@rackbops/plugin-tracker 0.36.0 → 0.38.0

package/dist/plugin.js

@@ -777,8 +777,15 @@ function followUpKey(occurrenceId) {
   return `${FOLLOW_UP_PREFIX}${occurrenceId}`;
 }
 var FOLLOW_UP_PREFIX = "followup:";
+function runNowKey(taskId, requestId) {
+  if (!REQUEST_ID.test(requestId))
+    throw new Error("runNowKey: requestId must be 1 to 64 of A-Z a-z 0-9 - _");
+  return `${RUN_NOW_PREFIX}${taskId}:${requestId}`;
+}
+var REQUEST_ID = /^[A-Za-z0-9_-]{1,64}$/;
+var RUN_NOW_PREFIX = "now:";
 function isOffSchedule(dedupeKey) {
-  return dedupeKey.startsWith(SNOOZE_PREFIX) || dedupeKey.startsWith(FOLLOW_UP_PREFIX);
+  return dedupeKey.startsWith(SNOOZE_PREFIX) || dedupeKey.startsWith(FOLLOW_UP_PREFIX) || dedupeKey.startsWith(RUN_NOW_PREFIX);
 }
 
 // node_modules/@rackbops/docket-core/dist/ports.js
@@ -4786,6 +4793,44 @@ function withinLimits(l, config) {
     return true;
   return l.price !== undefined && l.price <= config.maxPrice + 0.000000001;
 }
+var MAX_EXCLUDE = 20;
+var EXCLUDE_CHARS = 80;
+function parseExclude(text) {
+  const out = [];
+  const seen = new Set;
+  for (const raw of text.split(/[,\n]/)) {
+    const entry = raw.trim().slice(0, EXCLUDE_CHARS).trim();
+    const key = wordsOf(entry).join(" ");
+    if (!key || seen.has(key))
+      continue;
+    seen.add(key);
+    out.push(entry);
+    if (out.length === MAX_EXCLUDE)
+      break;
+  }
+  return out;
+}
+function isExcluded(title, value) {
+  const exclude = typeof value === "string" ? parseExclude(value) : value;
+  if (!Array.isArray(exclude) || exclude.length === 0)
+    return false;
+  const have = wordsOf(title);
+  return exclude.slice(0, MAX_EXCLUDE).some((entry) => {
+    if (typeof entry !== "string")
+      return false;
+    const want = wordsOf(entry.slice(0, EXCLUDE_CHARS));
+    if (want.length === 0)
+      return false;
+    for (let i = 0;i + want.length <= have.length; i++) {
+      if (want.every((w, j) => have[i + j] === w))
+        return true;
+    }
+    return false;
+  });
+}
+function wanted(l, config) {
+  return withinLimits(l, config) && !isExcluded(l.title, config.exclude);
+}
 function priceText(l, config) {
   return l.price === undefined ? "price not shown" : money(l.price, l.currency ?? config.currency ?? "");
 }
@@ -4865,9 +4910,11 @@ async function pollWant(ctx, sources, stored) {
     throw err;
   }
   const told = new Set(state.reported);
-  const within = listings.filter((l) => withinLimits(l, ctx.config));
+  const limited = listings.filter((l) => withinLimits(l, ctx.config));
+  const within = limited.filter((l) => !isExcluded(l.title, ctx.config.exclude));
   const fresh = within.filter((l) => !told.has(listingKey(l.id))).slice(0, MAX_NEW_PER_RUN);
-  const summary = `${listings.length} listed, ${within.length} within limits, ${fresh.length} new`;
+  const dropped = limited.length - within.length;
+  const summary = `${listings.length} listed, ${limited.length} within limits, ` + `${dropped > 0 ? `${dropped} excluded, ` : ""}${fresh.length} new`;
   const read = { ...state, misses: 0, warned: false };
   if (fresh.length === 0)
     return { kind: "done", outcome: { state: read, summary } };
@@ -4904,6 +4951,12 @@ function wantlistType(sources) {
           description: "Only listings in this currency",
           required: false,
           kind: "string"
+        },
+        {
+          name: "exclude",
+          description: "Leave out listings whose title has any of these words or phrases, separated by commas",
+          required: false,
+          kind: "string"
         }
       ]
     },
@@ -5164,7 +5217,7 @@ function judgeFailed(ctx, state, kind, detail) {
     return { state: { ...state, failures, retryAt: retry.at }, followUp: retry.followUp, summary };
   }
   const reason = SAID3[kind] ?? "the check failed";
-  const within = state.pending.filter((l) => withinLimits(l, ctx.config));
+  const within = state.pending.filter((l) => wanted(l, ctx.config));
   const kept = { ...state, pending: within };
   return {
     state: settled(kept, within.length),
@@ -5181,7 +5234,7 @@ function judgeFailed(ctx, state, kind, detail) {
   };
 }
 function judged(ctx, stored, verdicts) {
-  const all = stored.pending.map((l, i) => ({ l, v: verdicts.get(i + 1) ?? { fit: "maybe", why: "", seller: "" } })).filter(({ l }) => withinLimits(l, ctx.config));
+  const all = stored.pending.map((l, i) => ({ l, v: verdicts.get(i + 1) ?? { fit: "maybe", why: "", seller: "" } })).filter(({ l }) => wanted(l, ctx.config));
   const state = { ...stored, pending: all.map((x) => x.l) };
   const rank = { match: 0, maybe: 1, no: 2 };
   const shown = all.filter((x) => x.v.fit !== "no").sort((a, b) => rank[a.v.fit] - rank[b.v.fit]);
@@ -5242,6 +5295,12 @@ function wantjudgeType(sources, o = {}) {
           description: "Only listings in this currency",
           required: false,
           kind: "string"
+        },
+        {
+          name: "exclude",
+          description: "Leave out listings whose title has any of these words or phrases, separated by commas",
+          required: false,
+          kind: "string"
         }
       ]
     },
@@ -6423,6 +6482,10 @@ class SqliteStore {
     const next = this.one("SELECT * FROM occurrences WHERE task_id = ? AND status = 'queued' AND due_at > ? ORDER BY due_at, created_at, seq LIMIT 1", taskId, now);
     return { rows: rows.reverse().map(toOccurrence), total, next: next ? toOccurrence(next) : null };
   }
+  async runsNowSince(ownerId, since) {
+    const row = this.one("SELECT COUNT(*) AS n FROM occurrences o JOIN tasks t ON o.task_id = 't' || t.seq WHERE t.owner_id = ? AND o.dedupe_key LIKE 'now:%' AND o.created_at >= ?", ownerId, since);
+    return Number(row?.n ?? 0);
+  }
   async repliesTo(taskId, occurrenceIds, userId) {
     if (occurrenceIds.length === 0)
       return [];
@@ -6762,6 +6825,7 @@ var MAX_REMINDER_TEXT = 1500;
 var MAX_WHEN = 100;
 var MAX_NOTE = 300;
 var MAX_URL = 1000;
+var MAX_EXCLUDE_TEXT = 1000;
 var MAX_NEAR = 100;
 var MAX_AMOUNT = 1e6;
 var CURRENCY_LENGTH = 3;
@@ -6908,7 +6972,7 @@ function retimed(s, day, owner) {
   return null;
 }
 async function heldRuns(store, task) {
-  return (await store.listOccurrences({ taskId: task.id, status: "queued" })).filter((o) => !o.dedupeKey.startsWith(SNOOZE_PREFIX) && !hasFired(o));
+  return (await store.listOccurrences({ taskId: task.id, status: "queued" })).filter((o) => !isOffSchedule(o.dedupeKey) && !hasFired(o));
 }
 async function restoreHeldRun(store, task, held, before, after, now) {
   const s = task.schedule;
@@ -7562,6 +7626,10 @@ async function pauseLocked(d, user, taskId) {
   const at = d.clock.now().toISOString();
   await d.store.updateTask(task.id, { status: "paused", at });
   await d.store.addTaskEvent({ taskId: task.id, actorId: user.id, kind: "paused", detail: "paused by the owner", at });
+  for (const o of await d.store.listOccurrences({ taskId: task.id, status: "queued" })) {
+    if (o.dedupeKey.startsWith(RUN_NOW_PREFIX))
+      await deleteIdleRun(d.store, o);
+  }
   return { ok: true, text: `Paused \`${task.id}\`: nothing is sent until you resume it.` };
 }
 function resumeTask(d, user, taskId) {
@@ -8230,6 +8298,33 @@ function limitsPlan(input, defaultHours, minHours = 1) {
     limits: { name, hours, ...input.max !== undefined ? { maxPrice: input.max } : {}, ...currency ? { currency } : {} }
   };
 }
+function excludePlan(text, words) {
+  const raw = (text ?? "").trim();
+  if (raw === "" || raw === "-")
+    return { ok: true, exclude: [] };
+  if (raw.length > MAX_EXCLUDE_TEXT)
+    return { ok: false, error: `\`exclude\` is longer than ${MAX_EXCLUDE_TEXT} characters.` };
+  const entries = raw.split(/[,\n]/).map((e) => e.trim()).filter((e) => e !== "");
+  const long = entries.find((e) => e.length > EXCLUDE_CHARS);
+  if (long !== undefined)
+    return { ok: false, error: `Each word or phrase in \`exclude\` is at most ${EXCLUDE_CHARS} characters.` };
+  const distinct = new Set(entries.map((e) => searchWords(e).join(" ")).filter((k) => k !== ""));
+  if (distinct.size > MAX_EXCLUDE)
+    return { ok: false, error: `\`exclude\` takes at most ${MAX_EXCLUDE} words or phrases, separated by commas.` };
+  if (distinct.size === 0)
+    return { ok: false, error: "`exclude` needs words or phrases, separated by commas, such as `investigator`." };
+  const exclude = parseExclude(raw);
+  if (words !== null) {
+    const searched = new Set(searchWords(words));
+    const every = exclude.find((e) => {
+      const w = searchWords(e);
+      return w.length === 1 && searched.has(w[0]);
+    });
+    if (every !== undefined)
+      return { ok: false, error: `\`exclude\` has "${every}", a word this watch searches for, so every listing it finds has it and none would be left.` };
+  }
