@rackbops/plugin-tracker 0.6.0 → 0.7.0

package/README.md

@@ -8,8 +8,9 @@ command, delivered by DM, answered by button, with history -- the first slice of
 (#80): sign-in by one-time link, my tasks, a task's history, and settings -- renewals and
 the price tracker (#81, plan E6): two more types on the notify side, no model, nothing sent to
 city-hall -- the web area's task editor (#80, slice 2): make, edit, pause, resume and delete
-your own tasks from the web, under the commands' own rules -- and the admin view and forget-me (#80,
-slice 3).
+your own tasks from the web, under the commands' own rules -- the admin view and forget-me (#80,
+slice 3) -- and the JSON task API with personal API tokens (#80, slice 4), for a program acting as
+you, such as a later intake agent (plan E10).
 
 ## Commands
 
@@ -65,12 +66,15 @@ served at a hashed path, cached for a year).
 | `/new/reminder`, `/new/renewal`, `/new/price` | The editor's new-task forms (GET), and making one (POST). |
 | `/tasks/<id>/edit` | The owner's edit form (GET) and saving it (POST). |
 | `/tasks/<id>/pause`, `/resume`, `/delete` | POST only. Delete answers a confirmation first; only a second post carrying `confirm=yes` deletes. |
-| `/settings` | Preferred hour and time zone, checked as `/register` checks them. |
+| `/settings` | Preferred hour and time zone, checked as `/register` checks them. Links to API tokens and Forget me. |
+| `/tokens` | Your API tokens (below): each one's name, when it was made, last used and expires, with Revoke; and the form to make one (POST), which sends the new token to you by Discord DM -- never on the page. |
+| `/tokens/<id>/revoke` | POST only: revokes one of your own tokens. Anyone else's answers the same 404 as an unknown id. |
 | `/forget` | Forget me (below): what it deletes (GET); a POST asks for the confirmation; a POST with `confirm=yes` and the word `forget` erases. Linked from Settings. |
 | `/admin` | Admins only: everyone on the list, the decline blocks in force (each with Lift), and a form to allow a person by Discord id. |
 | `/admin/tasks` | Admins only: every task in the store, with its owner, status and how many receive it, each linking to its page. |
 | `/admin/people/<id>` | Admins only: one person -- Discord id, registration, zone and hour, delivery, task counts, their tasks -- with Make admin or Revoke admin, Resume delivery (when paused), and Remove from the tracker. |
-| `/admin/allow`, `/admin/people/<id>/grant`, `/revoke`, `/resume-delivery`, `/forget`, `/admin/blocks/<id>/lift` | Admins only, POST only: the acts below. |
+| `/admin/allow`, `/admin/people/<id>/grant`, `/revoke`, `/resume-delivery`, `/forget`, `/admin/blocks/<id>/lift`, `/admin/tokens/<id>/revoke` | Admins only, POST only: the acts below. |
+| `/api/v1/...` | The JSON task API (below): bearer tokens only, never the cookie. |
 | `/signin` | Where a request that is not signed in is sent: says to run `/web`. |
 | `/login?t=...` | The link `/web` gives. |
 
@@ -162,6 +166,8 @@ the function the command path runs:
 - **Resume delivery** of a person paused after failed DMs: `DeliveryHealth.resume`, what the
   person's own next command does -- the count clears and the tasks nothing else holds go back on.
 - **Lift** a decline block in force: docket's `liftBlock`, recorded as that admin's lift.
+- **Revoke an API token** of anyone's, from their page, which lists their tokens (never the
+  secret). It stops working at once; the owner is not told. Logged by token id.
 - **Remove from the tracker**: forget-me for that person (below), with the same confirmation.
 
 Not here yet, though plan 5.10 lists them: grants, budgets and retry (they belong to the execute
@@ -178,7 +184,8 @@ in one SQLite transaction in the write queue, **deleted, not archived**:
   made or that name them (an invitation of them, a pause for them), the run events and delivery
   claims of DMs to them, and their pause rows;
 - every decline block they are either side of;
-- their admission, delivery health, web sessions and unused sign-in links, and their person row.
+- their admission, delivery health, web sessions, unused sign-in links and API tokens, and their
+  person row.
 
 What stays, and why: another person's task that they received stays that owner's; one paused only
 because DMs to them failed goes back on. Another person's row keeps its own audit fact but not their
@@ -199,8 +206,8 @@ bot sent stay in the person's Discord DMs, and the host's log may hold their tra
 
 Bytes: the database runs with `secure_delete` on, so a deleted row is overwritten, and the first
 start of 0.6.0 on an existing database runs one `VACUUM`, so pages freed before that are rewritten
-too. That one-time VACUUM is recorded in a small `tracker_meta` table, not by a schema bump: the
-schema stays at 3, so rolling back to 0.5.0 still opens the database. If the VACUUM cannot run (a
+too. That one-time VACUUM is recorded in a small `tracker_meta` table, not by a schema bump (0.6.0
+kept the schema at 3; 0.7.0's API tokens are schema 4, see the CHANGELOG). If the VACUUM cannot run (a
 reader holds the file), the start goes on, a warning is logged, and the next start tries again.
 Not a VACUUM per erasure: it rewrites the whole file under an
 exclusive lock, and `secure_delete` already covers every later delete. After an erasure the
@@ -223,6 +230,131 @@ are among the rows, so they are signed out everywhere at once, and the browser's
 The `__Host-` prefix, which would stop that, requires `Path=/` and so cannot be used with
 `Path=/tracker/`. Put the bot on a host whose sibling subdomains are all yours.
 
