlockAgentOperationError))
+                            throw error;
+                        throw new SlotlockAgentOperationError(error.code, error.status, { resource_id: resourceId });
+                    }
+                    const result = await tenantStore.acquireHold({
+                        tenantRef: context.principal.tenantRef,
+                        principalRef: holderRef,
+                        holderRef,
+                        idempotencyKey: agentCommandIdempotencyKey(context, `${input.idempotency_key}\0together\0${resourceId}`),
+                        groupId,
+                        resourceId,
+                        start: new Date(input.start),
+                        end: new Date(input.end),
+                        ttlMs: input.ttl_seconds * 1_000,
+                        source: 'slotlock:together',
+                        ...(holderCaps ? { holderCaps } : {}),
+                        // Its price is the tenant's (holdPrice), never the agent's own (RFC 0004 C3).
+                        priceFromRules: true,
+                    });
+                    // All or nothing: thrown, so the holds already made roll back with it.
+                    if (!result.ok) {
+                        const refusal = operationError(result);
+                        throw new SlotlockAgentOperationError(refusal.code, refusal.status, { resource_id: resourceId });
+                    }
+                }
+                // One time to live for the set: each expires when the earliest does.
+                const holds = await tenantStore.holdGroup({
+                    tenantRef: context.principal.tenantRef,
+                    holderRef,
+                    groupId,
+                    alignExpiry: true,
+                });
+                if (holds.length !== resourceIds.length)
+                    throw new SlotlockAgentOperationError('store_inconsistent', 503);
+                return {
+                    group_id: groupId,
+                    holds: holds.map((hold) => ({
+                        hold_id: hold.holdId,
+                        resource_id: hold.resourceId,
+                        start: hold.start.toISOString(),
+                        end: hold.end.toISOString(),
+                        expires_at: hold.expiresAt.toISOString(),
+                    })),
+                    expires_at: holds[0].expiresAt.toISOString(),
+                };
+            });
+        },
         async bookPool(context, rawInput) {
             const input = rawInput;
             const content = {
@@ -564,6 +828,8 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     [window.end.getTime(), 0],
                 ]);
                 let complete = true;
+                const enforced = members.filter((member) => member.effectiveBookingRules?.enforceHours === true);
+                const memberHours = enforced.length > 0 ? await hoursWithin(tenantStore, context, enforced, window, options) : new Map();
                 for (const member of members) {
                     const sources = await requiredSources(options, context, member);
                     const freeBusy = await readFreeBusy(tenantStore, {
@@ -590,8 +856,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
                         ? [{ start: search.window.start, end: new Date(Math.min(search.window.end.getTime(), latestStart)) }]
                         : [];
                     if (rules?.enforceHours === true && open.length > 0) {
-                        const hours = member.availabilityRules ?? (await options.availabilityRules(context, member));
-                        const windows = expandRules(hours, window, member.timezone);
+                        const windows = memberHours.get(member.id) ?? [];
                         windowsLeft -= windows.length;
                         if (windowsLeft < 0)
                             throw new SlotlockAgentOperationError('calendar_work_limit', 400);
@@ -665,11 +930,25 @@ export function createSlotlockStoreAgentBackend(store, options) {
                         throw new SlotlockAgentOperationError(error.code, error.status, { resource_id: resourceId });
                     }
                 }
+                // A set held together (RFC 0004 B7) is booked from its holds: each must be the agent's, live,
+                // and for exactly this time.
+                const held = new Map();
+                if (input.hold_group_id !== undefined) {
+                    const holds = await tenantStore.holdGroup({
+                        tenantRef: context.principal.tenantRef,
+                        holderRef: agentOwnerRef(context),
+                        groupId: input.hold_group_id,
+                    });
+                    for (const hold of holds)
+                        held.set(hold.resourceId, hold.holdId);
+                }
                 const events = [];
                 let replayed = true;
                 for (const resourceId of resourceIds) {
                     const key = `${input.idempotency_key}\0${resourceId}`;
+                    const holdId = held.get(resourceId);
                     const result = await tenantStore.putCalendarEvent({
+                        ...(holdId !== undefined ? { fromHold: { holdId, holderRef: agentOwnerRef(context) } } : {}),
                         tenantRef: context.principal.tenantRef,
                         ownerRef: agentOwnerRef(context),
                         externalRef: agentExternalRef(context, key),
@@ -815,6 +1094,13 @@ export function createSlotlockStoreAgentBackend(store, options) {
             const labels = input.labels;
             const location = input.location;
             const group = input.group;
+            let words;
+            try {
+                words = typeof input.query === 'string' ? slotlockResourceSearchWords(input.query) : undefined;
+            }
+            catch {
+                throw new SlotlockAgentOperationError('invalid_arguments', 400);
+            }
             // What a resource says about itself, for an agent to show and choose by; its attributes are
             // the integrator's, and stay on the application API.
             const output = (resource) => ({
@@ -845,19 +1131,34 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     const places = location === undefined
                         ? null
                         : locationAndBelow(await tenantStore.listLocations({ tenantRef: context.principal.tenantRef }), location);
-                    return {
-                        resources: (await tenantStore.listPoolMembers({
-                            tenantRef: context.principal.tenantRef,
-                            pool: input.pool,
-                            visibility: 'shared',
-                        }))
-                            .filter((resource) => (kind === undefined || (resource.kind ?? 'other') === kind) &&
-                            (labels === undefined || slotlockResourceHasLabels(resource.labels, labels)) &&
-                            (places === null || (resource.location !== undefined && places.has(resource.location))) &&
-                            (group === undefined || resource.groups?.includes(group) === true))
-                            .map(output),
-                        next_cursor: null,
-                    };
+                    const members = (await tenantStore.listPoolMembers({
+                        tenantRef: context.principal.tenantRef,
+                        pool: input.pool,
+                        visibility: 'shared',
+                    })).filter((resource) => (kind === undefined || (resource.kind ?? 'other') === kind) &&
+                        (labels === undefined || slotlockResourceHasLabels(resource.labels, labels)) &&
+                        (places === null || (resource.location !== undefined && places.has(resource.location))) &&
+                        (group === undefined || resource.groups?.includes(group) === true));
+                    // Searched, the best matches first; else in the order slotlock_book_pool tries them.
+                    const shown = words === undefined
+                        ? members
+                        : slotlockSearchResources(members, words)
+                            .slice(0, input.limit)
+                            .map((match) => match.resource);
+                    return { resources: shown.map(output), next_cursor: null };
+                });
+            }
+            if (words !== undefined) {
+                // A search ranks every resource the filters allow (as many as a tenant may have), best first.
+                return withTenant(store, context, async (tenantStore) => {
+                    const candidates = await sharedResources(tenantStore, context.principal.tenantRef, {
+                        ...(kind !== undefined ? { kind } : {}),
+                        ...(labels !== undefined ? { labels } : {}),
+                        ...(location !== undefined ? { location } : {}),
+                        ...(group !== undefined ? { group } : {}),
+                    });
+                    const best = slotlockSearchResources(candidates, words).slice(0, input.limit);
+                    return { resources: best.map((match) => output(match.resource)), next_cursor: null };
                 });
             }
             return withTenant(store, context, async (tenantStore) => {
@@ -921,6 +1222,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     timezone: resource.timezone,
                     window,
                     now: new Date(),
+                    durationMs,
                 });
                 const sources = await requiredSources(options, context, resource);
                 const freeBusy = await readFreeBusy(tenantStore, {
@@ -935,8 +1237,13 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     return { slots: [], certain: false };
                 if (!search)
                     return { slots: [], certain: true };
-                const rules = resource.availabilityRules ?? (await options.availabilityRules(context, resource));
-                const windows = expandRules(rules, search.window, resource.timezone);
+                // Where the hours hold a hire only at its ends (hoursApply), a slot may run from one local
+                // day to another: each from the range search, judged as a write of it is.
