slotlock 0.8.0 → 0.10.0

package/store.d.ts

@@ -1,12 +1,17 @@
 import { type SlotlockResourceKind, type SlotlockResourceProfileInput, type SlotlockLocation, type SlotlockPoolOrder, type SlotlockResourceGroup, type SlotlockResourceScope } from './resource-profile.js';
 import { type SlotlockUsageRow } from './usage.js';
+import { type SlotlockWorkspaceRole } from './workspace-roles.js';
 import { type SlotlockChangeOrigin, type SlotlockEventFeed } from './event-feed.js';
 import { type SlotlockBookingRules } from './booking-rules.js';
 import type { Sql, TransactionSql } from 'postgres';
-import { SLOTLOCK_CALENDAR_HORIZON_DAYS } from './rules.js';
-import type { AcquireHoldResult, CalendarCoverageCommand, CalendarCoverageResult, CalendarEventContent, CalendarEventRetentionResult, BookingRetentionResult, SlotlockTenantErasure, SlotlockBookingRuleDefaults, CalendarFreeBusy, CalendarHorizonRollCursor, CalendarHorizonRollResult, CancelCalendarEventResult, CancelExternalReservationResult, ConfirmHoldResult, CreateReservationResult, DeleteResourceResult, ExternalReservationCommand, ExternalReservationResult, Interval, SlotlockCalendarEvent, SlotlockAgendaEntry, SlotlockHold, SlotlockBookingDescription, SlotlockApproval, SlotlockApprovalPolicy, SlotlockReservation, SlotlockResource, PutCalendarEventCommand, PutCalendarEventResult, ReleaseHoldResult, WeeklyAvailabilityRule } from './types.js';
+import { SLOTLOCK_CALENDAR_HORIZON_DAYS, SLOTLOCK_SOURCE_BUSY_MAX } from './rules.js';
+import type { AcquireHoldResult, MarkHoldPaidResult, PutContactResult, SlotlockContact, SlotlockContactConsent, CalendarCoverageCommand, CalendarCoverageResult, SourceBusyCommand, SourceBusyResult, CalendarEventContent, CalendarEventRetentionResult, BookingRetentionResult, SlotlockTenantErasure, SlotlockBookingRuleDefaults, CalendarFreeBusy, CalendarHorizonRollCursor, CalendarHorizonRollResult, CancelCalendarEventResult, CancelExternalReservationResult, ConfirmHoldResult, CreateReservationResult, DeleteResourceResult, ExternalReservationCommand, ExternalReservationResult, Interval, SlotlockCalendarEvent, SlotlockAgendaEntry, SlotlockHold, SlotlockBookingDescription, SlotlockApproval, SlotlockApprovalPolicy, SlotlockReservation, SlotlockResource, PutCalendarEventCommand, PutCalendarEventResult, ReleaseHoldResult, WeeklyAvailabilityRule } from './types.js';
+import { type SlotlockSubjectTable, type SlotlockTenantExportTable } from './types.js';
+import { type SlotlockAvailabilityDefaults, type SlotlockAvailabilityDefaultsResult, type SlotlockAvailabilityExceptionInput, type SlotlockOverrideResources, type SlotlockHolidayCalendar, type SlotlockHolidayImport } from './availability-store.js';
+import type { SlotlockAvailabilityException, SlotlockRankedException } from './hours.js';
+import type { SlotlockHoliday } from './holidays.js';
 import { type PutApprovalPolicyParams } from './approvals.js';
-export { SLOTLOCK_CALENDAR_HORIZON_DAYS };
+export { SLOTLOCK_CALENDAR_HORIZON_DAYS, SLOTLOCK_SOURCE_BUSY_MAX };
 /**
  * Longest one-off event (ten years and some leap days); a recurring series is bounded by its
  * materialization window instead.
@@ -69,6 +74,10 @@ export declare function readSlotlockSchemaVersion(sql: SlotlockSql): Promise<num
  * migrate`) or `schema_newer`. Both carry `installed` and `expected`.
  */
 export declare function assertSlotlockSchemaCurrent(sql: SlotlockSql): Promise<void>;
+/** The most contacts a tenant keeps (RFC 0004 P3). */
+export declare const SLOTLOCK_MAX_CONTACTS_PER_TENANT = 100000;
+/** The longest a hold that waits for payment may live (RFC 0004 C3): 30 minutes. */
+export declare const SLOTLOCK_PAYMENT_HOLD_MAX_TTL_MS: number;
 /**
  * A put's identity and the event it asks for, not its storage window: a series' window moves with
  * the UTC day, so a retry after midnight must still match.
@@ -405,11 +414,135 @@ export interface SlotlockStore extends SlotlockEventFeed {
         pool: string;
         resourceId: string;
     }): Promise<void>;
-    /** Set (or clear, with `null`) the bookable hours of every resource the tenant has; returns how many. */
+    /**
+     * Store (or clear, with `null`) the tenant's weekly hours (RFC 0004 B2): every resource without its
+     * own and with no location hours above it uses them, new ones too. Nothing is copied: a resource
+     * keeps hours of its own unless `overrideResources` clears them (`all`), or clears those that are
+     * the same as the tenant's were or as these (`matching`). Refuses `invalid_availability`.
