slotlock 0.9.0 → 0.10.0

package/availability-store.js

@@ -538,12 +538,20 @@ export async function deleteHolidayCalendar(sql, params) {
 }
 /** Subscriptions due to be imported again, the longest waiting first. */
 export async function dueHolidayCalendars(sql, params) {
+    // Each is put off as a failure would put it off before it is read, so a pass that never finishes
+    // one (a process stopped on it) does not try it again at once, and two passes do not both read it.
+    // Importing it sets its next import; a failure says why.
     const rows = await sql `
-    SELECT ${sql.unsafe(HOLIDAY_CALENDAR_COLUMNS)} FROM slotlock.holiday_calendars calendar
-     WHERE calendar.tenant_ref = ${params.tenantRef} AND calendar.next_import_at <= statement_timestamp()
-     ORDER BY calendar.next_import_at, calendar.id
-     LIMIT ${params.limit}`;
-    return rows.map(toHolidayCalendar);
+    UPDATE slotlock.holiday_calendars calendar
+       SET next_import_at = statement_timestamp() + make_interval(hours => ${SLOTLOCK_HOLIDAY_RETRY_HOURS})
+     WHERE calendar.id IN (
+             SELECT id FROM slotlock.holiday_calendars
+              WHERE tenant_ref = ${params.tenantRef} AND next_import_at <= statement_timestamp()
+              ORDER BY next_import_at, id
+              LIMIT ${params.limit}
+              FOR UPDATE SKIP LOCKED)
+    RETURNING ${sql.unsafe(HOLIDAY_CALENDAR_COLUMNS)}`;
+    return rows.map(toHolidayCalendar).sort((left, right) => left.id.localeCompare(right.id));
 }
 /** Note why a subscription's import failed, and try again in SLOTLOCK_HOLIDAY_RETRY_HOURS. */
 export async function noteHolidayCalendarFailure(sql, params) {

package/booking-rules.d.ts

@@ -65,6 +65,12 @@ export interface SlotlockBookingRules {
      * money. With `withinMinutes`, only a cancellation that late before the start.
      */
     cancellationFee?: SlotlockCancellationFee;
+    /**
+     * What holding the resource costs, set by the tenant (RFC 0004 C3): an agent's hold of it waits for
+     * this payment (at most 30 minutes) whatever the agent asks, an agent names no other price, and an
+     * agent books it only from such a hold, once paid. The tenant's own systems set their own.
+     */
+    holdPrice?: SlotlockHoldPrice;
     /** A booking lies inside the resource's bookable hours. */
     enforceHours?: boolean;
     /**
@@ -87,6 +93,11 @@ export interface SlotlockCancellationFee {
     /** Only a cancellation this many minutes or fewer before the start: 0-525,600. */
     withinMinutes?: number;
 }
+/** A hold's price: an amount in the currency's minor unit (cents), ISO 4217 currency. */
+export interface SlotlockHoldPrice {
+    amountMinor: number;
+    currency: string;
+}
 /** A window of a day: minutes after local midnight, and how long (it may run past midnight). */
 export interface SlotlockDayWindow {
     startMinutes: number;

