@rackbops/plugin-tracker 0.19.0 → 0.23.0

package/README.md

@@ -37,8 +37,8 @@ as in a server (plan 5.5, item 39).
 
 | Command | Who | What |
 |---|---|---|
-| `/allow user` | a tracker admin | Admits a person: they can now `/register`. |
-| `/register [hour] [zone]` | an admitted person | Signs up, or changes the preferred hour (0-23, default 9) and time zone (default `America/New_York`). The reply says an admin can see every task. |
+| `/allow user` | a tracker admin | Admits a person: they can now `/register`. With the usr link on (0.21.0), run in a server, it also allows them in usr as `tracker:member` and keeps their usr user id. The admin must be linked in usr and hold `tracker:register` and `tracker:member` there. Run again, it asks usr again (usr only ever adds), so it links someone not yet linked and relinks someone whose usr link was made anew. A usr refusal or outage leaves the admission standing and says what to do; in a DM it says to run it in the server. |
+| `/register [hour] [zone]` | an admitted person | Signs up, or changes the preferred hour (0-23, default 9) and time zone (default `America/New_York`). The reply says an admin can see every task. With the usr link on (0.21.0), run in a server, it also carries a linked person's one-time usr sign-up link, until usr says they have signed up; in a DM it says to run it in the server. If usr says they are not allowed yet (a usr admin removed their link), it forgets their link and says to ask for `/allow` again. See **First admin and usr** below. |
 | `/remind text [when] [repeat]` | a registered person | A reminder by DM. `when` is docket's `parseWhen` grammar (`in 20 minutes`, `tomorrow 9am`, `fri at 17:30`); `repeat` is once (the default), daily, weekly or monthly. A repeating one with no `when` starts today at the preferred hour. |
 | `/renewal name amount currency renews [unit] [every] [lead] [note]` | registered | A subscription, domain, warranty or membership (docket's `renewal`, a `period` schedule). `renews` is the next renewal or expiry date, `YYYY-MM-DD`, today or later; `unit` yearly (the default), monthly, weekly or daily, `every` how many of those; the ask comes `lead` days before (default 7) at the preferred hour, with Keep, Cancel, Renewed and Snooze. If that ask is already past but the date is not, the first ask comes within a minute (a zone or hour change before it fires drops it for the next period's). Keep and Renewed record what was paid; Cancel ends it. |
 | `/price url [name] [hours] [drop] [baseline] [near]` | registered | A price (docket's `price`, a `poll` schedule every `hours`, default 12, at most 168). The page is read once at once, and nothing is created unless a price is found in it; then the first check, within a minute, DMs the starting price, and a drop of `drop` percent or more (default 10) from the `baseline` -- the last (default), first or highest price seen -- DMs the owner once per crossing. `near` is the words just before the price, for a page with no structured price. At most 20 per person. |
@@ -208,9 +208,10 @@ served at a hashed path, cached for a year).
 | `/admin/tasks` | Admins only: every task in the store, with its owner, status and how many receive it, each linking to its page. |
 | `/admin/deliveries` | Admins only: the DMs that did not arrive (below), newest first. |
 | `/admin/people/<id>` | Admins only: one person -- Discord id, registration, zone and hour, delivery, task counts, their tasks -- with Make admin or Revoke admin, Resume delivery (when paused), and Remove from the tracker. |
+| `/admin/usr-link` | Admins only, POST only, with the usr link on: Link everyone to usr (below). |
 | `/admin/allow`, `/admin/people/<id>/grant`, `/revoke`, `/resume-delivery`, `/forget`, `/admin/blocks/<id>/lift`, `/admin/tokens/<id>/revoke` | Admins only, POST only: the acts below. |
 | `/api/v1/...` | The JSON task API (below): bearer tokens only, never the cookie. |
-| `/signin` | Where a request that is not signed in is sent: says to run `/web`. |
+| `/signin` | Where a request that is not signed in is sent (a POST, or any request with the usr link off): says to run `/web`, and with the usr link on offers Sign in with usr. |
 | `/login?t=...` | The link `/web` gives. |
 
 **Signing in** (plan item 41; the one-time link is the method for now, kept in
@@ -223,6 +224,27 @@ same-origin` and `Cache-Control: no-store` (every page does). Not `no-referrer`:
 sends a form post's `Origin` as `null`, which the Origin check refuses, so no form would work; the
 pages link nowhere else, so the token never leaves in a Referer either way.
 
+**Signing in through usr** (0.22.0, while the usr link is on: `TRACKER_USR_URL`). A GET with no
+session reads usr's `nz_id` cookie, which usr sets on the parent domain named by its
+`USR_SSO_COOKIE_DOMAIN`. That domain must cover `TRACKER_WEB_URL`'s host: otherwise usr refuses the
+return address and keeps the browser on its own site. The token is checked offline, as usr's
+`docs/sso-verifier.md` says: an ES256 signature against usr's `/.well-known/jwks.json` (cached five
+minutes, fetched again on an unknown key at most every 30 seconds), `iss` "usr", not expired, and
+never a delegation token. A valid token whose account holds `tracker:member` and is linked to a
+registered person (`users.usr_subject`) opens a session as the one-time link does, once server
+membership is checked (as `/web` checks it), and the browser goes on to the page and query it asked
+for. With no valid token the browser is sent to usr's `/api/auth/sso/refresh` once, returning to
+the same address marked `?usr=1`; coming back still without one (usr's keys could not be fetched,
+the clocks disagree) says the sign-in could not be confirmed, instead of going round again. A token
+without the member role, or for an account linked to no one registered here, shows what to ask an
+admin for. While signed in, a usr cookie for the person's own account that no longer carries
+`tracker:member` signs them out of every session and revokes their API tokens. Sign out ends the
+tracker's session only, not usr's: for 12 hours after it, a plain GET does not sign back in from
+usr's cookie; the sign-in page's "Sign in with usr" button (and usr's trip back from it) or a `/web`
+link does. Any site under usr's cookie domain can set an
+`nz_id` of its own, so every host under that domain must be trusted. The one-time `/web` link stays
+beside it. `src/usr-identity.ts` uses WebCrypto only.
+
 **Sessions and forms.** The session cookie is `__Secure-tracker-session`, `HttpOnly; Secure;
 SameSite=Lax; Path=/tracker/`, for 7 days from sign-in. The store keeps only SHA-256 hashes of
 link tokens and session ids. Every request re-reads the person: one no longer in the tracker's
@@ -553,7 +575,7 @@ $ curl -s https://clerk.example.com/tracker/api/v1/tasks/t9 -H "Authorization: B
 