+                if (hoursApplyOf(resource.effectiveBookingRules) === 'ends') {
+                    const ranged = await rangedSlots(tenantStore, context, resource, window, search.window.start.getTime(), durationMs, freeBusy.busy, input.limit, options.availabilityRules);
+                    return { slots: ranged.map((slot) => ({ start: slot.start.toISOString(), end: slot.end.toISOString() })), certain: true };
+                }
+                const windows = (await hoursWithin(tenantStore, context, [resource], search.window, options)).get(resource.id) ?? [];
                 if (windows.length > MAX_REQUEST_RULE_WINDOWS)
                     throw new SlotlockAgentOperationError('calendar_work_limit', 400);
                 const busy = bookingSearchBlocked(freeBusy.busy, search);
@@ -957,6 +1264,96 @@ export function createSlotlockStoreAgentBackend(store, options) {
                 return { slots, certain: true };
             });
         },
+        async defaultDuration(context, resourceIds) {
+            return withTenant(store, context, async (tenantStore) => {
+                const lengths = new Set();
+                for (const resourceId of resourceIds) {
+                    const resource = await requireAgentResource(tenantStore, context.principal.tenantRef, resourceId);
+                    lengths.add(resource.effectiveBookingRules?.defaultDurationMinutes);
+                }
+                const [only] = [...lengths];
+                return lengths.size === 1 && only !== undefined ? only : null;
+            });
+        },
+        async findAvailableRanges(context, input) {
+            const tenantRef = context.principal.tenantRef;
+            const pickup = { start: new Date(input.pickup_start), end: new Date(input.pickup_end) };
+            const days = input.days;
+            const back = input.return_start !== undefined
+                ? { start: new Date(input.return_start), end: new Date(input.return_end) }
+                : undefined;
+            const limit = input.limit;
+            const charge = busyBudget();
+            const now = new Date();
+            return withTenant(store, context, async (tenantStore) => {
+                let resources;
+                if (typeof input.pool === 'string') {
+                    resources = await tenantStore.listPoolMembers({ tenantRef, pool: input.pool, visibility: 'shared', ordered: true });
+                    if (resources.length === 0)
+                        throw new SlotlockAgentOperationError('pool_not_found', 404);
+                    resources = resources.slice(0, 100);
+                }
+                else {
+                    resources = [];
+                    for (const resourceId of distinctResourceIds(input)) {
+                        resources.push(await requireAgentResource(tenantStore, tenantRef, resourceId));
+                    }
+                }
+                // What a range may reach: the pick-up window, the longest it may run, and its buffers.
+                const lastEnd = back ? back.end.getTime() : pickup.end.getTime() + ((days ?? 1) + 1) * 86_400_000;
+                const reach = { start: new Date(pickup.start.getTime() - 86_400_000), end: new Date(lastEnd + 8 * 86_400_000) };
+                const exceptions = await tenantStore.availabilityExceptionsFor({
+                    tenantRef,
+                    resourceIds: resources.map((resource) => resource.id),
+                    window: reach,
+                });
+                const ranges = [];
+                let complete = true;
+                for (const resource of resources) {
+                    const sources = await requiredSources(options, context, resource);
+                    const freeBusy = await readFreeBusy(tenantStore, {
+                        tenantRef,
+                        resourceId: resource.id,
+                        window: reach,
+                        requiredSources: [...sources],
+                        ...(options.coverageMaxAgeMs !== undefined ? { coverageMaxAgeMs: options.coverageMaxAgeMs } : {}),
+                    });
+                    charge(freeBusy.busy.length);
+                    if (freeBusy.coverage.state !== 'complete') {
+                        complete = false;
+                        continue;
+                    }
+                    const fallback = resource.availabilityRules === undefined && resource.inheritedAvailability === undefined
+                        ? await options.availabilityRules(context, resource)
+                        : [];
+                    const found = findEarliestRange({
+                        busy: freeBusy.busy,
+                        rules: resource.effectiveBookingRules,
+                        timezone: resource.timezone,
+                        hours: applicableHours(resource, fallback).rules,
+                        exceptions: exceptions.get(resource.id) ?? [],
+                        now,
+                        pickup,
+                        ...(back ? { return: back } : {}),
+                        ...(days !== undefined ? { days } : {}),
+                    });
+                    if (found)
+                        ranges.push({ resource_id: resource.id, start: found.start.toISOString(), end: found.end.toISOString() });
+                }
+                const window = { start: pickup.start, end: new Date(lastEnd) };
+                const answer = {
+                    ranges: complete
+                        ? ranges
+                            .sort((a, b) => Date.parse(a.start) - Date.parse(b.start) || a.resource_id.localeCompare(b.resource_id))
+                            .slice(0, limit)
+                        : [],
+                    coverage: coverageProjection(window, complete),
+                };
+                return typeof input.pool === 'string'
+                    ? { ...answer, selected_resource_ids: resources.map((resource) => resource.id) }
+                    : answer;
+            });
+        },
         async findNextAvailable(context, input) {
             const window = interval(input);
             const resourceIds = distinctResourceIds(input);
@@ -974,6 +1371,7 @@ export function createSlotlockStoreAgentBackend(store, options) {
                         timezone: resource.timezone,
                         window,
                         now: new Date(),
+                        durationMs,
                     });
                     const sources = await requiredSources(options, context, resource);
                     const freeBusy = await readFreeBusy(tenantStore, {
@@ -993,17 +1391,23 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     }
                     if (!search)
                         continue;
-                    const rules = resource.availabilityRules ?? (await options.availabilityRules(context, resource));
-                    const windows = expandRules(rules, search.window, resource.timezone);
-                    windowsLeft -= windows.length;
-                    if (windowsLeft < 0)
-                        throw new SlotlockAgentOperationError('calendar_work_limit', 400);
-                    const candidate = findNextAvailable({
-                        busy: bookingSearchBlocked(freeBusy.busy, search),
-                        windows,
-                        durationMs,
-                        ...(search.align ? { align: search.align } : {}),
-                    });
+                    let candidate;
+                    if (hoursApplyOf(resource.effectiveBookingRules) === 'ends') {
+                        // A slot may run from one local day to another: the range search's earliest.
+                        [candidate = null] = await rangedSlots(tenantStore, context, resource, window, search.window.start.getTime(), durationMs, freeBusy.busy, 1, options.availabilityRules);
+                    }
+                    else {
+                        const windows = (await hoursWithin(tenantStore, context, [resource], search.window, options)).get(resource.id) ?? [];
+                        windowsLeft -= windows.length;
+                        if (windowsLeft < 0)
+                            throw new SlotlockAgentOperationError('calendar_work_limit', 400);
+                        candidate = findNextAvailable({
+                            busy: bookingSearchBlocked(freeBusy.busy, search),
+                            windows,
+                            durationMs,
+                            ...(search.align ? { align: search.align } : {}),
+                        });
+                    }
                     if (candidate &&
                         (!best ||
                             candidate.start.getTime() < best.interval.start.getTime() ||
@@ -1066,6 +1470,8 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     ...(typeof input.hold_id === 'string'
                         ? { fromHold: { holdId: input.hold_id, holderRef: agentOwnerRef(context) } }
                         : {}),
+                    // Tell no one about it (RFC 0004 P3).
