slotlock 0.8.0 → 0.10.0

package/self-host.js

@@ -3,7 +3,7 @@
 // supplies it the same way and nothing is read from a file or a request. A missing or weak secret
 // stops a command before it connects anywhere, and no secret is written to a log line or an error.
 // The one exception is the API key `key create` prints: that output is the key's only copy.
-import { createSlotlockWebhookSender, deliverSlotlockWebhooks, startSlotlockWebhookDelivery, } from './webhooks.js';
+import { createSlotlockGuardedFetch, createSlotlockWebhookSender, deliverSlotlockWebhooks, startSlotlockWebhookDelivery, } from './webhooks.js';
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { parseArgs } from 'node:util';
 import postgres from 'postgres';
@@ -12,15 +12,22 @@ import { createSlotlockStoreAgentBackend, createSlotlockStoreApplicationBackend,
 import { SLOTLOCK_API_KEY_DEFAULT_SCOPES, SLOTLOCK_API_KEY_MAX_LIFETIME_DAYS, SLOTLOCK_API_KEY_SCOPES, createSlotlockApiKeyAuthenticator, createSlotlockApiKeyStore, SLOTLOCK_TEST_TENANT_SUFFIX, slotlockBearerCredential, slotlockLiveTenant, } from './api-keys.js';
 import { SLOTLOCK_SANDBOX_MAX_RACERS, SLOTLOCK_SANDBOX_SCENARIOS, fastForwardSlotlockSandbox, raceSlotlockSandbox, resetSlotlockSandbox, seedSlotlockSandbox, } from './sandbox.js';
 import { createSlotlockDashboard, createSlotlockDashboardResources, createSlotlockAcceptanceRecords, createSlotlockDashboardState, } from './dashboard.js';
-import { SECRET_HINT, SlotlockConfigError, formatSlotlockRate, optional, readAvailability, readDashboardConfig, readDashboardOrganizations, readDashboardUsers, readLimits, readSecret, readServerUrl, readTrustedProxyHeader, readTrustedProxySecret, slotlockKeySubscriptions, } from './config.js';
+import { SECRET_HINT, SlotlockConfigError, formatSlotlockRate, optional, readAvailability, readDashboardConfig, readDashboardOrganizations, readDashboardTeamWorkspaces, readDashboardUsers, readVerifiedDomains, readLimits, readSecret, readServerUrl, readTrustedProxyHeader, readTrustedProxySecret, slotlockKeySubscriptions, } from './config.js';
 import { parseBookingRules } from './booking-rules.js';
 import { slotlockApplicationOperation, slotlockApplicationScope, } from './application-api.js';
 import { SLOTLOCK_ACCOUNT_FIELD, createSlotlockPartnerKey, createSlotlockPartnerKeyAuthenticator, createSlotlockPartnerStore, listSlotlockPartners, putSlotlockPartner, revokeSlotlockPartnerKey, setSlotlockPartnerBilling, setSlotlockPartnerStatus, slotlockPartnerContractJson, } from './partners.js';
 import { closeSlotlockPartnerMonth, slotlockClientLabel, slotlockPreviousMonth } from './partner-billing.js';
 import { createSlotlockDashboardTeams, createSlotlockOrganizationCheck } from './teams.js';
+import { createSlotlockDashboardWorkspaces, createSlotlockWorkspaceCheck } from './workspaces.js';
+import { createSlotlockWorkspaceDomains, runSlotlockDomainChecks } from './workspace-domains.js';
+import { slotlockDomainResolvers } from './domains.js';
+import { createSlotlockSecretBox } from './oidc.js';
+import { createSlotlockInvitationEmailSender } from './invitation-email.js';
 import { SLOTLOCK_DEFAULT_OVERAGE_STOP_PERCENT, reportSlotlockOverage, slotlockMonthOf } from './overage.js';
 import { createSlotlockOtlpExporter, createSlotlockOtlpMetricsExporter, readSlotlockOtlpConfig, } from './otel.js';
-import { readFile } from 'node:fs/promises';
+import { appendFile, mkdir, readdir, readFile } from 'node:fs/promises';
+import { join as joinPath } from 'node:path';
+import { readSlotlockHolidayCalendar } from './holiday-import.js';
 import { SLOTLOCK_DASHBOARD_FUNCTIONS, SLOTLOCK_QUOTA_FUNCTIONS, SLOTLOCK_TENANT_TABLES, SLOTLOCK_USAGE_FUNCTIONS, } from './ddl.js';
 import { maintainSlotlockTenant, startSlotlockMaintenance, withSlotlockMaintenanceLock, } from './maintenance.js';
 import { createSlotlockNodeServer, } from './node-server.js';
@@ -31,7 +38,7 @@ import { isSlotlockResourceScope } from './resource-profile.js';
 import { createSlotlockQuotas, noteSlotlockQuotaThreshold, readSlotlockQuotaUse } from './quotas.js';
 import { createSlotlockRequestLimits } from './rate-limit.js';
 import { createSlotlockUsageMeter, recordSlotlockUsage } from './usage.js';
-import { assertSlotlockSchemaCurrent, createSlotlockStore, } from './store.js';
+import { assertSlotlockSchemaCurrent, createSlotlockStore, slotlockAuditEventRecord, } from './store.js';
 import { parseAvailabilityRules } from './weekly-hours.js';
 export { SlotlockConfigError };
 /**
@@ -75,9 +82,18 @@ export const SLOTLOCK_ENVIRONMENT_VARIABLES = Object.freeze([