+     */
+    storeTenantAvailability(params: {
+        tenantRef: string;
+        rules: readonly WeeklyAvailabilityRule[] | null;
+        overrideResources?: SlotlockOverrideResources;
+    }): Promise<SlotlockAvailabilityDefaultsResult>;
+    /**
+     * Every resource the tenant has uses these weekly hours (or the server's, with `null`): as in 0.8.0,
+     * whatever hours of their own they had are gone. Now done by storing them as the tenant's, which
+     * resources added later inherit too. Returns how many resources in use they now apply to.
+     *
+     * @deprecated Use storeTenantAvailability, which can keep the hours resources have of their own
+     * and says how many do.
+     */
     setTenantAvailability(params: {
         tenantRef: string;
         rules: readonly WeeklyAvailabilityRule[] | null;
     }): Promise<number>;
+    /**
+     * Store (or clear) a location's weekly hours: resources at it or inside it without their own use
+     * them, unless a nearer location has its own. Null for a location the tenant does not have.
+     */
+    setLocationAvailability(params: {
+        tenantRef: string;
+        location: string;
+        rules: readonly WeeklyAvailabilityRule[] | null;
+    }): Promise<SlotlockAvailabilityDefaultsResult | null>;
+    /** The tenant's stored hours, and each location's that has them. */
+    getAvailabilityDefaults(params: {
+        tenantRef: string;
+    }): Promise<SlotlockAvailabilityDefaults>;
+    /**
+     * Add a closure or a day of special hours (RFC 0004 B1) for the tenant, a location or a resource;
+     * an import's `sourceUid` already stored at that scope is updated instead. Refuses
+     * `invalid_availability_exception`, `location_not_found`, `resource_not_found` and
+     * `availability_exceptions_limit_reached`.
+     */
+    createAvailabilityException(params: SlotlockAvailabilityExceptionInput): Promise<SlotlockAvailabilityException>;
+    /**
+     * The tenant's exceptions by first day: those that apply to `resourceId`, or a `location`'s own,
+     * or all; only those reaching `from` to `to` when given.
+     */
+    listAvailabilityExceptions(params: {
+        tenantRef: string;
+        resourceId?: string;
+        location?: string;
+        from?: string;
+        to?: string;
+        limit?: number;
+        after?: string;
+    }): Promise<SlotlockAvailabilityException[]>;
+    deleteAvailabilityException(params: {
+        tenantRef: string;
+        id: string;
+    }): Promise<boolean>;
+    /**
+     * Replace the exceptions an import of one resource's VAVAILABILITY made (source `vavailability`)
+     * with `ranges`; returns how many it keeps.
+     */
+    replaceImportedExceptions(params: {
+        tenantRef: string;
+        resourceId: string;
+        ranges: readonly {
+            startsOn: string;
+            endsOn: string;
+            outcome: 'closed' | 'open';
+            hours?: {
+                startMinutes: number;
+                durationMinutes: number;
+            }[];
+        }[];
+    }): Promise<number>;
+    /**
+     * Import a holiday calendar's days off as closures at its scope, as the calendar named `name`
+     * there (RFC 0004 B1): holidays added or updated, and those it made before and no longer names
+     * in `span` deleted. With `url`, a subscription maintenance imports again. See
+     * availability-store.ts importHolidayCalendar for its refusals.
+     */
+    importHolidayCalendar(params: {
+        tenantRef: string;
+        location?: string;
+        resourceId?: string;
+        name: string;
+        url?: string;
+        holidays: readonly SlotlockHoliday[];
+        span: {
+            from: string;
+            to: string;
+        };
+    }): Promise<SlotlockHolidayImport>;
+    /** The tenant's holiday calendars. */
+    listHolidayCalendars(params: {
+        tenantRef: string;
+    }): Promise<SlotlockHolidayCalendar[]>;
+    /** Delete a holiday calendar and its closures; null for one the tenant does not have. */
+    deleteHolidayCalendar(params: {
+        tenantRef: string;
+        id: string;
+    }): Promise<{
+        closures: number;
+    } | null>;
+    /**
+     * Subscriptions due to be imported again, each put off a day before it is read (maintenance):
+     * importing it sets its next import, so one a pass never finishes is not tried again at once.
+     */
+    dueHolidayCalendars(params: {
+        tenantRef: string;
+        limit: number;
+    }): Promise<SlotlockHolidayCalendar[]>;
+    /** Note why a subscription's import failed; it is tried again a day later. */
+    noteHolidayCalendarFailure(params: {
+        tenantRef: string;
+        id: string;
+        error: string;
+    }): Promise<void>;
+    /**
+     * Each resource's exceptions that reach `window`, in the order the evaluator applies them, by
+     * resource id.
+     */
+    availabilityExceptionsFor(params: {
+        tenantRef: string;
+        resourceIds: readonly string[];
+        window: Interval;
+    }): Promise<Map<string, SlotlockRankedException[]>>;
     /** Bounded tenant resource discovery, ordered and keyset-paginated by immutable UUID. */
     listResources(params: {
         tenantRef: string;
@@ -483,6 +616,12 @@ export interface SlotlockStore extends SlotlockEventFeed {
         tenantRef: string;
         externalRef: string;
         revision: number;
+        /**
+         * An admin's reason for cancelling past the booking's cancel cutoff (RFC 0004 B5), 1-500
+         * characters, kept on its tombstone and the feed. Without it, a cancellation past the cutoff is
+         * refused.
