slotlock 0.9.0 → 0.10.0

package/scim.js

@@ -0,0 +1,416 @@
+// SCIM 2.0 (RFC 7643, RFC 7644) as Okta and Microsoft Entra ID speak it (teams phase 5.6–5.7): the
+// pure part, shared by both runtimes. Requests are normalised here before anything is applied, so
+// the database sees one shape whichever provider sent it:
+// - `op` in any case (Entra without `aadOptscim062020` sends "Replace");
+// - booleans as JSON booleans or the strings "True"/"False" (Entra again);
+// - a replace with no path whose value holds dotted or URN-qualified keys (Entra with the flag,
+//   Okta's deactivation) expanded into one operation per attribute;
+// - Okta's group rename, which carries the group's own id in its value, accepted;
+// - Entra's member removal without the flag ({"op":"Remove","path":"members","value":[{value}]})
+//   read as removing those members, never as clearing the list;
+// - a remove with no path refused (400 noTarget), as RFC 7644 §3.5.2.2 says.
+// Attributes Slotlock does not keep (Entra's enterprise extension, phone numbers, …) are ignored.
+export const SLOTLOCK_SCIM_CONTENT_TYPE = 'application/scim+json';
+export const SCIM_USER_SCHEMA = 'urn:ietf:params:scim:schemas:core:2.0:User';
+export const SCIM_GROUP_SCHEMA = 'urn:ietf:params:scim:schemas:core:2.0:Group';
+export const SCIM_PATCH_SCHEMA = 'urn:ietf:params:scim:api:messages:2.0:PatchOp';
+export const SCIM_LIST_SCHEMA = 'urn:ietf:params:scim:api:messages:2.0:ListResponse';
+export const SCIM_ERROR_SCHEMA = 'urn:ietf:params:scim:api:messages:2.0:Error';
+/** A page holds at most this many resources (ServiceProviderConfig's filter.maxResults). */
+export const SLOTLOCK_SCIM_MAX_RESULTS = 100;
+/** A request refused: its status and SCIM error type. */
+export class SlotlockScimError extends Error {
+    status;
+    scimType;
+    constructor(status, scimType, message) {
+        super(message);
+        this.status = status;
+        this.scimType = scimType;
+        this.name = 'SlotlockScimError';
+    }
+}
+/** An error body: `status` as a string, as RFC 7644 §3.12 has it. */
+export function slotlockScimErrorBody(status, scimType, detail) {
+    return { schemas: [SCIM_ERROR_SCHEMA], status: String(status), ...(scimType ? { scimType } : {}), detail };
+}
+const invalid = (detail) => new SlotlockScimError(400, 'invalidValue', detail);
+const textOf = (value, what, max = 254) => {
+    if (value === null || value === undefined)
+        return null;
+    if (typeof value !== 'string' || value.length > max || /[\p{Cc}]/u.test(value))
+        throw invalid(`${what} must be text of at most ${max} characters`);
+    const trimmed = value.trim();
+    return trimmed === '' ? null : trimmed;
+};
+/** A SCIM boolean: true or false, or the strings Entra sends ("True", "False"). */
+export function slotlockScimBoolean(value) {
+    if (value === true || value === false)
+        return value;
+    if (typeof value === 'string' && /^(true|false)$/i.test(value.trim()))
+        return value.trim().toLowerCase() === 'true';
+    throw invalid('active must be true or false');
+}
+/** The work email of an `emails` value: type work, else primary, else the first. */
+function workEmailOf(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (!Array.isArray(value))
+        throw invalid('emails must be a list');
+    const emails = value.filter((entry) => typeof entry === 'object' && entry !== null);
+    const chosen = emails.find((entry) => typeof entry.type === 'string' && entry.type.toLowerCase() === 'work') ??
+        emails.find((entry) => entry.primary === true || entry.primary === 'true' || entry.primary === 'True') ??
+        emails[0];
+    const address = textOf(chosen?.value, 'An email');
+    return address === null ? null : address.toLowerCase();
+}
+/** A user as a POST or PUT body gives it (RFC 7643 §4.1): what Slotlock keeps, the rest ignored. */
+export function slotlockScimUserFromBody(body) {
+    if (typeof body !== 'object' || body === null || Array.isArray(body))
+        throw new SlotlockScimError(400, 'invalidSyntax', 'A user is a JSON object');
+    const user = body;
+    const userName = textOf(user.userName, 'userName');
+    if (userName === null)
+        throw invalid('userName is required');
+    const name = typeof user.name === 'object' && user.name !== null ? user.name : {};
+    return {
+        userName,
+        externalId: textOf(user.externalId, 'externalId', 255),
+        active: user.active === undefined ? true : slotlockScimBoolean(user.active),
+        givenName: textOf(name.givenName, 'name.givenName', 100),
+        familyName: textOf(name.familyName, 'name.familyName', 100),
+        displayName: textOf(user.displayName, 'displayName', 200),
+        workEmail: workEmailOf(user.emails),
+    };
+}
+/** A group as a POST or PUT body gives it. */
+export function slotlockScimGroupFromBody(body) {
+    if (typeof body !== 'object' || body === null || Array.isArray(body))
+        throw new SlotlockScimError(400, 'invalidSyntax', 'A group is a JSON object');
+    const group = body;
+    const displayName = textOf(group.displayName, 'displayName', 200);
+    if (displayName === null)
+        throw invalid('displayName is required');
+    return { displayName, externalId: textOf(group.externalId, 'externalId', 255), members: membersOf(group.members) };
+}
+function membersOf(value) {
+    if (value === null || value === undefined)
+        return [];
+    if (!Array.isArray(value))
+        throw invalid('members must be a list');
+    const ids = [];
+    for (const entry of value) {
+        const id = typeof entry === 'object' && entry !== null ? entry.value : undefined;
+        if (typeof id !== 'string' || id.length === 0 || id.length > 64)
+            throw invalid('Each member is {"value": "<user id>"}');
+        ids.push(id);
+    }
+    return [...new Set(ids)];
+}
+/** A PATCH body's operations, normalised (see the top of this file). */
+export function slotlockScimPatchOperations(body) {
+    if (typeof body !== 'object' || body === null)
+        throw new SlotlockScimError(400, 'invalidSyntax', 'A patch is a JSON object');
+    const patch = body;
+    const schemas = Array.isArray(patch.schemas) ? patch.schemas : [];
+    if (!schemas.includes(SCIM_PATCH_SCHEMA))
+        throw new SlotlockScimError(400, 'invalidSyntax', `A patch names the schema ${SCIM_PATCH_SCHEMA}`);
+    const operations = patch.Operations ?? patch.operations;
+    if (!Array.isArray(operations) || operations.length === 0 || operations.length > 100) {
+        throw new SlotlockScimError(400, 'invalidSyntax', 'A patch has 1 to 100 Operations');
+    }
+    return operations.map((operation) => {
+        if (typeof operation !== 'object' || operation === null)
+            throw new SlotlockScimError(400, 'invalidSyntax', 'Each operation is an object');
+        const { op, path, value } = operation;
+        const name = typeof op === 'string' ? op.toLowerCase() : '';
+        if (name !== 'add' && name !== 'replace' && name !== 'remove')
+            throw new SlotlockScimError(400, 'invalidSyntax', 'op is add, replace or remove');
+        if (path !== undefined && path !== null && (typeof path !== 'string' || path.length > 200))
+            throw new SlotlockScimError(400, 'invalidPath', 'path is text');
+        const target = typeof path === 'string' && path.trim() !== '' ? path.trim() : null;
+        if (name === 'remove' && target === null)
+            throw new SlotlockScimError(400, 'noTarget', 'A remove names its path');
+        return { op: name, path: target, value };
+    });
+}
+/** A path without the core schema's URN prefix, in lowercase; null for an extension's (ignored). */
+function corePath(path, schema) {
+    const lower = path.toLowerCase();
+    const prefix = `${schema.toLowerCase()}:`;
+    if (lower.startsWith(prefix))
+        return lower.slice(prefix.length);
+    if (lower.startsWith('urn:'))
+        return null;
+    return lower;
+}
+/** Each attribute a path-less add or replace sets: its keys as paths (dotted or URN-qualified). */
+function expand(operation) {
+    if (operation.path !== null)
+        return [operation];
+    if (typeof operation.value !== 'object' || operation.value === null || Array.isArray(operation.value)) {
+        throw invalid('An add or replace without a path holds an object of attributes');
+    }
+    return Object.entries(operation.value).map(([key, value]) => ({ op: operation.op, path: key, value }));
+}
+/** A user changed by a patch, all of it or none (RFC 7644 §3.5.2: a patch is atomic). */
+export function slotlockScimPatchUser(current, id, operations) {
+    const next = { ...current };
+    for (const operation of operations.flatMap(expand)) {
+        const path = corePath(operation.path, SCIM_USER_SCHEMA);
+        if (path === null || path === 'schemas' || path === 'meta')
+            continue;
+        const removing = operation.op === 'remove';
