@rackbops/plugin-tracker 0.6.0 → 0.8.0

package/dist/plugin.js

@@ -1841,13 +1841,18 @@ function decideAccess(input) {
     return NOT_REGISTERED;
   return null;
 }
-function parseGuildId(raw) {
+function parseGuildIds(raw) {
   if (raw === undefined || raw.trim() === "")
     return null;
-  const id = raw.trim();
-  if (!/^[0-9]{17,20}$/.test(id))
-    throw new Error(`TRACKER_GUILD_ID: "${id}" is not a Discord server id`);
-  return id;
+  const ids = [];
+  for (const entry of raw.split(",")) {
+    const id = entry.trim();
+    if (!/^[0-9]{17,20}$/.test(id))
+      throw new Error(`TRACKER_GUILD_ID: "${id}" is not a Discord server id`);
+    if (!ids.includes(id))
+      ids.push(id);
+  }
+  return ids;
 }
 
 // plugins/tracker/src/admissions.ts
@@ -2372,13 +2377,22 @@ var EPHEMERAL = { flags: MessageFlags.Ephemeral };
 var NO_MENTIONS = { allowedMentions: { parse: [] } };
 var UNKNOWN_MEMBER = 10007;
 var UNKNOWN_USER = 10013;
-async function lookupMembership(interaction, guildId, discordId, log) {
-  if (guildId === null)
+async function lookupMembership(interaction, guildIds, discordId, log) {
+  if (guildIds === null)
     return "not-checked";
-  if (interaction.guildId === guildId && interaction.user.id === discordId)
+  if (interaction.guildId !== null && guildIds.includes(interaction.guildId) && interaction.user.id === discordId)
     return "member";
+  const lookups = guildIds.map((guildId) => memberOf(interaction.client, guildId, discordId, log));
+  const firstYes = new Promise((resolve) => {
+    for (const l of lookups)
+      l.then((a) => a === "member" && resolve("member"));
+  });
+  const all = Promise.all(lookups).then((answers) => answers.includes("unknown") ? "unknown" : answers.includes("member") ? "member" : "not-member");
+  return Promise.race([firstYes, all]);
+}
+async function memberOf(client, guildId, discordId, log) {
   try {
-    const guild = await interaction.client.guilds.fetch(guildId);
+    const guild = await client.guilds.fetch(guildId);
     await guild.members.fetch({ user: discordId, force: true });
     return "member";
   } catch (err) {
@@ -3687,7 +3701,7 @@ function createSurface(w) {
   const ctx = {
     deps: w.deps,
     queue: w.queue ?? serial(),
-    membershipOf: (interaction, discordId) => w.membership ? w.membership(interaction, discordId) : lookupMembership(interaction, w.guildId, discordId, w.log),
+    membershipOf: (interaction, discordId) => w.membership ? w.membership(interaction, discordId) : lookupMembership(interaction, w.guildIds, discordId, w.log),
     log: w.log
   };
   const membershipOf = (interaction, discordId) => ctx.membershipOf(interaction, discordId);
@@ -4115,6 +4129,19 @@ var MIGRATIONS = [
   );
   CREATE INDEX web_sessions_user ON web_sessions (user_id);
   CREATE INDEX web_sessions_expiry ON web_sessions (expires_at);
+  `,
+  `
+  CREATE TABLE api_tokens (
+    seq INTEGER PRIMARY KEY AUTOINCREMENT,
+    token_hash TEXT NOT NULL UNIQUE,
+    user_id TEXT NOT NULL,
+    name TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    expires_at TEXT,
+    last_used_at TEXT,
+    member_checked_at TEXT
+  );
+  CREATE INDEX api_tokens_user ON api_tokens (user_id);
   `
 ];
 var BUSY_TIMEOUT_MS = 5000;
@@ -4340,6 +4367,7 @@ class Roster {
       del("delivery_health", "user_id = ?", userId);
       del("web_sessions", "user_id = ?", userId);
