slotlock 0.6.3 → 0.8.0

package/billing.d.ts

@@ -0,0 +1,114 @@
+import { type SlotlockPlan, type SlotlockPlanStatus } from './plans.js';
+import type { SlotlockSql } from './store.js';
+export type SlotlockBillingInterval = 'month' | 'year';
+/**
+ * Stripe answered with an error, or did not answer, or (`subscription_exists`) the customer already
+ * pays for a subscription. The message never holds the key.
+ */
+export declare class SlotlockBillingError extends Error {
+    readonly status?: number | undefined;
+    readonly code?: 'subscription_exists' | undefined;
+    constructor(message: string, status?: number | undefined, code?: 'subscription_exists' | undefined);
+}
+/**
+ * The Stripe-Version every request sends unless `apiVersion` says otherwise: Managed Payments needs
+ * 2025-03-31.basil or later and became generally available in this one (docs.stripe.com changelog,
+ * read 2026-11-09). Pinned, so the account's default version never changes what is sent or read.
+ */
+export declare const SLOTLOCK_STRIPE_API_VERSION = "2026-04-22.dahlia";
+export interface SlotlockStripeOptions {
+    /** A restricted key: write on Checkout Sessions and portal sessions, read on Subscriptions. */
+    secretKey: string;
+    /** The Developer plan's price ids, monthly and yearly. */
+    prices: Readonly<Record<SlotlockBillingInterval, string>>;
+    /** The Team plan's price ids, monthly and yearly (Teams on Cloud): an organization's checkout. */
+    teamPrices?: Readonly<Record<SlotlockBillingInterval, string>>;
+    /**
+     * Metered overage (overage.ts, SLOTLOCK_OVERAGE): a metered price on a Billing Meter, added to a
+     * Developer checkout so operations above the quota can be billed. Off without it.
+     */
+    overagePrice?: string;
+    /** Sent as Stripe-Version; SLOTLOCK_STRIPE_API_VERSION when unset. */
+    apiVersion?: string;
+    apiBase?: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}
+/** The parts of a Stripe subscription the plan is read from. */
+export interface SlotlockStripeSubscription {
+    id: string;
+    status: string;
+    customer: string | {
+        id: string;
+    };
+    metadata?: Record<string, string>;
+    current_period_end?: number | null;
+    items?: {
+        data?: Array<{
+            current_period_end?: number | null;
+            price?: {
+                id?: string;
+            } | string | null;
+        }>;
+    };
+}
+export interface SlotlockStripe {
+    /** A Checkout URL for a Developer (or, with team prices, Team) subscription, tagged with the tenant. */
+    checkout(input: {
+        tenantRef: string;
+        interval: SlotlockBillingInterval;
+        /** Developer unless `team`, which needs the Team prices. */
+        plan?: 'developer' | 'team';
+        customer: string | null;
+        successUrl: string;
+        cancelUrl: string;
+    }): Promise<string>;
+    /** A customer portal URL, to change or cancel the subscription and see invoices. */
+    portal(input: {
+        customer: string;
+        returnUrl: string;
+    }): Promise<string>;
+    subscription(id: string): Promise<SlotlockStripeSubscription>;
+    /** The customer's subscriptions that give a plan (`active`, `trialing`, `past_due`). */
+    liveSubscriptionsOfCustomer(customer: string): Promise<SlotlockStripeSubscription[]>;
+    /**
+     * The tenant's subscriptions that give a plan, found by their `tenant_ref` metadata under any
+     * customer (Stripe's search, which can lag a minute behind a subscription just created).
+     */
+    liveSubscriptionsOfTenant(tenantRef: string): Promise<SlotlockStripeSubscription[]>;
+    /** The plan a subscription gives, by its price: Team for a Team price, else Developer. */
+    planOf?(subscription: SlotlockStripeSubscription): {
+        plan: SlotlockPlan;
+        status: SlotlockPlanStatus;
+    };
+}
+/** Whether the subscription gives its tenant a plan. */
+export declare function slotlockSubscriptionIsLive(subscription: SlotlockStripeSubscription): boolean;
+export declare function createSlotlockStripe(options: SlotlockStripeOptions): SlotlockStripe;
+/**
+ * Whether a webhook's body was signed by Stripe with this endpoint's secret
+ * (docs.stripe.com/webhooks#verify-manually): `t=<unix seconds>,v1=<hex HMAC-SHA256 of "t.body">`,
+ * any v1 matching, within `toleranceSeconds` of now.
+ */
+export declare function verifySlotlockStripeSignature(body: string, header: string | null, secret: string, nowMs: number, toleranceSeconds?: number): boolean;
+/** The plan a subscription gives its tenant. */
+export declare function slotlockPlanOfSubscription(subscription: SlotlockStripeSubscription, teamPrices?: Readonly<Record<SlotlockBillingInterval, string>>): {
+    plan: SlotlockPlan;
+    status: SlotlockPlanStatus;
+};
+/**
+ * Handles one Stripe webhook delivery: checks its signature, then, for any event about a
+ * subscription, reads that subscription from Stripe (not the event, which may be stale or arrive out
+ * of order) and sets its tenant's plan. A tenant that bought twice (two tabs, before either webhook
+ * arrived) keeps Developer until its last live subscription ends, and the second purchase is
+ * reported through `onDuplicate`, by subscription ids only, for a refund. Answers 400 to an unsigned
+ * or unreadable body, 500 when Stripe or the database fails (Stripe retries), and 200 otherwise.