 | Piece | File | Notes |
 |---|---|---|
-| Store | `src/store.ts`, `src/schema.ts` | docket's `Store` port on `bun:sqlite`, in `<dataDir>/tracker/tracker.sqlite` (WAL). A Discord id belongs to at most one user. Schema versioned by `PRAGMA user_version`; a shipped migration is never edited. Schema 5 (0.9.0) is docket 0.4.0's: a run's `record`, a series point's `key`, `deliveries` (from `delivery_claims`), `usage` and `notices`. Schema 6 (0.11.0) is docket 0.5.0's, all additive: `findings`, a charge's `usage.key`, and the Executor's `executor_jobs`. Forget-me erases a person's findings and their runs' Job records too. Schema 8 (0.19.0) adds `want_inbox`, the listings sent in for an inbox watch. `store.test.ts` runs docket's `STORE_CONTRACT` against it. |
+| Store | `src/store.ts`, `src/schema.ts` | docket's `Store` port on `bun:sqlite`, in `<dataDir>/tracker/tracker.sqlite` (WAL). A Discord id belongs to at most one user. Schema versioned by `PRAGMA user_version`; a shipped migration is never edited. Schema 5 (0.9.0) is docket 0.4.0's: a run's `record`, a series point's `key`, `deliveries` (from `delivery_claims`), `usage` and `notices`. Schema 6 (0.11.0) is docket 0.5.0's, all additive: `findings`, a charge's `usage.key`, and the Executor's `executor_jobs`. Forget-me erases a person's findings and their runs' Job records too. Schema 8 (0.19.0) adds `want_inbox`, the listings sent in for an inbox watch. Schema 9 (0.20.0) adds `users.usr_subject`, a person's usr user id, null until linked, unique when set. `store.test.ts` runs docket's `STORE_CONTRACT` against it. |
 | Notify lane | `src/notify-lane.ts` | docket's `Lanes.tickNotify` on two host ticks, every 60 s, one pass per task with work (a due run, a run in flight, a DM owed or claimed), each under that task's lock through a view of the store limited to that task: `notify` runs every type but the page readers, `poll` runs only them (`price`, `wantlist`) with the Fetch port, so a slow page never holds up a reminder. A task the execute tick holds is left for the next notify tick, never waited on. Registers `reminder`, `renewal`, `price`, `research`, `scout`, `wantlist` and `wantjudge`. |
 | Want-list watcher | `src/want.ts`, `src/inbox.ts`, `src/web/api-listings.ts`; the types and sources are `@rackbops/docket-types`' (0.7.0: `wantlist`, `wantjudge`, `pageSource`, `bggSource`, `inboxSource`) | `/want`'s rules; the `wantlist` type over a `Source` port; the `inbox` source over the `want_inbox` table (schema 8, 0.19.0: the listings sent in per watch, keyed `ebay-` or `bgg-` and 24 random hex digits, the newest 100 kept, as many as one look reads; forget-me erases them with the person's tasks), filled by the task API's listings route; the `page` source (JSON-LD listings through the fenced Fetch port, no HTML guessing) and the `bgg` source (BGG's XML API with the Bearer token, on `boardgamegeek.com`, never `www.`, at least 5 s between requests (a read due sooner is put back for the next tick, never waited on), read by a bounded `indexOf` parser, never a pattern over the whole body; a 401 or 403 is the token refused, a 202, 429 or 5xx a miss). The BGG fixture is hand-written to BGG's documented shape until a real response is captured with the token. The judged watch (`wantjudge`) is an execute-lane type: its `prepare` reads the source in plain code (an uncharged `NoJob` when nothing is new), keeps new listings in the task's state as `pending` and asks for a follow-up, whose `prepare` makes the judge Job; `finish` maps the verdicts back by number, so a Job collected after a restart still has its listings. On this lane a BGG read due too soon waits out the spacing once. |
 | Execute lane | `src/execute-lane.ts`, `src/executor.ts`, `src/research.ts`, `src/scout.ts` (the `scout` type is docket-types') | Only when the city-hall Executor is configured: a third host tick, `execute`, that starts docket's `Lanes.tickExecute` in the background (one at a time, at most once a minute) over every task with a due execute-lane run, reserving those tasks and then holding their locks in id order, through one docket `Lanes` kept while the plugin is active (docket keeps its usage-limit pause on it). The Executor is city-hall#18's source pair (above), its I/O injected; `executor_jobs` keeps each Job key's city-hall id. `/research`'s and `/scout`'s rules, and the scout type. |
@@ -564,7 +586,7 @@ $ curl -s https://clerk.example.com/tracker/api/v1/tasks/t9 -H "Authorization: B
 | Daily digest | `src/digest.ts` | Plan 5.5's "today and overdue" DM, on the `notify` tick after the runs due now, no model. For each person whose preferred hour has come in their zone, the day is claimed first (docket's `claimNotice`, key `digest:<user>:<YYYY-MM-DD>`, research-triage's exactly-once pattern; forget-me erases it), then their own active reminders and renewals are read: overdue is the latest fired run before today with no done or decision from the owner, due today is a run not yet fired today or the latest fired run today still unanswered. A snoozed run, an older run behind a newer one, other types and received tasks are left out. Nothing listed, no DM; a paused person is passed by unclaimed; a failed send is not retried. |
 | Task lock | `src/locks.ts` | One task at a time: its runs, answers and edits never overlap (docket 0.4.0 asks the host to serialize per task). |
 | Pause | `src/delivery-health.ts` | The per-person failure count, the pause and the resume. |
-| People | `src/people.ts`, `src/admissions.ts` | Discord id, time zone, preferred hour, admin flag -- in the tracker's store, never usr; who admitted each person and when they registered. `TRACKER_ADMIN_DISCORD_IDS` only ever grants admin. |
+| People | `src/people.ts`, `src/admissions.ts` | Discord id, time zone, preferred hour, admin flag -- in the tracker's store, with each person's usr user id once the usr link links them (`src/usr.ts`, 0.20.0); who admitted each person and when they registered. `TRACKER_ADMIN_DISCORD_IDS` only ever grants admin. |
 | Commands | `src/discord.ts`, `src/interactions.ts`, `src/discord-common.ts` (discord.js); `src/actions.ts`, `src/press.ts`, `src/history.ts`, `src/access.ts` | The discord.js files read options and render; the rest is Discord-free over the injected store, clock and notifier. Store writes are handled one at a time; Discord lookups and DMs run outside that queue. |
 | Health | `src/health.ts` | `GET /tracker/healthz` (through the bot's HTTP router): `200` `ok`/`starting`, `503` `inactive`/`stale`/`blocked`. |
 | Admin, forget-me | `src/admin.ts`, `src/roster.ts`; `src/web/admin.ts`, `src/web/admin-pages.ts` | The admin acts and forget-me, Discord-free; the SQL docket's Store has no method for (listing people and blocks, erasing a person); the routes and pages. |
@@ -586,6 +608,9 @@ $ curl -s https://clerk.example.com/tracker/api/v1/tasks/t9 -H "Authorization: B
 | `TRACKER_CITY_HALL_CAPABILITY` | no | The capability tag every Job names, one only docket-runner carries (plan item 71), e.g. `claude-cli:subscription`. No default: a guessed tag could send the tracker's Jobs to another agent. |
 | `TRACKER_CITY_HALL_ACCESS_CLIENT_ID`, `TRACKER_CITY_HALL_ACCESS_CLIENT_SECRET` | yes | A Cloudflare Access service token for city-hall's edge (`CF-Access-Client-Id` / `-Secret`), when one is in front. Both or neither. |
 | `TRACKER_BGG_TOKEN` | yes | BoardGameGeek's XML API Bearer token for the tracker's registered application. Set = `/want source: bgg` watches a game's BGG marketplace; unset or empty = `/want source: bgg` makes an inbox watch instead, whose listings are sent in (as for eBay). Never logged. To get one: register an application at boardgamegeek.com/applications (roshne applied 2026-09-29, non-commercial; approval takes a week or more), then put the token in the instance's `.env` and recreate the bot. BGG's terms ask for attribution: every BGG line in a DM says "via BoardGameGeek". |
+| `TRACKER_USR_URL` | no | The https origin of our usr (Rackbops/usr), e.g. `https://id.example.com` (no path). With `TRACKER_USR_KEY` it turns the usr link on (0.20.0): people stay in the tracker, and each is linked to a usr account by usr's user id (`users.usr_subject`). Unset = off, and the tracker behaves as before (migration 9 still adds the empty column). `/allow` and `/register` use it since 0.21.0, and the web sign-in since 0.22.0 (Signing in through usr, above). |
+| `TRACKER_USR_KEY` | yes | The tracker's usr API key, with the role `usr:discord` only (usr's `/api/discord/allow` and `/register-link`), never `tracker:admin` or `tracker:register`, and a usr Discord service (`PUT /api/discord/services/<keyId>`) set to the tracker's app. Required with `TRACKER_USR_URL`; set without it, or with whitespace in it, refuses to load. Never logged. |
+| `TRACKER_USR_APP` | no | The usr app the tracker's roles live under (`tracker:member`, `tracker:register`): lowercase words joined by `-`. It must match the app on the key's usr Discord service row, which is what usr goes by. Unset = `tracker`. Needs `TRACKER_USR_URL`. |
 
 **The execute lane is off until all three of `TRACKER_CITY_HALL_URL`, `_KEY` and `_CAPABILITY` are
 set**: no `execute` tick, and `/research` answers that research is not available, so nobody can
@@ -600,6 +625,27 @@ key>`, so two databases never collide.
 
 `/tracker/healthz` and the web area need the bot's `HTTP_PORT` set; without it there is no HTTP at all.
 