package/booking-rules.js

@@ -22,7 +22,7 @@ const LIMITS = SLOTLOCK_BOOKING_RULE_LIMITS;
 export const SLOTLOCK_MAX_ALLOWED_DURATIONS = 20;
 /** Windows `pickupTimes` and `returnTimes` may each hold. */
 export const SLOTLOCK_MAX_DAY_WINDOWS = 4;
-const LIST_RULES = new Set(['allowedDurations', 'pickupTimes', 'returnTimes', 'cancellationFee']);
+const LIST_RULES = new Set(['allowedDurations', 'pickupTimes', 'returnTimes', 'cancellationFee', 'holdPrice']);
 /** The `hoursApply` a resource's rules mean: as given, else `ends` with pick-up or return times. */
 export function hoursApplyOf(rules) {
     if (rules?.hoursApply !== undefined)
@@ -34,6 +34,22 @@ function parseHoursApply(value) {
         throw new TypeError("Slotlock booking rule hoursApply must be 'whole' or 'ends'");
     return value;
 }
+/** `holdPrice` from untrusted input, or a TypeError. */
+function parseHoldPrice(value) {
+    const price = value;
+    if (typeof price !== 'object' ||
+        price === null ||
+        Array.isArray(price) ||
+        Object.keys(price).some((key) => !['amountMinor', 'currency'].includes(key)) ||
+        !Number.isSafeInteger(price.amountMinor) ||
+        price.amountMinor < 1 ||
+        price.amountMinor > 1_000_000_000_000 ||
+        typeof price.currency !== 'string' ||
+        !/^[A-Z]{3}$/.test(price.currency)) {
+        throw new TypeError('Slotlock booking rule holdPrice needs amountMinor (a whole 1-1,000,000,000,000) and currency (ISO 4217, like EUR)');
+    }
+    return { amountMinor: price.amountMinor, currency: price.currency };
+}
 /** `cancellationFee` from untrusted input, or a TypeError. */
 function parseCancellationFee(value) {
     const fee = value;
@@ -152,6 +168,8 @@ export function parseBookingRules(value) {
         rules.allowedDurations = parseAllowedDurations(input.allowedDurations);
     if (input.cancellationFee !== undefined)
         rules.cancellationFee = parseCancellationFee(input.cancellationFee);
+    if (input.holdPrice !== undefined)
+        rules.holdPrice = parseHoldPrice(input.holdPrice);
     if (input.pickupTimes !== undefined)
         rules.pickupTimes = parseDayWindows('pickupTimes', input.pickupTimes);
     if (input.returnTimes !== undefined)
@@ -218,6 +236,8 @@ export function parseEffectiveBookingRules(value) {
                     rules.allowedDurations = parseAllowedDurations(field);
                 else if (key === 'cancellationFee')
                     rules.cancellationFee = parseCancellationFee(field);
+                else if (key === 'holdPrice')
+                    rules.holdPrice = parseHoldPrice(field);
                 else
                     rules[key] = parseDayWindows(key, field);
             }

package/config.d.ts

@@ -42,6 +42,41 @@ export interface SlotlockServeDashboardConfig {
      * `'enabled'`: those an owner turned on from the dashboard (Teams on Cloud, teams.ts).
      */
     organizations?: string[] | 'enabled';
+    /**
+     * Team workspaces (SLOTLOCK_DASHBOARD_TEAM_WORKSPACES=on): anyone signed in creates one and invites
+     * people to it by email, each with a role (workspaces.ts).
+     */
+    teamWorkspaces?: boolean;
+    /**
+     * Team invitations sent by email (SLOTLOCK_INVITATION_EMAIL resend or postmark, with
+     * SLOTLOCK_INVITATION_EMAIL_KEY and SLOTLOCK_INVITATION_EMAIL_FROM); without it, the person inviting
+     * sends the link.
+     */
+    invitationEmail?: {
+        provider: 'resend' | 'postmark';
+        key: string;
+        from: string;
+    };
+    /**
+     * Verified domains (SLOTLOCK_VERIFIED_DOMAINS=on, with team workspaces): a team's Owner proves a
+     * domain with a DNS record, and the people whose verified address is at it may ask to join. Looked
+     * up over DNS-over-HTTPS, or with the system's resolver (SLOTLOCK_DNS_RESOLVER=system, a server only).
+     */
+    verifiedDomains?: {
+        resolver: 'doh' | 'system';
+    };
+    /**
+     * Single sign-on through each team's own identity provider (SLOTLOCK_TEAM_SSO=on, with verified
+     * domains): its client secrets sealed under SLOTLOCK_SSO_SECRET.
+     */
+    teamSso?: {
+        secret: string;
+    };
+    /**
+     * SCIM provisioning (SLOTLOCK_TEAM_SCIM=on, with verified domains): each team's identity provider
+     * adds, deactivates and groups its people at the dashboard's /scim/v2.
+     */
+    teamScim?: boolean;
     /** What the deployment is called in the dashboard (SLOTLOCK_DASHBOARD_NAME). */
     name?: string;
     /**
@@ -85,6 +120,21 @@ export declare function readDashboardConfig(env: SlotlockEnv): SlotlockServeDash
  * organizations' keys, and only theirs.
  */
 export declare function readDashboardOrganizations(env: SlotlockEnv): string[] | 'enabled' | undefined;
+/**
+ * SLOTLOCK_VERIFIED_DOMAINS: on or off (the default), only with team workspaces; and
+ * SLOTLOCK_DNS_RESOLVER, how a domain's record is looked up: doh (the default: Cloudflare's
+ * DNS-over-HTTPS, cross-checked by Google's) or system (the server's own resolver, which follows
+ * split-horizon DNS). Read on its own as well: the server that runs maintenance checks the domains
+ * each day, wherever the dashboard runs.
+ */
+export declare function readVerifiedDomains(env: SlotlockEnv): {
+    resolver: 'doh' | 'system';
+} | undefined;
+/**
+ * SLOTLOCK_DASHBOARD_TEAM_WORKSPACES: on or off (the default). Read on its own as well: a server whose
+ * dashboard runs elsewhere (on Cloudflare Workers) takes team workspaces' keys only with it on.
+ */
+export declare function readDashboardTeamWorkspaces(env: SlotlockEnv): boolean;
 /** A token bucket: `perSecond` tokens come back each second, and it holds at most `burst`. */
 export interface SlotlockRate {
     perSecond: number;

