slotlock 0.9.0 → 0.10.0

package/index.d.ts

@@ -36,7 +36,7 @@ export { maintainSlotlockTenant, startSlotlockMaintenance, withSlotlockMaintenan
 export type { SlotlockMaintenanceResult, SlotlockMaintenanceScheduler, SlotlockMaintenanceSchedulerOptions, } from './maintenance.js';
 export { createSlotlockApiKeyAuthenticator, createSlotlockApiKeyStore, generateSlotlockApiKey, isSlotlockApiKey, isSlotlockTestTenant, slotlockLiveTenant, SLOTLOCK_TEST_API_KEY_PREFIX, SLOTLOCK_TEST_TENANT_SUFFIX, slotlockApiKeyDigest, SLOTLOCK_API_KEY_ACTIVE_LIMIT, SLOTLOCK_API_KEY_MAX_LIFETIME_DAYS, SLOTLOCK_API_KEY_PREFIX, SLOTLOCK_API_KEY_RETAINED_LIMIT, SLOTLOCK_API_KEY_SCOPES, } from './api-keys.js';
 export { createSlotlockDashboard, createSlotlockDashboardResources, createSlotlockAcceptanceRecords, createSlotlockDashboardState, createSlotlockMemoryDashboardState, SLOTLOCK_DASHBOARD_MAX_RESOURCES, } from './dashboard.js';
-export type { SlotlockDashboard, SlotlockDashboardAssistantOptions, SlotlockDashboardOptions, SlotlockDashboardResources, SlotlockDashboardState, } from './dashboard.js';
+export type { SlotlockDashboard, SlotlockDashboardAssistantOptions, SlotlockDashboardOptions, SlotlockDashboardResources, SlotlockDashboardState, SlotlockInvitationSender, } from './dashboard.js';
 export { createSlotlockAssistantStore, createSlotlockMemoryAssistantStore, SLOTLOCK_ASSISTANT_TOOL_USE, } from './assistant.js';
 export type { SlotlockAssistantStore } from './assistant.js';
 export { createSlotlockPartnerKeyAuthenticator, createSlotlockPartnerStore, parseSlotlockPartnerContract, slotlockPartnerTenantRef, SLOTLOCK_PARTNER_ACCOUNT, SLOTLOCK_PARTNER_ID, SLOTLOCK_PARTNER_SCOPE, } from './partners.js';
@@ -46,6 +46,13 @@ export type { SlotlockOverageReport } from './overage.js';
 export { createSlotlockOtlpExporter, readSlotlockOtlpConfig, slotlockCallSpan } from './otel.js';
 export type { SlotlockOtlpConfig, SlotlockTraceExporter } from './otel.js';
 export type { SlotlockDashboardTeams } from './teams.js';
+export { createSlotlockInvitationEmailSender, SlotlockInvitationEmailError, slotlockInvitationEmail, } from './invitation-email.js';
+export type { SlotlockInvitationEmailConfig } from './invitation-email.js';
+export { createSlotlockDashboardWorkspaces, createSlotlockMemoryDashboardWorkspaces, createSlotlockWorkspaceCheck, } from './workspaces.js';
+export type { SlotlockDashboardWorkspaces, SlotlockGitHubMembership, SlotlockInvitationPreview, SlotlockTeamRefusal, SlotlockTeamWorkspace, SlotlockWorkspaceInvitation, SlotlockWorkspaceMember, SlotlockWorkspaceStanding, SlotlockWorkspaceTeams, SlotlockDashboardSession, SlotlockDashboardSessions, } from './workspaces.js';
+export { SLOTLOCK_DASHBOARD_PAGE_CAPABILITIES, SLOTLOCK_DASHBOARD_POST_CAPABILITIES, SLOTLOCK_FRESH_CAPABILITIES, SLOTLOCK_ROLE_CAPABILITIES, SLOTLOCK_SCOPED_CAPABILITIES, SLOTLOCK_SCOPED_DASHBOARD_PAGES, SLOTLOCK_SCOPED_DASHBOARD_POSTS, SLOTLOCK_WORKSPACE_CAPABILITIES, SLOTLOCK_WORKSPACE_ROLE_NAMES, SLOTLOCK_WORKSPACE_ROLES, isSlotlockWorkspaceRole, slotlockMemberCan, slotlockRoleCan, slotlockRoleKeyScopes, slotlockRoleMayGrant, } from './workspace-roles.js';
+export { slotlockDashboardRequestScope } from './dashboard-scope.js';
