slotlock 0.6.2 → 0.7.0

package/billing.js

@@ -0,0 +1,258 @@
+// Hosted Slotlock's billing through Stripe: Checkout (with Managed Payments, Stripe as merchant of
+// record) to start a Developer subscription, the customer portal to manage one, and the webhook that
+// keeps a tenant's plan (plans.ts) in step with its subscription. Plain fetch, so it runs on a
+// Worker. Self-hosted Slotlock never uses it.
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { readSlotlockTenantPlan, setSlotlockTenantPlan, } from './plans.js';
+/**
+ * Stripe answered with an error, or did not answer, or (`subscription_exists`) the customer already
+ * pays for a subscription. The message never holds the key.
+ */
+export class SlotlockBillingError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'SlotlockBillingError';
+    }
+}
+/**
+ * The Stripe-Version every request sends unless `apiVersion` says otherwise: Managed Payments needs
+ * 2025-03-31.basil or later and became generally available in this one (docs.stripe.com changelog,
+ * read 2026-11-09). Pinned, so the account's default version never changes what is sent or read.
+ */
+export const SLOTLOCK_STRIPE_API_VERSION = '2026-04-22.dahlia';
+/** Statuses in which a subscription gives its tenant the Developer plan (slotlockPlanOfSubscription). */
+const LIVE = new Set(['active', 'trialing', 'past_due']);
+/** Whether the subscription gives its tenant a plan. */
+export function slotlockSubscriptionIsLive(subscription) {
+    return LIVE.has(subscription.status);
+}
+const STRIPE_ID = /^[A-Za-z0-9_]{1,255}$/;
+/** A tenant reference as Stripe's search may quote it: no quote, backslash or control character. */
+const SEARCHABLE = /^[^'"\\\p{Cc}]{1,500}$/u;
+export function createSlotlockStripe(options) {
+    const base = options.apiBase ?? 'https://api.stripe.com';
+    const send = options.fetch ?? fetch;
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    async function call(method, path, body) {
+        const headers = {
+            authorization: `Bearer ${options.secretKey}`,
+            'stripe-version': options.apiVersion ?? SLOTLOCK_STRIPE_API_VERSION,
+        };
+        if (body)
+            headers['content-type'] = 'application/x-www-form-urlencoded';
+        let response;
+        try {
+            response = await send(`${base}${path}`, {
+                method,
+                headers,
+                ...(body ? { body: body.toString() } : {}),
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+        }
+        catch {
+            throw new SlotlockBillingError('Stripe did not answer');
+        }
+        const parsed = (await response.json().catch(() => null));
+        if (!response.ok || !parsed) {
+            const reason = [parsed?.error?.type, parsed?.error?.code].filter(Boolean).join(': ');
+            throw new SlotlockBillingError(`Stripe refused ${method} ${path.split('?')[0]} (${String(response.status)}${reason ? `, ${reason}` : ''})`, response.status);
+        }
+        return parsed;
+    }
+    async function liveSubscriptionsOfCustomer(customer) {
+        if (!STRIPE_ID.test(customer))
+            throw new SlotlockBillingError('Not a customer id');
+        // Without a status, Stripe lists every subscription that is not canceled.
+        const page = await call('GET', `/v1/subscriptions?${new URLSearchParams({ customer, limit: '100' }).toString()}`);
+        return (page.data ?? []).filter(slotlockSubscriptionIsLive);
+    }
+    return {
+        async checkout({ tenantRef, interval, plan = 'developer', customer, successUrl, cancelUrl }) {
+            if (plan === 'team' && !options.teamPrices)
+                throw new SlotlockBillingError('There is no Team price');
+            const price = plan === 'team' ? options.teamPrices[interval] : options.prices[interval];
+            // A customer who already pays changes the plan in the portal: a second Checkout would charge
+            // twice for one tenant. (A first purchase has no customer yet; the webhook catches that case.)