+         */
+        overrideReason?: string;
     }): Promise<CancelExternalReservationResult>;
     /**
      * Occupy a window without committing: the hold blocks rivals under the same EXCLUDE arbiter until
@@ -526,7 +665,176 @@ export interface SlotlockStore extends SlotlockEventFeed {
          * `fromHold` releases the rest, and releasing one with a holder releases them all.
          */
         groupId?: string;
+        /**
+         * The hold waits for payment (RFC 0004 C3): it cannot be confirmed until `markHoldPaid`
+         * records the payment's reference, and lives at most SLOTLOCK_PAYMENT_HOLD_MAX_TTL_MS
+         * (`invalid_ttl` beyond). Slotlock records payment state; it never moves money.
+         */
+        paymentRequired?: boolean;
+        /**
+         * What the payment must be (with `paymentRequired`): markHoldPaid refuses one for less, or in
+         * another currency (`payment_amount_mismatch`). Without it, any recorded payment counts.
+         */
+        payment?: {
+            amountMinor: number;
+            currency: string;
+        };
+        /**
+         * An agent's hold (RFC 0004 C3): its price is the resource's `holdPrice` booking rule, never its
+         * own. On a resource with one, it waits for that payment whatever it asks (and lives at most
+         * SLOTLOCK_PAYMENT_HOLD_MAX_TTL_MS); a `payment` other than that price is refused
+         * (`payment_price_mismatch`), as is any `payment` where the resource sets none.
+         */
+        priceFromRules?: boolean;
     }): Promise<AcquireHoldResult>;
+    /**
+     * Record that a hold waiting for payment is paid (RFC 0004 C3), by the payment's reference at the
+     * integrator's processor: the integrator says so, or an adapter that verified it. Once paid it
+     * may be confirmed. The same reference again answers the same hold, whatever became of it since
+     * (confirmed or booked from: the payment is kept apart), unless the hold ended without a booking (`hold_ended`: never applied, so refunded); another is `payment_conflict`, naming the one recorded. The feed says so (`hold.paid`). A hold that does not wait for payment is
+     * `payment_not_required`; an expired one `hold_expired`; one confirmed, released or unknown
+     * `hold_not_found`.
+     */
+    markHoldPaid(params: {
+        tenantRef: string;
+        holdId: string;
+        paymentRef: string;
+        /** What was received, as the processor says: needed when the hold names its payment. */
+        received?: {
+            amountMinor: number;
+            currency: string;
+        };
+    }): Promise<MarkHoldPaidResult>;
+    /**
+     * Keep a person a booking may name (`contactRef`) to be told about it (RFC 0004 P3): how to reach
+     * them and which channels they agreed to. Replaces what was kept under the reference. A sender
+     * reads it to send; Slotlock sends nothing. At most SLOTLOCK_MAX_CONTACTS_PER_TENANT.
+     */
+    putContact(params: {
+        tenantRef: string;
+        ref: string;
+        name?: string | null;
+        email?: string | null;
+        phone?: string | null;
+        whatsapp?: string | null;
+        consent?: SlotlockContactConsent;
+        locale?: string | null;
+    }): Promise<PutContactResult>;
+    /** The tenant's contact with this reference, or null. */
+    getContact(params: {
+        tenantRef: string;
+        ref: string;
+    }): Promise<SlotlockContact | null>;
+    /** The tenant's contacts by reference, after `after`, up to `limit` (1-100, default 50). */
+    listContacts(params: {
+        tenantRef: string;
+        limit?: number;
+        after?: string;
+    }): Promise<SlotlockContact[]>;
+    /**
+     * Forget a person (RFC 0004 P3): their contact, and their reference on every booking that named
+     * it, in one transaction. `deleted` is false when there was no contact; `bookings` counts the
+     * bookings that no longer name them.
+     */
+    deleteContact(params: {
+        tenantRef: string;
+        ref: string;
+    }): Promise<{
+        deleted: boolean;
+        bookings: number;
+    }>;
+    /**
+     * What the tenant keeps about one person (RFC 0004 D3, an access request): the rows that name
+     * them, as kept, by table (SLOTLOCK_SUBJECT_TABLES), up to `limit` (1-10,000, default 1,000) a
+     * table. It lists what eraseSubject would delete or take them out of; an event lists its time and
+     * title, and an approval its decision, never the other people they name.
+     */
+    exportSubject(params: {
+        tenantRef: string;
+        subject: SlotlockSubject;
+        limit?: number;
+    }): Promise<SlotlockSubjectExport>;
+    /**
+     * Take one person out of the tenant's data (RFC 0004 D3, an erasure request), in one transaction.
+     * Their contacts, attendee entries and waitlist entries are deleted; their email leaves events'
+     * attendee and organizer lists and approvals' requests; their holder reference and booking
+     * reference become one `erased-` name wherever they were (bookings, holds, ended bookings, the
+     * change history, approvals), and a contact's reference leaves them. Bookings stay, as time taken.
+     * Counts, by table, the rows deleted or changed.
+     */
+    eraseSubject(params: {
+        tenantRef: string;
+        subject: SlotlockSubject;
+    }): Promise<SlotlockSubjectErasure>;
+    /**
+     * Ask for a copy of everything the tenant keeps (RFC 0004 D3): a pending export, which
+     * buildTenantExport builds. Refused while another is pending (`export_in_progress`) or when the
+     * tenant keeps SLOTLOCK_MAX_TENANT_EXPORTS already (`export_limit_reached`).
