slotlock 0.8.0 → 0.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slotlock",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "type": "module",
   "description": "Resource-first, deterministic calendar and availability engine for AI agents.",
   "license": "Apache-2.0",
@@ -59,6 +59,7 @@
   "dependencies": {
     "ical.js": "2.2.1",
     "rrule": "2.8.1",
+    "tldts": "7.4.19",
     "zod": "4.6.7"
   },
   "peerDependencies": {

package/ranges.d.ts

@@ -0,0 +1,28 @@
+import { type SlotlockBookingRules } from './booking-rules.js';
+import { type SlotlockRankedException } from './hours.js';
+import type { Interval, WeeklyAvailabilityRule } from './types.js';
+/** Candidates one resource's search judges before it gives up. */
+export declare const SLOTLOCK_MAX_RANGE_CANDIDATES = 5000;
+export interface SlotlockRangeSearch {
+    /** Occupied time on the resource (other bookings with their buffers). */
+    busy: readonly Interval[];
+    rules: SlotlockBookingRules | undefined;
+    timezone: string;
+    hours: readonly WeeklyAvailabilityRule[];
+    exceptions?: readonly SlotlockRankedException[];
+    now: Date;
+    /** The start lies from `pickup.start` to `pickup.end`, both included. */
+    pickup: Interval;
+    /** The end lies from `return.start` to `return.end`, both included (or give `days`). */
+    return?: Interval;
+    /** The end is the start's local time this many days later. */
+    days?: number;
+}
+/** The instant `days` local days after `instant`, at the same wall time (a clock change moves it). */
+export declare function sameTimeDaysLater(instant: Date, days: number, timezone: string): Date;
+/**
+ * The earliest range the search allows, or null. Search honours hours always, as slot search does:
+ * a range from one local day to another starts and ends inside the hours, one within a day lies
+ * inside them. Bounded by SLOTLOCK_MAX_RANGE_CANDIDATES judged candidates.
+ */
+export declare function findEarliestRange(search: SlotlockRangeSearch): Interval | null;