+            if (customer && (await liveSubscriptionsOfCustomer(customer)).length > 0) {
+                throw new SlotlockBillingError('The customer has a live subscription already', 409, 'subscription_exists');
+            }
+            const form = new URLSearchParams({
+                mode: 'subscription',
+                'line_items[0][price]': price,
+                'line_items[0][quantity]': '1',
+                // A metered price takes no quantity: what the meter reports is billed.
+                ...(plan === 'developer' && options.overagePrice ? { 'line_items[1][price]': options.overagePrice } : {}),
+                'managed_payments[enabled]': 'true',
+                success_url: successUrl,
+                cancel_url: cancelUrl,
+                client_reference_id: tenantRef.replace(/[^A-Za-z0-9_-]/g, '_').slice(0, 200),
+                'metadata[tenant_ref]': tenantRef,
+                'subscription_data[metadata][tenant_ref]': tenantRef,
+            });
+            if (customer)
+                form.set('customer', customer);
+            const session = await call('POST', '/v1/checkout/sessions', form);
+            if (!session.url)
+                throw new SlotlockBillingError('Stripe gave no Checkout URL');
+            return session.url;
+        },
+        async portal({ customer, returnUrl }) {
+            const session = await call('POST', '/v1/billing_portal/sessions', new URLSearchParams({ customer, return_url: returnUrl }));
+            if (!session.url)
+                throw new SlotlockBillingError('Stripe gave no portal URL');
+            return session.url;
+        },
+        async subscription(id) {
+            if (!STRIPE_ID.test(id))
+                throw new SlotlockBillingError('Not a subscription id');
+            return call('GET', `/v1/subscriptions/${id}`);
+        },
+        liveSubscriptionsOfCustomer,
+        planOf: (subscription) => slotlockPlanOfSubscription(subscription, options.teamPrices),
+        async liveSubscriptionsOfTenant(tenantRef) {
+            if (!SEARCHABLE.test(tenantRef))
+                throw new SlotlockBillingError('Not a searchable tenant');
+            const page = await call('GET', `/v1/subscriptions/search?${new URLSearchParams({
+                query: `metadata['tenant_ref']:'${tenantRef}'`,
+                limit: '100',
+            }).toString()}`);
+            return (page.data ?? []).filter((found) => slotlockSubscriptionIsLive(found) && found.metadata?.tenant_ref === tenantRef);
+        },
+    };
+}
+/**
+ * Whether a webhook's body was signed by Stripe with this endpoint's secret
+ * (docs.stripe.com/webhooks#verify-manually): `t=<unix seconds>,v1=<hex HMAC-SHA256 of "t.body">`,
+ * any v1 matching, within `toleranceSeconds` of now.
+ */
+export function verifySlotlockStripeSignature(body, header, secret, nowMs, toleranceSeconds = 300) {
+    if (!header || !secret)
+        return false;
+    let timestamp;
+    const signatures = [];
+    for (const part of header.split(',')) {
+        const at = part.indexOf('=');
+        const key = part.slice(0, at).trim();
+        const value = part.slice(at + 1).trim();
+        if (key === 't' && /^\d{1,12}$/.test(value))
+            timestamp = Number(value);
+        if (key === 'v1' && /^[0-9a-f]{64}$/.test(value))
+            signatures.push(value);
+    }
+    if (timestamp === undefined || signatures.length === 0)
+        return false;
+    if (Math.abs(nowMs / 1000 - timestamp) > toleranceSeconds)
+        return false;
+    const expected = createHmac('sha256', secret).update(`${String(timestamp)}.${body}`).digest();
+    return signatures.some((signature) => timingSafeEqual(Buffer.from(signature, 'hex'), expected));
+}
+/** The plan a subscription gives its tenant. */
+export function slotlockPlanOfSubscription(subscription, teamPrices) {
+    // Team when any item is at a Team price: changed to it in the portal, or bought as it.
+    const team = teamPrices !== undefined &&
+        (subscription.items?.data ?? []).some((item) => {
+            const id = typeof item.price === 'string' ? item.price : item.price?.id;
+            return id === teamPrices.month || id === teamPrices.year;
+        });
+    const paid = team ? 'team' : 'developer';
+    switch (subscription.status) {
+        case 'active':
+        case 'trialing':
+            return { plan: paid, status: 'active' };
+        case 'past_due':
+            // Stripe is retrying the payment: keep the plan while it does.