+ */
+export declare function handleSlotlockStripeWebhook(request: Request, deps: {
+    secret: string;
+    stripe: SlotlockStripe;
+    sql: SlotlockSql;
+    now?: () => number;
+    onError?: (error: unknown) => void;
+    onDuplicate?: (subscriptionIds: readonly string[]) => void;
+}): Promise<Response>;

package/billing.js

@@ -0,0 +1,258 @@
+// Hosted Slotlock's billing through Stripe: Checkout (with Managed Payments, Stripe as merchant of
+// record) to start a Developer subscription, the customer portal to manage one, and the webhook that
+// keeps a tenant's plan (plans.ts) in step with its subscription. Plain fetch, so it runs on a
+// Worker. Self-hosted Slotlock never uses it.
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { readSlotlockTenantPlan, setSlotlockTenantPlan, } from './plans.js';
+/**
+ * Stripe answered with an error, or did not answer, or (`subscription_exists`) the customer already
+ * pays for a subscription. The message never holds the key.
+ */
+export class SlotlockBillingError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'SlotlockBillingError';
+    }
+}
+/**
+ * The Stripe-Version every request sends unless `apiVersion` says otherwise: Managed Payments needs
+ * 2025-03-31.basil or later and became generally available in this one (docs.stripe.com changelog,
+ * read 2026-11-09). Pinned, so the account's default version never changes what is sent or read.
+ */
+export const SLOTLOCK_STRIPE_API_VERSION = '2026-04-22.dahlia';
+/** Statuses in which a subscription gives its tenant the Developer plan (slotlockPlanOfSubscription). */
+const LIVE = new Set(['active', 'trialing', 'past_due']);
+/** Whether the subscription gives its tenant a plan. */
+export function slotlockSubscriptionIsLive(subscription) {
+    return LIVE.has(subscription.status);
+}
+const STRIPE_ID = /^[A-Za-z0-9_]{1,255}$/;
+/** A tenant reference as Stripe's search may quote it: no quote, backslash or control character. */
+const SEARCHABLE = /^[^'"\\\p{Cc}]{1,500}$/u;
+export function createSlotlockStripe(options) {
+    const base = options.apiBase ?? 'https://api.stripe.com';
+    const send = options.fetch ?? fetch;
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    async function call(method, path, body) {
+        const headers = {
+            authorization: `Bearer ${options.secretKey}`,
+            'stripe-version': options.apiVersion ?? SLOTLOCK_STRIPE_API_VERSION,
+        };
+        if (body)
+            headers['content-type'] = 'application/x-www-form-urlencoded';
+        let response;
+        try {
+            response = await send(`${base}${path}`, {
+                method,
+                headers,
+                ...(body ? { body: body.toString() } : {}),
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+        }
+        catch {
+            throw new SlotlockBillingError('Stripe did not answer');
+        }
+        const parsed = (await response.json().catch(() => null));
+        if (!response.ok || !parsed) {
+            const reason = [parsed?.error?.type, parsed?.error?.code].filter(Boolean).join(': ');
+            throw new SlotlockBillingError(`Stripe refused ${method} ${path.split('?')[0]} (${String(response.status)}${reason ? `, ${reason}` : ''})`, response.status);
+        }
+        return parsed;
+    }
+    async function liveSubscriptionsOfCustomer(customer) {
+        if (!STRIPE_ID.test(customer))
+            throw new SlotlockBillingError('Not a customer id');
+        // Without a status, Stripe lists every subscription that is not canceled.
+        const page = await call('GET', `/v1/subscriptions?${new URLSearchParams({ customer, limit: '100' }).toString()}`);
+        return (page.data ?? []).filter(slotlockSubscriptionIsLive);
+    }
+    return {
+        async checkout({ tenantRef, interval, plan = 'developer', customer, successUrl, cancelUrl }) {
+            if (plan === 'team' && !options.teamPrices)
+                throw new SlotlockBillingError('There is no Team price');
+            const price = plan === 'team' ? options.teamPrices[interval] : options.prices[interval];
+            // A customer who already pays changes the plan in the portal: a second Checkout would charge
+            // twice for one tenant. (A first purchase has no customer yet; the webhook catches that case.)
+            if (customer && (await liveSubscriptionsOfCustomer(customer)).length > 0) {
+                throw new SlotlockBillingError('The customer has a live subscription already', 409, 'subscription_exists');
+            }
+            const form = new URLSearchParams({
+                mode: 'subscription',
+                'line_items[0][price]': price,
+                'line_items[0][quantity]': '1',
+                // A metered price takes no quantity: what the meter reports is billed.
+                ...(plan === 'developer' && options.overagePrice ? { 'line_items[1][price]': options.overagePrice } : {}),
+                'managed_payments[enabled]': 'true',
+                success_url: successUrl,
+                cancel_url: cancelUrl,
+                client_reference_id: tenantRef.replace(/[^A-Za-z0-9_-]/g, '_').slice(0, 200),
+                'metadata[tenant_ref]': tenantRef,
+                'subscription_data[metadata][tenant_ref]': tenantRef,
+            });
+            if (customer)
+                form.set('customer', customer);
+            const session = await call('POST', '/v1/checkout/sessions', form);
+            if (!session.url)
+                throw new SlotlockBillingError('Stripe gave no Checkout URL');
+            return session.url;
+        },
+        async portal({ customer, returnUrl }) {
+            const session = await call('POST', '/v1/billing_portal/sessions', new URLSearchParams({ customer, return_url: returnUrl }));
+            if (!session.url)
+                throw new SlotlockBillingError('Stripe gave no portal URL');
+            return session.url;
+        },
+        async subscription(id) {
+            if (!STRIPE_ID.test(id))
+                throw new SlotlockBillingError('Not a subscription id');
+            return call('GET', `/v1/subscriptions/${id}`);
+        },
+        liveSubscriptionsOfCustomer,
+        planOf: (subscription) => slotlockPlanOfSubscription(subscription, options.teamPrices),
+        async liveSubscriptionsOfTenant(tenantRef) {
+            if (!SEARCHABLE.test(tenantRef))
+                throw new SlotlockBillingError('Not a searchable tenant');
+            const page = await call('GET', `/v1/subscriptions/search?${new URLSearchParams({
+                query: `metadata['tenant_ref']:'${tenantRef}'`,
+                limit: '100',
+            }).toString()}`);
+            return (page.data ?? []).filter((found) => slotlockSubscriptionIsLive(found) && found.metadata?.tenant_ref === tenantRef);
+        },
+    };
+}
+/**
+ * Whether a webhook's body was signed by Stripe with this endpoint's secret
+ * (docs.stripe.com/webhooks#verify-manually): `t=<unix seconds>,v1=<hex HMAC-SHA256 of "t.body">`,
+ * any v1 matching, within `toleranceSeconds` of now.