+  return { ok: true, exclude };
+}
 function ebaySearchUrl(words, max) {
   const q = new URLSearchParams({ _nkw: words });
   if (max !== undefined)
@@ -8362,11 +8457,15 @@ async function startWant(d, user, input) {
   const capped = await liveTaskCap(d, user);
   if (capped)
     return { ok: false, error: capped };
+  const excluded = excludePlan(input.exclude, words);
+  if (!excluded.ok)
+    return excluded;
   const where = words !== null ? { source: source === "ebay" ? "ebay" : "shopify", target: words } : site && inbox ? { source: "inbox", target: newInboxKey(site), search: inbox.search, ...inbox.game !== null ? { game: String(inbox.game) } : {} } : { source, target: source === "bgg" ? String(parseBggThingId(target)) : target };
   const config = {
     ...where,
     ...limits.maxPrice !== undefined ? { maxPrice: limits.maxPrice } : {},
-    ...limits.currency ? { currency: limits.currency } : {}
+    ...limits.currency ? { currency: limits.currency } : {},
+    ...excluded.exclude.length > 0 ? { exclude: excluded.exclude } : {}
   };
   return { ok: true, start: { title: limits.name, hours: limits.hours, config, judge: judged.judge } };
 }
@@ -8375,8 +8474,9 @@ async function previewWant(d, start) {
     return { ok: true, text: "" };
   try {
     const listings = await pageSource.search(start.config.target, d.fetch ?? undefined);
-    const within = listings.filter((l) => withinLimits(l, start.config)).length;
-    const limited = start.config.maxPrice !== undefined || start.config.currency ? `, ${within} within your limits` : "";
+    const within = listings.filter((l) => wanted(l, start.config)).length;
+    const c = start.config;
+    const limited = c.maxPrice !== undefined || c.currency || (c.exclude?.length ?? 0) > 0 ? `, ${within} within your limits` : "";
     return { ok: true, text: `The page lists ${plural4(listings.length, "thing")} now${limited}.` };
   } catch (err) {
     const cause = err instanceof Error ? err.cause : undefined;
@@ -8427,7 +8527,8 @@ async function finishWant(d, asked, start, seen) {
       start.judge ? `I look at ${where} every ${plural4(start.hours, "hour")}, and the model looks at each listing${limits.length ? ` ${limits.join(" ")}` : ""} I have not shown you before -- whether it is the thing, and ${shows} -- then I DM you the ones worth a look, with its notes; the first look starts within a minute. Those looks are model runs, charged like research; \`judge: false\` makes a watch without them. Press Done on a DM once you have it, or \`/task done ${task.id}\`.` : `I look at ${where} every ${plural4(start.hours, "hour")} and DM you each listing${limits.length ? ` ${limits.join(" ")}` : ""} I have not shown you before; ${first}. Press Done on a DM once you have it, or \`/task done ${task.id}\`.`,
       ...inboxNote(c, task.id, d.mail && watchSite(c) === "ebay" ? d.mail.addressFor(user.id, now) : null),
       ...c.source === "shopify" ? ["Shopify's search finds new copies at Shopify stores only (not eBay or used copies), and I keep a product only when its title has every word you are watching for. Each look is a Firecrawl search (5 credits)."] : [],
-      ...c.source === "ebay" ? ["I search eBay US through eBay's own API, newest listings first, new and used, an auction at its current bid (or its Buy It Now price), and count a listing only when its title has every word you are watching for. I never open an eBay page, and the model does not check these listings. eBay's terms let me keep its listings only briefly, so they are in the DM alone, and my own copy of it is cleared after 6 hours."] : []
+      ...c.source === "ebay" ? ["I search eBay US through eBay's own API, newest listings first, new and used, an auction at its current bid (or its Buy It Now price), and count a listing only when its title has every word you are watching for. I never open an eBay page, and the model does not check these listings. eBay's terms let me keep its listings only briefly, so they are in the DM alone, and my own copy of it is cleared after 6 hours."] : [],
+      ...c.exclude && c.exclude.length > 0 ? [`I leave out any listing whose title has ${c.exclude.map((e) => `"${e}"`).join(", ")}.`] : []
     ].join(`
 `))
   };
@@ -8463,13 +8564,18 @@ async function editWantLocked(d, user, taskId, input) {
   const { limits } = planned;
   if (config.source === "ebay" && limits.currency && limits.currency !== "USD")
     return { ok: false, error: EBAY_USD };
+  const searchedBy = config.source === "shopify" || config.source === "ebay" ? config.target : null;
+  const excluded = input.exclude === undefined ? { ok: true, exclude: config.exclude ?? [] } : excludePlan(input.exclude, searchedBy);
+  if (!excluded.ok)
+    return excluded;
   const nextConfig = {
     source: config.source,
     target: config.target,
     ...config.search !== undefined ? { search: config.search } : {},
     ...config.game !== undefined ? { game: config.game } : {},
     ...limits.maxPrice !== undefined ? { maxPrice: limits.maxPrice } : {},
-    ...limits.currency ? { currency: limits.currency } : {}
+    ...limits.currency ? { currency: limits.currency } : {},
+    ...excluded.exclude.length > 0 ? { exclude: excluded.exclude } : {}
   };
   const patch = {};
   if (limits.name !== task.title)
@@ -9465,6 +9571,19 @@ var MIGRATIONS = [
     ended_at TEXT
   );
   CREATE UNIQUE INDEX intake_conversations_open ON intake_conversations (user_id) WHERE status = 'open';
+  `,
+  `
+  CREATE TABLE api_idempotency (
+    user_id TEXT NOT NULL,
+    key TEXT NOT NULL,
+    request_hash TEXT NOT NULL,
+    claim TEXT NOT NULL,
+    status INTEGER,
+    answer TEXT,
+    created_at TEXT NOT NULL,
+    PRIMARY KEY (user_id, key)
+  );
+  CREATE INDEX api_idempotency_created ON api_idempotency (created_at);
   `
 ];
 var BUSY_TIMEOUT_MS = 5000;
@@ -10102,6 +10221,7 @@ function scoutSchedule(every, zone, now) {
   const start = `${w.year}-${String(w.month).padStart(2, "0")}-${String(w.day).padStart(2, "0")}`;
   return { kind: "calendar", every, unit: "day", start };
 }
+var SCOUT_CAP = `You already have ${MAX_LIVE_SCOUTS} scouts, the most one person may. Delete or change one instead.`;
 async function liveScouts(d, user) {
   const active = await d.store.listTasks({ ownerId: user.id, status: "active", type: "scout" });
   const paused = await d.store.listTasks({ ownerId: user.id, status: "paused", type: "scout" });
@@ -10118,7 +10238,7 @@ async function createScout(d, user, input) {
   if (capped)
     return { ok: false, error: capped };
   if (await liveScouts(d, user) >= MAX_LIVE_SCOUTS) {
-    return { ok: false, error: `You already have ${MAX_LIVE_SCOUTS} scouts, the most one person may. Delete or change one instead.` };
+    return { ok: false, error: SCOUT_CAP };
   }
   const now = d.clock.now();
   const actor = { userId: user.id, admin: user.admin };
@@ -10734,6 +10854,7 @@ class Roster {
       del("web_sessions", "user_id = ?", userId);
       del("web_login_tokens", "user_id = ?", userId);
       del("api_tokens", "user_id = ?", userId);
+      del("api_idempotency", "user_id = ?", userId);
       del("notices", "key LIKE 'budget:person:' || ? || ':%'", userId);
       del("notices", "key LIKE 'digest:' || ? || ':%'", userId);
       del("ceiling_changes", "user_id = ?", userId);
@@ -10760,6 +10881,24 @@ function replyText(r) {
     return `chose ${String(r.payload?.choice ?? "?")}`;
   return r.kind === "opt_out" ? "opted out" : r.kind;
 }
+function owed(r) {
+  return r.retryAt !== null || r.status === "claimed" || r.status === "pending";
+}
+function deliveryView(o, rows, people, viewer, seesEveryone) {
+  const shown = seesEveryone ? rows : rows.filter((r) => r.userId === viewer.id);
+  const sends = shown.map((r) => ({ to: people.get(r.userId)?.displayName ?? r.userId, status: r.status, error: r.error ? clip2(r.error, 120) : null }));
+  if (shown.length === 0) {
+    const finished = o.status !== "queued" && o.status !== "running";
+    return { state: finished ? "nothing_to_send" : "not_run", reason: null, sends };
+  }
+  const lost = shown.find((r) => r.status === "failed" && !owed(r));
+  if (lost)
+    return { state: "failed", reason: lost.error ? clip2(lost.error, 120) : null, sends };
+  const unsure = shown.find((r) => r.status === "unconfirmed");
+  if (unsure)
+    return { state: "unconfirmed", reason: unsure.error ? clip2(unsure.error, 120) : null, sends };
+  return { state: shown.some(owed) ? "sending" : "delivered", reason: null, sends };
+}
 var OTHER_RECIPIENT_ERROR = "a recipient cannot be messaged";
 function runView(o, replies, people, viewer, now, seesEveryone) {
   const error = o.status === "failed" && o.error ? seesEveryone || !errorNamesOther(o.error, viewer.id) ? clip2(o.error, 120) : OTHER_RECIPIENT_ERROR : null;