+            return { plan: paid, status: 'past_due' };
+        default:
+            // canceled, unpaid, incomplete, incomplete_expired, paused: the Free limits.
+            return { plan: 'free', status: 'canceled' };
+    }
+}
+/** The subscription a webhook event is about, if any. */
+function subscriptionOf(event) {
+    const object = event?.data?.object;
+    if (!object)
+        return null;
+    if (object.object === 'subscription' && typeof object.id === 'string')
+        return object.id;
+    const field = object.subscription;
+    if (typeof field === 'string')
+        return field;
+    if (field && typeof field.id === 'string')
+        return field.id;
+    return null;
+}
+/**
+ * Handles one Stripe webhook delivery: checks its signature, then, for any event about a
+ * subscription, reads that subscription from Stripe (not the event, which may be stale or arrive out
+ * of order) and sets its tenant's plan. A tenant that bought twice (two tabs, before either webhook
+ * arrived) keeps Developer until its last live subscription ends, and the second purchase is
+ * reported through `onDuplicate`, by subscription ids only, for a refund. Answers 400 to an unsigned
+ * or unreadable body, 500 when Stripe or the database fails (Stripe retries), and 200 otherwise.
+ */
+export async function handleSlotlockStripeWebhook(request, deps) {
+    const text = (status, body) => new Response(body, { status, headers: { 'content-type': 'text/plain; charset=utf-8' } });
+    if (request.method !== 'POST')
+        return text(405, 'Use POST.');
+    if (Number(request.headers.get('content-length') ?? 0) > 1_000_000)
+        return text(413, 'Too large.');
+    const body = await request.text();
+    if (body.length > 1_000_000)
+        return text(413, 'Too large.');
+    const signed = verifySlotlockStripeSignature(body, request.headers.get('stripe-signature'), deps.secret, (deps.now ?? Date.now)());
+    if (!signed)
+        return text(400, 'Bad signature.');
+    let event;
+    try {
+        event = JSON.parse(body);
+    }
+    catch {
+        return text(400, 'Not JSON.');
+    }
+    const id = subscriptionOf(event);
+    if (!id)
+        return text(200, 'Ignored.');
+    try {
+        const subscription = await deps.stripe.subscription(id);
+        const tenantRef = subscription.metadata?.tenant_ref;
+        // Not one of the dashboard's: nothing to set.
+        if (!tenantRef)
+            return text(200, 'Ignored.');
+        const current = await readSlotlockTenantPlan(deps.sql, tenantRef);
+        const named = current?.stripeSubscription ?? null;
+        let chosen = subscription;
+        if (!slotlockSubscriptionIsLive(subscription)) {
+            // An ended subscription only ends the plan it gave: not one the tenant has started since.
+            if (named && named !== subscription.id)
+                return text(200, 'Ignored.');
+            // Nor one the tenant still pays for under another subscription.
+            const other = (await deps.stripe.liveSubscriptionsOfTenant(tenantRef)).find((found) => found.id !== subscription.id);
+            if (other)
+                chosen = other;
+        }
+        else if (named && named !== subscription.id) {
+            const previous = await deps.stripe.subscription(named).catch(() => null);
+            if (previous && slotlockSubscriptionIsLive(previous))
+                deps.onDuplicate?.([previous.id, subscription.id]);
+        }
+        const { plan, status } = deps.stripe.planOf?.(chosen) ?? slotlockPlanOfSubscription(chosen);
+        const customer = typeof chosen.customer === 'string' ? chosen.customer : chosen.customer.id;
+        const end = chosen.items?.data?.[0]?.current_period_end ?? chosen.current_period_end ?? null;
+        await setSlotlockTenantPlan(deps.sql, {
+            tenantRef,
+            plan,
+            status,
+            stripeCustomer: customer,
+            stripeSubscription: plan === 'free' ? null : chosen.id,
+            currentPeriodEnd: plan === 'free' || !end ? null : new Date(end * 1000),
+        });
+        return text(200, 'Updated.');
+    }
+    catch (error) {
+        deps.onError?.(error);
+        return text(500, 'Try again.');
+    }
+}

package/booking-rules.d.ts

@@ -1,8 +1,7 @@
 import type { Interval, WeeklyAvailabilityRule } from './types.js';
 /**
- * A resource's booking rules: what a booking made through Slotlock (a hold, a reservation, an
- * agent's event) must satisfy, and what a search offers. Each is optional; none set is no rule.