+ */
+export function verifySlotlockStripeSignature(body, header, secret, nowMs, toleranceSeconds = 300) {
+    if (!header || !secret)
+        return false;
+    let timestamp;
+    const signatures = [];
+    for (const part of header.split(',')) {
+        const at = part.indexOf('=');
+        const key = part.slice(0, at).trim();
+        const value = part.slice(at + 1).trim();
+        if (key === 't' && /^\d{1,12}$/.test(value))
+            timestamp = Number(value);
+        if (key === 'v1' && /^[0-9a-f]{64}$/.test(value))
+            signatures.push(value);
+    }
+    if (timestamp === undefined || signatures.length === 0)
+        return false;
+    if (Math.abs(nowMs / 1000 - timestamp) > toleranceSeconds)
+        return false;
+    const expected = createHmac('sha256', secret).update(`${String(timestamp)}.${body}`).digest();
+    return signatures.some((signature) => timingSafeEqual(Buffer.from(signature, 'hex'), expected));
+}
+/** The plan a subscription gives its tenant. */
+export function slotlockPlanOfSubscription(subscription, teamPrices) {
+    // Team when any item is at a Team price: changed to it in the portal, or bought as it.
+    const team = teamPrices !== undefined &&
+        (subscription.items?.data ?? []).some((item) => {
+            const id = typeof item.price === 'string' ? item.price : item.price?.id;
+            return id === teamPrices.month || id === teamPrices.year;
+        });
+    const paid = team ? 'team' : 'developer';
+    switch (subscription.status) {
+        case 'active':
+        case 'trialing':
+            return { plan: paid, status: 'active' };
+        case 'past_due':
+            // Stripe is retrying the payment: keep the plan while it does.
+            return { plan: paid, status: 'past_due' };
+        default:
+            // canceled, unpaid, incomplete, incomplete_expired, paused: the Free limits.
+            return { plan: 'free', status: 'canceled' };
+    }
+}
+/** The subscription a webhook event is about, if any. */
+function subscriptionOf(event) {
+    const object = event?.data?.object;
+    if (!object)
+        return null;
+    if (object.object === 'subscription' && typeof object.id === 'string')
+        return object.id;
+    const field = object.subscription;
+    if (typeof field === 'string')
+        return field;
+    if (field && typeof field.id === 'string')
+        return field.id;
+    return null;
+}
+/**
+ * Handles one Stripe webhook delivery: checks its signature, then, for any event about a
+ * subscription, reads that subscription from Stripe (not the event, which may be stale or arrive out
+ * of order) and sets its tenant's plan. A tenant that bought twice (two tabs, before either webhook
+ * arrived) keeps Developer until its last live subscription ends, and the second purchase is
+ * reported through `onDuplicate`, by subscription ids only, for a refund. Answers 400 to an unsigned
+ * or unreadable body, 500 when Stripe or the database fails (Stripe retries), and 200 otherwise.
+ */
+export async function handleSlotlockStripeWebhook(request, deps) {
+    const text = (status, body) => new Response(body, { status, headers: { 'content-type': 'text/plain; charset=utf-8' } });
+    if (request.method !== 'POST')
+        return text(405, 'Use POST.');
+    if (Number(request.headers.get('content-length') ?? 0) > 1_000_000)
+        return text(413, 'Too large.');
+    const body = await request.text();
+    if (body.length > 1_000_000)
+        return text(413, 'Too large.');
+    const signed = verifySlotlockStripeSignature(body, request.headers.get('stripe-signature'), deps.secret, (deps.now ?? Date.now)());
+    if (!signed)
+        return text(400, 'Bad signature.');
+    let event;
+    try {
+        event = JSON.parse(body);
+    }
+    catch {
+        return text(400, 'Not JSON.');
+    }
+    const id = subscriptionOf(event);
+    if (!id)
+        return text(200, 'Ignored.');
+    try {
+        const subscription = await deps.stripe.subscription(id);
+        const tenantRef = subscription.metadata?.tenant_ref;
+        // Not one of the dashboard's: nothing to set.
+        if (!tenantRef)
+            return text(200, 'Ignored.');
+        const current = await readSlotlockTenantPlan(deps.sql, tenantRef);
+        const named = current?.stripeSubscription ?? null;
+        let chosen = subscription;
+        if (!slotlockSubscriptionIsLive(subscription)) {
+            // An ended subscription only ends the plan it gave: not one the tenant has started since.
+            if (named && named !== subscription.id)
+                return text(200, 'Ignored.');
+            // Nor one the tenant still pays for under another subscription.