+**Link everyone to usr** (0.23.0, the admin page, with the usr link on). People admitted before the
+link was on are not linked to usr. One press starts a run in the background (the bot answers a web
+request it waited on for 10 seconds with a 504, so the press does not wait) and goes back to the
+admin page, which shows how far the run has got and then how it ended; a second press while it runs
+starts nothing. For each person on the list with a Discord id and no usr link, one at a time, it
+checks they are a member of the server with its role, as `/allow` does; re-reads them just before asking
+usr, so someone forgotten before then is never sent; allows them in usr as `tracker:member`, with the pressing
+admin as the one who allowed them; then links them. usr records each link against
+`TRACKER_GUILD_ID`'s first server, so with no gate it refuses and says to `/allow` in the server
+instead. Only a 400 from usr about the person's own details is theirs, listed by name while the rest go on; any other
+refusal or failure (the admin not linked in usr or missing `tracker:register` or `tracker:member`,
+the key, usr unreachable) stops the run, since it would fail everyone the same way. It never starts
+on its own.
+
+**First admin and usr.** usr's `/api/discord/allow` needs the admin running `/allow` to be linked in
+usr already, so the first admin cannot be `/allow`ed by anyone. With the usr link on, a configured
+admin (`TRACKER_ADMIN_DISCORD_IDS`) who is not linked gets usr's open sign-up link from `/register`,
+run in a server. They finish signing up on usr, a usr admin gives them `tracker:register` and
+`tracker:member` there, and they run `/allow` on themselves, which links their tracker account.
+From then on they `/allow` everyone else. (usr's own "Setup" step 3, in `docs/discord-registration.md`, has the owner `/register` through the bot; the tracker uses the open link for that one step only, since its `/register` otherwise asks with the allow policy.)
+
 ## Not yet
 
 - The rest of the web area (E5): sharing a task from the web, and the admin view's grants and

package/dist/plugin.js

@@ -5604,6 +5604,10 @@ var MIGRATIONS = [
   );
   CREATE INDEX want_inbox_key ON want_inbox (key, seq);
   CREATE INDEX want_inbox_task ON want_inbox (task_id);
+  `,
+  `
+  ALTER TABLE users ADD COLUMN usr_subject TEXT;
+  CREATE UNIQUE INDEX users_usr_subject ON users (usr_subject) WHERE usr_subject IS NOT NULL;
   `
 ];
 var BUSY_TIMEOUT_MS = 5000;
@@ -6231,6 +6235,152 @@ async function restoreHeldRun(store, task, held, before, after, now) {
   return store.createOccurrence({ taskId: task.id, lane: task.lane, dueAt: due.toISOString(), dedupeKey: scheduledKey(task.id, due), at: now.toISOString() });
 }
 