       del("web_login_tokens", "user_id = ?", userId);
+      del("api_tokens", "user_id = ?", userId);
       del("users", "seq = ?", Number(seq));
       const held = this.db.query("SELECT 1 FROM delivery_pauses WHERE task_id = ? LIMIT 1");
       const freed = [...new Set(pausedFor)].filter((t) => held.get(t) === null);
@@ -6182,6 +6210,10 @@ ${form.error ? html`<div class="rb-alert rb-alert--danger" role="alert"><p class
 </form>
 </section>
 <section>
+<h2>API tokens</h2>
+<p>For a program that uses the tracker's task API as you. <a class="rb-link" href="${v.base}/tokens">API tokens</a></p>
+</section>
+<section>
 <h2>Forget me</h2>
 <p>Delete everything the tracker holds about you, for good. <a class="rb-link" href="${v.base}/forget">Forget me</a></p>
 </section>`);
@@ -6335,6 +6367,166 @@ function notice(key, error) {
   return text ? html`<div class="rb-alert rb-alert--success" role="status"><p class="rb-alert__title">${text}</p></div>` : null;
 }
 
+// plugins/tracker/src/web/api-tokens.ts
+var TOKEN_PREFIX = "trk_";
+var MAX_TOKENS_PER_PERSON = 10;
+var MAX_TOKEN_NAME = 50;
+var TOKEN_EXPIRY_DAYS = [30, 90, 365];
+var DEFAULT_EXPIRY_DAYS = 90;
+var DAY_MS3 = 24 * 60 * 60 * 1000;
+var TOUCH_EVERY_MS = 60 * 1000;
+function isApiTokenShape(value) {
+  return /^trk_[A-Za-z0-9_-]{43}$/.test(value);
+}
+function isTokenId(id) {
+  return /^k[1-9][0-9]{0,15}$/.test(id);
+}
+function expiryChoice(raw) {
+  const days = Number(raw);
+  return TOKEN_EXPIRY_DAYS.includes(days) ? days : undefined;
+}
+var COLUMNS = "seq, user_id, name, created_at, expires_at, last_used_at, member_checked_at";
+function toToken(r) {
+  return {
+    id: `k${Number(r.seq)}`,
+    userId: r.user_id,
+    name: r.name,
+    createdAt: r.created_at,
+    expiresAt: r.expires_at,
+    lastUsedAt: r.last_used_at,
+    memberCheckedAt: r.member_checked_at
+  };
+}
+
+class ApiTokens {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  create(userId, input, now, memberCheckedAt) {
+    const name = input.name.trim();
+    if (name.length === 0)
+      return { ok: false, error: "Give the token a name, such as the program that will use it." };
+    if (name.length > MAX_TOKEN_NAME)
+      return { ok: false, error: `That name is longer than ${MAX_TOKEN_NAME} characters.` };
+    if (/[\u0000-\u001f\u007f]/.test(name))
+      return { ok: false, error: "That name has a control character in it." };
+    if (!TOKEN_EXPIRY_DAYS.includes(input.days))
+      return { ok: false, error: "Choose when the token expires." };
+    const at = now.toISOString();
+    return this.db.transaction(() => {
+      const seq = /^u([1-9][0-9]*)$/.exec(userId)?.[1];
+      if (seq === undefined || this.db.query("SELECT 1 FROM users WHERE seq = ?").get(Number(seq)) === null) {
+        return { ok: false, error: "You are no longer on this tracker's list." };
+      }
+      this.db.query("DELETE FROM api_tokens WHERE expires_at IS NOT NULL AND expires_at <= ?").run(at);
+      const live = this.db.query("SELECT COUNT(*) AS n FROM api_tokens WHERE user_id = ?").get(userId).n;
+      if (live >= MAX_TOKENS_PER_PERSON) {
+        return { ok: false, error: `You already have ${MAX_TOKENS_PER_PERSON} API tokens, the most one person may. Revoke one first.` };
+      }
+      const token = `${TOKEN_PREFIX}${randomToken()}`;