+     */
+    createTenantExport(params: {
+        tenantRef: string;
+        requestedBy?: string;
+    }): Promise<SlotlockTenantExport>;
+    /**
+     * Build a pending export: every table of SLOTLOCK_TENANT_EXPORT_TABLES read through one cursor,
+     * so in one snapshot, into parts of one table's rows. Null when it is not pending, or another is
+     * building it. Throws `export_too_large` past SLOTLOCK_TENANT_EXPORT_MAX_BYTES, writing nothing.
+     */
+    buildTenantExport(params: {
+        tenantRef: string;
+        exportId: string;
+    }): Promise<SlotlockTenantExport | null>;
+    /** Mark a pending export failed, with why (`export_too_large`, `export_failed`). */
+    failTenantExport(params: {
+        tenantRef: string;
+        exportId: string;
+        error: string;
+    }): Promise<void>;
+    /** One of the tenant's exports, or null. */
+    getTenantExport(params: {
+        tenantRef: string;
+        exportId: string;
+    }): Promise<SlotlockTenantExport | null>;
+    /** The tenant's exports, newest first. */
+    listTenantExports(params: {
+        tenantRef: string;
+    }): Promise<SlotlockTenantExport[]>;
+    /** One part (1 to its `parts`) of a ready export. */
+    getTenantExportPart(params: {
+        tenantRef: string;
+        exportId: string;
+        part: number;
+    }): Promise<SlotlockTenantExportPartResult>;
+    /** Delete one of the tenant's exports at once. False when there was none. */
+    deleteTenantExport(params: {
+        tenantRef: string;
+        exportId: string;
+    }): Promise<boolean>;
+    /**
+     * Delete the tenant's exports past their time; and name those left pending for more than two
+     * minutes (their server stopped before building them), for maintenance to build.
+     */
+    pruneTenantExports(params: {
+        tenantRef: string;
+    }): Promise<{
+        deleted: number;
+        pending: string[];
+    }>;
+    /**
+     * Read everything the tenant keeps, as an export holds it, in one snapshot, without storing it
+     * (`slotlock tenant export`): each part (one table's rows) to `onPart` as it is read.
+     */
+    streamTenantExport(params: {
+        tenantRef: string;
+        onPart: (part: {
+            table: SlotlockTenantExportTable;
+            lines: string[];
+        }) => Promise<void>;
+    }): Promise<{
+        rows: number;
+        bytes: number;
+        tables: Record<string, number>;
+    }>;
     /** One of the tenant's live holds, or null (none, expired, confirmed, or another tenant's). */
     getHold(params: {
         tenantRef: string;
@@ -639,6 +947,19 @@ export interface SlotlockStore extends SlotlockEventFeed {
             holdId: string;
             holderRef: string;
         };
+        /**
+         * The agent it holds time for, and its key's caps (RFC 0004 A5): its pending approvals' holds
+         * count against its live-hold and held-hour caps with its own holds, so asking for approval
+         * never holds more than the agent could hold itself (`hold_limit_reached`,
+         * `held_time_limit_reached`). Kept on the approval's requester as `holder_ref`.
+         */
+        holder?: {
+            ref: string;
+            caps?: {
+                maxHolds?: number;
+                maxHeldHours?: number;
+            };
+        };
     }): Promise<{
         ok: true;
         approval: SlotlockApproval;
@@ -647,6 +968,10 @@ export interface SlotlockStore extends SlotlockEventFeed {
         ok: false;
         code: 'overlap' | 'approval_limit_reached' | 'idempotency_conflict';
         limit?: number;
+    } | {
+        ok: false;
+        code: 'hold_limit_reached' | 'held_time_limit_reached';
+        limit: number;
     }>;
     /** The approval a request key made, or null. */
     findApproval(params: {
@@ -814,6 +1139,8 @@ export interface SlotlockStore extends SlotlockEventFeed {
          * another, checked under the event's lock.
          */
         expectedResourceId?: string;
+        /** Hold a one-off event to its resource's cancel cutoff (RFC 0004 B5), as agents' cancels are. */
+        enforceBookingRules?: boolean;
     }): Promise<CancelCalendarEventResult>;
     /**
      * The tenant's cancellation of one of its events by id, whichever owner wrote it: an agent key's
@@ -829,6 +1156,11 @@ export interface SlotlockStore extends SlotlockEventFeed {
         expectedRevision: number;
         /** As for cancelCalendarEvent: `event_not_found` when the event is on another resource. */
         expectedResourceId?: string;
+        /**
+         * An admin's reason for cancelling a one-off event past its cancel cutoff (RFC 0004 B5), kept on
+         * the feed; without it, that cancellation is refused.
+         */
+        overrideReason?: string;
     }): Promise<CancelCalendarEventResult>;
     /**
      * Rematerialize due recurring masters into one rolling window without changing their revision. A
@@ -921,6 +1253,17 @@ export interface SlotlockStore extends SlotlockEventFeed {
         maxAgeMs?: number;
         limit?: number;
     }): Promise<number>;
+    /**
+     * Put each event reminder that has come due on the feed once (RFC 0004 P3), as `reminder.due`:
+     * an occurrence's reminder, its minutes before the start, of an event that may be notified about
+     * (`notify`), due within the last day and not started yet. Each is recorded in
+     * `reminder_dispatches` in the same transaction, so no later pass says it again. The change's id
+     * is the key a sender sends it once by. Up to `limit` (default 500); how many.