@@ -10834,8 +10973,11 @@ async function loadHistory(d, user, taskId) {
   const tail = await d.store.changesTail(task.id, seesEveryone ? null : user.id, HISTORY_CHANGES);
   const lead = tail.before?.kind === "paused" ? [tail.before] : [];
   const changes = seesEveryone ? tail.rows : changesForRecipient([...lead, ...tail.rows], user.id).slice(lead.length);
+  const deliveries = new Map;
+  for (const o of runs.rows)
+    deliveries.set(o.id, await d.store.listDeliveries({ occurrenceId: o.id }));
   const people = new Map;
-  for (const r of replies) {
+  for (const r of [...replies, ...[...deliveries.values()].flat()]) {
     if (!people.has(r.userId)) {
       const u = await d.store.getUser(r.userId);
       if (u)
@@ -10858,7 +11000,7 @@ async function loadHistory(d, user, taskId) {
     task,
     cadence: task.schedule && owner ? describeSchedule(task.schedule, owner, user.timeZone, now) : "no schedule",
     next: next ? formatInstant(next.dueAt, user.timeZone, now) : null,
-    runs: runs.rows.map((o) => runView(o, replies, people, user, now, seesEveryone)),
+    runs: runs.rows.map((o) => ({ ...runView(o, replies, people, user, now, seesEveryone), delivery: deliveryView(o, deliveries.get(o.id) ?? [], people, user, seesEveryone) })),
     earlierRuns: Math.max(0, runs.total - HISTORY_RUNS),
     changes: changes.map((e) => changeView(e, user, now, names)),
     earlierChanges: Math.max(0, tail.total - HISTORY_CHANGES),
@@ -11230,12 +11372,13 @@ function createSurface(w) {
     },
     {
       name: "want",
-      build: (b) => b.setDescription("Watch for something you want: I DM you new listings until you have it").addStringOption((o) => o.setName("name").setDescription("What you want, e.g. Wingspan Oceania expansion").setRequired(true).setMaxLength(MAX_TITLE)).addStringOption((o) => o.setName("source").setDescription("Where to look").setRequired(true).addChoices({ name: "a listing page you paste", value: "page" }, { name: "BoardGameGeek's marketplace", value: "bgg" }, { name: "eBay (through eBay's own API when set up, else from listings you send in)", value: "ebay" }, { name: "Shopify stores (new copies in stock, at most once a day)", value: "shopify" })).addStringOption((o) => o.setName("target").setDescription("The page's address, or the BGG game's address or id; for eBay or Shopify, the words to search").setMaxLength(MAX_URL)).addNumberOption((o) => o.setName("max").setDescription("Only listings at or under this price").setMinValue(0.01)).addStringOption((o) => o.setName("currency").setDescription("Only listings in this currency, e.g. USD").setMinLength(CURRENCY_LENGTH).setMaxLength(CURRENCY_LENGTH)).addIntegerOption((o) => o.setName("hours").setDescription(`Hours between looks (default: page ${DEFAULT_PAGE_HOURS}, BGG API ${DEFAULT_BGG_HOURS}, eBay ${DEFAULT_EBAY_HOURS}, BGG without it ${DEFAULT_INBOX_HOURS}, Shopify ${DEFAULT_SHOPIFY_HOURS})`).setMinValue(1).setMaxValue(MAX_WANT_HOURS)).addBooleanOption((o) => o.setName("judge").setDescription("Have the model check each new listing and its seller first (default: yes, when it can)")),
+      build: (b) => b.setDescription("Watch for something you want: I DM you new listings until you have it").addStringOption((o) => o.setName("name").setDescription("What you want, e.g. Wingspan Oceania expansion").setRequired(true).setMaxLength(MAX_TITLE)).addStringOption((o) => o.setName("source").setDescription("Where to look").setRequired(true).addChoices({ name: "a listing page you paste", value: "page" }, { name: "BoardGameGeek's marketplace", value: "bgg" }, { name: "eBay (through eBay's own API when set up, else from listings you send in)", value: "ebay" }, { name: "Shopify stores (new copies in stock, at most once a day)", value: "shopify" })).addStringOption((o) => o.setName("target").setDescription("The page's address, or the BGG game's address or id; for eBay or Shopify, the words to search").setMaxLength(MAX_URL)).addNumberOption((o) => o.setName("max").setDescription("Only listings at or under this price").setMinValue(0.01)).addStringOption((o) => o.setName("currency").setDescription("Only listings in this currency, e.g. USD").setMinLength(CURRENCY_LENGTH).setMaxLength(CURRENCY_LENGTH)).addStringOption((o) => o.setName("exclude").setDescription("Leave out listings whose title has any of these words, separated by commas").setMaxLength(MAX_EXCLUDE_TEXT)).addIntegerOption((o) => o.setName("hours").setDescription(`Hours between looks (default: page ${DEFAULT_PAGE_HOURS}, BGG API ${DEFAULT_BGG_HOURS}, eBay ${DEFAULT_EBAY_HOURS}, BGG without it ${DEFAULT_INBOX_HOURS}, Shopify ${DEFAULT_SHOPIFY_HOURS})`).setMinValue(1).setMaxValue(MAX_WANT_HOURS)).addBooleanOption((o) => o.setName("judge").setDescription("Have the model check each new listing and its seller first (default: yes, when it can)")),
       handle: (interaction) => run(interaction, "registered", (d, user) => {
         const target = interaction.options.getString("target");
         const judge = interaction.options.getBoolean("judge");
         const max = interaction.options.getNumber("max");
         const currency = interaction.options.getString("currency");
+        const exclude = interaction.options.getString("exclude");
         const hours = interaction.options.getInteger("hours");
         return wantCommand(d, user, {
           name: interaction.options.getString("name", true),
@@ -11243,6 +11386,7 @@ function createSurface(w) {
           ...target !== null ? { target } : {},
           ...max !== null ? { max } : {},
           ...currency !== null ? { currency } : {},
+          ...exclude !== null ? { exclude } : {},
           ...hours !== null ? { hours } : {},
           ...judge !== null ? { judge } : {}
         });
@@ -11395,6 +11539,52 @@ async function loadUsage(store, now, days = USAGE_DAYS) {
   return usageReport(rows, now, days);
 }
 
+// plugins/tracker/src/run-now.ts
+var RUNNABLE = new Set(["reminder", "price", "wantlist", "wantjudge", "scout"]);
+var RUN_NOW_PER_DAY = 10;
+var DAY_MS4 = 24 * 3600000;
+var NOT_NOW = "That task cannot run now:";
+function runNow(d, user, taskId) {
+  return d.locks.turn(taskId.trim(), () => runNowLocked(d, user, taskId), () => ({ ok: false, error: TASK_BUSY }));
+}
+async function runNowLocked(d, user, taskId) {
+  const task = await ownLiveTask(d, user, taskId);
+  if (!task)
+    return { ok: false, error: NO_SUCH_TASK };
+  if (task.status !== "active")
+    return { ok: false, error: `That task is ${task.status}, not active.` };
+  if (task.type === "renewal")
+    return { ok: false, error: `${NOT_NOW} a renewal asks about its own date, at its own time.` };
+  if (task.type === "research")
+    return { ok: false, error: `${NOT_NOW} a research request runs once.` };
+  if (!RUNNABLE.has(task.type))
+    return { ok: false, error: `${NOT_NOW} a ${task.type} runs only on its own schedule.` };
+  if (!task.schedule || task.schedule.kind === "once") {
+    return { ok: false, error: `${NOT_NOW} a one-off runs once, at its own time; change its time instead.` };
+  }
+  const now = d.clock.now();
+  const queued = await d.store.listOccurrences({ taskId: task.id, status: "queued" });
+  if (queued.some((o) => !hasFired(o) && Date.parse(o.dueAt) <= now.getTime())) {
+    return { ok: false, error: `${NOT_NOW} it already has a run due, which is on its way.` };
+  }
+  if (queued.some((o) => !hasFired(o) && o.dedupeKey.startsWith(FOLLOW_UP_PREFIX))) {
+    return { ok: false, error: `${NOT_NOW} it is waiting to try its last look again.` };
+  }
+  const since = new Date(now.getTime() - DAY_MS4).toISOString();
+  if (await d.store.runsNowSince(user.id, since) >= RUN_NOW_PER_DAY) {
+    return { ok: false, error: `You already ran ${RUN_NOW_PER_DAY} tasks now in the last 24 hours; each runs on its own schedule meanwhile.` };
+  }
+  const at = now.toISOString();
+  const made = await d.store.createOccurrence({ taskId: task.id, lane: task.lane, dueAt: at, dedupeKey: runNowKey(task.id, crypto.randomUUID()), at });
+  if (!made)
+    return { ok: false, error: TASK_BUSY };
+  d.log.info(`run now: ${task.id} for ${user.id} (${made.id})`);
+  return { ok: true, text: `Running \`${task.id}\` now: ${when2(task)}, and its schedule stays as it was.` };
+}
+function when2(task) {
+  return task.lane === "execute" ? "it goes to the model runner on its next turn (a daily ceiling met holds it until midnight Eastern)" : "it goes within a minute";
+}
+
 // node_modules/@rackbops/styles/rackbops-noir/bundle.css
 var bundle_default = `:where([data-rb-style], [data-rb-style] *), :where([data-rb-style], [data-rb-style] *):before, :where([data-rb-style], [data-rb-style] *):after {
   box-sizing: border-box;
@@ -12739,7 +12929,7 @@ function loginPage(base, input) {
 </section>`
   });
 }