     'SLOTLOCK_ASSISTANT_PRIVATE_URLS',
     'SLOTLOCK_DASHBOARD_USERS',
     'SLOTLOCK_DASHBOARD_ORGS',
+    'SLOTLOCK_DASHBOARD_TEAM_WORKSPACES',
     'SLOTLOCK_DASHBOARD_NAME',
     'SLOTLOCK_DASHBOARD_TERMS_URL',
     'SLOTLOCK_DASHBOARD_PRIVACY_URL',
+    'SLOTLOCK_INVITATION_EMAIL',
+    'SLOTLOCK_INVITATION_EMAIL_KEY',
+    'SLOTLOCK_INVITATION_EMAIL_FROM',
+    'SLOTLOCK_VERIFIED_DOMAINS',
+    'SLOTLOCK_DNS_RESOLVER',
+    'SLOTLOCK_TEAM_SSO',
+    'SLOTLOCK_SSO_SECRET',
+    'SLOTLOCK_TEAM_SCIM',
     'HOST',
     'PORT',
 ]);
@@ -114,7 +130,9 @@ const SERVED_OPERATIONS = new Set([
     'slotlock_get_free_busy',
     'slotlock_find_next_available',
     'slotlock_find_available_slots',
+    'slotlock_find_available_ranges',
     'slotlock_hold_slots',
+    'slotlock_hold_together',
     'slotlock_release_slots',
     'slotlock_book_together',
     'slotlock_book_pool',
@@ -355,6 +373,11 @@ export function readSlotlockServeConfig(env) {
     const organizations = readDashboardOrganizations(env);
     if (organizations !== undefined)
         config.organizations = organizations;
+    if (readDashboardTeamWorkspaces(env))
+        config.teamWorkspaces = true;
+    const verifiedDomains = readVerifiedDomains(env);
+    if (verifiedDomains !== undefined)
+        config.verifiedDomains = verifiedDomains;
     const allowedUsers = dashboard?.allowedUsers ?? readDashboardUsers(env);
     if (allowedUsers !== undefined)
         config.allowedUsers = allowedUsers;
@@ -607,13 +630,19 @@ function serveMetrics(target, metrics, path, token) {
 }
 /**
  * Whether the dashboard's allowlists let a tenant act, wherever the dashboard runs: a
- * `github-org:<id>` tenant only while SLOTLOCK_DASHBOARD_ORGS lists that organization; a
- * `github:<id>` tenant only while SLOTLOCK_DASHBOARD_USERS is `*` or lists that id; every tenant when
- * SLOTLOCK_DASHBOARD_USERS is not set, and every other tenant.
+ * `github-org:<id>` tenant only while SLOTLOCK_DASHBOARD_ORGS lists that organization; a `team:<id>`
+ * tenant only with SLOTLOCK_DASHBOARD_TEAM_WORKSPACES=on (and, as serve's authenticate asks, while
+ * it exists); a `github:<id>` tenant only while SLOTLOCK_DASHBOARD_USERS is `*` or lists that id;
+ * every tenant when SLOTLOCK_DASHBOARD_USERS is not set, and every other tenant.
  */
 export function slotlockServeAllowsTenant(config, tenantRef) {
     // A test environment (RFC 0003 G9) is let through exactly as its live tenant.
     const live = slotlockLiveTenant(tenantRef);
+    if (live.startsWith('team:'))
+        return config.teamWorkspaces === true;
+    // A person a team's identity provider made has no workspace of their own, so no keys of one.
+    if (live.startsWith('sso:'))
+        return false;
     const orgId = /^github-org:(\d+)$/.exec(live)?.[1];
     // With `enabled`, the database decides, as serve's authenticate asks (createSlotlockOrganizationCheck).
     if (orgId !== undefined)
@@ -818,6 +847,8 @@ export async function startSlotlockServer(config, log) {
             : undefined;
         // Teams on Cloud: an organization's keys work while an owner has it turned on.
         const organizationEnabled = config.organizations === 'enabled' ? createSlotlockOrganizationCheck(sql) : null;
+        // Team workspaces: a team's keys work while it exists.
+        const teamActive = config.teamWorkspaces ? createSlotlockWorkspaceCheck(sql) : null;
         const limits = createSlotlockRequestLimits({
             limits: config.limits,
             ...(config.sharedLimits
@@ -853,6 +884,8 @@ export async function startSlotlockServer(config, log) {
                 const orgId = organizationEnabled ? /^github-org:(\d+)$/.exec(slotlockLiveTenant(principal.tenantRef))?.[1] : undefined;
                 if (orgId !== undefined && !(await organizationEnabled?.(orgId)))
                     return null;
+                if (slotlockLiveTenant(principal.tenantRef).startsWith('team:') && !(await teamActive?.(principal.tenantRef)))
+                    return null;
                 // Slotlock-Account is a partner key's alone (RFC 0003 P3): with any other credential, or one
                 // that could not act for that account, the request is refused rather than run elsewhere.
                 if (request.headers.has(SLOTLOCK_ACCOUNT_FIELD) && principal.onBehalfOf === undefined)
@@ -929,6 +962,8 @@ export async function startSlotlockServer(config, log) {
                             maxTenantResources: SERVE_MAX_TENANT_RESOURCES,
                             // A granted approval's booking is made as an agent's would be (RFC 0004 A4).