+     */
+    dueReminders(params: {
+        tenantRef: string;
+        limit?: number;
+    }): Promise<number>;
     /**
      * Claim a booking by its reference (check-in), so a resource whose booking rules ask for check-in
      * (`checkInMinutes`) does not release it. Check-in opens `SLOTLOCK_CHECK_IN_OPENS_MINUTES` before
@@ -932,6 +1275,15 @@ export interface SlotlockStore extends SlotlockEventFeed {
         tenantRef: string;
         externalRef: string;
     }): Promise<CheckInReservationResult>;
+    /**
+     * Say on the feed that bookings have ended (RFC 0004 B4): each confirmed booking whose end passed
+     * within the last week and was not said yet gets one `reservation.completed`, its row unchanged
+     * but for when it was said. Up to `limit` (default 500); returns how many.
+     */
+    completeEndedBookings(params: {
+        tenantRef: string;
+        limit?: number;
+    }): Promise<number>;
     /**
      * Release up to `limit` (default 100) bookings left unclaimed: on a resource whose booking rules
      * ask for check-in, made since they did, not checked in `checkInMinutes` after the start, and not
@@ -956,12 +1308,44 @@ export interface SlotlockStore extends SlotlockEventFeed {
         end: Date;
         holderRef: string;
         offerTtlMs?: number;
+        /**
+         * Wait for any slot of this many milliseconds within the window (RFC 0004 B6), a whole minute
+         * from one minute to the window's length; left out, the whole window.
+         */
+        durationMs?: number;
         /**
          * A retry identity, kept as long as the entry: the same key and request answer the entry the
          * first made (`replayed`), another request `idempotency_conflict`.
          */
         idempotencyKey?: string;
     }): Promise<JoinWaitlistResult>;
+    /**
+     * One holder's live holds in a group, by resource id (RFC 0004 B7). With `alignExpiry`, every one
+     * expires when the earliest does, so the set has one time to live.
+     */
+    holdGroup(params: {
+        tenantRef: string;
+        holderRef: string;
+        groupId: string;
+        alignExpiry?: boolean;
+    }): Promise<{
+        holdId: string;
+        resourceId: string;
+        start: Date;
+        end: Date;
+        expiresAt: Date;
+        source: string | null;
+    }[]>;
+    /**
+     * Decline an entry's offer (RFC 0004 B6): its hold is let go and the entry is `declined`, so the
+     * time is offered to the next. With `holderRef`, only that holder's. Null when there is no such
+     * offer.
+     */
+    declineWaitlistOffer(params: {
+        tenantRef: string;
+        id: string;
+        holderRef?: string;
+    }): Promise<SlotlockWaitlistEntry | null>;
     /** The tenant's waitlist entries, oldest first, optionally of one resource, pool or holder. */
     listWaitlist(params: {
         tenantRef: string;
@@ -1018,43 +1402,118 @@ export interface SlotlockStore extends SlotlockEventFeed {
         from: string;
         to: string;
     }): Promise<boolean>;
-    /** A member's live assistant conversation, or null when none is (or it expired). */
-    getAssistantConversation(params: {
+    /**
+     * A member's conversations with the assistant, the most recent first (at most `limit`, default
+     * 100): what the Chats list shows. Expired ones are left out.
+     */
+    listAssistantChats(params: {
         tenantRef: string;
         memberRef: string;
-    }): Promise<SlotlockAssistantConversationRecord | null>;
+        limit?: number;
+    }): Promise<SlotlockAssistantChatSummary[]>;
+    /** One of a member's conversations, or null when there is none by that id (or it expired). */
+    getAssistantChat(params: {
+        tenantRef: string;
+        memberRef: string;
+        chatId: string;
+    }): Promise<SlotlockAssistantChatRecord | null>;
     /**
-     * Store a member's conversation for `ttlMs` (1 second to a day) from now, replacing its messages.
+     * Store one of a member's conversations, creating it (titled `title`) or replacing its messages.
      * Its actions become those stored already that `keep` names, in their stored state
      * (settleAssistantAction changes it), and the `added` ones not stored already: an action is never
-     * put back into a conversation that no longer has it. The tenant's expired conversations are
-     * deleted with it, and the tenant is listed for sweepAssistantConversations.
+     * put back into a conversation that no longer has it. It is kept until deleted, or for `ttlMs`
+     * (1 second to 3,650 days) from now when given, and then the tenant is listed for
+     * sweepAssistantConversations. The member keeps at most SLOTLOCK_ASSISTANT_MAX_CHATS: past it,
+     * the least recently used go (the member's writes take turns, so two at once keep the bound).
+     * True when it was written; false when `create` is false and it was not there. Run it in a
+     * transaction (withTenant does) so its lock lasts until the trim commits.
      */
-    putAssistantConversation(params: {
+    putAssistantChat(params: {
         tenantRef: string;
         memberRef: string;
+        chatId: string;
+        title: string;
         messages: unknown[];
         added: Record<string, Record<string, unknown>>;
         keep: readonly string[];
-        ttlMs: number;
-    }): Promise<void>;
+        ttlMs: number | null;
+        /**
+         * False to only change a conversation that is still there: one the member deleted while a turn
+         * on it ran is not written back. True (the default) creates it when it is not.
+         */
+        create?: boolean;
+    }): Promise<boolean>;
+    /** Give one of a member's conversations a new title (1-120 characters). False when there is none. */
+    renameAssistantChat(params: {
+        tenantRef: string;
+        memberRef: string;
+        chatId: string;
+        title: string;
+    }): Promise<boolean>;
     /**
-     * Change one proposed action, only while its `status` is `from`: its fields are merged with
-     * `patch`. The action as changed, or null when it is not in that state (or not there): of two
-     * racing approvals, one wins.