+        const value = removing ? null : operation.value;
+        switch (path) {
+            case 'id':
+                if (value !== id)
+                    throw new SlotlockScimError(400, 'mutability', 'id is read-only');
+                break;
+            case 'active':
+                if (removing)
+                    throw invalid('active cannot be removed');
+                next.active = slotlockScimBoolean(value);
+                break;
+            case 'username': {
+                const userName = textOf(value, 'userName');
+                if (userName === null)
+                    throw invalid('userName is required');
+                next.userName = userName;
+                break;
+            }
+            case 'externalid':
+                next.externalId = textOf(value, 'externalId', 255);
+                break;
+            case 'displayname':
+                next.displayName = textOf(value, 'displayName', 200);
+                break;
+            case 'name.givenname':
+                next.givenName = textOf(value, 'name.givenName', 100);
+                break;
+            case 'name.familyname':
+                next.familyName = textOf(value, 'name.familyName', 100);
+                break;
+            case 'name': {
+                const name = typeof value === 'object' && value !== null ? value : {};
+                next.givenName = removing ? null : textOf(name.givenName, 'name.givenName', 100);
+                next.familyName = removing ? null : textOf(name.familyName, 'name.familyName', 100);
+                break;
+            }
+            case 'emails':
+                next.workEmail = removing ? null : workEmailOf(value);
+                break;
+            case 'emails[type eq "work"].value':
+            case 'emails[type eq "work"]': {
+                const address = path.endsWith('.value') ? textOf(value, 'An email') : workEmailOf(value === null ? null : [value]);
+                next.workEmail = address === null ? null : address.toLowerCase();
+                break;
+            }
+            default:
+                // Kept nowhere in Slotlock (title, phone numbers, addresses, locale, …): ignored.
+                break;
+        }
+    }
+    return next;
+}
+/** A group changed by a patch, all of it or none. */
+export function slotlockScimPatchGroup(current, id, operations) {
+    const next = { ...current, members: [...current.members] };
+    for (const operation of operations.flatMap(expand)) {
+        const raw = operation.path;
+        const path = corePath(raw, SCIM_GROUP_SCHEMA);
+        if (path === null || path === 'schemas' || path === 'meta')
+            continue;
+        const member = /^members\[value eq "([^"\\]{1,64})"\]$/.exec(path)?.[1];
+        if (member !== undefined) {
+            if (operation.op !== 'remove')
+                throw new SlotlockScimError(400, 'invalidPath', 'A member filter only removes');
+            // The id as sent (ids are case-sensitive); the path was lowercased to match its shape only.
+            const sent = /\[value eq "([^"\\]{1,64})"\]/i.exec(raw)?.[1] ?? member;
+            next.members = next.members.filter((existing) => existing !== sent);
+            continue;
+        }
+        switch (path) {
+            case 'id':
+                if (operation.value !== id)
+                    throw new SlotlockScimError(400, 'mutability', 'id is read-only');
+                break;
+            case 'displayname': {
+                if (operation.op === 'remove')
+                    throw invalid('displayName cannot be removed');
+                const displayName = textOf(operation.value, 'displayName', 200);
+                if (displayName === null)
+                    throw invalid('displayName is required');
+                next.displayName = displayName;
+                break;
+            }
+            case 'externalid':
+                next.externalId = operation.op === 'remove' ? null : textOf(operation.value, 'externalId', 255);
+                break;
+            case 'members': {
+                if (operation.op === 'replace') {
+                    next.members = membersOf(operation.value);
+                }
+                else if (operation.op === 'add') {
+                    next.members = [...new Set([...next.members, ...membersOf(operation.value)])];
+                }
+                else if (operation.value === undefined || operation.value === null) {
+                    // RFC 7644: a remove of the whole attribute.
+                    next.members = [];
+                }
+                else {
+                    // Entra without the flag: the members named, not the list.
+                    const removed = new Set(membersOf(operation.value));
+                    next.members = next.members.filter((existing) => !removed.has(existing));
+                }
+                break;
+            }
+            default:
+                break;
+        }
+    }
+    return next;
+}
+/**
+ * A filter (RFC 7644 §3.4.2.2) as Okta and Entra send it: `eq` comparisons of the allowed
+ * attributes, joined by `and`. Anything else is 400 invalidFilter.
+ */
+export function slotlockScimFilter(filter, allowed) {
+    if (filter.length > 500)
+        throw new SlotlockScimError(400, 'invalidFilter', 'The filter is too long');
+    const comparisons = [];
+    let rest = filter.trim();
+    const comparison = /^([A-Za-z][A-Za-z0-9._:-]*(?:\[[A-Za-z]+ eq "[A-Za-z]+"\]\.[A-Za-z]+)?)\s+eq\s+"((?:[^"\\]|\\.){0,254})"/i;
+    for (;;) {
+        const match = comparison.exec(rest);
+        if (!match)
+            throw new SlotlockScimError(400, 'invalidFilter', 'Slotlock filters by eq, joined by and');
+        const attribute = corePath(match[1], SCIM_USER_SCHEMA) ?? '';
+        if (!allowed.includes(attribute))
+            throw new SlotlockScimError(400, 'invalidFilter', `Slotlock does not filter by ${match[1]}`);
+        let value;
+        try {
+            value = JSON.parse(`"${match[2]}"`);
+        }
+        catch {
+            throw new SlotlockScimError(400, 'invalidFilter', 'The filter value is not a valid string');
+        }
+        if (/\p{Cc}/u.test(value))
+            throw new SlotlockScimError(400, 'invalidFilter', 'The filter value holds a control character');
+        comparisons.push({ attribute, value });
+        rest = rest.slice(match[0].length).trim();
+        if (rest === '')
+            return comparisons;
+        const and = /^and\s+/i.exec(rest);
+        if (!and || comparisons.length >= 5)
+            throw new SlotlockScimError(400, 'invalidFilter', 'Slotlock filters by eq, joined by and');
+        rest = rest.slice(and[0].length);
+    }
+}
+/** A user as SCIM answers it: every attribute Slotlock keeps, so a GET then PUT loses nothing. */
+export function slotlockScimUserResource(id, user, meta) {
+    return {
+        schemas: [SCIM_USER_SCHEMA],
+        id,
+        ...(user.externalId !== null ? { externalId: user.externalId } : {}),
+        userName: user.userName,
+        active: user.active,
+        ...(user.givenName !== null || user.familyName !== null
+            ? { name: { ...(user.givenName !== null ? { givenName: user.givenName } : {}), ...(user.familyName !== null ? { familyName: user.familyName } : {}) } }
+            : {}),
+        ...(user.displayName !== null ? { displayName: user.displayName } : {}),
+        ...(user.workEmail !== null ? { emails: [{ value: user.workEmail, type: 'work', primary: true }] } : {}),
+        meta: { resourceType: 'User', created: meta.created.toISOString(), lastModified: meta.lastModified.toISOString(), location: meta.location },
+    };
+}
+/** A group as SCIM answers it, with its members unless asked not to. */
+export function slotlockScimGroupResource(id, group, meta, withMembers = true) {
+    return {
+        schemas: [SCIM_GROUP_SCHEMA],
+        id,
+        displayName: group.displayName,
+        ...(group.externalId !== null ? { externalId: group.externalId } : {}),
+        ...(withMembers ? { members: group.members.map((member) => ({ value: member })) } : {}),
+        meta: { resourceType: 'Group', created: meta.created.toISOString(), lastModified: meta.lastModified.toISOString(), location: meta.location },
+    };
+}
+/** A list response; an empty one too (Entra needs it), with integer counts. */
+export function slotlockScimList(resources, totalResults, startIndex) {
+    return { schemas: [SCIM_LIST_SCHEMA], totalResults, startIndex, itemsPerPage: resources.length, Resources: resources };
+}
+/** startIndex and count as a page: startIndex below 1 read as 1, count clamped to 0–100. */
+export function slotlockScimPage(query) {
+    const start = Number.parseInt(query.get('startIndex') ?? '1', 10);
+    const count = Number.parseInt(query.get('count') ?? String(SLOTLOCK_SCIM_MAX_RESULTS), 10);
+    return {
+        // Within PostgreSQL's integer: past the end answers an empty page, never an error.