+## Task API
+
+A JSON API over your own tasks, for a program that acts as you -- a script, or the plain-language
+intake agent the plan defers (E10, item 31), which would end its dialogue by posting a task here.
+It is served under `/tracker/api/v1/` on the same origin as the web area, and only when
+`TRACKER_WEB_URL` is set. Every write goes through the same functions as the web editor and the
+slash commands -- the same fields, defaults, limits, caps and messages -- in the same write queue.
+
+**Tokens.** Make one on the web area's `/tokens` page (linked from Settings): a name, and an expiry
+of 30, 90 (the default) or 365 days -- every token expires. The token -- `trk_` and 43 characters --
+is sent to you once, by Discord DM from the bot; it never appears in any web page or response, and
+the tracker keeps only its SHA-256. If that DM cannot be delivered (DMs closed), the token is
+deleted at once and the page says so: open your DMs and try again. At most 10 live tokens per
+person, and at most 10 made per person in any rolling hour, revoked ones counted (each is a DM, so
+a script riding your session cannot flood your DMs by making and revoking); the count is kept in
+memory only, so a restart clears it. Each lists when it was made, last used (recorded at most once a minute) and expires, and
+can be revoked there at once; an admin sees and revokes anyone's from the admin view's page for
+that person. Forget-me erases a person's tokens with the rest. The log names a token by its id
+(`k1`), never by its secret.
+
+**Authentication.** `Authorization: Bearer <token>` on every request. The web area's session
+cookie is never read here: every plugin shares one browser origin, so a cookie-authenticated JSON
+API could be called by any script on it. A token acts as its owner with the owner's rights only,
+and only on the owner's own tasks -- an admin's token included; an admin's wider reads stay on the
+signed-in web pages. Every request re-reads the owner, as the web does a session: a person no
+longer on the tracker, or no longer registered, is refused and their tokens deleted; with `TRACKER_GUILD_ID` set, membership
+is re-checked on the web's schedule (after 15 minutes, one lookup, shared with the web), and one who
+has left the server loses every token and every session; a lookup that keeps failing lets them on
+for 24 hours from the last confirmation, then answers 503 until one succeeds (the token is kept).
+A token is looked up by the SHA-256 of what was sent, so the comparison is over a hash the sender
+cannot steer.
+
+**Browsers.** No answer carries a CORS header, and a request with an `Origin` header -- which a
+browser adds to every cross-origin request and to any same-origin one that is not a GET -- is
+refused with 403: the API is for programs, not pages. A browser page cannot send a cross-origin
+`Authorization` header without a CORS preflight, which is refused. A script of another plugin on
+the same origin (or an XSS there) can ride a signed-in person's cookie and use the web area as
+them for as long as the session lasts -- that is the shared origin's cost, as for the cookies above
+-- but it cannot get a token's secret: the page that makes one never shows it, the secret goes
+only to the person's Discord DMs (a token made that way is one they are told about and can
+revoke), and every token expires within a year. Put nothing on that origin you do not trust.
+
+**Limits.** Each token may make 60 requests at once, refilled at one per second; over that, `429`
+with `Retry-After`. A limited request is refused before its owner is looked up. Requests whose
+token does not look up (unknown, revoked, expired, malformed) share one global bucket of 30,
+refilled at one every two seconds; past it they get `429` instead of `401`, and valid tokens are
+unaffected. A body is at most
+16 KiB, read no further. One new price tracker's page read in flight per person, shared with the
+web editor (`409 busy`).
+
+**Requests.** A `POST` or `PATCH` body is one JSON object with `Content-Type: application/json`
+(else `415`), and names only the fields listed for that type (else `400 unknown_field`), each of
+its JSON type: text as a string, a whole number or a number as a JSON number. A field left out of a
+create gets the command's default; a field left out of an edit keeps what the task has, and an empty
+string does the same, except that an empty `note` clears a renewal's note and an empty `name` gives
+a price back the page's address -- exactly as the web editor's empty fields do. `null` is never a
+value: it is refused as the wrong JSON type (send `""` to clear a note).
+
+Which types: `GET /tasks`, `GET /tasks/<id>`, pause, resume and `DELETE` work on any task you own,
+whatever its type; `POST /tasks` and `PATCH` take the three editor types (reminder, renewal,
+price), and a `PATCH` of a task of another type answers `404`, as the web editor does.
+
+| Method and path | What |
+|---|---|
+| `GET /api/v1/me` | The token's owner (id, name, zone, preferred hour) and the token (id, name, made, expires). |
+| `GET /api/v1/types` | Each type's create and edit fields: name, JSON type, required (never, for an edit), description, and limits (`maxLength`, `minimum`, `maximum`, `enum`). This describes the tracker's own editor fields -- what these endpoints take -- and is **not** docket-core's `TaskType.intake` (`IntakeSpec`), which describes a type's config. |
+| `GET /api/v1/tasks` | Your tasks that are not deleted -- active, paused and done -- oldest first. Not the ones shared with you. |
+| `POST /api/v1/tasks` | Makes one: `type` is `reminder`, `renewal` or `price`, and the rest are that type's create fields. `201`, with `Location`. A price's page is read first, and nothing is made unless a price is found in it. |
+| `GET /api/v1/tasks/<id>` | One of your tasks (a deleted one too), with its history: the newest runs and changes, as `/task history` shows them. |
+| `PATCH /api/v1/tasks/<id>` | Edits it: the fields to change. A price's page is not editable. |
+| `POST /api/v1/tasks/<id>/pause`, `/resume` | Body `{}`. As the web's Pause and Resume, and `/task resume`. |
+| `DELETE /api/v1/tasks/<id>` | Deletes it as the web does: archived, nothing more sent, history kept. No confirmation step. |
+
+A task is `{"id", "type", "title", "status", "cadence", "nextAt", "createdAt", "updatedAt",
+"settings"}`, and a price also has a top-level `url`: `status` is `active`, `paused`, `done` or
+`deleted`; `cadence` is the schedule in words, in your zone; `nextAt` the next run's instant (UTC),
+null when paused or nothing is due; `settings` exactly the fields a `PATCH` takes, as the task has
+them. A price's `url` is read-only -- another page is another tracker -- so it is not in `settings`
+and a `PATCH` naming it is refused (`unknown_field`). A write answers
+`{"task", "message"}`, `message` being the words the web and the command say.
+
+**Errors** are `{"error": {"code": "...", "message": "..."}}`:
+
+| Status | Code | When |
+|---|---|---|
+| 400 | `invalid` | A rule refused a value; `message` is the rule's own words, as the web editor shows them. Also a field of the wrong JSON type, or no `type`. |
+| 400 | `unknown_field` | A field that type does not take (on a pause or resume, any field). |
+| 400 | `invalid_json` | The body is not JSON, or not one object. |
+| 401 | `unauthorized` | No `Authorization` header. With `WWW-Authenticate: Bearer realm="tracker"`. |
+| 401 | `invalid_token` | A token unknown, revoked or expired, or whose owner is no longer registered (their tokens are then deleted): one answer for all. |
+| 403 | `origin_refused` | The request carried an `Origin` header. |
+| 403 | `not_member` | The owner has left the `TRACKER_GUILD_ID` server; their tokens are revoked. |
+| 404 | `not_found` | No such endpoint, or no such task of yours. Anyone else's task -- one shared with you, or any task to an admin's token -- answers exactly as an unknown id. |
+| 405 | `method_not_allowed` | With `Allow`. |
+| 409 | `conflict` | A finished task edited, or a pause of a task not active (a resume of one not paused). |
+| 409 | `limit_reached` | 200 active or paused tasks, or 20 price trackers, as the commands count them. |
+| 409 | `busy` | Your last new price tracker's page is still being read. |
+| 413 | `too_large` | Body over 16 KiB. |
+| 415 | `unsupported_media_type` | Not `application/json`. |
+| 429 | `rate_limited` | With `Retry-After`: this token's bucket, or the shared one for bad tokens. |
+| 503 | `starting`, `membership_unknown`, `unavailable` | The plugin is starting; the owner's membership could not be checked for 24 hours; the type is not available on this bot. |
+
+**Example.**
+
+```
+$ curl -s https://clerk.example.com/tracker/api/v1/tasks \
+    -H "Authorization: Bearer $TRACKER_TOKEN" -H "Content-Type: application/json" \
+    -d '{"type": "reminder", "text": "water the plants", "when": "tomorrow 9am", "repeat": "week"}'
+{"task":{"id":"t7","type":"reminder","title":"water the plants","status":"active",
+ "cadence":"weekly on Fri at 9:00","nextAt":"2026-10-02T13:00:00.000Z",
+ "createdAt":"2026-10-01T12:00:00.000Z","updatedAt":"2026-10-01T12:00:00.000Z",
+ "settings":{"text":"water the plants","repeat":"week"}},
+ "message":"Reminder `t7` set: water the plants\nNext: Fri Oct 2, 9:00, weekly on Fri at 9:00."}
+
+$ curl -s -X PATCH https://clerk.example.com/tracker/api/v1/tasks/t7 \
+    -H "Authorization: Bearer $TRACKER_TOKEN" -H "Content-Type: application/json" \
+    -d '{"repeat": "day"}'
+
+$ curl -s -X POST https://clerk.example.com/tracker/api/v1/tasks/t7/pause \
+    -H "Authorization: Bearer $TRACKER_TOKEN" -H "Content-Type: application/json" -d '{}'
+
+$ curl -s https://clerk.example.com/tracker/api/v1/tasks/t9 -H "Authorization: Bearer $TRACKER_TOKEN"
+{"error":{"code":"not_found","message":"No such task."}}
+```
+
 ## What it does
 
 | Piece | File | Notes |
@@ -237,7 +369,8 @@ The `__Host-` prefix, which would stop that, requires `Path=/` and so cannot be
 | Commands | `src/discord.ts`, `src/interactions.ts`, `src/discord-common.ts` (discord.js); `src/actions.ts`, `src/press.ts`, `src/history.ts`, `src/access.ts` | The discord.js files read options and render; the rest is Discord-free over the injected store, clock and notifier. Store writes are handled one at a time; Discord lookups and DMs run outside that queue. |
 | Health | `src/health.ts` | `GET /tracker/healthz` (through the bot's HTTP router): `200` `ok`/`starting`, `503` `inactive`/`stale`/`blocked`. |
 | Admin, forget-me | `src/admin.ts`, `src/roster.ts`; `src/web/admin.ts`, `src/web/admin-pages.ts` | The admin acts and forget-me, Discord-free; the SQL docket's Store has no method for (listing people and blocks, erasing a person); the routes and pages. |
-| Web area | `src/web/` | `app.ts` authenticates and dispatches (pure over the injected store and clock), `routes.ts` names the paths; `pages.ts`, `editor-pages.ts` and `html.ts` render; `editor.ts` reads the editor's forms and calls the shared rules; `signin-link.ts` and `sessions.ts` hold the sign-in; `theme.ts` the stylesheet; `command.ts` is `/web`. |
+| Web area | `src/web/` | `app.ts` authenticates and dispatches (pure over the injected store and clock), `routes.ts` names the paths; `pages.ts`, `editor-pages.ts` and `html.ts` render; `form-input.ts` reads the editor's fields and `editor.ts` calls the shared rules with them; `signin-link.ts` and `sessions.ts` hold the sign-in; `theme.ts` the stylesheet; `command.ts` is `/web`. |
+| Task API | `src/web/api.ts`, `src/web/api-tasks.ts`, `src/web/api-tokens.ts`, `src/web/tokens.ts`, `src/web/token-pages.ts` | The JSON API's authentication, gates and rate limit; its task routes over editor.ts's writes; the tokens (SQL, hashed); the tokens page and its routes. |
 | Task rules | `src/reminders.ts`, `src/tracked.ts`, `src/price.ts`, `src/edit.ts`, `src/manage.ts`, `src/limits.ts` | What makes, edits, pauses, resumes and deletes a task, and the limits on it, Discord-free, for the commands and the web editor alike. |
 
 ## Configuration
@@ -252,8 +385,10 @@ The `__Host-` prefix, which would stop that, requires `Path=/` and so cannot be
 
 ## Not yet
 
-- The rest of the web area (E5): sharing a task from the web, the JSON task API, and the admin
-  view's grants, budgets and retry (with the execute lane). Discord OAuth2 as a second sign-in
+- The rest of the web area (E5): sharing a task from the web, and the admin view's grants, budgets
+  and retry (with the execute lane). The task API covers reminders, renewals and prices only --
+  not `/task done`, `snooze`, `decide`, `share` or the settings -- and no intake agent uses it yet
+  (E10, deferred). Discord OAuth2 as a second sign-in
   method, if chosen (plan item 41).
 - The city-hall Executor adapter (the execute lane).
 - Editing in Discord (the editor is on the web only), and changing a price tracker's page or `near` after it is made (make a new one); a free-form pattern for `price` (`near` is the safe subset: a user's regular expression run on a large page could hang the bot).