+// plugins/tracker/src/usr.ts
+var USR_ENV = {
+  url: "TRACKER_USR_URL",
+  key: "TRACKER_USR_KEY",
+  app: "TRACKER_USR_APP"
+};
+var USR_URL_FORMAT = "^https://[A-Za-z0-9.-]+(:[0-9]{1,5})?/?$";
+var USR_APP_FORMAT = "^[a-z0-9]+(-[a-z0-9]+)*$";
+var APP = new RegExp(USR_APP_FORMAT);
+var DEFAULT_USR_APP = "tracker";
+var USR_TIMEOUT_MS = 1e4;
+var SNOWFLAKE2 = /^[0-9]{17,20}$/;
+function value2(env, key) {
+  const v = env[key]?.trim();
+  return v === undefined || v === "" ? undefined : v;
+}
+function parseUsrConfig(env) {
+  const url = value2(env, USR_ENV.url);
+  const key = value2(env, USR_ENV.key);
+  const app = value2(env, USR_ENV.app);
+  if (url === undefined) {
+    if (key !== undefined || app !== undefined)
+      throw new Error(`${USR_ENV.key} and ${USR_ENV.app} need ${USR_ENV.url}: set it, or unset them`);
+    return null;
+  }
+  let parsed = null;
+  try {
+    parsed = new URL(url);
+  } catch {
+    parsed = null;
+  }
+  if (url.includes("@") || parsed && (parsed.username !== "" || parsed.password !== "")) {
+    throw new Error(`${USR_ENV.url} must not contain credentials: give the bare origin, and the key in ${USR_ENV.key}`);
+  }
+  if (!new RegExp(USR_URL_FORMAT).test(url) || !parsed || parsed.protocol !== "https:") {
+    throw new Error(`${USR_ENV.url} is not an https origin such as https://id.example.com (no path, query or credentials)`);
+  }
+  if (key === undefined)
+    throw new Error(`${USR_ENV.url} is set but ${USR_ENV.key} is not: the usr link needs both`);
+  if (/\s/.test(key))
+    throw new Error(`${USR_ENV.key} has whitespace in it`);
+  if (app !== undefined && !APP.test(app)) {
+    throw new Error(`${USR_ENV.app}: "${app}" is not a usr app name (lowercase words joined by "-", e.g. tracker)`);
+  }
+  return { url: parsed.origin, key, app: app ?? DEFAULT_USR_APP };
+}
+
+class UsrError extends Error {
+  status;
+  reason;
+  constructor(message, status, reason = "") {
+    super(message);
+    this.status = status;
+    this.reason = reason;
+    this.name = "UsrError";
+  }
+}
+function reason2(body) {
+  const e = body && typeof body === "object" ? body.error : undefined;
+  if (typeof e !== "string")
+    return "";
+  return e.replace(/\s*\u2014\s*/g, " -- ").replace(/[^\x20-\x7e]/g, "").slice(0, 200).trim();
+}
+function createUsrClient(o) {
+  const fetchImpl = o.fetchImpl ?? fetch;
+  const timeoutMs = o.timeoutMs ?? USR_TIMEOUT_MS;
+  async function post(path, body, ok409 = false) {
+    let res;
+    try {
+      res = await fetchImpl(`${o.config.url}${path}`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${o.config.key}`, Accept: "application/json", "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+        redirect: "manual",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    } catch (err) {
+      const why = err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError") ? "timed out" : "could not be reached";
+      throw new UsrError(`usr ${why}`, null);
+    }
+    let parsed;
+    try {
+      parsed = await res.json();
+    } catch {
+      parsed = null;
+    }
+    const status = res.status;
+    if (status === 401)
+      throw new UsrError(`usr refused the tracker's key (HTTP 401): check ${USR_ENV.key}`, status);
+    if (status >= 300 && status < 400)
+      throw new UsrError(`usr answered with a redirect (HTTP ${status}), as an edge login does`, status);
+    if (status === 409 && ok409)
+      return { status, body: parsed };
+    if (status < 200 || status >= 300) {
+      const why = reason2(parsed);
+      throw new UsrError(`usr answered HTTP ${status}${why ? `: ${why}` : ""}`, status, why);
+    }
+    return { status, body: parsed };
+  }
+  function snowflake(name, id) {
+    if (!SNOWFLAKE2.test(id))
+      throw new UsrError(`${name} is not a Discord id`, null);
+  }
+  return {
+    async allow(req) {
+      snowflake("the person", req.discordId);
+      snowflake("the server", req.guildId);
+      snowflake("the admin", req.invokerDiscordId);
+      const { body } = await post("/api/discord/allow", {
+        discord_user_id: req.discordId,
+        guild_id: req.guildId,
+        invoker_discord_user_id: req.invokerDiscordId,
+        roles: [...req.roles],
+        ...req.displayName ? { display_name: req.displayName } : {}
+      });
+      const b = body ?? {};
+      if (typeof b.user_id !== "string" || b.user_id === "" || typeof b.created !== "boolean" || !Array.isArray(b.roles) || !b.roles.every((r) => typeof r === "string")) {
+        throw new UsrError(`usr's answer to allow was not one the tracker could read: is ${USR_ENV.url} usr?`, 200);
+      }
+      return { userId: b.user_id, created: b.created, roles: b.roles };
+    },
+    async registerLink(req) {
+      snowflake("the person", req.discordId);
+      snowflake("the server", req.guildId);
+      const { status, body } = await post("/api/discord/register-link", { discord_user_id: req.discordId, guild_id: req.guildId, policy: req.policy ?? "allow", ...req.displayName ? { display_name: req.displayName } : {} }, true);
+      if (status === 409)
+        return null;
+      const b = body ?? {};
+      if (typeof b.url !== "string" || typeof b.expires_at !== "string") {
+        throw new UsrError(`usr's answer to register-link was not one the tracker could read: is ${USR_ENV.url} usr?`, status);
+      }
+      let link;
+      try {
+        link = new URL(b.url);
+      } catch {
+        throw new UsrError("usr's registration link is not a URL", status);
+      }
+      if (link.protocol !== "https:")
+        throw new UsrError("usr's registration link is not https: check usr's USR_PUBLIC_URL", status);
+      if (link.username !== "" || link.password !== "")
+        throw new UsrError("usr's registration link has credentials in it: check usr's USR_PUBLIC_URL", status);
+      return { url: link.href, expiresAt: b.expires_at };
+    }
+  };
+}
+
 // plugins/tracker/src/actions.ts
 var MAX_ANSWER = 2000;
 var NO_LONGER_LISTED = "You are no longer on this tracker's list.";
@@ -6247,7 +6397,7 @@ async function enter(d, discordId, membership, need) {
   const resumed = await d.health.resume(person.id, d.clock.now());
   return { ok: true, user: person, notice: resumed ? resumedNotice(resumed) : null };
 }
-async function allowPerson(d, admin, target) {
+async function allowPerson(d, admin, target, guildId = null) {
   if (target.bot)
     return "A bot cannot use the tracker.";
   if (target.membership === "not-member")
@@ -6258,9 +6408,65 @@ async function allowPerson(d, admin, target) {
   const now = d.clock.now();
   const user = await admit(d.store, target.discordId, now);
   d.admissions.record(user.id, admin.id, now.toISOString());
-  if (before)
-    return `<@${target.discordId}> is already on the list.`;
-  return `Allowed <@${target.discordId}>: they can now use \`/register\`.`;
+  const text = before ? `<@${target.discordId}> is already on the list.` : `Allowed <@${target.discordId}>: they can now use \`/register\`.`;
+  const usr = d.usr;
+  if (!usr)
+    return text;
+  if (guildId === null || admin.discordId === null) {
+    return usr.links.subjectOf(user.id) !== null ? text : `${text}
+
+Not linked to usr: run \`/allow\` in the server to link them.`;
+  }
+  const invoker = admin.discordId;
+  return {
+    outside: () => usr.client.allow({ discordId: target.discordId, guildId, invokerDiscordId: invoker, roles: [`${usr.app}:${MEMBER_ROLE}`], ...target.displayName ? { displayName: target.displayName } : {} }).catch((err) => err),
+    finish: async (result) => `${text}
+
+${usrAllowed(d, usr, user.id, result)}`
+  };
+}
+var MEMBER_ROLE = "member";
+function usrAllowed(d, usr, userId, result) {
+  const app = usr.app;
+  if (result instanceof UsrError) {
+    const why = result.reason;
+    if (result.status === 403 && why.includes("invoker is not linked")) {
+      return `Not linked to usr: you are not linked to usr yourself yet. Run \`/register\` here and finish signing up on usr, have a usr admin give you \`${app}:register\` and \`${app}:${MEMBER_ROLE}\` there, then run \`/allow\` on yourself and on them.`;
+    }
+    if (result.status === 403 && (why.includes(`lacks ${app}:register`) || why.includes("cannot grant roles"))) {
+      return `Not linked to usr: you need both \`${app}:register\` and \`${app}:${MEMBER_ROLE}\` in usr; a usr admin gives them. Then run \`/allow\` again. They are on the tracker's list.`;