+        startIndex: Number.isFinite(start) && start >= 1 ? Math.min(start, 2_000_000_000) : 1,
+        count: Number.isFinite(count) ? Math.min(Math.max(count, 0), SLOTLOCK_SCIM_MAX_RESULTS) : SLOTLOCK_SCIM_MAX_RESULTS,
+    };
+}
+/** What Slotlock supports (RFC 7643 §5): PATCH, filters up to 100 results; no bulk, sort or ETags. */
+export function slotlockScimServiceProviderConfig(documentationUri) {
+    return {
+        schemas: ['urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig'],
+        documentationUri,
+        patch: { supported: true },
+        bulk: { supported: false, maxOperations: 0, maxPayloadSize: 0 },
+        filter: { supported: true, maxResults: SLOTLOCK_SCIM_MAX_RESULTS },
+        changePassword: { supported: false },
+        sort: { supported: false },
+        etag: { supported: false },
+        authenticationSchemes: [
+            { type: 'oauthbearertoken', name: 'Bearer token', description: 'The SCIM token from the team’s Identity settings', primary: true },
+        ],
+        meta: { resourceType: 'ServiceProviderConfig' },
+    };
+}
+/** The resource types Slotlock serves, as a list. */
+export function slotlockScimResourceTypes(base) {
+    const types = [
+        { schemas: ['urn:ietf:params:scim:schemas:core:2.0:ResourceType'], id: 'User', name: 'User', endpoint: '/Users', schema: SCIM_USER_SCHEMA, meta: { resourceType: 'ResourceType', location: `${base}/ResourceTypes/User` } },
+        { schemas: ['urn:ietf:params:scim:schemas:core:2.0:ResourceType'], id: 'Group', name: 'Group', endpoint: '/Groups', schema: SCIM_GROUP_SCHEMA, meta: { resourceType: 'ResourceType', location: `${base}/ResourceTypes/Group` } },
+    ];
+    return slotlockScimList(types, types.length, 1);
+}
+const attribute = (name, type, extra = {}) => ({
+    name,
+    type,
+    multiValued: false,
+    required: false,
+    caseExact: false,
+    mutability: 'readWrite',
+    returned: 'default',
+    uniqueness: 'none',
+    ...extra,
+});
+/** The schemas of what Slotlock keeps, as a list. */
+export function slotlockScimSchemas(base) {
+    const schemas = [
+        {
+            schemas: ['urn:ietf:params:scim:schemas:core:2.0:Schema'],
+            id: SCIM_USER_SCHEMA,
+            name: 'User',
+            attributes: [
+                attribute('userName', 'string', { required: true, uniqueness: 'server' }),
+                attribute('externalId', 'string', { caseExact: true }),
+                attribute('active', 'boolean'),
+                attribute('displayName', 'string'),
+                attribute('name', 'complex', { subAttributes: [attribute('givenName', 'string'), attribute('familyName', 'string')] }),
+                attribute('emails', 'complex', { multiValued: true, subAttributes: [attribute('value', 'string'), attribute('type', 'string'), attribute('primary', 'boolean')] }),
+            ],
+            meta: { resourceType: 'Schema', location: `${base}/Schemas/${SCIM_USER_SCHEMA}` },
+        },
+        {
+            schemas: ['urn:ietf:params:scim:schemas:core:2.0:Schema'],
+            id: SCIM_GROUP_SCHEMA,
+            name: 'Group',
+            attributes: [
+                attribute('displayName', 'string', { required: true, uniqueness: 'server' }),
+                attribute('externalId', 'string', { caseExact: true }),
+                attribute('members', 'complex', { multiValued: true, subAttributes: [attribute('value', 'string', { mutability: 'immutable' })] }),
+            ],
+            meta: { resourceType: 'Schema', location: `${base}/Schemas/${SCIM_GROUP_SCHEMA}` },
+        },
+    ];
+    return slotlockScimList(schemas, schemas.length, 1);
+}

package/self-host.d.ts

@@ -10,7 +10,7 @@ export { SlotlockConfigError, type SlotlockEnv, type SlotlockServeDashboardConfi
  * (site/docs-src/self-host.md) document these. Not STRIPE_SECRET_KEY, which only the owner's
  * `partner close` reads, to bill partners.
