slotlock 0.9.0 → 0.10.0

package/agent-store-backend.js

@@ -12,7 +12,7 @@ import { readSlotlockHolidayCalendar } from './holiday-import.js';
 import { SLOTLOCK_OVERRIDE_RESOURCES, } from './availability-store.js';
 import { findEarliestRange } from './ranges.js';
 import { emitVAvailability, parseVAvailability, toJSCalendarEvent } from './interop.js';
-import { SLOTLOCK_INTERNAL_EVENT_OWNER_REF, calendarEventRollingHorizon, } from './store.js';
+import { buildSlotlockTenantExport, slotlockAuditEventRecord, SLOTLOCK_INTERNAL_EVENT_OWNER_REF, calendarEventRollingHorizon, } from './store.js';
 import { slotlockResourceSearchWords, slotlockSearchResources } from './resource-search.js';
 import { maintainSlotlockTenant } from './maintenance.js';
 import { fastForwardSlotlockSandbox, raceSlotlockSandbox, resetSlotlockSandbox, seedSlotlockSandbox, } from './sandbox.js';
@@ -78,6 +78,52 @@ function assertActive(context) {
     if (context.signal.aborted)
         throw new SlotlockAgentOperationError('request_aborted', 503);
 }
+/** A tenant export as the API gives it. */
+function tenantExportOutput(made) {
+    return {
+        id: made.id,
+        status: made.status,
+        requested_by: made.requestedBy,
+        created_at: made.createdAt.toISOString(),
+        finished_at: made.finishedAt?.toISOString() ?? null,
+        expires_at: made.expiresAt.toISOString(),
+        parts: made.parts,
+        rows: made.rows,
+        bytes: made.bytes,
+        tables: made.tables,
+        error: made.error,
+    };
+}
+/** A key's own caps on what its agent holds (RFC 0004 A5), or undefined when it has none. */
+function keyHoldCaps(context) {
+    const limits = context.principal.limits;
+    return limits?.maxHolds !== undefined || limits?.maxHeldHours !== undefined
+        ? {
+            ...(limits.maxHolds !== undefined ? { maxHolds: limits.maxHolds } : {}),
+            ...(limits.maxHeldHours !== undefined ? { maxHeldHours: limits.maxHeldHours } : {}),
+        }
+        : undefined;
+}
+/** The agent an approval holds time for, and its key's caps. */
+function approvalHolder(context) {
+    const caps = keyHoldCaps(context);
+    return caps ? { ref: agentOwnerRef(context), caps } : { ref: agentOwnerRef(context) };
+}
+/** The person an access or erasure request names (RFC 0004 D3), as the schema checked it. */
+function subjectOf(input) {
+    for (const kind of ['email', 'holder', 'contact', 'reference']) {
+        const value = input[kind];
+        if (typeof value === 'string')
+            return { [kind]: value };
+    }
+    throw new SlotlockAgentOperationError('invalid_subject', 400);
+}
+function subjectRefusal(error) {
+    if (error?.code === 'invalid_subject') {
+        throw new SlotlockAgentOperationError('invalid_subject', 400);
+    }
+    throw error;
+}
 async function withTenant(store, context, callback, options) {
     assertActive(context);
     let value;
@@ -607,6 +653,8 @@ export function createSlotlockStoreAgentBackend(store, options) {
                         source: 'agent-server',
                         // The key's own caps, below the server's (RFC 0004 A5).
                         ...(holderCaps ? { holderCaps } : {}),
+                        // Its price is the tenant's (holdPrice), never the agent's own (RFC 0004 C3).
+                        priceFromRules: true,
                         // Booked only once your system records its payment (RFC 0004 C3).
                         ...(input.payment_required === true ? { paymentRequired: true } : {}),
                         ...(input.payment !== undefined ? { payment: amountInput(input.payment) } : {}),
@@ -665,6 +713,8 @@ export function createSlotlockStoreAgentBackend(store, options) {
                         ttlMs: input.ttl_seconds * 1_000,
                         source: 'slotlock:together',
                         ...(holderCaps ? { holderCaps } : {}),
+                        // Its price is the tenant's (holdPrice), never the agent's own (RFC 0004 C3).
+                        priceFromRules: true,
                     });
                     // All or nothing: thrown, so the holds already made roll back with it.
                     if (!result.ok) {
@@ -1893,6 +1943,22 @@ function withApprovalPolicies(store, options, maxApprovalMinutes, backend) {
         const windows = (await hoursWithin(tenantStore, context, [resource], reach, options)).get(resource.id) ?? [];
         return !coveredByOpenWindows(windows, { start, end });
     }
+    /**
+     * What an update may change without booking any time: everything else (time, resource, zone,
+     * transparency, status, recurrence and its exceptions) is judged by what it would add.
+     */
+    const EVENT_DETAIL_FIELDS = new Set([
+        'event_id',
+        'expected_revision',
+        'expected_resource_id',
+        'idempotency_key',
+        'title',
+        'description',
+        'location',
+        'organizer',
+        'attendees',
+        'reminders',
+    ]);
     /** The write's ask and the policies that may cover it, or null when none can. */
     async function plan(tenantStore, context, operation, input) {
         const tenantRef = context.principal.tenantRef;
@@ -1950,15 +2016,18 @@ function withApprovalPolicies(store, options, maxApprovalMinutes, backend) {
             const current = await tenantStore.getCalendarEvent({ tenantRef, ownerRef, externalRef: input.event_id });
             if (!current)
                 return null;
+            // Details alone book nothing. Any other change may: a move, or time the event did not hold
+            // (made opaque or confirmed, given occurrences or fewer exceptions, another zone), judged
+            // below by what the write would add to what the event holds.