+     * Change one proposed action of a conversation, only while its `status` is `from`: its fields are
+     * merged with `patch`. The action as changed, or null when it is not in that state (or not
+     * there): of two racing approvals, one wins.
      */
     settleAssistantAction(params: {
         tenantRef: string;
         memberRef: string;
+        chatId: string;
         actionId: string;
         from: string;
         patch: Record<string, unknown>;
     }): Promise<Record<string, unknown> | null>;
-    /** Forget a member's conversation. False when there was none. */
-    deleteAssistantConversation(params: {
+    /** Delete one of a member's conversations. False when there was none. */
+    deleteAssistantChat(params: {
         tenantRef: string;
         memberRef: string;
+        chatId: string;
     }): Promise<boolean>;
+    /**
+     * Add an event to the tenant's audit log (slotlock.audit_events). The log is append-only for the
+     * serving role: nothing here changes or removes an event. Text past its column's bound is cut.
+     */
+    recordAuditEvent(params: {
+        tenantRef: string;
+        event: SlotlockAuditEventInput;
+    }): Promise<void>;
+    /**
+     * The tenant's audit events, newest first: up to `limit` (1-200, default 50), before the event
+     * `before` names, and only those of `action` or `actorRef` when given.
+     */
+    listAuditEvents(params: {
+        tenantRef: string;
+        limit?: number;
+        before?: {
+            occurredAt: Date;
+            id: string;
+        };
+        /** After the event with this id, at its exact time (the API's cursor); none if it was pruned. */
+        beforeId?: string;
+        action?: string;
+        actorRef?: string;
+    }): Promise<SlotlockAuditEvent[]>;
+    /** The tenant's hosted plan and its standing (slotlock.tenant_plan), or null when none applies. */
+    tenantPlan(params: {
+        tenantRef: string;
+    }): Promise<{
+        plan: string;
+        status: string;
+    } | null>;
+    /** Delete the tenant's audit events older than SLOTLOCK_AUDIT_RETENTION_DAYS; how many went. */
+    pruneAuditEvents(params: {
+        tenantRef: string;
+    }): Promise<number>;
+    /**
+     * Check the tenant's audit chain from its oldest event kept (slotlock.verify_audit_chain): how many
+     * events held, and the number of the first that does not (null when every one does).
+     */
+    verifyAuditChain(params: {
+        tenantRef: string;
+    }): Promise<{
+        checked: number;
+        brokenAt: number | null;
+    }>;
     /** Delete up to `limit` (default 1,000) of the tenant's expired assistant conversations: how many. */
     pruneAssistantConversations(params: {
         tenantRef: string;
@@ -1067,6 +1526,14 @@ export interface SlotlockStore extends SlotlockEventFeed {
     sweepAssistantConversations(params?: {
         limit?: number;
     }): Promise<number>;
+    /**
+     * Delete team workspace invitations finished (accepted, revoked or expired) more than 30 days ago,
+     * with the addresses they were sent to (slotlock.prune_workspace_invitations), requests to join
+     * decided a month ago and domain claims ended three months ago (slotlock.prune_workspace_domains), and dashboard
+     * sessions ended or expired a day ago (slotlock.prune_dashboard_sessions), and erase the team
+     * workspaces whose deletion came due (slotlock.erase_deleted_teams): how many.
+     */
+    sweepDashboardRecords(): Promise<number>;
     /**
      * Offer freed time to the waitlist in join order: each waiting entry whose window is free (on its
      * resource, or the first free pool member) gets a hold for its holder (`waitlist.offered`).
@@ -1132,6 +1599,39 @@ export interface SlotlockStore extends SlotlockEventFeed {
     }): Promise<SlotlockTenantErasure>;
     /** Record the bounded, complete source window represented by a provider cursor/revision. */
     recordCalendarCoverage(params: CalendarCoverageCommand): Promise<CalendarCoverageResult>;
+    /**
+     * A calendar that gives busy time but not its events (RFC 0004 C1): records its coverage of the
+     * window at the revision, as recordCalendarCoverage does, and in the same transaction replaces
+     * the busy time it reported for that window (what it said outside the window stays). Busy time
+     * counts in free/busy and is refused to every booking Slotlock makes, as an event's would be;
+     * a confirmed booking the source newly reports busy time over is put on the feed as
+     * coverage.conflict, once, and left as it is. A revision already recorded changes nothing.
+     */
+    replaceSourceBusy(params: SourceBusyCommand): Promise<SourceBusyResult>;
+    /**
+     * A source says a booking it was given (a sync's write-back) was changed or removed in its
+     * calendar (RFC 0004 C4): put on the feed as `coverage.conflict`, named by the source's
+     * `source_id`, with the booking and what the calendar now says. The booking is left as it is:
+     * Slotlock stays the source of truth, and someone decides.
