slotlock 0.6.2 → 0.7.0

package/assistant.js

@@ -1,27 +1,23 @@
-// The dashboard assistant: an organization connects a model of its own (the Anthropic Messages API,
-// or any OpenAI-compatible chat completions endpoint: OpenAI, OpenRouter, vLLM, Ollama, LM Studio)
-// and its members operate Slotlock by chat. The server runs the tool loop: it calls the model with a
-// fixed list of agent tools, runs reads through the agent operation boundary (schemas, scopes,
-// authorization and limits, as for any agent) and turns every write into an action the member
-// approves on a form before it runs. Nothing the model says changes the list of tools.
+// The dashboard assistant: an organization connects its own model (the Anthropic Messages API, or
+// any OpenAI-compatible chat completions endpoint) and its members operate Slotlock by chat. The
+// server runs the tool loop with a fixed tool list: reads go through the agent operation boundary
+// (schemas, scopes, limits), and every write becomes an action the member approves before it runs.
+// Nothing the model says changes the list of tools.
 //
-// Request formats: the Messages API (POST <base>/v1/messages, x-api-key, anthropic-version; tool_use
-// and tool_result blocks) and Chat Completions (POST <base>/chat/completions, Bearer; tool_calls with
-// JSON-string arguments, role "tool" results), as the vendors' official TypeScript SDKs describe
-// them: @anthropic-ai/sdk 1.3.0 and openai 7.45.1, read from the npm registry 2026-10-28.
+// Request formats as the vendors' official TypeScript SDKs describe them: @anthropic-ai/sdk 1.3.0
+// and openai 7.45.1 (read from the npm registry 2026-10-28).
 //
-// The API key is sealed with AES-256-GCM (WebCrypto, in Node.js and Workers alike) under a key
-// derived by HKDF-SHA-256 from the deployment's SLOTLOCK_ASSISTANT_SECRET, with the tenant as
-// additional data: a sealed key copied to another tenant's row does not open.
+// The API key is sealed with AES-256-GCM (WebCrypto) under a key HKDF-SHA-256-derived from
+// SLOTLOCK_ASSISTANT_SECRET, with the tenant as additional data: a sealed key copied to another
+// tenant's row does not open.
 import { slotlockAgentOperationScope, slotlockAgentTools, } from './agent-server.js';
 import { isIP } from 'node:net';
 import { isPrivateAddress } from './webhooks.js';
 /**
- * The tools the model is offered, by agent operation. A record over every operation, so one a later
- * release adds does not compile until it is placed here. Reads run when the model calls them;
- * every write is only proposed, and runs when the member approves it. API keys, webhooks, booking
- * rules, pools, erasure and coverage are application operations, never agent ones, so no entry can
- * offer them.
+ * The tools the model is offered, by agent operation. A record over every operation, so a new one
+ * does not compile until placed here. Reads run when called; writes are only proposed and run on
+ * approval. API keys, webhooks, booking rules, pools, erasure and coverage are application
+ * operations, never agent ones, so none can be offered.
  */
 export const SLOTLOCK_ASSISTANT_TOOL_USE = Object.freeze({
     slotlock_list_resources: 'read',
@@ -38,6 +34,9 @@ export const SLOTLOCK_ASSISTANT_TOOL_USE = Object.freeze({
     slotlock_create_event: 'propose',
     slotlock_update_event: 'propose',
     slotlock_delete_event: 'propose',
+    slotlock_confirm_slot: 'propose',
+    slotlock_reschedule: 'propose',
+    slotlock_cancel: 'propose',
 });
 for (const [operation, use] of Object.entries(SLOTLOCK_ASSISTANT_TOOL_USE)) {
     // A read the assistant runs freely must be one the agent server calls a read.
@@ -52,15 +51,16 @@ export const SLOTLOCK_ASSISTANT_MAX_MESSAGE = 2_000;
 /** Entries a conversation keeps; the oldest exchanges go first. */
 const MAX_ENTRIES = 60;
 /**
- * UTF-8 bytes of the stored conversation as JSON, past which the oldest exchanges go first.
- * PostgreSQL's jsonb text adds at most one space per `:` or `,`, so at most half again: under the
- * table's 262,144-byte CHECK on `messages::text` whatever the text.
+ * UTF-8 bytes of the stored conversation as JSON. jsonb text adds at most one space per `:` or `,`,
+ * so this stays under the table's 262,144-byte CHECK on `messages::text`.