package/ranges.js

@@ -0,0 +1,135 @@
+// Hires across days (RFC 0004 B3): the earliest range on one resource that starts in a pick-up
+// window and ends a number of local days later, or in a return window, free throughout with its
+// buffers and allowed by the resource's booking rules. Pure: the caller reads the busy time, the
+// hours and the exceptions; the booking rules' own judge decides each candidate.
+import { bookingBufferAfterMs, bookingBufferBeforeMs, bookingRuleBroken, hoursApplyOf, isMultiDay, nextStepStart, withinDayWindows, } from './booking-rules.js';
+import { mergeIntervals } from './engine.js';
+import { openWindows } from './hours.js';
+import { createTimeZoneConverter, zonedOffsetMinutes } from './timezone.js';
+const MINUTE_MS = 60_000;
+const DAY_MS = 86_400_000;
+/** Candidates one resource's search judges before it gives up. */
+export const SLOTLOCK_MAX_RANGE_CANDIDATES = 5_000;
+/** The instant `days` local days after `instant`, at the same wall time (a clock change moves it). */
+export function sameTimeDaysLater(instant, days, timezone) {
+    const offset = zonedOffsetMinutes(instant, timezone) * MINUTE_MS;
+    return createTimeZoneConverter(timezone).wallFrameToUtc(instant.getTime() + offset + days * DAY_MS);
+}
+/**
+ * The earliest range the search allows, or null. Search honours hours always, as slot search does:
+ * a range from one local day to another starts and ends inside the hours, one within a day lies
+ * inside them. Bounded by SLOTLOCK_MAX_RANGE_CANDIDATES judged candidates.
+ */
+export function findEarliestRange(search) {
+    const { timezone, now } = search;
+    // Judged as a write is, inside the hours always: as the write is held to them where it is
+    // (enforceHours), else at a hire's start and end, what a hire needs.
+    const rules = {
+        ...(search.rules ?? {}),
+        enforceHours: true,
+        hoursApply: search.rules?.hoursApply ?? (search.rules?.enforceHours === true ? hoursApplyOf(search.rules) : 'ends'),
+    };
+    const before = bookingBufferBeforeMs(rules);
+    const after = bookingBufferAfterMs(rules);
+    const busy = mergeIntervals([...search.busy]);
+    const lastEnd = search.return
+        ? search.return.end.getTime()
+        : sameTimeDaysLater(search.pickup.end, search.days ?? 1, timezone).getTime() + DAY_MS;
+    const open = openWindows({
+        hours: search.hours,
+        ...(search.exceptions ? { exceptions: search.exceptions } : {}),
+        timezone,
+        window: { start: new Date(search.pickup.start.getTime() - DAY_MS), end: new Date(lastEnd + DAY_MS) },
+    });
+    const isOpen = (instant, closed = false) => open.some((part) => part.start.getTime() <= instant && (closed ? instant <= part.end.getTime() : instant < part.end.getTime()));
+    const nextOpen = (instant) => open.find((part) => part.end.getTime() > instant)?.start.getTime() ?? null;
+    const step = rules.slotStepMinutes;
+    const offset = step === undefined ? 0 : (rules.stepOffsetMinutes ?? 0) % step;
+    const align = (instant) => step === undefined
+        ? Math.ceil(instant / MINUTE_MS) * MINUTE_MS
+        : nextStepStart(new Date(instant), step, timezone, offset).getTime();
+    const earliest = Math.max(search.pickup.start.getTime(), now.getTime() + (rules.minNoticeMinutes ?? 0) * MINUTE_MS);
+    const latest = Math.min(search.pickup.end.getTime(), rules.maxAdvanceDays === undefined ? Number.POSITIVE_INFINITY : now.getTime() + rules.maxAdvanceDays * DAY_MS);
+    const blocker = (start, end) => busy.find((taken) => taken.start.getTime() < end + after && taken.end.getTime() > start - before);
+    /** The earliest end in the return window a range from `start` may have, or null. */
+    const endFor = (start) => {
+        if (search.days !== undefined)
+            return sameTimeDaysLater(new Date(start), search.days, timezone).getTime();
+        const window = search.return;
+        const lengths = rules.allowedDurations;
+        if (lengths) {
+            for (const minutes of lengths) {
+                const end = start + minutes * MINUTE_MS;
+                if (end >= window.start.getTime() && end <= window.end.getTime() && returnable(start, end))
+                    return end;
+            }
+            return null;
+        }
+        let end = Math.max(window.start.getTime(), start + Math.max(1, rules.minDurationMinutes ?? 1) * MINUTE_MS);
+        end = Math.ceil(end / MINUTE_MS) * MINUTE_MS;
+        for (let tries = 0; end <= window.end.getTime() && tries < 3 * 1_440; tries++) {
+            if (rules.maxDurationMinutes !== undefined && end - start > rules.maxDurationMinutes * MINUTE_MS)
+                return null;
+            if (returnable(start, end))
+                return end;
+            // On to the next return time or opening, else the next minute.
+            const reopening = isOpen(end, true) ? null : nextOpen(end);
+            end = reopening !== null && reopening > end ? reopening : end + MINUTE_MS;
+        }
+        return null;
+    };
+    /** Whether a range may end at `end`: inside the hours at its end, and in a return time for a hire. */
+    const returnable = (start, end) => isOpen(end, true) &&
+        (!rules.returnTimes ||
+            !isMultiDay({ start: new Date(start), end: new Date(end) }, timezone) ||
+            withinDayWindows(new Date(end), rules.returnTimes, timezone, true));
+    /** The next start of a pick-up time at or after `instant`, by the local clock. */
+    const nextPickup = (instant) => {
+        const windows = rules.pickupTimes ?? [];
+        const local = ((((instant + zonedOffsetMinutes(new Date(instant), timezone) * MINUTE_MS) / MINUTE_MS) % 1_440) + 1_440) % 1_440;
+        const ahead = Math.min(...windows.map((window) => (((window.startMinutes - local) % 1_440) + 1_440) % 1_440));
+        return instant + Math.max(1, Math.round(ahead)) * MINUTE_MS;
+    };
+    let candidate = align(earliest);
+    for (let judged = 0; candidate <= latest && judged < SLOTLOCK_MAX_RANGE_CANDIDATES; judged++) {
+        // Start inside the hours, and inside a pick-up time.
+        if (!isOpen(candidate)) {
+            const reopening = nextOpen(candidate);
+            if (reopening === null)
+                return null;
+            candidate = align(Math.max(reopening, candidate + 1));
+            continue;
+        }
+        const end = endFor(candidate);
+        if (end !== null &&
+            rules.pickupTimes &&
+            isMultiDay({ start: new Date(candidate), end: new Date(end) }, timezone) &&
+            !withinDayWindows(new Date(candidate), rules.pickupTimes, timezone)) {
+            candidate = align(nextPickup(candidate));
+            continue;
+        }
+        if (end !== null && end > candidate) {
+            const taken = blocker(candidate, end);
+            if (taken) {
+                candidate = align(Math.max(taken.end.getTime() + before, candidate + 1));
+                continue;
+            }
+            const range = { start: new Date(candidate), end: new Date(end) };
+            if (bookingRuleBroken({
+                rules,
+                timezone,
+                hours: search.hours,
+                ...(search.exceptions ? { exceptions: search.exceptions } : {}),
+                interval: range,
+                now,
+            }) === null) {
+                return range;
+            }
+        }
+        else if (search.return && candidate + (rules.minDurationMinutes ?? 0) * MINUTE_MS > search.return.end.getTime()) {
+            return null;
+        }
+        candidate = align(candidate + MINUTE_MS);
+    }
+    return null;
+}