package/config.js

@@ -181,6 +181,14 @@ export function readDashboardConfig(env) {
     if (Array.isArray(orgs) && googleClientId !== undefined) {
         throw new SlotlockConfigError('SLOTLOCK_GOOGLE_CLIENT_ID does not go with a list of SLOTLOCK_DASHBOARD_ORGS: those organizations are GitHub\'s; use SLOTLOCK_DASHBOARD_ORGS=enabled to have both');
     }
+    const teamWorkspaces = readDashboardTeamWorkspaces(env);
+    if (teamWorkspaces && Array.isArray(orgs)) {
+        throw new SlotlockConfigError('SLOTLOCK_DASHBOARD_TEAM_WORKSPACES does not go with a list of SLOTLOCK_DASHBOARD_ORGS: with a list, everyone works in those organizations');
+    }
+    const invitationEmail = readInvitationEmail(env, teamWorkspaces);
+    const verifiedDomains = readVerifiedDomains(env);
+    const teamSso = readTeamSso(env, verifiedDomains !== undefined);
+    const teamScim = readTeamScim(env, verifiedDomains !== undefined);
     const name = optional(env, 'SLOTLOCK_DASHBOARD_NAME')?.trim();
     if (name !== undefined && name !== '' && !SLOTLOCK_DASHBOARD_NAME_PATTERN.test(name)) {
         throw new SlotlockConfigError('SLOTLOCK_DASHBOARD_NAME must be 1-60 characters, without <, > or control or invisible characters');
@@ -196,6 +204,11 @@ export function readDashboardConfig(env) {
             ? { google: { clientId: googleClientId, clientSecret: googleClientSecret } }
             : {}),
         ...(orgs !== undefined ? { organizations: orgs } : {}),
+        ...(teamWorkspaces ? { teamWorkspaces: true } : {}),
+        ...(invitationEmail ? { invitationEmail } : {}),
+        ...(verifiedDomains ? { verifiedDomains } : {}),
+        ...(teamSso ? { teamSso } : {}),
+        ...(teamScim ? { teamScim } : {}),
         ...(name !== undefined && name !== '' ? { name } : {}),
         ...(termsUrl !== undefined ? { termsUrl } : {}),
         ...(privacyUrl !== undefined ? { privacyUrl } : {}),
@@ -265,6 +278,100 @@ export function readDashboardOrganizations(env) {
     }
     return [...new Set(orgs.split(','))];
 }
+/**
+ * SLOTLOCK_INVITATION_EMAIL (resend or postmark), with its key and the verified sender: all three, or
+ * none. Only with team workspaces, the one thing it sends.
+ */
+function readInvitationEmail(env, teamWorkspaces) {
+    const provider = optional(env, 'SLOTLOCK_INVITATION_EMAIL');
+    const key = optional(env, 'SLOTLOCK_INVITATION_EMAIL_KEY');
+    const from = optional(env, 'SLOTLOCK_INVITATION_EMAIL_FROM');
+    if (provider === undefined && key === undefined && from === undefined)
+        return undefined;
+    if (provider !== 'resend' && provider !== 'postmark') {
+        throw new SlotlockConfigError('SLOTLOCK_INVITATION_EMAIL must be resend or postmark');
+    }
+    if (!teamWorkspaces) {
+        throw new SlotlockConfigError('SLOTLOCK_INVITATION_EMAIL sends team invitations: it needs SLOTLOCK_DASHBOARD_TEAM_WORKSPACES=on');
+    }
+    if (key === undefined || !/^[\x21-\x7e]{10,500}$/.test(key)) {
+        throw new SlotlockConfigError(`SLOTLOCK_INVITATION_EMAIL_KEY must be ${provider === 'resend' ? "Resend's API key" : "Postmark's server token"}`);
+    }
+    if (from === undefined || !/^([^<>\r\n"]{1,80} )?<?[^@\s<>"]{1,64}@[^@\s<>"]+\.[^@\s<>"]+>?$/.test(from)) {
+        throw new SlotlockConfigError('SLOTLOCK_INVITATION_EMAIL_FROM must be the sender the provider verified: team@example.com or Name <team@example.com>');
+    }
+    return { provider, key, from };
+}
+/**
+ * SLOTLOCK_VERIFIED_DOMAINS: on or off (the default), only with team workspaces; and
+ * SLOTLOCK_DNS_RESOLVER, how a domain's record is looked up: doh (the default: Cloudflare's