+export type { SlotlockWorkspaceCapability, SlotlockWorkspaceRole } from './workspace-roles.js';
 export { closeSlotlockPartnerMonth, priceSlotlockPartnerMonth, slotlockClientLabel, slotlockPartnerMonthChecksum, } from './partner-billing.js';
 export type { SlotlockPartnerAccountMonth, SlotlockPartnerInvoiceLine, SlotlockPartnerMonthClose, } from './partner-billing.js';
 export type { SlotlockPartnerAccount, SlotlockPartnerContract, SlotlockPartnerPlan, SlotlockPartnerPricing, SlotlockPartnerStore, } from './partners.js';
@@ -54,6 +61,7 @@ export { ICalendarWorkerBusyError, ICalendarWorkerPoolClosedError, createICalend
 export type { ICalendarWorkerPool, ICalendarWorkerPoolOptions } from './ical-worker.js';
 export { CalendarContractError, CalendarExpansionLimitError, emitICalendar, emitITipCalendar, expandCalendarEventOccurrences, normalizeCalendarEventContent, normalizeExternalCalendarChange, parseICalendarChanges, parseICalendarFeed, parseTrustedICalendarEvents, recurrenceRuleProblem, storedCalendarEventProblem, } from './sync.js';
 export type { ExternalCalendarChange, ExternalCalendarChangeInput, ExternalCalendarStatus, ICalendarEvent, ICalendarExpansionWindow, ICalendarFeedRead, ICalendarSeriesRefusal, ITipMethod, } from './sync.js';
-export { createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, SLOTLOCK_API_KEY_FUNCTIONS, SLOTLOCK_API_KEY_TABLES, SLOTLOCK_CORE_DDL, SLOTLOCK_DASHBOARD_FUNCTIONS, SLOTLOCK_DASHBOARD_TABLES, SLOTLOCK_DEFINER_FUNCTIONS, SLOTLOCK_DEFINER_TABLES, SLOTLOCK_OPERATOR_FUNCTIONS, SLOTLOCK_SCHEMA_FUNCTIONS, SLOTLOCK_SCHEMA_TABLES, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_TENANT_ADMIN_FUNCTIONS, SLOTLOCK_TENANT_ADMIN_TABLES, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_TENANT_RLS_DDL, SLOTLOCK_TENANT_TABLES, } from './ddl.js';
-export { assertSlotlockSchemaCurrent, calendarEventRollingHorizon, createSlotlockStore, readSlotlockSchemaVersion, SLOTLOCK_AGENT_OWNER_COMMAND_QUOTA, SLOTLOCK_AGENT_OWNER_EVENT_QUOTA, SLOTLOCK_CALENDAR_HORIZON_DAYS, SLOTLOCK_SOURCE_BUSY_MAX, SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS, SLOTLOCK_INTERNAL_EVENT_OWNER_REF, SLOTLOCK_LOCAL_RECURRENCE_COVERAGE_SOURCE, SLOTLOCK_MATERIALIZATION_WINDOW_DAYS, SLOTLOCK_MAX_EVENT_DURATION_DAYS, SLOTLOCK_MAX_CONTACTS_PER_TENANT, SLOTLOCK_PAYMENT_HOLD_MAX_TTL_MS, SLOTLOCK_TENANT_WRITE_METHODS, type SlotlockHoldTenantOptions, type SlotlockMigrationOptions, type SlotlockSql, type SlotlockStore, type SlotlockStoreOptions, type SlotlockTenantLimits, type SlotlockTenantStore, } from './store.js';
-export type { AcquireHoldResult, BookingRetentionResult, CalendarAttendee, CalendarAttendeeRole, CalendarCoverageAssessment, CalendarCoverageCommand, CalendarCoverageResult, CalendarEventContent, CalendarEventOccurrence, CalendarEventRetentionResult, CalendarEventStatus, CalendarFreeBusy, CalendarHorizonRollCursor, CalendarHorizonRollResult, CalendarOrganizer, CalendarParticipationStatus, CalendarRecurrence, CalendarRecurrenceException, CalendarReminder, CalendarTransparency, ConfirmHoldResult, CancelCalendarEventResult, CancelExternalReservationResult, CreateReservationResult, DeleteResourceResult, ExternalReservationCommand, ExternalReservationResult, Interval, SlotlockAgendaEntry, SlotlockHold, MarkHoldPaidResult, SlotlockContact, SlotlockContactConsent, PutContactResult, SourceBusyCommand, SourceBusyResult, SlotlockCalendarEvent, SlotlockBookingDescription, SlotlockReservation, SlotlockResource, SlotlockTenantErasure, SlotlockBookingRuleDefaults, PutCalendarEventCommand, PutCalendarEventResult, ReleaseHoldResult, TrustedICalendarEvent, SlotlockInheritedAvailability, WeeklyAvailabilityRule, } from './types.js';