  */
 export const SLOTLOCK_ASSISTANT_MAX_STORED_BYTES = 160_000;
 /** UTF-8 bytes of the kept actions as JSON: under the 131,072-byte CHECK on `actions::text` as above. */
 const MAX_ACTIONS_BYTES = 80_000;
 /** UTF-8 bytes of one proposed change's arguments as JSON; a larger one is not proposed. */
 export const SLOTLOCK_ASSISTANT_MAX_ACTION_BYTES = 16_000;
+/** Previous secrets a deployment may keep while keys are sealed again under its current one. */
+export const SLOTLOCK_ASSISTANT_MAX_PREVIOUS_SECRETS = 3;
 /** Proposed changes one conversation may have waiting at once (4 of the largest fit the bound). */
 export const SLOTLOCK_ASSISTANT_MAX_PENDING = 4;
 /** Characters of one tool result the model is shown. */
@@ -72,15 +72,10 @@ const MAX_CALLS_PER_STEP = 8;
 /** Bytes of one provider answer. */
 const MAX_RESPONSE_BYTES = 1_048_576;
 const MAX_OUTPUT_TOKENS = 1_024;
-/**
- * The Messages API version this sends: the one @anthropic-ai/sdk 1.3.0 (2026-10-23) sends, read
- * from its source on 2026-10-28. Top-level `system`, `tools[].input_schema`, `tool_use` and
- * `tool_result` blocks are as before in it.
- */
+/** The Messages API version @anthropic-ai/sdk 1.3.0 sends (read from its source 2026-10-28). */
 export const SLOTLOCK_ANTHROPIC_VERSION = '2026-10-21';
 /** The assistant's records in the store, each in a transaction under the tenant's row-level security. */
 export function createSlotlockAssistantStore(store) {
-    // Every change here is the dashboard's, made by the person signed in (actor) when known.
     const by = (actor) => actor === undefined ? { origin: 'dashboard' } : { origin: 'dashboard', actor };
     return {
         getSettings: (tenantRef) => store.withTenant(tenantRef, (tenant) => tenant.getAssistantSettings({ tenantRef })),
@@ -90,8 +85,9 @@ export function createSlotlockAssistantStore(store) {
             ...(actor !== undefined ? { updatedBy: actor } : {}),
         }), by(actor)),
         deleteSettings: (tenantRef, actor) => store.withTenant(tenantRef, (tenant) => tenant.deleteAssistantSettings({ tenantRef }), by(actor)),
-        // Each read deletes the tenant's expired conversations first, so they go on a deployment whose
-        // maintenance never meets the tenant (a Worker's) too.
+        resealKey: (tenantRef, from, to) => store.withTenant(tenantRef, (tenant) => tenant.resealAssistantKey({ tenantRef, from, to }), by(undefined)),
+        // Each read deletes the tenant's expired conversations first, for deployments whose maintenance
+        // never meets the tenant (a Worker's).
         getConversation: (tenantRef, memberRef) => store.withTenant(tenantRef, async (tenant) => {
             await tenant.pruneAssistantConversations({ tenantRef, limit: 100 });
             return tenant.getAssistantConversation({ tenantRef, memberRef });
@@ -143,6 +139,13 @@ export function createSlotlockMemoryAssistantStore(now = Date.now) {
         async deleteSettings(tenantRef) {
             return settings.delete(tenantRef);
         },
+        async resealKey(tenantRef, from, to) {
+            const stored = settings.get(tenantRef);
+            if (!stored || stored.sealedKey !== from || to.length === 0 || to === from)
+                return false;
+            settings.set(tenantRef, { ...stored, sealedKey: to });
+            return true;
+        },
         async getConversation(tenantRef, memberRef) {
             const found = live(tenantRef, memberRef);
             if (!found)
@@ -156,7 +159,7 @@ export function createSlotlockMemoryAssistantStore(now = Date.now) {
         },
         async putConversation(tenantRef, memberRef, conversation, ttlMs) {
             const stored = live(tenantRef, memberRef);
-            // As the store: the stored ones kept as they stand, then the new ones not stored already.