+            const other = (await deps.stripe.liveSubscriptionsOfTenant(tenantRef)).find((found) => found.id !== subscription.id);
+            if (other)
+                chosen = other;
+        }
+        else if (named && named !== subscription.id) {
+            const previous = await deps.stripe.subscription(named).catch(() => null);
+            if (previous && slotlockSubscriptionIsLive(previous))
+                deps.onDuplicate?.([previous.id, subscription.id]);
+        }
+        const { plan, status } = deps.stripe.planOf?.(chosen) ?? slotlockPlanOfSubscription(chosen);
+        const customer = typeof chosen.customer === 'string' ? chosen.customer : chosen.customer.id;
+        const end = chosen.items?.data?.[0]?.current_period_end ?? chosen.current_period_end ?? null;
+        await setSlotlockTenantPlan(deps.sql, {
+            tenantRef,
+            plan,
+            status,
+            stripeCustomer: customer,
+            stripeSubscription: plan === 'free' ? null : chosen.id,
+            currentPeriodEnd: plan === 'free' || !end ? null : new Date(end * 1000),
+        });
+        return text(200, 'Updated.');
+    }
+    catch (error) {
+        deps.onError?.(error);
+        return text(500, 'Try again.');
+    }
+}

package/config.d.ts

@@ -30,17 +30,38 @@ export interface SlotlockServeDashboardConfig {
     githubClientId: string;
     githubClientSecret: string;
     sessionSecret: string;
-    /** GitHub user ids that may sign in, or `'*'` for every GitHub account. */
+    /** GitHub user ids and Google accounts (`google:<subject>`) that may sign in, or `'*'` for everyone. */
     allowedUsers: '*' | string[];
-    /** GitHub organization ids whose members share a tenant each (SLOTLOCK_DASHBOARD_ORGS). */
-    organizations?: string[];
+    /** Sign-in with Google too (SLOTLOCK_GOOGLE_CLIENT_ID and SLOTLOCK_GOOGLE_CLIENT_SECRET). */
+    google?: {
+        clientId: string;
+        clientSecret: string;
+    };
+    /**
+     * GitHub organization ids whose members share a tenant each (SLOTLOCK_DASHBOARD_ORGS), or
+     * `'enabled'`: those an owner turned on from the dashboard (Teams on Cloud, teams.ts).
+     */
+    organizations?: string[] | 'enabled';
     /** What the deployment is called in the dashboard (SLOTLOCK_DASHBOARD_NAME). */
     name?: string;
+    /**
+     * The terms people accept by signing in (SLOTLOCK_DASHBOARD_TERMS_URL): the sign-in page links
+     * them beside the button. Without it, the page names no terms.
+     */
+    termsUrl?: string;
+    /** What the sign-in page links as the privacy notice (SLOTLOCK_DASHBOARD_PRIVACY_URL). */
+    privacyUrl?: string;
     /**
      * Seals each tenant's model API key for the dashboard assistant (SLOTLOCK_ASSISTANT_SECRET).
      * Without it the assistant is off.
      */
     assistantSecret?: string;
+    /**
+     * Secrets model keys may still be sealed under, newest first (SLOTLOCK_ASSISTANT_PREVIOUS_SECRETS,
+     * comma-separated): each key one opens is sealed again under SLOTLOCK_ASSISTANT_SECRET when next
+     * used.
+     */
+    assistantPreviousSecrets?: string[];
     /**
      * Let the assistant reach a model at a local or private network address
      * (SLOTLOCK_ASSISTANT_PRIVATE_URLS=on): a self-hosted model on the same machine or network.
@@ -63,7 +84,7 @@ export declare function readDashboardConfig(env: SlotlockEnv): SlotlockServeDash
  * well: a server whose dashboard runs elsewhere (on Cloudflare Workers) still takes those
  * organizations' keys, and only theirs.
  */
-export declare function readDashboardOrganizations(env: SlotlockEnv): string[] | undefined;
+export declare function readDashboardOrganizations(env: SlotlockEnv): string[] | 'enabled' | undefined;
 /** A token bucket: `perSecond` tokens come back each second, and it holds at most `burst`. */
 export interface SlotlockRate {
     perSecond: number;

package/config.js

@@ -114,8 +114,9 @@ export function readDashboardUsers(env) {
     const users = optional(env, 'SLOTLOCK_DASHBOARD_USERS')?.replaceAll(' ', '');
     if (users === undefined)
         return undefined;
-    if (users !== '*' && !/^[1-9]\d{0,19}(,[1-9]\d{0,19})*$/.test(users)) {
-        throw new SlotlockConfigError('SLOTLOCK_DASHBOARD_USERS must be * for every GitHub account, or a comma-separated list of GitHub user ids (gh api users/<login> --jq .id)');
+    const person = '(?:[1-9]\\d{0,19}|google:[A-Za-z0-9._-]{1,255})';
+    if (users !== '*' && !new RegExp(`^${person}(,${person})*$`).test(users)) {