+export { createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, SLOTLOCK_API_KEY_FUNCTIONS, SLOTLOCK_API_KEY_TABLES, SLOTLOCK_CORE_DDL, SLOTLOCK_DASHBOARD_FUNCTIONS, SLOTLOCK_DASHBOARD_TABLES, SLOTLOCK_APPEND_ONLY_TABLES, SLOTLOCK_AUDIT_RETENTION_DAYS, SLOTLOCK_CHANGE_RETENTION_BY_PLAN, SLOTLOCK_DEFINER_FUNCTIONS, SLOTLOCK_DEFINER_TABLES, SLOTLOCK_OPERATOR_FUNCTIONS, SLOTLOCK_SCHEMA_FUNCTIONS, SLOTLOCK_SCHEMA_TABLES, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_TENANT_ADMIN_FUNCTIONS, SLOTLOCK_TENANT_ADMIN_TABLES, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_TENANT_RLS_DDL, SLOTLOCK_TENANT_TABLES, } from './ddl.js';
+export { assertSlotlockSchemaCurrent, calendarEventRollingHorizon, createSlotlockStore, readSlotlockSchemaVersion, SLOTLOCK_AGENT_OWNER_COMMAND_QUOTA, SLOTLOCK_AGENT_OWNER_EVENT_QUOTA, SLOTLOCK_CALENDAR_HORIZON_DAYS, SLOTLOCK_SOURCE_BUSY_MAX, SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS, SLOTLOCK_INTERNAL_EVENT_OWNER_REF, SLOTLOCK_LOCAL_RECURRENCE_COVERAGE_SOURCE, SLOTLOCK_MATERIALIZATION_WINDOW_DAYS, SLOTLOCK_MAX_EVENT_DURATION_DAYS, SLOTLOCK_MAX_CONTACTS_PER_TENANT, SLOTLOCK_PAYMENT_HOLD_MAX_TTL_MS, SLOTLOCK_TENANT_WRITE_METHODS, SLOTLOCK_TENANT_EXPORT_HOURS, SLOTLOCK_TENANT_EXPORT_MAX_BYTES, SLOTLOCK_TENANT_EXPORT_PART_ROWS, SLOTLOCK_MAX_TENANT_EXPORTS, buildSlotlockTenantExport, slotlockAuditEventRecord, type SlotlockAuditEvent, type SlotlockAuditEventInput, type SlotlockSubject, type SlotlockSubjectErasure, type SlotlockSubjectExport, type SlotlockTenantExport, type SlotlockTenantExportPartResult, type SlotlockHoldTenantOptions, type SlotlockMigrationOptions, type SlotlockSql, type SlotlockStore, type SlotlockStoreOptions, type SlotlockTenantLimits, type SlotlockTenantStore, } from './store.js';
+export type { AcquireHoldResult, BookingRetentionResult, CalendarAttendee, CalendarAttendeeRole, CalendarCoverageAssessment, CalendarCoverageCommand, CalendarCoverageResult, CalendarEventContent, CalendarEventOccurrence, CalendarEventRetentionResult, CalendarEventStatus, CalendarFreeBusy, CalendarHorizonRollCursor, CalendarHorizonRollResult, CalendarOrganizer, CalendarParticipationStatus, CalendarRecurrence, CalendarRecurrenceException, CalendarReminder, CalendarTransparency, ConfirmHoldResult, CancelCalendarEventResult, CancelExternalReservationResult, CreateReservationResult, DeleteResourceResult, ExternalReservationCommand, ExternalReservationResult, Interval, SlotlockAgendaEntry, SlotlockHold, MarkHoldPaidResult, SlotlockContact, SlotlockContactConsent, PutContactResult, SourceBusyCommand, SourceBusyResult, SlotlockCalendarEvent, SlotlockBookingDescription, SlotlockReservation, SlotlockResource, SlotlockTenantErasure, SlotlockBookingRuleDefaults, PutCalendarEventCommand, PutCalendarEventResult, ReleaseHoldResult, TrustedICalendarEvent, SlotlockInheritedAvailability, WeeklyAvailabilityRule, SlotlockSubjectTable, SlotlockTenantExportTable, } from './types.js';