+    }
+    if (result.status === 403 && why.includes("outside the")) {
+      return `Not linked to usr: usr's Discord service for the tracker's key is set to another app than \`${app}\` (TRACKER_USR_APP). Fix one to match; nothing was granted.`;
+    }
+    return `Not linked to usr: ${result.message}. They are on the tracker's list; run \`/allow\` again once it is fixed.`;
+  }
+  if (result instanceof Error) {
+    d.log.error("usr allow failed", result);
+    return "Not linked to usr: something went wrong. They are on the tracker's list; run `/allow` again to retry.";
+  }
+  const answer = result;
+  const member = `${app}:${MEMBER_ROLE}`;
+  if (!answer.roles.includes(member)) {
+    return `Not linked to usr: usr did not give them \`${member}\`. Check that the tracker's usr key's Discord service is set to app \`${app}\` (TRACKER_USR_APP).`;
+  }
+  let outcome;
+  try {
+    outcome = usr.links.link(userId, answer.userId);
+  } catch (err) {
+    d.log.error("usr link failed", err);
+    if (err instanceof Error && /UNIQUE constraint failed/.test(err.message))
+      outcome = "taken";
+    else
+      return "Not linked to usr: something went wrong keeping their usr link. They are on the tracker's list; run `/allow` again to retry.";
+  }
+  if (outcome === "gone")
+    return "Not linked to usr: they left the tracker while usr was being asked.";
+  if (outcome === "taken")
+    return "Not linked to usr: usr's account for them is already linked to someone else here.";
+  if (outcome === "unchanged")
+    return "Linked to usr.";
+  return "Linked to usr: they can finish their usr sign-up with `/register`.";
 }
 function registeredText(user, first) {
   return registrationText(user, {
@@ -6268,7 +6474,53 @@ function registeredText(user, first) {
     notes: [`Keep DMs from this server open: after ${PAUSE_AFTER} DMs in a row that cannot be delivered, your reminders pause until you next use a command.`]
   });
 }
-async function registerPerson(d, user, input) {
+async function registerPerson(d, user, input, guildId = null) {
+  const { text, saved } = await registerSettings(d, user, input);
+  const usr = d.usr;
+  if (!usr || !saved || user.discordId === null || usr.links.isSignedUp(user.id))
+    return text;
+  const linked = usr.links.subjectOf(user.id) !== null;
+  const firstAdmin = !linked && d.configuredAdmins.has(user.discordId);
+  if (!linked && !firstAdmin)
+    return text;
+  if (guildId === null)
+    return `${text}
+
+Run \`/register\` in the server to get your usr sign-up link.`;
+  const discordId = user.discordId;
+  const policy = firstAdmin ? "open" : "allow";
+  return {
+    outside: () => usr.client.registerLink({ discordId, guildId, policy }).catch((err) => err),
+    finish: async (result) => {
+      if (result === null) {
+        usr.links.markSignedUp(user.id);
+        return firstAdmin ? `${text}
+
+You are signed up on usr. Once a usr admin gives you \`${usr.app}:register\` and \`${usr.app}:${MEMBER_ROLE}\` there, run \`/allow\` on yourself to link your tracker account.` : text;
+      }
+      if (result instanceof UsrError && result.status === 403 && linked && result.reason.includes("not allowed yet")) {
+        usr.links.unlink(user.id);
+        return `${text}
+
+usr no longer has you on its list: ask an admin to run \`/allow\` for you again.`;
+      }
+      if (result instanceof Error) {
+        d.log.warn(`usr register-link failed: ${result instanceof UsrError ? result.message : String(result)}`);
+        const detail = user.admin && result instanceof UsrError ? ` (${result.message})` : "";
+        return `${text}
+
+I could not get your usr sign-up link${detail}. Try \`/register\` again later.`;
+      }
+      const link = result;
+      const after = firstAdmin ? ` Then have a usr admin give you \`${usr.app}:register\` and \`${usr.app}:${MEMBER_ROLE}\` there, and run \`/allow\` on yourself to link your tracker account.` : "";
+      return `${text}
+
+Finish signing up on usr, where you will sign in to the web area: ${link.url}
+The link works once and expires soon; \`/register\` gives a new one.${after}`;
+    }
+  };
+}
+async function registerSettings(d, user, input) {
   let updated;
   try {
     updated = await setPreferences(d.store, user.id, {
@@ -6277,7 +6529,7 @@ async function registerPerson(d, user, input) {
     });
   } catch (err) {
     if (err instanceof PeopleError)
-      return err.message;
+      return { text: err.message, saved: false };
     throw err;
   }
   updated = await d.store.updateUser(user.id, { displayName: clip2(input.displayName, 100) });
@@ -6286,7 +6538,7 @@ async function registerPerson(d, user, input) {
   const zoneChanged = updated.timeZone !== user.timeZone;
   if (zoneChanged || updated.preferredHour !== user.preferredHour)
     await rescheduleOwned(d, updated, zoneChanged, user);
-  return registeredText(updated, first);
+  return { text: registeredText(updated, first), saved: true };
 }
 async function saveSettings(d, user, input) {
   let updated;
@@ -8047,7 +8299,7 @@ ${body}` : body);
       build: (b) => b.setDescription("Admin: let a person use the tracker").addUserOption((o) => o.setName("user").setDescription("Who to let in").setRequired(true)),
       handle: (interaction) => {
         const target = interaction.options.getUser("user", true);
-        return run(interaction, "admin", (d, admin, membership) => allowPerson(d, admin, { discordId: target.id, bot: target.bot, membership }), () => membershipOf(interaction, target.id));
+        return run(interaction, "admin", (d, admin, membership) => allowPerson(d, admin, { discordId: target.id, bot: target.bot, membership, displayName: displayName(target) }, interaction.guildId), () => membershipOf(interaction, target.id));
       }
     },
     {
@@ -8060,7 +8312,7 @@ ${body}` : body);
           displayName: displayName(interaction.user),
           ...hour !== null ? { hour } : {},
           ...zone !== null ? { zone: zone.trim() } : {}
-        });
+        }, interaction.guildId);
       })
     },
     {
@@ -10385,14 +10637,15 @@ function name3(u) {
 function framed(v, title, body) {
   return page({ base: v.base, title, signedIn: { name: name3(v.user), csrf: v.csrf, admin: v.user.admin }, body });
 }
-function signInHelpPage(base, note) {
+function signInHelpPage(base, note, usr = false) {
   return page({
     base,
     title: "Sign in",
     body: html`<section class="rb-card">
 <h1>Sign in</h1>
 ${note ? html`<p class="rb-muted">${note}</p>` : null}
-<p>Run <code>/web</code> in Discord: the bot answers you alone with a sign-in link, good for ten minutes and one use.</p>
+${usr ? html`<p><a class="rb-btn rb-btn--primary" href="${base}/?usr=go">Sign in with usr</a></p>` : null}
+<p>${usr ? "Or run" : "Run"} <code>/web</code> in Discord: the bot answers you alone with a sign-in link, good for ten minutes and one use.</p>
 </section>`
   });
 }
@@ -11103,6 +11356,12 @@ ${hidden(v)}
 <div><button class="rb-btn rb-btn--primary" type="submit">Allow</button></div>
 </form>
 </section>
+${o.usrUnlinked === undefined || o.usrUnlinked === null ? null : html`<section>
+<h2>Link everyone to usr</h2>
+<p class="rb-muted">${o.usrUnlinked === 0 ? "Everyone on the list is linked to usr." : `${o.usrUnlinked} on the list ${o.usrUnlinked === 1 ? "is" : "are"} not linked to usr yet.`} Each one is checked as a member of the server and allowed in usr as a member, with you as the admin who allowed them, as <code>/allow</code> does in the server.</p>
+${o.usrRun?.running ? html`<p>Linking everyone to usr: ${String(o.usrRun.done)} of ${String(o.usrRun.total)} done. Reload this page to see how far it has got.</p>` : o.usrRun?.result ? html`<div class="rb-alert ${o.usrRun.result.ok ? "rb-alert--success" : "rb-alert--warning"}" role="status"><p>Last run: ${o.usrRun.result.text}</p></div>` : null}
+${o.usrUnlinked === 0 || o.usrRun?.running ? null : html`<form method="post" action="${v.base}/admin/usr-link">${hidden(v)}<button class="rb-btn rb-btn--primary" type="submit">Link everyone to usr</button></form>`}
+</section>`}
 <section>
 <h2>Decline blocks</h2>
 ${blocks}
@@ -11283,8 +11542,12 @@ function confirmed(form) {
 }
 var WRONG_WORD = `Type ${CONFIRM_WORD} to confirm. Nothing was deleted.`;
 async function peoplePage(a, result, status, allow) {
-  const data = { people: a.d.roster.people(), blocks: a.d.roster.activeBlocks(a.d.clock.now()), now: a.d.clock.now() };