+                    ...(input.notify === false ? { notify: false } : {}),
                 });
                 if (!result.ok)
                     throw operationError(result, await overlapDetails(tenantStore, context, result));
@@ -1237,6 +1643,8 @@ export function createSlotlockStoreAgentBackend(store, options) {
                     ...(current ? { expectedResourceId: current.resourceId } : {}),
                     idempotencyKey: agentCommandIdempotencyKey(context, input.idempotency_key),
                     expectedRevision: input.expected_revision,
+                    // An agent is held to the resource's cancel cutoff (RFC 0004 B5).
+                    enforceBookingRules: true,
                 });
                 if (!result.ok)
                     throw operationError(result);
@@ -1254,6 +1662,42 @@ export function createSlotlockStoreAgentBackend(store, options) {
     };
     return withApprovalPolicies(store, options, maxApprovalMinutes, backend);
 }
+/** An exception as the API answers it. */
+function exceptionOutput(exception) {
+    return {
+        id: exception.id,
+        location: exception.location ?? null,
+        resource_id: exception.resourceId ?? null,
+        starts_on: exception.startsOn,
+        ends_on: exception.endsOn,
+        outcome: exception.outcome,
+        hours: exception.hours?.map((window) => ({ start_minutes: window.startMinutes, duration_minutes: window.durationMinutes })) ??
+            null,
+        label: exception.label,
+        source: exception.source,
+        calendar_id: exception.calendarId ?? null,
+        created_at: exception.createdAt.toISOString(),
+    };
+}
+function holidayCalendarOutput(calendar) {
+    return {
+        calendar_id: calendar.id,
+        name: calendar.name,
+        location: calendar.location ?? null,
+        resource_id: calendar.resourceId ?? null,
+        url: calendar.url ?? null,
+        imported_at: calendar.importedAt?.toISOString() ?? null,
+        next_import_at: calendar.nextImportAt?.toISOString() ?? null,
+        last_error: calendar.lastError ?? null,
+        closures: calendar.closures,
+        created_at: calendar.createdAt.toISOString(),
+    };
+}
+/** Days the exports and imports of hours reach: a year on from yesterday. */
+function exportDays() {
+    const today = Math.floor(Date.now() / 86_400_000);
+    return { from: dayToDate(today - 1), to: dayToDate(today + 366) };
+}
 function storeRefusal(error) {
     const code = error?.code;
     if (typeof code !== 'string')
@@ -1280,9 +1724,12 @@ function storeRefusal(error) {
         code === 'pool_order_limit_reached' ||
         code === 'composite_too_deep' ||
         code === 'composite_parts_limit' ||
-        code === 'composite_busy') {
+        code === 'composite_busy' ||
+        code === 'availability_exceptions_limit_reached') {
         return new SlotlockAgentOperationError(code, 409);
     }
+    if (code === 'holiday_calendar_unreachable')
+        return new SlotlockAgentOperationError(code, 400);
     if (code.startsWith('invalid_') && code !== 'invalid_transaction_isolation') {
         return new SlotlockAgentOperationError(code, 400);
     }
@@ -1331,6 +1778,7 @@ function approvalPolicyOutput(policy) {
         outcome: policy.outcome,
         approval_ttl_minutes: policy.approvalTtlMinutes,
         lead_minutes: policy.leadMinutes,
+        include_application: policy.includeApplication,
         created_at: policy.createdAt.toISOString(),
         updated_at: policy.updatedAt.toISOString(),
     };
@@ -1370,6 +1818,16 @@ function approvalOutput(approval) {
         created_at: approval.createdAt.toISOString(),
     };
 }
+/** A store refusal as the application API answers it, a broken booking rule by its own code. */
+function applicationRuleRefusal(result) {
+    return result.code === 'booking_rule_violated' && result.rule
+        ? new SlotlockAgentOperationError(`booking_rule_${result.rule}`, 409)
+        : applicationRefusal(result.code);
+}
+/** A recorded cancellation fee as the API answers it (RFC 0004 B5). */
+function feeOutput(fee) {
+    return fee ? { amount_minor: fee.amountMinor, currency: fee.currency } : null;
+}
 function applicationRefusal(code) {
     if (code === 'resource_tenant_mismatch') {
         return new SlotlockAgentOperationError('resource_not_found', 404);
@@ -1393,6 +1851,8 @@ function waitlistOutput(entry) {
         hold_id: entry.holdId,
         offered_resource_id: entry.offeredResourceId,
         offered_at: entry.offeredAt?.toISOString() ?? null,
+        duration_minutes: entry.durationMs === null ? null : Math.round(entry.durationMs / 60_000),
+        decided_at: entry.decidedAt?.toISOString() ?? null,
         created_at: entry.createdAt.toISOString(),
     };
 }
@@ -1409,6 +1869,8 @@ function keyApprovalPolicy() {
         outcome: 'require_approval',
         approvalTtlMinutes: SLOTLOCK_DEFAULT_APPROVAL_MINUTES,
         leadMinutes: 0,
+        // The key's own approval holds whatever it books, for the tenant too.
+        includeApplication: true,
         createdAt: new Date(0),
         updatedAt: new Date(0),
     };
@@ -1477,10 +1939,26 @@ function withApprovalPolicies(store, options, maxApprovalMinutes, backend) {
     /** Whether [start, end) on the resource falls outside its bookable hours. */
     async function outsideHours(tenantStore, context, resourceId, start, end) {
         const resource = await requireAgentResource(tenantStore, context.principal.tenantRef, resourceId);
-        const hours = resource.availabilityRules ?? (await options.availabilityRules(context, resource));
-        const windows = mergeIntervals(expandRules(hours, { start: new Date(start.getTime() - 86_400_000), end: new Date(end.getTime() + 86_400_000) }, resource.timezone));
-        return !windows.some((window) => window.start <= start && window.end >= end);
+        const reach = { start: new Date(start.getTime() - 86_400_000), end: new Date(end.getTime() + 86_400_000) };
+        const windows = (await hoursWithin(tenantStore, context, [resource], reach, options)).get(resource.id) ?? [];
+        return !coveredByOpenWindows(windows, { start, end });
     }
+    /**
+     * What an update may change without booking any time: everything else (time, resource, zone,
+     * transparency, status, recurrence and its exceptions) is judged by what it would add.
+     */
+    const EVENT_DETAIL_FIELDS = new Set([
+        'event_id',
+        'expected_revision',
+        'expected_resource_id',
+        'idempotency_key',
+        'title',
+        'description',
+        'location',
+        'organizer',
+        'attendees',
+        'reminders',
+    ]);
     /** The write's ask and the policies that may cover it, or null when none can. */
     async function plan(tenantStore, context, operation, input) {
         const tenantRef = context.principal.tenantRef;
@@ -1538,15 +2016,18 @@ function withApprovalPolicies(store, options, maxApprovalMinutes, backend) {
             const current = await tenantStore.getCalendarEvent({ tenantRef, ownerRef, externalRef: input.event_id });
             if (!current)
                 return null;
+            // Details alone book nothing. Any other change may: a move, or time the event did not hold
+            // (made opaque or confirmed, given occurrences or fewer exceptions, another zone), judged
+            // below by what the write would add to what the event holds.
+            if (Object.keys(input).every((field) => EVENT_DETAIL_FIELDS.has(field)))
+                return null;
             const resourceId = input.resource_id ?? current.resourceId;
             const start = input.starts_at ? new Date(input.starts_at) : current.start;
             const end = input.ends_at ? new Date(input.ends_at) : current.end;
-            // Only a move to another time or resource is a booking a policy can be about.