  */
-export declare const SLOTLOCK_ENVIRONMENT_VARIABLES: readonly ["DATABASE_URL", "SLOTLOCK_MIGRATE_DATABASE_URL", "SLOTLOCK_AUTH_TOKEN", "SLOTLOCK_CONFIRMATION_SECRET", "SLOTLOCK_CONFIRM_WRITES", "SLOTLOCK_METRICS_TOKEN", "SLOTLOCK_PUBLIC_URL", "SLOTLOCK_TENANT", "SLOTLOCK_AVAILABILITY", "SLOTLOCK_REST_API", "SLOTLOCK_RETENTION_DAYS", "SLOTLOCK_WEBHOOKS", "SLOTLOCK_SHARED_LIMITS", "SLOTLOCK_USAGE", "SLOTLOCK_QUOTAS", "SLOTLOCK_OVERAGE", "SLOTLOCK_LIMITS", "SLOTLOCK_TRUSTED_PROXY_HEADER", "SLOTLOCK_TRUSTED_PROXY_SECRET", "SLOTLOCK_KNOWN_CLIENTS", "OTEL_EXPORTER_OTLP_ENDPOINT", "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT", "OTEL_EXPORTER_OTLP_METRICS_ENDPOINT", "OTEL_EXPORTER_OTLP_HEADERS", "OTEL_SERVICE_NAME", "SLOTLOCK_GITHUB_CLIENT_ID", "SLOTLOCK_GITHUB_CLIENT_SECRET", "SLOTLOCK_GOOGLE_CLIENT_ID", "SLOTLOCK_GOOGLE_CLIENT_SECRET", "SLOTLOCK_SESSION_SECRET", "SLOTLOCK_ASSISTANT_SECRET", "SLOTLOCK_ASSISTANT_PREVIOUS_SECRETS", "SLOTLOCK_ASSISTANT_PRIVATE_URLS", "SLOTLOCK_DASHBOARD_USERS", "SLOTLOCK_DASHBOARD_ORGS", "SLOTLOCK_DASHBOARD_NAME", "SLOTLOCK_DASHBOARD_TERMS_URL", "SLOTLOCK_DASHBOARD_PRIVACY_URL", "HOST", "PORT"];
+export declare const SLOTLOCK_ENVIRONMENT_VARIABLES: readonly ["DATABASE_URL", "SLOTLOCK_MIGRATE_DATABASE_URL", "SLOTLOCK_AUTH_TOKEN", "SLOTLOCK_CONFIRMATION_SECRET", "SLOTLOCK_CONFIRM_WRITES", "SLOTLOCK_METRICS_TOKEN", "SLOTLOCK_PUBLIC_URL", "SLOTLOCK_TENANT", "SLOTLOCK_AVAILABILITY", "SLOTLOCK_REST_API", "SLOTLOCK_RETENTION_DAYS", "SLOTLOCK_WEBHOOKS", "SLOTLOCK_SHARED_LIMITS", "SLOTLOCK_USAGE", "SLOTLOCK_QUOTAS", "SLOTLOCK_OVERAGE", "SLOTLOCK_LIMITS", "SLOTLOCK_TRUSTED_PROXY_HEADER", "SLOTLOCK_TRUSTED_PROXY_SECRET", "SLOTLOCK_KNOWN_CLIENTS", "OTEL_EXPORTER_OTLP_ENDPOINT", "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT", "OTEL_EXPORTER_OTLP_METRICS_ENDPOINT", "OTEL_EXPORTER_OTLP_HEADERS", "OTEL_SERVICE_NAME", "SLOTLOCK_GITHUB_CLIENT_ID", "SLOTLOCK_GITHUB_CLIENT_SECRET", "SLOTLOCK_GOOGLE_CLIENT_ID", "SLOTLOCK_GOOGLE_CLIENT_SECRET", "SLOTLOCK_SESSION_SECRET", "SLOTLOCK_ASSISTANT_SECRET", "SLOTLOCK_ASSISTANT_PREVIOUS_SECRETS", "SLOTLOCK_ASSISTANT_PRIVATE_URLS", "SLOTLOCK_DASHBOARD_USERS", "SLOTLOCK_DASHBOARD_ORGS", "SLOTLOCK_DASHBOARD_TEAM_WORKSPACES", "SLOTLOCK_DASHBOARD_NAME", "SLOTLOCK_DASHBOARD_TERMS_URL", "SLOTLOCK_DASHBOARD_PRIVACY_URL", "SLOTLOCK_INVITATION_EMAIL", "SLOTLOCK_INVITATION_EMAIL_KEY", "SLOTLOCK_INVITATION_EMAIL_FROM", "SLOTLOCK_VERIFIED_DOMAINS", "SLOTLOCK_DNS_RESOLVER", "SLOTLOCK_TEAM_SSO", "SLOTLOCK_SSO_SECRET", "SLOTLOCK_TEAM_SCIM", "HOST", "PORT"];
 export interface SlotlockDatabaseConfig {
     /** The role `serve` and `resource` connect as. */
     databaseUrl: string;
@@ -60,6 +60,18 @@ export interface SlotlockServeConfig extends SlotlockDatabaseConfig {
      * keys may act for, whether it serves the dashboard or another server (a Worker) does.
      */
     allowedUsers?: '*' | string[];
+    /**
+     * Team workspaces (SLOTLOCK_DASHBOARD_TEAM_WORKSPACES=on), whether this server serves the dashboard
+     * or a Worker does: their `team:<id>` keys act only while the workspace exists (workspace_active).
+     */
+    teamWorkspaces?: boolean;
+    /**
+     * Verified domains (SLOTLOCK_VERIFIED_DOMAINS=on), whether this server serves the dashboard or a
+     * Worker does: their daily check runs in this server's maintenance.
+     */
+    verifiedDomains?: {
+        resolver: 'doh' | 'system';
+    };
     /**
      * Serve the REST API under /v1, with the application API for admin keys, and its OpenAPI document
      * (SLOTLOCK_REST_API: on unless off).
@@ -147,11 +159,12 @@ export interface SlotlockRunningServer {
 }
 /**
  * Whether the dashboard's allowlists let a tenant act, wherever the dashboard runs: a
- * `github-org:<id>` tenant only while SLOTLOCK_DASHBOARD_ORGS lists that organization; a
- * `github:<id>` tenant only while SLOTLOCK_DASHBOARD_USERS is `*` or lists that id; every tenant when
- * SLOTLOCK_DASHBOARD_USERS is not set, and every other tenant.
+ * `github-org:<id>` tenant only while SLOTLOCK_DASHBOARD_ORGS lists that organization; a `team:<id>`
+ * tenant only with SLOTLOCK_DASHBOARD_TEAM_WORKSPACES=on (and, as serve's authenticate asks, while
+ * it exists); a `github:<id>` tenant only while SLOTLOCK_DASHBOARD_USERS is `*` or lists that id;
+ * every tenant when SLOTLOCK_DASHBOARD_USERS is not set, and every other tenant.
  */
-export declare function slotlockServeAllowsTenant(config: Pick<SlotlockServeConfig, 'organizations' | 'allowedUsers'>, tenantRef: string): boolean;
+export declare function slotlockServeAllowsTenant(config: Pick<SlotlockServeConfig, 'organizations' | 'allowedUsers' | 'teamWorkspaces'>, tenantRef: string): boolean;
 /**
  * The store `serve` answers requests from. Every surface writes through it, so its tenant limits
  * bound what any key can add, and its transaction limits what one tenant holds of the shared pool.