package/dist/plugin.js

@@ -4115,6 +4115,19 @@ var MIGRATIONS = [
   );
   CREATE INDEX web_sessions_user ON web_sessions (user_id);
   CREATE INDEX web_sessions_expiry ON web_sessions (expires_at);
+  `,
+  `
+  CREATE TABLE api_tokens (
+    seq INTEGER PRIMARY KEY AUTOINCREMENT,
+    token_hash TEXT NOT NULL UNIQUE,
+    user_id TEXT NOT NULL,
+    name TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    expires_at TEXT,
+    last_used_at TEXT,
+    member_checked_at TEXT
+  );
+  CREATE INDEX api_tokens_user ON api_tokens (user_id);
   `
 ];
 var BUSY_TIMEOUT_MS = 5000;
@@ -4340,6 +4353,7 @@ class Roster {
       del("delivery_health", "user_id = ?", userId);
       del("web_sessions", "user_id = ?", userId);
       del("web_login_tokens", "user_id = ?", userId);
+      del("api_tokens", "user_id = ?", userId);
       del("users", "seq = ?", Number(seq));
       const held = this.db.query("SELECT 1 FROM delivery_pauses WHERE task_id = ? LIMIT 1");
       const freed = [...new Set(pausedFor)].filter((t) => held.get(t) === null);
@@ -6182,6 +6196,10 @@ ${form.error ? html`<div class="rb-alert rb-alert--danger" role="alert"><p class
 </form>
 </section>
 <section>
+<h2>API tokens</h2>
+<p>For a program that uses the tracker's task API as you. <a class="rb-link" href="${v.base}/tokens">API tokens</a></p>
+</section>
+<section>
 <h2>Forget me</h2>
 <p>Delete everything the tracker holds about you, for good. <a class="rb-link" href="${v.base}/forget">Forget me</a></p>
 </section>`);
@@ -6335,6 +6353,166 @@ function notice(key, error) {
   return text ? html`<div class="rb-alert rb-alert--success" role="status"><p class="rb-alert__title">${text}</p></div>` : null;
 }
 