-            if (resourceId === current.resourceId && start.getTime() === current.start.getTime() && end.getTime() === current.end.getTime()) {
-                return null;
-            }
+            const moved = resourceId !== current.resourceId || start.getTime() !== current.start.getTime() || end.getTime() !== current.end.getTime();
             asked = {
-                kind: 'move',
+                // Time added in place is a booking of its own; a move is a move.
+                kind: moved ? 'move' : 'single',
                 stored: 'slotlock_update_event',
                 resourceIds: [resourceId],
                 externalRefs: [current.externalRef],
@@ -1558,7 +2039,10 @@ function withApprovalPolicies(store, options, maxApprovalMinutes, backend) {
         }
         const minutes = (asked.end.getTime() - asked.start.getTime()) / 60_000;
         // What the ask alone decides; hours wait for the resource the write takes.
-        const policies = (await tenantStore.approvalPoliciesFor({ tenantRef, resourceIds: asked.resourceIds })).filter((policy) => (policy.conditions.kinds === undefined || policy.conditions.kinds.includes(asked.kind)) &&
+        const policies = (await tenantStore.approvalPoliciesFor({ tenantRef, resourceIds: asked.resourceIds })).filter((policy) => 
+        // The tenant's own bookings are held only by policies that include the application.
+        (!forTenant(context) || policy.includeApplication === true) &&
+            (policy.conditions.kinds === undefined || policy.conditions.kinds.includes(asked.kind)) &&
             (policy.conditions.longerThanMinutes === undefined || minutes > policy.conditions.longerThanMinutes));
         if (policies.length === 0 && !keyPolicy)
             return null;
@@ -1580,18 +2064,20 @@ function withApprovalPolicies(store, options, maxApprovalMinutes, backend) {
             });
             if (asked.prior) {
                 const { hold_id: _held, ...request } = input;
-                // Granted: the booking was made with this key, so the write answers it as a replay (and
-                // the store refuses another request with it). Without the hold the approval took over,
-                // as the grant made it.
-                if (asked.prior.status === 'granted')
-                    return method.call(this, context, request);
                 const kept = { ...asked.prior.request };
                 // A pool booking is kept as the member it would take.
                 if (operation === 'slotlock_book_pool')
                     delete kept.resource_id;
+                // The key answers only the request a person was asked about, granted or not: a grant
+                // approves that booking, never another made with its key (a bundle's other resources, say,
+                // which the store would take as new).
                 if (JSON.stringify(canonical(kept)) !== JSON.stringify(canonical(request))) {
                     throw new SlotlockAgentOperationError('idempotency_conflict', 409);
                 }
+                // Granted: the booking was made with this key, so the write answers it as a replay.
+                // Without the hold the approval took over, as the grant made it.
+                if (asked.prior.status === 'granted')
+                    return method.call(this, context, request);
                 throw approvalAnswer(asked.prior);
             }
             const ask = asked.plan;
@@ -1615,6 +2101,11 @@ function withApprovalPolicies(store, options, maxApprovalMinutes, backend) {
             if (probed.replayed === true || occupied.length === 0) {
                 return context.dryRun ? probed : method.call(this, context, input);
             }
+            // Only time the event did not already hold needs a person: an edit or a move within its own
+            // time books nothing new.
+            const holds = uncovered(occupied, ask.before);
+            if (holds.length === 0)
+                return context.dryRun ? probed : method.call(this, context, input);
             const written = [...new Set(occupied.map((occupation) => occupation.resourceId))];
             const decided = await withTenant(store, { ...context, dryRun: false }, async (tenantStore) => {
                 // A pool's policies are those of the member the write would take, and its pool.
@@ -1662,9 +2153,6 @@ function withApprovalPolicies(store, options, maxApprovalMinutes, backend) {
                     expires_at: expiresAt.toISOString(),
                 });
             }
-            const holds = uncovered(occupied, ask.before);
-            if (holds.length === 0)
-                return method.call(this, context, input);
             const chosen = ask.pool ? written[0] : undefined;
             const { hold_id: _hold, ...request } = input;
             const principal = context.principal;
@@ -1682,6 +2170,8 @@ function withApprovalPolicies(store, options, maxApprovalMinutes, backend) {
                         : {}),
                     ...(context.origin !== undefined ? { origin: context.origin } : {}),
                     ...(ask.pool !== undefined ? { pool: ask.pool } : {}),
+                    // Granted, it is made as the tenant's again, never as the key's agent.
+                    ...(forTenant(context) ? { for: 'tenant' } : {}),
                 },
                 requesterRef: principal.subject,
                 requestKey,
@@ -1690,8 +2180,14 @@ function withApprovalPolicies(store, options, maxApprovalMinutes, backend) {
                 end: ask.end,
                 expiresAt,
                 ...(ask.consumeHold ? { consumeHold: ask.consumeHold } : {}),
+                // An agent's approvals hold time against its own caps (RFC 0004 A5); the tenant's own
+                // systems have none.
+                ...(forTenant(context) ? {} : { holder: approvalHolder(context) }),
             }), WRITE);
             if (!result.ok) {
+                if (result.code === 'hold_limit_reached' || result.code === 'held_time_limit_reached') {
+                    throw new SlotlockAgentOperationError(result.code, 409, { limit: String(result.limit) });
+                }
                 if (result.code === 'approval_limit_reached') {
                     throw new SlotlockAgentOperationError('approval_limit_reached', 429, { limit: String(result.limit ?? '') });
                 }
@@ -1751,6 +2247,7 @@ export async function runSlotlockApprovalGrant(agentBackend, approval, grant) {
             decidedBy: grant.decidedBy,
             ...(typeof requester.pool === 'string' ? { pool: requester.pool } : {}),
         },
+        ...(requester.for === 'tenant' ? { [TENANT_ACTOR]: true } : {}),
     };
     const method = approval.operation === 'slotlock_book_together'
         ? agentBackend.bookTogether
@@ -1838,8 +2335,34 @@ function bookingRulesOutput(rules) {
         ...(rules.enforceHours !== undefined ? { enforce_hours: rules.enforceHours } : {}),
         ...(rules.checkInMinutes !== undefined ? { check_in_minutes: rules.checkInMinutes } : {}),
         ...(rules.requireCertain !== undefined ? { require_certain: rules.requireCertain } : {}),
+        ...(rules.minDurationMinutes !== undefined ? { min_duration_minutes: rules.minDurationMinutes } : {}),
+        ...(rules.maxDurationMinutes !== undefined ? { max_duration_minutes: rules.maxDurationMinutes } : {}),
+        ...(rules.allowedDurations !== undefined ? { allowed_durations: [...rules.allowedDurations] } : {}),
+        ...(rules.defaultDurationMinutes !== undefined ? { default_duration_minutes: rules.defaultDurationMinutes } : {}),
+        ...(rules.pickupTimes !== undefined ? { pickup_times: dayWindowsOutput(rules.pickupTimes) } : {}),
+        ...(rules.returnTimes !== undefined ? { return_times: dayWindowsOutput(rules.returnTimes) } : {}),
+        ...(rules.hoursApply !== undefined ? { hours_apply: rules.hoursApply } : {}),