- * Imported calendar events are what happened elsewhere and are not checked.
+ * A resource's booking rules: what a booking made through Slotlock (hold, reservation, agent event)
+ * must satisfy, and what a search offers. All optional. Imported calendar events are not checked.
  */
 export interface SlotlockBookingRules {
     /** A booking starts at least this many minutes after it is made: 0-525,600 (a year). */
@@ -15,35 +14,32 @@ export interface SlotlockBookingRules {
      */
     slotStepMinutes?: number;
     /**
-     * Where the steps fall: this many minutes past each step from local midnight (with a 30-minute
-     * step, 15 starts bookings on :15 and :45): 0 to one less than the step. Without a step it is
-     * kept and does nothing.
+     * Offset of the steps from local midnight (with a 30-minute step, 15 starts bookings on :15 and
+     * :45): 0 to one less than the step. Ignored without a step.
      */
     stepOffsetMinutes?: number;
     /**
-     * Minutes kept free before each booking made under the rule (preparation, travel), as its
-     * leading buffer: the database refuses a booking whose time, or trailing buffer, reaches into
-     * it. 0-1,440. A booking made before the rule, or imported, keeps none.
+     * Minutes kept free before each booking made under the rule, as its leading buffer: 0-1,440.
+     * Bookings made before the rule, or imported, keep none.
      */
     bufferBeforeMinutes?: number;
     /**
-     * Minutes kept free after each booking made under the rule (cleaning, handover, travel), as its
-     * trailing buffer, so the database refuses a booking that would start inside it: 0-1,440. A
-     * booking made before the rule, or imported, keeps the buffer it has.
+     * Minutes kept free after each booking made under the rule, as its trailing buffer: 0-1,440.
+     * Bookings made before the rule, or imported, keep what they have.
      */
     turnaroundMinutes?: number;
     /** A booking lies inside the resource's bookable hours. */
     enforceHours?: boolean;
     /**
-     * A booking is claimed (checked in) within this many minutes of its start, or maintenance
-     * releases it for others (and offers it to the waitlist): 1-1,440. Only bookings made once the
-     * rule is set are released.
+     * A booking must be checked in within this many minutes of its start, or maintenance releases it
+     * (and offers it to the waitlist): 1-1,440. Only bookings made after the rule is set are
+     * released.
      */
     checkInMinutes?: number;
     /**
-     * A booking lies in time every calendar sync recording coverage for the resource has read within
-     * the last day (`recordCalendarCoverage`): time a stale or failing sync leaves unproven is
-     * refused (`uncertain`), not booked over what it may hide. A resource no sync covers is certain.
+     * A booking must lie in time every sync covering the resource read within the last day
+     * (`recordCalendarCoverage`): time a stale or failing sync leaves unproven is refused
+     * (`uncertain`). A resource no sync covers is certain.
      */
     requireCertain?: boolean;
 }
@@ -62,20 +58,18 @@ export declare const SLOTLOCK_BOOKING_RULE_LIMITS: Readonly<{
 /** Booking rules from untrusted input, or a TypeError naming the field that is wrong. */
 export declare function parseBookingRules(value: unknown): SlotlockBookingRules;
 /**
- * The rules that apply to a resource, merged from its own and its pool's and tenant's defaults
- * (each validated when it was set), read leniently: each field is kept when it is valid on its own
- * and dropped (named in `dropped`) when not. No cross-field check: a merge may join a pool's offset
- * to a resource's own shorter step, and the offset then applies modulo the step. A merge never
- * reads as refusing every booking.