+            if (Object.keys(input).every((field) => EVENT_DETAIL_FIELDS.has(field)))
+                return null;
             const resourceId = input.resource_id ?? current.resourceId;
             const start = input.starts_at ? new Date(input.starts_at) : current.start;
             const end = input.ends_at ? new Date(input.ends_at) : current.end;
-            // Only a move to another time or resource is a booking a policy can be about.
-            if (resourceId === current.resourceId && start.getTime() === current.start.getTime() && end.getTime() === current.end.getTime()) {
-                return null;
-            }
+            const moved = resourceId !== current.resourceId || start.getTime() !== current.start.getTime() || end.getTime() !== current.end.getTime();
             asked = {
-                kind: 'move',
+                // Time added in place is a booking of its own; a move is a move.
+                kind: moved ? 'move' : 'single',
                 stored: 'slotlock_update_event',
                 resourceIds: [resourceId],
                 externalRefs: [current.externalRef],
@@ -1995,18 +2064,20 @@ function withApprovalPolicies(store, options, maxApprovalMinutes, backend) {
             });
             if (asked.prior) {
                 const { hold_id: _held, ...request } = input;
-                // Granted: the booking was made with this key, so the write answers it as a replay (and
-                // the store refuses another request with it). Without the hold the approval took over,
-                // as the grant made it.
-                if (asked.prior.status === 'granted')
-                    return method.call(this, context, request);
                 const kept = { ...asked.prior.request };
                 // A pool booking is kept as the member it would take.
                 if (operation === 'slotlock_book_pool')
                     delete kept.resource_id;
+                // The key answers only the request a person was asked about, granted or not: a grant
+                // approves that booking, never another made with its key (a bundle's other resources, say,
+                // which the store would take as new).
                 if (JSON.stringify(canonical(kept)) !== JSON.stringify(canonical(request))) {
                     throw new SlotlockAgentOperationError('idempotency_conflict', 409);
                 }
+                // Granted: the booking was made with this key, so the write answers it as a replay.
+                // Without the hold the approval took over, as the grant made it.
+                if (asked.prior.status === 'granted')
+                    return method.call(this, context, request);
                 throw approvalAnswer(asked.prior);
             }
             const ask = asked.plan;
@@ -2030,6 +2101,11 @@ function withApprovalPolicies(store, options, maxApprovalMinutes, backend) {
             if (probed.replayed === true || occupied.length === 0) {
                 return context.dryRun ? probed : method.call(this, context, input);
             }
+            // Only time the event did not already hold needs a person: an edit or a move within its own
+            // time books nothing new.
+            const holds = uncovered(occupied, ask.before);
+            if (holds.length === 0)
+                return context.dryRun ? probed : method.call(this, context, input);
             const written = [...new Set(occupied.map((occupation) => occupation.resourceId))];
             const decided = await withTenant(store, { ...context, dryRun: false }, async (tenantStore) => {
                 // A pool's policies are those of the member the write would take, and its pool.
@@ -2077,9 +2153,6 @@ function withApprovalPolicies(store, options, maxApprovalMinutes, backend) {
                     expires_at: expiresAt.toISOString(),
                 });
             }
-            const holds = uncovered(occupied, ask.before);
-            if (holds.length === 0)
-                return method.call(this, context, input);
             const chosen = ask.pool ? written[0] : undefined;
             const { hold_id: _hold, ...request } = input;
             const principal = context.principal;
@@ -2107,8 +2180,14 @@ function withApprovalPolicies(store, options, maxApprovalMinutes, backend) {
                 end: ask.end,
                 expiresAt,
                 ...(ask.consumeHold ? { consumeHold: ask.consumeHold } : {}),
+                // An agent's approvals hold time against its own caps (RFC 0004 A5); the tenant's own
+                // systems have none.
+                ...(forTenant(context) ? {} : { holder: approvalHolder(context) }),
             }), WRITE);
             if (!result.ok) {
+                if (result.code === 'hold_limit_reached' || result.code === 'held_time_limit_reached') {
+                    throw new SlotlockAgentOperationError(result.code, 409, { limit: String(result.limit) });
+                }
                 if (result.code === 'approval_limit_reached') {
                     throw new SlotlockAgentOperationError('approval_limit_reached', 429, { limit: String(result.limit ?? '') });
                 }
@@ -2274,6 +2353,9 @@ function bookingRulesOutput(rules) {
                 },
             }
             : {}),
+        ...(rules.holdPrice !== undefined
+            ? { hold_price: { amount_minor: rules.holdPrice.amountMinor, currency: rules.holdPrice.currency } }
+            : {}),
     };
 }
 const dayWindowsOutput = (windows) => windows.map((window) => ({ start_minutes: window.startMinutes, duration_minutes: window.durationMinutes }));
@@ -2333,6 +2415,10 @@ function bookingRulesInput(value) {
             ...(fee.within_minutes !== undefined ? { withinMinutes: fee.within_minutes } : {}),
         };
     }
+    if (input.hold_price !== undefined) {
+        const price = input.hold_price;
+        rules.holdPrice = { amountMinor: price.amount_minor, currency: price.currency };
+    }
     return rules;
 }
 function resourceOutput(resource) {
@@ -3220,8 +3306,12 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                     paymentRef: input.payment_ref,
                     ...(input.received !== undefined ? { received: amountInput(input.received) } : {}),
                 });
-                if (!result.ok)
+                if (!result.ok) {
+                    if (result.code === 'payment_conflict') {
+                        throw new SlotlockAgentOperationError('payment_conflict', 409, { payment_ref: result.paymentRef });
+                    }
                     throw applicationRefusal(result.code);
+                }
                 return { hold: holdOutput(result.hold), replayed: result.idempotent };
             }, WRITE);
         },
@@ -3858,6 +3948,110 @@ export function createSlotlockStoreApplicationBackend(store, options = {}) {
                 surfaces: summary.surfaces,
             };
         },
+        async listAuditEvents(context, input) {
+            const tenantRef = tenantOf(context);
+            const limit = input.limit ?? 50;
+            return withTenant(store, context, async (tenant) => {
+                // As the dashboard's export: where hosted plans apply, the Team plan's.
