@rackbops/plugin-tracker 0.12.0 → 0.13.0

package/README.md

@@ -12,7 +12,8 @@ your own tasks from the web, under the commands' own rules -- the admin view and
 slice 3) -- the JSON task API with personal API tokens (#80, slice 4), for a program acting as
 you, such as a later intake agent (plan E10) -- and the one-off research request (#82, plan E8,
 category 5): a question looked into on the web by a model run, checked by a second run against its
-sources, and DMed once, with its claims kept as findings. The model runs never happen here: they go
+sources, and DMed once, with its claims kept as findings -- and an admin raising one person's
+daily model ceiling from the web (#82, plan 5.7). The model runs never happen here: they go
 through city-hall to Rackbops/docket-runner on roshne's own host (plan 5.12), and the whole execute
 lane stays off until the city-hall Executor is configured (Configuration below).
 
@@ -124,8 +125,9 @@ says research is not available; it does not list the waiting ones (`/tasks` does
 
 **Budgets** (plan 5.7, docket's defaults): 2 USD and 20 model calls a person a day, 10 USD and 100
 calls in all. At a ceiling the person's research waits until midnight Eastern; the person gets one
-DM and the admins one each. Reminders, renewals and prices never count. There is no web control to
-raise a person's ceiling yet.
+DM and the admins one each. Reminders, renewals and prices never count. An admin can raise one
+person's ceiling from their admin page (0.13.0, below); the global ceiling still applies to everyone
+together.
 
 **Findings.** A passed research answer's claims are stored with their first source (docket's
 `findings`), shown on the task's page to its owner, accepted recipients and admins (docket's
@@ -262,6 +264,24 @@ the function the command path runs:
 - **Lift** a decline block in force: docket's `liftBlock`, recorded as that admin's lift.
 - **Revoke an API token** of anyone's, from their page, which lists their tokens (never the
   secret). It stops working at once; the owner is not told. Logged by token id.
+- **Raise a person's daily ceiling** (0.13.0, plan 5.7: "The admin raises a person's ceiling from
+  the web area"). Their page shows what they spent today (the budget day ends at midnight Eastern),
+  their ceiling now, a form with both numbers -- dollars to the cent and whole model calls -- and
+  the latest 20 changes an admin made, newest first (older ones stay in the table). Each number
+  must be at least the default (2 USD, 20 calls) and at most the global ceiling (10 USD, 100
+  calls), which docket checks first anyway; those bounds are proposed on #82, roshne's to confirm.
+  Setting exactly the default is a reset to it, not a raise.
+  **A raise stands until an admin changes it** -- raises it again or presses **Back to the
+  default**. That default is proposed on #82 and is roshne's to confirm; a today-only raise
+  would be a small change (`limitsOf` and `isRaised` plus a clock in `Ceilings`, and the page's
+  badge). Enforcement stays docket's: the
+  execute lane hands docket's `budgetHold` a policy whose `personFor` reads the person's newest
+  change, before every run, so a raise lets a held request run on the next tick. docket
+  sends its ceiling notices once a day per person (`noticeOnce`, key `budget:person:<id>:<day>`),
+  so every change -- raise or reset -- deletes that person's key for the current budget day in the
+  same transaction: meeting the new ceiling the same day DMs the person and the admins again (plan
+  5.7: "nothing fails silently"). Every change is an append-only `ceiling_changes` row (who, for whom, the values,
+  when) and a log line (`u1 set u2's daily ceiling to 4 USD / 40 calls (c1)`).
 - **Remove from the tracker**: forget-me for that person (below), with the same confirmation.
 
 **Deliveries** (0.10.0). `/admin/deliveries`, linked from every admin page, lists the DMs that
@@ -273,8 +293,9 @@ have gone out and is never resent; `deferred` is still owed (a recipient whose d
 say). Before 0.10.0 these showed only in the bot log, where the warnings still go. The page is
 read-only, and like every admin page answers anyone who is not an admin with the unknown page's 404.
 
-Not here yet, though plan 5.10 lists them: grants, budgets and retry (they belong to the execute
-lane, which is not built) and an admin pause of someone else's task.
+Not here yet, though plan 5.10 lists them: grants and retry, and an admin pause of someone else's
+task. Of budgets, raising one person's ceiling is here; the global ceiling and the defaults are
+docket's constants.
 