package/resource-search.d.ts

@@ -0,0 +1,19 @@
+import type { SlotlockResource } from './types.js';
+/** The longest search, and the most words one may have once read. */
+export declare const SLOTLOCK_RESOURCE_SEARCH_MAX = 200;
+/** What a search looks at: a resource as listResources gives it. */
+export type SlotlockSearchableResource = Pick<SlotlockResource, 'id' | 'externalRef' | 'name' | 'description' | 'kind' | 'labels' | 'locationName' | 'location'>;
+/**
+ * A search's words, or `invalid_query` when it is empty, longer than 200 characters or more than 12
+ * words. Filler ("the", "my") is dropped when other words remain.
+ */
+export declare function slotlockResourceSearchWords(query: string): string[];
+/**
+ * The resources that match a search's words, best first, each with its score (0 to 1). A resource is
+ * kept when at least half of the words find it somewhere; one that every word names exactly scores 1.
+ * Ties keep the order the resources were given in.
+ */
+export declare function slotlockSearchResources<T extends SlotlockSearchableResource>(resources: readonly T[], words: readonly string[]): {
+    resource: T;
+    score: number;
+}[];

package/resource-search.js

@@ -0,0 +1,153 @@
+/** The longest search, and the most words one may have once read. */
+export const SLOTLOCK_RESOURCE_SEARCH_MAX = 200;
+const MAX_WORDS = 12;
+/** Words that say nothing about which resource is meant, when others do. */
+const FILLER = new Set(['the', 'a', 'an', 'my', 'our', 'your', 'of', 'for', 'at', 'in', 'on', 'to', 'and', 'with']);
+/** Lower case, accents and other marks taken off: "Zürich" reads as "zurich". */
+const fold = (text) => text.normalize('NFKD').replace(/\p{M}+/gu, '').toLowerCase();
+const wordsOf = (text) => fold(text).split(/[^\p{L}\p{N}]+/u).filter((word) => word !== '');
+/**
+ * A search's words, or `invalid_query` when it is empty, longer than 200 characters or more than 12
+ * words. Filler ("the", "my") is dropped when other words remain.
+ */
+export function slotlockResourceSearchWords(query) {
+    const trimmed = typeof query === 'string' ? query.trim() : '';
+    if (trimmed === '' || [...trimmed].length > SLOTLOCK_RESOURCE_SEARCH_MAX)
+        throw invalidQuery();
+    // Counted as written: repeating a word does not make room for more.
+    const written = wordsOf(trimmed);
+    if (written.length > MAX_WORDS)
+        throw invalidQuery();
+    const words = [...new Set(written)];
+    const meaningful = words.filter((word) => !FILLER.has(word));
+    // Only symbols ("%", "#"): looked for as written.
+    if (words.length === 0)
+        return [fold(trimmed)];
+    return meaningful.length > 0 ? meaningful : words;
+}
+function invalidQuery() {
+    return Object.assign(new Error(`Slotlock resource search must be 1-${String(SLOTLOCK_RESOURCE_SEARCH_MAX)} characters of at most ${String(MAX_WORDS)} words`), { code: 'invalid_query' });
+}
+/** Edits between two words (a swap of neighbours is one), or more than `most` once past it. */
+function distance(a, b, most) {
+    if (Math.abs(a.length - b.length) > most)
+        return most + 1;
+    let before = [];
+    let previous = Array.from({ length: b.length + 1 }, (_, index) => index);
+    for (let i = 1; i <= a.length; i += 1) {
+        const current = [i];
+        let smallest = i;
+        for (let j = 1; j <= b.length; j += 1) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            let value = Math.min(previous[j] + 1, current[j - 1] + 1, previous[j - 1] + cost);
+            if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+                value = Math.min(value, before[j - 2] + 1);
+            }
+            current[j] = value;
+            smallest = Math.min(smallest, value);
+        }
+        if (smallest > most)
+            return most + 1;
+        before = previous;
+        previous = current;
+    }
+    return previous[b.length];
+}
+const DIGITS = /^\p{N}+$/u;
+/**
+ * The most edit distances one search computes: past it, matching is exact, by prefix and by words