-function when2(entry, viewer, now) {
+function when3(entry, viewer, now) {
   return entry.next ? formatInstant(entry.next.dueAt, viewer.timeZone, now) : "nothing due";
 }
 function cadence(entry, viewer, now) {
@@ -12762,7 +12952,7 @@ function tasksPage(v, data, now, flash = null, research = false) {
   const rows = data.entries.map((e) => html`<tr>
 <td><a class="rb-link" href="${v.base}/tasks/${e.task.id}">${e.task.title}</a></td>
 <td>${e.from ? name3(e.from) : "you"}</td>
-<td>${when2(e, v.user, now)}</td>
+<td>${when3(e, v.user, now)}</td>
 <td>${cadence(e, v.user, now)}</td>
 </tr>`);
   const active = data.entries.length === 0 ? html`<p class="rb-muted">You have no active tasks.</p>` : html`<div class="rb-table-scroll"><table class="rb-table">
@@ -12921,6 +13111,7 @@ var JUDGE_OPTIONS = [["yes", "yes: the model checks each new listing and its sel
 var wantLimits = (mode, surface) => [
   { name: "max", label: "Top price", kind: "text", decimal: true, help: "Only listings at or under it, and so only listings that show a price. Leave it empty for any price." },
   { name: "currency", label: "Currency", kind: "text", maxlength: CURRENCY_LENGTH, help: "Only listings in it, such as USD. Leave it empty for any." },
+  { name: "exclude", label: "Leave out titles with", kind: "text", maxlength: MAX_EXCLUDE_TEXT, help: "Words or phrases, separated by commas: a listing whose title has any of them is left out, such as investigator for a campaign box. At most 20. Leave it empty to leave nothing out." },
   { name: "hours", label: "Hours between looks", kind: "number", min: 1, max: MAX_WANT_HOURS, help: `1 to ${MAX_WANT_HOURS}, and at least ${MIN_SHOPIFY_HOURS} for Shopify, since each Shopify look is a paid Firecrawl search. ${empty(mode, `When empty, ${DEFAULT_PAGE_HOURS} for a page, ${DEFAULT_BGG_HOURS} for BGG, ${DEFAULT_EBAY_HOURS} for eBay, ${DEFAULT_INBOX_HOURS} for BGG when this bot has no BGG access, whose listings are sent in, and ${DEFAULT_SHOPIFY_HOURS} for Shopify.`, surface)}` }
 ];
 function fieldsFor(type, mode, surface = "web") {
@@ -13168,6 +13359,7 @@ function scoutEdit(form) {
 }
 function wantInput(form) {
   const target = opt(form, "target");
+  const exclude = opt(form, "exclude");
   const max = decimal(form, "max");
   const currency = opt(form, "currency");
   const hours = int(form, "hours");
@@ -13179,6 +13371,7 @@ function wantInput(form) {
     ...target !== undefined ? { target } : {},
     ...max !== undefined ? { max } : {},
     ...currency !== undefined ? { currency } : {},
+    ...exclude !== undefined ? { exclude } : {},
     ...hours !== undefined ? { hours } : {}
   };
 }
@@ -13189,6 +13382,7 @@ function wantEdit(form) {
     ...name !== undefined ? { name } : {},
     ...form.has("max") ? { max: decimal(form, "max") ?? null } : {},
     ...form.has("currency") ? { currency: str3(form, "currency") } : {},
+    ...form.has("exclude") ? { exclude: str3(form, "exclude") } : {},
     ...hours !== undefined ? { hours } : {}
   };
 }
@@ -13282,7 +13476,8 @@ function editValues(d, user, task) {
   if (task.type === "wantlist" || task.type === "wantjudge") {
     const c = task.config;
     const every = task.schedule?.kind === "poll" ? task.schedule.every : "";
-    return { name: task.title, max: c.maxPrice !== undefined ? String(c.maxPrice) : "", currency: c.currency ?? "", hours: String(every) };
+    const exclude = Array.isArray(c.exclude) ? c.exclude.filter((e) => typeof e === "string").join(", ") : "";
+    return { name: task.title, max: c.maxPrice !== undefined ? String(c.maxPrice) : "", currency: c.currency ?? "", exclude, hours: String(every) };
   }
   if (task.type !== "price")
     return {};
@@ -13291,6 +13486,31 @@ function editValues(d, user, task) {
   return { name: task.title, hours: String(every), drop: String(c.dropPercent ?? 10), baseline: c.baseline ?? "last" };
 }
 
+// plugins/tracker/src/web/task-version.ts
+function taskVersion(task) {
+  const owned = { title: task.title, config: task.config, schedule: task.schedule, status: task.status, capabilities: task.capabilities };
+  return sha256(canonicalJson(owned)).slice(0, 16);
+}
+function canonicalJson(value) {
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value !== null && typeof value === "object") {
+    const o = value;
+    return `{${Object.keys(o).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(o[k])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function etag(version) {
+  return `"${version}"`;
+}
+function ifMatchVersion(header) {
+  if (header === null)
+    return null;
+  const m = /^\s*"([0-9a-f]{16})"\s*$/.exec(header);
+  return m?.[1] ?? null;
+}
+var VERSION_MISMATCH = "That task has changed since you read it. Read it again (GET the task) and send its new version in If-Match.";
+
 // plugins/tracker/src/web/editor.ts
 var READING = "I am still reading a page for your last new price tracker or want-list watch; try again when it is done.";
 var GONE = NO_LONGER_LISTED;
@@ -13298,7 +13518,14 @@ var writer = (e) => ({ d: e.d, queue: e.queue, reading: e.reading, userId: e.v.u
 function asUser(w, fn) {
   return w.queue(async () => {
     const user = await w.d.store.getUser(w.userId);
-    return user ? fn(user) : { ok: false, error: GONE };
+    if (!user)
+      return { ok: false, error: GONE };
+    if (w.ifMatch) {
+      const task = await w.d.store.getTask(w.ifMatch.taskId);
+      if (!task || taskVersion(task) !== w.ifMatch.version)
+        return { ok: false, error: VERSION_MISMATCH };
+    }
+    return fn(user);
   });
 }
 var WEB_READ_MS = 8000;
@@ -13391,6 +13618,9 @@ function saveEdit(w, task, form) {
     return asUser(w, (u) => editWant(w.d, u, task.id, wantEdit(form)));
   return asUser(w, (u) => editPrice(w.d, u, task.id, priceEdit(form)));
 }
+function runOn(w, taskId) {
+  return asUser(w, (u) => runNow(w.d, u, taskId));
+}
 function actOn(w, taskId, action) {
   const act = action === "pause" ? pauseTask : action === "resume" ? resumeTask : deleteTask;
   return asUser(w, (u) => act(w.d, u, taskId));
@@ -13555,12 +13785,16 @@ function refusal(error) {
     return problem(503, "slow_page", error, { "Retry-After": "10" });
   if (error === NOT_EDITABLE)
     return problem(409, "conflict", error);
+  if (error === VERSION_MISMATCH)
+    return problem(412, "version_mismatch", error);
   if (error === RESEARCH_OFF || error === SCOUT_OFF)
     return problem(503, "unavailable", error);
   if (error === FINISHED || /^That task is [a-z]+, not [a-z]+\.$/.test(error))
     return problem(409, "conflict", error);
-  if (/^You already (have|track|watch for) [0-9]+ /.test(error))
+  if (/^You already (have|track|watch for|ran) [0-9]+ /.test(error))
     return problem(409, "limit_reached", error);
+  if (error.startsWith(NOT_NOW))
+    return problem(409, "cannot_run_now", error);
   if (error === INBOX_OFF || error === JUDGE_OFF)
     return problem(503, "unavailable", error);
   if (/ (is|are) not available on this bot\.$/.test(error))
@@ -13603,6 +13837,7 @@ async function taskJson(d, user, task) {
     type: task.type,
     title: task.title,
     status: task.status === "archived" ? "deleted" : task.status,
+    version: taskVersion(task),
     cadence: task.schedule ? describeSchedule(task.schedule, user, user.timeZone, d.clock.now()) : "no schedule",
     nextAt: await nextAt(d, task),
     createdAt: task.createdAt,
@@ -13621,12 +13856,74 @@ function watchJson(c) {
     ...site ? { site, ...c.search !== undefined ? { search: c.search } : {}, ...c.game !== undefined ? { game: c.game } : {} } : {}
   };
 }
-async function listAnswer(d, user) {
-  const tasks = (await d.store.listTasks({ ownerId: user.id })).filter((t) => t.status !== "archived");
+var MAX_PAGE = 200;
+var cursorOf = (taskId) => Buffer.from(taskId).toString("base64url");
+var CURSOR = /^[A-Za-z0-9_-]{1,64}$/;
+async function listAnswer(d, user, query = new URLSearchParams) {
+  const rawLimit = query.get("limit");
+  const rawCursor = query.get("cursor");
+  for (const key of ["limit", "cursor"]) {
+    if (query.getAll(key).length > 1)
+      return problem(400, "invalid", `\`${key}\` is given more than once.`);
+  }
+  let limit = null;
+  if (rawLimit !== null) {
+    limit = /^[0-9]{1,4}$/.test(rawLimit) ? Number(rawLimit) : 0;
+    if (limit < 1 || limit > MAX_PAGE)
+      return problem(400, "invalid", `\`limit\` is a whole number from 1 to ${MAX_PAGE}.`);
+  }
+  if (rawCursor !== null && limit === null)
+    return problem(400, "invalid", "`cursor` goes with `limit`.");
+  const all = await d.store.listTasks({ ownerId: user.id });
+  let start = 0;
+  if (rawCursor !== null) {
+    const at = CURSOR.test(rawCursor) ? all.findIndex((t) => cursorOf(t.id) === rawCursor) : -1;
+    if (at < 0)
