slotlock 0.8.0 → 0.10.0

package/index.js

@@ -11,7 +11,15 @@ export { createSlotlockGuardedFetch, createSlotlockWebhookSender, deliverSlotloc
 export { createSlotlockMetrics } from './metrics.js';
 export { expandRules } from './rules.js';
 export { availabilityRuleProblem, parseAvailabilityRules, rulesToWeeklyHours, SLOTLOCK_MAX_AVAILABILITY_RULES, weeklyHoursToRules, } from './weekly-hours.js';
-export { emitVAvailability, parseVAvailability, recurrenceRuleFromRRule, SLOTLOCK_MAX_VAVAILABILITY_CHARACTERS, toJSCalendarEvent, } from './interop.js';
+export { emitVAvailability, parseVAvailability, recurrenceRuleFromRRule, SLOTLOCK_MAX_VAVAILABILITY_CHARACTERS, SLOTLOCK_MAX_VAVAILABILITY_DAYS, toJSCalendarEvent, } from './interop.js';
+// Stored hours that inherit, and closures and special days (RFC 0004 B1, B2).
+export { applicableHours, coveredByOpenWindows, exceptionDays, exceptionRanges, openWindows, parseExceptionDays, SLOTLOCK_MAX_AVAILABILITY_EXCEPTIONS, SLOTLOCK_MAX_EXCEPTION_DAYS, SLOTLOCK_MAX_EXCEPTION_WINDOWS, } from './hours.js';
+export { SLOTLOCK_OVERRIDE_RESOURCES, SLOTLOCK_HOLIDAY_REIMPORT_DAYS, SLOTLOCK_MAX_HOLIDAY_CALENDARS, } from './availability-store.js';
+export { readSlotlockHolidayCalendar, } from './holiday-import.js';
+export { fetchHolidayCalendar, parseHolidayCalendar, SLOTLOCK_MAX_HOLIDAY_CALENDAR_BYTES, SLOTLOCK_MAX_HOLIDAY_DAYS, } from './holidays.js';
+// The booking lifecycle, written down (RFC 0004 B4).
+export { SLOTLOCK_BOOKING_ACTIONS, SLOTLOCK_BOOKING_ENDS, SLOTLOCK_BOOKING_STATUSES, SLOTLOCK_BOOKING_TRANSITIONS, slotlockBookingNext, slotlockBookingRefusal, } from './lifecycle.js';
+export { findEarliestRange, sameTimeDaysLater } from './ranges.js';
 export { createTimeZoneConverter, zonedCalendarDate, zonedDateTimeToUtc, zonedWallTime, } from './timezone.js';
 export { createSlotlockAgentServer, clientSupportsSlotlockMcpApp, invokeSlotlockAgentOperation, isSlotlockAgentOperation, slotlockAgentTools, slotlockApplicationOperations, slotlockOpenApi, slotlockCalendarResourceUri, slotlockMcpToolResult, parseSlotlockA2ATimestamp, resolveSlotlockAgentOperation, slotlockAgentOperationScope, SLOTLOCK_A2A_PROTOCOL_VERSION, SLOTLOCK_A2A_TASK_PAGE_SIZE, SLOTLOCK_A2A_WATCH_SKILL, SLOTLOCK_A2A_TASK_STATES, SLOTLOCK_AGENT_OPERATION_LEGACY_NAMES, SLOTLOCK_AGENT_SERVER_VERSION, SLOTLOCK_MAX_ALTERNATIVES, SLOTLOCK_MCP_LEGACY_PROTOCOL_VERSION, SLOTLOCK_MCP_PROTOCOL_VERSION, SLOTLOCK_MCP_RATE_LIMITED_ERROR_CODE, SLOTLOCK_MCP_RESOURCE_URI_TEMPLATE, SLOTLOCK_MCP_SUPPORTED_PROTOCOL_VERSIONS, SLOTLOCK_MCP_APP_HTML, SLOTLOCK_MCP_APP_MIME_TYPE, SLOTLOCK_MCP_APP_RESOURCE, SLOTLOCK_MCP_APP_RESOURCE_URI, SLOTLOCK_MCP_APPS_EXTENSION, SlotlockAgentOperationError, } from './agent-server.js';
 export { createSlotlockNodeServer } from './node-server.js';
@@ -26,8 +34,14 @@ export { createSlotlockPartnerKeyAuthenticator, createSlotlockPartnerStore, pars
 export { createSlotlockDashboardTeams, createSlotlockOrganizationCheck } from './teams.js';
 export { reportSlotlockOverage, SLOTLOCK_DEFAULT_OVERAGE_STOP_PERCENT } from './overage.js';
 export { createSlotlockOtlpExporter, readSlotlockOtlpConfig, slotlockCallSpan } from './otel.js';
+export { createSlotlockInvitationEmailSender, SlotlockInvitationEmailError, slotlockInvitationEmail, } from './invitation-email.js';
+export { createSlotlockDashboardWorkspaces, createSlotlockMemoryDashboardWorkspaces, createSlotlockWorkspaceCheck, } from './workspaces.js';