+// plugins/tracker/src/web/api-tokens.ts
+var TOKEN_PREFIX = "trk_";
+var MAX_TOKENS_PER_PERSON = 10;
+var MAX_TOKEN_NAME = 50;
+var TOKEN_EXPIRY_DAYS = [30, 90, 365];
+var DEFAULT_EXPIRY_DAYS = 90;
+var DAY_MS3 = 24 * 60 * 60 * 1000;
+var TOUCH_EVERY_MS = 60 * 1000;
+function isApiTokenShape(value) {
+  return /^trk_[A-Za-z0-9_-]{43}$/.test(value);
+}
+function isTokenId(id) {
+  return /^k[1-9][0-9]{0,15}$/.test(id);
+}
+function expiryChoice(raw) {
+  const days = Number(raw);
+  return TOKEN_EXPIRY_DAYS.includes(days) ? days : undefined;
+}
+var COLUMNS = "seq, user_id, name, created_at, expires_at, last_used_at, member_checked_at";
+function toToken(r) {
+  return {
+    id: `k${Number(r.seq)}`,
+    userId: r.user_id,
+    name: r.name,
+    createdAt: r.created_at,
+    expiresAt: r.expires_at,
+    lastUsedAt: r.last_used_at,
+    memberCheckedAt: r.member_checked_at
+  };
+}
+
+class ApiTokens {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  create(userId, input, now, memberCheckedAt) {
+    const name = input.name.trim();
+    if (name.length === 0)
+      return { ok: false, error: "Give the token a name, such as the program that will use it." };
+    if (name.length > MAX_TOKEN_NAME)
+      return { ok: false, error: `That name is longer than ${MAX_TOKEN_NAME} characters.` };
+    if (/[\u0000-\u001f\u007f]/.test(name))
+      return { ok: false, error: "That name has a control character in it." };
+    if (!TOKEN_EXPIRY_DAYS.includes(input.days))
+      return { ok: false, error: "Choose when the token expires." };
+    const at = now.toISOString();
+    return this.db.transaction(() => {
+      const seq = /^u([1-9][0-9]*)$/.exec(userId)?.[1];
+      if (seq === undefined || this.db.query("SELECT 1 FROM users WHERE seq = ?").get(Number(seq)) === null) {
+        return { ok: false, error: "You are no longer on this tracker's list." };
+      }
+      this.db.query("DELETE FROM api_tokens WHERE expires_at IS NOT NULL AND expires_at <= ?").run(at);
+      const live = this.db.query("SELECT COUNT(*) AS n FROM api_tokens WHERE user_id = ?").get(userId).n;
+      if (live >= MAX_TOKENS_PER_PERSON) {
+        return { ok: false, error: `You already have ${MAX_TOKENS_PER_PERSON} API tokens, the most one person may. Revoke one first.` };
+      }
+      const token = `${TOKEN_PREFIX}${randomToken()}`;
+      const expiresAt = new Date(now.getTime() + input.days * DAY_MS3).toISOString();
+      const r = this.db.query(`INSERT INTO api_tokens (token_hash, user_id, name, created_at, expires_at, last_used_at, member_checked_at)
+           VALUES (?, ?, ?, ?, ?, NULL, ?) RETURNING ${COLUMNS}`).get(sha256(token), userId, name, at, expiresAt, memberCheckedAt);
+      return { ok: true, token, row: toToken(r) };
+    })();
+  }
+  find(token, now) {
+    if (!isApiTokenShape(token))
+      return null;
+    const r = this.db.query(`SELECT ${COLUMNS} FROM api_tokens WHERE token_hash = ? AND (expires_at IS NULL OR expires_at > ?)`).get(sha256(token), now.toISOString());
+    return r ? toToken(r) : null;
+  }
+  get(id) {
+    if (!isTokenId(id))
+      return null;
+    const r = this.db.query(`SELECT ${COLUMNS} FROM api_tokens WHERE seq = ?`).get(Number(id.slice(1)));
+    return r ? toToken(r) : null;
+  }
+  listFor(userId, now) {
+    const rows = this.db.query(`SELECT ${COLUMNS} FROM api_tokens WHERE user_id = ? AND (expires_at IS NULL OR expires_at > ?) ORDER BY seq`).all(userId, now.toISOString());
+    return rows.map(toToken);
+  }
+  touch(token, now) {
+    if (!isTokenId(token.id))
+      return false;
+    if (token.lastUsedAt !== null && now.getTime() - Date.parse(token.lastUsedAt) < TOUCH_EVERY_MS && Date.parse(token.lastUsedAt) <= now.getTime())
+      return false;
+    const cutoff = new Date(now.getTime() - TOUCH_EVERY_MS).toISOString();
+    return this.db.query("UPDATE api_tokens SET last_used_at = ? WHERE seq = ? AND (last_used_at IS NULL OR last_used_at <= ? OR last_used_at > ?)").run(now.toISOString(), Number(token.id.slice(1)), cutoff, now.toISOString()).changes > 0;
+  }
+  revokeOwn(userId, id) {
+    if (!isTokenId(id))
+      return false;
+    return this.db.query("DELETE FROM api_tokens WHERE seq = ? AND user_id = ?").run(Number(id.slice(1)), userId).changes > 0;
+  }
+  revokeAny(id) {
+    if (!isTokenId(id))
+      return null;
+    const r = this.db.query("DELETE FROM api_tokens WHERE seq = ? RETURNING user_id").get(Number(id.slice(1)));
+    return r ? r.user_id : null;
+  }
+  deleteForUser(userId) {
+    this.db.query("DELETE FROM api_tokens WHERE user_id = ?").run(userId);
+  }
+  confirmMember(userId, at) {
+    this.db.query("UPDATE api_tokens SET member_checked_at = ? WHERE user_id = ?").run(at, userId);
+  }
+}
+
+// plugins/tracker/src/web/token-pages.ts
+function tokenHref(v, id) {
+  return `${v.base}/tokens/${encodeURIComponent(id)}/revoke`;
+}
+function adminTokenHref(v, id) {
+  return `${v.base}/admin/tokens/${encodeURIComponent(id)}/revoke`;
+}
+function at(iso, viewer, now, none) {
+  return iso ? formatInstant(iso, viewer.timeZone, now) : none;
+}
+function tokenTable(v, tokens, now, href) {
+  if (tokens.length === 0)
+    return html`<p class="rb-muted">None.</p>`;
+  return html`<div class="rb-table-scroll"><table class="rb-table">
+<thead><tr><th>Name</th><th>Made</th><th>Last used</th><th>Expires</th><th></th></tr></thead>
+<tbody>${tokens.map((t) => html`<tr>
+<td>${t.name}</td>
+<td>${at(t.createdAt, v.user, now, "")}</td>
+<td>${at(t.lastUsedAt, v.user, now, "never")}</td>
+<td>${at(t.expiresAt, v.user, now, "never")}</td>
+<td><form method="post" action="${href(t.id)}"><input type="hidden" name="csrf" value="${v.csrf}"><button class="rb-btn rb-btn--danger rb-btn--sm" type="submit">Revoke</button></form></td>
+</tr>`)}</tbody>
+</table></div>`;
+}
+function tokensPage(v, tokens, now, f = {}) {
+  const expiry = f.expiry ?? String(DEFAULT_EXPIRY_DAYS);
+  const choices = TOKEN_EXPIRY_DAYS.map((d) => [String(d), `in ${d} days`]);
+  return framed(v, "API tokens", html`<section>
+<p><a class="rb-link" href="${v.base}/settings">Settings</a></p>
+<h1>API tokens</h1>
+<p>A token lets a program use the tracker's task API as you: list, read, make, edit, pause, resume and delete your own tasks, nothing more. Send it as <code>Authorization: Bearer &lt;token&gt;</code> to <code>${v.base}/api/v1/</code>. Anyone holding it can act as you, so keep it secret, and revoke it when the program no longer needs it. A new token is sent to you by Discord DM, once, and never shown here. At most ${MAX_TOKENS_PER_PERSON}, each for a year at most.</p>
+${f.result ? html`<div class="rb-alert rb-alert--success" role="status"><p>${f.result}</p></div>` : null}
+${f.error ? html`<div class="rb-alert rb-alert--danger" role="alert"><p class="rb-alert__title">Not made</p><p>${f.error}</p></div>` : null}
+${tokenTable(v, tokens, now, (id) => tokenHref(v, id))}
+</section>
+<section>
+<h2>Make a token</h2>
+<form method="post" action="${v.base}/tokens" class="tr-stack">
+<input type="hidden" name="csrf" value="${v.csrf}">
+<div class="rb-field">
+<label class="rb-label" for="name">Name</label>
+<input class="rb-input" id="name" name="name" value="${f.name ?? ""}" maxlength="${MAX_TOKEN_NAME}" required>
+<p class="rb-field__help">What will use it, so you know which to revoke.</p>
+</div>
+<div class="rb-field">
+<label class="rb-label" for="expiry">Expires</label>
+<select class="rb-select" id="expiry" name="expiry">${choices.map(([value, label]) => html`<option value="${value}"${value === expiry ? html` selected` : null}>${label}</option>`)}</select>
+</div>
+<div><button class="rb-btn rb-btn--primary" type="submit">Make token</button></div>
+</form>
+</section>`);
+}
+
 // plugins/tracker/src/web/admin-pages.ts
 var CONFIGURED_NOTE = "Named in TRACKER_ADMIN_DISCORD_IDS: made an admin again at every start, so they cannot be revoked or removed here. Remove them from the configuration first.";
 var CONFIRM_WORD = "forget";
@@ -6435,7 +6613,7 @@ ${tasks.length === 0 ? html`<p class="rb-muted">There are no tasks.</p>` : html`
 function post2(v, p, action, label, style) {
   return html`<form method="post" action="${personHref(v, p.id, action)}">${hidden(v)}<button class="rb-btn ${style} rb-btn--sm" type="submit">${label}</button></form>`;
 }
-function personPage(v, p, tasks, now, result = null, configured = false) {
+function personPage(v, p, tasks, now, result = null, configured = false, tokens = []) {
   return framed(v, nameOf(p), html`<section>
 ${adminNav(v)}
 <h1>${nameOf(p)}${p.admin ? html` <span class="rb-badge">admin</span>` : null}</h1>
@@ -6457,9 +6635,14 @@ ${configured && p.id !== v.user.id ? null : post2(v, p, "forget", "Remove from t
 <section>
 <h2>Their tasks</h2>
 ${tasks.length === 0 ? html`<p class="rb-muted">None.</p>` : html`<ul>${tasks.map((t) => html`<li><a class="rb-link" href="${taskHref(v, t.id)}">${t.title}</a> -- ${t.type}, ${t.status === "archived" ? "deleted" : t.status}</li>`)}</ul>`}
+</section>
+<section>
+<h2>Their API tokens</h2>
+<p class="rb-muted">Each acts as them on their own tasks. Revoking one stops it at once; they are not told.</p>
+${tokenTable(v, tokens, now, (id) => adminTokenHref(v, id))}
 </section>`);
 }
-var WHAT_GOES = "every task (deleted ones too) with its runs, replies and history; your replies, answers and history on other people's tasks, " + "and your place on the tasks shared with you; decline blocks either way; delivery pauses; your settings and sign-in sessions; and your place on the list.";
+var WHAT_GOES = "every task (deleted ones too) with its runs, replies and history; your replies, answers and history on other people's tasks, " + "and your place on the tasks shared with you; decline blocks either way; delivery pauses; your settings, sign-in sessions and API tokens; and your place on the list.";
 function forgetPage(v, note) {
   return framed(v, "Forget me", html`<section class="rb-card">
 <h1>Forget me</h1>
@@ -6520,7 +6703,8 @@ async function onePerson(a, id, result = null) {
   if (!p)
     return htmlResponse(notFoundPage(a.v.base, a.v), 404);
   const tasks = await a.d.store.listTasks({ ownerId: p.id });
-  return htmlResponse(personPage(a.v, p, tasks, a.d.clock.now(), result, isConfiguredAdmin(a.d, p)), result && !result.ok ? 400 : 200);
+  const tokens = a.d.apiTokens.listFor(p.id, a.d.clock.now());
+  return htmlResponse(personPage(a.v, p, tasks, a.d.clock.now(), result, isConfiguredAdmin(a.d, p), tokens), result && !result.ok ? 400 : 200);
 }
 async function adminGet(a, r) {
   if (r.kind === "admin")
@@ -6554,6 +6738,19 @@ async function adminPost(a, r, form) {
       return unknownPage(base);
     return peoplePage(a, said2(done), done.ok ? 200 : 400);
   }
+  if (r.kind === "admin-token-revoke") {
+    const owner = await fresh(a, true, async (me) => {
+      const whose = a.d.apiTokens.revokeAny(r.id);
+      if (whose !== null)
+        a.d.log.info(`${me.id} revoked API token ${r.id} of ${whose}`);
+      return { whose };
+    });
+    if (owner === null)
+      return unknownPage(base);
+    if (owner.whose === null)
+      return htmlResponse(notFoundPage(base, a.v), 404);
+    return onePerson(a, owner.whose, { ok: true, text: "Revoked: that token no longer works." });
+  }
   if (r.kind !== "admin-act")
     return unknownPage(base);
   if (r.action === "forget") {
@@ -6657,10 +6854,10 @@ async function editReminder(d, user, taskId, input) {
     updated = await rescheduleKeepingSnoozes(d, updated, user, plan.schedule, user.id);
   return { ok: true, task: updated, text: savedText(updated, user, await nextRun(d, updated), d.clock.now(), "(reminder)") };
 }
-var DAY_MS3 = 24 * 60 * 60 * 1000;
+var DAY_MS4 = 24 * 60 * 60 * 1000;
 function periodDateFrom(s, date, owner) {
   const ctx = { zone: owner.timeZone, preferredHour: owner.preferredHour };
-  let after = new Date(Date.parse(`${date}T00:00:00Z`) - ((s.leadDays ?? 0) + 2) * DAY_MS3);
+  let after = new Date(Date.parse(`${date}T00:00:00Z`) - ((s.leadDays ?? 0) + 2) * DAY_MS4);
   for (let i = 0;i < 1000; i++) {
     const due = nextDue(s, after, ctx);
     if (!due)
@@ -6767,15 +6964,7 @@ async function editPrice(d, user, taskId, input) {
   return { ok: true, task: updated, text: savedText(updated, user, await nextRun(d, updated), d.clock.now(), "(price)") };
 }
 