+ * DNS-over-HTTPS, cross-checked by Google's) or system (the server's own resolver, which follows
+ * split-horizon DNS). Read on its own as well: the server that runs maintenance checks the domains
+ * each day, wherever the dashboard runs.
+ */
+export function readVerifiedDomains(env) {
+    const value = optional(env, 'SLOTLOCK_VERIFIED_DOMAINS') ?? 'off';
+    if (value !== 'on' && value !== 'off') {
+        throw new SlotlockConfigError('SLOTLOCK_VERIFIED_DOMAINS must be on or off');
+    }
+    const resolver = optional(env, 'SLOTLOCK_DNS_RESOLVER');
+    if (resolver !== undefined && resolver !== 'doh' && resolver !== 'system') {
+        throw new SlotlockConfigError('SLOTLOCK_DNS_RESOLVER must be doh or system');
+    }
+    if (value === 'off') {
+        if (resolver !== undefined) {
+            throw new SlotlockConfigError('SLOTLOCK_DNS_RESOLVER looks up verified domains: it needs SLOTLOCK_VERIFIED_DOMAINS=on');
+        }
+        return undefined;
+    }
+    if (!readDashboardTeamWorkspaces(env)) {
+        throw new SlotlockConfigError('SLOTLOCK_VERIFIED_DOMAINS verifies team workspaces\' domains: it needs SLOTLOCK_DASHBOARD_TEAM_WORKSPACES=on');
+    }
+    return { resolver: resolver ?? 'doh' };
+}
+/**
+ * SLOTLOCK_TEAM_SSO: on or off (the default), only with verified domains; with it,
+ * SLOTLOCK_SSO_SECRET (32+ characters), which seals each team's client secret.
+ */
+function readTeamSso(env, verifiedDomains) {
+    const value = optional(env, 'SLOTLOCK_TEAM_SSO') ?? 'off';
+    if (value !== 'on' && value !== 'off')
+        throw new SlotlockConfigError('SLOTLOCK_TEAM_SSO must be on or off');
+    const secret = optional(env, 'SLOTLOCK_SSO_SECRET');
+    if (value === 'off') {
+        if (secret !== undefined)
+            throw new SlotlockConfigError('SLOTLOCK_SSO_SECRET seals teams\' client secrets: it needs SLOTLOCK_TEAM_SSO=on');
+        return undefined;
+    }
+    if (!verifiedDomains) {
+        throw new SlotlockConfigError('SLOTLOCK_TEAM_SSO trusts addresses only at verified domains: it needs SLOTLOCK_VERIFIED_DOMAINS=on');
+    }
+    if (secret === undefined || secret.length < 32 || /\s/.test(secret)) {
+        throw new SlotlockConfigError(`SLOTLOCK_SSO_SECRET must be 32 or more characters without spaces. ${SECRET_HINT}`);
+    }
+    return { secret };
+}
+/** SLOTLOCK_TEAM_SCIM: on or off (the default), only with verified domains. */
+function readTeamScim(env, verifiedDomains) {
+    const value = optional(env, 'SLOTLOCK_TEAM_SCIM') ?? 'off';
+    if (value !== 'on' && value !== 'off')
+        throw new SlotlockConfigError('SLOTLOCK_TEAM_SCIM must be on or off');
+    if (value === 'on' && !verifiedDomains) {
+        throw new SlotlockConfigError('SLOTLOCK_TEAM_SCIM adds people only at verified domains: it needs SLOTLOCK_VERIFIED_DOMAINS=on');
+    }
+    return value === 'on';
+}
+/**
+ * SLOTLOCK_DASHBOARD_TEAM_WORKSPACES: on or off (the default). Read on its own as well: a server whose
+ * dashboard runs elsewhere (on Cloudflare Workers) takes team workspaces' keys only with it on.
+ */
+export function readDashboardTeamWorkspaces(env) {
+    const value = optional(env, 'SLOTLOCK_DASHBOARD_TEAM_WORKSPACES') ?? 'off';
+    if (value !== 'on' && value !== 'off') {
+        throw new SlotlockConfigError('SLOTLOCK_DASHBOARD_TEAM_WORKSPACES must be on or off');
+    }
+    return value === 'on';
+}
 /** The token buckets `slotlock serve` keeps (SLOTLOCK_LIMITS), each counted per its own key. */
 export const SLOTLOCK_RATE_NAMES = Object.freeze([
     'address',