+        throw new SlotlockConfigError('SLOTLOCK_DASHBOARD_USERS must be * for every account, or a comma-separated list of GitHub user ids (gh api users/<login> --jq .id) and Google accounts as google:<subject>');
     }
     return users === '*' ? '*' : [...new Set(users.split(','))];
 }
@@ -135,6 +136,14 @@ export function readDashboardConfig(env) {
     if (githubClientSecret === undefined) {
         throw new SlotlockConfigError('SLOTLOCK_GITHUB_CLIENT_SECRET is required to serve the dashboard: a client secret of that GitHub OAuth app');
     }
+    const googleClientId = optional(env, 'SLOTLOCK_GOOGLE_CLIENT_ID');
+    const googleClientSecret = readSecret(env, 'SLOTLOCK_GOOGLE_CLIENT_SECRET');
+    if ((googleClientId === undefined) !== (googleClientSecret === undefined)) {
+        throw new SlotlockConfigError('SLOTLOCK_GOOGLE_CLIENT_ID and SLOTLOCK_GOOGLE_CLIENT_SECRET go together: an OAuth client of a Google Cloud project whose redirect URI is <SLOTLOCK_PUBLIC_URL>/dashboard/callback');
+    }
+    if (googleClientId !== undefined && !/^[A-Za-z0-9._-]{1,200}$/.test(googleClientId)) {
+        throw new SlotlockConfigError('SLOTLOCK_GOOGLE_CLIENT_ID must be a Google OAuth client id');
+    }
     const sessionSecret = readSecret(env, 'SLOTLOCK_SESSION_SECRET');
     if (sessionSecret === undefined) {
         throw new SlotlockConfigError(`SLOTLOCK_SESSION_SECRET is required to serve the dashboard: it signs sign-in sessions; ${SECRET_HINT}`);
@@ -143,6 +152,7 @@ export function readDashboardConfig(env) {
         env.SLOTLOCK_GITHUB_CLIENT_SECRET,
         env.SLOTLOCK_AUTH_TOKEN,
         env.SLOTLOCK_CONFIRMATION_SECRET,
+        ...(googleClientSecret !== undefined ? [googleClientSecret] : []),
     ];
     if (others.includes(sessionSecret)) {
         throw new SlotlockConfigError('SLOTLOCK_SESSION_SECRET must differ from every other secret');
@@ -162,26 +172,83 @@ export function readDashboardConfig(env) {
         [sessionSecret, ...others].includes(assistantSecret)) {
         throw new SlotlockConfigError('SLOTLOCK_ASSISTANT_SECRET must differ from every other secret');
     }
+    const previousSecrets = readAssistantPreviousSecrets(env, assistantSecret, [sessionSecret, ...others]);
     const privateUrls = optional(env, 'SLOTLOCK_ASSISTANT_PRIVATE_URLS') ?? 'off';
     if (privateUrls !== 'on' && privateUrls !== 'off') {
         throw new SlotlockConfigError('SLOTLOCK_ASSISTANT_PRIVATE_URLS must be on or off');
     }
     const orgs = readDashboardOrganizations(env);
+    if (Array.isArray(orgs) && googleClientId !== undefined) {
+        throw new SlotlockConfigError('SLOTLOCK_GOOGLE_CLIENT_ID does not go with a list of SLOTLOCK_DASHBOARD_ORGS: those organizations are GitHub\'s; use SLOTLOCK_DASHBOARD_ORGS=enabled to have both');
+    }
     const name = optional(env, 'SLOTLOCK_DASHBOARD_NAME')?.trim();
     if (name !== undefined && name !== '' && !SLOTLOCK_DASHBOARD_NAME_PATTERN.test(name)) {
         throw new SlotlockConfigError('SLOTLOCK_DASHBOARD_NAME must be 1-60 characters, without <, > or control or invisible characters');
     }
+    const termsUrl = readPolicyUrl(env, 'SLOTLOCK_DASHBOARD_TERMS_URL');
+    const privacyUrl = readPolicyUrl(env, 'SLOTLOCK_DASHBOARD_PRIVACY_URL');
     return {
         githubClientId,
         githubClientSecret,
         sessionSecret,
         allowedUsers: users,
+        ...(googleClientId !== undefined && googleClientSecret !== undefined
+            ? { google: { clientId: googleClientId, clientSecret: googleClientSecret } }
+            : {}),
         ...(orgs !== undefined ? { organizations: orgs } : {}),
         ...(name !== undefined && name !== '' ? { name } : {}),
+        ...(termsUrl !== undefined ? { termsUrl } : {}),
+        ...(privacyUrl !== undefined ? { privacyUrl } : {}),
         ...(assistantSecret !== undefined ? { assistantSecret } : {}),
+        ...(previousSecrets.length > 0 ? { assistantPreviousSecrets: previousSecrets } : {}),
         ...(assistantSecret !== undefined && privateUrls === 'on' ? { assistantPrivateUrls: true } : {}),
     };
 }
+/** Previous assistant secrets a deployment may keep (assistant.ts SLOTLOCK_ASSISTANT_MAX_PREVIOUS_SECRETS). */
+const MAX_ASSISTANT_PREVIOUS_SECRETS = 3;
+/**
+ * SLOTLOCK_ASSISTANT_PREVIOUS_SECRETS: up to three earlier values of SLOTLOCK_ASSISTANT_SECRET,
+ * comma-separated, newest first, each as strong as a secret must be and unlike every other secret.
+ * Only with SLOTLOCK_ASSISTANT_SECRET: without a current secret nothing would seal the keys again.