+export { SLOTLOCK_DASHBOARD_PAGE_CAPABILITIES, SLOTLOCK_DASHBOARD_POST_CAPABILITIES, SLOTLOCK_FRESH_CAPABILITIES, SLOTLOCK_ROLE_CAPABILITIES, SLOTLOCK_SCOPED_CAPABILITIES, SLOTLOCK_SCOPED_DASHBOARD_PAGES, SLOTLOCK_SCOPED_DASHBOARD_POSTS, SLOTLOCK_WORKSPACE_CAPABILITIES, SLOTLOCK_WORKSPACE_ROLE_NAMES, SLOTLOCK_WORKSPACE_ROLES, isSlotlockWorkspaceRole, slotlockMemberCan, slotlockRoleCan, slotlockRoleKeyScopes, slotlockRoleMayGrant, } from './workspace-roles.js';
+// For resource adapters of one's own that keep to a limited member's scope (`keepsToScope`).
+export { slotlockDashboardRequestScope } from './dashboard-scope.js';
 export { closeSlotlockPartnerMonth, priceSlotlockPartnerMonth, slotlockClientLabel, slotlockPartnerMonthChecksum, } from './partner-billing.js';
 export { ICalendarWorkerBusyError, ICalendarWorkerPoolClosedError, createICalendarWorkerPool, } from './ical-worker.js';
 export { CalendarContractError, CalendarExpansionLimitError, emitICalendar, emitITipCalendar, expandCalendarEventOccurrences, normalizeCalendarEventContent, normalizeExternalCalendarChange, parseICalendarChanges, parseICalendarFeed, parseTrustedICalendarEvents, recurrenceRuleProblem, storedCalendarEventProblem, } from './sync.js';
-export { createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, SLOTLOCK_API_KEY_FUNCTIONS, SLOTLOCK_API_KEY_TABLES, SLOTLOCK_CORE_DDL, SLOTLOCK_DASHBOARD_FUNCTIONS, SLOTLOCK_DASHBOARD_TABLES, SLOTLOCK_DEFINER_FUNCTIONS, SLOTLOCK_DEFINER_TABLES, SLOTLOCK_OPERATOR_FUNCTIONS, SLOTLOCK_SCHEMA_FUNCTIONS, SLOTLOCK_SCHEMA_TABLES, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_TENANT_ADMIN_FUNCTIONS, SLOTLOCK_TENANT_ADMIN_TABLES, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_TENANT_RLS_DDL, SLOTLOCK_TENANT_TABLES, } from './ddl.js';
-export { assertSlotlockSchemaCurrent, calendarEventRollingHorizon, createSlotlockStore, readSlotlockSchemaVersion, SLOTLOCK_AGENT_OWNER_COMMAND_QUOTA, SLOTLOCK_AGENT_OWNER_EVENT_QUOTA, SLOTLOCK_CALENDAR_HORIZON_DAYS, SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS, SLOTLOCK_INTERNAL_EVENT_OWNER_REF, SLOTLOCK_LOCAL_RECURRENCE_COVERAGE_SOURCE, SLOTLOCK_MATERIALIZATION_WINDOW_DAYS, SLOTLOCK_MAX_EVENT_DURATION_DAYS, SLOTLOCK_TENANT_WRITE_METHODS, } from './store.js';
+export { createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, SLOTLOCK_API_KEY_FUNCTIONS, SLOTLOCK_API_KEY_TABLES, SLOTLOCK_CORE_DDL, SLOTLOCK_DASHBOARD_FUNCTIONS, SLOTLOCK_DASHBOARD_TABLES, SLOTLOCK_APPEND_ONLY_TABLES, SLOTLOCK_AUDIT_RETENTION_DAYS, SLOTLOCK_CHANGE_RETENTION_BY_PLAN, SLOTLOCK_DEFINER_FUNCTIONS, SLOTLOCK_DEFINER_TABLES, SLOTLOCK_OPERATOR_FUNCTIONS, SLOTLOCK_SCHEMA_FUNCTIONS, SLOTLOCK_SCHEMA_TABLES, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_TENANT_ADMIN_FUNCTIONS, SLOTLOCK_TENANT_ADMIN_TABLES, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_TENANT_RLS_DDL, SLOTLOCK_TENANT_TABLES, } from './ddl.js';
+export { assertSlotlockSchemaCurrent, calendarEventRollingHorizon, createSlotlockStore, readSlotlockSchemaVersion, SLOTLOCK_AGENT_OWNER_COMMAND_QUOTA, SLOTLOCK_AGENT_OWNER_EVENT_QUOTA, SLOTLOCK_CALENDAR_HORIZON_DAYS, SLOTLOCK_SOURCE_BUSY_MAX, SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS, SLOTLOCK_INTERNAL_EVENT_OWNER_REF, SLOTLOCK_LOCAL_RECURRENCE_COVERAGE_SOURCE, SLOTLOCK_MATERIALIZATION_WINDOW_DAYS, SLOTLOCK_MAX_EVENT_DURATION_DAYS, SLOTLOCK_MAX_CONTACTS_PER_TENANT, SLOTLOCK_PAYMENT_HOLD_MAX_TTL_MS, SLOTLOCK_TENANT_WRITE_METHODS, SLOTLOCK_TENANT_EXPORT_HOURS, SLOTLOCK_TENANT_EXPORT_MAX_BYTES, SLOTLOCK_TENANT_EXPORT_PART_ROWS, SLOTLOCK_MAX_TENANT_EXPORTS, buildSlotlockTenantExport, slotlockAuditEventRecord, } from './store.js';
+export { SLOTLOCK_SUBJECT_TABLES, SLOTLOCK_TENANT_EXPORT_LEFT_OUT, SLOTLOCK_TENANT_EXPORT_TABLES, } from './types.js';