+      return problem(400, "invalid_cursor", "That cursor is not one this API gave you: start again without it.");
+    start = at + 1;
+  }
   const out = [];
-  for (const t of tasks)
+  let last = null;
+  let more = false;
+  for (let i = start;i < all.length; i++) {
+    const t = all[i];
+    if (t.status === "archived")
+      continue;
+    if (limit !== null && out.length === limit) {
+      more = true;
+      break;
+    }
     out.push(await taskJson(d, user, t));
-  return { status: 200, body: { tasks: out } };
+    last = t;
+  }
+  return { status: 200, body: { tasks: out, ...limit !== null ? { nextCursor: more && last ? cursorOf(last.id) : null } : {} } };
+}
+function capabilitiesAnswer(d, user, rate) {
+  return {
+    status: 200,
+    body: {
+      types: intakeTypes(d),
+      owner: { timeZone: user.timeZone, preferredHour: user.preferredHour },
+      limits: {
+        liveTasks: MAX_LIVE_TASKS,
+        priceTrackers: MAX_PRICE_TASKS,
+        researchWaiting: MAX_LIVE_RESEARCH,
+        scouts: MAX_LIVE_SCOUTS,
+        wantWatches: MAX_WANT_TASKS,
+        pageSize: MAX_PAGE,
+        requestsBurst: rate.burst,
+        requestsPerSecond: rate.perSecond
+      },
+      sources: {
+        runner: d.research === true,
+        bgg: d.bgg === true,
+        ebay: d.ebay === true,
+        shopify: d.shopify === true,
+        mail: d.mail != null,
+        webArea: d.webEditor
+      }
+    }
+  };
 }
 async function getAnswer(d, user, id) {
   const task = await ownTask(d, user, id);
@@ -13637,6 +13934,7 @@ async function getAnswer(d, user, id) {
     return notFound();
   return {
     status: 200,
+    headers: { ETag: etag(taskVersion(view.task)) },
     body: {
       task: await taskJson(d, user, view.task),
       history: { next: view.next, runs: view.runs, earlierRuns: view.earlierRuns, changes: view.changes, earlierChanges: view.earlierChanges },
@@ -13648,10 +13946,11 @@ async function written(w, user, result, status, base) {
   if (!result.ok)
     return refusal(result.error);
   const task = await w.d.store.getTask(result.task.id) ?? result.task;
+  const tag = { ETag: etag(taskVersion(task)) };
   return {
     status,
     body: { task: await taskJson(w.d, user, task), message: result.text },
-    ...status === 201 ? { headers: { Location: `${base}/tasks/${encodeURIComponent(task.id)}` } } : {}
+    headers: status === 201 ? { ...tag, Location: `${base}/tasks/${encodeURIComponent(task.id)}` } : tag
   };
 }
 async function createAnswer(w, user, body, base) {
@@ -13668,6 +13967,9 @@ async function createAnswer(w, user, body, base) {
     return form;
   return written(w, user, await makeTask(w, type, form), 201, base);
 }
+function bound(w, task) {
+  return w.ifMatch ? { ...w, ifMatch: { taskId: task.id, version: w.ifMatch.version } } : w;
+}
 async function editAnswer(w, user, id, body, base) {
   const task = await editableTask(w.d, user, id);
   if (!task)
@@ -13675,17 +13977,27 @@ async function editAnswer(w, user, id, body, base) {
   const form = asFields(body, task.type, "edit");
   if (!(form instanceof URLSearchParams))
     return form;
-  return written(w, user, await saveEdit(w, task, form), 200, base);
+  return written(w, user, await saveEdit(bound(w, task), task, form), 200, base);
+}
+async function runNowAnswer(w, user, id) {
+  const task = await ownTask(w.d, user, id);
+  if (!task || task.status === "archived")
+    return notFound();
+  const done = await runOn(w, task.id);
+  if (!done.ok)
+    return refusal(done.error);
+  const after = await w.d.store.getTask(task.id) ?? task;
+  return { status: 202, headers: { ETag: etag(taskVersion(after)) }, body: { task: await taskJson(w.d, user, after), message: done.text } };
 }
 async function actAnswer(w, user, id, action) {
   const task = await ownTask(w.d, user, id);
   if (!task || task.status === "archived")
     return notFound();
-  const done = await actOn(w, task.id, action);
+  const done = await actOn(bound(w, task), task.id, action);
   if (!done.ok)
     return refusal(done.error);
   const after = await w.d.store.getTask(task.id) ?? task;
-  return { status: 200, body: { task: await taskJson(w.d, user, after), message: done.text } };
+  return { status: 200, headers: { ETag: etag(taskVersion(after)) }, body: { task: await taskJson(w.d, user, after), message: done.text } };
 }
 
 // plugins/tracker/src/intake.ts
@@ -14170,7 +14482,7 @@ var MAX_TOKENS_PER_PERSON = 10;
 var MAX_TOKEN_NAME = 50;
 var TOKEN_EXPIRY_DAYS = [30, 90, 365];
 var DEFAULT_EXPIRY_DAYS = 90;
-var DAY_MS4 = 24 * 60 * 60 * 1000;
+var DAY_MS5 = 24 * 60 * 60 * 1000;
 var TOUCH_EVERY_MS = 60 * 1000;
 function isApiTokenShape(value) {
   return /^trk_[A-Za-z0-9_-]{43}$/.test(value);
@@ -14222,7 +14534,7 @@ class ApiTokens {
         return { ok: false, error: `You already have ${MAX_TOKENS_PER_PERSON} API tokens, the most one person may. Revoke one first.` };
       }
       const token = `${TOKEN_PREFIX}${randomToken()}`;
-      const expiresAt = new Date(now.getTime() + input.days * DAY_MS4).toISOString();
+      const expiresAt = new Date(now.getTime() + input.days * DAY_MS5).toISOString();
       const r = this.db.query(`INSERT INTO api_tokens (token_hash, user_id, name, created_at, expires_at, last_used_at, member_checked_at)
            VALUES (?, ?, ?, ?, ?, NULL, ?) RETURNING ${COLUMNS}`).get(sha256(token), userId, name, at, expiresAt, memberCheckedAt);
       return { ok: true, token, row: toToken(r) };
@@ -14798,7 +15110,7 @@ function startUsrRun(a, usr, me, kind) {
   const current = usrLinkRuns.get(usr);
   if (current?.running)
     return { ok: false, text: `Already ${RUN_WORDS[current.kind].doing}: ${current.done} of ${current.total} done.` };
-  const waiting = a.d.roster.people().filter((p) => p.discordId !== null && wanted(kind, usr.links.subjectOf(p.id)));
+  const waiting = a.d.roster.people().filter((p) => p.discordId !== null && wanted2(kind, usr.links.subjectOf(p.id)));
   if (waiting.length === 0)
     return { ok: true, text: RUN_WORDS[kind].none };
   const run = { kind, running: true, done: 0, total: waiting.length, result: null };
@@ -14816,7 +15128,7 @@ function startUsrRun(a, usr, me, kind) {
 function personsOwn400(err) {
   return err.status === 400 && /^(discord_user_id|display_name)\b/.test(err.reason);
 }
-function wanted(kind, subject) {
+function wanted2(kind, subject) {
   return kind === "link" ? subject === null : subject !== null;
 }
 async function usrRun(a, usr, invoker, by, guildId, ids, run) {
@@ -14841,7 +15153,7 @@ async function usrRun(a, usr, invoker, by, guildId, ids, run) {
   const notAdmin = () => end(false, `${words.stopped}: ${by}, who started it, is no longer an admin here. ${soFar()}.`);
   const stillWaiting = (id) => fresh(a, true, async () => {
     const p = await a.d.store.getUser(id);
-    return p && p.discordId !== null && wanted(run.kind, usr.links.subjectOf(id)) ? p : "skip";
+    return p && p.discordId !== null && wanted2(run.kind, usr.links.subjectOf(id)) ? p : "skip";
   });
   for (const id of ids) {
     const first = await stillWaiting(id);
@@ -14929,6 +15241,46 @@ async function forgetRoute(a, method, form) {
   return redirect(`${base}/signin?forgotten=1`, [a.signOutCookie]);
 }
 
+// plugins/tracker/src/web/api-delegation.ts
+var DELEGATES_ENV = "TRACKER_API_DELEGATES";
+var DELEGATES_FORMAT = "^[0-9]+(,[0-9]+)*$";
+function parseDelegates(env, usrOn) {
+  const raw = env[DELEGATES_ENV]?.trim();
+  if (raw === undefined || raw === "")
+    return new Set;
+  if (!usrOn)
+    throw new Error(`${DELEGATES_ENV} needs TRACKER_USR_URL: delegation tokens come from usr`);
+  if (!new RegExp(DELEGATES_FORMAT).test(raw))
+    throw new Error(`${DELEGATES_ENV} is usr API key ids separated by commas, such as 12,31`);
+  return new Set(raw.split(",").map((id) => `key:${Number(id)}`));
+}
+function operationOf(r, method) {
+  switch (r.kind) {
+    case "me":
+      return method === "GET" ? "whoami" : null;
+    case "types":
+      return method === "GET" ? "list_task_types" : null;
+    case "capabilities":
+      return method === "GET" ? "get_capabilities" : null;
+    case "validate":
+      return method === "POST" ? "validate_task" : null;
+    case "tasks":
+      return method === "GET" ? "list_tasks" : method === "POST" ? "create_task" : null;
+    case "task":
+      return method === "GET" ? "get_task" : method === "PATCH" ? "update_task" : method === "DELETE" ? "delete_task" : null;
+    case "act":
+      return method === "POST" ? r.action === "pause" ? "pause_task" : "resume_task" : null;
+    case "run":
+      return method === "POST" ? "run_task" : null;
+    case "listings":
+      return method === "POST" ? "send_listings" : null;
+    case "sources":
+      return method === "POST" ? "send_sources" : null;
+    case "ready":