+ * The effective rules merged from the resource's own, its pool's and the tenant's (each validated
+ * when set), read leniently: each field is kept if valid alone, else named in `dropped`. A pool's
+ * offset over a resource's shorter step applies modulo the step. A merge never refuses every
+ * booking.
  */
 export declare function parseEffectiveBookingRules(value: unknown): {
     rules: SlotlockBookingRules;
     dropped: string[];
 };
 /**
- * Default booking rules for a tenant or a pool from untrusted input: booking rules without
- * `checkInMinutes`, which only a resource's own rules set (it releases the bookings made after it
- * was set, and that moment is the resource's).
+ * Tenant or pool default rules from untrusted input: no `checkInMinutes`, which only a resource's
+ * own rules set (it applies from the moment it was set on the resource).
  */
 export declare function parseBookingRuleDefaults(value: unknown): SlotlockBookingRules;
 /** The trailing buffer a booking made under the rules keeps: the larger of its own and the rule's. */
@@ -83,15 +77,14 @@ export declare function bookingBufferAfterMs(rules: SlotlockBookingRules | undef
 /** The leading buffer a booking made under the rules keeps. */
 export declare function bookingBufferBeforeMs(rules: SlotlockBookingRules | undefined): number;
 /**
- * The first instant at or after `from` that starts on a step in `timezone`, `offsetMinutes` past
- * each multiple of the step from local midnight (0 to the step less one). A step that does not
- * divide the day starts again at local midnight. Across a clock change it moves forward until the
- * local time is on a step.
+ * The first instant at or after `from` on a step in `timezone`, `offsetMinutes` past each multiple
+ * of the step from local midnight. A step that does not divide the day restarts at local midnight;
+ * across a clock change it moves forward to the next local step.
  */
 export declare function nextStepStart(from: Date, stepMinutes: number, timezone: string, offsetMinutes?: number): Date;
 /**
- * The rule a booking of `interval` made at `now` breaks, or null. `hours` are the resource's
- * bookable hours (its own, or the default), read only when the rules enforce them.
+ * The rule a booking of `interval` made at `now` breaks, or null. `hours` (the resource's own, or
+ * the default) are read only when enforced.
  */
 export declare function bookingRuleBroken(params: {
     rules: SlotlockBookingRules | undefined;
@@ -113,8 +106,7 @@ export interface SlotlockBookingSearch {
 }
 /**
  * How a search honours the rules: the part of `window` a booking made at `now` may start in, the
- * buffers each slot keeps, and how a candidate start moves to a step. `null` when no start in the
- * window is allowed.
+ * buffers each slot keeps, and how a candidate moves to a step. `null` when no start is allowed.
  */
 export declare function bookingSearch(params: {
     rules: SlotlockBookingRules | undefined;
@@ -123,14 +115,11 @@ export declare function bookingSearch(params: {
     now: Date;
     bufferAfterMs?: number;
 }): SlotlockBookingSearch | null;
-/**
- * The time a search must read as free or busy: its window, widened by the buffers a slot in it
- * keeps (before its first start and after its last end).
- */
+/** The time a search must read as free or busy: its window widened by a slot's buffers. */
 export declare function bookingSearchReach(search: SlotlockBookingSearch): Interval;
 /**
- * Busy time as the slot times it rules out. A slot [s, s + d) keeping buffers occupies
- * [s - before, s + d + after), so it meets busy [b, e) exactly when [s, s + d) meets
- * [b - after, e + before): the database refuses the same booking.
+ * Busy time as the slot times it rules out: a slot [s, s + d) with buffers occupies [s - before, s
+ * + d + after), so it meets busy [b, e) exactly when [s, s + d) meets [b - after, e + before), as
+ * the database decides.
  */
 export declare function bookingSearchBlocked(busy: readonly Interval[], search: SlotlockBookingSearch): Interval[];

package/booking-rules.js

@@ -54,11 +54,10 @@ export function parseBookingRules(value) {
     return rules;
 }
 /**
- * The rules that apply to a resource, merged from its own and its pool's and tenant's defaults
- * (each validated when it was set), read leniently: each field is kept when it is valid on its own
- * and dropped (named in `dropped`) when not. No cross-field check: a merge may join a pool's offset
- * to a resource's own shorter step, and the offset then applies modulo the step. A merge never
- * reads as refusing every booking.