package/interop.d.ts

@@ -1,3 +1,4 @@
+import { type SlotlockExceptionDay } from './hours.js';
 import type { SlotlockCalendarEvent, WeeklyAvailabilityRule } from './types.js';
 /** The longest VAVAILABILITY text `parseVAvailability` reads. */
 export declare const SLOTLOCK_MAX_VAVAILABILITY_CHARACTERS = 65536;
@@ -8,26 +9,43 @@ export interface EmitVAvailabilityOptions {
     timezone: string;
     /** The VAVAILABILITY's UID; each AVAILABLE's is this with its index. */
     uid: string;
+    /**
+     * Days exceptions replace (RFC 0004 B1): each weekly AVAILABLE gets an EXDATE for its window on
+     * them, and the hours an open day has instead are AVAILABLEs of their own, one per window with an
+     * RDATE for each further day with the same window.
+     */
+    days?: readonly SlotlockExceptionDay[];
 }
+/** The most days one VAVAILABILITY's EXDATEs, RDATEs and single AVAILABLEs may name. */
+export declare const SLOTLOCK_MAX_VAVAILABILITY_DAYS = 1000;
 /**
  * A VCALENDAR with one VAVAILABILITY holding an AVAILABLE per rule: DTSTART on the rule's first day
  * in a reference week of January 2024, with the IANA zone as TZID (no VTIMEZONE: RFC 7809 lets the
  * two sides agree on IANA names), DURATION and the rule's RRULE. `[]` is a VAVAILABILITY with no
  * AVAILABLE: never bookable. CRLF line endings, folded at 75 octets.
  */
-export declare function emitVAvailability({ rules, timezone, uid }: EmitVAvailabilityOptions): string;
+export declare function emitVAvailability({ rules, timezone, uid, days }: EmitVAvailabilityOptions): string;
 export interface ParsedVAvailability {
     /** The TZID every AVAILABLE named, `UTC` for UTC times, or null when they are all floating. */
     timezone: string | null;
     rules: WeeklyAvailabilityRule[];
+    /**
+     * The days EXDATEs, RDATEs and single AVAILABLEs change, each with the windows it has: none is
+     * closed. Empty when the hours are only weekly.
+     */
+    days: SlotlockExceptionDay[];
 }
 /**
- * Weekly rules from an iCalendar VAVAILABILITY (RFC 7953): one VAVAILABILITY, each AVAILABLE a
- * weekly RRULE with a time of day and a length. Refuses (`invalid_availability`) what weekly
- * rules cannot say: a VAVAILABILITY bounded by DTSTART or DTEND, more than one, an AVAILABLE
- * without RRULE, with RDATE, EXDATE or RECURRENCE-ID, a whole-day DTSTART, seconds, AVAILABLEs in
- * different zones, and any rule `parseAvailabilityRules` refuses. An RRULE without BYDAY takes
- * DTSTART's day, as RFC 5545 reads it.
+ * Weekly rules and the days that differ from them, from an iCalendar VAVAILABILITY (RFC 7953): one
+ * VAVAILABILITY, each AVAILABLE either a weekly RRULE with a time of day and a length, or a single
+ * window. EXDATE takes a weekly window off its day, RDATE adds a window (of the AVAILABLE's length,
+ * or a PERIOD's), and a single AVAILABLE adds its own: each day they name becomes a day with hours
+ * of its own (`days`), as exceptions keep them (RFC 0004 B1). Refuses (`invalid_availability`) what
+ * these cannot say: a VAVAILABILITY bounded by DTSTART or DTEND, more than one, RECURRENCE-ID, a
+ * whole-day DTSTART, seconds, AVAILABLEs in different zones, an EXDATE at another time than its
+ * window, a day with more than four windows or one over a day, more than
+ * SLOTLOCK_MAX_VAVAILABILITY_DAYS such days, and any rule `parseAvailabilityRules` refuses. An
+ * RRULE without BYDAY takes DTSTART's day, as RFC 5545 reads it.
  */
 export declare function parseVAvailability(text: string): ParsedVAvailability;
 /** A JSCalendar Event object (RFC 8984 §5.1): the properties Slotlock fills. */