                             agentBackend,
+                            // Holiday calendars by URL (RFC 0004 B1), never from a private address.
+                            holidayFetch: createSlotlockGuardedFetch(),
                             partners: createSlotlockPartnerStore(sql, {
                                 keys: createSlotlockApiKeyStore(sql),
                                 eraseTenant: (tenantRef) => store.eraseTenant({ tenantRef }),
@@ -974,9 +1009,28 @@ export async function startSlotlockServer(config, log) {
                     ? { organizations: config.dashboard.organizations }
                     : {}),
                 ...(config.dashboard.organizations === 'enabled' ? { teams: createSlotlockDashboardTeams(sql) } : {}),
+                ...(config.dashboard.teamWorkspaces ? { teamWorkspaces: true } : {}),
+                ...(config.dashboard.verifiedDomains
+                    ? { domains: { resolvers: slotlockDomainResolvers(config.dashboard.verifiedDomains.resolver) } }
+                    : {}),
+                // Teams' single sign-on: their Owners' URLs fetched never from a private address.
+                ...(config.dashboard.teamSso
+                    ? { sso: { secretBox: createSlotlockSecretBox(config.dashboard.teamSso.secret), fetch: createSlotlockGuardedFetch() } }
+                    : {}),
+                ...(config.dashboard.teamScim ? { scim: true } : {}),
+                ...(config.dashboard.invitationEmail
+                    ? {
+                        invitations: createSlotlockInvitationEmailSender(config.dashboard.invitationEmail, {
+                            ...(config.dashboard.name ? { brandName: config.dashboard.name } : {}),
+                        }),
+                    }
+                    : {}),
                 keys: createSlotlockApiKeyStore(sql),
-                resources: createSlotlockDashboardResources(store, { agentBackend }),
+                // Holiday calendars by address (RFC 0004 B1), never from a private address.
+                resources: createSlotlockDashboardResources(store, { agentBackend, holidayFetch: createSlotlockGuardedFetch() }),
                 state: createSlotlockDashboardState(sql),
+                // Roles from the database on every request, and "Sign out everywhere" (workspaces.ts).
+                workspaces: createSlotlockDashboardWorkspaces(sql),
                 availability: config.availability,
                 ...(config.usage ? { usage: true } : {}),
                 ...(config.quotas ? { quotas: true } : {}),
@@ -1037,6 +1091,23 @@ export async function startSlotlockServer(config, log) {
           SELECT slotlock.maintenance_tenants(${after}::text) AS tenant`),
             intervalMs: SERVE_MAINTENANCE_INTERVAL_MS,
             ...(config.usage ? { usage: true } : {}),
+            // Holiday calendar subscriptions (RFC 0004 B1), never from a private address.
+            holidayFetch: createSlotlockGuardedFetch(),
+            // Team workspaces' verified domains, looked up again each day; each change in the team's audit log.
+            ...(config.verifiedDomains
+                ? {
+                    domainChecks: (() => {
+                        const domains = createSlotlockWorkspaceDomains(sql);
+                        const resolvers = slotlockDomainResolvers(config.verifiedDomains.resolver);
+                        const audit = createSlotlockStore(sql, retention);
+                        return () => runSlotlockDomainChecks({
+                            domains,
+                            resolvers,
+                            record: (tenantRef, event) => audit.withTenant(tenantRef, (tenant) => tenant.recordAuditEvent({ tenantRef, event })).then(() => undefined),
+                        });
+                    })(),
+                }
+                : {}),
             // Counts only, never the tenant.
             onPass: (result) => {
                 metrics?.maintenance(result);
@@ -1250,8 +1321,243 @@ function hoursLine(resource) {
         external_ref: resource.externalRef,
         timezone: resource.timezone,
         hours: resource.availabilityRules ?? null,
+        inherited: resource.inheritedAvailability ?? null,
     })}\n`;
 }
+/**
+ * `tenant export [--out <dir>]` (RFC 0004 D3): everything the tenant keeps, read in one snapshot and
+ * stored nowhere: JSON lines on stdout, or one NDJSON file a table in a new or empty directory.
+ * Prints what it wrote, and records it in the audit log.
+ */
+async function runTenantExport(config, io, out) {
+    if (out !== undefined) {
+        await mkdir(out, { recursive: true });
+        if ((await readdir(out)).length > 0) {
+            io.stderr.write(`slotlock: ${out} is not empty: export into a new or empty directory\n`);
+            return 1;
+        }
+    }
+    const sql = connect(config.databaseUrl, 1);
+    try {
+        const store = createSlotlockStore(sql);
+        const tenantRef = config.tenantRef;
+        const totals = await store.withTenant(tenantRef, async (tenant) => {
+            const read = await tenant.streamTenantExport({
+                tenantRef,
+                onPart: async ({ table, lines }) => {
+                    if (out !== undefined) {
+                        await appendFile(joinPath(out, `${table}.ndjson`), `${lines.join('\n')}\n`, { mode: 0o600 });
+                    }
+                    else {
+                        io.stdout.write(lines.map((line) => `{"table":${JSON.stringify(table)},"row":${line}}\n`).join(''));
+                    }
+                },
+            });
+            await tenant.recordAuditEvent({
+                tenantRef,
+                event: { action: 'export.created', actorType: 'system', actorRef: 'cli', targetType: 'export', metadata: { rows: read.rows } },
+            });
+            return read;
+        });
+        if (out !== undefined)
+            io.stdout.write(`${JSON.stringify({ directory: out, ...totals })}\n`);
+        return 0;
+    }
+    finally {
+        await sql.end({ timeout: 5 });
+    }
+}
+/**
+ * `audit verify|export` (RFC 0004 D2): the tenant's workspace audit log. verify exits 1 when the
+ * chain is broken; export prints every event kept, newest first, as JSON lines.