+ * The effective rules merged from the resource's own, its pool's and the tenant's (each validated
+ * when set), read leniently: each field is kept if valid alone, else named in `dropped`. A pool's
+ * offset over a resource's shorter step applies modulo the step. A merge never refuses every
+ * booking.
  */
 export function parseEffectiveBookingRules(value) {
     const rules = {};
@@ -88,9 +87,8 @@ export function parseEffectiveBookingRules(value) {
     return { rules, dropped };
 }
 /**
- * Default booking rules for a tenant or a pool from untrusted input: booking rules without
- * `checkInMinutes`, which only a resource's own rules set (it releases the bookings made after it
- * was set, and that moment is the resource's).
+ * Tenant or pool default rules from untrusted input: no `checkInMinutes`, which only a resource's
+ * own rules set (it applies from the moment it was set on the resource).
  */
 export function parseBookingRuleDefaults(value) {
     const rules = parseBookingRules(value);
@@ -123,10 +121,9 @@ function onStep(instant, stepMinutes, timezone, offset = 0) {
     return Number.isInteger(minutes) && minutes >= offset && (minutes - offset) % stepMinutes === 0;
 }
 /**
- * The first instant at or after `from` that starts on a step in `timezone`, `offsetMinutes` past
- * each multiple of the step from local midnight (0 to the step less one). A step that does not
- * divide the day starts again at local midnight. Across a clock change it moves forward until the
- * local time is on a step.
+ * The first instant at or after `from` on a step in `timezone`, `offsetMinutes` past each multiple
+ * of the step from local midnight. A step that does not divide the day restarts at local midnight;
+ * across a clock change it moves forward to the next local step.
  */
 export function nextStepStart(from, stepMinutes, timezone, offsetMinutes = 0) {
     const offset = offsetMinutes % stepMinutes;
@@ -142,8 +139,8 @@ export function nextStepStart(from, stepMinutes, timezone, offsetMinutes = 0) {
     return candidate;
 }
 /**
- * The rule a booking of `interval` made at `now` breaks, or null. `hours` are the resource's
- * bookable hours (its own, or the default), read only when the rules enforce them.
+ * The rule a booking of `interval` made at `now` breaks, or null. `hours` (the resource's own, or
+ * the default) are read only when enforced.
  */
 export function bookingRuleBroken(params) {
     const { rules, interval, now } = params;
@@ -178,8 +175,7 @@ export function bookingRuleBroken(params) {
 }
 /**
  * How a search honours the rules: the part of `window` a booking made at `now` may start in, the
- * buffers each slot keeps, and how a candidate start moves to a step. `null` when no start in the
- * window is allowed.
+ * buffers each slot keeps, and how a candidate moves to a step. `null` when no start is allowed.
  */
 export function bookingSearch(params) {
     const { rules, window, now } = params;
@@ -195,7 +191,6 @@ export function bookingSearch(params) {
     const toStep = step === undefined ? undefined : (from) => nextStepStart(from, step, params.timezone, offset);
     const searched = { start: new Date(start), end: new Date(end) };
     if (rules?.maxAdvanceDays !== undefined) {
-        // The latest allowed start bounds where a slot may start; it may still end after it.
         const latestStart = now.getTime() + rules.maxAdvanceDays * DAY_MINUTES * MINUTE_MS;
         if (latestStart < start || end <= start)
             return null;
@@ -205,7 +200,7 @@ export function bookingSearch(params) {
             bufferBeforeMs,
             align: (from) => {
                 const aligned = toStep ? toStep(from) : from;
-                // Past the latest start, no slot: move it beyond the window so it cannot fit.
+                // Past the latest start: move it beyond the window so it cannot fit.
                 return aligned.getTime() > latestStart ? new Date(end + 1) : aligned;
             },
         };
@@ -216,10 +211,7 @@ export function bookingSearch(params) {
         ? { window: searched, bufferAfterMs, bufferBeforeMs }
         : { window: searched, bufferAfterMs, bufferBeforeMs, align: toStep };
 }
-/**
- * The time a search must read as free or busy: its window, widened by the buffers a slot in it
- * keeps (before its first start and after its last end).