+      const expiresAt = new Date(now.getTime() + input.days * DAY_MS3).toISOString();
+      const r = this.db.query(`INSERT INTO api_tokens (token_hash, user_id, name, created_at, expires_at, last_used_at, member_checked_at)
+           VALUES (?, ?, ?, ?, ?, NULL, ?) RETURNING ${COLUMNS}`).get(sha256(token), userId, name, at, expiresAt, memberCheckedAt);
+      return { ok: true, token, row: toToken(r) };
+    })();
+  }
+  find(token, now) {
+    if (!isApiTokenShape(token))
+      return null;
+    const r = this.db.query(`SELECT ${COLUMNS} FROM api_tokens WHERE token_hash = ? AND (expires_at IS NULL OR expires_at > ?)`).get(sha256(token), now.toISOString());
+    return r ? toToken(r) : null;
+  }
+  get(id) {
+    if (!isTokenId(id))
+      return null;
+    const r = this.db.query(`SELECT ${COLUMNS} FROM api_tokens WHERE seq = ?`).get(Number(id.slice(1)));
+    return r ? toToken(r) : null;
+  }
+  listFor(userId, now) {
+    const rows = this.db.query(`SELECT ${COLUMNS} FROM api_tokens WHERE user_id = ? AND (expires_at IS NULL OR expires_at > ?) ORDER BY seq`).all(userId, now.toISOString());
+    return rows.map(toToken);
+  }
+  touch(token, now) {
+    if (!isTokenId(token.id))
+      return false;
+    if (token.lastUsedAt !== null && now.getTime() - Date.parse(token.lastUsedAt) < TOUCH_EVERY_MS && Date.parse(token.lastUsedAt) <= now.getTime())
+      return false;
+    const cutoff = new Date(now.getTime() - TOUCH_EVERY_MS).toISOString();
+    return this.db.query("UPDATE api_tokens SET last_used_at = ? WHERE seq = ? AND (last_used_at IS NULL OR last_used_at <= ? OR last_used_at > ?)").run(now.toISOString(), Number(token.id.slice(1)), cutoff, now.toISOString()).changes > 0;
+  }
+  revokeOwn(userId, id) {
+    if (!isTokenId(id))
+      return false;
+    return this.db.query("DELETE FROM api_tokens WHERE seq = ? AND user_id = ?").run(Number(id.slice(1)), userId).changes > 0;
+  }
+  revokeAny(id) {
+    if (!isTokenId(id))
+      return null;
+    const r = this.db.query("DELETE FROM api_tokens WHERE seq = ? RETURNING user_id").get(Number(id.slice(1)));
+    return r ? r.user_id : null;
+  }
+  deleteForUser(userId) {
+    this.db.query("DELETE FROM api_tokens WHERE user_id = ?").run(userId);
+  }
+  confirmMember(userId, at) {
+    this.db.query("UPDATE api_tokens SET member_checked_at = ? WHERE user_id = ?").run(at, userId);
+  }
+}
+
+// plugins/tracker/src/web/token-pages.ts
+function tokenHref(v, id) {
+  return `${v.base}/tokens/${encodeURIComponent(id)}/revoke`;
+}
+function adminTokenHref(v, id) {
+  return `${v.base}/admin/tokens/${encodeURIComponent(id)}/revoke`;
+}
+function at(iso, viewer, now, none) {
+  return iso ? formatInstant(iso, viewer.timeZone, now) : none;
+}
+function tokenTable(v, tokens, now, href) {
+  if (tokens.length === 0)
+    return html`<p class="rb-muted">None.</p>`;
+  return html`<div class="rb-table-scroll"><table class="rb-table">
+<thead><tr><th>Name</th><th>Made</th><th>Last used</th><th>Expires</th><th></th></tr></thead>
+<tbody>${tokens.map((t) => html`<tr>
+<td>${t.name}</td>
+<td>${at(t.createdAt, v.user, now, "")}</td>
+<td>${at(t.lastUsedAt, v.user, now, "never")}</td>
+<td>${at(t.expiresAt, v.user, now, "never")}</td>
+<td><form method="post" action="${href(t.id)}"><input type="hidden" name="csrf" value="${v.csrf}"><button class="rb-btn rb-btn--danger rb-btn--sm" type="submit">Revoke</button></form></td>