+export { SLOTLOCK_SUBJECT_TABLES, SLOTLOCK_TENANT_EXPORT_LEFT_OUT, SLOTLOCK_TENANT_EXPORT_TABLES, } from './types.js';

package/index.js

@@ -34,8 +34,14 @@ export { createSlotlockPartnerKeyAuthenticator, createSlotlockPartnerStore, pars
 export { createSlotlockDashboardTeams, createSlotlockOrganizationCheck } from './teams.js';
 export { reportSlotlockOverage, SLOTLOCK_DEFAULT_OVERAGE_STOP_PERCENT } from './overage.js';
 export { createSlotlockOtlpExporter, readSlotlockOtlpConfig, slotlockCallSpan } from './otel.js';
+export { createSlotlockInvitationEmailSender, SlotlockInvitationEmailError, slotlockInvitationEmail, } from './invitation-email.js';
+export { createSlotlockDashboardWorkspaces, createSlotlockMemoryDashboardWorkspaces, createSlotlockWorkspaceCheck, } from './workspaces.js';
+export { SLOTLOCK_DASHBOARD_PAGE_CAPABILITIES, SLOTLOCK_DASHBOARD_POST_CAPABILITIES, SLOTLOCK_FRESH_CAPABILITIES, SLOTLOCK_ROLE_CAPABILITIES, SLOTLOCK_SCOPED_CAPABILITIES, SLOTLOCK_SCOPED_DASHBOARD_PAGES, SLOTLOCK_SCOPED_DASHBOARD_POSTS, SLOTLOCK_WORKSPACE_CAPABILITIES, SLOTLOCK_WORKSPACE_ROLE_NAMES, SLOTLOCK_WORKSPACE_ROLES, isSlotlockWorkspaceRole, slotlockMemberCan, slotlockRoleCan, slotlockRoleKeyScopes, slotlockRoleMayGrant, } from './workspace-roles.js';
+// For resource adapters of one's own that keep to a limited member's scope (`keepsToScope`).
+export { slotlockDashboardRequestScope } from './dashboard-scope.js';
 export { closeSlotlockPartnerMonth, priceSlotlockPartnerMonth, slotlockClientLabel, slotlockPartnerMonthChecksum, } from './partner-billing.js';
 export { ICalendarWorkerBusyError, ICalendarWorkerPoolClosedError, createICalendarWorkerPool, } from './ical-worker.js';
 export { CalendarContractError, CalendarExpansionLimitError, emitICalendar, emitITipCalendar, expandCalendarEventOccurrences, normalizeCalendarEventContent, normalizeExternalCalendarChange, parseICalendarChanges, parseICalendarFeed, parseTrustedICalendarEvents, recurrenceRuleProblem, storedCalendarEventProblem, } from './sync.js';
-export { createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, SLOTLOCK_API_KEY_FUNCTIONS, SLOTLOCK_API_KEY_TABLES, SLOTLOCK_CORE_DDL, SLOTLOCK_DASHBOARD_FUNCTIONS, SLOTLOCK_DASHBOARD_TABLES, SLOTLOCK_DEFINER_FUNCTIONS, SLOTLOCK_DEFINER_TABLES, SLOTLOCK_OPERATOR_FUNCTIONS, SLOTLOCK_SCHEMA_FUNCTIONS, SLOTLOCK_SCHEMA_TABLES, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_TENANT_ADMIN_FUNCTIONS, SLOTLOCK_TENANT_ADMIN_TABLES, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_TENANT_RLS_DDL, SLOTLOCK_TENANT_TABLES, } from './ddl.js';
-export { assertSlotlockSchemaCurrent, calendarEventRollingHorizon, createSlotlockStore, readSlotlockSchemaVersion, SLOTLOCK_AGENT_OWNER_COMMAND_QUOTA, SLOTLOCK_AGENT_OWNER_EVENT_QUOTA, SLOTLOCK_CALENDAR_HORIZON_DAYS, SLOTLOCK_SOURCE_BUSY_MAX, SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS, SLOTLOCK_INTERNAL_EVENT_OWNER_REF, SLOTLOCK_LOCAL_RECURRENCE_COVERAGE_SOURCE, SLOTLOCK_MATERIALIZATION_WINDOW_DAYS, SLOTLOCK_MAX_EVENT_DURATION_DAYS, SLOTLOCK_MAX_CONTACTS_PER_TENANT, SLOTLOCK_PAYMENT_HOLD_MAX_TTL_MS, SLOTLOCK_TENANT_WRITE_METHODS, } from './store.js';