+            // As the store does: stored ones kept as they stand, then new ones not stored already.
             const actions = {};
             for (const id of conversation.keep) {
                 const kept = stored?.actions[id];
@@ -188,7 +191,6 @@ export function createSlotlockMemoryAssistantStore(now = Date.now) {
         },
     };
 }
-// ---- The key, sealed ----
 const SEAL_VERSION = 'v1';
 const encoder = new TextEncoder();
 async function sealingKey(secret) {
@@ -209,6 +211,19 @@ export async function sealSlotlockAssistantKey(secret, tenantRef, apiKey) {
     const sealed = await crypto.subtle.encrypt({ name: 'AES-GCM', iv, additionalData: boundTo(tenantRef) }, await sealingKey(secret), encoder.encode(apiKey));
     return `${SEAL_VERSION}.${Buffer.from(iv).toString('base64url')}.${Buffer.from(sealed).toString('base64url')}`;
 }
+/**
+ * The key a seal holds, tried with each secret in turn (the current one first, then
+ * SLOTLOCK_ASSISTANT_PREVIOUS_SECRETS), and which one opened it: 0 for the current secret. Null when
+ * none of them sealed it for this tenant.
+ */
+export async function openSlotlockAssistantKeyWithAny(secrets, tenantRef, sealed) {
+    for (const [secretIndex, secret] of secrets.entries()) {
+        const apiKey = await openSlotlockAssistantKey(secret, tenantRef, sealed);
+        if (apiKey !== null)
+            return { apiKey, secretIndex };
+    }
+    return null;
+}
 /** The key a seal holds, or null when it is not one this secret sealed for this tenant. */
 export async function openSlotlockAssistantKey(secret, tenantRef, sealed) {
     const [version, iv, body, ...rest] = sealed.split('.');
@@ -226,7 +241,6 @@ export async function openSlotlockAssistantKey(secret, tenantRef, sealed) {
         return null;
     }
 }
-// ---- Settings ----
 const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
 /** Whether a URL's host names this machine or a private network by itself: `localhost`, or an IP literal isPrivateAddress refuses. */
 function namesPrivateHost(url) {
@@ -236,11 +250,10 @@ function namesPrivateHost(url) {
     return isIP(host) !== 0 && isPrivateAddress(host);
 }
 /**
- * A provider base URL as stored: https, or http on localhost or 127.0.0.1 (a model on the server's
- * own machine); no credentials, query or fragment; no trailing slash. Unless `privateUrls`, a URL
- * whose host is `localhost` or a loopback, private, link-local, shared (CGNAT), unique-local or
- * metadata address (the webhooks' isPrivateAddress) is refused as `private`; a name that resolves
- * to one is refused when it is resolved (checkSlotlockAssistantHost, and at each connection).
+ * A provider base URL as stored: https, or http on localhost or 127.0.0.1; no credentials, query,
+ * fragment or trailing slash. Unless `privateUrls`, a host that is `localhost` or a private-range
+ * IP literal is refused as `private`; a name resolving to one is refused when resolved
+ * (checkSlotlockAssistantHost, and at each connection).
  */
 export function readSlotlockAssistantBaseUrl(value, options = {}) {
     let url;
@@ -263,10 +276,9 @@ export function readSlotlockAssistantBaseUrl(value, options = {}) {
     return { ok: true, url: href };
 }
 /**
- * Whether a base URL's host resolves only to public addresses: `resolve` lists them (dns.lookup's,
- * on Node.js). True when `privateUrls`, or when the host is an IP literal readSlotlockAssistantBaseUrl
- * already checked; false when any address is private. A name that does not resolve is not refused
- * here: the connection fails later, plainly.
+ * Whether a base URL's host resolves only to public addresses (`resolve`: dns.lookup on Node.js).
+ * True with `privateUrls` or an IP literal already checked; a name that does not resolve is not
+ * refused here: the connection fails later.
  */
 export async function checkSlotlockAssistantHost(baseUrl, options) {
     if (options.privateUrls === true || !options.resolve)
@@ -316,7 +328,6 @@ export function slotlockAssistantTools() {
         ];
     });
 }
-// ---- Providers ----
 /** Why a provider call failed, in words safe to show (never the key, never the provider's body). */
 export class SlotlockAssistantProviderError extends Error {
     reason;
@@ -473,7 +484,7 @@ function readOpenai(body) {
         catch {
             input = null;
         }
-        // Some local servers leave the id out; one is needed to pair the result.
+        // Some local servers omit the id; one is needed to pair the result.
         const id = typeof call.id === 'string' && call.id !== '' ? call.id : `call_${index}`;
         calls.push({ id, name: call.function.name, input });
     }
@@ -523,7 +534,7 @@ export async function callSlotlockAssistantModel(request) {
             method: 'POST',
             headers,
             body: JSON.stringify(anthropic ? anthropicBody(request) : openaiBody(request)),
-            // A redirect is not followed: it would carry the key elsewhere.