- */
+/** The time a search must read as free or busy: its window widened by a slot's buffers. */
 export function bookingSearchReach(search) {
     return {
         start: new Date(search.window.start.getTime() - search.bufferBeforeMs),
@@ -227,9 +219,9 @@ export function bookingSearchReach(search) {
     };
 }
 /**
- * Busy time as the slot times it rules out. A slot [s, s + d) keeping buffers occupies
- * [s - before, s + d + after), so it meets busy [b, e) exactly when [s, s + d) meets
- * [b - after, e + before): the database refuses the same booking.
+ * Busy time as the slot times it rules out: a slot [s, s + d) with buffers occupies [s - before, s
+ * + d + after), so it meets busy [b, e) exactly when [s, s + d) meets [b - after, e + before), as
+ * the database decides.
  */
 export function bookingSearchBlocked(busy, search) {
     return busy.map((interval) => ({

package/change-watch.d.ts

@@ -45,6 +45,7 @@ export interface SlotlockChangeWatcher {
 export declare const SLOTLOCK_FEED_BUSY_MS = 250;
 /** How often a quiet tenant's feed is read, in ms: the poll backs off to this from the busy rate. */
 export declare const SLOTLOCK_FEED_IDLE_MS = 1000;
+export declare function unref<T>(timer: T): T;
 /**
  * The readers of one server process. `join` adds a watcher to its tenant's reader (starting it) and
  * returns the function that removes it (stopping the reader with its last watcher).

package/change-watch.js

@@ -17,7 +17,7 @@ export const SLOTLOCK_FEED_BUSY_MS = 250;
 export const SLOTLOCK_FEED_IDLE_MS = 1_000;
 /** How often a quiet feed is read while a custom source's `watch` is listening, in ms. */
 const FEED_LISTENING_IDLE_MS = 15_000;
-function unref(timer) {
+export function unref(timer) {
     timer.unref?.();
     return timer;
 }

package/cli.js

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
-// The `slotlock` executable: process wiring only (arguments, environment, output streams, signals
-// and the exit code). The commands and their configuration live in self-host.ts.
+// The `slotlock` executable: process wiring only; the commands live in self-host.ts.
 import { runSlotlockCli } from './self-host.js';
 const shutdown = new AbortController();
 for (const signal of ['SIGINT', 'SIGTERM']) {
@@ -17,6 +16,6 @@ process.exitCode = await runSlotlockCli(process.argv.slice(2), {
     stderr: process.stderr,
     signal: shutdown.signal,
 });
-// Everything is closed by now, so the process ends on its own. Should a stray handle (a socket or
-// timer something else left open) keep it alive, exit anyway rather than hang a container stop.
+// Everything is closed, so the process should end on its own; exit anyway if a stray handle would
+// hang a container stop.
 setTimeout(() => process.exit(), 5_000).unref();

package/config.d.ts

@@ -30,17 +30,38 @@ export interface SlotlockServeDashboardConfig {
     githubClientId: string;
     githubClientSecret: string;
     sessionSecret: string;
-    /** GitHub user ids that may sign in, or `'*'` for every GitHub account. */
+    /** GitHub user ids and Google accounts (`google:<subject>`) that may sign in, or `'*'` for everyone. */
     allowedUsers: '*' | string[];
-    /** GitHub organization ids whose members share a tenant each (SLOTLOCK_DASHBOARD_ORGS). */
-    organizations?: string[];
+    /** Sign-in with Google too (SLOTLOCK_GOOGLE_CLIENT_ID and SLOTLOCK_GOOGLE_CLIENT_SECRET). */
+    google?: {
+        clientId: string;
+        clientSecret: string;
+    };
+    /**
+     * GitHub organization ids whose members share a tenant each (SLOTLOCK_DASHBOARD_ORGS), or
+     * `'enabled'`: those an owner turned on from the dashboard (Teams on Cloud, teams.ts).