+ * run together only. A tenant's resources (up to 5,000, each with a long description) cannot make
+ * one search cost seconds.
+ */
+const FUZZY_BUDGET = 20_000;
+/** A description is looked through by its first words only. */
+const DESCRIPTION_WORDS = 60;
+/**
+ * How well one word of a search names a field (0 to 1), given the field's words and those run
+ * together. Typos are forgiven only where `fuzzy`, and only while `budget` lasts.
+ */
+function wordScore(word, field, fuzzy, budget) {
+    let best = 0;
+    for (const candidate of field.words) {
+        if (candidate === word)
+            return 1;
+        if (word.length >= 2 && candidate.startsWith(word))
+            best = Math.max(best, 0.85);
+    }
+    // "mercedesbenz" for "Mercedes-Benz", "car17" for "car-17".
+    if (word.length >= 3 && field.joined.includes(word))
+        best = Math.max(best, 0.75);
+    if (fuzzy && best < 0.7 && !DIGITS.test(word) && word.length >= 4 && word.length <= 24) {
+        const most = word.length >= 8 ? 2 : 1;
+        for (const candidate of field.words) {
+            if (DIGITS.test(candidate) || candidate.length > 32)
+                continue;
+            if (budget.left <= 0)
+                break;
+            budget.left -= 2;
+            const edits = distance(word, candidate, most);
+            if (edits <= most)
+                best = Math.max(best, edits === 1 ? 0.7 : 0.6);
+            // A typo in a word cut short: "merced" for "mercedes" is a prefix; "mercad" is one edit off one.
+            if (candidate.length > word.length && distance(word, candidate.slice(0, word.length), 1) <= 1) {
+                best = Math.max(best, 0.6);
+            }
+        }
+    }
+    return best;
+}
+/** How much a match in each field counts (a name most, a description least), and whether typos are forgiven there. */
+const FIELDS = [
+    ['name', 1, true],
+    ['ref', 0.95, true],
+    ['labels', 0.7, true],
+    ['kind', 0.6, true],
+    ['location', 0.6, true],
+    ['description', 0.4, false],
+];
+const indexed = (text, most = Number.POSITIVE_INFINITY) => {
+    const words = text ? wordsOf(text).slice(0, most) : [];
+    return { words, joined: words.join('') };
+};
+/**
+ * The resources that match a search's words, best first, each with its score (0 to 1). A resource is
+ * kept when at least half of the words find it somewhere; one that every word names exactly scores 1.
+ * Ties keep the order the resources were given in.
+ */
+export function slotlockSearchResources(resources, words) {
+    if (words.length === 0)
+        return [];
+    const budget = { left: FUZZY_BUDGET };
+    const scored = [];
+    resources.forEach((resource, at) => {
+        const fields = {
+            name: indexed(resource.name),
+            ref: indexed(resource.externalRef),
+            labels: indexed(resource.labels?.join(' ')),
+            kind: indexed(resource.kind),
+            location: indexed(resource.locationName ?? resource.location),
+            description: indexed(resource.description, DESCRIPTION_WORDS),
+        };
+        let total = 0;
+        let found = 0;
+        for (const word of words) {
+            let best = 0;
+            for (const [field, weight, fuzzy] of FIELDS)
+                best = Math.max(best, weight * wordScore(word, fields[field], fuzzy, budget));
+            // A search of symbols only ("%"): looked for as written in the name and reference.
+            if (best === 0 && !/[\p{L}\p{N}]/u.test(word)) {
+                if (fold(`${resource.name ?? ''} ${resource.externalRef ?? ''}`).includes(word))
+                    best = 1;
+            }
+            total += best;
+            if (best >= 0.3)
+                found += 1;
+        }
+        const score = total / words.length;
+        if (found * 2 >= words.length && score >= 0.3)
+            scored.push({ resource, score, at });
+    });
+    return scored
+        .sort((a, b) => b.score - a.score || a.at - b.at)
+        .map(({ resource, score }) => ({ resource, score: Math.round(score * 100) / 100 }));
+}