+                const plan = await tenant.tenantPlan({ tenantRef });
+                if (plan && (plan.plan !== 'team' || plan.status === 'canceled')) {
+                    throw new SlotlockAgentOperationError('team_plan_required', 403);
+                }
+                const events = await tenant.listAuditEvents({
+                    tenantRef,
+                    limit,
+                    ...(typeof input.cursor === 'string' ? { beforeId: input.cursor } : {}),
+                    ...(typeof input.action === 'string' ? { action: input.action } : {}),
+                    ...(typeof input.actor_ref === 'string' ? { actorRef: input.actor_ref } : {}),
+                });
+                return {
+                    events: events.map(slotlockAuditEventRecord),
+                    // A full page may have more after it; the next then answers none.
+                    next_cursor: events.length === limit ? (events.at(-1)?.id ?? null) : null,
+                };
+            });
+        },
+        async verifyAuditLog(context) {
+            const verified = await withTenant(store, context, (tenant) => tenant.verifyAuditChain({ tenantRef: tenantOf(context) }));
+            return { checked: verified.checked, broken_at: verified.brokenAt };
+        },
+        async createTenantExport(context) {
+            const tenantRef = tenantOf(context);
+            const keyId = context.principal.keyId;
+            const actor = typeof keyId === 'string' && /^[0-9a-f-]{36}$/i.test(keyId)
+                ? { actorType: 'api_key', actorRef: `api_key:${keyId}` }
+                : { actorType: 'system', actorRef: 'application' };
+            const created = await withTenant(store, context, async (tenant) => {
+                const made = await tenant.createTenantExport({ tenantRef, requestedBy: actor.actorRef }).catch((error) => {
+                    const code = error?.code;
+                    if (code === 'export_in_progress' || code === 'export_limit_reached') {
+                        throw new SlotlockAgentOperationError(code, 409);
+                    }
+                    throw error;
+                });
+                await tenant.recordAuditEvent({
+                    tenantRef,
+                    event: { action: 'export.created', ...actor, targetType: 'export', targetRef: made.id },
+                });
+                return made;
+            }, WRITE);
+            // Built after the answer; maintenance builds one a stopped server left pending.
+            void buildSlotlockTenantExport(store, tenantRef, created.id);
+            return { export: tenantExportOutput(created) };
+        },
+        async listTenantExports(context) {
+            const exports = await withTenant(store, context, (tenant) => tenant.listTenantExports({ tenantRef: tenantOf(context) }));
+            return { exports: exports.slice(0, 100).map(tenantExportOutput) };
+        },
+        async getTenantExport(context, input) {
+            const found = await withTenant(store, context, (tenant) => tenant.getTenantExport({ tenantRef: tenantOf(context), exportId: input.export_id }));
+            if (!found)
+                throw new SlotlockAgentOperationError('export_not_found', 404);
+            return { export: tenantExportOutput(found) };
+        },
+        async getTenantExportPart(context, input) {
+            const part = Number(input.part);
+            const read = await withTenant(store, context, (tenant) => tenant.getTenantExportPart({ tenantRef: tenantOf(context), exportId: input.export_id, part }));
+            if (!read.ok)
+                throw new SlotlockAgentOperationError(read.code, read.code === 'export_not_ready' ? 409 : 404);
+            return {
+                export_id: input.export_id,
+                part,
+                table: read.table,
+                rows: read.lines.map((line) => JSON.parse(line)),
+            };
+        },
+        async deleteTenantExport(context, input) {
+            const deleted = await withTenant(store, context, (tenant) => tenant.deleteTenantExport({ tenantRef: tenantOf(context), exportId: input.export_id }), WRITE);
+            return { deleted };
+        },
+        async exportSubject(context, input) {
+            const subject = subjectOf(input);
+            const exported = await withTenant(store, context, (tenant) => tenant.exportSubject({ tenantRef: tenantOf(context), subject, limit: 1_000 })).catch(subjectRefusal);
+            return { records: exported.records, truncated: exported.truncated };
+        },
+        async eraseSubject(context, input) {
+            const subject = subjectOf(input);
+            const tenantRef = tenantOf(context);
+            const keyId = context.principal.keyId;
+            return withTenant(store, context, async (tenant) => {
+                const { erased } = await tenant.eraseSubject({ tenantRef, subject }).catch(subjectRefusal);
+                // Who erased whom is the workspace's to know, but never the person: how they were named,
+                // and what went.