package/interop.js

@@ -3,6 +3,7 @@
 // (RFC 8984). Pure functions: the application API serves them, and an application may call them
 // directly.
 import ICAL from 'ical.js';
+import { epochDay } from './hours.js';
 import { zonedDateTimeFields } from './timezone.js';
 import { invalidAvailability, parseAvailabilityRules } from './weekly-hours.js';
 /** The longest VAVAILABILITY text `parseVAvailability` reads. */
@@ -40,13 +41,21 @@ function referenceDay(rrule) {
     const index = DAYS.findIndex((day) => named.includes(day));
     return new Date(REFERENCE_SUNDAY + Math.max(index, 0) * 86_400_000);
 }
+/** The most days one VAVAILABILITY's EXDATEs, RDATEs and single AVAILABLEs may name. */
+export const SLOTLOCK_MAX_VAVAILABILITY_DAYS = 1_000;
+const compactDate = (date) => date.replaceAll('-', '');
+const wallStamp = (date, minutes) => `${compactDate(date)}T${pad(Math.floor(minutes / 60))}${pad(minutes % 60)}00`;
+/** The weekday codes an RRULE's BYDAY names. */
+const byDays = (rrule) => new Set((/(?:^|;)BYDAY=([^;]*)/.exec(rrule)?.[1] ?? '').split(',').map((day) => day.slice(-2)));
+/** The weekday code of `YYYY-MM-DD`. */
+const weekdayOf = (date) => DAYS[new Date(`${date}T00:00:00Z`).getUTCDay()];
 /**
  * A VCALENDAR with one VAVAILABILITY holding an AVAILABLE per rule: DTSTART on the rule's first day
  * in a reference week of January 2024, with the IANA zone as TZID (no VTIMEZONE: RFC 7809 lets the
  * two sides agree on IANA names), DURATION and the rule's RRULE. `[]` is a VAVAILABILITY with no
  * AVAILABLE: never bookable. CRLF line endings, folded at 75 octets.
  */
-export function emitVAvailability({ rules, timezone, uid }) {
+export function emitVAvailability({ rules, timezone, uid, days }) {
     const lines = [
         'BEGIN:VCALENDAR',
         'VERSION:2.0',
@@ -59,7 +68,31 @@ export function emitVAvailability({ rules, timezone, uid }) {
         const day = referenceDay(rule.rrule);
         const hour = Math.floor(rule.startMinutes / 60);
         const minute = rule.startMinutes % 60;
-        lines.push('BEGIN:AVAILABLE', `UID:${uid}-${index}`, `DTSTAMP:${VAVAILABILITY_DTSTAMP}`, `DTSTART;TZID=${timezone}:${day.getUTCFullYear()}${pad(day.getUTCMonth() + 1)}${pad(day.getUTCDate())}T${pad(hour)}${pad(minute)}00`, `DURATION:PT${rule.durationMinutes}M`, `RRULE:${rule.rrule}`, 'END:AVAILABLE');
+        lines.push('BEGIN:AVAILABLE', `UID:${uid}-${index}`, `DTSTAMP:${VAVAILABILITY_DTSTAMP}`, `DTSTART;TZID=${timezone}:${day.getUTCFullYear()}${pad(day.getUTCMonth() + 1)}${pad(day.getUTCDate())}T${pad(hour)}${pad(minute)}00`, `DURATION:PT${rule.durationMinutes}M`, `RRULE:${rule.rrule}`);
+        const weekdays = byDays(rule.rrule);
+        const excluded = (days ?? [])
+            .filter((day) => weekdays.has(weekdayOf(day.date)))
+            .map((day) => wallStamp(day.date, rule.startMinutes));
+        if (excluded.length > 0)
+            lines.push(`EXDATE;TZID=${timezone}:${excluded.join(',')}`);
+        lines.push('END:AVAILABLE');
+    });
+    // An open day's hours: one AVAILABLE per window, repeated by RDATE on each further day with it.
+    const byWindow = new Map();
+    for (const day of days ?? []) {
+        for (const window of day.windows) {
+            const key = `${window.startMinutes}:${window.durationMinutes}`;
+            const entry = byWindow.get(key) ?? { window, dates: [] };
+            entry.dates.push(day.date);
+            byWindow.set(key, entry);
+        }
+    }
+    [...byWindow.values()].forEach(({ window, dates }, index) => {
+        const [first, ...rest] = [...dates].sort();
+        lines.push('BEGIN:AVAILABLE', `UID:${uid}-day-${index}`, `DTSTAMP:${VAVAILABILITY_DTSTAMP}`, `DTSTART;TZID=${timezone}:${wallStamp(first, window.startMinutes)}`, `DURATION:PT${window.durationMinutes}M`);
+        if (rest.length > 0)
+            lines.push(`RDATE;TZID=${timezone}:${rest.map((date) => wallStamp(date, window.startMinutes)).join(',')}`);
+        lines.push('END:AVAILABLE');
     });
     lines.push('END:VAVAILABILITY', 'END:VCALENDAR');
     return `${lines.map(fold).join(CRLF)}${CRLF}`;
@@ -72,12 +105,16 @@ function single(component, name) {
     return properties[0] ?? null;
 }
 /**
- * Weekly rules from an iCalendar VAVAILABILITY (RFC 7953): one VAVAILABILITY, each AVAILABLE a
- * weekly RRULE with a time of day and a length. Refuses (`invalid_availability`) what weekly
- * rules cannot say: a VAVAILABILITY bounded by DTSTART or DTEND, more than one, an AVAILABLE
- * without RRULE, with RDATE, EXDATE or RECURRENCE-ID, a whole-day DTSTART, seconds, AVAILABLEs in
- * different zones, and any rule `parseAvailabilityRules` refuses. An RRULE without BYDAY takes
- * DTSTART's day, as RFC 5545 reads it.
+ * Weekly rules and the days that differ from them, from an iCalendar VAVAILABILITY (RFC 7953): one
+ * VAVAILABILITY, each AVAILABLE either a weekly RRULE with a time of day and a length, or a single
+ * window. EXDATE takes a weekly window off its day, RDATE adds a window (of the AVAILABLE's length,
+ * or a PERIOD's), and a single AVAILABLE adds its own: each day they name becomes a day with hours
+ * of its own (`days`), as exceptions keep them (RFC 0004 B1). Refuses (`invalid_availability`) what
+ * these cannot say: a VAVAILABILITY bounded by DTSTART or DTEND, more than one, RECURRENCE-ID, a
+ * whole-day DTSTART, seconds, AVAILABLEs in different zones, an EXDATE at another time than its
+ * window, a day with more than four windows or one over a day, more than
+ * SLOTLOCK_MAX_VAVAILABILITY_DAYS such days, and any rule `parseAvailabilityRules` refuses. An
+ * RRULE without BYDAY takes DTSTART's day, as RFC 5545 reads it.
  */
 export function parseVAvailability(text) {
     if (text.length > SLOTLOCK_MAX_VAVAILABILITY_CHARACTERS) {
@@ -99,16 +136,26 @@ export function parseVAvailability(text) {
         throw invalidAvailability('A VAVAILABILITY bounded by DTSTART or DTEND cannot be weekly hours');
     }
     const zones = new Set();
-    const rules = availability.getAllSubcomponents('available').map((available, index) => {
-        for (const name of ['rdate', 'exdate', 'recurrence-id']) {
-            if (available.hasProperty(name)) {
-                throw invalidAvailability(`AVAILABLE ${index} has ${name.toUpperCase()}: weekly hours cannot say it`);
-            }
+    // What EXDATE, RDATE and single AVAILABLEs say, day by day: weekly windows taken away, and
+    // windows added.