package/rest-api.js

@@ -14,7 +14,14 @@ export const SLOTLOCK_REST_ROUTES = Object.freeze([
         operation: 'slotlock_find_available_slots',
         refusals: [404],
     },
+    {
+        method: 'GET',
+        path: '/v1/available-ranges',
+        operation: 'slotlock_find_available_ranges',
+        refusals: [404, 409],
+    },
     { method: 'POST', path: '/v1/slot-holds', operation: 'slotlock_hold_slots', refusals: [409] },
+    { method: 'POST', path: '/v1/slot-holds/together', operation: 'slotlock_hold_together', refusals: [404, 409] },
     { method: 'POST', path: '/v1/bundles', operation: 'slotlock_book_together', refusals: [404, 409] },
     { method: 'POST', path: '/v1/pool-bookings', operation: 'slotlock_book_pool', refusals: [404, 409] },
     {

package/rules.d.ts

@@ -9,6 +9,8 @@ export declare const SLOTLOCK_CALENDAR_HORIZON_DAYS = 367;
  * many days as a rule lasts, so a longer one is skipped, as the hours validator refuses it.
  */
 export declare const SLOTLOCK_MAX_RULE_DURATION_MINUTES = 10080;
+/** The most busy intervals one calendar source may report for one window (RFC 0004 C1). */
+export declare const SLOTLOCK_SOURCE_BUSY_MAX = 5000;
 export declare function invalidWindowError(message?: string): Error & {
     code: 'invalid_window';
 };

package/rules.js

@@ -17,6 +17,8 @@ const MAX_SEARCH_WINDOW_MS = SLOTLOCK_CALENDAR_HORIZON_DAYS * DAY_MS;
  * many days as a rule lasts, so a longer one is skipped, as the hours validator refuses it.
  */
 export const SLOTLOCK_MAX_RULE_DURATION_MINUTES = 10_080;
+/** The most busy intervals one calendar source may report for one window (RFC 0004 C1). */
+export const SLOTLOCK_SOURCE_BUSY_MAX = 5_000;
 export function invalidWindowError(message = 'Slotlock window must contain two finite dates with end > start') {
     return Object.assign(new Error(message), { code: 'invalid_window' });
 }

package/scim-server.d.ts

@@ -0,0 +1,19 @@
+import type { SlotlockAuditEventInput } from './store.js';
+import type { SlotlockWorkspaceScim } from './workspace-scim.js';
+/** What the endpoint needs from its host. */
+export interface SlotlockScimServerOptions {
+    scim: SlotlockWorkspaceScim;
+    /** Where `scim/v2` lives: the dashboard's public root. */
+    publicRoot: string;
+    documentationUri: string;
+    /** Records an event in a team's audit log. */
+    record?: (tenantRef: string, event: SlotlockAuditEventInput) => Promise<void>;
+    /** A person's membership ended by the directory: their keys go where the team chose. */
+    deactivated?: (tenantRef: string, person: string, keyPolicy: 'keep' | 'revoke') => Promise<number>;
+    newId?: () => string;
+}
+/**
+ * One SCIM request. `path` is what follows `scim/v2/`: `<team id>/<resource>[/<id>]`. Answers 401
+ * without a token for the team the address names.
+ */
+export declare function handleSlotlockScimRequest(request: Request, path: string, options: SlotlockScimServerOptions): Promise<Response>;