 **Forget me** (plan 5.8). A signed-in person erases themselves from `/forget` (web only: the plan
 asks for no Discord command, so without `TRACKER_WEB_URL` the only path is an admin with the web
@@ -286,14 +307,15 @@ in one SQLite transaction in the write queue, **deleted, not archived**:
 - on everyone else's tasks: their recipient rows, their replies and answers, the history rows they
   made or that name them (an invitation of them, a pause for them), the run events and deliveries
   of DMs to them (docket's `deleteDeliveries`), charges made for them, and their pause rows;
-- the budget notices kept for them (`budget:person:<id>:...`);
+- the budget notices kept for them (`budget:person:<id>:...`) and the changes to their ceiling;
 - every decline block they are either side of;
 - their admission, delivery health, web sessions, unused sign-in links and API tokens, and their
   person row.
 
 What stays, and why: another person's task that they received stays that owner's; one paused only
 because DMs to them failed goes back on. Another person's row keeps its own audit fact but not their
-id -- `admitted_by` of someone they admitted, and `lifted_by` of a block they lifted, become
+id -- `admitted_by` of someone they admitted, `lifted_by` of a block they lifted, and `set_by` of a
+change they made to someone's ceiling become
 `forgotten` ("an admin since forgotten"; null already means "the configuration"). Text is matched
 only in the forms the code writes a person's id into -- docket's consent rows (`u5`, `u5 24h`), the
 tracker's `u5: ...` removals and `delivery to {u5} paused` pauses, docket's `u5 <message>` delivery
@@ -517,8 +539,8 @@ key>`, so two databases never collide.
 
 ## Not yet
 
-- The rest of the web area (E5): sharing a task from the web, and the admin view's grants, budgets
-  (raising a person's ceiling) and retry. The task API makes reminders, renewals, prices and
+- The rest of the web area (E5): sharing a task from the web, and the admin view's grants and
+  retry. The task API makes reminders, renewals, prices and
   research requests -- not `/task done`, `snooze`, `decide`, `share` or the settings -- and no intake agent uses it yet
   (E10, deferred). Discord OAuth2 as a second sign-in
   method, if chosen (plan item 41).