@@ -166,7 +179,7 @@ export declare function createSlotlockMaintenanceStore(sql: SlotlockSql, caps: S
 }): SlotlockStore;
 /** Serve MCP and A2A over HTTP from the Postgres store, as one token-authenticated tenant. */
 export declare function startSlotlockServer(config: SlotlockServeConfig, log: SlotlockLogger): Promise<SlotlockRunningServer>;
-export declare const SLOTLOCK_CLI_HELP = "Usage: slotlock <command> [options]\n\nCommands:\n  migrate                  Apply the schema and row-level security, then grant the serving\n                           role when SLOTLOCK_MIGRATE_DATABASE_URL names another role\n  serve [--migrate]        Serve MCP, A2A and REST over HTTP (--migrate runs migrate first);\n                           maintains every tenant with data every hour\n  maintain                 Run maintenance for the tenant now: extend recurring events to the\n                           rolling horizon and prune past the retention window (for cron)\n  resource add <ref> [--timezone <IANA zone>]\n                           Create a calendar resource (a car, room, person or machine)\n  resource list            Print the tenant's resources, one JSON object per line\n  resource archive <ref>   Take a resource out of use: no new bookings, holds or events, and\n                           no longer listed; what is on it stays\n  resource restore <ref>   Put an archived resource back in use\n  resource parent <ref> (<parent-ref> | none)\n                           Make a resource a part of a composite (a room of a hall): booking\n                           the whole then takes every part, and a part's booking keeps the\n                           whole from being booked; none makes it no part\n  resource delete <ref>    Delete a resource and its history; refused while a booking, hold\n                           or event on it has not ended\n  hours show [--resource <ref>]\n                           Print each resource's bookable hours: its own (null when none) and\n                           what it inherits from its location or the tenant\n  hours set <json> (--resource <ref> | --location <ref> | --all [--override | --matching])\n                           Give one resource, one location or the tenant weekly hours; a\n                           resource without its own inherits its location's, then the\n                           tenant's, then the server's; --override also clears resources'\n                           own hours, --matching only those the same as the tenant's were\n                           or as these (copies 0.8.0 made); [] closes\n  hours clear (--resource <ref> | --location <ref> | --all)\n                           Clear those hours, so they inherit from further up\n  closures list            Print the tenant's closures and special days from yesterday on\n  closures add <first-day> [<last-day>] --label <text> [--open HH:MM-HH:MM]\n               [--resource <ref> | --location <ref>]\n                           Close whole days (YYYY-MM-DD), or with --open give them those hours\n                           instead, everywhere or for one location or resource\n  closures delete <id>     Remove a closure\n  closures import <file> [--resource <ref> | --location <ref>] [--label <calendar name>]\n                           Close the days an iCalendar file of holidays names (each all-day\n                           event, for the next two years); importing the calendar again (by its\n                           name: --label, else its own) updates them and removes those it dropped\n  rules set <json> --resource <ref>\n                           Set what a booking on the resource must satisfy, like\n                           {\"minNoticeMinutes\":120,\"slotStepMinutes\":30,\"turnaroundMinutes\":30,\"enforceHours\":true}\n  rules clear --resource <ref>\n                           Remove the resource's booking rules\n  key create <name> [--scope read,write,admin] [--expires-in-days <n>]\n             [--locations <ref,...>] [--groups <ref,...>]\n                           Create an API key for the tenant (default scope read,write, no\n                           expiry; admin adds the application API) and print it once; only its\n                           SHA-256 is stored. With --locations or --groups, the key reaches\n                           only the resources there (each location with those in it), read and\n                           write only\n             [--max-holds <n>] [--max-held-hours <n>] [--requests-per-minute <n>]\n             [--requires-approval]\n                           ... and hold the key below the server's limits: its live holds, the\n                           hours they hold, its requests a minute, and every booking it makes\n                           waiting for a person (the dashboard's Approvals)\n  key limits <id> [--max-holds <n>] [--max-held-hours <n>] [--requests-per-minute <n>]\n             [--requires-approval]\n                           Replace an active key's limits; none at all gives it the server's\n  key list                 Print the tenant's API keys, one JSON object per line\n  key rotate <id>          Give an active key a new secret and print it once; the old one stops\n                           working at once, and the key keeps its id and what it booked\n  key revoke <id>          Revoke one of the tenant's API keys at once\n  sandbox seed <car-rental|clinic|desks>\n                           Fill an empty test environment (SLOTLOCK_TENANT=<tenant>~test) with a\n                           scenario: locations, groups, resources, hours, rules and bookings\n  sandbox reset            Empty the test environment; its keys, webhooks and plan stay\n  sandbox fast-forward <minutes>\n                           Make what would lapse in the test environment within that time lapse\n                           now (holds, offers, approvals), then run maintenance\n  sandbox race <resource-ref> [--agents <n>] [--start <date-time>]\n                           Race agents (default 100) for one hour on a test resource and print who\n                           booked, who was refused and why, and how long the answers took\n  partner create <id> <name> --contract <json | @file>\n                           Create a partner reselling Slotlock, or change its name and contract:\n                           its plans (limits and quotas), its accounts' key scopes and its prices\n                           (as the schema owner, SLOTLOCK_MIGRATE_DATABASE_URL)\n  partner list             Print the partners, one JSON object per line\n  partner suspend <id>     Suspend a partner: every account with it, and its keys stop\n  partner unsuspend <id>   Make a suspended partner active again\n  partner key <id> <name>  Create a partner key (slk_partner_\u2026) and print it once\n  partner revoke-key <id> <key-id>\n                           Revoke one of a partner's keys at once\n  partner customer <id> <cus_\u2026>\n                           The Stripe customer its monthly invoice goes to\n  partner webhook <id> <https-url>\n                           Where usage.period_closed goes; prints its signing secret once\n  billing daily            Once a day (cron), as the schema owner: close last month for every\n                           active partner once it has been over for 6 hours, report overage\n                           when SLOTLOCK_OVERAGE is on (with STRIPE_SECRET_KEY), and list the\n                           partners' reconciliation mismatches of the last 7 days; exits 1 when\n                           anything waits or differs. Safe to run again\n  overage report [--month <YYYY-MM>] [--event <name>]\n                           With SLOTLOCK_OVERAGE: send Stripe each paying Developer tenant's\n                           operations above its quota this month (or --month) not yet sent, as\n                           Billing Meter events (--event, default slotlock_operations), once\n                           (as the schema owner, with STRIPE_SECRET_KEY)\n  partner close <id> [--month <YYYY-MM>]\n                           Close an ended month (default: last month): price its accounts' use\n                           with the contract, record the lines once, send usage.period_closed,\n                           and with STRIPE_SECRET_KEY add the lines to the partner's next Stripe\n                           invoice; safe to run again\n  tenant status            Print whether the tenant is suspended\n  tenant suspend [--reason <text>]\n                           Suspend the tenant: it may read, and writes nothing; its keys get\n                           no new secret (as SLOTLOCK_MIGRATE_DATABASE_URL's role when set:\n                           only the schema owner suspends)\n  tenant unsuspend         Lift the tenant's suspension (as the schema owner, likewise)\n  tenant erase --confirm <tenant>\n                           Delete everything the tenant has, its API keys included, for good;\n                           --confirm repeats SLOTLOCK_TENANT; refused while its hosted plan is\n                           paid for (cancel the subscription first)\n  plan status              Print the deployment's default plan and the tenant's own (hosted)\n  plan default (free | developer | none) [--from <date>]\n                           Put every tenant without a plan of its own on this one from --from\n                           (an ISO date or time; default now), or none for no default; a new\n                           tenant gets it at once (as the schema owner, like tenant suspend)\n  healthcheck              Exit 0 when the local server reports ready\n\nOptions:\n  -h, --help               Show this help\n  -v, --version            Print the version\n\nEnvironment:\n  DATABASE_URL                   postgres:// URL of the role Slotlock serves as (required); serve\n                                 refuses a superuser or a role with BYPASSRLS\n  SLOTLOCK_MIGRATE_DATABASE_URL  postgres:// URL of the schema owner, for migrate (optional)\n  SLOTLOCK_AUTH_TOKEN            Optional bearer token for SLOTLOCK_TENANT with read and write\n                                 access (never admin), 32+ random characters (serve); API keys\n                                 work with or without it\n  SLOTLOCK_CONFIRMATION_SECRET   Signs pending write confirmations, 32+ random characters (serve;\n                                 required when SLOTLOCK_CONFIRM_WRITES is not none)\n  SLOTLOCK_METRICS_TOKEN         Serves Prometheus metrics at /metrics to this bearer token, 32+\n                                 random characters (serve; off without it)\n  SLOTLOCK_CONFIRM_WRITES        none (default), all, or a comma-separated list of write tools\n                                 that wait for a person (MCP 2026-07-28 form elicitation; refused\n                                 with confirmation_required on REST, A2A and older MCP)\n  SLOTLOCK_PUBLIC_URL            URL clients use (default http://localhost:$PORT)\n  SLOTLOCK_TENANT                Tenant of the token, resource and key commands (default \"default\")\n  SLOTLOCK_AVAILABILITY          JSON array of weekly bookable-hours rules (default: none)\n  SLOTLOCK_REST_API              on (default): also serve the tools as a REST API under /v1, and\n                                 the application API for admin keys, described at /openapi.json;\n                                 off: MCP and A2A only\n  SLOTLOCK_RETENTION_DAYS        Days of history kept: the change feed, ended waitlist entries,\n                                 and retired answers (never under 30) (1-3650, default 30;\n                                 serve and maintain)\n  SLOTLOCK_USAGE                 on: count each tenant's operations, bookings and holds by day, API\n                                 key and surface (slotlock.usage_daily, kept 400 days); off\n                                 (default): record nothing\n  SLOTLOCK_QUOTAS                on (needs SLOTLOCK_USAGE=on): refuse a tenant on a plan past its\n                                 operations or bookings this month (quota_exceeded, 429); off\n                                 (default): no quota\n  SLOTLOCK_OVERAGE               off (default), or on (300) or a percent (111-1000): a paying\n                                 Developer tenant is refused only past that share of its\n                                 operations, and the rest above its quota is billed (overage\n                                 report); needs SLOTLOCK_QUOTAS=on\n  SLOTLOCK_SHARED_LIMITS         on: tenant request budgets are shared by every server through the\n                                 database, so N servers allow a tenant its rate once; off (default):\n                                 each server keeps its own\n  SLOTLOCK_WEBHOOKS              on (default): deliver each tenant's changes to its webhooks,\n                                 never to a private network address; private: those too, for\n                                 testing; off: keep the change feed, send nothing\n  SLOTLOCK_LIMITS                Request limits, comma-separated name=value over the defaults:\n                                 rates as <count>/<s|m|h>[:<burst>] or off for address (50/s:100,\n                                 every request per client, before any key lookup), key_read,\n                                 tenant_read (20/s:40), key_write, tenant_write (5/s:20),\n                                 global_read (500/s:1000), global_write (50/s:100), app_read\n                                 (20/s:40) and app_write (5/s:20) per tenant for the\n                                 application API, sign_in (20/m:20); counts for\n                                 tenant_series_writes and series_writes\n                                 (1: writes that may expand a recurring series at once),\n                                 maintenance_runs (1: application API maintenance runs at once),\n                                 subscriptions (256), tenant_subscriptions (16),\n                                 key_subscriptions (4, and fewer than tenant_subscriptions),\n                                 key_lookups (2), key_lookup_queue (256),\n                                 tenant_transactions (2: one tenant's database transactions at\n                                 once, of the pool's 10); what one tenant may store:\n                                 tenant_holds (10000), tenant_reservations, tenant_events and\n                                 tenant_coverage (100000), holder_holds (20) and\n                                 holder_held_hours (2160), which maintain keeps too\n  SLOTLOCK_TRUSTED_PROXY_HEADER  The request field a proxy in front sets to the client address,\n                                 such as CF-Connecting-IP (default: the connection's address);\n                                 set it only when every request comes through that proxy\n  SLOTLOCK_TRUSTED_PROXY_SECRET  A secret the proxy adds to every request in x-slotlock-proxy-proof,\n                                 32+ random characters: without it there, the field above is\n                                 ignored and the connection's address counts\n  SLOTLOCK_KNOWN_CLIENTS         Comma-separated integrator names /metrics counts requests by, from\n                                 their Slotlock-Client field (any other: other; none sent: none)\n  OTEL_EXPORTER_OTLP_ENDPOINT    An OpenTelemetry collector (OTLP over HTTP, JSON): a span per\n                                 call is sent to <endpoint>/v1/traces (off without it)\n  OTEL_EXPORTER_OTLP_TRACES_ENDPOINT The full traces URL instead of <endpoint>/v1/traces\n  OTEL_EXPORTER_OTLP_METRICS_ENDPOINT The full metrics URL instead of <endpoint>/v1/metrics (sent each minute)\n  OTEL_EXPORTER_OTLP_HEADERS     name=value pairs sent with each export, such as an API key\n  OTEL_SERVICE_NAME              service.name of the spans (default slotlock)\n  SLOTLOCK_GITHUB_CLIENT_ID      Serve the dashboard at $SLOTLOCK_PUBLIC_URL/dashboard: the Client ID\n                                 of a GitHub OAuth app with callback .../dashboard/callback\n  SLOTLOCK_GITHUB_CLIENT_SECRET  That app's client secret (dashboard)\n  SLOTLOCK_SESSION_SECRET        Signs dashboard sessions, 32+ random characters (dashboard)\n  SLOTLOCK_ASSISTANT_SECRET      Turns on the dashboard assistant and seals each organization's\n                                 model API key with it, 32+ random characters (dashboard; off\n                                 without it)\n  SLOTLOCK_ASSISTANT_PREVIOUS_SECRETS Up to three earlier SLOTLOCK_ASSISTANT_SECRET values,\n                                 comma-separated, newest first: keys sealed under one still open\n                                 and are sealed again under the current secret when next used\n  SLOTLOCK_ASSISTANT_PRIVATE_URLS off (default): refuse an assistant model URL whose host is, or\n                                 resolves to, a loopback, private, link-local, CGNAT, unique-local\n                                 or metadata address; on: allow them, for a self-hosted model\n                                 (Ollama, vLLM) on this machine or network\n  SLOTLOCK_GOOGLE_CLIENT_ID      Sign-in with Google too: the client id of a Google OAuth client with\n                                 redirect URI .../dashboard/callback (not with organization ids)\n  SLOTLOCK_GOOGLE_CLIENT_SECRET  Its client secret\n  SLOTLOCK_DASHBOARD_USERS       * or comma-separated GitHub user ids (and google:<subject>) that may sign in and whose keys work\n  SLOTLOCK_DASHBOARD_ORGS        comma-separated GitHub organization ids: each is one shared tenant;\n                                 or enabled: each person's own tenant, plus the organizations an\n                                 owner turns on from the dashboard's Teams page\n  SLOTLOCK_DASHBOARD_NAME        What the dashboard calls this deployment (default Slotlock)\n  SLOTLOCK_DASHBOARD_TERMS_URL   https URL of the terms people accept by signing in, linked on the\n                                 sign-in page (none named without it)\n  SLOTLOCK_DASHBOARD_PRIVACY_URL https URL of the privacy notice the sign-in page links\n  HOST                           Listen address (default 127.0.0.1)\n  PORT                           Listen port (default 8080)\n\nGenerate each secret with: openssl rand -hex 32\n";