+        ...(rules.cancelCutoffMinutes !== undefined ? { cancel_cutoff_minutes: rules.cancelCutoffMinutes } : {}),
+        ...(rules.rescheduleCutoffMinutes !== undefined ? { reschedule_cutoff_minutes: rules.rescheduleCutoffMinutes } : {}),
+        ...(rules.cancellationFee !== undefined
+            ? {
+                cancellation_fee: {
+                    amount_minor: rules.cancellationFee.amountMinor,
+                    currency: rules.cancellationFee.currency,
+                    ...(rules.cancellationFee.withinMinutes !== undefined ? { within_minutes: rules.cancellationFee.withinMinutes } : {}),
+                },
+            }
+            : {}),
+        ...(rules.holdPrice !== undefined
+            ? { hold_price: { amount_minor: rules.holdPrice.amountMinor, currency: rules.holdPrice.currency } }
+            : {}),
     };
 }
+const dayWindowsOutput = (windows) => windows.map((window) => ({ start_minutes: window.startMinutes, duration_minutes: window.durationMinutes }));
+const dayWindowsInput = (value) => value.map((window) => ({
+    startMinutes: window.start_minutes,
+    durationMinutes: window.duration_minutes,
+}));
 function bookingRulesInput(value) {
     if (value === null || value === undefined)
         return null;
@@ -1864,6 +2387,38 @@ function bookingRulesInput(value) {
         rules.checkInMinutes = input.check_in_minutes;
     if (input.require_certain !== undefined)
         rules.requireCertain = input.require_certain;
+    if (input.min_duration_minutes !== undefined)
+        rules.minDurationMinutes = input.min_duration_minutes;
+    if (input.max_duration_minutes !== undefined)
+        rules.maxDurationMinutes = input.max_duration_minutes;
+    if (input.allowed_durations !== undefined)
+        rules.allowedDurations = [...input.allowed_durations];
+    if (input.default_duration_minutes !== undefined) {
+        rules.defaultDurationMinutes = input.default_duration_minutes;
+    }
+    if (input.pickup_times !== undefined)
+        rules.pickupTimes = dayWindowsInput(input.pickup_times);
+    if (input.return_times !== undefined)
+        rules.returnTimes = dayWindowsInput(input.return_times);
+    if (input.hours_apply === 'whole' || input.hours_apply === 'ends')
+        rules.hoursApply = input.hours_apply;
+    if (input.cancel_cutoff_minutes !== undefined)
+        rules.cancelCutoffMinutes = input.cancel_cutoff_minutes;
+    if (input.reschedule_cutoff_minutes !== undefined) {
+        rules.rescheduleCutoffMinutes = input.reschedule_cutoff_minutes;
+    }
+    if (input.cancellation_fee !== undefined) {
+        const fee = input.cancellation_fee;
+        rules.cancellationFee = {
+            amountMinor: fee.amount_minor,
+            currency: fee.currency,
+            ...(fee.within_minutes !== undefined ? { withinMinutes: fee.within_minutes } : {}),
+        };
+    }
+    if (input.hold_price !== undefined) {
+        const price = input.hold_price;
+        rules.holdPrice = { amountMinor: price.amount_minor, currency: price.currency };
+    }
     return rules;
 }
 function resourceOutput(resource) {
@@ -1886,6 +2441,13 @@ function resourceOutput(resource) {
         location: resource.location ?? null,
         groups: resource.groups ?? [],
         parent_id: resource.parentId ?? null,
+        inherited_availability: resource.inheritedAvailability
+            ? {
+                source: resource.inheritedAvailability.source,
+                location: resource.inheritedAvailability.location ?? null,
+                rules: rulesOutput(resource.inheritedAvailability.rules) ?? [],
+            }
+            : null,
         part_index: resource.partIndex ?? null,
     };
 }
@@ -1941,6 +2503,36 @@ function holdOutput(hold) {
         end: hold.end.toISOString(),
         expires_at: hold.expiresAt.toISOString(),
         source: hold.source,
+        ...(hold.paymentRequired
+            ? {
+                payment_required: true,
+                payment_ref: hold.paymentRef ?? null,
+                paid_at: hold.paidAt?.toISOString() ?? null,
+                payment_amount: amountOutput(hold.paymentAmount),
+                paid_amount: amountOutput(hold.paidAmount),
+            }
+            : {}),
+    };
+}
+function amountOutput(amount) {
+    return amount ? { amount_minor: amount.amountMinor, currency: amount.currency } : null;
+}
+function amountInput(value) {
+    const amount = value;
+    return amount ? { amountMinor: amount.amount_minor, currency: amount.currency } : undefined;
+}
+function contactOutput(contact) {
+    return {
+        contact_ref: contact.ref,
+        name: contact.name,
+        email: contact.email,
+        phone: contact.phone,
+        whatsapp: contact.whatsapp,
+        consent: contact.consent,
+        consent_at: Object.fromEntries(Object.entries(contact.consentAt).map(([channel, at]) => [channel, at.toISOString()])),
+        locale: contact.locale,
+        created_at: contact.createdAt.toISOString(),
+        updated_at: contact.updatedAt.toISOString(),
     };
 }
 function reservationOutput(reservation) {
@@ -1954,6 +2546,9 @@ function reservationOutput(reservation) {
         buffer_after_minutes: Math.ceil(reservation.bufferAfterMs / 60_000),
         revision: reservation.revision,
         source: reservation.source,
+        ...(reservation.contactRef ? { contact_ref: reservation.contactRef } : {}),
+        ...(reservation.notify === false ? { notify: false } : {}),
+        ...(reservation.reminderMinutes ? { reminder_minutes: reservation.reminderMinutes } : {}),
     };
 }
 /**
@@ -2288,15 +2883,29 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
         async exportResourceAvailability(context, input) {
             return withTenant(store, context, async (tenant) => {
                 const resource = await requireResource(tenant, tenantOf(context), input.resource_id);
-                if (resource.availabilityRules === undefined)
+                const rules = resource.availabilityRules ?? resource.inheritedAvailability?.rules;
+                if (rules === undefined)
                     return { icalendar: null };
-                return {
-                    icalendar: emitVAvailability({
-                        rules: resource.availabilityRules,
-                        timezone: resource.timezone,
-                        uid: `${resource.id}-hours`,
-                    }),
+                // The year ahead's closures and special hours, as EXDATE and RDATE (RFC 0004 B1).
+                const span = exportDays();
+                const window = {
+                    start: new Date(epochDay(span.from) * 86_400_000),
+                    end: new Date((epochDay(span.to) + 1) * 86_400_000),
                 };
+                const exceptions = await tenant.availabilityExceptionsFor({
+                    tenantRef: tenantOf(context),
+                    resourceIds: [resource.id],
+                    window,
+                });
+                const icalendar = emitVAvailability({
+                    rules,
+                    timezone: resource.timezone,
+                    uid: `${resource.id}-hours`,
+                    days: exceptionDays(exceptions.get(resource.id) ?? [], span.from, span.to),
+                });
+                if (icalendar.length > 200_000)
+                    throw new SlotlockAgentOperationError('calendar_work_limit', 400);
+                return { icalendar };
             });
         },
         async importResourceAvailability(context, input) {
@@ -2326,6 +2935,14 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                         id,
                         rules: parsed.rules,
                     });
+                    if (resource) {
+                        // The days it names replace those an earlier import of its hours made.