+export { createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, SLOTLOCK_API_KEY_FUNCTIONS, SLOTLOCK_API_KEY_TABLES, SLOTLOCK_CORE_DDL, SLOTLOCK_DASHBOARD_FUNCTIONS, SLOTLOCK_DASHBOARD_TABLES, SLOTLOCK_APPEND_ONLY_TABLES, SLOTLOCK_AUDIT_RETENTION_DAYS, SLOTLOCK_CHANGE_RETENTION_BY_PLAN, SLOTLOCK_DEFINER_FUNCTIONS, SLOTLOCK_DEFINER_TABLES, SLOTLOCK_OPERATOR_FUNCTIONS, SLOTLOCK_SCHEMA_FUNCTIONS, SLOTLOCK_SCHEMA_TABLES, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_TENANT_ADMIN_FUNCTIONS, SLOTLOCK_TENANT_ADMIN_TABLES, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_TENANT_RLS_DDL, SLOTLOCK_TENANT_TABLES, } from './ddl.js';
+export { assertSlotlockSchemaCurrent, calendarEventRollingHorizon, createSlotlockStore, readSlotlockSchemaVersion, SLOTLOCK_AGENT_OWNER_COMMAND_QUOTA, SLOTLOCK_AGENT_OWNER_EVENT_QUOTA, SLOTLOCK_CALENDAR_HORIZON_DAYS, SLOTLOCK_SOURCE_BUSY_MAX, SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS, SLOTLOCK_INTERNAL_EVENT_OWNER_REF, SLOTLOCK_LOCAL_RECURRENCE_COVERAGE_SOURCE, SLOTLOCK_MATERIALIZATION_WINDOW_DAYS, SLOTLOCK_MAX_EVENT_DURATION_DAYS, SLOTLOCK_MAX_CONTACTS_PER_TENANT, SLOTLOCK_PAYMENT_HOLD_MAX_TTL_MS, SLOTLOCK_TENANT_WRITE_METHODS, SLOTLOCK_TENANT_EXPORT_HOURS, SLOTLOCK_TENANT_EXPORT_MAX_BYTES, SLOTLOCK_TENANT_EXPORT_PART_ROWS, SLOTLOCK_MAX_TENANT_EXPORTS, buildSlotlockTenantExport, slotlockAuditEventRecord, } from './store.js';
+export { SLOTLOCK_SUBJECT_TABLES, SLOTLOCK_TENANT_EXPORT_LEFT_OUT, SLOTLOCK_TENANT_EXPORT_TABLES, } from './types.js';

package/invitation-email.d.ts

@@ -0,0 +1,26 @@
+import type { SlotlockInvitationSender } from './dashboard.js';
+/** Where invitations are sent from (SLOTLOCK_INVITATION_EMAIL, _KEY, _FROM). */
+export interface SlotlockInvitationEmailConfig {
+    provider: 'resend' | 'postmark';
+    /** Resend's API key, or Postmark's server token. */
+    key: string;
+    /** The sender, as the provider has it verified: `Slotlock <team@example.com>` or an address. */
+    from: string;
+}
+type Invitation = Parameters<SlotlockInvitationSender['send']>[0];
+/** A provider's refusal: its name and HTTP status alone (its text can echo the address). */
+export declare class SlotlockInvitationEmailError extends Error {
+    name: string;
+}
+/** The message an invitation sends: subject, text and HTML saying the same, with no marketing. */
+export declare function slotlockInvitationEmail(invitation: Invitation, brandName?: string): {
+    subject: string;
+    text: string;
+    html: string;
+};
+/** Sends each invitation once through the provider; throws on any answer but success. */
+export declare function createSlotlockInvitationEmailSender(config: SlotlockInvitationEmailConfig, options?: {
+    fetch?: typeof fetch;
+    brandName?: string;
+}): SlotlockInvitationSender;
+export {};

package/invitation-email.js

@@ -0,0 +1,73 @@
+// Team invitations by email (dashboard.ts SlotlockInvitationSender): a plain transactional message
+// with the link, sent through Resend or Postmark with the deployment's own key. Nothing else is
+// sent, and no address is kept by this module.