+      return method === "POST" ? "sources_ready" : null;
+  }
+}
+
 // plugins/tracker/src/web/api-listings.ts
 var EBAY_DOMAINS = [
   "ebay.com",
@@ -15138,6 +15490,148 @@ async function fullerPass(w, user, task, owner, followUp, held, now) {
   };
 }
 
+// plugins/tracker/src/web/api-idempotency.ts
+import { randomBytes as randomBytes3 } from "crypto";
+var KEEP_MS = 24 * 60 * 60 * 1000;
+var PENDING_MS = 2 * 60 * 1000;
+function isIdempotencyKey(value) {
+  return /^[A-Za-z0-9_.:-]{8,128}$/.test(value);
+}
+var OUTCOME_UNKNOWN = "That request failed partway and may have made its change. Read your tasks before you send it again, under a new Idempotency-Key.";
+
+class ApiIdempotency {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  begin(userId, key, requestHash, now) {
+    const at = now.toISOString();
+    return this.db.transaction(() => {
+      this.db.query("DELETE FROM api_idempotency WHERE created_at <= ?").run(new Date(now.getTime() - KEEP_MS).toISOString());
+      const row = this.db.query("SELECT request_hash, status, answer, created_at FROM api_idempotency WHERE user_id = ? AND key = ?").get(userId, key);
+      if (row !== null) {
+        const stale = row.status === null && Date.parse(row.created_at) <= now.getTime() - PENDING_MS;
+        if (!stale) {
+          if (row.request_hash !== requestHash)
+            return { kind: "conflict" };
+          if (row.status === null || row.answer === null)
+            return { kind: "in_progress" };
+          const kept = JSON.parse(row.answer);
+          return { kind: "replay", answer: { status: row.status, body: kept.body, headers: kept.headers } };
+        }
+        this.db.query("DELETE FROM api_idempotency WHERE user_id = ? AND key = ?").run(userId, key);
+      }
+      const claim = randomBytes3(16).toString("hex");
+      this.db.query("INSERT INTO api_idempotency (user_id, key, request_hash, claim, status, answer, created_at) VALUES (?, ?, ?, ?, NULL, NULL, ?)").run(userId, key, requestHash, claim, at);
+      return { kind: "new", claim };
+    })();
+  }
+  finish(userId, key, claim, answer) {
+    if (answer.status >= 200 && answer.status < 300)
+      this.keep(userId, key, claim, answer);
+    else
+      this.abandon(userId, key, claim);
+  }
+  fail(userId, key, claim) {
+    this.keep(userId, key, claim, { status: 500, body: { error: { code: "outcome_unknown", message: OUTCOME_UNKNOWN } }, headers: {} });
+  }
+  abandon(userId, key, claim) {
+    this.db.query("DELETE FROM api_idempotency WHERE user_id = ? AND key = ? AND claim = ? AND status IS NULL").run(userId, key, claim);
+  }
+  keep(userId, key, claim, answer) {
+    this.db.query("UPDATE api_idempotency SET status = ?, answer = ? WHERE user_id = ? AND key = ? AND claim = ? AND status IS NULL").run(answer.status, JSON.stringify({ body: answer.body, headers: answer.headers }), userId, key, claim);
+  }
+}
+
+// plugins/tracker/src/web/api-validate.ts
+function firstDueAfter2(schedule, now) {
+  if (schedule.kind === "once")
+    return new Date(0);
+  if (schedule.kind === "poll")
+    return new Date(Date.parse(schedule.start) - 1);
+  return now;
+}
+function runs(schedule, user, now, renewal) {
+  const ctx = { zone: user.timeZone, preferredHour: user.preferredHour };
+  if (renewal) {
+    const ask = nextDue(schedule, new Date(0), ctx);
+    if (ask && ask.getTime() <= now.getTime())
+      return { first: ask, second: nextDue(schedule, now, ctx) };
+  }
+  const first = nextDue(schedule, firstDueAfter2(schedule, now), ctx);
+  return { first, second: first && schedule.kind !== "once" ? nextDue(schedule, first, ctx) : null };
+}
+async function validateAnswer(d, user, body) {
+  const type = body.type;
+  if (typeof type !== "string" || !NEW_TYPES.includes(type)) {
+    return problem(400, "invalid", `\`type\` is one of ${offeredTypes(d).join(", ")}.`);
+  }
+  if (type === "research" && !d.research)
+    return refusal(RESEARCH_OFF);
+  if (type === "scout" && (!d.types.scout || !d.research))
+    return refusal(SCOUT_OFF);
+  if (type === "reminder" && !d.types.reminder)
+    return refusal("Reminders are not available on this bot.");
+  if (type === "renewal" && !d.types.renewal)
+    return refusal("Renewals are not available on this bot.");
+  const form = asFields(body, type, "new");
+  if (!(form instanceof URLSearchParams))
+    return form;
+  const now = d.clock.now();
+  let schedule = null;
+  if (type === "reminder") {
+    const plan = reminderPlan(d, user, reminderInput(form));
+    if (!plan.ok)
+      return refusal(plan.error);
+    schedule = plan.schedule;
+  } else if (type === "renewal") {
+    const plan = renewalPlan(d, user, renewalInput(form));
+    if (!plan.ok)
+      return refusal(plan.error);
+    schedule = plan.schedule;
+  } else if (type === "scout") {
+    const plan = scoutPlan(scoutInput(form));
+    if (!plan.ok)
+      return refusal(plan.error);
+    schedule = scoutSchedule(plan.every, user.timeZone, now);
+  }
+  const capped = await liveTaskCap(d, user);
+  if (capped)
+    return refusal(capped);
+  if (type === "scout" && await liveScouts(d, user) >= MAX_LIVE_SCOUTS) {
+    return refusal(SCOUT_CAP);
+  }
+  if (schedule === null) {
+    return {
+      status: 200,
+      body: {
+        valid: true,
+        type,
+        checked: "fields",
+        message: `The fields of that ${type} are right, and you are under the live-task cap. The rest is checked when it is made: ${type === "research" ? "the model runner takes it then" : "its page or source is read then"}. Nothing was made.`
+      }
+    };
+  }
+  const problems = scheduleProblems(schedule);
+  if (problems.length > 0)
+    return refusal(`That schedule does not work: ${problems.join("; ")}.`);
+  const { first, second: then } = runs(schedule, user, now, type === "renewal");
+  const cadence = describeSchedule(schedule, user, user.timeZone, now);
+  return {
+    status: 200,
+    body: {
+      valid: true,
+      type,
+      checked: "full",
+      timeZone: user.timeZone,
+      cadence,
+      firstAt: first?.toISOString() ?? null,
+      thenAt: then?.toISOString() ?? null,
+      message: first ? `That ${type} would first run ${first.getTime() <= now.getTime() ? "at once" : formatInstant(first.toISOString(), user.timeZone, now)}${then ? `, then ${formatInstant(then.toISOString(), user.timeZone, now)}` : ""} (${cadence}). Nothing was made.` : `That ${type} would never run: its time has no next run. Nothing was made.`
+    }
+  };
+}
+
 // plugins/tracker/src/web/api.ts
 var API_PREFIX = "/api/v1";
 var MAX_API_BYTES = 16 * 1024;
@@ -15193,6 +15687,7 @@ function bearer(header) {
   return m?.[1] ?? null;
 }
 var ACT = /^\/tasks\/([^/]+)\/(pause|resume)$/;
+var RUN = /^\/tasks\/([^/]+)\/run$/;
 var LISTINGS = /^\/tasks\/([^/]+)\/listings$/;
 var SOURCES = /^\/tasks\/([^/]+)\/sources(\/ready)?$/;
 var ONE = /^\/tasks\/([^/]+)$/;
@@ -15208,11 +15703,18 @@ function route(rest) {
     return { kind: "me" };
   if (rest === "/types")
     return { kind: "types" };
+  if (rest === "/capabilities")
+    return { kind: "capabilities" };
   if (rest === "/tasks")
     return { kind: "tasks" };
+  if (rest === "/tasks/validate")
+    return { kind: "validate" };
   const act = ACT.exec(rest);
   if (act)
     return { kind: "act", id: segment(act[1]), action: act[2] };
+  const run = RUN.exec(rest);
+  if (run)
+    return { kind: "run", id: segment(run[1]) };
   const listings = LISTINGS.exec(rest);
   if (listings)
     return { kind: "listings", id: segment(listings[1]) };
@@ -15227,7 +15729,7 @@ function allowedMethods(r) {
     return "GET, POST";
   if (r.kind === "task")
     return "GET, PATCH, DELETE";
-  if (r.kind === "act" || r.kind === "listings" || r.kind === "sources" || r.kind === "ready")
+  if (r.kind === "validate" || r.kind === "act" || r.kind === "run" || r.kind === "listings" || r.kind === "sources" || r.kind === "ready")
     return "POST";
   return "GET";
 }
@@ -15258,6 +15760,10 @@ async function authenticate(w, request) {
   const invalid = problem(401, "invalid_token", "That token is unknown, revoked or expired.", { "WWW-Authenticate": `${CHALLENGE}, error="invalid_token"` });
   const sent = bearer(header);
   const now = d.clock.now();
+  const delegates = d.usr?.delegates;
+  if (sent !== null && !sent.startsWith(TOKEN_PREFIX) && d.usr && delegates && delegates.size > 0) {
+    return authenticateDelegation(w, d.usr, delegates, sent, invalid);
+  }
   const token = sent === null ? null : d.apiTokens.find(sent, now);
   if (!token) {
     const waitFailed = w.failed.take(FAILED_KEY, now.getTime());
@@ -15282,7 +15788,61 @@ async function authenticate(w, request) {
   if (!current)
     return no(invalid);
   d.apiTokens.touch(current, d.clock.now());