+</tr>`)}</tbody>
+</table></div>`;
+}
+function tokensPage(v, tokens, now, f = {}) {
+  const expiry = f.expiry ?? String(DEFAULT_EXPIRY_DAYS);
+  const choices = TOKEN_EXPIRY_DAYS.map((d) => [String(d), `in ${d} days`]);
+  return framed(v, "API tokens", html`<section>
+<p><a class="rb-link" href="${v.base}/settings">Settings</a></p>
+<h1>API tokens</h1>
+<p>A token lets a program use the tracker's task API as you: list, read, make, edit, pause, resume and delete your own tasks, nothing more. Send it as <code>Authorization: Bearer &lt;token&gt;</code> to <code>${v.base}/api/v1/</code>. Anyone holding it can act as you, so keep it secret, and revoke it when the program no longer needs it. A new token is sent to you by Discord DM, once, and never shown here. At most ${MAX_TOKENS_PER_PERSON}, each for a year at most.</p>
+${f.result ? html`<div class="rb-alert rb-alert--success" role="status"><p>${f.result}</p></div>` : null}
+${f.error ? html`<div class="rb-alert rb-alert--danger" role="alert"><p class="rb-alert__title">Not made</p><p>${f.error}</p></div>` : null}
+${tokenTable(v, tokens, now, (id) => tokenHref(v, id))}
+</section>
+<section>
+<h2>Make a token</h2>
+<form method="post" action="${v.base}/tokens" class="tr-stack">
+<input type="hidden" name="csrf" value="${v.csrf}">
+<div class="rb-field">
+<label class="rb-label" for="name">Name</label>
+<input class="rb-input" id="name" name="name" value="${f.name ?? ""}" maxlength="${MAX_TOKEN_NAME}" required>
+<p class="rb-field__help">What will use it, so you know which to revoke.</p>
+</div>
+<div class="rb-field">
+<label class="rb-label" for="expiry">Expires</label>
+<select class="rb-select" id="expiry" name="expiry">${choices.map(([value, label]) => html`<option value="${value}"${value === expiry ? html` selected` : null}>${label}</option>`)}</select>
+</div>
+<div><button class="rb-btn rb-btn--primary" type="submit">Make token</button></div>
+</form>
+</section>`);
+}
+
 // plugins/tracker/src/web/admin-pages.ts
 var CONFIGURED_NOTE = "Named in TRACKER_ADMIN_DISCORD_IDS: made an admin again at every start, so they cannot be revoked or removed here. Remove them from the configuration first.";
 var CONFIRM_WORD = "forget";
@@ -6435,7 +6627,7 @@ ${tasks.length === 0 ? html`<p class="rb-muted">There are no tasks.</p>` : html`
 function post2(v, p, action, label, style) {
   return html`<form method="post" action="${personHref(v, p.id, action)}">${hidden(v)}<button class="rb-btn ${style} rb-btn--sm" type="submit">${label}</button></form>`;
 }
-function personPage(v, p, tasks, now, result = null, configured = false) {
+function personPage(v, p, tasks, now, result = null, configured = false, tokens = []) {
   return framed(v, nameOf(p), html`<section>
 ${adminNav(v)}
 <h1>${nameOf(p)}${p.admin ? html` <span class="rb-badge">admin</span>` : null}</h1>
@@ -6457,9 +6649,14 @@ ${configured && p.id !== v.user.id ? null : post2(v, p, "forget", "Remove from t
 <section>
 <h2>Their tasks</h2>
 ${tasks.length === 0 ? html`<p class="rb-muted">None.</p>` : html`<ul>${tasks.map((t) => html`<li><a class="rb-link" href="${taskHref(v, t.id)}">${t.title}</a> -- ${t.type}, ${t.status === "archived" ? "deleted" : t.status}</li>`)}</ul>`}
+</section>
+<section>
+<h2>Their API tokens</h2>