+import { createHash } from 'node:crypto';
+/** A provider's refusal: its name and HTTP status alone (its text can echo the address). */
+export class SlotlockInvitationEmailError extends Error {
+    name = 'SlotlockInvitationEmailError';
+}
+/** Resend refuses a request without a User-Agent (403), and a Worker's fetch sends none. */
+const USER_AGENT = 'Slotlock (+https://slotlock.pylota.io)';
+const escape = (value) => value.replace(/[&<>"']/g, (character) => `&#${character.charCodeAt(0)};`);
+/** The message an invitation sends: subject, text and HTML saying the same, with no marketing. */
+export function slotlockInvitationEmail(invitation, brandName = 'Slotlock') {
+    const until = `${invitation.expiresAt.toISOString().slice(0, 16).replace('T', ' ')} UTC`;
+    const subject = `${invitation.inviter} invited you to ${invitation.workspace} on ${brandName}`;
+    const lines = [
+        `${invitation.inviter} invited you to join ${invitation.workspace} on ${brandName} as ${invitation.role}.`,
+        `Join: ${invitation.link}`,
+        `The link works once, for this address, until ${until}. If you did not expect it, ignore this email: nothing happens unless you use the link.`,
+    ];
+    const html = `<!doctype html><html><body style="font-family:system-ui,sans-serif;line-height:1.5;color:#111"><p>${escape(lines[0])}</p><p><a href="${escape(invitation.link)}">Join ${escape(invitation.workspace)}</a></p><p style="color:#555;font-size:14px">${escape(lines[2])}</p></body></html>`;
+    return { subject, text: `${lines.join('\n\n')}\n`, html };
+}
+/** Sends each invitation once through the provider; throws on any answer but success. */
+export function createSlotlockInvitationEmailSender(config, options = {}) {
+    const fetchImpl = options.fetch ?? fetch;
+    return {
+        async send(invitation) {
+            const message = slotlockInvitationEmail(invitation, options.brandName);
+            const request = config.provider === 'resend'
+                ? {
+                    url: 'https://api.resend.com/emails',
+                    headers: {
+                        authorization: `Bearer ${config.key}`,
+                        'content-type': 'application/json',
+                        'user-agent': USER_AGENT,
+                        // One send per link, however often the person inviting submits: keyed by the link,
+                        // as a digest, so the key names no address.
+                        'idempotency-key': createHash('sha256').update(invitation.link, 'utf8').digest('hex'),
+                    },
+                    body: { from: config.from, to: [invitation.to], subject: message.subject, text: message.text, html: message.html },
+                }
+                : {
+                    url: 'https://api.postmarkapp.com/email',
+                    headers: {
+                        'x-postmark-server-token': config.key,
+                        'content-type': 'application/json',
+                        accept: 'application/json',
+                        'user-agent': USER_AGENT,
+                    },
+                    body: {
+                        From: config.from,
+                        To: invitation.to,
+                        Subject: message.subject,
+                        TextBody: message.text,
+                        HtmlBody: message.html,
+                        MessageStream: 'outbound',
+                    },
+                };
+            const response = await fetchImpl(request.url, {
+                method: 'POST',
+                headers: request.headers,
+                body: JSON.stringify(request.body),
+                redirect: 'manual',
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (!response.ok) {
+                // The status alone: a provider's error text can echo the address.
+                throw new SlotlockInvitationEmailError(`${config.provider === 'resend' ? 'Resend' : 'Postmark'} answered HTTP ${response.status}`);
+            }
+        },
+    };
+}

package/maintenance.d.ts

@@ -9,8 +9,8 @@ export interface SlotlockMaintenanceResult {
     refused: number;
     /**
      * Rows deleted: expired holds and their keyed answers; past retention, event idempotency answers,
-     * agent event cancellations, stray booking retirements and feed changes; and expired assistant
-     * conversations. A cancelled booking's tombstone stays.
+     * agent event cancellations, stray booking retirements and feed changes; expired assistant
+     * conversations; and audit events past retention. A cancelled booking's tombstone stays.
      */
     pruned: number;
     /**
@@ -102,6 +102,11 @@ export interface SlotlockMaintenanceSchedulerOptions {
     usage?: boolean;
     /** Fetches holiday calendar subscriptions due to be imported again (maintainSlotlockTenant). */
     holidayFetch?: typeof fetch;
+    /**
+     * Team workspaces' verified domains looked up again (workspace-domains.ts runSlotlockDomainChecks):
+     * run with each sweep, at most every quarter hour. What it throws goes to onError.
+     */
+    domainChecks?: () => Promise<unknown>;
     /** A pass that ran: counts only, never the tenant. Not awaited; what it throws is ignored. */
     onPass?: (result: SlotlockMaintenanceResult) => void;
     /**

package/maintenance.js

@@ -1,5 +1,5 @@
 import { ignoreRejection } from './hooks.js';
-import { SLOTLOCK_MAX_WAITLIST_PER_TENANT, calendarEventRollingHorizon, } from './store.js';
+import { SLOTLOCK_MAX_WAITLIST_PER_TENANT, buildSlotlockTenantExport, calendarEventRollingHorizon, } from './store.js';
 import { readSlotlockHolidayCalendar } from './holiday-import.js';
 /**
  * One maintenance pass for a tenant: roll its recurring events to the horizon, then purge expired
@@ -73,6 +73,15 @@ export async function maintainSlotlockTenant(store, tenantRef, options = {}) {
     options.signal?.throwIfAborted();
     // Conversations expire 2 hours after their last message (dashboard.ts).
     pruned += await withTenant((tenant) => tenant.pruneAssistantConversations({ tenantRef }));
+    // Audit events past retention (SLOTLOCK_AUDIT_RETENTION_DAYS, 180).