package/scim-server.js

@@ -0,0 +1,243 @@
+// A team's SCIM 2.0 endpoint (teams phase 5.6–5.7): `<root>/scim/v2/<team id>/…`, on the dashboard's
+// Worker and on the Node server alike. The token decides the team, and must be the one the address
+// names; session cookies never work here, nor SCIM tokens on the dashboard. Requests are parsed and
+// normalised by scim.ts, kept through workspace-scim.ts, and each write is one event in the team's
+// audit log, as its token's (never a body: Okta sends a placeholder password).
+import { randomUUID } from 'node:crypto';
+import { SLOTLOCK_SCIM_CONTENT_TYPE, SlotlockScimError, slotlockScimErrorBody, slotlockScimFilter, slotlockScimGroupFromBody, slotlockScimGroupResource, slotlockScimList, slotlockScimPage, slotlockScimPatchGroup, slotlockScimPatchOperations, slotlockScimPatchUser, slotlockScimResourceTypes, slotlockScimSchemas, slotlockScimServiceProviderConfig, slotlockScimUserFromBody, slotlockScimUserResource, } from './scim.js';
+const USER_FILTERS = ['username', 'externalid', 'id', 'emails[type eq "work"].value', 'emails.value'];
+const GROUP_FILTERS = ['displayname', 'externalid', 'id'];
+const MAX_BODY_BYTES = 262_144;
+const json = (status, body, headers = {}) => new Response(status === 204 ? null : JSON.stringify(body), {
+    status,
+    headers: { 'content-type': `${SLOTLOCK_SCIM_CONTENT_TYPE}; charset=utf-8`, 'cache-control': 'no-store', ...headers },
+});
+const failure = (status, scimType, detail) => json(status, slotlockScimErrorBody(status, scimType, detail));
+/** How a refusal from the database answers. */
+function refused(refusal) {
+    switch (refusal) {
+        case 'uniqueness':
+            return failure(409, 'uniqueness', 'A resource with that name exists');
+        case 'domain_not_verified':
+            return failure(400, 'invalidValue', 'The address is not at a domain this team has verified');
+        case 'owner_protected':
+            return failure(400, 'mutability', 'Owners are managed in Slotlock, not by the directory');
+        case 'invalid_member':
+            return failure(400, 'invalidValue', 'A member is not one of this team’s users');
+        case 'not_found':
+            return failure(404, null, 'Not found');
+        default:
+            return failure(400, 'invalidValue', refusal);
+    }
+}
+/** The lookup a filter asks for, as workspace-scim.ts takes it. */
+function lookupOf(query, allowed) {
+    const filter = query.get('filter');
+    if (filter === null || filter.trim() === '')
+        return null;
+    const [first, ...rest] = slotlockScimFilter(filter, allowed);
+    if (!first || rest.length > 0)
+        throw new SlotlockScimError(400, 'invalidFilter', 'Slotlock filters by one attribute');
+    const attribute = first.attribute.startsWith('emails') ? 'email' : first.attribute;
+    return { attribute, value: first.value };
+}
+async function bodyOf(request) {
+    const type = (request.headers.get('content-type') ?? '').split(';')[0]?.trim().toLowerCase();
+    if (type !== SLOTLOCK_SCIM_CONTENT_TYPE && type !== 'application/json')
+        throw new SlotlockScimError(415, null, 'Send application/scim+json');
+    // Counted in bytes as it arrives, never read past the cap: a token's holder cannot make the server
+    // buffer an endless body.
+    const tooLarge = () => new SlotlockScimError(413, null, 'The request is too large');
+    const declared = Number(request.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+        await request.body?.cancel().catch(() => undefined);
+        throw tooLarge();
+    }
+    const chunks = [];
+    let size = 0;
+    const reader = request.body?.getReader();
+    if (reader) {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > MAX_BODY_BYTES) {
+                await reader.cancel().catch(() => undefined);
+                throw tooLarge();
+            }
+            chunks.push(value);
+        }
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    let text;
+    try {
+        text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new SlotlockScimError(400, 'invalidSyntax', 'The body is not UTF-8');
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new SlotlockScimError(400, 'invalidSyntax', 'The body is not JSON');
+    }
+}
+/**
+ * One SCIM request. `path` is what follows `scim/v2/`: `<team id>/<resource>[/<id>]`. Answers 401
+ * without a token for the team the address names.
+ */
+export async function handleSlotlockScimRequest(request, path, options) {
+    const [teamId = '', resource = '', id, ...extra] = path.split('/');
+    const authorization = request.headers.get('authorization') ?? '';