-  return { ok: true, token: current, user };
+  return { ok: true, via: { kind: "token", token: current }, user };
+}
+async function authenticateDelegation(w, usr, delegates, sent, invalid) {
+  const { d } = w;
+  const no = (answer) => ({ ok: false, answer });
+  const failed = () => {
+    const wait = w.failed.take(FAILED_KEY, d.clock.now().getTime());
+    return no(wait > 0 ? problem(429, "rate_limited", `Too many requests with bad tokens; try again in ${wait} s.`, { "Retry-After": String(wait) }) : invalid);
+  };
+  const checked = await usr.verifier.verifyDelegation(sent, usr.app);
+  if (checked === "unavailable")
+    return no(problem(503, "usr_unavailable", "I could not fetch usr's signing keys to check that token; try again in a minute.", { "Retry-After": "60" }));
+  if (checked === "invalid" || !delegates.has(checked.actor))
+    return failed();
+  const wait = w.limiter.take(`dlg:${checked.sub}`, d.clock.now().getTime());
+  if (wait > 0)
+    return no(problem(429, "rate_limited", `Too many requests for this person; try again in ${wait} s.`, { "Retry-After": String(wait) }));
+  const userId = usr.links.userOfSubject(checked.sub);
+  const user = userId ? await d.store.getUser(userId) : null;
+  if (!user || !d.admissions.isRegistered(user.id))
+    return failed();
+  const found = await w.recheck(user, w.confirmedAt(user.id));
+  if (found === "not-member")
+    return no(problem(403, "not_member", "That person is no longer a member of this tracker's server, or lost the role it asks for."));
+  if (found === "unknown")
+    return no(problem(503, "membership_unknown", MEMBERSHIP_UNKNOWN2, { "Retry-After": "60" }));
+  return { ok: true, via: { kind: "delegation", delegation: checked }, user };
+}
+async function write(writer, user, r, method, body, base) {
+  if (method === "DELETE")
+    return actAnswer(writer, user, r.id, "delete");
+  if (r.kind === "tasks")
+    return createAnswer(writer, user, body, base);
+  if (r.kind === "task")
+    return editAnswer(writer, user, r.id, body, base);
+  if (r.kind === "act") {
+    if (Object.keys(body).length > 0)
+      return problem(400, "unknown_field", `\`${r.action}\` takes no fields: send {}.`);
+    return actAnswer(writer, user, r.id, r.action);
+  }
+  if (r.kind === "run") {
+    if (Object.keys(body).length > 0)
+      return problem(400, "unknown_field", "`run` takes no fields: send {}.");
+    return runNowAnswer(writer, user, r.id);
+  }
+  if (r.kind === "listings")
+    return listingsAnswer(writer, user, r.id, body);
+  if (r.kind === "sources")
+    return sourcesAnswer(writer, user, r.id, body);
+  if (r.kind === "ready") {
+    if (Object.keys(body).length > 0)
+      return problem(400, "unknown_field", "`ready` takes no fields: send {}.");
+    return sourcesReadyAnswer(writer, user, r.id);
+  }
+  return problem(405, "method_not_allowed", "Not a write.");
 }
 async function handleApi(w, request, path) {
   if (request.headers.get("origin") !== null)
@@ -15298,45 +15858,83 @@ async function handleApi(w, request, path) {
   const method = request.method;
   if (!allowed.split(", ").includes(method))
     return json2(problem(405, "method_not_allowed", `Use ${allowed}.`, { Allow: allowed }));
+  if (auth.via.kind === "delegation") {
+    const operation = operationOf(r, method);
+    if (operation === null)
+      return json2(problem(403, "insufficient_scope", "No delegation token can do this."));
+    const needed = `${w.d.usr?.app}:${operation}`;
+    if (!auth.via.delegation.scopes.has(needed)) {
+      return json2(problem(403, "insufficient_scope", `That token does not allow this: it needs ${needed}.`, { "WWW-Authenticate": `${CHALLENGE}, error="insufficient_scope", scope="${needed}"` }));
+    }
+    if (method !== "GET")
+      w.d.log.info(`api: ${operation} for ${user.id} by usr ${auth.via.delegation.actor} (token ${auth.via.delegation.jti})`);
+  }
   const writer = { d: w.d, queue: w.queue, reading: w.reading, userId: user.id, arrived: w.arrived };
   const base = `${w.base}${API_PREFIX}`;
-  if (method === "POST" || method === "PATCH") {
-    const read = await readJson(request, r.kind === "listings" ? MAX_LISTINGS_BYTES : r.kind === "sources" ? MAX_SOURCES_BYTES : MAX_API_BYTES);
+  if (r.kind === "validate") {
+    if (request.headers.get("if-match") !== null)
+      return json2(problem(400, "if_match_unsupported", "If-Match goes only with PATCH or DELETE of a task, or its pause or resume."));
+    const read = await readJson(request);
     if (!read.ok)
       return json2(read.answer);
-    const { body } = read;
-    if (r.kind === "tasks")
-      return json2(await createAnswer(writer, user, body, base));
-    if (r.kind === "task")
-      return json2(await editAnswer(writer, user, r.id, body, base));
-    if (r.kind === "act") {
-      if (Object.keys(body).length > 0)
-        return json2(problem(400, "unknown_field", `\`${r.action}\` takes no fields: send {}.`));
-      return json2(await actAnswer(writer, user, r.id, r.action));
+    return json2(await validateAnswer(w.d, user, read.body));
+  }
+  if (method === "POST" || method === "PATCH" || method === "DELETE") {
+    const ifMatchRaw = request.headers.get("if-match");
+    if (ifMatchRaw !== null) {
+      const onOneTask = r.kind === "task" && method !== "POST" || r.kind === "act";
+      if (!onOneTask)
+        return json2(problem(400, "if_match_unsupported", "If-Match goes only with PATCH or DELETE of a task, or its pause or resume."));
+      const version = ifMatchVersion(ifMatchRaw);
+      if (version === null)
+        return json2(problem(400, "invalid_if_match", 'If-Match is one task version in quotes, as its ETag gives it: "0123456789abcdef".'));
+      writer.ifMatch = { taskId: r.id.trim(), version };
     }
-    if (r.kind === "listings")
-      return json2(await listingsAnswer(writer, user, r.id, body));
-    if (r.kind === "sources")
-      return json2(await sourcesAnswer(writer, user, r.id, body));
-    if (r.kind === "ready") {
-      if (Object.keys(body).length > 0)
-        return json2(problem(400, "unknown_field", "`ready` takes no fields: send {}."));
-      return json2(await sourcesReadyAnswer(writer, user, r.id));
+    const key = request.headers.get("idempotency-key");
+    if (key !== null && !isIdempotencyKey(key))
+      return json2(problem(400, "invalid_idempotency_key", "Idempotency-Key is 8 to 128 letters, digits, '-', '_', '.' or ':'; a UUID will do."));
+    let body = {};
+    if (method !== "DELETE") {
+      const read = await readJson(request, r.kind === "listings" ? MAX_LISTINGS_BYTES : r.kind === "sources" ? MAX_SOURCES_BYTES : MAX_API_BYTES);
+      if (!read.ok)
+        return json2(read.answer);
+      body = read.body;
+    }
+    if (key === null)
+      return json2(await write(writer, user, r, method, body, base));
+    const hash = sha256(`${method} ${path}
+${writer.ifMatch?.version ?? ""}
+${canonicalJson(body)}`);
+    const begun = w.d.apiIdempotency.begin(user.id, key, hash, w.d.clock.now());
+    if (begun.kind === "conflict")
+      return json2(problem(409, "idempotency_conflict", "That Idempotency-Key was used for a different request; use a new key for a new request."));
+    if (begun.kind === "in_progress")
+      return json2(problem(409, "idempotency_in_progress", "A request with that Idempotency-Key is still running; try again in a moment.", { "Retry-After": "1" }));
+    if (begun.kind === "replay")
+      return json2({ status: begun.answer.status, body: begun.answer.body, headers: { ...begun.answer.headers, "Idempotency-Replayed": "true" } });
+    let answer;
+    try {
+      answer = await write(writer, user, r, method, body, base);
+    } catch (err) {
+      w.d.apiIdempotency.fail(user.id, key, begun.claim);
+      throw err;
     }
+    w.d.apiIdempotency.finish(user.id, key, begun.claim, { status: answer.status, body: answer.body, headers: answer.headers ?? {} });
+    return json2(answer);
   }
-  if (method === "DELETE" && r.kind === "task")
-    return json2(await actAnswer(writer, user, r.id, "delete"));
   if (r.kind === "types")
     return json2(typesAnswer(w.d));
   if (r.kind === "tasks")
-    return json2(await listAnswer(w.d, user));
+    return json2(await listAnswer(w.d, user, new URL(request.url).searchParams));
+  if (r.kind === "capabilities")
+    return json2(capabilitiesAnswer(w.d, user, { burst: RATE_BURST, perSecond: RATE_PER_SECOND }));
   if (r.kind === "task")
     return json2(await getAnswer(w.d, user, r.id));
   return json2({
     status: 200,
     body: {
       user: { id: user.id, name: user.displayName, timeZone: user.timeZone, preferredHour: user.preferredHour },
-      token: { id: auth.token.id, name: auth.token.name, createdAt: auth.token.createdAt, expiresAt: auth.token.expiresAt }