package/dist/plugin.js

@@ -3189,6 +3189,206 @@ class Admissions {
   }
 }
 
+// plugins/tracker/src/admin.ts
+var NO_SUCH_PERSON = "There is no such person on this tracker's list.";
+var NO_SUCH_BLOCK = "There is no such block in force.";
+var LAST_ADMIN = "That is the tracker's only admin: make someone else an admin first.";
+var BUSY = "The tracker is busy sending reminders; nothing was deleted. Try again in a minute.";
+var TICK_WAIT_MS = 20000;
+var CONFIGURED_ADMIN = "That admin is named in TRACKER_ADMIN_DISCORD_IDS, which makes them an admin again at every start: remove them from the configuration first.";
+var CONFIGURED_SELF = "You are named in TRACKER_ADMIN_DISCORD_IDS: this erases you now, but the next start makes you an admin again, as a new person, unless you are removed from the configuration first.";
+function isConfiguredAdmin(d, u) {
+  return u.discordId !== null && d.configuredAdmins.has(u.discordId);
+}
+function ticksSettled(d) {
+  return d.lanes.idle(TICK_WAIT_MS);
+}
+function isPersonId(id) {
+  return /^u[1-9][0-9]{0,15}$/.test(id);
+}
+async function person(d, id) {
+  return isPersonId(id) ? d.store.getUser(id) : null;
+}
+function who(u) {
+  return u.displayName ?? u.discordId ?? u.id;
+}
+async function setAdminFlag(d, admin, targetId, flag) {
+  if (!admin.admin)
+    return { ok: false, error: NOT_ADMIN };
+  const target = await person(d, targetId);
+  if (!target)
+    return { ok: false, error: NO_SUCH_PERSON };
+  if (target.admin === flag)
+    return { ok: true, text: `${who(target)} ${flag ? "is already" : "is not"} an admin.` };
+  if (!flag && d.roster.admins() <= 1)
+    return { ok: false, error: LAST_ADMIN };
+  if (!flag && isConfiguredAdmin(d, target))
+    return { ok: false, error: CONFIGURED_ADMIN };
+  await d.store.updateUser(target.id, { admin: flag });
+  d.log.info(`${admin.id} ${flag ? "made" : "revoked"} ${target.id} ${flag ? "an admin" : "as admin"}`);
+  return { ok: true, text: flag ? `${who(target)} is now an admin.` : `${who(target)} is no longer an admin.` };
+}
+async function resumeDelivery(d, admin, targetId) {
+  if (!admin.admin)
+    return { ok: false, error: NOT_ADMIN };
+  const target = await person(d, targetId);
+  if (!target)
+    return { ok: false, error: NO_SUCH_PERSON };
+  const resumed = await d.health.resume(target.id, d.clock.now());
+  if (!resumed)
+    return { ok: false, error: `Delivery to ${who(target)} is not paused.` };
+  return { ok: true, text: `Delivery to ${who(target)} resumed; ${resumed.tasks.length} task(s) back on.` };
+}
+async function liftDeclineBlock(d, admin, blockId) {
+  if (!admin.admin)
+    return { ok: false, error: NOT_ADMIN };
+  const block = /^b[1-9][0-9]{0,15}$/.test(blockId) ? await d.store.getBlock(blockId) : null;
+  const now = d.clock.now();
+  if (!block || (await activeBlock(d.store, block.ownerId, block.recipientId, now))?.id !== block.id)
+    return { ok: false, error: NO_SUCH_BLOCK };
+  await liftBlock(d.store, { userId: admin.id, admin: true }, block.id, now);
+  const owner = await d.store.getUser(block.ownerId);
+  const recipient = await d.store.getUser(block.recipientId);
+  return {
+    ok: true,
+    text: `Lifted: ${owner ? who(owner) : block.ownerId} may invite ${recipient ? who(recipient) : block.recipientId} again.`
+  };
+}
+async function forgetPerson(d, actor, targetId) {
+  if (actor.id !== targetId && !actor.admin)
+    return { ok: false, error: NOT_ADMIN };
+  const target = await person(d, targetId);
+  if (!target)
+    return { ok: false, error: NO_SUCH_PERSON };
+  if (target.admin && d.roster.admins() <= 1)