+<p class="rb-muted">Each acts as them on their own tasks. Revoking one stops it at once; they are not told.</p>
+${tokenTable(v, tokens, now, (id) => adminTokenHref(v, id))}
 </section>`);
 }
-var WHAT_GOES = "every task (deleted ones too) with its runs, replies and history; your replies, answers and history on other people's tasks, " + "and your place on the tasks shared with you; decline blocks either way; delivery pauses; your settings and sign-in sessions; and your place on the list.";
+var WHAT_GOES = "every task (deleted ones too) with its runs, replies and history; your replies, answers and history on other people's tasks, " + "and your place on the tasks shared with you; decline blocks either way; delivery pauses; your settings, sign-in sessions and API tokens; and your place on the list.";
 function forgetPage(v, note) {
   return framed(v, "Forget me", html`<section class="rb-card">
 <h1>Forget me</h1>
@@ -6520,7 +6717,8 @@ async function onePerson(a, id, result = null) {
   if (!p)
     return htmlResponse(notFoundPage(a.v.base, a.v), 404);
   const tasks = await a.d.store.listTasks({ ownerId: p.id });
-  return htmlResponse(personPage(a.v, p, tasks, a.d.clock.now(), result, isConfiguredAdmin(a.d, p)), result && !result.ok ? 400 : 200);
+  const tokens = a.d.apiTokens.listFor(p.id, a.d.clock.now());
+  return htmlResponse(personPage(a.v, p, tasks, a.d.clock.now(), result, isConfiguredAdmin(a.d, p), tokens), result && !result.ok ? 400 : 200);
 }
 async function adminGet(a, r) {
   if (r.kind === "admin")
@@ -6554,6 +6752,19 @@ async function adminPost(a, r, form) {
       return unknownPage(base);
     return peoplePage(a, said2(done), done.ok ? 200 : 400);
   }
+  if (r.kind === "admin-token-revoke") {
+    const owner = await fresh(a, true, async (me) => {
+      const whose = a.d.apiTokens.revokeAny(r.id);
+      if (whose !== null)
+        a.d.log.info(`${me.id} revoked API token ${r.id} of ${whose}`);
+      return { whose };
+    });
+    if (owner === null)
+      return unknownPage(base);
+    if (owner.whose === null)
+      return htmlResponse(notFoundPage(base, a.v), 404);
+    return onePerson(a, owner.whose, { ok: true, text: "Revoked: that token no longer works." });
+  }
   if (r.kind !== "admin-act")
     return unknownPage(base);
   if (r.action === "forget") {
@@ -6657,10 +6868,10 @@ async function editReminder(d, user, taskId, input) {
     updated = await rescheduleKeepingSnoozes(d, updated, user, plan.schedule, user.id);
   return { ok: true, task: updated, text: savedText(updated, user, await nextRun(d, updated), d.clock.now(), "(reminder)") };
 }
-var DAY_MS3 = 24 * 60 * 60 * 1000;
+var DAY_MS4 = 24 * 60 * 60 * 1000;
 function periodDateFrom(s, date, owner) {
   const ctx = { zone: owner.timeZone, preferredHour: owner.preferredHour };
-  let after = new Date(Date.parse(`${date}T00:00:00Z`) - ((s.leadDays ?? 0) + 2) * DAY_MS3);
+  let after = new Date(Date.parse(`${date}T00:00:00Z`) - ((s.leadDays ?? 0) + 2) * DAY_MS4);
   for (let i = 0;i < 1000; i++) {
     const due = nextDue(s, after, ctx);
     if (!due)
@@ -6767,15 +6978,7 @@ async function editPrice(d, user, taskId, input) {
   return { ok: true, task: updated, text: savedText(updated, user, await nextRun(d, updated), d.clock.now(), "(price)") };
 }
 
-// plugins/tracker/src/web/editor.ts
-var READING = "I am still reading the page of your last new price tracker; try again when it is done.";