+export declare const SLOTLOCK_CLI_HELP = "Usage: slotlock <command> [options]\n\nCommands:\n  migrate                  Apply the schema and row-level security, then grant the serving\n                           role when SLOTLOCK_MIGRATE_DATABASE_URL names another role\n  serve [--migrate]        Serve MCP, A2A and REST over HTTP (--migrate runs migrate first);\n                           maintains every tenant with data every hour\n  maintain                 Run maintenance for the tenant now: extend recurring events to the\n                           rolling horizon and prune past the retention window (for cron)\n  resource add <ref> [--timezone <IANA zone>]\n                           Create a calendar resource (a car, room, person or machine)\n  resource list            Print the tenant's resources, one JSON object per line\n  resource archive <ref>   Take a resource out of use: no new bookings, holds or events, and\n                           no longer listed; what is on it stays\n  resource restore <ref>   Put an archived resource back in use\n  resource parent <ref> (<parent-ref> | none)\n                           Make a resource a part of a composite (a room of a hall): booking\n                           the whole then takes every part, and a part's booking keeps the\n                           whole from being booked; none makes it no part\n  resource delete <ref>    Delete a resource and its history; refused while a booking, hold\n                           or event on it has not ended\n  hours show [--resource <ref>]\n                           Print each resource's bookable hours: its own (null when none) and\n                           what it inherits from its location or the tenant\n  hours set <json> (--resource <ref> | --location <ref> | --all [--override | --matching])\n                           Give one resource, one location or the tenant weekly hours; a\n                           resource without its own inherits its location's, then the\n                           tenant's, then the server's; --override also clears resources'\n                           own hours, --matching only those the same as the tenant's were\n                           or as these (copies 0.8.0 made); [] closes\n  hours clear (--resource <ref> | --location <ref> | --all)\n                           Clear those hours, so they inherit from further up\n  closures list            Print the tenant's closures and special days from yesterday on\n  closures add <first-day> [<last-day>] --label <text> [--open HH:MM-HH:MM]\n               [--resource <ref> | --location <ref>]\n                           Close whole days (YYYY-MM-DD), or with --open give them those hours\n                           instead, everywhere or for one location or resource\n  closures delete <id>     Remove a closure\n  closures import <file> [--resource <ref> | --location <ref>] [--label <calendar name>]\n                           Close the days an iCalendar file of holidays names (each all-day\n                           event, for the next two years); importing the calendar again (by its\n                           name: --label, else its own) updates them and removes those it dropped\n  rules set <json> --resource <ref>\n                           Set what a booking on the resource must satisfy, like\n                           {\"minNoticeMinutes\":120,\"slotStepMinutes\":30,\"turnaroundMinutes\":30,\"enforceHours\":true}\n  rules clear --resource <ref>\n                           Remove the resource's booking rules\n  key create <name> [--scope read,write,admin] [--expires-in-days <n>]\n             [--locations <ref,...>] [--groups <ref,...>]\n                           Create an API key for the tenant (default scope read,write, no\n                           expiry; admin adds the application API) and print it once; only its\n                           SHA-256 is stored. With --locations or --groups, the key reaches\n                           only the resources there (each location with those in it), read and\n                           write only\n             [--max-holds <n>] [--max-held-hours <n>] [--requests-per-minute <n>]\n             [--requires-approval]\n                           ... and hold the key below the server's limits: its live holds, the\n                           hours they hold, its requests a minute, and every booking it makes\n                           waiting for a person (the dashboard's Approvals)\n  key limits <id> [--max-holds <n>] [--max-held-hours <n>] [--requests-per-minute <n>]\n             [--requires-approval]\n                           Replace an active key's limits; none at all gives it the server's\n  key list                 Print the tenant's API keys, one JSON object per line\n  key rotate <id>          Give an active key a new secret and print it once; the old one stops\n                           working at once, and the key keeps its id and what it booked\n  key revoke <id>          Revoke one of the tenant's API keys at once\n  sandbox seed <car-rental|clinic|desks>\n                           Fill an empty test environment (SLOTLOCK_TENANT=<tenant>~test) with a\n                           scenario: locations, groups, resources, hours, rules and bookings\n  sandbox reset            Empty the test environment; its keys, webhooks and plan stay\n  sandbox fast-forward <minutes>\n                           Make what would lapse in the test environment within that time lapse\n                           now (holds, offers, approvals), then run maintenance\n  sandbox race <resource-ref> [--agents <n>] [--start <date-time>]\n                           Race agents (default 100) for one hour on a test resource and print who\n                           booked, who was refused and why, and how long the answers took\n  partner create <id> <name> --contract <json | @file>\n                           Create a partner reselling Slotlock, or change its name and contract:\n                           its plans (limits and quotas), its accounts' key scopes and its prices\n                           (as the schema owner, SLOTLOCK_MIGRATE_DATABASE_URL)\n  partner list             Print the partners, one JSON object per line\n  partner suspend <id>     Suspend a partner: every account with it, and its keys stop\n  partner unsuspend <id>   Make a suspended partner active again\n  partner key <id> <name>  Create a partner key (slk_partner_\u2026) and print it once\n  partner revoke-key <id> <key-id>\n                           Revoke one of a partner's keys at once\n  partner customer <id> <cus_\u2026>\n                           The Stripe customer its monthly invoice goes to\n  partner webhook <id> <https-url>\n                           Where usage.period_closed goes; prints its signing secret once\n  billing daily            Once a day (cron), as the schema owner: close last month for every\n                           active partner once it has been over for 6 hours, report overage\n                           when SLOTLOCK_OVERAGE is on (with STRIPE_SECRET_KEY), and list the\n                           partners' reconciliation mismatches of the last 7 days; exits 1 when\n                           anything waits or differs. Safe to run again\n  overage report [--month <YYYY-MM>] [--event <name>]\n                           With SLOTLOCK_OVERAGE: send Stripe each paying Developer tenant's\n                           operations above its quota this month (or --month) not yet sent, as\n                           Billing Meter events (--event, default slotlock_operations), once\n                           (as the schema owner, with STRIPE_SECRET_KEY)\n  partner close <id> [--month <YYYY-MM>]\n                           Close an ended month (default: last month): price its accounts' use\n                           with the contract, record the lines once, send usage.period_closed,\n                           and with STRIPE_SECRET_KEY add the lines to the partner's next Stripe\n                           invoice; safe to run again\n  tenant status            Print whether the tenant is suspended\n  tenant suspend [--reason <text>]\n                           Suspend the tenant: it may read, and writes nothing; its keys get\n                           no new secret (as SLOTLOCK_MIGRATE_DATABASE_URL's role when set:\n                           only the schema owner suspends)\n  tenant unsuspend         Lift the tenant's suspension (as the schema owner, likewise)\n  tenant export [--out <dir>]\n                           Print everything the tenant keeps, read at one moment, one JSON line a\n                           row ({\"table\": ..., \"row\": ...}); with --out, one <table>.ndjson file a\n                           table in that directory (new or empty). Secrets stay out\n  tenant erase --confirm <tenant>\n                           Delete everything the tenant has, its API keys included, for good;\n                           --confirm repeats SLOTLOCK_TENANT; refused while its hosted plan is\n                           paid for (cancel the subscription first)\n  audit verify             Check the tenant's audit log chain: prints how many events held and\n                           the first that does not (exit 1 when one does not)\n  audit export             Print the tenant's audit log, newest first, one JSON object per line\n  subject export (--email <address> | --holder <ref> | --contact <ref> | --reference <ref>)\n                           Print what the tenant keeps about one person, one JSON line per row:\n                           {\"table\": ..., \"row\": ...}, up to 10,000 rows a table\n  subject erase (--email <address> | --holder <ref> | --contact <ref> | --reference <ref>)\n                           Take one person out of the tenant's data: their contacts, attendee\n                           and waitlist entries go; their references become an erased name;\n                           bookings stay as time taken. Prints what it changed, by table\n  plan status              Print the deployment's default plan and the tenant's own (hosted)\n  plan default (free | developer | none) [--from <date>]\n                           Put every tenant without a plan of its own on this one from --from\n                           (an ISO date or time; default now), or none for no default; a new\n                           tenant gets it at once (as the schema owner, like tenant suspend)\n  healthcheck              Exit 0 when the local server reports ready\n\nOptions:\n  -h, --help               Show this help\n  -v, --version            Print the version\n\nEnvironment:\n  DATABASE_URL                   postgres:// URL of the role Slotlock serves as (required); serve\n                                 refuses a superuser or a role with BYPASSRLS\n  SLOTLOCK_MIGRATE_DATABASE_URL  postgres:// URL of the schema owner, for migrate (optional)\n  SLOTLOCK_AUTH_TOKEN            Optional bearer token for SLOTLOCK_TENANT with read and write\n                                 access (never admin), 32+ random characters (serve); API keys\n                                 