+    return { ok: false, error: LAST_ADMIN };
+  if (actor.id !== target.id && isConfiguredAdmin(d, target))
+    return { ok: false, error: CONFIGURED_ADMIN };
+  const now = d.clock.now();
+  const erased = await d.health.exclusive(async () => {
+    if (d.lanes.busy())
+      return null;
+    const e = d.roster.erase(target.id);
+    for (const taskId of e.freed)
+      await d.health.release(taskId, null, "resumed: a recipient left the tracker", now);
+    return e;
+  });
+  if (erased === null)
+    return { ok: false, error: BUSY };
+  if (!d.roster.checkpoint())
+    d.log.warn(`after forgetting ${target.id}: the write-ahead log is busy, so SQLite's next checkpoint copies it back`);
+  const total = Object.values(erased.rows).reduce((a, b) => a + b, 0);
+  d.log.info(`forgot ${target.id} (${actor.id === target.id ? "at their own request" : `removed by ${actor.id}`}): ${total} row(s) deleted`);
+  return { ok: true, text: actor.id === target.id ? "Everything the tracker held about you is deleted." : `${who(target)} is removed from the tracker.` };
+}
+
+// plugins/tracker/src/ceilings.ts
+function boundsOf(policy = DEFAULT_BUDGET) {
+  return { min: policy.person, max: policy.global };
+}
+function limitsOf(latest, defaults = DEFAULT_BUDGET.person) {
+  if (!latest || latest.usd === null || latest.calls === null)
+    return defaults;
+  return { usd: latest.usd, calls: latest.calls };
+}
+var USD = /^[0-9]{1,4}(\.[0-9]{1,2})?$/;
+var CALLS = /^[0-9]{1,5}$/;
+function money2(n) {
+  return `${n.toFixed(2)} USD`;
+}
+function decideCeiling(input, bounds = boundsOf()) {
+  if (input.reset)
+    return { ok: true, limits: null };
+  const usdText = input.usd.trim();
+  const callsText = input.calls.trim();
+  if (!USD.test(usdText))
+    return { ok: false, error: "Give the dollars as a number, like 4 or 4.50." };
+  if (!CALLS.test(callsText))
+    return { ok: false, error: "Give the model calls as a whole number, like 40." };
+  const usd = Number(usdText);
+  const calls = Number(callsText);
+  const { min, max } = bounds;
+  if (min.usd !== null && usd < min.usd)
+    return { ok: false, error: `The dollars cannot go below the default, ${money2(min.usd)}.` };
+  if (min.calls !== null && calls < min.calls)
+    return { ok: false, error: `The model calls cannot go below the default, ${min.calls}.` };
+  if (max.usd !== null && usd > max.usd)
+    return { ok: false, error: `The dollars cannot go above the global ceiling, ${money2(max.usd)} a day.` };
+  if (max.calls !== null && calls > max.calls)
+    return { ok: false, error: `The model calls cannot go above the global ceiling, ${max.calls} a day.` };
+  if (usd === min.usd && calls === min.calls)
+    return { ok: true, limits: null };
+  return { ok: true, limits: { usd, calls } };
+}
+function describeLimits(l) {
+  const usd = l.usd === null ? "no dollar ceiling" : money2(l.usd);
+  const calls = l.calls === null ? "no call ceiling" : `${l.calls} model calls`;
+  return `${usd} and ${calls} a day`;
+}
+function isRaised(latest) {
+  return latest !== null && latest.usd !== null && latest.calls !== null;
+}
+function budgetNoticeKey(userId, at) {
+  return `budget:person:${userId}:${budgetDay(at).day}`;
+}
+var HISTORY_SHOWN = 20;
+function toChange(r) {
+  return { id: `c${r.seq}`, userId: r.user_id, usd: r.usd, calls: r.calls, setBy: r.set_by, at: r.at };
+}
+
+class Ceilings {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  latest(userId) {
+    const r = this.db.query("SELECT * FROM ceiling_changes WHERE user_id = ? ORDER BY seq DESC LIMIT 1").get(userId);
+    return r ? toChange(r) : null;