+    const excluded = new Map();
+    const added = new Map();
+    const named = new Set();
+    const nameDay = (date, index) => {
+        named.add(date);
+        if (named.size > SLOTLOCK_MAX_VAVAILABILITY_DAYS) {
+            throw invalidAvailability(`AVAILABLE ${index}: at most ${SLOTLOCK_MAX_VAVAILABILITY_DAYS} days may differ from the week`);
+        }
+    };
+    const weekly = [];
+    availability.getAllSubcomponents('available').forEach((available, index) => {
+        if (available.hasProperty('recurrence-id')) {
+            throw invalidAvailability(`AVAILABLE ${index} has RECURRENCE-ID: weekly hours cannot say it`);
         }
         const dtstart = single(available, 'dtstart');
         const rrule = single(available, 'rrule');
-        if (!dtstart || !rrule)
-            throw invalidAvailability(`AVAILABLE ${index} needs DTSTART and RRULE`);
+        if (!dtstart)
+            throw invalidAvailability(`AVAILABLE ${index} needs DTSTART`);
         const start = dtstart.getFirstValue();
         if (start.isDate)
             throw invalidAvailability(`AVAILABLE ${index} starts on a date, not a time`);
@@ -139,16 +186,97 @@ export function parseVAvailability(text) {
         if (!Number.isInteger(durationMinutes) || durationMinutes < 1) {
             throw invalidAvailability(`AVAILABLE ${index} does not last a whole number of minutes`);
         }
+        const startMinutes = start.hour * 60 + start.minute;
+        const dateOf = (time) => `${pad(time.year, 4)}-${pad(time.month)}-${pad(time.day)}`;
+        // EXDATE and RDATE are read in DTSTART's zone: another would move them.
+        const sameZone = (property, name) => {
+            if (property.getParameter('tzid') !== dtstart.getParameter('tzid')) {
+                throw invalidAvailability(`AVAILABLE ${index} has ${name} in another zone than DTSTART`);
+            }
+        };
+        const addWindow = (date, minutes, length) => {
+            if (length > 1_440) {
+                throw invalidAvailability(`AVAILABLE ${index} adds a window longer than a day on ${date}`);
+            }
+            nameDay(date, index);
+            added.set(date, [...(added.get(date) ?? []), { startMinutes: minutes, durationMinutes: length }]);
+        };
+        for (const property of available.getAllProperties('rdate')) {
+            sameZone(property, 'RDATE');
+            for (const value of property.getValues()) {
+                if (value instanceof ICAL.Period) {
+                    const from = value.start;
+                    const to = value.getEnd();
+                    const length = (wallSeconds(to) - wallSeconds(from)) / 60;
+                    if (from.isDate || from.second !== 0 || !Number.isInteger(length) || length < 1) {
+                        throw invalidAvailability(`AVAILABLE ${index} has an RDATE period that is not whole minutes`);
+                    }
+                    addWindow(dateOf(from), from.hour * 60 + from.minute, length);
+                }
+                else {
+                    const time = value;
+                    if (time.isDate || time.second !== 0) {
+                        throw invalidAvailability(`AVAILABLE ${index} has an RDATE that is not a time to the minute`);
+                    }
+                    addWindow(dateOf(time), time.hour * 60 + time.minute, durationMinutes);
+                }
+            }
+        }
+        if (!rrule) {
+            // A single window on its day.
+            addWindow(dateOf(start), startMinutes, durationMinutes);
+            if (available.hasProperty('exdate')) {
+                throw invalidAvailability(`AVAILABLE ${index} has EXDATE but no RRULE`);
+            }
+            return;
+        }
         let value = String(rrule.getFirstValue());
         if (!/(?:^|;)BYDAY=/.test(value)) {
             value = `${value};BYDAY=${DAYS[start.dayOfWeek() - 1]}`;
         }
-        return { rrule: value, startMinutes: start.hour * 60 + start.minute, durationMinutes };
+        const position = weekly.length;
+        weekly.push({ rule: { rrule: value, startMinutes, durationMinutes }, index });
+        for (const property of available.getAllProperties('exdate')) {
+            sameZone(property, 'EXDATE');
+            for (const time of property.getValues()) {
+                if (!time.isDate && time.hour * 60 + time.minute !== startMinutes) {
+                    throw invalidAvailability(`AVAILABLE ${index} has an EXDATE at another time than its window`);
+                }
+                const date = dateOf(time);
+                nameDay(date, index);
+                excluded.set(date, (excluded.get(date) ?? new Set()).add(position));
+            }
+        }
     });
     if (zones.size > 1)
         throw invalidAvailability('The AVAILABLEs are in different time zones');
     const [timezone = null] = zones;
-    return { timezone, rules: parseAvailabilityRules(rules) };
+    const rules = parseAvailabilityRules(weekly.map(({ rule }) => rule));
+    // Each named day as it reads: the weekly windows that fall on it and are not excluded, and those
+    // added.
+    const days = [...named].sort().map((date) => {
+        const weekday = weekdayOf(date);
+        const untilOk = (rrule) => {
+            const until = /(?:^|;)UNTIL=(\d{8})/.exec(rrule)?.[1];
+            return until === undefined || compactDate(date) <= until;
+        };
+        const windows = [];
+        rules.forEach((rule, position) => {
+            if (!byDays(rule.rrule).has(weekday) || !untilOk(rule.rrule) || excluded.get(date)?.has(position))
+                return;
+            if (rule.durationMinutes > 1_440) {
+                throw invalidAvailability(`A window longer than a day falls on ${date}, which differs from the week`);
+            }
+            windows.push({ startMinutes: rule.startMinutes, durationMinutes: rule.durationMinutes });
+        });
+        windows.push(...(added.get(date) ?? []));
+        if (windows.length > 4)
+            throw invalidAvailability(`${date} has more than 4 windows`);
+        if (epochDay(date) === null)
+            throw invalidAvailability(`${date} is not a day`);
+        return { date, windows };
+    });
+    return { timezone, rules, days };
 }
 const wallSeconds = (time) => Date.UTC(time.year, time.month - 1, time.day, time.hour, time.minute, time.second) / 1000;
 /** An instant as a LocalDateTime (RFC 8984 §1.4.4) on the wall clock of `timezone`. */