+                await tenant.recordAuditEvent({
+                    tenantRef,
+                    event: {
+                        action: 'subject.erased',
+                        ...(typeof keyId === 'string' && /^[0-9a-f-]{36}$/i.test(keyId)
+                            ? { actorType: 'api_key', actorRef: `api_key:${keyId}` }
+                            : { actorType: 'system', actorRef: 'application' }),
+                        targetType: 'subject',
+                        metadata: { by: Object.keys(subject)[0], ...Object.fromEntries(Object.entries(erased).filter(([, rows]) => rows > 0)) },
+                    },
+                });
+                return { erased };
+            }, WRITE);
+        },
         async enableWebhook(context, input) {
             return withTenant(store, context, async (tenant) => {
                 const enabled = await tenant.enableWebhookEndpoint({

package/application-api.d.ts

@@ -2,7 +2,7 @@ import { type SlotlockChangeOrigin } from './event-feed.js';
 import { z } from 'zod';
 import type { SlotlockAgentPrincipal } from './agent-server.js';
 import type { SlotlockTraceContext } from './mcp-modern.js';
-export type SlotlockApplicationOperation = 'slotlock_create_resource' | 'slotlock_update_resource' | 'slotlock_list_locations' | 'slotlock_create_location' | 'slotlock_update_location' | 'slotlock_delete_location' | 'slotlock_list_groups' | 'slotlock_create_group' | 'slotlock_delete_group' | 'slotlock_add_group_member' | 'slotlock_remove_group_member' | 'slotlock_get_resource' | 'slotlock_archive_resource' | 'slotlock_restore_resource' | 'slotlock_delete_resource' | 'slotlock_list_busy' | 'slotlock_set_resource_availability' | 'slotlock_set_tenant_availability' | 'slotlock_get_availability_defaults' | 'slotlock_set_location_availability' | 'slotlock_list_availability_exceptions' | 'slotlock_create_availability_exception' | 'slotlock_delete_availability_exception' | 'slotlock_import_holidays' | 'slotlock_list_holiday_calendars' | 'slotlock_delete_holiday_calendar' | 'slotlock_export_resource_availability' | 'slotlock_import_resource_availability' | 'slotlock_set_resource_booking_rules' | 'slotlock_set_resource_pool' | 'slotlock_set_resource_parent' | 'slotlock_list_pools' | 'slotlock_set_pool_order' | 'slotlock_get_booking_rule_defaults' | 'slotlock_set_tenant_booking_rules' | 'slotlock_set_pool_booking_rules' | 'slotlock_get_resource_history' | 'slotlock_get_coverage' | 'slotlock_record_coverage_failure' | 'slotlock_delete_coverage' | 'slotlock_put_source_busy' | 'slotlock_report_coverage_conflict' | 'slotlock_get_reservation_history' | 'slotlock_get_tenant_event_history' | 'slotlock_acquire_hold' | 'slotlock_get_hold' | 'slotlock_list_holds' | 'slotlock_confirm_hold' | 'slotlock_mark_hold_paid' | 'slotlock_release_hold' | 'slotlock_get_reservation' | 'slotlock_list_reservations' | 'slotlock_put_reservation' | 'slotlock_cancel_reservation' | 'slotlock_check_in_reservation' | 'slotlock_put_contact' | 'slotlock_get_contact' | 'slotlock_list_contacts' | 'slotlock_delete_contact' | 'slotlock_join_waitlist' | 'slotlock_list_waitlist' | 'slotlock_leave_waitlist' | 'slotlock_decline_waitlist_offer' | 'slotlock_tenant_book_together' | 'slotlock_tenant_book_pool' | 'slotlock_record_coverage' | 'slotlock_list_tenant_events' | 'slotlock_get_tenant_event' | 'slotlock_export_tenant_event' | 'slotlock_cancel_tenant_event' | 'slotlock_get_tenant' | 'slotlock_erase_tenant' | 'slotlock_run_maintenance' | 'slotlock_list_changes' | 'slotlock_create_webhook' | 'slotlock_list_webhooks' | 'slotlock_delete_webhook' | 'slotlock_enable_webhook' | 'slotlock_get_usage' | 'slotlock_list_approval_policies' | 'slotlock_put_approval_policy' | 'slotlock_delete_approval_policy' | 'slotlock_list_approvals' | 'slotlock_get_approval' | 'slotlock_decide_approval' | 'slotlock_sandbox_seed' | 'slotlock_sandbox_reset' | 'slotlock_sandbox_fast_forward' | 'slotlock_sandbox_race' | 'slotlock_partner_put_account' | 'slotlock_partner_list_accounts' | 'slotlock_partner_get_account' | 'slotlock_partner_list_keys' | 'slotlock_partner_create_key' | 'slotlock_partner_rotate_key' | 'slotlock_partner_revoke_key' | 'slotlock_partner_suspend_account' | 'slotlock_partner_unsuspend_account' | 'slotlock_partner_erase_account' | 'slotlock_partner_get_usage' | 'slotlock_partner_reconcile_usage';