+     */
+    reportCoverageConflict(params: {
+        tenantRef: string;
+        resourceId: string;
+        source: string;
+        booking: {
+            reservationRef: string;
+        } | {
+            eventId: string;
+        };
+        reason: 'changed_in_calendar' | 'removed_from_calendar';
+        /** Where the calendar now has it, when it was moved. */
+        calendar?: Interval;
+    }): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        code: 'invalid_identity' | 'invalid_window' | 'coverage_not_found' | 'reservation_not_found' | 'event_not_found';
+    }>;
     /** Return merged busy intervals plus explicit completeness for caller-required provider sources. */
     getFreeBusy(params: {
         tenantRef: string;
@@ -1178,12 +1678,111 @@ export interface SlotlockAssistantSettingsRecord {
     updatedAt: Date;
 }
 /** One member's live conversation with the dashboard assistant, as assistant.ts keeps it. */
-export interface SlotlockAssistantConversationRecord {
+/** One of a member's conversations with the assistant, as the Chats list shows it. */
+export interface SlotlockAssistantChatSummary {
+    /** 16 URL-safe characters. */
+    id: string;
+    title: string;
+    updatedAt: Date;
+}
+/** One of a member's conversations with the assistant, whole. */
+export interface SlotlockAssistantChatRecord extends SlotlockAssistantChatSummary {
     messages: unknown[];
     /** The writes it proposed, by id. */
     actions: Record<string, Record<string, unknown>>;
-    updatedAt: Date;
+    createdAt: Date;
+    /** When it is deleted unless used again; null when it is kept until the member deletes it. */
+    expiresAt: Date | null;
+}
+/** What an audit event records (slotlock.audit_events): who did what, to what, from where. */
+export interface SlotlockAuditEventInput {
+    /** `<area>.<verb>`, such as `api_key.created` or `authz.denied`. */
+    action: string;
+    actorType: 'person' | 'api_key' | 'assistant' | 'system';
+    /** `github:<id>`, `google:<subject>`, `api_key:<id>`: a reference, never a name or an email. */
+    actorRef: string;
+    /** The actor's role in the workspace when it acted. */
+    actorRole?: SlotlockWorkspaceRole | null;
+    targetType?: string;
+    targetRef?: string;
+    outcome?: 'success' | 'denied';
+    reason?: string;
+    ipAddress?: string;
+    userAgent?: string;
+    /** Before-and-after values and the like: never a secret, a token or a key. */
+    metadata?: Record<string, unknown>;
+}
+/** An audit event as the API and `slotlock audit export` give it: snake_case, nulls kept. */
+export declare function slotlockAuditEventRecord(event: SlotlockAuditEvent): Record<string, unknown>;
+/**
+ * Whom an access or erasure request is about (RFC 0004 D3): one person, by exactly one of the
+ * identifiers Slotlock keeps for them. `email` matches contacts, event attendees and organizers
+ * (ignoring case); `holder` the holder reference on holds, bookings and waitlist entries;
+ * `contact` a contact's reference; `reference` a booking's or an event's reference.
+ */
+export type SlotlockSubject = {
+    email: string;
+} | {
+    holder: string;
+} | {
+    contact: string;
+} | {
+    reference: string;
+};
+/** What the tenant keeps about one person (exportSubject). */
+export interface SlotlockSubjectExport {
+    /** Each table's rows that name them, as kept (snake_case, without the tenant). */
+    records: Record<SlotlockSubjectTable, Record<string, unknown>[]>;
+    /** True when a table had more rows than the limit: its first ones are listed. */
+    truncated: boolean;
+}
+/** What an erasure did (eraseSubject): by table, the rows deleted or taken the person out of. */
+export interface SlotlockSubjectErasure {
+    erased: Record<SlotlockSubjectTable, number>;
+}
+/** Hours a tenant export is kept once ready, or since it was asked for if it never is. */
+export declare const SLOTLOCK_TENANT_EXPORT_HOURS = 24;
+/** The most a tenant export holds: past it, the export fails (`export_too_large`). */
+export declare const SLOTLOCK_TENANT_EXPORT_MAX_BYTES: number;
+/** The most exports a tenant keeps at once. */
+export declare const SLOTLOCK_MAX_TENANT_EXPORTS = 5;
+/** A part of an export: one table's rows, at most this many, or about this many bytes. */
+export declare const SLOTLOCK_TENANT_EXPORT_PART_ROWS = 5000;
+/** A copy of everything the tenant keeps (createTenantExport), as built or being built. */
+export interface SlotlockTenantExport {
+    id: string;
+    /** `pending` until it is built, then `ready`, or `failed` (`error` says why). */
+    status: 'pending' | 'ready' | 'failed';
+    requestedBy: string | null;
+    createdAt: Date;
+    finishedAt: Date | null;
+    /** When maintenance deletes it. */
     expiresAt: Date;
+    parts: number;
+    rows: number;
+    bytes: number;
+    /** Rows by table (SLOTLOCK_TENANT_EXPORT_TABLES), for the tables with any. */
+    tables: Record<string, number>;
+    error: string | null;
+}
+/** One part of an export: one table's rows, each a JSON object as kept (NDJSON lines). */
+export type SlotlockTenantExportPartResult = {
+    ok: true;
+    table: SlotlockTenantExportTable;
+    lines: string[];
+} | {
+    ok: false;
+    code: 'export_not_found' | 'export_not_ready' | 'export_part_not_found';
+};
+/** An audit event as the log keeps it. */
+export interface SlotlockAuditEvent extends SlotlockAuditEventInput {
+    id: string;
+    occurredAt: Date;
+    outcome: 'success' | 'denied';
+    metadata: Record<string, unknown>;
+    /** Its place in the tenant's chain, and its SHA-256 (hex) over the one before and itself. */
+    chainIndex: number | null;
+    hash: string | null;
 }
 /** One entry of a tenant's waitlist (joinWaitlist). */
 export interface SlotlockWaitlistEntry {
@@ -1195,12 +1794,20 @@ export interface SlotlockWaitlistEntry {
     end: Date;
     holderRef: string;
     offerTtlMs: number;
-    /** `waiting`, `offered` (a hold was made: `holdId` on `offeredResourceId`) or `expired`. */
-    status: 'waiting' | 'offered' | 'expired';
+    /**
+     * `waiting`; `offered` (a hold was made: `holdId` on `offeredResourceId`); then `accepted` (the
+     * hold was confirmed), `declined` (let go) or `lapsed` (it expired); or `expired` (no slot could
+     * be offered before the window closed).