+  }
+  history(userId, limit = HISTORY_SHOWN) {
+    return this.db.query("SELECT * FROM ceiling_changes WHERE user_id = ? ORDER BY seq DESC LIMIT ?").all(userId, limit).map(toChange);
+  }
+  record(userId, limits, setBy, at) {
+    return this.db.transaction(() => {
+      const r = this.db.query("INSERT INTO ceiling_changes (user_id, usd, calls, set_by, at) VALUES (?, ?, ?, ?, ?) RETURNING *").get(userId, limits?.usd ?? null, limits?.calls ?? null, setBy, at);
+      this.db.query("DELETE FROM notices WHERE key = ?").run(budgetNoticeKey(userId, new Date(at)));
+      return toChange(r);
+    })();
+  }
+  personFor(user) {
+    const latest = this.latest(user.id);
+    return isRaised(latest) ? limitsOf(latest) : null;
+  }
+}
+function budgetPolicy(ceilings, base = DEFAULT_BUDGET) {
+  return { person: base.person, global: base.global, personFor: (u) => ceilings.personFor(u) };
+}
+async function spentToday(store, userId, now) {
+  const day = budgetDay(now);
+  const rows = await store.listUsage({ userId, since: day.start, before: day.end });
+  return spent(rows);
+}
+function who2(u) {
+  return u.displayName ?? u.discordId ?? u.id;
+}
+async function setCeiling(d, admin, targetId, input) {
+  if (!admin.admin)
+    return { ok: false, error: NOT_ADMIN };
+  const target = isPersonId(targetId) ? await d.store.getUser(targetId) : null;
+  if (!target)
+    return { ok: false, error: NO_SUCH_PERSON };
+  const decided = decideCeiling(input);
+  if (!decided.ok)
+    return { ok: false, error: decided.error };
+  const before = d.ceilings.latest(target.id);
+  if (decided.limits === null && !isRaised(before))
+    return { ok: true, text: `${who2(target)} is already on the default ceiling.` };
+  const change = d.ceilings.record(target.id, decided.limits, admin.id, d.clock.now().toISOString());
+  const now = limitsOf(change);
+  d.log.info(`${admin.id} set ${target.id}'s daily ceiling to ${decided.limits === null ? "the default" : `${now.usd} USD / ${now.calls} calls`} (${change.id})`);
+  return decided.limits === null ? { ok: true, text: `${who2(target)} is back on the default ceiling: ${describeLimits(now)}.` } : { ok: true, text: `${who2(target)}'s ceiling is now ${describeLimits(now)}, until an admin changes it.` };
+}
+
 // plugins/tracker/src/delivery-health.ts
 var PAUSE_AFTER = 3;
 var PAUSE_DETAIL = `delivery paused: ${PAUSE_AFTER} DMs in a row could not be delivered (DMs closed, or the bot is blocked)`;
@@ -4201,6 +4401,18 @@ var MIGRATIONS = [
     paused_at TEXT
   );
   CREATE INDEX executor_jobs_occurrence ON executor_jobs (occurrence_id);
+  `,
+  `
+  CREATE TABLE ceiling_changes (
+    seq INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id TEXT NOT NULL,
+    usd REAL,
+    calls INTEGER,
+    set_by TEXT NOT NULL,
+    at TEXT NOT NULL,
+    CHECK ((usd IS NULL) = (calls IS NULL))
+  );
+  CREATE INDEX ceiling_changes_user ON ceiling_changes (user_id, seq);
   `
 ];
 var BUSY_TIMEOUT_MS = 5000;
@@ -6849,6 +7061,8 @@ class Roster {
       del("web_login_tokens", "user_id = ?", userId);
       del("api_tokens", "user_id = ?", userId);
       del("notices", "key LIKE 'budget:person:' || ? || ':%'", userId);
+      del("ceiling_changes", "user_id = ?", userId);
+      this.db.query("UPDATE ceiling_changes SET set_by = ? WHERE set_by = ?").run(FORGOTTEN, userId);
       del("users", "seq = ?", Number(seq));
       const held = this.db.query("SELECT 1 FROM delivery_pauses WHERE task_id = ? LIMIT 1");
       const freed = [...new Set(pausedFor)].filter((t) => held.get(t) === null);
@@ -6857,99 +7071,6 @@ class Roster {
   }
 }
 