+            // Never follow a redirect: it would carry the key elsewhere.
             redirect: 'manual',
             signal: request.signal,
         });
@@ -562,6 +573,95 @@ export async function callSlotlockAssistantModel(request) {
     const turn = anthropic ? readAnthropic(body) : readOpenai(body);
     return { text: turn.text.slice(0, MAX_MODEL_TEXT), calls: turn.calls };
 }
+/**
+ * Providers the Settings form fills in (RFC 0003 A4): each one's API and the base URL it documents
+ * for it. Custom fills nothing, for any other OpenAI-compatible API. Choosing one saves nothing.
+ */
+export const SLOTLOCK_ASSISTANT_PRESETS = Object.freeze([
+    { id: 'anthropic', name: 'Anthropic', provider: 'anthropic', baseUrl: 'https://api.anthropic.com' },
+    { id: 'openai', name: 'OpenAI', provider: 'openai', baseUrl: 'https://api.openai.com/v1' },
+    { id: 'openrouter', name: 'OpenRouter', provider: 'openai', baseUrl: 'https://openrouter.ai/api/v1' },
+    {
+        id: 'google',
+        name: 'Google',
+        provider: 'openai',
+        baseUrl: 'https://generativelanguage.googleapis.com/v1beta/openai',
+    },
+    { id: 'mistral', name: 'Mistral', provider: 'openai', baseUrl: 'https://api.mistral.ai/v1' },
+    { id: 'groq', name: 'Groq', provider: 'openai', baseUrl: 'https://api.groq.com/openai/v1' },
+    { id: 'together', name: 'Together', provider: 'openai', baseUrl: 'https://api.together.xyz/v1' },
+    { id: 'custom', name: 'Custom', provider: 'openai', baseUrl: '' },
+]);
+/** Models one list keeps: a provider may offer hundreds. */
+const MAX_LISTED_MODELS = 500;
+/**
+ * The models a provider offers (`GET /v1/models` on the Anthropic API, `GET /models` on an
+ * OpenAI-compatible one, listed under `data` or as a bare array), by id, sorted, for the Settings
+ * form's Model field. Throws
+ * SlotlockAssistantProviderError as a model call does, never with the key in its message.
+ */
+export async function listSlotlockAssistantModels(args) {
+    const anthropic = args.provider === 'anthropic';
+    const headers = { accept: 'application/json', 'user-agent': 'slotlock-dashboard-assistant' };
+    if (anthropic) {
+        headers['anthropic-version'] = SLOTLOCK_ANTHROPIC_VERSION;
+        if (args.apiKey)
+            headers['x-api-key'] = args.apiKey;
+    }
+    else if (args.apiKey) {
+        headers.authorization = `Bearer ${args.apiKey}`;
+    }
+    const signal = AbortSignal.timeout(args.timeoutMs);
+    let response;
+    try {
+        response = await args.fetch(anthropic ? `${args.baseUrl}/v1/models?limit=1000` : `${args.baseUrl}/models`, {
+            method: 'GET',
+            headers,
+            // Never follow a redirect: it would carry the key elsewhere.
+            redirect: 'manual',
+            signal,
+        });
+    }
+    catch (error) {
+        const name = error?.name;
+        if (error?.code === 'private_address') {
+            throw new SlotlockAssistantProviderError('private_address');
+        }
+        throw new SlotlockAssistantProviderError(name === 'TimeoutError' || name === 'AbortError' || signal.aborted ? 'timeout' : 'unavailable');
+    }
+    if (!response.ok) {
+        await response.body?.cancel().catch(() => undefined);
+        const status = response.status;
+        throw new SlotlockAssistantProviderError(status === 401 || status === 403
+            ? 'refused_key'
+            : status === 404
+                ? 'not_found'
+                : status === 429
+                    ? 'rate_limited'
+                    : 'unavailable', status);
+    }
+    let body;
+    try {
+        body = JSON.parse(await readBounded(response));
+    }
+    catch (error) {
+        if (error instanceof SlotlockAssistantProviderError)
+            throw error;
+        throw new SlotlockAssistantProviderError(signal.aborted ? 'timeout' : 'bad_answer');
+    }
+    // `{ data: [...] }` as OpenAI and Anthropic answer, or the bare array some OpenAI-compatible
+    // providers (Together) answer instead.