+    pruned += await withTenant((tenant) => tenant.pruneAuditEvents({ tenantRef }));
+    // Exports past their time go; one a stopped server left pending is built now (RFC 0004 D3).
+    const exports = await withTenant((tenant) => tenant.pruneTenantExports({ tenantRef }));
+    pruned += exports.deleted;
+    for (const exportId of exports.pending) {
+        options.signal?.throwIfAborted();
+        await buildSlotlockTenantExport(store, tenantRef, exportId);
+    }
     const zones = await withTenant((tenant) => tenant.followZoneRules({ tenantRef, move: options.followZoneRules === true }));
     const staleSources = await withTenant((tenant) => tenant.reportStaleCoverage({ tenantRef }));
     // Approvals past their wait, and no-shows, first: the time they free is offered to the waitlist
@@ -293,6 +302,11 @@ export function startSlotlockMaintenance(options) {
             return;
         lastSweep = Date.now();
         options.store.sweepAssistantConversations().catch(report);
+        // Team invitations finished a month ago, with the addresses they were sent to, and sessions
+        // ended a day ago.
+        options.store.sweepDashboardRecords().catch(report);
+        // Verified domains whose daily check (or a pending claim's hourly one) is due.
+        options.domainChecks?.().catch(report);
     };
     // Every tenant with data, once an interval: those no key has called since the server started too.
     let lastDiscovery = Number.NEGATIVE_INFINITY;

package/oidc.d.ts

@@ -0,0 +1,135 @@
+/** The algorithms Slotlock verifies: RSA PKCS#1 v1.5, RSA-PSS and ECDSA P-256, all with SHA-256. */
+export declare const SLOTLOCK_OIDC_ALGORITHMS: readonly ["RS256", "PS256", "ES256"];
+export type SlotlockOidcAlgorithm = (typeof SLOTLOCK_OIDC_ALGORITHMS)[number];
+/** Why an ID token was refused (never shown with the token). */
+export type SlotlockIdTokenRefusal = 'malformed' | 'algorithm' | 'key' | 'signature' | 'issuer' | 'audience' | 'expired' | 'not_yet_valid' | 'issued_at' | 'nonce' | 'subject';
+/** RFC 4648 base64url, without padding, to bytes; null when it is not that. */
+export declare function slotlockBase64UrlBytes(text: string): Uint8Array<ArrayBuffer> | null;
+/** Bytes as RFC 4648 base64url, without padding. */
+export declare function slotlockBase64Url(bytes: Uint8Array): string;
+/** A JWK as an issuer publishes it. */
+export interface SlotlockJwk {
+    kty?: unknown;
+    kid?: unknown;
+    use?: unknown;
+    alg?: unknown;
+    n?: unknown;
+    e?: unknown;
+    crv?: unknown;
+    x?: unknown;
+    y?: unknown;
+}
+/**
+ * A published key as a verification key for `alg`, or null when it does not fit it: RSA (at least
+ * 2048 bits) for RS256 and PS256, EC P-256 for ES256; `use`, when given, `sig`; `alg`, when given,
+ * the token's.
+ */
+export declare function importSlotlockJwk(jwk: SlotlockJwk, alg: SlotlockOidcAlgorithm): Promise<CryptoKey | null>;
+/** Finds the key a token names: by issuer's JWKS and key id (see createSlotlockJwksCache). */
+export type SlotlockKeyLookup = (kid: string | null, alg: SlotlockOidcAlgorithm) => Promise<CryptoKey | null>;
+/** What an ID token is checked against. */
+export interface SlotlockIdTokenExpectation {
+    /** The exact issuer, or the exact spellings one issuer documents (Google has two). */
+    issuers: readonly string[];
+    clientId: string;
+    /** The algorithms this issuer may sign with: a subset of SLOTLOCK_OIDC_ALGORITHMS. */
+    algorithms: readonly SlotlockOidcAlgorithm[];
+    keys: SlotlockKeyLookup;
+    nonce: string;
+    /** Milliseconds since the epoch. */
+    now: number;
+}
+/** An ID token checked: its claims, all of them, for the caller to read what it needs. */
+export type SlotlockIdTokenResult = {
+    claims: Record<string, unknown>;
+} | {
+    refusal: SlotlockIdTokenRefusal;
+};
+/** Check an ID token: its signature first, then its claims, in OpenID Connect Core's order. */
+export declare function verifySlotlockIdToken(token: string, expected: SlotlockIdTokenExpectation): Promise<SlotlockIdTokenResult>;
+/** Why a URL an Owner gave, or a document fetched from one, was refused. */
+export declare class SlotlockOidcFetchError extends Error {
+    readonly code: 'url' | 'redirect' | 'status' | 'type' | 'size' | 'json' | 'network';
+    constructor(code: 'url' | 'redirect' | 'status' | 'type' | 'size' | 'json' | 'network', message: string);
+}
+/**
+ * Whether a URL is one Slotlock fetches for a team: https on the default port, a host name (never
+ * an IP literal), never localhost, a single label, or a private-use suffix; no credentials.