+export type SlotlockApplicationOperation = 'slotlock_create_resource' | 'slotlock_update_resource' | 'slotlock_list_locations' | 'slotlock_create_location' | 'slotlock_update_location' | 'slotlock_delete_location' | 'slotlock_list_groups' | 'slotlock_create_group' | 'slotlock_delete_group' | 'slotlock_add_group_member' | 'slotlock_remove_group_member' | 'slotlock_get_resource' | 'slotlock_archive_resource' | 'slotlock_restore_resource' | 'slotlock_delete_resource' | 'slotlock_list_busy' | 'slotlock_set_resource_availability' | 'slotlock_set_tenant_availability' | 'slotlock_get_availability_defaults' | 'slotlock_set_location_availability' | 'slotlock_list_availability_exceptions' | 'slotlock_create_availability_exception' | 'slotlock_delete_availability_exception' | 'slotlock_import_holidays' | 'slotlock_list_holiday_calendars' | 'slotlock_delete_holiday_calendar' | 'slotlock_export_resource_availability' | 'slotlock_import_resource_availability' | 'slotlock_set_resource_booking_rules' | 'slotlock_set_resource_pool' | 'slotlock_set_resource_parent' | 'slotlock_list_pools' | 'slotlock_set_pool_order' | 'slotlock_get_booking_rule_defaults' | 'slotlock_set_tenant_booking_rules' | 'slotlock_set_pool_booking_rules' | 'slotlock_get_resource_history' | 'slotlock_get_coverage' | 'slotlock_record_coverage_failure' | 'slotlock_delete_coverage' | 'slotlock_put_source_busy' | 'slotlock_report_coverage_conflict' | 'slotlock_get_reservation_history' | 'slotlock_get_tenant_event_history' | 'slotlock_acquire_hold' | 'slotlock_get_hold' | 'slotlock_list_holds' | 'slotlock_confirm_hold' | 'slotlock_mark_hold_paid' | 'slotlock_release_hold' | 'slotlock_get_reservation' | 'slotlock_list_reservations' | 'slotlock_put_reservation' | 'slotlock_cancel_reservation' | 'slotlock_check_in_reservation' | 'slotlock_put_contact' | 'slotlock_get_contact' | 'slotlock_list_contacts' | 'slotlock_delete_contact' | 'slotlock_join_waitlist' | 'slotlock_list_waitlist' | 'slotlock_leave_waitlist' | 'slotlock_decline_waitlist_offer' | 'slotlock_tenant_book_together' | 'slotlock_tenant_book_pool' | 'slotlock_record_coverage' | 'slotlock_list_tenant_events' | 'slotlock_get_tenant_event' | 'slotlock_export_tenant_event' | 'slotlock_cancel_tenant_event' | 'slotlock_get_tenant' | 'slotlock_erase_tenant' | 'slotlock_run_maintenance' | 'slotlock_list_changes' | 'slotlock_create_webhook' | 'slotlock_list_webhooks' | 'slotlock_delete_webhook' | 'slotlock_enable_webhook' | 'slotlock_get_usage' | 'slotlock_list_audit_events' | 'slotlock_verify_audit_log' | 'slotlock_export_subject' | 'slotlock_erase_subject' | 'slotlock_create_tenant_export' | 'slotlock_list_tenant_exports' | 'slotlock_get_tenant_export' | 'slotlock_get_tenant_export_part' | 'slotlock_delete_tenant_export' | 'slotlock_list_approval_policies' | 'slotlock_put_approval_policy' | 'slotlock_delete_approval_policy' | 'slotlock_list_approvals' | 'slotlock_get_approval' | 'slotlock_decide_approval' | 'slotlock_sandbox_seed' | 'slotlock_sandbox_reset' | 'slotlock_sandbox_fast_forward' | 'slotlock_sandbox_race' | 'slotlock_partner_put_account' | 'slotlock_partner_list_accounts' | 'slotlock_partner_get_account' | 'slotlock_partner_list_keys' | 'slotlock_partner_create_key' | 'slotlock_partner_rotate_key' | 'slotlock_partner_revoke_key' | 'slotlock_partner_suspend_account' | 'slotlock_partner_unsuspend_account' | 'slotlock_partner_erase_account' | 'slotlock_partner_get_usage' | 'slotlock_partner_reconcile_usage';
 /** The scope an application operation needs, but the partner API's (`slotlockApplicationScope`). */
 export declare const SLOTLOCK_APPLICATION_SCOPE = "admin";
 /** The scope one application operation needs: `partner` for the partner API's, else `admin`. */
@@ -113,6 +113,15 @@ export interface SlotlockApplicationBackend {
     deleteWebhook: Handler;
     enableWebhook: Handler;
     getUsage: Handler;
+    listAuditEvents: Handler;
+    verifyAuditLog: Handler;
+    exportSubject: Handler;
+    eraseSubject: Handler;
+    createTenantExport: Handler;
+    listTenantExports: Handler;
+    getTenantExport: Handler;
+    getTenantExportPart: Handler;
+    deleteTenantExport: Handler;
     listApprovalPolicies: Handler;
     putApprovalPolicy: Handler;
     deleteApprovalPolicy: Handler;

package/application-api.js

@@ -14,6 +14,7 @@ import { SLOTLOCK_APPROVAL_KINDS, SLOTLOCK_MAX_APPROVAL_MINUTES, SLOTLOCK_MAX_AP
 import { SLOTLOCK_PARTNER_ACCOUNT, SLOTLOCK_PARTNER_PLAN } from './partner-names.js';
 import { SLOTLOCK_EVENT_OUTPUT } from './event-schema.js';
 import { SLOTLOCK_CALENDAR_HORIZON_DAYS, SLOTLOCK_SOURCE_BUSY_MAX } from './rules.js';
+import { SLOTLOCK_SUBJECT_TABLES, SLOTLOCK_TENANT_EXPORT_LEFT_OUT, SLOTLOCK_TENANT_EXPORT_TABLES, } from './types.js';
 import { SLOTLOCK_GROUPING_REF, SLOTLOCK_MAX_GROUPS_PER_RESOURCE, SLOTLOCK_MAX_LOCATION_DEPTH, SLOTLOCK_MAX_LOCATIONS, SLOTLOCK_MAX_RESOURCE_GROUPS, SLOTLOCK_POOL_ORDERS, SLOTLOCK_RESOURCE_KINDS, SLOTLOCK_RESOURCE_LABEL, SLOTLOCK_RESOURCE_PROFILE_LIMITS, } from './resource-profile.js';
 /** The scope an application operation needs, but the partner API's (`slotlockApplicationScope`). */
 export const SLOTLOCK_APPLICATION_SCOPE = 'admin';
@@ -27,6 +28,8 @@ export function slotlockApplicationScope(definition) {
  */
 const NOT_DRY_RUNNABLE = new Set([
     'slotlock_erase_tenant',
+    // Built after the answer, outside the request's transaction.
+    'slotlock_create_tenant_export',
     'slotlock_run_maintenance',
     'slotlock_sandbox_seed',
     'slotlock_sandbox_reset',
@@ -207,6 +210,17 @@ const BOOKING_RULES = z
     })
         .strict()
         .optional(),
+    /**
+     * What holding it costs, your price (RFC 0004 C3): an agent's hold waits for this payment,
+     * whatever it asks, and an agent books it only from such a hold, once paid.