-// plugins/tracker/src/admin.ts
-var NO_SUCH_PERSON = "There is no such person on this tracker's list.";
-var NO_SUCH_BLOCK = "There is no such block in force.";
-var LAST_ADMIN = "That is the tracker's only admin: make someone else an admin first.";
-var BUSY = "The tracker is busy sending reminders; nothing was deleted. Try again in a minute.";
-var TICK_WAIT_MS = 20000;
-var CONFIGURED_ADMIN = "That admin is named in TRACKER_ADMIN_DISCORD_IDS, which makes them an admin again at every start: remove them from the configuration first.";
-var CONFIGURED_SELF = "You are named in TRACKER_ADMIN_DISCORD_IDS: this erases you now, but the next start makes you an admin again, as a new person, unless you are removed from the configuration first.";
-function isConfiguredAdmin(d, u) {
-  return u.discordId !== null && d.configuredAdmins.has(u.discordId);
-}
-function ticksSettled(d) {
-  return d.lanes.idle(TICK_WAIT_MS);
-}
-function isPersonId(id) {
-  return /^u[1-9][0-9]{0,15}$/.test(id);
-}
-async function person(d, id) {
-  return isPersonId(id) ? d.store.getUser(id) : null;
-}
-function who(u) {
-  return u.displayName ?? u.discordId ?? u.id;
-}
-async function setAdminFlag(d, admin, targetId, flag) {
-  if (!admin.admin)
-    return { ok: false, error: NOT_ADMIN };
-  const target = await person(d, targetId);
-  if (!target)
-    return { ok: false, error: NO_SUCH_PERSON };
-  if (target.admin === flag)
-    return { ok: true, text: `${who(target)} ${flag ? "is already" : "is not"} an admin.` };
-  if (!flag && d.roster.admins() <= 1)
-    return { ok: false, error: LAST_ADMIN };
-  if (!flag && isConfiguredAdmin(d, target))
-    return { ok: false, error: CONFIGURED_ADMIN };
-  await d.store.updateUser(target.id, { admin: flag });
-  d.log.info(`${admin.id} ${flag ? "made" : "revoked"} ${target.id} ${flag ? "an admin" : "as admin"}`);
-  return { ok: true, text: flag ? `${who(target)} is now an admin.` : `${who(target)} is no longer an admin.` };
-}
-async function resumeDelivery(d, admin, targetId) {
-  if (!admin.admin)
-    return { ok: false, error: NOT_ADMIN };
-  const target = await person(d, targetId);
-  if (!target)
-    return { ok: false, error: NO_SUCH_PERSON };
-  const resumed = await d.health.resume(target.id, d.clock.now());
-  if (!resumed)
-    return { ok: false, error: `Delivery to ${who(target)} is not paused.` };
-  return { ok: true, text: `Delivery to ${who(target)} resumed; ${resumed.tasks.length} task(s) back on.` };
-}
-async function liftDeclineBlock(d, admin, blockId) {
-  if (!admin.admin)
-    return { ok: false, error: NOT_ADMIN };
-  const block = /^b[1-9][0-9]{0,15}$/.test(blockId) ? await d.store.getBlock(blockId) : null;
-  const now = d.clock.now();
-  if (!block || (await activeBlock(d.store, block.ownerId, block.recipientId, now))?.id !== block.id)
-    return { ok: false, error: NO_SUCH_BLOCK };
-  await liftBlock(d.store, { userId: admin.id, admin: true }, block.id, now);
-  const owner = await d.store.getUser(block.ownerId);
-  const recipient = await d.store.getUser(block.recipientId);
-  return {
-    ok: true,
-    text: `Lifted: ${owner ? who(owner) : block.ownerId} may invite ${recipient ? who(recipient) : block.recipientId} again.`
-  };
-}
-async function forgetPerson(d, actor, targetId) {
-  if (actor.id !== targetId && !actor.admin)
-    return { ok: false, error: NOT_ADMIN };
-  const target = await person(d, targetId);
-  if (!target)
-    return { ok: false, error: NO_SUCH_PERSON };
-  if (target.admin && d.roster.admins() <= 1)
-    return { ok: false, error: LAST_ADMIN };
-  if (actor.id !== target.id && isConfiguredAdmin(d, target))
-    return { ok: false, error: CONFIGURED_ADMIN };
-  const now = d.clock.now();
-  const erased = await d.health.exclusive(async () => {
-    if (d.lanes.busy())
-      return null;
-    const e = d.roster.erase(target.id);
-    for (const taskId of e.freed)
-      await d.health.release(taskId, null, "resumed: a recipient left the tracker", now);
-    return e;
-  });
-  if (erased === null)
-    return { ok: false, error: BUSY };
-  if (!d.roster.checkpoint())
-    d.log.warn(`after forgetting ${target.id}: the write-ahead log is busy, so SQLite's next checkpoint copies it back`);
-  const total = Object.values(erased.rows).reduce((a, b) => a + b, 0);
-  d.log.info(`forgot ${target.id} (${actor.id === target.id ? "at their own request" : `removed by ${actor.id}`}): ${total} row(s) deleted`);
-  return { ok: true, text: actor.id === target.id ? "Everything the tracker held about you is deleted." : `${who(target)} is removed from the tracker.` };
-}
-
 // node_modules/@rackbops/styles/rackbops-noir/bundle.css
 var bundle_default = `:where([data-rb-style], [data-rb-style] *), :where([data-rb-style], [data-rb-style] *):before, :where([data-rb-style], [data-rb-style] *):after {
   box-sizing: border-box;
@@ -8727,6 +8848,45 @@ ${tokenTable(v, tokens, now, (id) => tokenHref(v, id))}
 </section>`);
 }
 