+    const token = /^Bearer\s+(\S+)$/i.exec(authorization)?.[1] ?? '';
+    const authenticated = await options.scim.authenticate(token, teamId);
+    if ('refusal' in authenticated) {
+        // Another team's token at this address: a security event, in the token's own team's log.
+        if (authenticated.refusal === 'wrong_workspace' && authenticated.tenantRef && options.record) {
+            await options.record(authenticated.tenantRef, {
+                action: 'scim.token_refused',
+                actorType: 'system',
+                actorRef: `scim_token:${authenticated.prefix ?? 'unknown'}`,
+                outcome: 'denied',
+                reason: 'wrong_workspace',
+            }).catch(() => undefined);
+        }
+        return json(401, slotlockScimErrorBody(401, null, 'A SCIM token for this team is needed'), { 'www-authenticate': 'Bearer' });
+    }
+    const { tenantRef, prefix, keyPolicy } = authenticated;
+    const base = `${options.publicRoot}/scim/v2/${teamId.toLowerCase()}`;
+    const actor = { actorType: 'system', actorRef: `scim_token:${prefix}` };
+    const record = async (event) => {
+        await options.record?.(tenantRef, { ...event, ...actor }).catch(() => undefined);
+    };
+    const newId = options.newId ?? randomUUID;
+    const url = new URL(request.url);
+    const method = request.method.toUpperCase();
+    if (extra.length > 0)
+        return failure(404, null, 'Not found');
+    try {
+        if (resource === 'ServiceProviderConfig' && method === 'GET')
+            return json(200, slotlockScimServiceProviderConfig(options.documentationUri));
+        if (resource === 'ResourceTypes' && method === 'GET')
+            return json(200, slotlockScimResourceTypes(base));
+        if (resource === 'Schemas' && method === 'GET')
+            return json(200, slotlockScimSchemas(base));
+        if (resource === 'Users') {
+            const meta = (user) => ({ created: user.createdAt, lastModified: user.updatedAt, location: `${base}/Users/${user.id}` });
+            const one = async (userId) => (await options.scim.users(tenantRef, null, 1, 1, userId)).users[0];
+            if (id === undefined && method === 'GET') {
+                const { startIndex, count } = slotlockScimPage(url.searchParams);
+                const found = await options.scim.users(tenantRef, lookupOf(url.searchParams, USER_FILTERS), startIndex, count);
+                return json(200, slotlockScimList(found.users.map((user) => slotlockScimUserResource(user.id, user, meta(user))), found.total, startIndex));
+            }
+            if (id === undefined && method === 'POST') {
+                const user = slotlockScimUserFromBody(await bodyOf(request));
+                const saved = await options.scim.putUser(tenantRef, null, newId(), user);
+                if ('refusal' in saved)
+                    return refused(saved.refusal);
+                await record({ action: 'scim.user_created', targetType: 'scim_user', targetRef: saved.id });
+                const made = await one(saved.id);
+                return made ? json(201, slotlockScimUserResource(made.id, made, meta(made)), { location: `${base}/Users/${made.id}` }) : failure(404, null, 'Not found');
+            }
+            if (id === undefined)
+                return failure(405, null, 'Not allowed');
+            const current = await one(id);
+            if (!current)
+                return failure(404, null, 'Not found');
+            if (method === 'GET')
+                return json(200, slotlockScimUserResource(current.id, current, meta(current)));
+            if (method === 'DELETE') {
+                const deleted = await options.scim.deleteUser(tenantRef, id);
+                if (deleted.refusal)
+                    return refused(deleted.refusal);
+                await record({ action: 'scim.user_deleted', targetType: 'scim_user', targetRef: id });
+                if (deleted.person)
+                    await options.deactivated?.(tenantRef, deleted.person, keyPolicy);
+                return json(204, null);
+            }
+            if (method === 'PUT' || method === 'PATCH') {
+                const user = method === 'PUT'
+                    ? slotlockScimUserFromBody(await bodyOf(request))
+                    : slotlockScimPatchUser(current, current.id, slotlockScimPatchOperations(await bodyOf(request)));
+                const saved = await options.scim.putUser(tenantRef, id, newId(), user);
+                if ('refusal' in saved) {
+                    if (saved.refusal === 'owner_protected') {