+ */
+export declare function slotlockOidcUrlAllowed(value: string): URL | null;
+/**
+ * GET a JSON document from a URL an Owner influenced: refused unless slotlockOidcUrlAllowed; no
+ * redirect followed (any 3xx refuses); 5 seconds; 256 KB; a JSON content type. On Node, pass a
+ * fetch that refuses private addresses (webhooks.ts createSlotlockGuardedFetch).
+ */
+export declare function slotlockFetchOidcJson(value: string, options?: {
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+    maxBytes?: number;
+}): Promise<{
+    body: Record<string, unknown>;
+    maxAge: number | null;
+}>;
+/**
+ * A JSON object answered by a host an Owner chose, read to at most maxBytes (the declared length
+ * first, then as it streams), so a provider cannot make the server buffer an endless answer.
+ */
+export declare function slotlockReadJsonBody(response: Response, maxBytes: number): Promise<Record<string, unknown>>;
+/** An issuer's endpoints, as its discovery document gave them when an Owner saved the connection. */
+export interface SlotlockOidcProvider {
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    jwksUri: string;
+    algorithms: SlotlockOidcAlgorithm[];
+    /** RFC 9207: the issuer returns `iss` with the code, and Slotlock then checks it. */
+    issParameter: boolean;
+}
+/**
+ * An issuer's discovery document (OpenID Connect Discovery 1.0): its `issuer` must be exactly the
+ * one entered, its endpoints https on public host names, and it must sign with an algorithm Slotlock
+ * verifies.
+ */
+export declare function discoverSlotlockOidc(issuer: string, options?: {
+    fetch?: typeof fetch;
+}): Promise<SlotlockOidcProvider>;
+/**
+ * An Entra ID tenant's v2.0 issuer, pinned to its GUID: never `common`, `organizations`,
+ * `consumers`, a domain name or the consumer tenant, so the multi-tenant `{tenantid}` issuer never
+ * exists in Slotlock. Null when the tenant is not one.
+ */
+export declare function slotlockEntraIssuer(tenant: string): string | null;
+/** Google's issuer, in the two spellings it documents. */
+export declare const SLOTLOCK_GOOGLE_ISSUERS: readonly string[];
+/**
+ * Issuers' keys, by JWKS URL: kept for the answer's max-age (5 minutes to 24 hours). A key id not
+ * among them is fetched again at most once a minute per URL, one fetch at a time; while the URL
+ * fails, a set fetched within 24 hours still serves the keys it holds. At most `maxUrls` URLs and 20
+ * keys each are kept, only the fields verifying needs: the URLs are Owners' to choose.
+ */
+export declare function createSlotlockJwksCache(options: {
+    fetchJson?: (url: string) => Promise<{
+        body: Record<string, unknown>;
+        maxAge: number | null;
+    }>;
+    fetch?: typeof fetch;
+    now?: () => number;
+    /** How many JWKS URLs are kept (100): the least recently used goes first. */
+    maxUrls?: number;
+}): {
+    /** The key `kid` names at `url` for `alg`, or null. */
+    key(url: string, kid: string | null, alg: SlotlockOidcAlgorithm): Promise<CryptoKey | null>;
+    /** A lookup bound to one JWKS URL, for verifySlotlockIdToken. */
+    lookup(url: string): SlotlockKeyLookup;
+};
+export type SlotlockJwksCache = ReturnType<typeof createSlotlockJwksCache>;
+/**
+ * Seals and opens a team's client secret: AES-256-GCM under a key derived (HKDF-SHA-256) from
+ * SLOTLOCK_SSO_SECRET, a random 12-byte IV each time, and the team and connection as associated
+ * data, so a sealed secret moved to another row does not open.
+ */
+export declare function createSlotlockSecretBox(secret: string): {
+    seal(plaintext: string, associated: string): Promise<string>;
+    open(sealed: string, associated: string): Promise<string | null>;
+};
+export type SlotlockSecretBox = ReturnType<typeof createSlotlockSecretBox>;