-  return htmlResponse(adminPage(a.v, data, { result, unlimited: a.d.budgetUnlimited === true, ...allow !== undefined ? { allow } : {} }), status);
+  const people = a.d.roster.people();
+  const data = { people, blocks: a.d.roster.activeBlocks(a.d.clock.now()), now: a.d.clock.now() };
+  const usr = a.d.usr;
+  const usrUnlinked = usr ? people.filter((p) => p.discordId !== null && usr.links.subjectOf(p.id) === null).length : null;
+  const usrRun = usr ? usrLinkRuns.get(usr) : undefined;
+  return htmlResponse(adminPage(a.v, data, { result, unlimited: a.d.budgetUnlimited === true, usrUnlinked, ...usrRun ? { usrRun } : {}, ...allow !== undefined ? { allow } : {} }), status);
 }
 async function onePerson(a, id, result = null) {
   const everyone = a.d.roster.people();
@@ -11334,12 +11597,28 @@ async function adminPost(a, r, form) {
     if (!/^[0-9]{17,20}$/.test(raw))
       return peoplePage(a, { ok: false, text: "That is not a Discord user id (17 to 20 digits)." }, 400, raw.slice(0, 20));
     const membership = await a.memberOf(raw);
-    const text = await fresh(a, true, (me) => allowPerson(a.d, me, { discordId: raw, bot: false, membership }));
+    const text = await fresh(a, true, async (me) => {
+      const answer = await allowPerson(a.d, me, { discordId: raw, bot: false, membership }, null);
+      if (typeof answer !== "string")
+        throw new Error("allowPerson called out without a server");
+      return answer;
+    });
     if (text === null)
       return unknownPage(base);
     const ok = text.startsWith("Allowed") || text.includes("already on the list");
     return peoplePage(a, { ok, text }, ok ? 200 : 400);
   }
+  if (r.kind === "admin-usr-link") {
+    if (!a.d.usr)
+      return unknownPage(base);
+    const usr = a.d.usr;
+    const result = await fresh(a, true, async (me) => startLinkEveryone(a, usr, me));
+    if (result === null)
+      return unknownPage(base);
+    if (result === "started")
+      return redirect(`${base}/admin`);
+    return peoplePage(a, result, result.ok ? 200 : 400);
+  }
   if (r.kind === "admin-lift") {
     const done = await fresh(a, true, (me) => liftDeclineBlock(a.d, me, r.id));
     if (done === null)
@@ -11402,6 +11681,106 @@ async function adminPost(a, r, form) {
     return redirect(`${base}/`);
   return onePerson(a, r.id, said2(done));
 }
+var usrLinkRuns = new WeakMap;
+var usrLinkPending = new Set;
+function startLinkEveryone(a, usr, me) {
+  if (a.usrGuildId === null) {
+    return { ok: false, text: "usr needs a server for each link, and TRACKER_GUILD_ID is unset: run /allow on each person in the server instead." };
+  }
+  if (me.discordId === null)
+    return { ok: false, text: "You have no Discord id here, and usr asks who is allowing them by it." };
+  const current = usrLinkRuns.get(usr);
+  if (current?.running)
+    return { ok: false, text: `Already linking everyone to usr: ${current.done} of ${current.total} done.` };
+  const waiting = a.d.roster.people().filter((p) => p.discordId !== null && usr.links.subjectOf(p.id) === null);
+  if (waiting.length === 0)
+    return { ok: true, text: "Everyone on the list is already linked to usr." };
+  const run = { running: true, done: 0, total: waiting.length, result: null };
+  usrLinkRuns.set(usr, run);
+  const pending = linkEveryone(a, usr, me.discordId, nameOf(me), a.usrGuildId, waiting.map((p) => p.id), run).catch((err) => {
+    a.d.log.error("usr link run failed", err);
+    run.result = { ok: false, text: `Linking to usr stopped: something went wrong. Linked ${run.done} so far; press again to go on.` };
+  }).finally(() => {
+    run.running = false;
+    usrLinkPending.delete(pending);
+  });
+  usrLinkPending.add(pending);
+  return "started";
+}
+async function linkEveryone(a, usr, invoker, by, guildId, ids, run) {
+  const member = `${usr.app}:${MEMBER_ROLE}`;
+  let linked = 0;
+  const problems = [];
+  const end = (ok, stopped) => {
+    const parts = [stopped ?? `Linked ${linked} of ${ids.length} to usr.`];
+    if (problems.length > 0)
+      parts.push(`Not linked: ${problems.join("; ")}.`);
+    run.result = { ok: ok && problems.length === 0, text: parts.join(" ") };
+  };
+  const notAdmin = () => end(false, `Linking to usr stopped: ${by}, who started it, is no longer an admin here. Linked ${linked} so far.`);
+  const stillWaiting = (id) => fresh(a, true, async () => {
+    const p = await a.d.store.getUser(id);
+    return p && p.discordId !== null && usr.links.subjectOf(id) === null ? p : "skip";
+  });
+  for (const id of ids) {
+    const first = await stillWaiting(id);
+    if (first === null)
+      return notAdmin();
+    if (first === "skip") {
+      run.done++;
+      continue;
+    }
+    const membership = await a.memberOf(first.discordId);
+    if (membership === "not-member" || membership === "unknown") {
+      problems.push(`${nameOf(first)}: ${membership === "not-member" ? "not a member of the server, or lacks its role" : "could not check they are a member of the server"}`);
+      run.done++;
+      continue;
+    }
+    const p = await stillWaiting(id);
+    if (p === null)
+      return notAdmin();
+    if (p === "skip") {
+      run.done++;
+      continue;
+    }
+    const answer = await usr.client.allow({ discordId: p.discordId, guildId, invokerDiscordId: invoker, roles: [member], ...p.displayName ? { displayName: p.displayName } : {} }).catch((err) => err);
+    if (answer instanceof UsrError && answer.status === 400 && !/guild_id|invoker|roles|role "/.test(answer.reason)) {
+      problems.push(`${nameOf(p)}: ${answer.message}`);
+      run.done++;
+      continue;
+    }
+    if (answer instanceof Error) {
+      if (!(answer instanceof UsrError))
+        a.d.log.error("usr allow failed", answer);
+      const why = answer instanceof UsrError ? answer.message : "something went wrong";
+      return end(false, `Linking to usr stopped, since it would fail for everyone: ${why}. Linked ${linked} so far; fix that, then press again.`);
+    }
+    const allowed = answer;
+    if (!allowed.roles.includes(member)) {
+      return end(false, `Linking to usr stopped: usr did not give ${nameOf(p)} ${member}. Check that the tracker's usr key's Discord service is set to app ${usr.app} (TRACKER_USR_APP). Linked ${linked} so far.`);
+    }
+    const outcome = await fresh(a, true, async () => {
+      try {
+        return usr.links.link(id, allowed.userId);
+      } catch (err) {
+        a.d.log.error("usr link failed", err);
+        return err instanceof Error && /UNIQUE constraint failed/.test(err.message) ? "taken" : "failed";
+      }
+    });
+    if (outcome === null)
+      return notAdmin();
+    run.done++;
+    if (outcome === "linked" || outcome === "relinked" || outcome === "unchanged")
+      linked++;
+    else if (outcome === "taken")
+      problems.push(`${nameOf(p)}: their usr account is already linked to someone else here`);
+    else if (outcome === "gone")
+      problems.push(`${nameOf(p)}: left the tracker meanwhile`);
+    else
+      problems.push(`${nameOf(p)}: something went wrong keeping their usr link`);
+  }
+  end(true);
+}
 async function forgetRoute(a, method, form) {
   const base = a.v.base;
   const note = isConfiguredAdmin(a.d, a.v.user) ? CONFIGURED_SELF : undefined;
@@ -12319,6 +12698,8 @@ function route2(path) {
     return { kind: "admin-usage" };
   if (path === "/admin/allow")
     return { kind: "admin-allow" };
+  if (path === "/admin/usr-link")
+    return { kind: "admin-usr-link" };
   const ceiling = PERSON_CEILING.exec(path);
   if (ceiling)
     return { kind: "admin-ceiling", id: segment2(ceiling[1]) };
@@ -12348,7 +12729,7 @@ function route2(path) {
   return { kind: "act", id, action };
 }
 function methodsOf(r) {
-  if (r.kind === "logout" || r.kind === "act" || r.kind === "admin-allow" || r.kind === "admin-act" || r.kind === "admin-ceiling" || r.kind === "admin-lift" || r.kind === "token-revoke" || r.kind === "admin-token-revoke") {
+  if (r.kind === "logout" || r.kind === "act" || r.kind === "admin-allow" || r.kind === "admin-usr-link" || r.kind === "admin-act" || r.kind === "admin-ceiling" || r.kind === "admin-lift" || r.kind === "token-revoke" || r.kind === "admin-token-revoke") {
     return "POST";
   }
   if (r.kind === "settings" || r.kind === "edit" || r.kind === "new" || r.kind === "forget" || r.kind === "tokens")
@@ -12390,12 +12771,118 @@ class Sessions {
   }
 }
 