+ */
+async function runAudit(config, io, subcommand) {
+    const sql = connect(config.databaseUrl, 1);
+    try {
+        const store = createSlotlockStore(sql);
+        const tenantRef = config.tenantRef;
+        if (subcommand === 'audit verify') {
+            const verified = await store.withTenant(tenantRef, (tenant) => tenant.verifyAuditChain({ tenantRef }));
+            io.stdout.write(`${JSON.stringify({ checked: verified.checked, broken_at: verified.brokenAt })}\n`);
+            if (verified.brokenAt === null)
+                return 0;
+            io.stderr.write(`slotlock: the audit log's chain breaks at event ${verified.brokenAt}: it was changed outside Slotlock\n`);
+            return 1;
+        }
+        let before;
+        for (;;) {
+            const page = await store.withTenant(tenantRef, (tenant) => tenant.listAuditEvents({ tenantRef, limit: 200, ...(before ? { beforeId: before } : {}) }));
+            for (const event of page)
+                io.stdout.write(`${JSON.stringify(slotlockAuditEventRecord(event))}\n`);
+            const last = page.at(-1);
+            if (page.length < 200 || !last)
+                return 0;
+            before = last.id;
+        }
+    }
+    finally {
+        await sql.end({ timeout: 5 });
+    }
+}
+/**
+ * `subject export|erase` (RFC 0004 D3): what the tenant keeps about one person, and taking them out
+ * of it. The erasure is recorded in the audit log without the person.
+ */
+async function runSubject(config, io, subcommand, subject) {
+    const sql = connect(config.databaseUrl, 1);
+    try {
+        const store = createSlotlockStore(sql);
+        const tenantRef = config.tenantRef;
+        try {
+            if (subcommand === 'subject export') {
+                const exported = await store.withTenant(tenantRef, (tenant) => tenant.exportSubject({ tenantRef, subject, limit: 10_000 }));
+                for (const [table, rows] of Object.entries(exported.records)) {
+                    for (const row of rows)
+                        io.stdout.write(`${JSON.stringify({ table, row })}\n`);
+                }
+                if (exported.truncated)
+                    io.stderr.write('slotlock: a table had more than 10,000 rows; the first 10,000 are listed\n');
+                return 0;
+            }
+            const { erased } = await store.withTenant(tenantRef, async (tenant) => {
+                const result = await tenant.eraseSubject({ tenantRef, subject });
+                await tenant.recordAuditEvent({
+                    tenantRef,
+                    event: {
+                        action: 'subject.erased',
+                        actorType: 'system',
+                        actorRef: 'cli',
+                        targetType: 'subject',
+                        metadata: {
+                            by: Object.keys(subject)[0],
+                            ...Object.fromEntries(Object.entries(result.erased).filter(([, rows]) => rows > 0)),
+                        },
+                    },
+                });
+                return result;
+            }, { isolation: 'read committed' });
+            io.stdout.write(`${JSON.stringify({ erased })}\n`);
+            return 0;
+        }
+        catch (error) {
+            if (error?.code === 'invalid_subject') {
+                io.stderr.write('slotlock: give an email address, or a holder, contact or booking reference of 1-500 bytes\n');
+                return 2;
+            }
+            throw error;
+        }
+    }
+    finally {
+        await sql.end({ timeout: 5 });
+    }
+}
+/**
+ * `closures list|add|delete|import` (RFC 0004 B1): the tenant's closures and special days. Exit 0, 1
+ * when a name, id or file is not found or refused, as JSON lines on stdout.
+ */
+async function runClosures(config, io, subcommand, operands, given) {
+    const sql = connect(config.databaseUrl, 1);
+    const fail = (message) => {
+        io.stderr.write(`slotlock: ${message}\n`);
+        return 1;
+    };
+    try {
+        const store = createSlotlockStore(sql);
+        const tenantRef = config.tenantRef;
+        const line = (exception) => io.stdout.write(`${JSON.stringify({
+            id: exception.id,
+            location: exception.location ?? null,
+            resource_id: exception.resourceId ?? null,
+            starts_on: exception.startsOn,
+            ends_on: exception.endsOn,
+            outcome: exception.outcome,
+            hours: exception.hours ?? null,
+            label: exception.label,
+            source: exception.source,
+        })}\n`);
+        let scope = {};
+        if (given.location !== undefined)
+            scope = { location: given.location };
+        if (given.resource !== undefined) {
+            const resources = await tenantResources(store, tenantRef);
+            const named = resources.find((resource) => resource.id === given.resource) ??