-// plugins/tracker/src/web/editor.ts
-var READING = "I am still reading the page of your last new price tracker; try again when it is done.";
-var GONE = NO_LONGER_LISTED;
-function asViewer(e, fn) {
-  return e.queue(async () => {
-    const user = await e.d.store.getUser(e.v.user.id);
-    return user ? fn(user) : { ok: false, error: GONE };
-  });
-}
+// plugins/tracker/src/web/form-input.ts
 var str2 = (form, name) => form.get(name) ?? "";
 var opt = (form, name) => str2(form, name).trim() === "" ? undefined : str2(form, name);
 function int(form, name) {
@@ -6825,6 +7014,10 @@ function priceSettings(form) {
     ...baseline !== undefined ? { baseline } : {}
   };
 }
+function priceInput(form) {
+  const near = opt(form, "near");
+  return { url: str2(form, "url"), ...priceSettings(form), ...near !== undefined ? { near } : {} };
+}
 function reminderEdit(form) {
   const text = opt(form, "text");
   const when = opt(form, "when");
@@ -6854,56 +7047,7 @@ function priceEdit(form) {
   const { name: _name, ...rest } = priceSettings(form);
   return { ...rest, ...form.has("name") ? { name: str2(form, "name") } : {} };
 }
-var DEFAULTS = {
-  reminder: { repeat: "none" },
-  renewal: { unit: "year", every: "1", lead: "7" },
-  price: { hours: "12", drop: "10", baseline: "last" }
-};
-function newGet(e, type) {
-  return htmlResponse(newTaskPage(e.v, type, type === "renewal" ? { ...DEFAULTS.renewal, currency: "USD" } : DEFAULTS[type]));
-}
-async function newPost(e, type, form) {
-  let made;
-  if (type === "reminder")
-    made = await asViewer(e, (u) => createReminder(e.d, u, reminderInput(form)));
-  else if (type === "renewal")
-    made = await asViewer(e, (u) => createRenewal(e.d, u, renewalInput(form)));
-  else {
-    const near = opt(form, "near");
-    const input = { url: str2(form, "url"), ...priceSettings(form), ...near !== undefined ? { near } : {} };
-    const who = e.v.user.id;
-    if (e.reading.has(who))
-      made = { ok: false, error: READING };
-    else {
-      e.reading.add(who);
-      try {
-        const started = await asViewer(e, (u) => startPrice(e.d, u, input));
-        if (!started.ok)
-          made = started;
-        else {
-          const { pending } = started;
-          const seen = await previewPrice(e.d, pending);
-          made = await asViewer(e, (u) => finishPrice(e.d, u, pending, seen));
-        }
-      } finally {
-        e.reading.delete(who);
-      }
-    }
-  }
-  if (!made.ok)
-    return htmlResponse(newTaskPage(e.v, type, typed(type, "new", form), made.error), 400);
-  return redirect(`${taskHref(e.v, made.task.id)}?done=created`);
-}
-async function taskPage(e, id, done, error) {
-  const view = await loadHistory(e.d, e.v.user, id);
-  if (!view)
-    return htmlResponse(notFoundPage(e.v.base, e.v), 404);
-  const own = view.task.ownerId === e.v.user.id;
-  const controls = own ? ownerControls(e.v, view.task) : null;
-  const owner = own ? null : (await e.d.store.getUser(view.task.ownerId))?.displayName ?? view.task.ownerId;
-  return htmlResponse(historyPage(e.v, view, { controls, flash: notice(done, error), owner }), error ? 400 : 200);
-}
-function current(d, user, task) {
+function editValues(d, user, task) {
   const now = d.clock.now();
   if (task.type === "reminder")
     return { text: String(task.config?.text ?? ""), when: "", repeat: repeatOf(task.schedule) };
@@ -6929,28 +7073,93 @@ function current(d, user, task) {
   const every = task.schedule?.kind === "poll" ? task.schedule.every : 12;
   return { name: task.title, hours: String(every), drop: String(c.dropPercent ?? 10), baseline: c.baseline ?? "last" };
 }
+
+// plugins/tracker/src/web/editor.ts
+var READING = "I am still reading the page of your last new price tracker; try again when it is done.";
+var GONE = NO_LONGER_LISTED;
+var writer = (e) => ({ d: e.d, queue: e.queue, reading: e.reading, userId: e.v.user.id });
+function asUser(w, fn) {
+  return w.queue(async () => {
+    const user = await w.d.store.getUser(w.userId);
+    return user ? fn(user) : { ok: false, error: GONE };
+  });
+}
+async function makeTask(w, type, form) {
+  if (type === "reminder")
+    return asUser(w, (u) => createReminder(w.d, u, reminderInput(form)));
+  if (type === "renewal")
+    return asUser(w, (u) => createRenewal(w.d, u, renewalInput(form)));
+  const input = priceInput(form);
+  if (w.reading.has(w.userId))
+    return { ok: false, error: READING };
+  w.reading.add(w.userId);
+  try {
+    const started = await asUser(w, (u) => startPrice(w.d, u, input));
+    if (!started.ok)
+      return started;
+    const { pending } = started;
+    const seen = await previewPrice(w.d, pending);
+    return await asUser(w, (u) => finishPrice(w.d, u, pending, seen));
+  } finally {
+    w.reading.delete(w.userId);
+  }
+}
+async function editableTask(d, user, id) {
+  const task = await ownLiveTask(d, user, id);
+  return task && (task.type === "reminder" || task.type === "renewal" || task.type === "price") ? task : null;
+}
+function saveEdit(w, task, form) {
+  if (task.type === "reminder")
+    return asUser(w, (u) => editReminder(w.d, u, task.id, reminderEdit(form)));
+  if (task.type === "renewal")
+    return asUser(w, (u) => editRenewal(w.d, u, task.id, renewalEdit(form)));
+  return asUser(w, (u) => editPrice(w.d, u, task.id, priceEdit(form)));
+}
+function actOn(w, taskId, action) {
+  const act = action === "pause" ? pauseTask : action === "resume" ? resumeTask : deleteTask;
+  return asUser(w, (u) => act(w.d, u, taskId));
+}
+var DEFAULTS = {
+  reminder: { repeat: "none" },
+  renewal: { unit: "year", every: "1", lead: "7" },
+  price: { hours: "12", drop: "10", baseline: "last" }
+};
+function newGet(e, type) {
+  return htmlResponse(newTaskPage(e.v, type, type === "renewal" ? { ...DEFAULTS.renewal, currency: "USD" } : DEFAULTS[type]));
+}
+async function newPost(e, type, form) {
+  const made = await makeTask(writer(e), type, form);
+  if (!made.ok)
+    return htmlResponse(newTaskPage(e.v, type, typed(type, "new", form), made.error), 400);
+  return redirect(`${taskHref(e.v, made.task.id)}?done=created`);
+}
+async function taskPage(e, id, done, error) {
+  const view = await loadHistory(e.d, e.v.user, id);
+  if (!view)
+    return htmlResponse(notFoundPage(e.v.base, e.v), 404);
+  const own = view.task.ownerId === e.v.user.id;
+  const controls = own ? ownerControls(e.v, view.task) : null;
+  const owner = own ? null : (await e.d.store.getUser(view.task.ownerId))?.displayName ?? view.task.ownerId;
+  return htmlResponse(historyPage(e.v, view, { controls, flash: notice(done, error), owner }), error ? 400 : 200);
+}
 function editPage(e, task, values, error) {
   const now = task.schedule ? describeSchedule(task.schedule, e.v.user, e.v.user.timeZone, e.d.clock.now()) : "no schedule";
   const page = task.type === "price" ? String(task.config.url) : undefined;
   return editTaskPage(e.v, task, values, { now, ...page !== undefined ? { page } : {}, ...error !== undefined ? { error } : {} });
 }
-async function editableTask(e, id) {
-  const task = await ownLiveTask(e.d, e.v.user, id);
-  return task && (task.type === "reminder" || task.type === "renewal" || task.type === "price") ? task : null;
-}
 async function editGet(e, id) {
-  const task = await editableTask(e, id);
+  const task = await editableTask(e.d, e.v.user, id);
   if (!task)
     return htmlResponse(notFoundPage(e.v.base, e.v), 404);
   if (task.status !== "active" && task.status !== "paused")
     return redirect(taskHref(e.v, task.id));
-  return htmlResponse(editPage(e, task, current(e.d, e.v.user, task)));
+  return htmlResponse(editPage(e, task, editValues(e.d, e.v.user, task)));
 }
 async function editPost(e, id, form) {
-  const task = await editableTask(e, id);
+  const task = await editableTask(e.d, e.v.user, id);
   if (!task)
     return htmlResponse(notFoundPage(e.v.base, e.v), 404);
-  const saved = task.type === "reminder" ? await asViewer(e, (u) => editReminder(e.d, u, task.id, reminderEdit(form))) : task.type === "renewal" ? await asViewer(e, (u) => editRenewal(e.d, u, task.id, renewalEdit(form))) : await asViewer(e, (u) => editPrice(e.d, u, task.id, priceEdit(form)));
+  const saved = await saveEdit(writer(e), task, form);
   if (saved.ok)
     return redirect(`${taskHref(e.v, task.id)}?done=saved`);
   if (saved.error === NO_SUCH_TASK)
@@ -6961,10 +7170,9 @@ async function actionPost(e, id, action, form) {
   const task = await ownLiveTask(e.d, e.v.user, id);
   if (!task)
     return htmlResponse(notFoundPage(e.v.base, e.v), 404);
-  if (action === "delete" && str2(form, "confirm") !== "yes")
+  if (action === "delete" && form.get("confirm") !== "yes")
     return htmlResponse(confirmDeletePage(e.v, task));
-  const act = action === "pause" ? pauseTask : action === "resume" ? resumeTask : deleteTask;
-  const done = await asViewer(e, (u) => act(e.d, u, task.id));
+  const done = await actOn(writer(e), task.id, action);
   if (!done.ok)
     return done.error === NO_SUCH_TASK ? htmlResponse(notFoundPage(e.v.base, e.v), 404) : taskPage(e, task.id, null, done.error);
   if (action === "delete")
@@ -6972,6 +7180,418 @@ async function actionPost(e, id, action, form) {
   return redirect(`${taskHref(e.v, task.id)}?done=${action === "pause" ? "paused" : "resumed"}`);
 }
 