+// plugins/tracker/src/usr-identity.ts
+var SSO_COOKIE = "nz_id";
+var JWKS_TTL_MS = 5 * 60 * 1000;
+var JWKS_RETRY_MS = 30 * 1000;
+var JWKS_TIMEOUT_MS = 5000;
+var MAX_TOKEN = 8192;
+var MAX_JWKS = 64 * 1024;
+function decode(part) {
+  try {
+    return JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+
+class UsrVerifier {
+  o;
+  keys = [];
+  fetchedAt = Number.NEGATIVE_INFINITY;
+  pending = null;
+  constructor(o) {
+    this.o = o;
+  }
+  async verify(token) {
+    if (!token || token.length > MAX_TOKEN)
+      return null;
+    const parts = token.split(".");
+    if (parts.length !== 3)
+      return null;
+    const [h, p, s] = parts;
+    const header = decode(h);
+    if (!header || header.alg !== "ES256" || header.typ === "dlg+jwt" || typeof header.kid !== "string")
+      return null;
+    const key = await this.keyFor(header.kid, false) ?? await this.keyFor(header.kid, true);
+    if (!key)
+      return null;
+    const signature = Buffer.from(s, "base64url");
+    if (signature.length !== 64)
+      return null;
+    const ok = await crypto.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, key, signature, new TextEncoder().encode(`${h}.${p}`));
+    if (!ok)
+      return null;
+    const claims = decode(p);
+    if (!claims || claims.iss !== "usr" || claims.act !== undefined)
+      return null;
+    if (typeof claims.exp !== "number" || claims.exp * 1000 <= this.o.now())
+      return null;
+    if (typeof claims.sub !== "string" || claims.sub === "")
+      return null;
+    const roles = Array.isArray(claims.roles) ? claims.roles.filter((r) => typeof r === "string") : [];
+    return { sub: claims.sub, roles };
+  }
+  async keyFor(kid, force) {
+    const age = this.o.now() - this.fetchedAt;
+    if (age < 0 || age >= JWKS_TTL_MS || force && age >= JWKS_RETRY_MS)
+      await this.refresh();
+    return this.keys.find((k) => k.kid === kid)?.key ?? null;
+  }
+  refresh() {
+    if (!this.pending) {
+      this.pending = this.load().finally(() => {
+        this.pending = null;
+      });
+    }
+    return this.pending;
+  }
+  async load() {
+    this.fetchedAt = this.o.now();
+    try {
+      const res = await (this.o.fetchImpl ?? fetch)(`${this.o.url}/.well-known/jwks.json`, {
+        headers: { Accept: "application/json" },
+        redirect: "manual",
+        signal: AbortSignal.timeout(JWKS_TIMEOUT_MS)
+      });
+      if (!res.ok)
+        return;
+      const text = await readBody(res, MAX_JWKS);
+      if (text === null)
+        return;
+      const body = JSON.parse(text);
+      if (!Array.isArray(body.keys))
+        return;
+      const keys = [];
+      for (const k of body.keys) {
+        if (typeof k.kid !== "string" || k.kty !== "EC" || k.crv !== "P-256")
+          continue;
+        try {
+          const jwk = { kty: "EC", crv: "P-256", ...k.x !== undefined ? { x: k.x } : {}, ...k.y !== undefined ? { y: k.y } : {} };
+          keys.push({ kid: k.kid, key: await crypto.subtle.importKey("jwk", jwk, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]) });
+        } catch {}
+      }
+      this.keys = keys;
+    } catch {}
+  }
+}
+function refreshUrl(usrUrl, returnTo) {
+  return `${usrUrl}/api/auth/sso/refresh?return=${encodeURIComponent(returnTo)}`;
+}
+
 // plugins/tracker/src/web/app.ts
 var MEMBER_RECHECK_MS = 15 * 60 * 1000;
 var MEMBER_GRACE_MS = 24 * 60 * 60 * 1000;
 var MEMBER_CHECK_TIMEOUT_MS = 3000;
 var MEMBER_RETRY_MS = 60 * 1000;
 var LEFT_SERVER = `You are signed out. ${NOT_MEMBER}`;
+var USR_NO_COOKIE = "I could not confirm your usr sign-in. Try again in a minute, or run /web in Discord for a one-time link. If it keeps happening, tell an admin.";
+var USR_RECHECK_FAILED = "I could not check that you are a member of this tracker's server. Try again in a minute.";
+var USR_NOT_MEMBER = "Your usr account does not have this tracker's member role yet: ask an admin to run /allow for you in the server.";
+var USR_NOT_LINKED = "Your usr account is not linked to anyone on this tracker yet: ask an admin to run /allow for you in the server, then run /register.";
+var USR_BACK = "usr";
+var USR_GO = "go";
+var SIGNED_OUT_MS = 12 * 60 * 60 * 1000;
 var RECHECK_FAILED = "You are signed out: I could not check that you are still a member of this tracker's server.";
 var MAX_FORM_BYTES = 32 * 1024;
 function plain(status, text, extra = {}) {
@@ -12424,6 +12911,7 @@ function createWebHandler(w) {
   const base = `/${w.name}`;
   const SESSION_COOKIE = `__Secure-${w.name}-session`;
   const LOGIN_COOKIE = `__Secure-${w.name}-login`;
+  const OUT_COOKIE = `__Secure-${w.name}-out`;
   const clear = (name) => cookie(name, "", { base, maxAgeSeconds: 0, sameSite: "Lax" });
   const inFlight = new Map;
   const failedAt = new Map;
@@ -12545,7 +13033,51 @@ function createWebHandler(w) {
       return htmlResponse(signInHelpPage(base, "That sign-in link has expired or was already used."), 400, { "Set-Cookie": clear(LOGIN_COOKIE) });
     }
     const { id } = d.sessions.create(user.id, now, link?.memberCheckedAt ?? null);
-    return redirect(`${base}/`, [cookie(SESSION_COOKIE, id, { base, maxAgeSeconds: SESSION_TTL_MS / 1000, sameSite: "Lax" }), clear(LOGIN_COOKIE)]);
+    return redirect(`${base}/`, [cookie(SESSION_COOKIE, id, { base, maxAgeSeconds: SESSION_TTL_MS / 1000, sameSite: "Lax" }), clear(LOGIN_COOKIE), clear(OUT_COOKIE)]);
+  }
+  async function usrSignIn(d, usr, request, path, url, origin, stale) {
+    const asked = url.searchParams.get(USR_BACK);
+    if (readCookie(request, OUT_COOKIE) !== null && asked !== USR_GO && asked !== "1")
+      return redirect(`${base}/signin?out=1`, stale);
+    const identity = await usr.verifier.verify(readCookie(request, SSO_COOKIE));
+    const help = (note) => htmlResponse(signInHelpPage(base, note), 403, stale[0] ? { "Set-Cookie": stale[0] } : {});
+    const query = new URLSearchParams(url.searchParams);
+    query.delete(USR_BACK);
+    const rest = query.toString();
+    if (!identity) {
+      if (asked === "1")
+        return help(USR_NO_COOKIE);
+      const back = refreshUrl(usr.url, `${origin}${base}${path}?${rest ? `${rest}&` : ""}${USR_BACK}=1`);
+      const h = new Headers({ Location: back, "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" });
+      for (const c of stale)
+        h.append("Set-Cookie", c);
+      return new Response(null, { status: 303, headers: h });
+    }
+    if (!identity.roles.includes(`${usr.app}:${MEMBER_ROLE}`))
+      return help(USR_NOT_MEMBER);
+    const userId = usr.links.userOfSubject(identity.sub);
+    const user = userId ? await d.store.getUser(userId) : null;
+    if (!user || !d.admissions.isRegistered(user.id))
+      return help(USR_NOT_LINKED);
+    const member = await recheck(d, user, null);
+    if (member === "not-member")
+      return help(NOT_MEMBER);
+    if (member !== "ok")
+      return help(USR_RECHECK_FAILED);
+    const now = d.clock.now();
+    const { id } = d.sessions.create(user.id, now, w.guildIds === null ? null : now.toISOString());
+    return redirect(`${base}${path}${rest ? `?${rest}` : ""}`, [cookie(SESSION_COOKIE, id, { base, maxAgeSeconds: SESSION_TTL_MS / 1000, sameSite: "Lax" }), clear(OUT_COOKIE)]);
+  }
+  async function usrRevoked(d, request, user) {
+    const usr = d.usr;
+    if (!usr)
+      return false;
+    const identity = await usr.verifier.verify(readCookie(request, SSO_COOKIE));
+    if (!identity || identity.sub !== usr.links.subjectOf(user.id) || identity.roles.includes(`${usr.app}:${MEMBER_ROLE}`))
+      return false;
+    d.sessions.deleteForUser(user.id);
+    d.apiTokens.deleteForUser(user.id);
+    return true;
   }
   async function settingsPost(d, v, form) {
     const hour = (form.get("hour") ?? "").trim();
@@ -12596,7 +13128,7 @@ function createWebHandler(w) {
       });
     }
     if (path === "/signin")
-      return only("GET") ?? htmlResponse(signInHelpPage(base, signInNote(url.searchParams)));
+      return only("GET") ?? htmlResponse(signInHelpPage(base, signInNote(url.searchParams), Boolean(d.usr)));
     if (path === "/login")
       return method === "GET" ? loginGet(d, url) : loginPost(d, request);
     const r = route2(path);
@@ -12609,15 +13141,21 @@ function createWebHandler(w) {
     const auth = await authenticate(d, request);
     if (auth.kind === "signed-out")
       return htmlResponse(signInHelpPage(base, auth.note), 403, { "Set-Cookie": clear(SESSION_COOKIE) });
-    if (auth.kind !== "ok")
-      return redirect(`${base}/signin`, auth.kind === "stale" ? [clear(SESSION_COOKIE)] : []);
+    if (auth.kind !== "ok") {
+      const stale = auth.kind === "stale" ? [clear(SESSION_COOKIE)] : [];
+      if (method === "GET" && d.usr && w.origin !== null)
+        return usrSignIn(d, d.usr, request, path, url, w.origin, stale);
+      return redirect(`${base}/signin`, stale);
+    }
+    if (await usrRevoked(d, request, auth.user))
+      return htmlResponse(signInHelpPage(base, USR_NOT_MEMBER), 403, { "Set-Cookie": clear(SESSION_COOKIE) });
     if (admin && !auth.user.admin)
       return unknownPage(base);
     if (admin && !allowed.split(", ").includes(method))
       return plain(405, "Method not allowed", { Allow: allowed });
     const v = { base, user: auth.user, csrf: auth.session.csrf };
     const e = { d, v, queue: w.queue, reading };
-    const a = { d, v, queue: w.queue, memberOf: (id) => memberOf(id), signOutCookie: clear(SESSION_COOKIE) };
+    const a = { d, v, queue: w.queue, memberOf: (id) => memberOf(id), signOutCookie: clear(SESSION_COOKIE), usrGuildId: w.guildIds?.[0] ?? null };
     if (method === "POST") {
       const form = await readForm(request);
       if (!form)
@@ -12627,7 +13165,10 @@ function createWebHandler(w) {
       switch (r.kind) {
         case "logout":
           d.sessions.delete(auth.id);
-          return redirect(`${base}/signin?out=1`, [clear(SESSION_COOKIE)]);
+          return redirect(`${base}/signin?out=1`, [
+            clear(SESSION_COOKIE),
+            ...d.usr ? [cookie(OUT_COOKIE, "1", { base, maxAgeSeconds: SIGNED_OUT_MS / 1000, sameSite: "Lax" })] : []
+          ]);
         case "settings":
           return settingsPost(d, v, form);
         case "new":
@@ -12643,6 +13184,7 @@ function createWebHandler(w) {
         case "token-revoke":
           return tokenRevokePost(d, v, r.id);
         case "admin-allow":
+        case "admin-usr-link":
         case "admin-act":
         case "admin-ceiling":
         case "admin-lift":
@@ -12702,6 +13244,61 @@ function parseWebUrl(raw) {
   return url.origin;
 }
 