+      ...auth.via.kind === "token" ? { token: { id: auth.via.token.id, name: auth.via.token.name, createdAt: auth.via.token.createdAt, expiresAt: auth.via.token.expiresAt } } : { delegation: { actor: auth.via.delegation.actor, scopes: [...auth.via.delegation.scopes].sort(), expiresAt: new Date(auth.via.delegation.expiresAt).toISOString() } }
     }
   });
 }
@@ -15544,6 +16142,9 @@ var JWKS_RETRY_MS = 30 * 1000;
 var JWKS_TIMEOUT_MS = 5000;
 var MAX_TOKEN = 8192;
 var MAX_JWKS = 64 * 1024;
+var MAX_DELEGATION_MS = 30 * 60 * 1000;
+var DELEGATION_SKEW_MS = 60 * 1000;
+var JTI = /^[A-Za-z0-9_-]{1,64}$/;
 function decode(part) {
   try {
     return JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
@@ -15556,38 +16157,70 @@ class UsrVerifier {
   o;
   keys = [];
   fetchedAt = Number.NEGATIVE_INFINITY;
+  loadFailed = false;
   pending = null;
   constructor(o) {
     this.o = o;
   }
   async verify(token) {
-    if (!token || token.length > MAX_TOKEN)
+    const signed = await this.signed(token);
+    if (typeof signed === "string" || signed.header.typ === "dlg+jwt")
+      return null;
+    const claims = signed.claims;
+    if (claims.iss !== "usr" || claims.act !== undefined)
+      return null;
+    if (typeof claims.exp !== "number" || claims.exp * 1000 <= this.o.now())
+      return null;
+    if (typeof claims.sub !== "string" || claims.sub === "")
       return null;
+    const roles = Array.isArray(claims.roles) ? claims.roles.filter((r) => typeof r === "string") : [];
+    return { sub: claims.sub, roles };
+  }
+  async verifyDelegation(token, audience) {
+    const signed = await this.signed(token);
+    if (typeof signed === "string")
+      return signed;
+    if (signed.header.typ !== "dlg+jwt")
+      return "invalid";
+    const c = signed.claims;
+    if (c.iss !== "usr" || c.aud !== audience)
+      return "invalid";
+    if (typeof c.sub !== "string" || c.sub === "" || typeof c.scope !== "string" || typeof c.jti !== "string" || !JTI.test(c.jti))
+      return "invalid";
+    const actor = c.act?.sub;
+    if (typeof actor !== "string" || !/^key:[0-9]+$/.test(actor))
+      return "invalid";
+    if (typeof c.exp !== "number")
+      return "invalid";
+    const expiresAt = c.exp * 1000;
+    const now = this.o.now();
+    if (expiresAt <= now || expiresAt - now > MAX_DELEGATION_MS + DELEGATION_SKEW_MS)
+      return "invalid";
+    return { sub: c.sub, actor, scopes: new Set(c.scope.split(" ").filter((x) => x !== "")), jti: c.jti, expiresAt };
+  }
+  async signed(token) {
+    if (!token || token.length > MAX_TOKEN)
+      return "invalid";
     const parts = token.split(".");
     if (parts.length !== 3)
-      return null;
+      return "invalid";
     const [h, p, s] = parts;
     const header = decode(h);
-    if (!header || header.alg !== "ES256" || header.typ === "dlg+jwt" || typeof header.kid !== "string")
-      return null;
+    if (!header || header.alg !== "ES256" || typeof header.kid !== "string")
+      return "invalid";
     const key = await this.keyFor(header.kid, false) ?? await this.keyFor(header.kid, true);
     if (!key)
-      return null;
+      return this.loadFailed ? "unavailable" : "invalid";
     const signature = Buffer.from(s, "base64url");
     if (signature.length !== 64)
-      return null;
+      return "invalid";
     const ok = await crypto.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, key, signature, new TextEncoder().encode(`${h}.${p}`));
     if (!ok)
-      return null;
+      return "invalid";
     const claims = decode(p);
-    if (!claims || claims.iss !== "usr" || claims.act !== undefined)
-      return null;
-    if (typeof claims.exp !== "number" || claims.exp * 1000 <= this.o.now())
-      return null;
-    if (typeof claims.sub !== "string" || claims.sub === "")
-      return null;
-    const roles = Array.isArray(claims.roles) ? claims.roles.filter((r) => typeof r === "string") : [];
-    return { sub: claims.sub, roles };
+    if (claims === null || typeof claims !== "object")
+      return "invalid";
+    return { header, claims };
   }
   async keyFor(kid, force) {
     const fresh = () => {
@@ -15614,6 +16247,7 @@ class UsrVerifier {
   }
   async load() {
     this.fetchedAt = this.o.now();
+    this.loadFailed = true;
     try {
       const res = await (this.o.fetchImpl ?? fetch)(`${this.o.url}/.well-known/jwks.json`, {
         headers: { Accept: "application/json" },
@@ -15638,6 +16272,7 @@ class UsrVerifier {
         } catch {}
       }
       this.keys = keys;
+      this.loadFailed = false;
     } catch {}
   }
 }
@@ -15731,6 +16366,7 @@ function createWebHandler(w) {
     const shared = pending;
     return lookupWithin(() => shared, MEMBER_CHECK_TIMEOUT_MS);
   }
+  const memberConfirmed = new Map;
   async function recheck(d, user, checkedAt) {
     if (w.guildIds === null)
       return "ok";
@@ -15750,12 +16386,14 @@ function createWebHandler(w) {
         failedAt.set(user.id, d.clock.now().getTime());
     }
     if (found === "not-member") {
+      memberConfirmed.delete(user.id);
       d.sessions.deleteForUser(user.id);
       d.apiTokens.deleteForUser(user.id);
       return "not-member";
     }
     if (found === "member") {
       const at = d.clock.now().toISOString();
+      memberConfirmed.set(user.id, at);
       d.sessions.confirmMember(user.id, at);
       d.apiTokens.confirmMember(user.id, at);
       return "ok";
@@ -15905,7 +16543,7 @@ function createWebHandler(w) {
       const d = w.deps();
       if (!d)
         return json2(problem(503, "starting", "The tracker is starting up; try again in a minute.", { "Retry-After": "60" }));
-      return handleApi({ d, queue: w.queue, reading, base, limiter, failed, arrived, recheck: (user, at) => recheck(d, user, at) }, request, info.path);
+      return handleApi({ d, queue: w.queue, reading, base, limiter, failed, arrived, recheck: (user, at) => recheck(d, user, at), confirmedAt: (userId) => memberConfirmed.get(userId) ?? null }, request, info.path);
     }
     const method = request.method;
     if (method !== "GET" && method !== "POST")
@@ -16052,7 +16690,7 @@ function createWebHandler(w) {
 }
 
 // plugins/tracker/src/mail.ts
-import { randomBytes as randomBytes3 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 
 // plugins/tracker/src/ebay-alert.ts
 var MAX_ALERT_LISTINGS = MAX_LISTINGS_PER_POST;
@@ -16233,7 +16871,7 @@ class MailAddresses {
     const row = this.db.query("SELECT local FROM mail_addresses WHERE user_id = ?").get(userId);
     if (row)
       return `${row.local}@${this.domain}`;
-    const local = `m-${randomBytes3(12).toString("hex")}`;
+    const local = `m-${randomBytes4(12).toString("hex")}`;
     this.db.query("INSERT INTO mail_addresses (user_id, local, created_at) VALUES (?, ?, ?)").run(userId, local, now.toISOString());
     return `${local}@${this.domain}`;
   }
@@ -16681,6 +17319,7 @@ function createPlugin(host, options = {}) {
   const webOrigin = parseWebUrl(host.env.TRACKER_WEB_URL);
   const cityHall = parseCityHallConfig(host.env);
   const usrConfig = parseUsrConfig(host.env);
+  const delegates = parseDelegates(host.env, usrConfig !== null);
   const mailConfig = parseMailConfig(host.env);
   const usrClient = usrConfig ? createUsrClient({ config: usrConfig, ...options.usrFetch ? { fetchImpl: options.usrFetch } : {} }) : null;
   const budgetUnlimited = parseBudgetUnlimited(host.env[BUDGET_UNLIMITED_KEY]);
@@ -16962,6 +17601,8 @@ function createPlugin(host, options = {}) {
           host.log.warn(`execute lane is off, so /research is unavailable: ${cityHall.missing.join(", ")} not set`);
         if (usrConfig)
           host.log.info(`usr link on: ${usrConfig.url}, app ${usrConfig.app}`);
+        if (delegates.size > 0)
+          host.log.info(`task API takes usr delegation tokens from ${[...delegates].join(", ")}`);
         const openedDeps = {
           store: openedStore,
           admissions: new Admissions(opened),
@@ -16976,6 +17617,7 @@ function createPlugin(host, options = {}) {
           logins: new LoginLinks(opened),
           sessions: new Sessions(opened),
           apiTokens: new ApiTokens(opened),
+          apiIdempotency: new ApiIdempotency(opened),
           roster: new Roster(opened),
           ceilings,
           budgetUnlimited,
@@ -16995,7 +17637,8 @@ function createPlugin(host, options = {}) {
             url: usrConfig.url,
             verifier: new UsrVerifier({ url: usrConfig.url, now: () => clock.now().getTime(), ...options.usrFetch ? { fetchImpl: options.usrFetch } : {} }),
             app: usrConfig.app,
-            links: new UsrLinks(opened)
+            links: new UsrLinks(opened),
+            delegates
           } : null
         };
         if (guildIds === null)