+ */
+function readAssistantPreviousSecrets(env, current, others) {
+    const name = 'SLOTLOCK_ASSISTANT_PREVIOUS_SECRETS';
+    const value = env[name];
+    if (value === undefined || value.trim() === '')
+        return [];
+    if (current === undefined) {
+        throw new SlotlockConfigError(`${name} needs SLOTLOCK_ASSISTANT_SECRET: the secret keys are sealed again under`);
+    }
+    const secrets = value.split(',').map((part) => readSecret({ [name]: part }, name));
+    if (secrets.some((secret) => secret === undefined)) {
+        throw new SlotlockConfigError(`${name} must be comma-separated secrets, with no empty one`);
+    }
+    const listed = secrets;
+    if (listed.length > MAX_ASSISTANT_PREVIOUS_SECRETS) {
+        throw new SlotlockConfigError(`${name} takes at most ${String(MAX_ASSISTANT_PREVIOUS_SECRETS)} secrets`);
+    }
+    if (new Set(listed).size !== listed.length || listed.some((secret) => secret === current || others.includes(secret))) {
+        throw new SlotlockConfigError(`${name} must differ from each other, from SLOTLOCK_ASSISTANT_SECRET and from every other secret`);
+    }
+    return listed;
+}
+/** A policy page the sign-in page links: an https URL, or undefined when the setting is empty. */
+function readPolicyUrl(env, name) {
+    const value = optional(env, name)?.trim();
+    if (value === undefined || value === '')
+        return undefined;
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new SlotlockConfigError(`${name} must be an https URL`);
+    }
+    if (url.protocol !== 'https:' || url.username !== '' || url.password !== '') {
+        throw new SlotlockConfigError(`${name} must be an https URL`);
+    }
+    return url.href;
+}
 /**
  * The GitHub organization ids of SLOTLOCK_DASHBOARD_ORGS, or undefined when unset. Read on its own as
  * well: a server whose dashboard runs elsewhere (on Cloudflare Workers) still takes those
@@ -191,8 +258,10 @@ export function readDashboardOrganizations(env) {
     const orgs = optional(env, 'SLOTLOCK_DASHBOARD_ORGS')?.replaceAll(' ', '');
     if (orgs === undefined)
         return undefined;
+    if (orgs === 'enabled')
+        return 'enabled';
     if (!/^[1-9]\d{0,19}(,[1-9]\d{0,19})*$/.test(orgs)) {
-        throw new SlotlockConfigError('SLOTLOCK_DASHBOARD_ORGS must be a comma-separated list of GitHub organization ids (gh api orgs/<login> --jq .id)');
+        throw new SlotlockConfigError('SLOTLOCK_DASHBOARD_ORGS must be a comma-separated list of GitHub organization ids (gh api orgs/<login> --jq .id), or enabled');
     }
     return [...new Set(orgs.split(','))];
 }

package/dashboard-assistant-ui.d.ts

@@ -0,0 +1,21 @@
+/** How a step reads while it runs, once it has, and when it could not. */
+export type SlotlockAssistantStepState = 'run' | 'ok' | 'bad';
+/** A tool step in plain words: "Checking availability…", "Checked availability", "Couldn't check availability". */
+export declare function slotlockAssistantStepLabel(name: string, title: string, state: SlotlockAssistantStepState, write?: boolean): string;
+/** The verb a proposed change's card is approved with, and whether it removes something. */
+export declare function slotlockAssistantActionVerb(operation: string): {
+    verb: string;
+    busy: string;
+    done: string;
+    danger: boolean;
+};
+/** The chat's styles: one centred column, the composer docked under it, quiet steps and cards. */
+export declare const SLOTLOCK_ASSISTANT_CSS = "\n.assistant-page { display: grid; }\n.assistant { position: relative; display: flex; flex-direction: column; width: min(100%, 720px); margin: 0 auto; min-height: calc(100dvh - 180px); }\n.assistant .thread { flex: 1; }\n.assistant[data-empty] { justify-content: center; padding-bottom: 12vh; }\n.assistant[data-empty] .thread { display: none; }\n.assistant[data-empty] .dock { order: 1; position: static; padding: 0; background: none; }\n.assistant[data-empty] .assistant-start { order: 2; padding-top: var(--space-3); }\n.assistant:not([data-empty]) .assistant-start { display: none; }\n.chips { display: flex; flex-wrap: wrap; justify-content: center; gap: var(--space-2); }\n.chips form { margin: 0; }\n.chip { display: inline-flex; align-items: center; gap: 6px; height: 32px; padding: 0 var(--space-3); border-radius: var(--radius-full); border: 1px solid var(--line); background: var(--surface); color: var(--ink-2); font: inherit; font-size: var(--text-md); cursor: pointer; transition: background var(--fast) var(--ease), border-color var(--fast) var(--ease); }\n.chip:hover { background: var(--hover); border-color: var(--line-strong); color: var(--ink); }\n.thread { list-style: none; margin: 0; padding: var(--space-2) 0 var(--space-6); display: grid; gap: var(--space-6); align-content: start; }\n.turn { margin: 0; min-width: 0; }\n.turn.mine { justify-self: end; max-width: 80%; }\n.bubble { padding: 10px 14px; border-radius: 18px; background: var(--sunken); color: var(--ink); font-size: var(--text-lg); line-height: 1.5; white-space: pre-wrap; overflow-wrap: anywhere; }\n.turn.bot { justify-self: stretch; }\n.prose { max-width: 68ch; color: var(--ink); font-size: var(--text-lg); line-height: 1.6; overflow-wrap: anywhere; }\n.prose > :first-child { margin-top: 0; }\n.prose > :last-child { margin-bottom: 0; }\n.prose p { margin: 0 0 var(--space-3); color: inherit; }\n.prose strong { font-weight: 