+                resources.find((resource) => resource.externalRef === given.resource);
+            if (!named)
+                return fail('no resource with that reference or id in this tenant');
+            scope = { resourceId: named.id };
+        }
+        try {
+            if (subcommand === 'closures list') {
+                const exceptions = await store.withTenant(tenantRef, (tenant) => tenant.listAvailabilityExceptions({
+                    tenantRef,
+                    from: new Date(Date.now() - 86_400_000).toISOString().slice(0, 10),
+                    limit: 1_000,
+                }));
+                for (const exception of exceptions)
+                    line(exception);
+                return 0;
+            }
+            if (subcommand === 'closures delete') {
+                const deleted = await store.withTenant(tenantRef, (tenant) => tenant.deleteAvailabilityException({ tenantRef, id: operands[0] }));
+                if (!deleted)
+                    return fail('no closure with that id in this tenant');
+                io.stdout.write(`${JSON.stringify({ deleted: true })}\n`);
+                return 0;
+            }
+            if (subcommand === 'closures add') {
+                let hours;
+                if (given.open !== undefined) {
+                    const match = /^(\d{2}):(\d{2})-(\d{2}):(\d{2})$/.exec(given.open);
+                    if (!match)
+                        return fail('--open takes HH:MM-HH:MM, like 10:00-14:00');
+                    const [opens, closes] = [Number(match[1]) * 60 + Number(match[2]), Number(match[3]) * 60 + Number(match[4])];
+                    hours = [{ startMinutes: opens, durationMinutes: closes > opens ? closes - opens : closes + 1_440 - opens }];
+                }
+                const exception = await store.withTenant(tenantRef, (tenant) => tenant.createAvailabilityException({
+                    tenantRef,
+                    ...scope,
+                    startsOn: operands[0],
+                    ...(operands[1] !== undefined ? { endsOn: operands[1] } : {}),
+                    outcome: hours ? 'open' : 'closed',
+                    ...(hours ? { hours } : {}),
+                    label: given.label ?? '',
+                }));
+                line(exception);
+                return 0;
+            }
+            // closures import <file> [--label <calendar name>]
+            let text;
+            try {
+                text = await readFile(operands[0], 'utf8');
+            }
+            catch {
+                return fail('that file cannot be read');
+            }
+            const read = await readSlotlockHolidayCalendar({
+                icalendar: text,
+                ...(given.label !== undefined ? { name: given.label } : {}),
+            });
+            const result = await store.withTenant(tenantRef, (tenant) => tenant.importHolidayCalendar({ tenantRef, ...scope, name: read.name, holidays: read.holidays, span: read.span }));
+            io.stdout.write(`${JSON.stringify({ imported: result.imported, removed: result.removed, skipped: read.skipped, calendar: result.calendar.name })}\n`);
+            return 0;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 'invalid_availability_exception' ||
+                code === 'invalid_holiday_calendar' ||
+                code === 'location_not_found' ||
+                code === 'resource_not_found' ||
+                code === 'availability_exceptions_limit_reached' ||
+                code === 'holiday_calendars_limit_reached') {
+                return fail(error.message);
+            }
+            throw error;
+        }
+    }
+    finally {
+        await sql.end({ timeout: 5 });
+    }
+}
 /** Every resource of the tenant in use (with `includeArchived`, every one), a page at a time. */
 async function tenantResources(store, tenantRef, includeArchived = false) {
     const all = [];
@@ -1273,14 +1579,22 @@ async function tenantResources(store, tenantRef, includeArchived = false) {
  * `hours show|set|clear`: print, set or clear (`rules` null) the hours of the tenant's resource
  * named by reference or id, or of every resource. Returns false when no resource has that name.
  */
-async function runHours(config, out, target, rules) {
+async function runHours(config, out, target, rules, override = 'none') {
     const sql = connect(config.databaseUrl, 1);
     try {
         const store = createSlotlockStore(sql);
         const tenantRef = config.tenantRef;
         if (target === 'all') {
-            const updated = await store.withTenant(tenantRef, (tenant) => tenant.setTenantAvailability({ tenantRef, rules: rules ?? null }));
-            out.write(`${JSON.stringify({ updated })}\n`);
+            // The tenant's hours, which every resource without its own inherits (RFC 0004 B2).
+            const result = await store.withTenant(tenantRef, (tenant) => tenant.storeTenantAvailability({ tenantRef, rules: rules ?? null, overrideResources: override }));
+            out.write(`${JSON.stringify({ inheriting: result.inheriting, own_hours: result.ownHours })}\n`);
+            return true;
+        }
+        if (typeof target === 'object' && 'location' in target) {
+            const result = await store.withTenant(tenantRef, (tenant) => tenant.setLocationAvailability({ tenantRef, location: target.location, rules: rules ?? null }));
+            if (!result)
+                return false;
+            out.write(`${JSON.stringify({ location: target.location, inheriting: result.inheriting, own_hours: result.ownHours })}\n`);
             return true;
         }
         const resources = await tenantResources(store, tenantRef);
@@ -1298,6 +1612,8 @@ async function runHours(config, out, target, rules) {
             out.write(hoursLine(named));
             return true;
         }
+        if (!('resource' in target))
+            return false;
         const updated = await store.withTenant(tenantRef, (tenant) => tenant.setResourceAvailability({ tenantRef, id: named.id, rules }));
         if (!updated)
             return false;
@@ -1780,11 +2096,16 @@ async function maintainTenant(config, caps) {
                 noShows: 0,
                 waitlistOffers: 0,
                 approvalsExpired: 0,
+                bookingsCompleted: 0,
+                remindersDue: 0,
+                holidayCalendarsImported: 0,
                 capped: true,
                 passes: 0,
             };
+            // Holiday calendar subscriptions by URL (RFC 0004 B1), never from a private address.