+// plugins/tracker/src/usr-links.ts
+function seqOf2(id) {
+  return /^u[1-9][0-9]*$/.test(id) ? Number(id.slice(1)) : null;
+}
+
+class UsrLinks {
+  db;
+  signedUp = new Set;
+  constructor(db) {
+    this.db = db;
+  }
+  isSignedUp(userId) {
+    return this.signedUp.has(userId);
+  }
+  markSignedUp(userId) {
+    this.signedUp.add(userId);
+  }
+  subjectOf(userId) {
+    const seq = seqOf2(userId);
+    if (seq === null)
+      return null;
+    const row = this.db.query("SELECT usr_subject FROM users WHERE seq = ?").get(seq);
+    return row?.usr_subject ?? null;
+  }
+  userOfSubject(subject) {
+    const row = this.db.query("SELECT seq FROM users WHERE usr_subject = ?").get(subject);
+    return row ? `u${row.seq}` : null;
+  }
+  link(userId, subject) {
+    const seq = seqOf2(userId);
+    if (seq === null)
+      throw new Error(`not a tracker user id: ${userId}`);
+    return this.db.transaction(() => {
+      const row = this.db.query("SELECT usr_subject FROM users WHERE seq = ?").get(seq);
+      if (!row)
+        return "gone";
+      const holder = this.db.query("SELECT seq FROM users WHERE usr_subject = ?").get(subject);
+      if (holder && holder.seq !== seq)
+        return "taken";
+      if (row.usr_subject === subject)
+        return "unchanged";
+      this.db.query("UPDATE users SET usr_subject = ? WHERE seq = ?").run(subject, seq);
+      this.signedUp.delete(userId);
+      return row.usr_subject === null ? "linked" : "relinked";
+    }).immediate();
+  }
+  unlink(userId) {
+    const seq = seqOf2(userId);
+    if (seq === null)
+      return;
+    this.db.query("UPDATE users SET usr_subject = NULL WHERE seq = ?").run(seq);
+    this.signedUp.delete(userId);
+  }
+}
+
 // plugins/tracker/src/index.ts
 var DB_DIR = "tracker";
 var DB_FILE = "tracker.sqlite";
@@ -12732,6 +13329,8 @@ function createPlugin(host, options = {}) {
   const roleGate = { roles: parseGuildRoles(host.env.TRACKER_GUILD_ROLES, guildIds), exempt: new Set(adminIds) };
   const webOrigin = parseWebUrl(host.env.TRACKER_WEB_URL);
   const cityHall = parseCityHallConfig(host.env);
+  const usrConfig = parseUsrConfig(host.env);
+  const usrClient = usrConfig ? createUsrClient({ config: usrConfig, ...options.usrFetch ? { fetchImpl: options.usrFetch } : {} }) : null;
   const budgetUnlimited = parseBudgetUnlimited(host.env[BUDGET_UNLIMITED_KEY]);
   const cityHallConfig = cityHall.config;
   const executeOn = cityHallConfig !== null || options.executor !== undefined;
@@ -12957,6 +13556,8 @@ function createPlugin(host, options = {}) {
         host.log.info(`execute lane on: city-hall ${cityHallConfig.url}, capability ${cityHallConfig.capability}`);
       else if ("missing" in cityHall && cityHall.missing.length > 0)
         host.log.warn(`execute lane is off, so /research is unavailable: ${cityHall.missing.join(", ")} not set`);
+      if (usrConfig)
+        host.log.info(`usr link on: ${usrConfig.url}, app ${usrConfig.app}`);
       deps = {
         store: openedStore,
         admissions: new Admissions(opened),
@@ -12979,7 +13580,14 @@ function createPlugin(host, options = {}) {
         webEditor: webOrigin !== null,
         research: executeOn,
         bgg: bgg !== null,
-        inbox
+        inbox,
+        usr: usrConfig && usrClient ? {
+          client: usrClient,
+          url: usrConfig.url,
+          verifier: new UsrVerifier({ url: usrConfig.url, now: () => clock.now().getTime(), ...options.usrFetch ? { fetchImpl: options.usrFetch } : {} }),
+          app: usrConfig.app,
+          links: new UsrLinks(opened)
+        } : null
       };
       if (guildIds === null)
         host.log.warn("TRACKER_GUILD_ID is unset: no membership gate, only the admission list");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rackbops/plugin-tracker",
-  "version": "0.19.0",
+  "version": "0.23.0",
   "description": "The task tracker for Rackbops Clerk: reminders, renewals, price drops, one-off research and an interest scout (through city-hall, with their findings), a want-list watcher (listing pages you paste, BoardGameGeek through its API once its token is set, and eBay and BoardGameGeek listings you send in through the task API, never read by the tracker; with the model checking each new listing and its seller first, through city-hall) by slash command, delivered by DM with buttons, and a daily DM at each person's hour of what is due today and overdue, on docket's SQLite store (/allow, /register, /remind, /renewal, /price, /research, /scout, /want, /tasks, /task, /settings, /web), with a web area for your tasks, history and settings, a web editor to make, change, pause and delete your own tasks (research requests too, made but not changed, and scouts, made and changed), an admin view (with the DMs that did not arrive, raising a person's daily model ceiling, and daily model usage per person), an operator switch that turns the daily budgets off for the alpha, forget-me, and a JSON task API with personal API tokens",
   "type": "module",
   "main": "dist/plugin.js",
@@ -99,6 +99,27 @@
         "required": false,
         "secret": true,
         "description": "BoardGameGeek's XML API Bearer token for the tracker's registered application (boardgamegeek.com/using_the_xml_api). Set = /want source: bgg watches a game's BGG marketplace listings through BGG's API; unset = /want source: bgg makes a watch whose listings are sent in through the task API instead, as for eBay. Never logged."
+      },
+      {
+        "key": "TRACKER_USR_URL",
+        "format": "^https://[A-Za-z0-9.-]+(:[0-9]{1,5})?/?$",
+        "required": false,
+        "secret": false,
+        "description": "The https origin of our usr (Rackbops/usr), e.g. https://id.example.com (no path): turns the usr link on, with TRACKER_USR_KEY. People stay in the tracker; each is linked to a usr account by usr's user id. Unset = the usr link is off and nothing changes."
+      },
+      {
+        "key": "TRACKER_USR_KEY",
+        "format": "^\\S+$",
+        "required": false,
+        "secret": true,
+        "description": "The tracker's usr API key, holding usr:discord only (never tracker:admin or tracker:register), with a usr Discord service set to this app. Required with TRACKER_USR_URL; set without it refuses to load. Never logged."
+      },
+      {
+        "key": "TRACKER_USR_APP",
+        "format": "^[a-z0-9]+(-[a-z0-9]+)*$",
+        "required": false,
+        "secret": false,
+        "description": "The usr app the tracker's roles live under (tracker:member, tracker:register); it must match the app on the key's usr Discord service row, which is what usr goes by. Unset = tracker. Needs TRACKER_USR_URL."
       }
     ]
   }