+                        await record({ action: 'scim.user_refused', targetType: 'scim_user', targetRef: id, outcome: 'denied', reason: 'owner_protected' });
+                    }
+                    return refused(saved.refusal);
+                }
+                if (saved.membership === 'deactivated' && saved.person) {
+                    const revoked = (await options.deactivated?.(tenantRef, saved.person, keyPolicy)) ?? 0;
+                    await record({ action: 'scim.user_deactivated', targetType: 'person', targetRef: saved.person, metadata: { keys: keyPolicy, revoked } });
+                }
+                else if (saved.membership === 'activated' && saved.person) {
+                    await record({ action: 'scim.user_reactivated', targetType: 'person', targetRef: saved.person });
+                }
+                else {
+                    await record({ action: 'scim.user_updated', targetType: 'scim_user', targetRef: id });
+                }
+                const updated = await one(id);
+                return updated ? json(200, slotlockScimUserResource(updated.id, updated, meta(updated))) : failure(404, null, 'Not found');
+            }
+            return failure(405, null, 'Not allowed');
+        }
+        if (resource === 'Groups') {
+            const meta = (group) => ({ created: group.createdAt, lastModified: group.updatedAt, location: `${base}/Groups/${group.id}` });
+            const withMembers = !/\bmembers\b/i.test(url.searchParams.get('excludedAttributes') ?? '');
+            const one = async (groupId) => (await options.scim.groups(tenantRef, null, 1, 1, groupId)).groups[0];
+            if (id === undefined && method === 'GET') {
+                const { startIndex, count } = slotlockScimPage(url.searchParams);
+                const found = await options.scim.groups(tenantRef, lookupOf(url.searchParams, GROUP_FILTERS), startIndex, count);
+                return json(200, slotlockScimList(found.groups.map((group) => slotlockScimGroupResource(group.id, group, meta(group), withMembers)), found.total, startIndex));
+            }
+            if (id === undefined && method === 'POST') {
+                const group = slotlockScimGroupFromBody(await bodyOf(request));
+                const saved = await options.scim.putGroup(tenantRef, null, newId(), group);
+                if ('refusal' in saved)
+                    return refused(saved.refusal);
+                await record({ action: 'scim.group_created', targetType: 'scim_group', targetRef: saved.id, metadata: { members: group.members.length } });
+                const made = await one(saved.id);
+                return made ? json(201, slotlockScimGroupResource(made.id, made, meta(made)), { location: `${base}/Groups/${made.id}` }) : failure(404, null, 'Not found');
+            }
+            if (id === undefined)
+                return failure(405, null, 'Not allowed');
+            const current = await one(id);
+            if (!current)
+                return failure(404, null, 'Not found');
+            if (method === 'GET')
+                return json(200, slotlockScimGroupResource(current.id, current, meta(current), withMembers));
+            if (method === 'DELETE') {
+                const refusal = await options.scim.deleteGroup(tenantRef, id);
+                if (refusal)
+                    return refused(refusal);
+                await record({ action: 'scim.group_deleted', targetType: 'scim_group', targetRef: id });
+                return json(204, null);
+            }
+            if (method === 'PUT' || method === 'PATCH') {
+                const group = method === 'PUT'
+                    ? slotlockScimGroupFromBody(await bodyOf(request))
+                    : slotlockScimPatchGroup(current, current.id, slotlockScimPatchOperations(await bodyOf(request)));
+                const saved = await options.scim.putGroup(tenantRef, id, newId(), group);
+                if ('refusal' in saved)
+                    return refused(saved.refusal);
+                await record({ action: 'scim.group_updated', targetType: 'scim_group', targetRef: id, metadata: { members: group.members.length } });
+                const updated = await one(id);
+                return updated ? json(200, slotlockScimGroupResource(updated.id, updated, meta(updated), withMembers)) : failure(404, null, 'Not found');
+            }
+            return failure(405, null, 'Not allowed');
+        }
+        return failure(404, null, 'Not found');
+    }
+    catch (error) {
+        if (error instanceof SlotlockScimError)
+            return failure(error.status, error.scimType, error.message);
+        throw error;
+    }
+}