+    const listed = Array.isArray(body) ? body : isRecord(body) && Array.isArray(body.data) ? body.data : null;
+    if (!listed)
+        throw new SlotlockAssistantProviderError('bad_answer');
+    const ids = new Set();
+    for (const entry of listed) {
+        const id = isRecord(entry) ? entry.id : undefined;
+        if (typeof id === 'string' && SLOTLOCK_ASSISTANT_MODEL_NAME.test(id))
+            ids.add(id);
+    }
+    return [...ids].sort().slice(0, MAX_LISTED_MODELS);
+}
 /**
  * The connection test: one request offering one read tool the model must call. True when it
  * answers with exactly one call of that tool with object arguments.
@@ -675,24 +775,22 @@ export async function runSlotlockAssistantTurn(options) {
     return { added };
 }
 /**
- * The conversation within its bounds: at most MAX_ENTRIES entries and MAX_STORED_CHARACTERS, the
- * oldest exchanges dropped whole, so it always starts at a member's message (a tool result is never
- * kept without the call it answers).
+ * The conversation within MAX_ENTRIES and the stored-bytes bound, oldest exchanges dropped whole,
+ * so it always starts at a member's message (a tool result is never kept without its call).
  */
 export function boundSlotlockAssistantEntries(entries) {
-    // PostgreSQL's jsonb holds no NUL character: one would fail the write.
+    // jsonb holds no NUL character: one would fail the write.
     let kept = JSON.parse(JSON.stringify(entries, (_key, value) => typeof value === 'string' ? value.replaceAll('\u0000', '') : value));
     const tooBig = () => kept.length > MAX_ENTRIES ||
         Buffer.byteLength(JSON.stringify(kept), 'utf8') > SLOTLOCK_ASSISTANT_MAX_STORED_BYTES;
-    // The oldest exchanges first, whole.
     while (tooBig()) {
         const next = kept.findIndex((entry, index) => index > 0 && entry.role === 'user');
         if (next === -1)
             break;
         kept = kept.slice(next);
     }
-    // One exchange too big alone: its steps (a call and its results) from the oldest, those that
-    // proposed no change first; the member's message and the last answer stay.
+    // An exchange too big alone loses its steps from the oldest, non-proposing ones first; the
+    // member's message and the last answer stay.
     for (const keepProposals of [true, false]) {
         while (tooBig()) {
             const step = kept.findIndex((entry, index) => entry.role === 'assistant' &&
@@ -711,8 +809,8 @@ export function boundSlotlockAssistantEntries(entries) {
     return tooBig() ? [] : kept;
 }
 /**
- * The actions a conversation keeps: those its kept entries show, the oldest settled ones dropped
- * first past MAX_ACTIONS_BYTES (a waiting one is kept: SLOTLOCK_ASSISTANT_MAX_PENDING bounds them).
+ * The actions a conversation keeps: those its entries show, oldest settled ones dropped first past
+ * MAX_ACTIONS_BYTES (waiting ones are bounded by SLOTLOCK_ASSISTANT_MAX_PENDING).
  */
 export function pruneSlotlockAssistantActions(entries, actions) {
     const shown = [];

package/billing.d.ts

@@ -0,0 +1,114 @@
+import { type SlotlockPlan, type SlotlockPlanStatus } from './plans.js';
+import type { SlotlockSql } from './store.js';
+export type SlotlockBillingInterval = 'month' | 'year';
+/**
+ * Stripe answered with an error, or did not answer, or (`subscription_exists`) the customer already
+ * pays for a subscription. The message never holds the key.
+ */
+export declare class SlotlockBillingError extends Error {
+    readonly status?: number | undefined;
+    readonly code?: 'subscription_exists' | undefined;
+    constructor(message: string, status?: number | undefined, code?: 'subscription_exists' | undefined);
+}
+/**
+ * The Stripe-Version every request sends unless `apiVersion` says otherwise: Managed Payments needs
+ * 2025-03-31.basil or later and became generally available in this one (docs.stripe.com changelog,
+ * read 2026-11-09). Pinned, so the account's default version never changes what is sent or read.