+// plugins/tracker/src/web/api-tasks.ts
+function problem(status, code, message, headers) {
+  return { status, body: { error: { code, message } }, ...headers ? { headers } : {} };
+}
+var NOT_FOUND_MESSAGE = "No such task.";
+var notFound = () => problem(404, "not_found", NOT_FOUND_MESSAGE);
+function jsonKind(f) {
+  if (f.kind === "number")
+    return "integer";
+  return f.decimal ? "number" : "string";
+}
+function typesAnswer() {
+  const describe = (fields, mode) => fields.map((f) => ({
+    name: f.name,
+    type: jsonKind(f),
+    required: mode === "new" && f.required === true,
+    description: f.help ? `${f.label}. ${f.help}` : f.label,
+    ...f.maxlength !== undefined ? { maxLength: f.maxlength } : {},
+    ...f.min !== undefined ? { minimum: f.min } : {},
+    ...f.max !== undefined ? { maximum: f.max } : {},
+    ...f.options ? { enum: f.options.map(([value]) => value) } : {}
+  }));
+  return {
+    status: 200,
+    body: { types: EDITOR_TYPES.map((type) => ({ type, create: describe(fieldsFor(type, "new"), "new"), edit: describe(fieldsFor(type, "edit"), "edit") })) }
+  };
+}
+function asFields(body, type, mode) {
+  const fields = new Map(fieldsFor(type, mode).map((f) => [f.name, f]));
+  const form = new URLSearchParams;
+  for (const [key, value] of Object.entries(body)) {
+    if (mode === "new" && key === "type")
+      continue;
+    const f = fields.get(key);
+    if (!f)
+      return problem(400, "unknown_field", `\`${key.slice(0, 40)}\` is not a field of a ${type}${mode === "edit" ? " edit" : ""}. GET types lists them.`);
+    const kind = jsonKind(f);
+    if (kind === "string") {
+      if (typeof value !== "string")
+        return problem(400, "invalid", `\`${key}\` must be a string.`);
+      form.set(key, value);
+    } else {
+      if (typeof value !== "number" || !Number.isFinite(value))
+        return problem(400, "invalid", `\`${key}\` must be a number.`);
+      form.set(key, String(value));
+    }
+  }
+  return form;
+}
+function refusal(error) {
+  if (error === NO_SUCH_TASK)
+    return notFound();
+  if (error === NO_LONGER_LISTED)
+    return problem(401, "invalid_token", "The token's owner is no longer on this tracker's list.");
+  if (error === READING)
+    return problem(409, "busy", error);
+  if (error === FINISHED || /^That task is [a-z]+, not [a-z]+\.$/.test(error))
+    return problem(409, "conflict", error);
+  if (/^You already (have|track) [0-9]+ /.test(error))
+    return problem(409, "limit_reached", error);
+  if (/ (is|are) not available on this bot\.$/.test(error))
+    return problem(503, "unavailable", error);
+  return problem(400, "invalid", error);
+}
+async function nextAt(d, task) {
+  if (task.status !== "active")
+    return null;
+  const queued = await d.store.listOccurrences({ taskId: task.id, status: "queued" });
+  return queued[0]?.dueAt ?? null;
+}
+async function taskJson(d, user, task) {
+  const type = EDITOR_TYPES.includes(task.type) ? task.type : null;
+  const values = editValues(d, user, task);
+  const settings = {};
+  if (type) {
+    for (const f of fieldsFor(type, "edit")) {
+      if (f.name === "when")
+        continue;
+      const raw = values[f.name];
+      if (raw === undefined)
+        continue;
+      settings[f.name] = jsonKind(f) === "string" ? raw : Number(raw);
+    }
+  }
+  return {
+    id: task.id,
+    type: task.type,
+    title: task.title,
+    status: task.status === "archived" ? "deleted" : task.status,
+    cadence: task.schedule ? describeSchedule(task.schedule, user, user.timeZone, d.clock.now()) : "no schedule",
+    nextAt: await nextAt(d, task),
+    createdAt: task.createdAt,
+    updatedAt: task.updatedAt,
+    settings,
+    ...task.type === "price" ? { url: String(task.config.url) } : {}
+  };
+}
+async function listAnswer(d, user) {
+  const tasks = (await d.store.listTasks({ ownerId: user.id })).filter((t) => t.status !== "archived");
+  const out = [];
+  for (const t of tasks)
+    out.push(await taskJson(d, user, t));
+  return { status: 200, body: { tasks: out } };
+}
+async function getAnswer(d, user, id) {
+  const task = await ownTask(d, user, id);
+  if (!task)
+    return notFound();
+  const view = await loadHistory(d, user, task.id);
+  if (!view)
+    return notFound();
+  return {
+    status: 200,
+    body: {
+      task: await taskJson(d, user, view.task),
+      history: { next: view.next, runs: view.runs, earlierRuns: view.earlierRuns, changes: view.changes, earlierChanges: view.earlierChanges }
+    }
+  };
+}
+async function written(w, user, result, status, base) {
+  if (!result.ok)
+    return refusal(result.error);
+  const task = await w.d.store.getTask(result.task.id) ?? result.task;
+  return {
+    status,
+    body: { task: await taskJson(w.d, user, task), message: result.text },
+    ...status === 201 ? { headers: { Location: `${base}/tasks/${encodeURIComponent(task.id)}` } } : {}
+  };
+}
+async function createAnswer(w, user, body, base) {
+  const type = body.type;
+  if (typeof type !== "string" || !EDITOR_TYPES.includes(type)) {
+    return problem(400, "invalid", `\`type\` is one of ${EDITOR_TYPES.join(", ")}.`);
+  }
+  const form = asFields(body, type, "new");
+  if (!(form instanceof URLSearchParams))
+    return form;
+  return written(w, user, await makeTask(w, type, form), 201, base);
+}
+async function editAnswer(w, user, id, body, base) {
+  const task = await editableTask(w.d, user, id);
+  if (!task)
+    return notFound();
+  const form = asFields(body, task.type, "edit");
+  if (!(form instanceof URLSearchParams))
+    return form;
+  return written(w, user, await saveEdit(w, task, form), 200, base);
+}
+async function actAnswer(w, user, id, action) {
+  const task = await ownTask(w.d, user, id);
+  if (!task || task.status === "archived")
+    return notFound();
+  const done = await actOn(w, task.id, action);
+  if (!done.ok)
+    return refusal(done.error);
+  const after = await w.d.store.getTask(task.id) ?? task;
+  return { status: 200, body: { task: await taskJson(w.d, user, after), message: done.text } };
+}
+
+// plugins/tracker/src/web/api.ts
+var API_PREFIX = "/api/v1";
+var MAX_API_BYTES = 16 * 1024;
+var RATE_BURST = 60;
+var RATE_PER_SECOND = 1;
+var FAILED_BURST = 30;
+var FAILED_PER_SECOND = 0.5;
+var FAILED_KEY = "failed";
+
+class RateLimiter {
+  burst;
+  perSecond;
+  buckets = new Map;
+  constructor(burst, perSecond) {
+    this.burst = burst;
+    this.perSecond = perSecond;
+  }
+  take(key, nowMs) {
+    const b = this.buckets.get(key);
+    const elapsed = b ? Math.max(0, nowMs - b.at) / 1000 : 0;
+    const tokens = b ? Math.min(this.burst, b.tokens + elapsed * this.perSecond) : this.burst;
+    if (tokens < 1) {
+      this.buckets.set(key, { tokens, at: nowMs });
+      return Math.max(1, Math.ceil((1 - tokens) / this.perSecond));
+    }
+    this.buckets.set(key, { tokens: tokens - 1, at: nowMs });
+    if (this.buckets.size > 1e4) {
+      for (const [k, v] of this.buckets)
+        if (v.tokens + (nowMs - v.at) / 1000 * this.perSecond >= this.burst)
+          this.buckets.delete(k);
+    }
+    return 0;
+  }
+}
+var HEADERS = {
+  "Content-Type": "application/json; charset=utf-8",
+  "Cache-Control": "no-store",
+  "X-Content-Type-Options": "nosniff",
+  "Content-Security-Policy": "default-src 'none'; frame-ancestors 'none'",
+  "Referrer-Policy": "no-referrer"
+};
+function json2(a) {
+  return new Response(JSON.stringify(a.body), { status: a.status, headers: { ...HEADERS, ...a.headers ?? {} } });
+}
+var CHALLENGE = 'Bearer realm="tracker"';
+function bearer(header) {
+  if (header === null)
+    return null;
+  const m = /^Bearer +([^\s]+) *$/i.exec(header);
+  return m?.[1] ?? null;
+}
+var ACT = /^\/tasks\/([^/]+)\/(pause|resume)$/;
+var ONE = /^\/tasks\/([^/]+)$/;
+function segment(raw) {
+  try {
+    return decodeURIComponent(raw ?? "");
+  } catch {
+    return "";
+  }
+}
+function route(rest) {
+  if (rest === "/me")
+    return { kind: "me" };
+  if (rest === "/types")
+    return { kind: "types" };
+  if (rest === "/tasks")
+    return { kind: "tasks" };
+  const act = ACT.exec(rest);
+  if (act)
+    return { kind: "act", id: segment(act[1]), action: act[2] };
+  const one = ONE.exec(rest);
+  return one ? { kind: "task", id: segment(one[1]) } : null;
+}
+function allowedMethods(r) {
+  if (r.kind === "tasks")
+    return "GET, POST";
+  if (r.kind === "task")
+    return "GET, PATCH, DELETE";
+  if (r.kind === "act")
+    return "POST";
+  return "GET";
+}
+async function readJson(request) {