+     */
+    hold_price: z
+        .object({
+        amount_minor: z.number().int().min(1).max(1_000_000_000_000),
+        currency: z.string().regex(/^[A-Z]{3}$/),
+    })
+        .strict()
+        .optional(),
 })
     .strict();
 /** Default booking rules for the tenant or a pool: a resource's own rules but check-in. */
@@ -530,6 +544,67 @@ const HOLD = z
     paid_amount: PAYMENT_AMOUNT.nullable().optional(),
 })
     .strict();
+/** An event of the workspace audit log (RFC 0004 D2): who did what, to what, from where. */
+const AUDIT_EVENT = z
+    .object({
+    id: z.string().uuid(),
+    occurred_at: DATE_TIME,
+    /** `<area>.<verb>`, such as `api_key.created`, `authz.denied` or `subject.erased`. */
+    action: z.string().min(3).max(100),
+    actor_type: z.enum(['person', 'api_key', 'assistant', 'system']),
+    /** `github:<id>`, `google:<subject>`, `api_key:<id>`: a reference, never a name or an email. */
+    actor_ref: z.string().min(1).max(500),
+    actor_role: z.enum(['owner', 'admin', 'developer', 'member', 'viewer', 'billing']).nullable(),
+    target_type: z.string().min(1).max(32).nullable(),
+    target_ref: z.string().min(1).max(500).nullable(),
+    outcome: z.enum(['success', 'denied']),
+    reason: z.string().min(1).max(200).nullable(),
+    ip_address: z.string().min(1).max(64).nullable(),
+    user_agent: z.string().min(1).max(256).nullable(),
+    metadata: z.record(z.string(), z.unknown()),
+    /** Its place in the tenant's chain, and its SHA-256 (hex) over the one before and itself. */
+    chain_index: z.number().int().min(1).nullable(),
+    hash: z.string().regex(/^[0-9a-f]{64}$/).nullable(),
+})
+    .strict();
+/** Whom an access or erasure request is about (RFC 0004 D3): exactly one identifier. */
+const SUBJECT = z
+    .object({
+    /** Contacts, event attendees and organizers with this email (ignoring case). */
+    email: z.string().trim().min(3).max(320).regex(/^[^\s@]+@[^\s@]+$/, 'must be an email address').optional(),
+    /** Holds, bookings and waitlist entries held under this holder reference. */
+    holder: z.string().min(1).max(500).optional(),
+    /** The contact kept under this reference (slotlock_put_contact). */
+    contact: z
+        .string()
+        .regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/, 'must be 1-200 letters, digits, . _ : or -, starting with a letter or digit')
+        .optional(),
+    /** The booking or event with this reference. */
+    reference: z.string().min(1).max(500).optional(),
+})
+    .strict()
+    .refine((input) => Object.values(input).filter((value) => value !== undefined).length === 1, 'Name the person by exactly one of email, holder, contact or reference');
+/** A copy of everything the tenant keeps (RFC 0004 D3), as built or being built. */
+const TENANT_EXPORT = z
+    .object({
+    id: z.string().uuid(),
+    /** pending until it is built, then ready, or failed (error says why). */
+    status: z.enum(['pending', 'ready', 'failed']),
+    requested_by: z.string().min(1).max(200).nullable(),
+    created_at: DATE_TIME,
+    finished_at: DATE_TIME.nullable(),
+    /** When it is deleted. */
+    expires_at: DATE_TIME,
+    /** Parts to read, 1 to parts, with slotlock_get_tenant_export_part. */
+    parts: z.number().int().min(0),
+    rows: z.number().int().min(0),
+    bytes: z.number().int().min(0),
+    /** Rows by table, for the tables with any. */
+    tables: z.record(z.string(), z.number().int().min(0)),
+    error: z.string().min(1).max(200).nullable(),
+})
+    .strict();
+const EXPORT_ID = z.string().uuid();
 /** A person a booking may name to be told about it (RFC 0004 P3), by the tenant's reference. */
 const CONTACT_REF = z
     .string()
@@ -1123,7 +1198,7 @@ export const SLOTLOCK_APPLICATION_OPERATIONS = Object.freeze([
     {
         name: 'slotlock_import_holidays',
         title: 'Import a holiday calendar',
-        description: "Close the days an iCalendar holiday calendar names, for the whole tenant, one location or one resource: the text in icalendar, or an https url the server fetches (at most 1 MB, 10 seconds; private addresses refused). Each all-day event closes the days it covers, and each occurrence of a recurring one within from to to (default today to two years on, at most three years); timed and cancelled events are skipped. The calendar is kept by name at its scope (name, by default its own X-WR-CALNAME, else the url's host and path, else Holidays): importing it again updates its closures instead of adding more, and deletes the ones it made that it no longer names within the span (removed), so a holiday it dropped goes too. With subscribe (and a url), the server keeps the url and imports it again every 30 days. At most 50 calendars a tenant (409 holiday_calendars_limit_reached). 400 invalid_holiday_calendar for text that is not one; 400 holiday_calendar_unreachable when the url cannot be read; 400 holiday_url_not_served where the server fetches no urls.",
+        description: "Close the days an iCalendar holiday calendar names, for the whole tenant, one location or one resource: the text in icalendar, or an https url the server fetches (at most 1 MB, 10 seconds; private addresses refused). Each all-day event closes the days it covers, and each occurrence of a recurring one within from to to (default today to two years on, at most three years); timed and cancelled events are skipped. The calendar is kept by name at its scope (name, by default its own X-WR-CALNAME, else the url's host, else Holidays): importing it again updates its closures instead of adding more, and deletes the ones it made that it no longer names within the span (removed), so a holiday it dropped goes too. With subscribe (and a url), the server keeps the url and imports it again every 30 days. At most 50 calendars a tenant (409 holiday_calendars_limit_reached). 400 invalid_holiday_calendar for text that is not one, or one that repeats more often than daily, daily on days of the month or year, or too much to read; 400 holiday_calendar_unreachable when the url cannot be read; 400 holiday_url_not_served where the server fetches no urls.",