+                        await tenant.replaceImportedExceptions({
+                            tenantRef: tenantOf(context),
+                            resourceId: id,
+                            ranges: exceptionRanges(parsed.days),
+                        });
+                    }
                 }
                 catch (error) {
                     throw storeRefusal(error);
@@ -2460,11 +3077,142 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
             const rules = rulesInput(input.rules);
             return withTenant(store, context, async (tenant) => {
                 try {
+                    const result = await tenant.storeTenantAvailability({
+                        tenantRef: tenantOf(context),
+                        rules,
+                        overrideResources: SLOTLOCK_OVERRIDE_RESOURCES.includes(input.override_resources)
+                            ? input.override_resources
+                            : 'none',
+                    });
+                    return { resources_updated: result.inheriting, resources_with_own_hours: result.ownHours };
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+            });
+        },
+        async getAvailabilityDefaults(context) {
+            return withTenant(store, context, async (tenant) => {
+                const defaults = await tenant.getAvailabilityDefaults({ tenantRef: tenantOf(context) });
+                return {
+                    tenant: rulesOutput(defaults.tenant),
+                    locations: defaults.locations.map((entry) => ({
+                        location: entry.location,
+                        rules: rulesOutput(entry.rules) ?? [],
+                    })),
+                };
+            });
+        },
+        async setLocationAvailability(context, input) {
+            const rules = rulesInput(input.rules);
+            const location = input.location;
+            return withTenant(store, context, async (tenant) => {
+                let result;
+                try {
+                    result = await tenant.setLocationAvailability({ tenantRef: tenantOf(context), location, rules });
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+                if (!result)
+                    throw new SlotlockAgentOperationError('location_not_found', 404);
+                return { location, resources_updated: result.inheriting, resources_with_own_hours: result.ownHours };
+            });
+        },
+        async listAvailabilityExceptions(context, input) {
+            const limit = input.limit ?? 100;
+            return withTenant(store, context, async (tenant) => {
+                let exceptions;
+                try {
+                    exceptions = await tenant.listAvailabilityExceptions({
+                        tenantRef: tenantOf(context),
+                        ...(input.resource_id !== undefined ? { resourceId: input.resource_id } : {}),
+                        ...(input.location !== undefined ? { location: input.location } : {}),
+                        ...(input.from !== undefined ? { from: input.from } : {}),
+                        ...(input.to !== undefined ? { to: input.to } : {}),
+                        ...(input.after !== undefined ? { after: input.after } : {}),
+                        limit: limit + 1,
+                    });
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+                const page = exceptions.slice(0, limit);
+                return {
+                    exceptions: page.map(exceptionOutput),
+                    next: exceptions.length > limit ? (page.at(-1)?.id ?? null) : null,
+                };
+            });
+        },
+        async createAvailabilityException(context, input) {
+            const hours = input.hours;
+            return withTenant(store, context, async (tenant) => {
+                try {
+                    const exception = await tenant.createAvailabilityException({
+                        tenantRef: tenantOf(context),
+                        ...(input.location !== undefined ? { location: input.location } : {}),
+                        ...(input.resource_id !== undefined ? { resourceId: input.resource_id } : {}),
+                        startsOn: input.starts_on,
+                        ...(input.ends_on !== undefined ? { endsOn: input.ends_on } : {}),
+                        outcome: input.outcome,
+                        ...(hours
+                            ? { hours: hours.map((window) => ({ startMinutes: window.start_minutes, durationMinutes: window.duration_minutes })) }
+                            : {}),
+                        label: input.label,
+                    });
+                    return { exception: exceptionOutput(exception) };
+                }
+                catch (error) {
+                    throw storeRefusal(error);
+                }
+            });
+        },
+        async deleteAvailabilityException(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                const deleted = await tenant.deleteAvailabilityException({
+                    tenantRef: tenantOf(context),
+                    id: input.exception_id,
+                });
+                if (!deleted)
+                    throw new SlotlockAgentOperationError('availability_exception_not_found', 404);
+                return { deleted: true };
+            });
+        },
+        async importHolidays(context, input) {
+            if (input.location !== undefined && input.resource_id !== undefined) {
+                throw new SlotlockAgentOperationError('invalid_holiday_calendar', 400, { reason: 'a location or a resource, not both' });
+            }
+            // Read (a URL fetched) before the transaction opens.
+            let read;
+            try {
+                read = await readSlotlockHolidayCalendar({
+                    ...(input.icalendar !== undefined ? { icalendar: input.icalendar } : {}),
+                    ...(input.url !== undefined ? { url: input.url } : {}),
+                    ...(input.name !== undefined ? { name: input.name } : {}),
+                    ...(input.subscribe !== undefined ? { subscribe: input.subscribe } : {}),
+                    ...(input.from !== undefined ? { from: input.from } : {}),
+                    ...(input.to !== undefined ? { to: input.to } : {}),
+                }, options.holidayFetch);
+            }
+            catch (error) {
+                throw storeRefusal(error);
+            }
+            return withTenant(store, context, async (tenant) => {
+                try {
+                    const result = await tenant.importHolidayCalendar({
+                        tenantRef: tenantOf(context),
+                        ...(input.location !== undefined ? { location: input.location } : {}),
+                        ...(input.resource_id !== undefined ? { resourceId: input.resource_id } : {}),
+                        name: read.name,
+                        ...(read.url !== undefined ? { url: read.url } : {}),
+                        holidays: read.holidays,
+                        span: read.span,
+                    });
                     return {
-                        resources_updated: await tenant.setTenantAvailability({
-                            tenantRef: tenantOf(context),
-                            rules,
-                        }),
+                        imported: result.imported,
+                        skipped: read.skipped,
+                        removed: result.removed,
+                        calendar: holidayCalendarOutput(result.calendar),
                     };
                 }
                 catch (error) {
@@ -2472,6 +3220,17 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 }
             });
         },
+        async listHolidayCalendars(context) {
+            return withTenant(store, context, async (tenant) => ({
+                calendars: (await tenant.listHolidayCalendars({ tenantRef: tenantOf(context) })).map(holidayCalendarOutput),
+            }));
+        },
+        async deleteHolidayCalendar(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                const deleted = await tenant.deleteHolidayCalendar({ tenantRef: tenantOf(context), id: input.calendar_id });
+                return { deleted: deleted !== null, closures: deleted?.closures ?? 0 };
+            });
+        },
         async acquireHold(context, input) {
             return withTenant(store, context, async (tenant) => {
                 const resource = await requireResource(tenant, tenantOf(context), input.resource_id);
@@ -2485,6 +3244,8 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                     ...(input.buffer_after_minutes !== undefined
                         ? { bufferAfterMs: input.buffer_after_minutes * 60_000 }
                         : {}),
+                    ...(input.payment_required === true ? { paymentRequired: true } : {}),
+                    ...(input.payment !== undefined ? { payment: amountInput(input.payment) } : {}),
                     // A retried request with the caller's key answers the hold the first one made.