+ */
+export declare const SLOTLOCK_STRIPE_API_VERSION = "2026-04-22.dahlia";
+export interface SlotlockStripeOptions {
+    /** A restricted key: write on Checkout Sessions and portal sessions, read on Subscriptions. */
+    secretKey: string;
+    /** The Developer plan's price ids, monthly and yearly. */
+    prices: Readonly<Record<SlotlockBillingInterval, string>>;
+    /** The Team plan's price ids, monthly and yearly (Teams on Cloud): an organization's checkout. */
+    teamPrices?: Readonly<Record<SlotlockBillingInterval, string>>;
+    /**
+     * Metered overage (overage.ts, SLOTLOCK_OVERAGE): a metered price on a Billing Meter, added to a
+     * Developer checkout so operations above the quota can be billed. Off without it.
+     */
+    overagePrice?: string;
+    /** Sent as Stripe-Version; SLOTLOCK_STRIPE_API_VERSION when unset. */
+    apiVersion?: string;
+    apiBase?: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}
+/** The parts of a Stripe subscription the plan is read from. */
+export interface SlotlockStripeSubscription {
+    id: string;
+    status: string;
+    customer: string | {
+        id: string;
+    };
+    metadata?: Record<string, string>;
+    current_period_end?: number | null;
+    items?: {
+        data?: Array<{
+            current_period_end?: number | null;
+            price?: {
+                id?: string;
+            } | string | null;
+        }>;
+    };
+}
+export interface SlotlockStripe {
+    /** A Checkout URL for a Developer (or, with team prices, Team) subscription, tagged with the tenant. */
+    checkout(input: {
+        tenantRef: string;
+        interval: SlotlockBillingInterval;
+        /** Developer unless `team`, which needs the Team prices. */
+        plan?: 'developer' | 'team';
+        customer: string | null;
+        successUrl: string;
+        cancelUrl: string;
+    }): Promise<string>;
+    /** A customer portal URL, to change or cancel the subscription and see invoices. */
+    portal(input: {
+        customer: string;
+        returnUrl: string;
+    }): Promise<string>;
+    subscription(id: string): Promise<SlotlockStripeSubscription>;
+    /** The customer's subscriptions that give a plan (`active`, `trialing`, `past_due`). */
+    liveSubscriptionsOfCustomer(customer: string): Promise<SlotlockStripeSubscription[]>;
+    /**
+     * The tenant's subscriptions that give a plan, found by their `tenant_ref` metadata under any
+     * customer (Stripe's search, which can lag a minute behind a subscription just created).
+     */
+    liveSubscriptionsOfTenant(tenantRef: string): Promise<SlotlockStripeSubscription[]>;
+    /** The plan a subscription gives, by its price: Team for a Team price, else Developer. */
+    planOf?(subscription: SlotlockStripeSubscription): {
+        plan: SlotlockPlan;
+        status: SlotlockPlanStatus;
+    };
+}
+/** Whether the subscription gives its tenant a plan. */
+export declare function slotlockSubscriptionIsLive(subscription: SlotlockStripeSubscription): boolean;
+export declare function createSlotlockStripe(options: SlotlockStripeOptions): SlotlockStripe;
+/**
+ * Whether a webhook's body was signed by Stripe with this endpoint's secret
+ * (docs.stripe.com/webhooks#verify-manually): `t=<unix seconds>,v1=<hex HMAC-SHA256 of "t.body">`,
+ * any v1 matching, within `toleranceSeconds` of now.
+ */
+export declare function verifySlotlockStripeSignature(body: string, header: string | null, secret: string, nowMs: number, toleranceSeconds?: number): boolean;
+/** The plan a subscription gives its tenant. */
+export declare function slotlockPlanOfSubscription(subscription: SlotlockStripeSubscription, teamPrices?: Readonly<Record<SlotlockBillingInterval, string>>): {
+    plan: SlotlockPlan;
+    status: SlotlockPlanStatus;
+};
+/**
+ * Handles one Stripe webhook delivery: checks its signature, then, for any event about a
+ * subscription, reads that subscription from Stripe (not the event, which may be stale or arrive out
+ * of order) and sets its tenant's plan. A tenant that bought twice (two tabs, before either webhook
+ * arrived) keeps Developer until its last live subscription ends, and the second purchase is
+ * reported through `onDuplicate`, by subscription ids only, for a refund. Answers 400 to an unsigned
+ * or unreadable body, 500 when Stripe or the database fails (Stripe retries), and 200 otherwise.
+ */
+export declare function handleSlotlockStripeWebhook(request: Request, deps: {
+    secret: string;
+    stripe: SlotlockStripe;
+    sql: SlotlockSql;
+    now?: () => number;
+    onError?: (error: unknown) => void;
+    onDuplicate?: (subscriptionIds: readonly string[]) => void;
+}): Promise<Response>;