+     */
+    organizations?: string[] | 'enabled';
     /** What the deployment is called in the dashboard (SLOTLOCK_DASHBOARD_NAME). */
     name?: string;
+    /**
+     * The terms people accept by signing in (SLOTLOCK_DASHBOARD_TERMS_URL): the sign-in page links
+     * them beside the button. Without it, the page names no terms.
+     */
+    termsUrl?: string;
+    /** What the sign-in page links as the privacy notice (SLOTLOCK_DASHBOARD_PRIVACY_URL). */
+    privacyUrl?: string;
     /**
      * Seals each tenant's model API key for the dashboard assistant (SLOTLOCK_ASSISTANT_SECRET).
      * Without it the assistant is off.
      */
     assistantSecret?: string;
+    /**
+     * Secrets model keys may still be sealed under, newest first (SLOTLOCK_ASSISTANT_PREVIOUS_SECRETS,
+     * comma-separated): each key one opens is sealed again under SLOTLOCK_ASSISTANT_SECRET when next
+     * used.
+     */
+    assistantPreviousSecrets?: string[];
     /**
      * Let the assistant reach a model at a local or private network address
      * (SLOTLOCK_ASSISTANT_PRIVATE_URLS=on): a self-hosted model on the same machine or network.
@@ -48,8 +69,14 @@ export interface SlotlockServeDashboardConfig {
     assistantPrivateUrls?: boolean;
 }
 /**
- * The dashboard's settings, or undefined when none is set. Setting any of them means serving the
- * dashboard, so the rest are then required: a half-configured sign-in is a startup error.
+ * SLOTLOCK_DASHBOARD_USERS: `'*'`, GitHub user ids, or undefined when it is not set. A server whose
+ * dashboard runs elsewhere (a Worker) reads it too, so that removing a person there stops their keys.
+ */
+export declare function readDashboardUsers(env: SlotlockEnv): '*' | string[] | undefined;
+/**
+ * The dashboard's settings, or undefined when none of DASHBOARD_VARIABLES is set. Setting any of
+ * them means serving the dashboard, so the rest, and SLOTLOCK_DASHBOARD_USERS, are then required: a
+ * half-configured sign-in is a startup error.
  */
 export declare function readDashboardConfig(env: SlotlockEnv): SlotlockServeDashboardConfig | undefined;
 /**
@@ -57,7 +84,7 @@ export declare function readDashboardConfig(env: SlotlockEnv): SlotlockServeDash
  * well: a server whose dashboard runs elsewhere (on Cloudflare Workers) still takes those
  * organizations' keys, and only theirs.
  */
-export declare function readDashboardOrganizations(env: SlotlockEnv): string[] | undefined;
+export declare function readDashboardOrganizations(env: SlotlockEnv): string[] | 'enabled' | undefined;
 /** A token bucket: `perSecond` tokens come back each second, and it holds at most `burst`. */
 export interface SlotlockRate {
     perSecond: number;
@@ -154,4 +181,13 @@ export declare function readLimits(env: SlotlockEnv): SlotlockLimits;
  * only when nothing reaches the server except through that proxy.
  */
 export declare function readTrustedProxyHeader(env: SlotlockEnv): string | undefined;
+/** The request field that carries SLOTLOCK_TRUSTED_PROXY_SECRET; not cf-…, which Cloudflare's rules may not set. */
+export declare const SLOTLOCK_TRUSTED_PROXY_PROOF_FIELD = "x-slotlock-proxy-proof";
+/**
+ * SLOTLOCK_TRUSTED_PROXY_SECRET: a value the proxy in front adds to every request in
+ * SLOTLOCK_TRUSTED_PROXY_PROOF_FIELD, such as a Cloudflare transform rule. With it, the trusted
+ * proxy field is believed only beside that value, so a process that reaches the server without
+ * passing the proxy (another container on its network) cannot choose its own client address.
+ */
+export declare function readTrustedProxySecret(env: SlotlockEnv, trustedProxyHeader: string | undefined): string | undefined;
 export {};