package/dashboard-scope.d.ts

@@ -0,0 +1,7 @@
+import type { SlotlockResourceScope } from './resource-profile.js';
+/** Serve one dashboard request with a scope of its own, none until the person's is read. */
+export declare function runSlotlockDashboardRequest<T>(serve: () => T): T;
+/** The request's person is limited to `scope`: what is read for them from now on keeps to it. */
+export declare function setSlotlockDashboardRequestScope(scope: SlotlockResourceScope | null): void;
+/** The scope of the dashboard request being served, or null for none (or outside a request). */
+export declare function slotlockDashboardRequestScope(): SlotlockResourceScope | null;

package/dashboard-scope.js

@@ -0,0 +1,21 @@
+// The locations and groups the person signed in to the dashboard is limited to (RFC 0004 D1), for
+// the request being served. The dashboard sets it once it has read the person's standing; the
+// store its resources read through (createSlotlockDashboardResources) runs each transaction with it
+// as its resource scope, so the database's resource_scope_v1 policies keep every read and write to
+// those resources, as they do for a key limited to them.
+import { AsyncLocalStorage } from 'node:async_hooks';
+const requests = new AsyncLocalStorage();
+/** Serve one dashboard request with a scope of its own, none until the person's is read. */
+export function runSlotlockDashboardRequest(serve) {
+    return requests.run({ scope: null }, serve);
+}
+/** The request's person is limited to `scope`: what is read for them from now on keeps to it. */
+export function setSlotlockDashboardRequestScope(scope) {
+    const request = requests.getStore();
+    if (request)
+        request.scope = scope;
+}
+/** The scope of the dashboard request being served, or null for none (or outside a request). */
+export function slotlockDashboardRequestScope() {
+    return requests.getStore()?.scope ?? null;
+}