+            const holidayFetch = createSlotlockGuardedFetch();
             while (sum.capped && sum.passes < MAINTAIN_MAX_PASSES) {
-                const pass = await maintainSlotlockTenant(store, config.tenantRef);
+                const pass = await maintainSlotlockTenant(store, config.tenantRef, { holidayFetch });
                 sum.passes += 1;
                 sum.extended += pass.extended;
                 sum.conflicts += pass.conflicts;
@@ -1795,6 +2116,9 @@ async function maintainTenant(config, caps) {
                 sum.noShows += pass.noShows;
                 sum.waitlistOffers += pass.waitlistOffers;
                 sum.approvalsExpired += pass.approvalsExpired;
+                sum.bookingsCompleted += pass.bookingsCompleted;
+                sum.remindersDue += pass.remindersDue;
+                sum.holidayCalendarsImported += pass.holidayCalendarsImported;
                 // A capped pass that got nowhere met only series it cannot extend. While its roll stopped
                 // before the series it had put back, the next pass meets new ones (and perhaps a healthy
                 // one); once it reached them, another pass would meet them again.
@@ -1805,6 +2129,8 @@ async function maintainTenant(config, caps) {
             // Every tenant's expired assistant conversations, a tenant only the dashboard serves
             // included. Counted nowhere: the counts above are this tenant's.
             await store.sweepAssistantConversations();
+            // And finished team invitations, with the addresses they were sent to, and ended sessions.
+            await store.sweepDashboardRecords();
             return sum;
         });
         return total ?? null;
@@ -1872,11 +2198,26 @@ Commands:
   resource delete <ref>    Delete a resource and its history; refused while a booking, hold
                            or event on it has not ended
   hours show [--resource <ref>]
-                           Print each resource's bookable hours (null: the server's)
-  hours set <json> (--resource <ref> | --all)
-                           Give one resource, or every one, weekly hours of its own; [] closes
-  hours clear (--resource <ref> | --all)
-                           Hand one resource, or every one, back to the server's hours
+                           Print each resource's bookable hours: its own (null when none) and
+                           what it inherits from its location or the tenant
+  hours set <json> (--resource <ref> | --location <ref> | --all [--override | --matching])
+                           Give one resource, one location or the tenant weekly hours; a
+                           resource without its own inherits its location's, then the
+                           tenant's, then the server's; --override also clears resources'
+                           own hours, --matching only those the same as the tenant's were
+                           or as these (copies 0.8.0 made); [] closes
+  hours clear (--resource <ref> | --location <ref> | --all)
+                           Clear those hours, so they inherit from further up
+  closures list            Print the tenant's closures and special days from yesterday on
+  closures add <first-day> [<last-day>] --label <text> [--open HH:MM-HH:MM]
+               [--resource <ref> | --location <ref>]
+                           Close whole days (YYYY-MM-DD), or with --open give them those hours
+                           instead, everywhere or for one location or resource
+  closures delete <id>     Remove a closure
+  closures import <file> [--resource <ref> | --location <ref>] [--label <calendar name>]
+                           Close the days an iCalendar file of holidays names (each all-day
+                           event, for the next two years); importing the calendar again (by its
+                           name: --label, else its own) updates them and removes those it dropped
   rules set <json> --resource <ref>
                            Set what a booking on the resource must satisfy, like
                            {"minNoticeMinutes":120,"slotStepMinutes":30,"turnaroundMinutes":30,"enforceHours":true}
@@ -1946,10 +2287,24 @@ Commands:
                            no new secret (as SLOTLOCK_MIGRATE_DATABASE_URL's role when set:
                            only the schema owner suspends)
   tenant unsuspend         Lift the tenant's suspension (as the schema owner, likewise)
+  tenant export [--out <dir>]
+                           Print everything the tenant keeps, read at one moment, one JSON line a
+                           row ({"table": ..., "row": ...}); with --out, one <table>.ndjson file a
+                           table in that directory (new or empty). Secrets stay out
   tenant erase --confirm <tenant>
                            Delete everything the tenant has, its API keys included, for good;
                            --confirm repeats SLOTLOCK_TENANT; refused while its hosted plan is
                            paid for (cancel the subscription first)
+  audit verify             Check the tenant's audit log chain: prints how many events held and
+                           the first that does not (exit 1 when one does not)
+  audit export             Print the tenant's audit log, newest first, one JSON object per line
+  subject export (--email <address> | --holder <ref> | --contact <ref> | --reference <ref>)
+                           Print what the tenant keeps about one person, one JSON line per row:
+                           {"table": ..., "row": ...}, up to 10,000 rows a table
+  subject erase (--email <address> | --holder <ref> | --contact <ref> | --reference <ref>)
+                           Take one person out of the tenant's data: their contacts, attendee
+                           and waitlist entries go; their references become an erased name;
+                           bookings stay as time taken. Prints what it changed, by table
   plan status              Print the deployment's default plan and the tenant's own (hosted)