         method: 'POST',
         path: '/v1/availability/holidays',
         input: z
@@ -1265,7 +1340,7 @@ export const SLOTLOCK_APPLICATION_OPERATIONS = Object.freeze([
     {
         name: 'slotlock_mark_hold_paid',
         title: 'Record a hold as paid',
-        description: "Record that a hold made with payment_required is paid, by the payment's reference at your processor (a Stripe PaymentIntent id, say), once you have verified it: the hold may then be confirmed. Slotlock records payment state and never moves money. The same reference again answers the same hold (replayed: true), whatever became of it since (confirmed, booked as an event, expired): the payment is kept apart from the hold. Another reference answers 409 payment_conflict. When the hold names its payment, received must be at least that amount in that currency (409 payment_amount_mismatch). The feed says so (hold.paid). A hold that does not wait for payment answers 409 payment_not_required; one that expired before it was paid, 409 hold_expired (refund the payment: its time may be someone else's); one released before it was paid, or unknown, 404 hold_not_found.",
+        description: "Record that a hold made with payment_required is paid, by the payment's reference at your processor (a Stripe PaymentIntent id, say), once you have verified it: the hold may then be confirmed. Slotlock records payment state and never moves money. The same reference again answers the same hold (replayed: true) while it is held or once it is booked (confirmed, or booked as an event), whatever became of the booking since: the payment is kept apart from the hold. A hold that ended without a booking after it was paid (expired, or let go) answers 409 hold_ended: the payment was never applied, so refund it; the feed's hold.expired or hold.released says so too (payment_unapplied). Another reference answers 409 payment_conflict, naming the one recorded (payment_ref). When the hold names its payment, received must be at least that amount in that currency (409 payment_amount_mismatch). The feed says so (hold.paid). A hold that does not wait for payment answers 409 payment_not_required; one that expired before it was paid, 409 hold_expired (refund the payment: its time may be someone else's); one released before it was paid, or unknown, 404 hold_not_found.",
         method: 'POST',
         path: '/v1/holds/{hold_id}/paid',
         input: z
@@ -1989,6 +2064,142 @@ export const SLOTLOCK_APPLICATION_OPERATIONS = Object.freeze([
         invoke: 'getUsage',
         example: { from: '2026-11-01', to: '2026-11-30' },
     },
+    // The audit log and requests about one person (RFC 0004 D2, D3).
+    {
+        name: 'slotlock_list_audit_events',
+        title: 'List audit events',
+        description: "The workspace audit log, newest first: who did what to its people, keys, webhooks, billing and settings, from where, and whether it was refused. Actors are references (github:<id>, api_key:<id>), never names. Each event carries its place in the tenant's hash chain and its hash (slotlock_verify_audit_log checks them). Only events of action or actor_ref when given; pass next_cursor as cursor for the next page, until it is null. Events are kept 180 days, 400 on the Team plan. Where hosted plans apply, the log is read this way on the Team plan only (403 team_plan_required).",
+        method: 'GET',
+        path: '/v1/audit',
+        input: z
+            .object({
+            limit: z.number().int().min(1).max(200).default(50),
+            cursor: z.string().uuid().optional(),
+            action: z.string().regex(/^[a-z][a-z_]{0,31}(\.[a-z][a-z_]{0,31}){1,2}$/, 'must be an action, like api_key.created').optional(),
+            actor_ref: z.string().min(1).max(500).optional(),
+        })
+            .strict(),
+        output: z.object({ events: z.array(AUDIT_EVENT).max(200), next_cursor: z.string().uuid().nullable() }).strict(),
+        risk: { readOnly: true, destructive: false, idempotent: true },
+        invoke: 'listAuditEvents',
+        example: { limit: 50, action: 'api_key.created' },
+    },
+    {
+        name: 'slotlock_verify_audit_log',
+        title: 'Verify the audit log',
+        description: "Check the workspace audit log's hash chain from its oldest event kept: each event numbered after the one before, linked to its hash, and hashed over its own content. checked counts the events that held; broken_at is the number of the first that does not (an event changed, removed or reordered outside Slotlock), or null when every one does.",
+        method: 'GET',
+        path: '/v1/audit/verify',
+        input: z.object({}).strict(),
+        output: z.object({ checked: z.number().int().min(0), broken_at: z.number().int().min(1).nullable() }).strict(),
+        risk: { readOnly: true, destructive: false, idempotent: true },
+        invoke: 'verifyAuditLog',
+        example: {},
+    },
+    {
+        name: 'slotlock_export_subject',
+        title: "Export a person's data",
+        description: `What the tenant keeps about one person, for an access request: the rows that name them, as kept, by table (${SLOTLOCK_SUBJECT_TABLES.join(', ')}), up to 1,000 a table (truncated: true when a table had more). Name them by exactly one of email (contacts, event attendees and organizers, ignoring case), holder (holds, bookings and waitlist entries), contact (a contact's reference) or reference (a booking's or an event's). It lists what slotlock_erase_subject would delete or take them out of: the bookings, changes and approvals that name their contacts too. An event lists its time and title, and an approval its decision, never the other people they name. 400 invalid_subject when no identifier, or more than one, is given.`,
+        method: 'POST',
+        path: '/v1/subjects/export',
+        input: SUBJECT,
+        output: z
+            .object({
+            records: z
+                .object(Object.fromEntries(SLOTLOCK_SUBJECT_TABLES.map((table) => [table, z.array(z.record(z.string(), z.unknown())).max(1_000)])))