package/dashboard.d.ts

@@ -1,4 +1,8 @@
 import type { SlotlockDashboardTeams } from './teams.js';
+import type { SlotlockDashboardWorkspaces } from './workspaces.js';
+import { type SlotlockDnsResolver } from './domains.js';
+import { type SlotlockSecretBox } from './oidc.js';
+import type { SlotlockAuditEvent, SlotlockAuditEventInput } from './store.js';
 import { type SlotlockApiKeyStore } from './api-keys.js';
 import { type SlotlockAgentCalendarBackend, type SlotlockAgentOperation, type SlotlockAgentOperationDispatchOptions, type SlotlockAgentPrincipal, type SlotlockAgentUsage } from './agent-server.js';
 import { type SlotlockAssistantStore } from './assistant.js';
@@ -8,7 +12,7 @@ import { type SlotlockPlan, type SlotlockTenantPlan } from './plans.js';
 import { type SlotlockLocation, type SlotlockResourceGroup, type SlotlockResourceProfileInput } from './resource-profile.js';
 import { type SlotlockUsageRow } from './usage.js';
 import { type CreateWebhookEndpointResult, type SlotlockChange, type SlotlockWebhookEndpoint } from './event-feed.js';
-import type { SlotlockSql, SlotlockStore, SlotlockWaitlistEntry } from './store.js';
+import { type SlotlockSql, type SlotlockStore, type SlotlockSubject, type SlotlockSubjectErasure, type SlotlockSubjectExport, type SlotlockTenantExport, type SlotlockTenantExportPartResult, type SlotlockWaitlistEntry } from './store.js';
 import type { SlotlockAvailabilityDefaults, SlotlockAvailabilityExceptionInput, SlotlockHolidayCalendar, SlotlockOverrideResources } from './availability-store.js';
 import { type SlotlockAvailabilityException } from './hours.js';
 import { type SlotlockHolidaySource } from './holiday-import.js';
@@ -21,6 +25,12 @@ export declare const SLOTLOCK_DASHBOARD_MAX_RESOURCES = 500;
  * person who made it (`github:<user id>`) as `actor`, to record on the event feed.
  */
 export interface SlotlockDashboardResources {
+    /**
+     * These adapters keep each request to the locations and groups its member is limited to (RFC
+     * 0004 D1), as createSlotlockDashboardResources's do (dashboard-scope.ts). Without it, a limited
+     * member reaches only their own account.
+     */
+    keepsToScope?: boolean;
     list(tenantRef: string): Promise<SlotlockResource[]>;
     /** How many resources the tenant has, archived ones included, as a resource limit counts them. */
     count?(tenantRef: string): Promise<number>;
@@ -45,6 +55,19 @@ export interface SlotlockDashboardResources {
     } | {
         location: string;
     } | 'all', rules: WeeklyAvailabilityRule[] | null, actor?: string, override?: SlotlockOverrideResources): Promise<number>;
+    /**
+     * What the tenant keeps, exported whole, and what it keeps about one person, exported or erased
+     * (RFC 0004 D3): Settings, Privacy.
+     */
+    privacy?: {
+        /** Ask for an export, built in the background; refused while one is built, or with five kept. */
+        createExport(tenantRef: string, actor?: string): Promise<SlotlockTenantExport>;
+        listExports(tenantRef: string): Promise<SlotlockTenantExport[]>;
+        exportPart(tenantRef: string, exportId: string, part: number): Promise<SlotlockTenantExportPartResult>;
+        deleteExport(tenantRef: string, exportId: string): Promise<boolean>;
+        exportSubject(tenantRef: string, subject: SlotlockSubject): Promise<SlotlockSubjectExport>;
+        eraseSubject(tenantRef: string, subject: SlotlockSubject, actor?: string): Promise<SlotlockSubjectErasure>;
+    };
     /** The people the tenant keeps to tell about bookings (RFC 0004 P3), and forgetting one. */
     contacts?: {
         list(tenantRef: string, limit: number, after?: string): Promise<SlotlockContact[]>;
@@ -174,6 +197,27 @@ export interface SlotlockDashboardResources {
     };
     /** The tenant's assistant settings and its members' conversations (assistant.ts). */
     assistant?: SlotlockAssistantStore;
+    /**
+     * The tenant's audit log (slotlock.audit_events): who changed keys, webhooks, billing and
+     * settings, and every refusal. Append-only: record, and read newest first.
+     */
+    audit?: {
+        /** Whether the workspace's chain holds from its oldest event kept (store verifyAuditChain). */
+        verify?(tenantRef: string): Promise<{
+            checked: number;
+            brokenAt: number | null;
+        }>;