600; }\n.prose h4 { margin: var(--space-4) 0 var(--space-2); font-size: var(--text-lg); font-weight: 600; }\n.prose ul, .prose ol { margin: 0 0 var(--space-3); padding-left: 20px; }\n.prose li { margin: 4px 0; }\n.prose li > ul, .prose li > ol { margin: 4px 0 0; }\n.prose a { color: var(--accent); text-underline-offset: 2px; }\n.prose code { font: 400 12.5px/1.4 var(--mono); background: var(--sunken); border-radius: 4px; padding: 1px 5px; }\n.prose pre { margin: 0 0 var(--space-3); padding: var(--space-3); background: var(--sunken); border: 1px solid var(--line); border-radius: var(--radius); overflow-x: auto; }\n.prose pre code { background: none; padding: 0; font-size: 12.5px; }\n.prose blockquote { margin: 0 0 var(--space-3); padding-left: var(--space-3); border-left: 2px solid var(--line-strong); color: var(--ink-2); }\n.prose hr { border: 0; border-top: 1px solid var(--line); margin: var(--space-4) 0; }\n.md-table { overflow-x: auto; margin: 0 0 var(--space-3); }\n.md-table table { border-collapse: collapse; font-size: var(--text-md); min-width: 50%; }\n.md-table table { width: auto; }\n.md-table th { font: 600 var(--text-md)/1.4 var(--font); text-transform: none; letter-spacing: 0; background: none; text-align: left; color: var(--ink-2); padding: 6px 16px 6px 0; border-bottom: 1px solid var(--line); white-space: nowrap; }\n.md-table td { padding: 6px 16px 6px 0; border-bottom: 1px solid var(--line-soft); vertical-align: top; }\n.md-table tr:last-child td { border-bottom: 0; }\n.change details.more { margin: 0; }\n.change details.more > summary { cursor: pointer; color: var(--ink-3); font-size: var(--text-sm); list-style: none; }\n.change details.more > summary::-webkit-details-marker { display: none; }\n.change details.more > summary:hover { color: var(--ink-2); }\n.change details.more[open] > summary { margin-bottom: var(--space-2); }\n.turn.steps { justify-self: start; }\ndetails.steps > summary { list-style: none; display: inline-flex; align-items: center; gap: 6px; cursor: pointer; color: var(--ink-3); font-size: var(--text-md); padding: 2px 0; }\ndetails.steps > summary::-webkit-details-marker { display: none; }\ndetails.steps > summary::after { content: \"\"; width: 6px; height: 6px; border-right: 1.5px solid currentColor; border-bottom: 1.5px solid currentColor; transform: rotate(-45deg); transition: transform var(--fast) var(--ease); margin-left: 2px; }\ndetails.steps[open] > summary::after { transform: rotate(45deg); }\ndetails.steps > summary:hover { color: var(--ink-2); }\ndetails.steps.has-bad > summary::before { content: \"\"; width: 6px; height: 6px; border-radius: 50%; background: var(--bad); }\n.step-list { list-style: none; margin: var(--space-2) 0 0; padding: 0 0 0 var(--space-3); border-left: 1px solid var(--line); display: grid; gap: 6px; }\n.step { display: flex; align-items: baseline; gap: var(--space-2); font-size: var(--text-md); color: var(--ink-2); }\n.step::before { content: \"\"; flex: none; width: 7px; height: 7px; border-radius: 50%; background: var(--good); transform: translateY(-1px); }\n.step.bad::before { background: var(--bad); }\n.step.run::before { background: var(--ink-3); }\n.step .why { color: var(--ink-3); font-size: var(--text-sm); }\n.live-steps { display: grid; gap: 6px; }\n.live-steps .step.run, .thinking { background: linear-gradient(90deg, var(--ink-3) 0%, var(--ink) 50%, var(--ink-3) 100%); background-size: 200% 100%; -webkit-background-clip: text; background-clip: text; color: transparent; animation: assistant-shimmer 1.6s linear infinite; }\n.thinking { font-size: var(--text-md); justify-self: start; }\n@keyframes assistant-shimmer { from { background-position: 100% 0; } to { background-position: -100% 0; } }\n.prose.streaming > :last-child::after { content: \"\"; display: inline-block; width: 8px; height: 8px; margin-left: 4px; border-radius: 50%; background: var(--ink-3); vertical-align: baseline; animation: assistant-pulse 1s ease-in-out infinite; }\n@keyframes assistant-pulse { 50% { opacity: 0.25; } }\n.turn.note { color: var(--ink-3); font-size: var(--text-md); }\n.turn.error { display: flex; align-items: center; justify-content: space-between; gap: var(--space-3); padding: 10px 12px; border: 1px solid var(--bad-line); background: var(--bad-wash); border-radius: var(--radius); font-size: var(--text-md); color: var(--ink); }\n.turn.error::before { content: \"\"; flex: none; width: 8px; height: 8px; border-radius: 50%; background: var(--bad); }\n.turn.error > span { flex: 1; }\n.turn.error form, .turn.note form { margin: 0; }\n.text-button { appearance: none; border: 0; background: none; padding: 0; font: inherit; font-size: var(--text-md); color: var(--accent); cursor: pointer; }\n.text-button:hover { text-decoration: underline; text-underline-offset: 2px; }\n.turn.action { justify-self: start; width: min(100%, 560px); }\n.change { padding: var(--space-4) var(--space-5); background: var(--surface); border: 1px solid var(--line-strong); border-radius: var(--radius-lg); display: grid; gap: var(--space-3); }\n.change-title { margin: 0; font-size: var(--text-lg); font-weight: 600; color: var(--ink); overflow-wrap: anywhere; }\n.change .facts { display: grid; grid-template-columns: max-content minmax(0, 1fr); gap: 6px var(--space-4); margin: 0; font-size: var(--text-md); }\n.change .facts dt { color: var(--ink-3); font-size: var(--text-sm); padding-top: 