package/invitation-email.d.ts

@@ -0,0 +1,26 @@
+import type { SlotlockInvitationSender } from './dashboard.js';
+/** Where invitations are sent from (SLOTLOCK_INVITATION_EMAIL, _KEY, _FROM). */
+export interface SlotlockInvitationEmailConfig {
+    provider: 'resend' | 'postmark';
+    /** Resend's API key, or Postmark's server token. */
+    key: string;
+    /** The sender, as the provider has it verified: `Slotlock <team@example.com>` or an address. */
+    from: string;
+}
+type Invitation = Parameters<SlotlockInvitationSender['send']>[0];
+/** A provider's refusal: its name and HTTP status alone (its text can echo the address). */
+export declare class SlotlockInvitationEmailError extends Error {
+    name: string;
+}
+/** The message an invitation sends: subject, text and HTML saying the same, with no marketing. */
+export declare function slotlockInvitationEmail(invitation: Invitation, brandName?: string): {
+    subject: string;
+    text: string;
+    html: string;
+};
+/** Sends each invitation once through the provider; throws on any answer but success. */
+export declare function createSlotlockInvitationEmailSender(config: SlotlockInvitationEmailConfig, options?: {
+    fetch?: typeof fetch;
+    brandName?: string;
+}): SlotlockInvitationSender;
+export {};

package/invitation-email.js

@@ -0,0 +1,73 @@
+// Team invitations by email (dashboard.ts SlotlockInvitationSender): a plain transactional message
+// with the link, sent through Resend or Postmark with the deployment's own key. Nothing else is
+// sent, and no address is kept by this module.
+import { createHash } from 'node:crypto';
+/** A provider's refusal: its name and HTTP status alone (its text can echo the address). */
+export class SlotlockInvitationEmailError extends Error {
+    name = 'SlotlockInvitationEmailError';
+}
+/** Resend refuses a request without a User-Agent (403), and a Worker's fetch sends none. */
+const USER_AGENT = 'Slotlock (+https://slotlock.pylota.io)';
+const escape = (value) => value.replace(/[&<>"']/g, (character) => `&#${character.charCodeAt(0)};`);
+/** The message an invitation sends: subject, text and HTML saying the same, with no marketing. */
+export function slotlockInvitationEmail(invitation, brandName = 'Slotlock') {
+    const until = `${invitation.expiresAt.toISOString().slice(0, 16).replace('T', ' ')} UTC`;
+    const subject = `${invitation.inviter} invited you to ${invitation.workspace} on ${brandName}`;
+    const lines = [
+        `${invitation.inviter} invited you to join ${invitation.workspace} on ${brandName} as ${invitation.role}.`,
+        `Join: ${invitation.link}`,
+        `The link works once, for this address, until ${until}. If you did not expect it, ignore this email: nothing happens unless you use the link.`,
+    ];
+    const html = `<!doctype html><html><body style="font-family:system-ui,sans-serif;line-height:1.5;color:#111"><p>${escape(lines[0])}</p><p><a href="${escape(invitation.link)}">Join ${escape(invitation.workspace)}</a></p><p style="color:#555;font-size:14px">${escape(lines[2])}</p></body></html>`;
+    return { subject, text: `${lines.join('\n\n')}\n`, html };
+}
+/** Sends each invitation once through the provider; throws on any answer but success. */
+export function createSlotlockInvitationEmailSender(config, options = {}) {
+    const fetchImpl = options.fetch ?? fetch;
+    return {
+        async send(invitation) {
+            const message = slotlockInvitationEmail(invitation, options.brandName);
+            const request = config.provider === 'resend'
+                ? {
+                    url: 'https://api.resend.com/emails',
+                    headers: {
+                        authorization: `Bearer ${config.key}`,
+                        'content-type': 'application/json',
+                        'user-agent': USER_AGENT,
+                        // One send per link, however often the person inviting submits: keyed by the link,
+                        // as a digest, so the key names no address.
+                        'idempotency-key': createHash('sha256').update(invitation.link, 'utf8').digest('hex'),
+                    },
+                    body: { from: config.from, to: [invitation.to], subject: message.subject, text: message.text, html: message.html },
+                }
+                : {
+                    url: 'https://api.postmarkapp.com/email',
+                    headers: {
+                        'x-postmark-server-token': config.key,
+                        'content-type': 'application/json',
+                        accept: 'application/json',
+                        'user-agent': USER_AGENT,
+                    },
+                    body: {
+                        From: config.from,
+                        To: invitation.to,
+                        Subject: message.subject,
+                        TextBody: message.text,
+                        HtmlBody: message.html,
+                        MessageStream: 'outbound',
+                    },
+                };
+            const response = await fetchImpl(request.url, {
+                method: 'POST',
+                headers: request.headers,
+                body: JSON.stringify(request.body),
+                redirect: 'manual',
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (!response.ok) {
+                // The status alone: a provider's error text can echo the address.
+                throw new SlotlockInvitationEmailError(`${config.provider === 'resend' ? 'Resend' : 'Postmark'} answered HTTP ${response.status}`);
+            }
+        },
+    };
+}