+// plugins/tracker/src/web/ceiling-pages.ts
+function setBy(id, names) {
+  if (id === FORGOTTEN)
+    return "an admin since forgotten";
+  return names.get(id) ?? id;
+}
+function change(c, v, now, names) {
+  const what = c.usd === null || c.calls === null ? "back to the default" : `raised to ${describeLimits({ usd: c.usd, calls: c.calls })}`;
+  return html`<li>${formatInstant(c.at, v.user.timeZone, now)}: ${what}, by ${setBy(c.setBy, names)}</li>`;
+}
+function limitText(n, unit) {
+  return n === null ? `no ${unit} ceiling` : String(n);
+}
+function ceilingSection(v, personId, view, now) {
+  const limits = limitsOf(view.latest, view.defaults);
+  const raised = isRaised(view.latest);
+  const action = `${v.base}/admin/people/${encodeURIComponent(personId)}/ceiling`;
+  const csrf = html`<input type="hidden" name="csrf" value="${v.csrf}">`;
+  const { min, max } = view.bounds;
+  return html`<section>
+<h2>Daily model budget</h2>
+<p>Today: ${view.today.usd.toFixed(2)} USD and ${view.today.calls} model call(s). Ceiling: ${describeLimits(limits)}${raised ? html` <span class="rb-badge">raised</span>` : " (the default)"}.</p>
+<p class="rb-muted">A raise stands until an admin changes it. Setting exactly the default puts them back on it. It may not go below the default (${describeLimits(view.defaults)}) or above the global ceiling (${describeLimits(max)}), which still applies to everyone together. A day ends at midnight Eastern.</p>
+<form method="post" action="${action}" class="tr-stack">
+${csrf}
+<div class="tr-row">
+<div class="rb-field"><label class="rb-label" for="ceiling-usd">Dollars a day</label>
+<input class="rb-input" id="ceiling-usd" name="usd" inputmode="decimal" maxlength="7" value="${limits.usd === null ? "" : limits.usd.toFixed(2)}" required></div>
+<div class="rb-field"><label class="rb-label" for="ceiling-calls">Model calls a day</label>
+<input class="rb-input" id="ceiling-calls" name="calls" inputmode="numeric" maxlength="5" value="${limits.calls === null ? "" : String(limits.calls)}" required></div>
+</div>
+<p class="rb-muted">From ${limitText(min.usd, "dollar")} to ${limitText(max.usd, "dollar")} dollars; from ${limitText(min.calls, "call")} to ${limitText(max.calls, "call")} calls.</p>
+<div class="tr-row"><button class="rb-btn rb-btn--accent" type="submit">Set ceiling</button></div>
+</form>
+${raised ? html`<form method="post" action="${action}">${csrf}<input type="hidden" name="reset" value="yes"><button class="rb-btn rb-btn--ghost" type="submit">Back to the default</button></form>` : null}
+${view.history.length === 0 ? html`<p class="rb-muted">No admin has changed their ceiling.</p>` : html`<h3>Changes</h3><p class="rb-muted">The latest ${HISTORY_SHOWN} at most, newest first.</p><ul>${view.history.map((c) => change(c, v, now, view.names))}</ul>`}
+</section>`;
+}
+
 // plugins/tracker/src/web/admin-pages.ts
 var CONFIGURED_NOTE = "Named in TRACKER_ADMIN_DISCORD_IDS: made an admin again at every start, so they cannot be revoked or removed here. Remove them from the configuration first.";
 var CONFIRM_WORD = "forget";
@@ -8857,7 +9017,7 @@ ${data.rows.length === 0 ? html`<p class="rb-muted">None in that time.</p>` : ht
 function post2(v, p, action, label, style) {
   return html`<form method="post" action="${personHref(v, p.id, action)}">${hidden(v)}<button class="rb-btn ${style} rb-btn--sm" type="submit">${label}</button></form>`;
 }
-function personPage(v, p, tasks, now, result = null, configured = false, tokens = []) {
+function personPage(v, p, tasks, now, result = null, configured = false, tokens = [], budget) {
   return framed(v, nameOf(p), html`<section>
 ${adminNav(v)}
 <h1>${nameOf(p)}${p.admin ? html` <span class="rb-badge">admin</span>` : null}</h1>
@@ -8876,6 +9036,7 @@ ${p.deliveryPausedAt ? post2(v, p, "resume-delivery", "Resume delivery", "rb-btn
 ${configured && p.id !== v.user.id ? null : post2(v, p, "forget", "Remove from the tracker", "rb-btn--danger")}
 </div>
 </section>
+${budget ? ceilingSection(v, p.id, budget, now) : null}
 <section>
 <h2>Their tasks</h2>
 ${tasks.length === 0 ? html`<p class="rb-muted">None.</p>` : html`<ul>${tasks.map((t) => html`<li><a class="rb-link" href="${taskHref(v, t.id)}">${t.title}</a> -- ${t.type}, ${t.status === "archived" ? "deleted" : t.status}</li>`)}</ul>`}
@@ -8943,12 +9104,22 @@ async function peoplePage(a, result, status, allow) {
   return htmlResponse(adminPage(a.v, data, { result, ...allow !== undefined ? { allow } : {} }), status);
 }
 async function onePerson(a, id, result = null) {
-  const p = a.d.roster.people().find((x) => x.id === id);
+  const everyone = a.d.roster.people();
+  const p = everyone.find((x) => x.id === id);
   if (!p)
     return htmlResponse(notFoundPage(a.v.base, a.v), 404);
   const tasks = await a.d.store.listTasks({ ownerId: p.id });
-  const tokens = a.d.apiTokens.listFor(p.id, a.d.clock.now());
-  return htmlResponse(personPage(a.v, p, tasks, a.d.clock.now(), result, isConfiguredAdmin(a.d, p), tokens), result && !result.ok ? 400 : 200);
+  const now = a.d.clock.now();
+  const tokens = a.d.apiTokens.listFor(p.id, now);
+  const budget = {
+    latest: a.d.ceilings.latest(p.id),
+    history: a.d.ceilings.history(p.id),
+    today: await spentToday(a.d.store, p.id, now),
+    defaults: DEFAULT_BUDGET.person,
+    bounds: boundsOf(),