+     */
+    status: 'waiting' | 'offered' | 'accepted' | 'declined' | 'lapsed' | 'expired';
     holdId: string | null;
     offeredResourceId: string | null;
     offeredAt: Date | null;
     createdAt: Date;
+    /** The length it waits for, any slot of it within the window (RFC 0004 B6); null: the whole window. */
+    durationMs: number | null;
+    /** When its offer was accepted, declined or lapsed. */
+    decidedAt: Date | null;
 }
 export type JoinWaitlistResult = {
     ok: true;
@@ -1318,9 +1925,16 @@ export interface SlotlockHoldTenantOptions {
  * waiter out of the line, rejecting with its reason. Each holder calls the release it gets once.
  */
 export declare function createTenantSlots(max: number): (tenantRef: string, signal?: AbortSignal) => Promise<() => void>;
+/**
+ * Build a pending tenant export (RFC 0004 D3) in its own tenant transaction, and mark it failed if
+ * that fails (`export_too_large`, else `export_failed`). Null when it was not pending, or another
+ * server is building it. Never throws: a server builds it after answering, and maintenance builds
+ * one left pending.
+ */
+export declare function buildSlotlockTenantExport(store: SlotlockStore, tenantRef: string, exportId: string): Promise<SlotlockTenantExport | null>;
 export declare function createSlotlockStore(sql: StoreSql, options?: SlotlockStoreOptions): SlotlockStore;
 /**
  * Every store method that writes for a tenant: what a suspended tenant's withTenant store refuses.
  * Maintenance (rolling series, pruning, purging) and erasure are not among them.
  */
-export declare const SLOTLOCK_TENANT_WRITE_METHODS: readonly ["createResource", "updateResourceProfile", "putLocation", "updateLocation", "deleteLocation", "putGroup", "deleteGroup", "addGroupMember", "removeGroupMember", "archiveResource", "restoreResource", "deleteResource", "setResourceAvailability", "setResourceBookingRules", "setBookingRuleDefaults", "setResourcePool", "setResourceParent", "setPoolOrder", "notePoolBooking", "putApprovalPolicy", "deleteApprovalPolicy", "requestApproval", "beginApprovalGrant", "finishApprovalGrant", "declineApproval", "resetTestTenant", "fastForwardTestTenant", "setTenantAvailability", "createReservation", "createExternalReservation", "rescheduleExternalReservation", "cancelExternalReservation", "acquireHold", "confirmHold", "releaseHold", "putCalendarEvent", "cancelCalendarEvent", "cancelCalendarEventById", "recordCalendarCoverage", "createWebhookEndpoint", "deleteWebhookEndpoint", "enableWebhookEndpoint", "recordCoverageFailure", "deleteCoverage", "checkInReservation", "joinWaitlist", "leaveWaitlist", "putAssistantSettings", "deleteAssistantSettings", "resealAssistantKey", "putAssistantConversation", "settleAssistantAction", "deleteAssistantConversation"];
+export declare const SLOTLOCK_TENANT_WRITE_METHODS: readonly ["createResource", "updateResourceProfile", "putLocation", "updateLocation", "deleteLocation", "putGroup", "deleteGroup", "addGroupMember", "removeGroupMember", "archiveResource", "restoreResource", "deleteResource", "setResourceAvailability", "setResourceBookingRules", "setBookingRuleDefaults", "setResourcePool", "setResourceParent", "setPoolOrder", "notePoolBooking", "putApprovalPolicy", "deleteApprovalPolicy", "requestApproval", "beginApprovalGrant", "finishApprovalGrant", "declineApproval", "resetTestTenant", "fastForwardTestTenant", "storeTenantAvailability", "setTenantAvailability", "setLocationAvailability", "createAvailabilityException", "deleteAvailabilityException", "replaceImportedExceptions", "importHolidayCalendar", "deleteHolidayCalendar", "noteHolidayCalendarFailure", "createReservation", "createExternalReservation", "rescheduleExternalReservation", "cancelExternalReservation", "acquireHold", "markHoldPaid", "putContact", "deleteContact", "confirmHold", "releaseHold", "putCalendarEvent", "cancelCalendarEvent", "cancelCalendarEventById", "recordCalendarCoverage", "replaceSourceBusy", "reportCoverageConflict", "createWebhookEndpoint", "deleteWebhookEndpoint", "enableWebhookEndpoint", "recordCoverageFailure", "deleteCoverage", "checkInReservation", "joinWaitlist", "leaveWaitlist", "declineWaitlistOffer", "putAssistantSettings", "deleteAssistantSettings", "resealAssistantKey", "putAssistantChat", "renameAssistantChat", "settleAssistantAction", "deleteAssistantChat"];