1px; }\n.change .facts dd { margin: 0; color: var(--ink); overflow-wrap: anywhere; }\n.change .facts dd pre { margin: 0; white-space: pre-wrap; font: 400 12px/1.5 var(--mono); }\n.change .facts .was { color: var(--ink-3); text-decoration: line-through; }\n.change-buttons { display: flex; gap: var(--space-2); flex-wrap: wrap; }\n.change-buttons form { margin: 0; }\n.change-buttons button { height: 32px; }\nbutton.danger { background: var(--bad); color: var(--bad-ink); border-color: var(--bad); }\nbutton.danger:hover { filter: brightness(1.08); }\nbutton.ghost { background: transparent; border-color: transparent; color: var(--ink-2); }\nbutton.ghost:hover { background: var(--hover); color: var(--ink); }\n.receipt { margin: 0; display: flex; align-items: baseline; gap: var(--space-2); font-size: var(--text-md); color: var(--ink-2); }\n.receipt::before { content: \"\"; flex: none; width: 7px; height: 7px; border-radius: 50%; background: var(--ink-3); transform: translateY(-1px); }\n.receipt.ok { color: var(--ink); }\n.receipt.ok::before { background: var(--good); }\n.receipt.bad::before { background: var(--bad); }\n.receipt .why { color: var(--ink-3); }\n.dock { position: sticky; bottom: 0; padding: var(--space-6) 0 var(--space-6); background: linear-gradient(to bottom, transparent, var(--canvas) 24px); z-index: 2; }\n.composer { display: grid; margin: 0; background: var(--surface); border: 1px solid var(--line); border-radius: 16px; transition: border-color var(--fast) var(--ease), box-shadow var(--fast) var(--ease); }\n.composer:focus-within { border-color: var(--line-strong); box-shadow: 0 0 0 3px var(--ring); }\n.composer textarea { display: block; width: 100%; min-height: 26px; max-height: 200px; resize: none; border: 0; outline: 0; background: transparent; padding: 14px 16px 0; color: var(--ink); font: inherit; font-size: var(--text-lg); line-height: 1.5; box-shadow: none; }\n.composer textarea:focus { box-shadow: none; border: 0; }\n.composer-bar { display: flex; align-items: center; justify-content: flex-end; gap: var(--space-2); padding: var(--space-2); }\n.composer-bar .count { margin-right: auto; padding-left: var(--space-2); font-size: var(--text-sm); color: var(--ink-3); }\n.composer-bar .count.over { color: var(--warn); }\n.send { display: inline-grid; place-items: center; width: 32px; height: 32px; padding: 0; border-radius: 50%; border: 0; background: var(--button); color: var(--button-ink); cursor: pointer; transition: opacity var(--fast) var(--ease), background var(--fast) var(--ease); }\n.send:hover { background: var(--button-hover); }\n.send:disabled { opacity: 0.4; cursor: default; }\n.send svg { width: 16px; height: 16px; }\n.send .stop { display: none; }\n.assistant.streaming .send .arrow { display: none; }\n.assistant.streaming .send .stop { display: block; }\n.jump { position: absolute; left: 50%; transform: translate(-50%, 0); top: -8px; width: 32px; height: 32px; padding: 0; border-radius: 50%; border: 1px solid var(--line); background: var(--surface); color: var(--ink-2); display: grid; place-items: center; cursor: pointer; box-shadow: var(--pop-shadow); }\n.jump[hidden] { display: none; }\n.new-chat svg { width: 14px; height: 14px; }\n.assistant-page[data-empty] .new-chat { display: none; }\n@media (prefers-reduced-motion: reduce) {\n  .live-steps .step.run, .thinking { animation: none; color: var(--ink-3); background: none; }\n  .prose.streaming > :last-child::after { animation: none; }\n}\n@media (max-width: 760px) {\n  .assistant { min-height: calc(100dvh - 140px); }\n  .assistant[data-empty] { justify-content: flex-end; padding-bottom: 0; }\n  .assistant[data-empty] .assistant-start { order: 1; padding: 0 0 var(--space-3); }\n  .assistant[data-empty] .dock { order: 2; position: sticky; padding-bottom: max(12px, env(safe-area-inset-bottom)); }\n  .chips { flex-wrap: nowrap; justify-content: flex-start; overflow-x: auto; max-width: 100%; padding-bottom: 2px; scrollbar-width: none; }\n  .chips::-webkit-scrollbar { display: none; }\n  .chip { flex: none; }\n  .turn.mine { max-width: 88%; }\n  .md-table table { display: table; }\n  .md-table thead { display: table-header-group; }\n  .md-table tbody { display: table-row-group; }\n  .md-table tr { display: table-row; padding: 0; border: 0; }\n  .md-table th, .md-table td { display: table-cell; padding: 6px 12px 6px 0; }\n  .md-table td { border-bottom: 1px solid var(--line-soft); }\n  .composer textarea { font-size: 16px; }\n  .dock { padding-bottom: max(12px, env(safe-area-inset-bottom)); }\n  .change { padding: var(--space-4); }\n  .change .facts { grid-template-columns: minmax(0, 1fr); gap: 2px; }\n  .change .facts dd { margin-bottom: var(--space-2); }\n  .change-buttons form { flex: 1; }\n  .change-buttons button { width: 100%; height: 40px; }\n}\n";
+/**
+ * The browser side of the chat, appended to app.js: Enter sends, the box grows, a write chip fills
+ * the box instead of sending, and a reply streams in from `<root>/assistant/stream` (newline-
+ * delimited JSON: text deltas, steps, then the turn as the server renders it). Without it the
+ * page still works: every form posts and the page reloads at the latest message.
+ * `markdownSource` is renderSlotlockMarkdown's source, so a reply renders as it will once stored.
+ */
+export declare function slotlockAssistantScript(markdownSource: string): string;