+    names: new Map(everyone.map((x) => [x.id, nameOf(x)]))
+  };
+  return htmlResponse(personPage(a.v, p, tasks, now, result, isConfiguredAdmin(a.d, p), tokens, budget), result && !result.ok ? 400 : 200);
 }
 async function adminGet(a, r) {
   if (r.kind === "admin")
@@ -8999,6 +9170,15 @@ async function adminPost(a, r, form) {
       return htmlResponse(notFoundPage(base, a.v), 404);
     return onePerson(a, owner.whose, { ok: true, text: "Revoked: that token no longer works." });
   }
+  if (r.kind === "admin-ceiling") {
+    const input = form.get("reset") === "yes" ? { reset: true } : { reset: false, usd: form.get("usd") ?? "", calls: form.get("calls") ?? "" };
+    const done = await fresh(a, true, (me) => setCeiling(a.d, me, r.id, input));
+    if (done === null)
+      return unknownPage(base);
+    if (!done.ok && done.error === NO_SUCH_PERSON)
+      return htmlResponse(notFoundPage(base, a.v), 404);
+    return onePerson(a, r.id, said2(done));
+  }
   if (r.kind !== "admin-act")
     return unknownPage(base);
   if (r.action === "forget") {
@@ -9914,6 +10094,7 @@ var TASK_ACTION = /^\/tasks\/([^/]+)\/(edit|pause|resume|delete)$/;
 var NEW_PATH = /^\/new\/([a-z]+)$/;
 var PERSON_PATH = /^\/admin\/people\/([^/]+)$/;
 var PERSON_ACTION = /^\/admin\/people\/([^/]+)\/(grant|revoke|resume-delivery|forget)$/;
+var PERSON_CEILING = /^\/admin\/people\/([^/]+)\/ceiling$/;
 var BLOCK_LIFT = /^\/admin\/blocks\/([^/]+)\/lift$/;
 var TOKEN_REVOKE = /^\/tokens\/([^/]+)\/revoke$/;
 var ADMIN_TOKEN_REVOKE = /^\/admin\/tokens\/([^/]+)\/revoke$/;
@@ -9952,6 +10133,9 @@ function route2(path) {
     return { kind: "admin-deliveries" };
   if (path === "/admin/allow")
     return { kind: "admin-allow" };
+  const ceiling = PERSON_CEILING.exec(path);
+  if (ceiling)
+    return { kind: "admin-ceiling", id: segment2(ceiling[1]) };
   const personAct = PERSON_ACTION.exec(path);
   if (personAct)
     return { kind: "admin-act", id: segment2(personAct[1]), action: personAct[2] };
@@ -9978,7 +10162,7 @@ function route2(path) {
   return { kind: "act", id, action };
 }
 function methodsOf(r) {
-  if (r.kind === "logout" || r.kind === "act" || r.kind === "admin-allow" || r.kind === "admin-act" || r.kind === "admin-lift" || r.kind === "token-revoke" || r.kind === "admin-token-revoke") {
+  if (r.kind === "logout" || r.kind === "act" || r.kind === "admin-allow" || r.kind === "admin-act" || r.kind === "admin-ceiling" || r.kind === "admin-lift" || r.kind === "token-revoke" || r.kind === "admin-token-revoke") {
     return "POST";
   }
   if (r.kind === "settings" || r.kind === "edit" || r.kind === "new" || r.kind === "forget" || r.kind === "tokens")
@@ -10274,6 +10458,7 @@ function createWebHandler(w) {
           return tokenRevokePost(d, v, r.id);
         case "admin-allow":
         case "admin-act":
+        case "admin-ceiling":
         case "admin-lift":
         case "admin-token-revoke":
           return adminPost(a, r, form);
@@ -10554,7 +10739,8 @@ function createPlugin(host, options = {}) {
           ...options.cityHallFetch ? { fetchImpl: options.cityHallFetch } : {}
         });
       }
-      executeLane = executor ? new ExecuteLane({ store: openedStore, clock, types, notifier, executor, locks }) : null;
+      const ceilings = new Ceilings(opened);
+      executeLane = executor ? new ExecuteLane({ store: openedStore, clock, types, notifier, executor, locks, budget: budgetPolicy(ceilings) }) : null;
       if (cityHallConfig)
         host.log.info(`execute lane on: city-hall ${cityHallConfig.url}, capability ${cityHallConfig.capability}`);
       else if ("missing" in cityHall && cityHall.missing.length > 0)
@@ -10574,6 +10760,7 @@ function createPlugin(host, options = {}) {
         sessions: new Sessions(opened),
         apiTokens: new ApiTokens(opened),
         roster: new Roster(opened),
+        ceilings,
         configuredAdmins: new Set(adminIds),
         lanes,
         webEditor: webOrigin !== null,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rackbops/plugin-tracker",
-  "version": "0.12.0",
-  "description": "The task tracker for Rackbops Clerk: reminders, renewals, price drops and one-off research (through city-hall, with its findings) by slash command, delivered by DM with buttons, on docket's SQLite store (/allow, /register, /remind, /renewal, /price, /research, /tasks, /task, /settings, /web), with a web area for your tasks, history and settings, a web editor to make, change, pause and delete your own tasks (research requests too, made but not changed), an admin view (with the DMs that did not arrive), forget-me, and a JSON task API with personal API tokens",
+  "version": "0.13.0",
+  "description": "The task tracker for Rackbops Clerk: reminders, renewals, price drops and one-off research (through city-hall, with its findings) by slash command, delivered by DM with buttons, on docket's SQLite store (/allow, /register, /remind, /renewal, /price, /research, /tasks, /task, /settings, /web), with a web area for your tasks, history and settings, a web editor to make, change, pause and delete your own tasks (research requests too, made but not changed), an admin view (with the DMs that did not arrive, and raising a person's daily model ceiling), forget-me, and a JSON task API with personal API tokens",
   "type": "module",
   "main": "dist/plugin.js",
   "files": ["dist"],