+  const type = (request.headers.get("content-type") ?? "").trim();
+  const no = (answer) => ({ ok: false, answer });
+  if (!/^application\/json *(;.*)?$/i.test(type))
+    return no(problem(415, "unsupported_media_type", "Send the body as Content-Type: application/json."));
+  const text = await readBody(request, MAX_API_BYTES);
+  if (text === null)
+    return no(problem(413, "too_large", `The body is over ${MAX_API_BYTES} bytes.`));
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    return no(problem(400, "invalid_json", "The body is not JSON."));
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return no(problem(400, "invalid_json", "The body must be a JSON object."));
+  return { ok: true, body: value };
+}
+async function authenticate(w, request) {
+  const { d } = w;
+  const no = (answer) => ({ ok: false, answer });
+  const header = request.headers.get("authorization");
+  if (header === null)
+    return no(problem(401, "unauthorized", "Send Authorization: Bearer <token>. Make a token on the web area's API tokens page.", { "WWW-Authenticate": CHALLENGE }));
+  const invalid = problem(401, "invalid_token", "That token is unknown, revoked or expired.", { "WWW-Authenticate": `${CHALLENGE}, error="invalid_token"` });
+  const sent = bearer(header);
+  const now = d.clock.now();
+  const token = sent === null ? null : d.apiTokens.find(sent, now);
+  if (!token) {
+    const waitFailed = w.failed.take(FAILED_KEY, now.getTime());
+    if (waitFailed > 0)
+      return no(problem(429, "rate_limited", `Too many requests with bad tokens; try again in ${waitFailed} s.`, { "Retry-After": String(waitFailed) }));
+    return no(invalid);
+  }
+  const wait = w.limiter.take(token.id, now.getTime());
+  if (wait > 0)
+    return no(problem(429, "rate_limited", `Too many requests with this token; try again in ${wait} s.`, { "Retry-After": String(wait) }));
+  const user = await d.store.getUser(token.userId);
+  if (!user || !d.admissions.isRegistered(user.id)) {
+    d.apiTokens.deleteForUser(token.userId);
+    return no(invalid);
+  }
+  const found = await w.recheck(user, token.memberCheckedAt);
+  if (found === "not-member")
+    return no(problem(403, "not_member", "The token's owner is no longer a member of this tracker's server; their tokens are revoked."));
+  if (found === "unknown")
+    return no(problem(503, "membership_unknown", "I could not check that the token's owner is still a member of this tracker's server; try again later.", { "Retry-After": "60" }));
+  const current = d.apiTokens.find(sent, d.clock.now());
+  if (!current)
+    return no(invalid);
+  d.apiTokens.touch(current, d.clock.now());
+  return { ok: true, token: current, user };
+}
+async function handleApi(w, request, path) {
+  if (request.headers.get("origin") !== null)
+    return json2(problem(403, "origin_refused", "The task API is not for browsers: send no Origin header."));
+  const auth = await authenticate(w, request);
+  if (!auth.ok)
+    return json2(auth.answer);
+  const { user } = auth;
+  const r = path.startsWith(`${API_PREFIX}/`) ? route(path.slice(API_PREFIX.length)) : null;
+  if (r === null)
+    return json2(problem(404, "not_found", "No such endpoint."));
+  const allowed = allowedMethods(r);
+  const method = request.method;
+  if (!allowed.split(", ").includes(method))
+    return json2(problem(405, "method_not_allowed", `Use ${allowed}.`, { Allow: allowed }));
+  const writer = { d: w.d, queue: w.queue, reading: w.reading, userId: user.id };
+  const base = `${w.base}${API_PREFIX}`;
+  if (method === "POST" || method === "PATCH") {
+    const read = await readJson(request);
+    if (!read.ok)
+      return json2(read.answer);
+    const { body } = read;
+    if (r.kind === "tasks")
+      return json2(await createAnswer(writer, user, body, base));
+    if (r.kind === "task")
+      return json2(await editAnswer(writer, user, r.id, body, base));
+    if (r.kind === "act") {
+      if (Object.keys(body).length > 0)
+        return json2(problem(400, "unknown_field", `\`${r.action}\` takes no fields: send {}.`));
+      return json2(await actAnswer(writer, user, r.id, r.action));
+    }
+  }
+  if (method === "DELETE" && r.kind === "task")
+    return json2(await actAnswer(writer, user, r.id, "delete"));
+  if (r.kind === "types")
+    return json2(typesAnswer());
+  if (r.kind === "tasks")
+    return json2(await listAnswer(w.d, user));
+  if (r.kind === "task")
+    return json2(await getAnswer(w.d, user, r.id));
+  return json2({
+    status: 200,
+    body: {
+      user: { id: user.id, name: user.displayName, timeZone: user.timeZone, preferredHour: user.preferredHour },
+      token: { id: auth.token.id, name: auth.token.name, createdAt: auth.token.createdAt, expiresAt: auth.token.expiresAt }
+    }
+  });
+}
+
+// plugins/tracker/src/web/tokens.ts
+var MAX_CREATIONS_PER_HOUR = 10;
+var HOUR_MS = 60 * 60 * 1000;
+var TOO_MANY_CREATED = `You have made ${MAX_CREATIONS_PER_HOUR} tokens in the last hour, the most one person may. Try again later.`;
+
+class CreationLog {
+  made = new Map;
+  recent(userId, nowMs) {
+    const times = (this.made.get(userId) ?? []).filter((t) => t > nowMs - HOUR_MS && t <= nowMs);
+    if (times.length === 0)
+      this.made.delete(userId);
+    else
+      this.made.set(userId, times);
+    return times;
+  }
+  full(userId, nowMs) {
+    return this.recent(userId, nowMs).length >= MAX_CREATIONS_PER_HOUR;
+  }
+  record(userId, nowMs) {
+    this.made.set(userId, [...this.recent(userId, nowMs), nowMs]);
+  }
+}
+var TOKEN_SENT = "Your new token is in your Discord DMs from this bot. It is not shown here, and the tracker keeps only a hash of it.";
+var TOKEN_NOT_SENT = "I could not DM you the token, so none was made. Open your DMs from this server's members and try again.";
+function tokenMessage(name, token, expiresAt) {
+  return [
+    `Your tracker API token "${name}"${expiresAt ? `, expiring ${expiresAt.slice(0, 10)}` : ""}:`,
+    `\`${token}\``,
+    "Anyone holding it can use the tracker's task API as you: keep it secret, and revoke it on the web area's API tokens page when you no longer need it. If you did not make it, revoke it now."
+  ].join(`
+`);
+}
+function tokensGet(d, v) {
+  return htmlResponse(tokensPage(v, d.apiTokens.listFor(v.user.id, d.clock.now()), d.clock.now()));
+}
+async function tokensPost(d, v, session, form, log) {
+  const now = d.clock.now();
+  const name = (form.get("name") ?? "").slice(0, 200);
+  const expiry = form.get("expiry") ?? String(DEFAULT_EXPIRY_DAYS);
+  const days = expiryChoice(expiry);
+  const refuse = (error) => htmlResponse(tokensPage(v, d.apiTokens.listFor(v.user.id, d.clock.now()), d.clock.now(), { error, name, expiry: days === undefined ? String(DEFAULT_EXPIRY_DAYS) : expiry }), 400);
+  if (days === undefined)
+    return refuse("Choose when the token expires.");
+  const discordId = v.user.discordId;
+  if (!d.dm || !discordId)
+    return refuse(TOKEN_NOT_SENT);
+  if (log.full(v.user.id, now.getTime()))
+    return refuse(TOO_MANY_CREATED);
+  const made = d.apiTokens.create(v.user.id, { name, days }, now, session.memberCheckedAt);
+  if (!made.ok)
+    return refuse(made.error);
+  log.record(v.user.id, now.getTime());
+  try {
+    await d.dm(discordId, { content: tokenMessage(made.row.name, made.token, made.row.expiresAt) });
+  } catch (err) {
+    d.apiTokens.revokeOwn(v.user.id, made.row.id);
+    d.log.warn(`${v.user.id}'s API token ${made.row.id} deleted: the DM carrying it failed (${err instanceof Error ? err.message : String(err)})`);
+    return refuse(TOKEN_NOT_SENT);
+  }
+  d.log.info(`${v.user.id} made API token ${made.row.id}`);
+  return htmlResponse(tokensPage(v, d.apiTokens.listFor(v.user.id, d.clock.now()), d.clock.now(), { result: `"${made.row.name}": ${TOKEN_SENT}` }));
+}
+function tokenRevokePost(d, v, id) {
+  if (!d.apiTokens.revokeOwn(v.user.id, id))
+    return htmlResponse(notFoundPage(v.base, v), 404);
+  d.log.info(`${v.user.id} revoked their API token ${id}`);
+  const now = d.clock.now();
+  return htmlResponse(tokensPage(v, d.apiTokens.listFor(v.user.id, now), now, { result: "Revoked: that token no longer works." }));
+}
+
 // plugins/tracker/src/web/routes.ts
 var TASK_PATH = /^\/tasks\/([^/]+)$/;
 var TASK_ACTION = /^\/tasks\/([^/]+)\/(edit|pause|resume|delete)$/;
@@ -6979,17 +7599,19 @@ var NEW_PATH = /^\/new\/([a-z]+)$/;
 var PERSON_PATH = /^\/admin\/people\/([^/]+)$/;
 var PERSON_ACTION = /^\/admin\/people\/([^/]+)\/(grant|revoke|resume-delivery|forget)$/;
 var BLOCK_LIFT = /^\/admin\/blocks\/([^/]+)\/lift$/;