package/lifecycle.d.ts

@@ -0,0 +1,31 @@
+import type { SlotlockChangeType } from './event-feed.js';
+export declare const SLOTLOCK_BOOKING_STATUSES: readonly ["held", "confirmed", "checked_in", "completed", "cancelled", "no_show", "released", "expired", "erased"];
+export type SlotlockBookingStatus = (typeof SLOTLOCK_BOOKING_STATUSES)[number];
+/** What moves a hold or booking, and who does it. */
+export declare const SLOTLOCK_BOOKING_ACTIONS: readonly ["confirm", "release", "expire", "reschedule", "check_in", "cancel", "no_show", "complete", "erase"];
+export type SlotlockBookingAction = (typeof SLOTLOCK_BOOKING_ACTIONS)[number];
+/** Where an end leaves a hold or booking: nothing moves it again, but erasure. */
+export declare const SLOTLOCK_BOOKING_ENDS: ReadonlySet<SlotlockBookingStatus>;
+/** Why a tombstoned reference ended, as `reservation_tombstones.end_reason` keeps it. */
+export type SlotlockEndReason = 'cancelled' | 'no_show' | 'released' | 'expired' | 'erased';
+type Move = {
+    to: SlotlockBookingStatus;
+    change: SlotlockChangeType | readonly SlotlockChangeType[] | null;
+};
+/**
+ * Each allowed move: the status it leads to and the feed change it writes (null: none; a list: all
+ * of them, in order). Anything not here is refused with `SLOTLOCK_BOOKING_REFUSALS`.
+ */
+export declare const SLOTLOCK_BOOKING_TRANSITIONS: Readonly<Record<SlotlockBookingStatus, Readonly<Partial<Record<SlotlockBookingAction, Move>>>>>;
+/** The refusal a move gets from a status it is not allowed from, as the store names it. */
+export declare function slotlockBookingRefusal(from: SlotlockBookingStatus, action: SlotlockBookingAction): string;
+/** What `action` does from `from`: the status it leads to and the change it writes, or its refusal. */
+export declare function slotlockBookingNext(from: SlotlockBookingStatus, action: SlotlockBookingAction): {
+    ok: true;
+    to: SlotlockBookingStatus;
+    changes: readonly SlotlockChangeType[];
+} | {
+    ok: false;
+    code: string;
+};
+export {};