+        record(tenantRef: string, event: SlotlockAuditEventInput): Promise<void>;
+        list(tenantRef: string, params?: {
+            limit?: number;
+            before?: {
+                occurredAt: Date;
+                id: string;
+            };
+            action?: string;
+            actorRef?: string;
+        }): Promise<SlotlockAuditEvent[]>;
+    };
     /** The tenant's webhook endpoints, as the event feed keeps them. */
     webhooks?: {
         list(tenantRef: string): Promise<SlotlockWebhookEndpoint[]>;
@@ -350,6 +394,18 @@ export interface SlotlockDashboardBilling {
     /** The https origins Upgrade and Manage redirect to, allowed in the policy's form-action. */
     formOrigins: readonly string[];
 }
+/** Sends an invitation's link by email (hosted Slotlock); without one, the person inviting sends it. */
+export interface SlotlockInvitationSender {
+    send(invitation: {
+        to: string;
+        /** The team workspace's name, and how the person inviting is shown. */
+        workspace: string;
+        inviter: string;
+        role: string;
+        link: string;
+        expiresAt: Date;
+    }): Promise<void>;
+}
 export interface SlotlockDashboardOptions {
     /** Where people reach the server; the dashboard lives at `<publicUrl>/dashboard`. */
     publicUrl: string;
@@ -417,6 +473,45 @@ export interface SlotlockDashboardOptions {
     organizations?: readonly string[] | 'enabled';
     /** The organizations turned on, with `organizations: 'enabled'` (teams.ts). */
     teams?: SlotlockDashboardTeams;
+    /**
+     * Who belongs to which workspace, and as what (workspaces.ts, workspace-roles.ts): read on every
+     * request, so a role changed or a membership ended applies at the next one, and "Sign out
+     * everywhere" ends every session. Without it, a person is the Owner of their own workspace, and an
+     * organization's GitHub owners are its Owners and its other members Developers, as read at sign-in.
+     */
+    workspaces?: SlotlockDashboardWorkspaces;
+    /**
+     * Team workspaces (`team:<id>`): anyone signed in creates one, invites people to it by email with
+     * a role, and changes or removes them (workspaces.ts teams). Needs `workspaces` with its
+     * database, and no fixed list of organizations. Off unless set.
+     */
+    teamWorkspaces?: boolean;
+    /**
+     * Verified domains (workspace-domains.ts): a team's Owner proves a domain with a DNS record, and
+     * the people whose verified address is at it may ask to join. Needs team workspaces. The resolvers
+     * look the record up when an Owner asks (domains.ts slotlockDomainResolvers); the daily check runs
+     * in the server's maintenance. Off unless set.
+     */
+    domains?: {
+        resolvers: readonly SlotlockDnsResolver[];
+    };
+    /**
+     * Single sign-on through each team's own identity provider (OpenID Connect; workspace-sso.ts,
+     * oidc.ts): needs verified domains. `secretBox` seals the teams' client secrets; `fetch` reaches
+     * the URLs a team's Owner gives (on Node, one that refuses private addresses). Off unless set.
+     */
+    sso?: {
+        secretBox: SlotlockSecretBox;
+        fetch?: typeof fetch;
+    };
+    /**
+     * SCIM 2.0 provisioning (workspace-scim.ts, scim-server.ts): each team's identity provider adds,
+     * deactivates and groups its people at `<dashboard>/scim/v2/<team id>`, with a token an Owner
+     * makes on Settings, Identity. Needs verified domains. Off unless set.
+     */
+    scim?: boolean;
+    /** Sends invitations by email; the person inviting is shown each link either way. */
+    invitations?: SlotlockInvitationSender;
     keys: SlotlockApiKeyStore;
     resources: SlotlockDashboardResources;
     /** Shared by every server behind this origin: see SlotlockDashboardState. */
@@ -462,7 +557,7 @@ export interface SlotlockDashboard {
  * The dashboard's resources, in the store under each tenant's row-level security. Adds hold the cap
  * in the database (a READ COMMITTED transaction, under a per-tenant lock).
  */
-export declare function createSlotlockDashboardResources(store: SlotlockStore, options?: {
+export declare function createSlotlockDashboardResources(given: SlotlockStore, options?: {
     /**
      * The agent backend (`createSlotlockStoreAgentBackend`) a granted approval's booking is made
      * through: with it, the dashboard lists approvals and decides them.