+var TOKEN_REVOKE = /^\/tokens\/([^/]+)\/revoke$/;
+var ADMIN_TOKEN_REVOKE = /^\/admin\/tokens\/([^/]+)\/revoke$/;
 function isAdminRoute(r) {
   return r.kind.startsWith("admin");
 }
-function segment(raw) {
+function segment2(raw) {
   try {
     return decodeURIComponent(raw ?? "");
   } catch {
     return "";
   }
 }
-function route(path) {
+function route2(path) {
   if (path === "/")
     return { kind: "tasks" };
   if (path === "/settings")
@@ -6998,6 +7620,14 @@ function route(path) {
     return { kind: "logout" };
   if (path === "/forget")
     return { kind: "forget" };
+  if (path === "/tokens")
+    return { kind: "tokens" };
+  const revoke = TOKEN_REVOKE.exec(path);
+  if (revoke)
+    return { kind: "token-revoke", id: segment2(revoke[1]) };
+  const adminRevoke = ADMIN_TOKEN_REVOKE.exec(path);
+  if (adminRevoke)
+    return { kind: "admin-token-revoke", id: segment2(adminRevoke[1]) };
   if (path === "/admin")
     return { kind: "admin" };
   if (path === "/admin/tasks")
@@ -7006,13 +7636,13 @@ function route(path) {
     return { kind: "admin-allow" };
   const personAct = PERSON_ACTION.exec(path);
   if (personAct)
-    return { kind: "admin-act", id: segment(personAct[1]), action: personAct[2] };
+    return { kind: "admin-act", id: segment2(personAct[1]), action: personAct[2] };
   const onePerson = PERSON_PATH.exec(path);
   if (onePerson)
-    return { kind: "admin-person", id: segment(onePerson[1]) };
+    return { kind: "admin-person", id: segment2(onePerson[1]) };
   const lift = BLOCK_LIFT.exec(path);
   if (lift)
-    return { kind: "admin-lift", id: segment(lift[1]) };
+    return { kind: "admin-lift", id: segment2(lift[1]) };
   const created = NEW_PATH.exec(path);
   if (created) {
     const type = created[1];
@@ -7021,7 +7651,7 @@ function route(path) {
   const one = TASK_PATH.exec(path) ?? TASK_ACTION.exec(path);
   if (!one)
     return null;
-  const id = segment(one[1]);
+  const id = segment2(one[1]);
   const action = one[2];
   if (action === undefined)
     return { kind: "task", id };
@@ -7030,9 +7660,10 @@ function route(path) {
   return { kind: "act", id, action };
 }
 function methodsOf(r) {
-  if (r.kind === "logout" || r.kind === "act" || r.kind === "admin-allow" || r.kind === "admin-act" || r.kind === "admin-lift")
+  if (r.kind === "logout" || r.kind === "act" || r.kind === "admin-allow" || r.kind === "admin-act" || r.kind === "admin-lift" || r.kind === "token-revoke" || r.kind === "admin-token-revoke") {
     return "POST";
-  if (r.kind === "settings" || r.kind === "edit" || r.kind === "new" || r.kind === "forget")
+  }
+  if (r.kind === "settings" || r.kind === "edit" || r.kind === "new" || r.kind === "forget" || r.kind === "tokens")
     return "GET, POST";
   return "GET";
 }
@@ -7109,6 +7740,9 @@ function createWebHandler(w) {
   const inFlight = new Map;
   const failedAt = new Map;
   const reading = new Set;
+  const limiter = new RateLimiter(RATE_BURST, RATE_PER_SECOND);
+  const failed = new RateLimiter(FAILED_BURST, FAILED_PER_SECOND);
+  const created = new CreationLog;
   async function authenticate(d, request) {
     const id = readCookie(request, SESSION_COOKIE);
     if (!id)
@@ -7143,14 +7777,14 @@ function createWebHandler(w) {
     const shared = pending;
     return lookupWithin(() => shared, MEMBER_CHECK_TIMEOUT_MS);
   }
-  async function recheckMembership(d, session, user) {
+  async function recheck(d, user, checkedAt) {
     if (w.guildId === null)
-      return null;
+      return "ok";
     const now = d.clock.now().getTime();
-    const age = session.memberCheckedAt ? now - Date.parse(session.memberCheckedAt) : Number.POSITIVE_INFINITY;
+    const age = checkedAt ? now - Date.parse(checkedAt) : Number.POSITIVE_INFINITY;
     const fresh = (limit) => age >= 0 && age < limit;
     if (fresh(MEMBER_RECHECK_MS))
-      return null;
+      return "ok";
     const lastFailed = failedAt.get(user.id);
     const backingOff = lastFailed !== undefined && now - lastFailed >= 0 && now - lastFailed < MEMBER_RETRY_MS;
     let found = "unknown";
@@ -7163,14 +7797,23 @@ function createWebHandler(w) {
     }
     if (found === "not-member") {
       d.sessions.deleteForUser(user.id);
-      return { kind: "signed-out", note: LEFT_SERVER };
+      d.apiTokens.deleteForUser(user.id);
+      return "not-member";
     }
     if (found === "member") {
-      d.sessions.confirmMember(user.id, d.clock.now().toISOString());
-      return null;
+      const at = d.clock.now().toISOString();
+      d.sessions.confirmMember(user.id, at);
+      d.apiTokens.confirmMember(user.id, at);
+      return "ok";
     }
-    if (fresh(MEMBER_GRACE_MS))
+    return fresh(MEMBER_GRACE_MS) ? "ok" : "unknown";
+  }
+  async function recheckMembership(d, session, user) {
+    const found = await recheck(d, user, session.memberCheckedAt);
+    if (found === "ok")
       return null;
+    if (found === "not-member")
+      return { kind: "signed-out", note: LEFT_SERVER };
     d.sessions.deleteForUser(user.id);
     return { kind: "signed-out", note: RECHECK_FAILED };
   }
@@ -7235,6 +7878,14 @@ function createWebHandler(w) {
     return redirect(`${base}/settings?saved=1`);
   }
   return async (request, info) => {
+    if (info.path === "/api" || info.path.startsWith("/api/")) {
+      if (w.origin === null)
+        return plain(404, "Not found");
+      const d = w.deps();
+      if (!d)
+        return json2(problem(503, "starting", "The tracker is starting up; try again in a minute.", { "Retry-After": "60" }));
+      return handleApi({ d, queue: w.queue, reading, base, limiter, failed, recheck: (user, at) => recheck(d, user, at) }, request, info.path);
+    }
     const method = request.method;
     if (method !== "GET" && method !== "POST")
       return plain(405, "Method not allowed", { Allow: "GET, POST" });
@@ -7260,7 +7911,7 @@ function createWebHandler(w) {
       return only("GET") ?? htmlResponse(signInHelpPage(base, signInNote(url.searchParams)));
     if (path === "/login")
       return method === "GET" ? loginGet(d, url) : loginPost(d, request);
-    const r = route(path);
+    const r = route2(path);
     if (r === null)
       return htmlResponse(notFoundPage(base), 404);
     const allowed = methodsOf(r);
@@ -7299,9 +7950,14 @@ function createWebHandler(w) {
           return actionPost(e, r.id, r.action, form);
         case "forget":
           return forgetRoute(a, method, form);
+        case "tokens":
+          return tokensPost(d, v, auth.session, form, created);
+        case "token-revoke":
+          return tokenRevokePost(d, v, r.id);
         case "admin-allow":
         case "admin-act":
         case "admin-lift":
+        case "admin-token-revoke":
           return adminPost(a, r, form);
         default:
           return plain(405, "Method not allowed", { Allow: allowed });
@@ -7320,6 +7976,8 @@ function createWebHandler(w) {
         return newGet(e, r.type);
       case "forget":
         return forgetRoute(a, method, null);
+      case "tokens":
+        return tokensGet(d, v);
       case "admin":
       case "admin-tasks":
       case "admin-person":
@@ -7526,6 +8184,7 @@ function createPlugin(host, options = {}) {
         notifier: dm ? createDmNotifier({ store: openedStore, claims: openedClaims, dm, clock, log: host.log, health: delivery }) : NO_DM,
         logins: new LoginLinks(opened),
         sessions: new Sessions(opened),
+        apiTokens: new ApiTokens(opened),
         roster: new Roster(opened),
         configuredAdmins: new Set(adminIds),
         lanes,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rackbops/plugin-tracker",
-  "version": "0.6.0",
-  "description": "The task tracker for Rackbops Clerk: reminders, renewals and price drops by slash command, delivered by DM with buttons, on docket's SQLite store (/allow, /register, /remind, /renewal, /price, /tasks, /task, /settings, /web), with a web area for your tasks, history and settings, a web editor to make, change, pause and delete your own tasks, an admin view, and forget-me",
+  "version": "0.7.0",
+  "description": "The task tracker for Rackbops Clerk: reminders, renewals and price drops by slash command, delivered by DM with buttons, on docket's SQLite store (/allow, /register, /remind, /renewal, /price, /tasks, /task, /settings, /web), with a web area for your tasks, history and settings, a web editor to make, change, pause and delete your own tasks, an admin view, forget-me, and a JSON task API with personal API tokens",
   "type": "module",
   "main": "dist/plugin.js",
   "files": ["dist"],