   plan default (free | developer | none) [--from <date>]
                            Put every tenant without a plan of its own on this one from --from
@@ -2053,10 +2408,26 @@ Environment:
   SLOTLOCK_DASHBOARD_ORGS        comma-separated GitHub organization ids: each is one shared tenant;
                                  or enabled: each person's own tenant, plus the organizations an
                                  owner turns on from the dashboard's Teams page
+  SLOTLOCK_DASHBOARD_TEAM_WORKSPACES on: anyone signed in creates team workspaces and invites
+                                 people to them by email, each with a role (default off; not
+                                 with organization ids)
   SLOTLOCK_DASHBOARD_NAME        What the dashboard calls this deployment (default Slotlock)
   SLOTLOCK_DASHBOARD_TERMS_URL   https URL of the terms people accept by signing in, linked on the
                                  sign-in page (none named without it)
   SLOTLOCK_DASHBOARD_PRIVACY_URL https URL of the privacy notice the sign-in page links
+  SLOTLOCK_INVITATION_EMAIL      resend or postmark: send team invitations by email (with team
+                                 workspaces; without it, the person inviting sends the link)
+  SLOTLOCK_INVITATION_EMAIL_KEY  Resend's API key, or Postmark's server token
+  SLOTLOCK_INVITATION_EMAIL_FROM The sender the provider verified: team@example.com or Name <...>
+  SLOTLOCK_VERIFIED_DOMAINS      on or off (default): team Owners verify their domain with a DNS
+                                 record, and people at it may ask to join (with team workspaces)
+  SLOTLOCK_DNS_RESOLVER          doh (default: Cloudflare, checked by Google) or system: how a
+                                 verified domain's record is looked up each day
+  SLOTLOCK_TEAM_SSO              on or off (default): each team signs in through its own identity
+                                 provider over OpenID Connect (with verified domains)
+  SLOTLOCK_SSO_SECRET            32+ characters: seals each team's client secret (with team SSO)
+  SLOTLOCK_TEAM_SCIM             on or off (default): each team's identity provider provisions its
+                                 people over SCIM 2.0 at /dashboard/scim/v2 (with verified domains)
   HOST                           Listen address (default 127.0.0.1)
   PORT                           Listen port (default 8080)
 
@@ -2096,13 +2467,16 @@ export async function runSlotlockCli(argv, io) {
     const subcommand = command === 'resource' ||
         command === 'key' ||
         command === 'hours' ||
+        command === 'closures' ||
         command === 'rules' ||
         command === 'tenant' ||
         command === 'plan' ||
         command === 'partner' ||
         command === 'overage' ||
         command === 'billing' ||
-        command === 'sandbox'
+        command === 'sandbox' ||
+        command === 'audit' ||
+        command === 'subject'
         ? `${command} ${operands[0] ?? ''}`.trim()
         : command;
     const expectedOperands = {
@@ -2117,6 +2491,7 @@ export async function runSlotlockCli(argv, io) {
         'resource restore': 2,
         'resource delete': 2,
         'tenant status': 1,
+        'tenant export': 1,
         'tenant suspend': 1,
         'tenant unsuspend': 1,
         'tenant erase': 1,
@@ -2134,6 +2509,10 @@ export async function runSlotlockCli(argv, io) {
         'hours show': 1,
         'hours set': 2,
         'hours clear': 1,
+        'closures list': 1,
+        'closures add': 2,
+        'closures delete': 2,
+        'closures import': 2,
         'rules set': 2,
         'rules clear': 1,
         'partner create': 3,
@@ -2147,8 +2526,13 @@ export async function runSlotlockCli(argv, io) {
         'partner close': 2,
         'overage report': 1,
         'billing daily': 1,
+        'audit verify': 1,
+        'audit export': 1,
+        'subject export': 1,
+        'subject erase': 1,
     };
-    const expected = expectedOperands[subcommand];
+    // closures add takes a last day or not.
+    const expected = subcommand === 'closures add' && operands.length === 3 ? 3 : expectedOperands[subcommand];
     if (expected === undefined)
         return usage(`unknown command "${subcommand}"`);
     if (operands.length !== expected)
@@ -2202,16 +2586,47 @@ export async function runSlotlockCli(argv, io) {
         if (named !== 'none')
             planDefault = { plan: named, appliesFrom };
     }
+    const subjectOptions = ['email', 'holder', 'contact', 'reference'].filter((option) => values[option] !== undefined);
+    if (subjectOptions.length > 0 && !subcommand.startsWith('subject ')) {
+        return usage('--email, --holder, --contact and --reference apply only to subject export and subject erase');
+    }
+    if (subcommand.startsWith('subject ') && subjectOptions.length !== 1) {
+        return usage(`${subcommand} needs exactly one of --email, --holder, --contact or --reference`);
+    }
+    if (values.out !== undefined && subcommand !== 'tenant export')
+        return usage('--out applies only to tenant export');
     if (subcommand === 'tenant erase' && values.confirm === undefined) {
         return usage('tenant erase needs --confirm <tenant>, the tenant it erases (SLOTLOCK_TENANT)');
     }
     if (values.all && subcommand !== 'hours set' && subcommand !== 'hours clear') {
         return usage('--all applies only to hours set and hours clear');
     }
+    if (values.override && subcommand !== 'hours set')
+        return usage('--override applies only to hours set --all');
+    if (values.matching && subcommand !== 'hours set')
+        return usage('--matching applies only to hours set --all');
+    if (values.override && values.matching)
+        return usage('--override and --matching: give one');
     if (values.resource !== undefined &&
         !subcommand.startsWith('hours ') &&
-        !subcommand.startsWith('rules ')) {
-        return usage('--resource applies only to hours and rules commands');
+        !subcommand.startsWith('rules ') &&