package/lifecycle.js

@@ -0,0 +1,115 @@
+export const SLOTLOCK_BOOKING_STATUSES = Object.freeze([
+    'held',
+    'confirmed',
+    'checked_in',
+    'completed',
+    'cancelled',
+    'no_show',
+    'released',
+    'expired',
+    'erased',
+]);
+/** What moves a hold or booking, and who does it. */
+export const SLOTLOCK_BOOKING_ACTIONS = Object.freeze([
+    /** The holder books the held time (confirmHold, slotlock_confirm_slot). */
+    'confirm',
+    /** The holder lets the hold go (releaseHold, slotlock_release_slots). */
+    'release',
+    /** Its time to live runs out; the next writer in its way reaps it. */
+    'expire',
+    /** A new time or resource, at the next revision (rescheduleExternalReservation). */
+    'reschedule',
+    /** Claimed in person (checkInReservation), from an hour before the start until the end. */
+    'check_in',
+    /** Cancelled at the next revision (cancelExternalReservation). */
+    'cancel',
+    /** Not checked in within the resource's checkInMinutes: maintenance releases it. */
+    'no_show',
+    /** Its end passes: maintenance says so on the feed. */
+    'complete',
+    /** The tenant is erased. */
+    'erase',
+]);
+/** Where an end leaves a hold or booking: nothing moves it again, but erasure. */
+export const SLOTLOCK_BOOKING_ENDS = new Set([
+    'cancelled',
+    'no_show',
+    'released',
+    'expired',
+    'erased',
+]);
+/**
+ * Each allowed move: the status it leads to and the feed change it writes (null: none; a list: all
+ * of them, in order). Anything not here is refused with `SLOTLOCK_BOOKING_REFUSALS`.
+ */
+export const SLOTLOCK_BOOKING_TRANSITIONS = Object.freeze({
+    held: {
+        confirm: { to: 'confirmed', change: 'hold.confirmed' },
+        release: { to: 'released', change: 'hold.released' },
+        expire: { to: 'expired', change: 'hold.expired' },
+        reschedule: { to: 'held', change: 'hold.updated' },
+        erase: { to: 'erased', change: null },
+    },
+    confirmed: {
+        reschedule: { to: 'confirmed', change: ['reservation.updated', 'reservation.rescheduled'] },
+        check_in: { to: 'checked_in', change: 'reservation.checked_in' },
+        cancel: { to: 'cancelled', change: 'reservation.cancelled' },
+        no_show: { to: 'no_show', change: 'reservation.no_show' },
+        complete: { to: 'completed', change: 'reservation.completed' },
+        erase: { to: 'erased', change: null },
+    },
+    checked_in: {
+        reschedule: { to: 'checked_in', change: ['reservation.updated', 'reservation.rescheduled'] },
+        // Checking in again answers the first check-in.
+        check_in: { to: 'checked_in', change: null },
+        cancel: { to: 'cancelled', change: 'reservation.cancelled' },
+        complete: { to: 'completed', change: 'reservation.completed' },
+        erase: { to: 'erased', change: null },
+    },
+    completed: {
+        // A system of record may correct or void a booking after it ended.
+        reschedule: { to: 'completed', change: ['reservation.updated', 'reservation.rescheduled'] },
+        cancel: { to: 'cancelled', change: 'reservation.cancelled' },
+        erase: { to: 'erased', change: null },
+    },
+    cancelled: { erase: { to: 'erased', change: null } },
+    no_show: { erase: { to: 'erased', change: null } },
+    released: {},
+    expired: {},
+    erased: {},
+});
+/** The refusal a move gets from a status it is not allowed from, as the store names it. */
+export function slotlockBookingRefusal(from, action) {
+    const holdAction = action === 'confirm' || action === 'release' || action === 'expire';
+    switch (from) {
+        case 'held':
+            // A hold is not a booking: booking operations do not find it.
+            return 'reservation_not_found';
+        case 'confirmed':
+        case 'checked_in':
+            if (holdAction)
+                return 'hold_not_found';
+            // Only maintenance releases no-shows, and never one checked in.
+            return 'reservation_checked_in';
+        case 'completed':
+            return holdAction ? 'hold_not_found' : 'reservation_ended';
+        case 'cancelled':
+        case 'no_show':
+            // The reference is retired: writing it again is refused, checking it in finds nothing.
+            return action === 'check_in' ? 'reservation_not_found' : holdAction ? 'hold_not_found' : 'reservation_cancelled';
+        case 'released':
+            return action === 'confirm' ? 'hold_not_found' : 'not_found';
+        case 'expired':
+            return action === 'confirm' ? 'hold_expired' : 'not_found';
+        case 'erased':
+            return 'not_found';
+    }
+}
+/** What `action` does from `from`: the status it leads to and the change it writes, or its refusal. */
+export function slotlockBookingNext(from, action) {
+    const move = SLOTLOCK_BOOKING_TRANSITIONS[from][action];
+    if (!move)
+        return { ok: false, code: slotlockBookingRefusal(from, action) };
+    const changes = move.change === null ? [] : typeof move.change === 'string' ? [move.change] : move.change;
+    return { ok: true, to: move.to, changes };
+}

package/maintenance.d.ts

@@ -9,8 +9,8 @@ export interface SlotlockMaintenanceResult {
     refused: number;
     /**
      * Rows deleted: expired holds and their keyed answers; past retention, event idempotency answers,
-     * agent event cancellations, stray booking retirements and feed changes; and expired assistant
-     * conversations. A cancelled booking's tombstone stays.
+     * agent event cancellations, stray booking retirements and feed changes; expired assistant
+     * conversations; and audit events past retention. A cancelled booking's tombstone stays.
      */
     pruned: number;
     /**
@@ -26,6 +26,18 @@ export interface SlotlockMaintenanceResult {
     waitlistOffers: number;
     /** Approvals no one decided in time, their held time freed (`approval.expired`). */
     approvalsExpired: number;
+    /** Bookings whose end has passed in the last week, now said on the feed (`reservation.completed`). */
+    bookingsCompleted: number;
+    /**
+     * Event reminders that came due, each now on the feed once (`reminder.due`) for a sender to send
+     * (RFC 0004 P3).
+     */
+    remindersDue: number;
+    /**
+     * Holiday calendar subscriptions imported again (RFC 0004 B1), with `holidayFetch`; one that
+     * could not be read keeps its closures and is tried again a day later.
+     */
+    holidayCalendarsImported: number;
     /** More was left than one pass does: run another. */
     capped: boolean;
     /**
@@ -49,6 +61,11 @@ export declare function maintainSlotlockTenant(store: SlotlockStore, tenantRef:
      * (SLOTLOCK_USAGE=on).
      */
     usage?: boolean;
+    /**
+     * Fetches holiday calendar subscriptions due to be imported again (the guarded fetch under
+     * `serve`); without it, none is.
+     */
+    holidayFetch?: typeof fetch;
 }): Promise<SlotlockMaintenanceResult>;
 /**
  * Run `work` holding the tenant's maintenance lock on a connection of its own, or return
@@ -83,6 +100,13 @@ export interface SlotlockMaintenanceSchedulerOptions {
     batches?: number;
     /** Roll each tenant's bookings and holds up into its usage, first (maintainSlotlockTenant `usage`). */
     usage?: boolean;
+    /** Fetches holiday calendar subscriptions due to be imported again (maintainSlotlockTenant). */
+    holidayFetch?: typeof fetch;
+    /**
+     * Team workspaces' verified domains looked up again (workspace-domains.ts runSlotlockDomainChecks):
+     * run with each sweep, at most every quarter hour. What it throws goes to onError.
+     */
+    domainChecks?: () => Promise<unknown>;
     /** A pass that ran: counts only, never the tenant. Not awaited; what it throws is ignored. */
     onPass?: (result: SlotlockMaintenanceResult) => void;
     /**