                     ...(input.idempotency_key !== undefined
                         ? {
@@ -2534,6 +3295,69 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 return { reservation: reservationOutput(result.reservation) };
             }, WRITE);
         },
+        async markHoldPaid(context, input) {
+            const id = input.hold_id;
+            if (!STORE_ID_PATTERN.test(id))
+                throw new SlotlockAgentOperationError('hold_not_found', 404);
+            return withTenant(store, context, async (tenant) => {
+                const result = await tenant.markHoldPaid({
+                    tenantRef: tenantOf(context),
+                    holdId: id,
+                    paymentRef: input.payment_ref,
+                    ...(input.received !== undefined ? { received: amountInput(input.received) } : {}),
+                });
+                if (!result.ok) {
+                    if (result.code === 'payment_conflict') {
+                        throw new SlotlockAgentOperationError('payment_conflict', 409, { payment_ref: result.paymentRef });
+                    }
+                    throw applicationRefusal(result.code);
+                }
+                return { hold: holdOutput(result.hold), replayed: result.idempotent };
+            }, WRITE);
+        },
+        async putContact(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                const result = await tenant.putContact({
+                    tenantRef: tenantOf(context),
+                    ref: input.contact_ref,
+                    name: input.name ?? null,
+                    email: input.email ?? null,
+                    phone: input.phone ?? null,
+                    whatsapp: input.whatsapp ?? null,
+                    consent: input.consent ?? {},
+                    locale: input.locale ?? null,
+                });
+                if (!result.ok)
+                    throw applicationRefusal(result.code);
+                return { contact: contactOutput(result.contact), created: result.created };
+            }, WRITE);
+        },
+        async getContact(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                const contact = await tenant.getContact({ tenantRef: tenantOf(context), ref: input.contact_ref });
+                if (!contact)
+                    throw new SlotlockAgentOperationError('contact_not_found', 404);
+                return { contact: contactOutput(contact) };
+            });
+        },
+        async listContacts(context, input) {
+            const limit = input.limit;
+            return withTenant(store, context, async (tenant) => {
+                const contacts = await tenant.listContacts({
+                    tenantRef: tenantOf(context),
+                    limit: limit + 1,
+                    ...(input.cursor !== undefined ? { after: input.cursor } : {}),
+                });
+                const shown = contacts.slice(0, limit);
+                return {
+                    contacts: shown.map(contactOutput),
+                    next_cursor: contacts.length > limit ? (shown.at(-1)?.ref ?? null) : null,
+                };
+            });
+        },
+        async deleteContact(context, input) {
+            return withTenant(store, context, async (tenant) => tenant.deleteContact({ tenantRef: tenantOf(context), ref: input.contact_ref }), WRITE);
+        },
         async releaseHold(context, input) {
             const id = input.hold_id;
             if (!STORE_ID_PATTERN.test(id))
@@ -2583,12 +3407,17 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                     bufferAfterMs: input.buffer_after_minutes * 60_000,
                     revision: input.revision,
                     ...(input.source !== undefined ? { source: input.source } : {}),
+                    ...(input.override_reason !== undefined ? { overrideReason: input.override_reason } : {}),
+                    ...(input.local_start !== undefined ? { localStart: input.local_start } : {}),
+                    ...(input.contact_ref !== undefined ? { contactRef: input.contact_ref } : {}),
+                    ...(input.notify !== undefined ? { notify: input.notify } : {}),
+                    ...(input.reminder_minutes !== undefined ? { reminderMinutes: input.reminder_minutes } : {}),
                 };
                 const result = command.revision === 1
                     ? await tenant.createExternalReservation(command)
                     : await tenant.rescheduleExternalReservation(command);
                 if (!result.ok)
-                    throw applicationRefusal(result.code);
+                    throw applicationRuleRefusal(result);
                 return { reservation: reservationOutput(result.reservation), replayed: result.idempotent };
             }, WRITE);
             if (input.revision > 1 && !put.replayed) {
@@ -2602,10 +3431,11 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                     tenantRef: tenantOf(context),
                     externalRef: input.reservation_ref,
                     revision: input.revision,
+                    ...(input.override_reason !== undefined ? { overrideReason: input.override_reason } : {}),
                 });
                 if (!result.ok)
-                    throw applicationRefusal(result.code);
-                return { cancelled: result.cancelled, revision: result.revision };
+                    throw applicationRuleRefusal(result);
+                return { cancelled: result.cancelled, revision: result.revision, cancellation_fee: feeOutput(result.cancellationFee) };
             }, WRITE);
             if (cancelled.cancelled)
                 await offerFreedTime(store, context);
@@ -2633,6 +3463,7 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                     end: new Date(input.end),
                     holderRef: input.holder_ref,
                     ...(ttl !== undefined ? { offerTtlMs: ttl * 1000 } : {}),
+                    ...(input.duration_minutes !== undefined ? { durationMs: input.duration_minutes * 60_000 } : {}),
                     ...(input.idempotency_key !== undefined ? { idempotencyKey: input.idempotency_key } : {}),
                 });
                 if (!result.ok)
@@ -2659,6 +3490,26 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 await offerFreedTime(store, context);
             return left;
         },
+        async tenantBookTogether(context, input) {
+            if (!options.agentBackend?.bookTogether)
+                throw new SlotlockAgentOperationError('bundles_unavailable', 409);
+            // Through the agents' bundle (one transaction, the booking rules applied), as the tenant's:
+            // owned by the tenant, not the key, and held only by policies that include the application.
+            return options.agentBackend.bookTogether({ ...context, operation: 'slotlock_book_together', [TENANT_ACTOR]: true }, input);
+        },
+        async tenantBookPool(context, input) {
+            if (!options.agentBackend?.bookPool)
+                throw new SlotlockAgentOperationError('pools_unavailable', 409);
+            return options.agentBackend.bookPool({ ...context, operation: 'slotlock_book_pool', [TENANT_ACTOR]: true }, input);
+        },
+        async declineWaitlistOffer(context, input) {
+            const declined = await withTenant(store, context, (tenant) => tenant.declineWaitlistOffer({ tenantRef: tenantOf(context), id: input.entry_id }));
+            if (!declined)
+                throw new SlotlockAgentOperationError('waitlist_offer_not_found', 404);
+            // The time it let go goes to the next who waits.
+            await offerFreedTime(store, context);
+            return { entry: waitlistOutput(declined) };
+        },
         async getCoverage(context, input) {
             return withTenant(store, context, async (tenant) => {
                 const resource = await requireResource(tenant, tenantOf(context), input.resource_id);
@@ -2720,6 +3571,45 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 return { revision: result.revision, replayed: result.idempotent };
             }, WRITE);
         },
+        async putSourceBusy(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                const resource = await requireResource(tenant, tenantOf(context), input.resource_id);
+                const result = await tenant.replaceSourceBusy({
+                    tenantRef: tenantOf(context),
+                    resourceId: resource.id,
+                    source: input.source,
+                    window: interval(input),
+                    revision: input.revision,
+                    busy: input.busy.map((busy) => ({
+                        start: new Date(busy.start),
+                        end: new Date(busy.end),
+                    })),
+                });
+                if (!result.ok)
+                    throw applicationRefusal(result.code);
+                return { revision: result.revision, replayed: result.idempotent, busy: result.busy, conflicts: result.conflicts };
+            }, WRITE);
+        },
+        async reportCoverageConflict(context, input) {
+            return withTenant(store, context, async (tenant) => {
+                const resource = await requireResource(tenant, tenantOf(context), input.resource_id);
+                const result = await tenant.reportCoverageConflict({
+                    tenantRef: tenantOf(context),
+                    resourceId: resource.id,
+                    source: input.source,
+                    booking: input.event_id !== undefined
+                        ? { eventId: input.event_id }
+                        : { reservationRef: input.reservation_ref },
+                    reason: input.reason,
+                    ...(input.calendar_start !== undefined
+                        ? { calendar: interval({ start: input.calendar_start, end: input.calendar_end }) }
+                        : {}),
+                });
+                if (!result.ok)
+                    throw applicationRefusal(result.code);
+                return { reported: true };
+            }, WRITE);
+        },
         async listTenantEvents(context, input) {
             const limit = input.limit;
             const after = parseEventCursor(input.cursor);
@@ -2772,14 +3662,16 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                     idempotencyKey: applicationCommandKey(context, input.idempotency_key),
                     expectedRevision: input.expected_revision,
                     ...(expectedResourceId !== undefined ? { expectedResourceId } : {}),
+                    ...(input.override_reason !== undefined ? { overrideReason: input.override_reason } : {}),
                 });
                 if (!result.ok)
-                    throw applicationRefusal(result.code);
+                    throw applicationRuleRefusal(result);
                 return {
                     event_id: result.eventId,
                     revision: result.revision,
                     cancelled: true,
                     replayed: result.idempotent,
+                    cancellation_fee: feeOutput(result.cancellationFee),
                 };
             }, WRITE);
             if (!cancelled.replayed)
@@ -3056,6 +3948,110 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 surfaces: summary.surfaces,
             };
         },
+        async listAuditEvents(context, input) {
+            const tenantRef = tenantOf(context);
+            const limit = input.limit ?? 50;
+            return withTenant(store, context, async (tenant) => {
+                // As the dashboard's export: where hosted plans apply, the Team plan's.