+        !subcommand.startsWith('closures ')) {
+        return usage('--resource applies only to hours, closures and rules commands');
+    }
+    if (values.location !== undefined && !subcommand.startsWith('hours ') && !subcommand.startsWith('closures ')) {
+        return usage('--location applies only to hours and closures commands');
+    }
+    if (values.label !== undefined && subcommand !== 'closures add' && subcommand !== 'closures import') {
+        return usage('--label applies only to closures add and closures import');
+    }
+    if (values.open !== undefined && subcommand !== 'closures add') {
+        return usage('--open applies only to closures add');
+    }
+    if (subcommand.startsWith('closures ') && values.resource !== undefined && values.location !== undefined) {
+        return usage(`${subcommand} takes --resource or --location, not both`);
+    }
+    if (subcommand === 'closures add' && (operands.length < 2 || operands.length > 3 || values.label === undefined)) {
+        return usage('closures add needs <first-day> [<last-day>] --label <text>');
     }
     if (subcommand.startsWith('rules ') && values.resource === undefined) {
         return usage(`${subcommand} needs --resource <ref>`);
@@ -2228,9 +2643,13 @@ export async function runSlotlockCli(argv, io) {
         }
     }
     if ((subcommand === 'hours set' || subcommand === 'hours clear') &&
-        (values.resource === undefined) === (values.all !== true)) {
-        return usage(`${subcommand} needs --resource <ref> or --all, one of them`);
+        [values.resource !== undefined, values.location !== undefined, values.all === true].filter(Boolean).length !== 1) {
+        return usage(`${subcommand} needs --resource <ref>, --location <ref> or --all, one of them`);
     }
+    if (values.override && values.all !== true)
+        return usage('--override applies only to hours set --all');
+    if (values.matching && values.all !== true)
+        return usage('--matching applies only to hours set --all');
     let hours = null;
     if (subcommand === 'hours set') {
         let candidate;
@@ -2407,6 +2826,8 @@ export async function runSlotlockCli(argv, io) {
                 }
                 return 0;
             }
+            case 'tenant export':
+                return runTenantExport(readSlotlockDatabaseConfig(io.env), io, values.out);
             case 'tenant status':
             case 'tenant suspend':
             case 'tenant unsuspend':
@@ -2484,16 +2905,40 @@ export async function runSlotlockCli(argv, io) {
             case 'hours clear': {
                 const target = values.all === true
                     ? 'all'
-                    : values.resource !== undefined
-                        ? { resource: values.resource }
-                        : 'show';
-                const found = await runHours(readSlotlockDatabaseConfig(io.env), io.stdout, target, subcommand === 'hours show' ? undefined : hours);
+                    : values.location !== undefined
+                        ? { location: values.location }
+                        : values.resource !== undefined
+                            ? { resource: values.resource }
+                            : 'show';
+                const found = await runHours(readSlotlockDatabaseConfig(io.env), io.stdout, target, subcommand === 'hours show' ? undefined : hours, values.override === true ? 'all' : values.matching === true ? 'matching' : 'none');
                 if (!found) {
-                    io.stderr.write('slotlock: no resource with that reference or id in this tenant\n');
+                    io.stderr.write(values.location !== undefined
+                        ? 'slotlock: no location with that reference in this tenant\n'
+                        : 'slotlock: no resource with that reference or id in this tenant\n');
                     return 1;
                 }
                 return 0;
             }
+            case 'audit verify':
+            case 'audit export':
+                return runAudit(readSlotlockDatabaseConfig(io.env), io, subcommand);
+            case 'subject export':
+            case 'subject erase': {
+                const option = subjectOptions[0];
+                return runSubject(readSlotlockDatabaseConfig(io.env), io, subcommand, {
+                    [option]: values[option],
+                });
+            }
+            case 'closures list':
+            case 'closures add':
+            case 'closures delete':
+            case 'closures import':
+                return runClosures(readSlotlockDatabaseConfig(io.env), io, subcommand, operands.slice(1), {
+                    ...(values.resource !== undefined ? { resource: values.resource } : {}),
+                    ...(values.location !== undefined ? { location: values.location } : {}),
+                    ...(values.label !== undefined ? { label: values.label } : {}),
+                    ...(values.open !== undefined ? { open: values.open } : {}),
+                });
             case 'rules set':
             case 'rules clear': {
                 const found = await runRules(readSlotlockDatabaseConfig(io.env), io.stdout, values.resource, bookingRules);
@@ -2594,9 +3039,19 @@ function parseCliArguments(argv) {
             month: { type: 'string' },
             event: { type: 'string' },
             resource: { type: 'string' },
+            location: { type: 'string' },
             all: { type: 'boolean' },
+            override: { type: 'boolean' },
+            matching: { type: 'boolean' },
+            label: { type: 'string' },
+            open: { type: 'string' },
             reason: { type: 'string' },
             confirm: { type: 'string' },
+            out: { type: 'string' },
+            email: { type: 'string' },
+            holder: { type: 'string' },
+            contact: { type: 'string' },
+            reference: { type: 'string' },
             from: { type: 'string' },
             help: { type: 'boolean', short: 'h' },
             version: { type: 'boolean', short: 'v' },