work with or without it\n  SLOTLOCK_CONFIRMATION_SECRET   Signs pending write confirmations, 32+ random characters (serve;\n                                 required when SLOTLOCK_CONFIRM_WRITES is not none)\n  SLOTLOCK_METRICS_TOKEN         Serves Prometheus metrics at /metrics to this bearer token, 32+\n                                 random characters (serve; off without it)\n  SLOTLOCK_CONFIRM_WRITES        none (default), all, or a comma-separated list of write tools\n                                 that wait for a person (MCP 2026-07-28 form elicitation; refused\n                                 with confirmation_required on REST, A2A and older MCP)\n  SLOTLOCK_PUBLIC_URL            URL clients use (default http://localhost:$PORT)\n  SLOTLOCK_TENANT                Tenant of the token, resource and key commands (default \"default\")\n  SLOTLOCK_AVAILABILITY          JSON array of weekly bookable-hours rules (default: none)\n  SLOTLOCK_REST_API              on (default): also serve the tools as a REST API under /v1, and\n                                 the application API for admin keys, described at /openapi.json;\n                                 off: MCP and A2A only\n  SLOTLOCK_RETENTION_DAYS        Days of history kept: the change feed, ended waitlist entries,\n                                 and retired answers (never under 30) (1-3650, default 30;\n                                 serve and maintain)\n  SLOTLOCK_USAGE                 on: count each tenant's operations, bookings and holds by day, API\n                                 key and surface (slotlock.usage_daily, kept 400 days); off\n                                 (default): record nothing\n  SLOTLOCK_QUOTAS                on (needs SLOTLOCK_USAGE=on): refuse a tenant on a plan past its\n                                 operations or bookings this month (quota_exceeded, 429); off\n                                 (default): no quota\n  SLOTLOCK_OVERAGE               off (default), or on (300) or a percent (111-1000): a paying\n                                 Developer tenant is refused only past that share of its\n                                 operations, and the rest above its quota is billed (overage\n                                 report); needs SLOTLOCK_QUOTAS=on\n  SLOTLOCK_SHARED_LIMITS         on: tenant request budgets are shared by every server through the\n                                 database, so N servers allow a tenant its rate once; off (default):\n                                 each server keeps its own\n  SLOTLOCK_WEBHOOKS              on (default): deliver each tenant's changes to its webhooks,\n                                 never to a private network address; private: those too, for\n                                 testing; off: keep the change feed, send nothing\n  SLOTLOCK_LIMITS                Request limits, comma-separated name=value over the defaults:\n                                 rates as <count>/<s|m|h>[:<burst>] or off for address (50/s:100,\n                                 every request per client, before any key lookup), key_read,\n                                 tenant_read (20/s:40), key_write, tenant_write (5/s:20),\n                                 global_read (500/s:1000), global_write (50/s:100), app_read\n                                 (20/s:40) and app_write (5/s:20) per tenant for the\n                                 application API, sign_in (20/m:20); counts for\n                                 tenant_series_writes and series_writes\n                                 (1: writes that may expand a recurring series at once),\n                                 maintenance_runs (1: application API maintenance runs at once),\n                                 subscriptions (256), tenant_subscriptions (16),\n                                 key_subscriptions (4, and fewer than tenant_subscriptions),\n                                 key_lookups (2), key_lookup_queue (256),\n                                 tenant_transactions (2: one tenant's database transactions at\n                                 once, of the pool's 10); what one tenant may store:\n                                 tenant_holds (10000), tenant_reservations, tenant_events and\n                                 tenant_coverage (100000), holder_holds (20) and\n                                 holder_held_hours (2160), which maintain keeps too\n  SLOTLOCK_TRUSTED_PROXY_HEADER  The request field a proxy in front sets to the client address,\n                                 such as CF-Connecting-IP (default: the connection's address);\n                                 set it only when every request comes through that proxy\n  SLOTLOCK_TRUSTED_PROXY_SECRET  A secret the proxy adds to every request in x-slotlock-proxy-proof,\n                                 32+ random characters: without it there, the field above is\n                                 ignored and the connection's address counts\n  SLOTLOCK_KNOWN_CLIENTS         Comma-separated integrator names /metrics counts requests by, from\n                                 their Slotlock-Client field (any other: other; none sent: none)\n  OTEL_EXPORTER_OTLP_ENDPOINT    An OpenTelemetry collector (OTLP over HTTP, JSON): a span per\n                                 call is sent to <endpoint>/v1/traces (off without it)\n  OTEL_EXPORTER_OTLP_TRACES_ENDPOINT The full traces URL instead of <endpoint>/v1/traces\n  OTEL_EXPORTER_OTLP_METRICS_ENDPOINT The full metrics URL instead of <endpoint>/v1/metrics (sent each minute)\n  OTEL_EXPORTER_OTLP_HEADERS     name=value pairs sent with each export, such as an API key\n  OTEL_SERVICE_NAME              service.name of the spans (default slotlock)\n  SLOTLOCK_GITHUB_CLIENT_ID      Serve the dashboard at $SLOTLOCK_PUBLIC_URL/dashboard: the Client ID\n                                 of a GitHub OAuth app with callback .../dashboard/callback\n  SLOTLOCK_GITHUB_CLIENT_SECRET  That app's client secret (dashboard)\n  SLOTLOCK_SESSION_SECRET        Signs dashboard sessions, 32+ random characters (dashboard)\n  SLOTLOCK_ASSISTANT_SECRET      Turns on the dashboard assistant and seals each organization's\n                                 model API key with it, 32+ random characters (dashboard; off\n                                 without it)\n  SLOTLOCK_ASSISTANT_PREVIOUS_SECRETS Up to three earlier SLOTLOCK_ASSISTANT_SECRET values,\n                                 comma-separated, newest first: keys sealed under one still open\n                                 and are sealed again under the current secret when next used\n  SLOTLOCK_ASSISTANT_PRIVATE_URLS off (default): refuse an assistant model URL whose host is, or\n                                 resolves to, a loopback, private, link-local, CGNAT, unique-local\n                                 or metadata address; on: allow them, for a self-hosted model\n                                 (Ollama, vLLM) on this machine or network\n  SLOTLOCK_GOOGLE_CLIENT_ID      Sign-in with Google too: the client id of a Google OAuth client with\n                                 redirect URI .../dashboard/callback (not with organization ids)\n  SLOTLOCK_GOOGLE_CLIENT_SECRET  Its client secret\n  SLOTLOCK_DASHBOARD_USERS       * or comma-separated GitHub user ids (and google:<subject>) that may sign in and whose keys work\n  SLOTLOCK_DASHBOARD_ORGS        comma-separated GitHub organization ids: each is one shared tenant;\n                                 or enabled: each person's own tenant, plus the organizations an\n                                 owner turns on from the dashboard's Teams page\n  SLOTLOCK_DASHBOARD_TEAM_WORKSPACES on: anyone signed in creates team workspaces and invites\n                                 people to them by email, each with a role (default off; not\n                                 with organization ids)\n  SLOTLOCK_DASHBOARD_NAME        What the dashboard calls this deployment (default Slotlock)\n  SLOTLOCK_DASHBOARD_TERMS_URL   https URL of the terms people accept by signing in, linked on the\n                                 sign-in page (none named without it)\n  SLOTLOCK_DASHBOARD_PRIVACY_URL https URL of the privacy notice the sign-in page links\n  SLOTLOCK_INVITATION_EMAIL      resend or postmark: send team invitations by email (with team\n                                 workspaces; without it, the person inviting sends the link)\n  SLOTLOCK_INVITATION_EMAIL_KEY  Resend's API key, or Postmark's server token\n  SLOTLOCK_INVITATION_EMAIL_FROM The sender the provider verified: team@example.com or Name <...>\n  SLOTLOCK_VERIFIED_DOMAINS      on or off (default): team Owners verify their domain with a DNS\n                                 record, and people at it may ask to join (with team workspaces)\n  SLOTLOCK_DNS_RESOLVER          doh (default: Cloudflare, checked by Google) or system: how a\n                                 verified domain's record is looked up each day\n  SLOTLOCK_TEAM_SSO              on or off (default): each team signs in through its own identity\n                                 provider over OpenID Connect (with verified domains)\n  SLOTLOCK_SSO_SECRET            32+ characters: seals each team's client secret (with team SSO)\n  SLOTLOCK_TEAM_SCIM             on or off (default): each team's identity provider provisions its\n                                 people over SCIM 2.0 at /dashboard/scim/v2 (with verified domains)\n  HOST                           Listen address (default 127.0.0.1)\n  PORT                           Listen port (default 8080)\n\nGenerate each secret with: openssl rand -hex 32\n";
 /**
  * Run one `slotlock` command and resolve to its exit code: 0 success, 1 failure, 2 a usage or
  * configuration error (nothing was started). `serve` resolves once `io.signal` aborts and it has