+                const plan = await tenant.tenantPlan({ tenantRef });
+                if (plan && (plan.plan !== 'team' || plan.status === 'canceled')) {
+                    throw new SlotlockAgentOperationError('team_plan_required', 403);
+                }
+                const events = await tenant.listAuditEvents({
+                    tenantRef,
+                    limit,
+                    ...(typeof input.cursor === 'string' ? { beforeId: input.cursor } : {}),
+                    ...(typeof input.action === 'string' ? { action: input.action } : {}),
+                    ...(typeof input.actor_ref === 'string' ? { actorRef: input.actor_ref } : {}),
+                });
+                return {
+                    events: events.map(slotlockAuditEventRecord),
+                    // A full page may have more after it; the next then answers none.
+                    next_cursor: events.length === limit ? (events.at(-1)?.id ?? null) : null,
+                };
+            });
+        },
+        async verifyAuditLog(context) {
+            const verified = await withTenant(store, context, (tenant) => tenant.verifyAuditChain({ tenantRef: tenantOf(context) }));
+            return { checked: verified.checked, broken_at: verified.brokenAt };
+        },
+        async createTenantExport(context) {
+            const tenantRef = tenantOf(context);
+            const keyId = context.principal.keyId;
+            const actor = typeof keyId === 'string' && /^[0-9a-f-]{36}$/i.test(keyId)
+                ? { actorType: 'api_key', actorRef: `api_key:${keyId}` }
+                : { actorType: 'system', actorRef: 'application' };
+            const created = await withTenant(store, context, async (tenant) => {
+                const made = await tenant.createTenantExport({ tenantRef, requestedBy: actor.actorRef }).catch((error) => {
+                    const code = error?.code;
+                    if (code === 'export_in_progress' || code === 'export_limit_reached') {
+                        throw new SlotlockAgentOperationError(code, 409);
+                    }
+                    throw error;
+                });
+                await tenant.recordAuditEvent({
+                    tenantRef,
+                    event: { action: 'export.created', ...actor, targetType: 'export', targetRef: made.id },
+                });
+                return made;
+            }, WRITE);
+            // Built after the answer; maintenance builds one a stopped server left pending.
+            void buildSlotlockTenantExport(store, tenantRef, created.id);
+            return { export: tenantExportOutput(created) };
+        },
+        async listTenantExports(context) {
+            const exports = await withTenant(store, context, (tenant) => tenant.listTenantExports({ tenantRef: tenantOf(context) }));
+            return { exports: exports.slice(0, 100).map(tenantExportOutput) };
+        },
+        async getTenantExport(context, input) {
+            const found = await withTenant(store, context, (tenant) => tenant.getTenantExport({ tenantRef: tenantOf(context), exportId: input.export_id }));
+            if (!found)
+                throw new SlotlockAgentOperationError('export_not_found', 404);
+            return { export: tenantExportOutput(found) };
+        },
+        async getTenantExportPart(context, input) {
+            const part = Number(input.part);
+            const read = await withTenant(store, context, (tenant) => tenant.getTenantExportPart({ tenantRef: tenantOf(context), exportId: input.export_id, part }));
+            if (!read.ok)
+                throw new SlotlockAgentOperationError(read.code, read.code === 'export_not_ready' ? 409 : 404);
+            return {
+                export_id: input.export_id,
+                part,
+                table: read.table,
+                rows: read.lines.map((line) => JSON.parse(line)),
+            };
+        },
+        async deleteTenantExport(context, input) {
+            const deleted = await withTenant(store, context, (tenant) => tenant.deleteTenantExport({ tenantRef: tenantOf(context), exportId: input.export_id }), WRITE);
+            return { deleted };
+        },
+        async exportSubject(context, input) {
+            const subject = subjectOf(input);
+            const exported = await withTenant(store, context, (tenant) => tenant.exportSubject({ tenantRef: tenantOf(context), subject, limit: 1_000 })).catch(subjectRefusal);
+            return { records: exported.records, truncated: exported.truncated };
+        },
+        async eraseSubject(context, input) {
+            const subject = subjectOf(input);
+            const tenantRef = tenantOf(context);
+            const keyId = context.principal.keyId;
+            return withTenant(store, context, async (tenant) => {
+                const { erased } = await tenant.eraseSubject({ tenantRef, subject }).catch(subjectRefusal);
+                // Who erased whom is the workspace's to know, but never the person: how they were named,
+                // and what went.
+                await tenant.recordAuditEvent({
+                    tenantRef,
+                    event: {
+                        action: 'subject.erased',
+                        ...(typeof keyId === 'string' && /^[0-9a-f-]{36}$/i.test(keyId)
+                            ? { actorType: 'api_key', actorRef: `api_key:${keyId}` }
+                            : { actorType: 'system', actorRef: 'application' }),
+                        targetType: 'subject',
+                        metadata: { by: Object.keys(subject)[0], ...Object.fromEntries(Object.entries(erased).filter(([, rows]) => rows > 0)) },
+                    },
+                });
+                return { erased };
+            }, WRITE);
+        },
         async enableWebhook(context, input) {
             return withTenant(store, context, async (tenant) => {
                 const enabled = await tenant.enableWebhookEndpoint({
@@ -3087,6 +4083,7 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                         ...(input.conditions !== undefined ? { conditions: approvalConditions(input.conditions) } : {}),
                         ...(input.approval_ttl_minutes !== undefined ? { approvalTtlMinutes: input.approval_ttl_minutes } : {}),
                         ...(input.lead_minutes !== undefined ? { leadMinutes: input.lead_minutes } : {}),
+                        ...(input.include_application !== undefined ? { includeApplication: input.include_application } : {}),
                     });
                 }
                 catch (error) {
@@ -3214,9 +4211,10 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
         async runMaintenance(context) {
             assertActive(context);
             try {
-                const { rollPending: _, zoneShifts, staleSources, noShows, waitlistOffers, approvalsExpired, ...result } = await maintainSlotlockTenant(store, tenantOf(context), {
+                const { rollPending: _, holidayCalendarsImported: _holidays, zoneShifts, staleSources, noShows, waitlistOffers, approvalsExpired, bookingsCompleted, remindersDue, ...result } = await maintainSlotlockTenant(store, tenantOf(context), {
                     batches,
                     signal: context.signal,
+                    ...(options.holidayFetch ? { holidayFetch: options.holidayFetch } : {}),
                 });
                 return {
                     ...result,
@@ -3225,6 +4223,8 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                     no_shows: noShows,
                     waitlist_offers: waitlistOffers,
                     approvals_expired: approvalsExpired,
+                    bookings_completed: bookingsCompleted,
+                    reminders_due: remindersDue,
                 };
             }
             catch (error) {