+                .strict(),
+            truncated: z.boolean(),
+        })
+            .strict(),
+        risk: { readOnly: true, destructive: false, idempotent: true },
+        invoke: 'exportSubject',
+        example: { email: 'ada@example.com' },
+    },
+    {
+        name: 'slotlock_erase_subject',
+        title: 'Erase a person',
+        description: "Take one person out of the tenant's data, for an erasure request, at once: their contacts, attendee entries and waitlist entries are deleted; their email leaves events' attendee and organizer lists and approvals' requests; their holder reference and booking reference become one erased-<32 hex> name wherever they were (holds, bookings, ended bookings, events, the change history, approvals), and their contact's reference leaves bookings and changes. Bookings stay, as time taken, and nobody is told: the feed gets no change. Name them as for slotlock_export_subject. erased counts, by table, the rows deleted or changed; erasing again changes nothing. Recorded in the audit log (subject.erased) without the identifier. 400 invalid_subject when no identifier, or more than one, is given.",
+        method: 'POST',
+        path: '/v1/subjects/erase',
+        input: SUBJECT,
+        output: z
+            .object({
+            erased: z
+                .object(Object.fromEntries(SLOTLOCK_SUBJECT_TABLES.map((table) => [table, z.number().int().min(0)])))
+                .strict(),
+        })
+            .strict(),
+        risk: { readOnly: false, destructive: true, idempotent: true },
+        invoke: 'eraseSubject',
+        example: { email: 'ada@example.com' },
+    },
+    {
+        name: 'slotlock_create_tenant_export',
+        title: 'Export the tenant',
+        description: `Ask for a copy of everything the tenant keeps, to download: every table's rows as kept, read at one moment (${SLOTLOCK_TENANT_EXPORT_TABLES.join(', ')}). Secrets stay out: webhooks' signing secrets, the assistant's provider key and API keys' digests. ${Object.keys(SLOTLOCK_TENANT_EXPORT_LEFT_OUT).length} tables are left out as derived, internal or one member's own (each member's conversations with the assistant). It answers pending at once and is built in the background: slotlock_get_tenant_export says when it is ready, then read its parts with slotlock_get_tenant_export_part. Kept 24 hours once ready, then deleted. One is built at a time (409 export_in_progress) and five are kept (409 export_limit_reached); one past 512 MB fails (error export_too_large) and its operator runs slotlock tenant export. Recorded in the audit log (export.created).`,
+        method: 'POST',
+        path: '/v1/tenant/exports',
+        input: z.object({}).strict(),
+        output: z.object({ export: TENANT_EXPORT }).strict(),
+        risk: { readOnly: false, destructive: false, idempotent: false },
+        invoke: 'createTenantExport',
+        example: {},
+    },
+    {
+        name: 'slotlock_list_tenant_exports',
+        title: 'List tenant exports',
+        description: "The tenant's exports, newest first, until each is deleted: pending, ready (with how many parts and rows) or failed.",
+        method: 'GET',
+        path: '/v1/tenant/exports',
+        input: z.object({}).strict(),
+        output: z.object({ exports: z.array(TENANT_EXPORT).max(100) }).strict(),
+        risk: { readOnly: true, destructive: false, idempotent: true },
+        invoke: 'listTenantExports',
+        example: {},
+    },
+    {
+        name: 'slotlock_get_tenant_export',
+        title: 'Get a tenant export',
+        description: 'One of the tenant\'s exports: whether it is ready, its parts, rows and bytes, and rows by table. An unknown or deleted one answers 404 export_not_found.',
+        method: 'GET',
+        path: '/v1/tenant/exports/{export_id}',
+        input: z.object({ export_id: EXPORT_ID }).strict(),
+        output: z.object({ export: TENANT_EXPORT }).strict(),
+        risk: { readOnly: true, destructive: false, idempotent: true },
+        invoke: 'getTenantExport',
+        example: { export_id: '0b6c8d1e-4f2a-4c3b-9d5e-7f8a9b0c1d2e' },
+    },
+    {
+        name: 'slotlock_get_tenant_export_part',
+        title: 'Read a part of a tenant export',
+        description: 'One part of a ready export, 1 to its parts: one table\'s rows, each an object as Slotlock keeps it (without the tenant). Write each part\'s rows as JSON lines to its table\'s file to keep the export as NDJSON. 409 export_not_ready before it is ready; 404 export_not_found or export_part_not_found.',
+        method: 'GET',
+        path: '/v1/tenant/exports/{export_id}/parts/{part}',
+        input: z.object({ export_id: EXPORT_ID, part: z.string().regex(/^[1-9][0-9]{0,6}$/, 'must be a part number, 1 or more') }).strict(),
+        output: z
+            .object({
+            export_id: EXPORT_ID,
+            part: z.number().int().min(1),
+            table: z.string().min(1).max(63),
+            rows: z.array(z.record(z.string(), z.unknown())).max(5_000),
+        })
+            .strict(),
+        risk: { readOnly: true, destructive: false, idempotent: true },
+        invoke: 'getTenantExportPart',
+        example: { export_id: '0b6c8d1e-4f2a-4c3b-9d5e-7f8a9b0c1d2e', part: '1' },
+    },
+    {
+        name: 'slotlock_delete_tenant_export',
+        title: 'Delete a tenant export',
+        description: 'Delete one of the tenant\'s exports at once, with every part, rather than waiting for it to expire. deleted is false when there was none.',
+        method: 'DELETE',
+        path: '/v1/tenant/exports/{export_id}',
+        input: z.object({ export_id: EXPORT_ID }).strict(),
+        output: z.object({ deleted: z.boolean() }).strict(),
+        risk: { readOnly: false, destructive: true, idempotent: true },
+        invoke: 'deleteTenantExport',
+        example: { export_id: '0b6c8d1e-4f2a-4c3b-9d5e-7f8a9b0c1d2e' },
+    },
     // Approval policies (RFC 0004 A4): writes a person approves before they are made.
     {
         name: 'slotlock_list_approval_policies',