-var GONE = NO_LONGER_LISTED;
-function asViewer(e, fn) {
-  return e.queue(async () => {
-    const user = await e.d.store.getUser(e.v.user.id);
-    return user ? fn(user) : { ok: false, error: GONE };
-  });
-}
+// plugins/tracker/src/web/form-input.ts
 var str2 = (form, name) => form.get(name) ?? "";
 var opt = (form, name) => str2(form, name).trim() === "" ? undefined : str2(form, name);
 function int(form, name) {
@@ -6825,6 +7028,10 @@ function priceSettings(form) {
     ...baseline !== undefined ? { baseline } : {}
   };
 }
+function priceInput(form) {
+  const near = opt(form, "near");
+  return { url: str2(form, "url"), ...priceSettings(form), ...near !== undefined ? { near } : {} };
+}
 function reminderEdit(form) {
   const text = opt(form, "text");
   const when = opt(form, "when");
@@ -6854,56 +7061,7 @@ function priceEdit(form) {
   const { name: _name, ...rest } = priceSettings(form);
   return { ...rest, ...form.has("name") ? { name: str2(form, "name") } : {} };
 }
-var DEFAULTS = {
-  reminder: { repeat: "none" },
-  renewal: { unit: "year", every: "1", lead: "7" },
-  price: { hours: "12", drop: "10", baseline: "last" }
-};
-function newGet(e, type) {
-  return htmlResponse(newTaskPage(e.v, type, type === "renewal" ? { ...DEFAULTS.renewal, currency: "USD" } : DEFAULTS[type]));
-}
-async function newPost(e, type, form) {
-  let made;
-  if (type === "reminder")
-    made = await asViewer(e, (u) => createReminder(e.d, u, reminderInput(form)));
-  else if (type === "renewal")
-    made = await asViewer(e, (u) => createRenewal(e.d, u, renewalInput(form)));
-  else {
-    const near = opt(form, "near");
-    const input = { url: str2(form, "url"), ...priceSettings(form), ...near !== undefined ? { near } : {} };
-    const who = e.v.user.id;
-    if (e.reading.has(who))
-      made = { ok: false, error: READING };
-    else {
-      e.reading.add(who);
-      try {
-        const started = await asViewer(e, (u) => startPrice(e.d, u, input));
-        if (!started.ok)
-          made = started;
-        else {
-          const { pending } = started;
-          const seen = await previewPrice(e.d, pending);
-          made = await asViewer(e, (u) => finishPrice(e.d, u, pending, seen));
-        }
-      } finally {
-        e.reading.delete(who);
-      }
-    }
-  }
-  if (!made.ok)
-    return htmlResponse(newTaskPage(e.v, type, typed(type, "new", form), made.error), 400);
-  return redirect(`${taskHref(e.v, made.task.id)}?done=created`);
-}
-async function taskPage(e, id, done, error) {
-  const view = await loadHistory(e.d, e.v.user, id);
-  if (!view)
-    return htmlResponse(notFoundPage(e.v.base, e.v), 404);
-  const own = view.task.ownerId === e.v.user.id;
-  const controls = own ? ownerControls(e.v, view.task) : null;
-  const owner = own ? null : (await e.d.store.getUser(view.task.ownerId))?.displayName ?? view.task.ownerId;
-  return htmlResponse(historyPage(e.v, view, { controls, flash: notice(done, error), owner }), error ? 400 : 200);
-}
-function current(d, user, task) {
+function editValues(d, user, task) {
   const now = d.clock.now();
   if (task.type === "reminder")
     return { text: String(task.config?.text ?? ""), when: "", repeat: repeatOf(task.schedule) };
@@ -6929,28 +7087,93 @@ function current(d, user, task) {
   const every = task.schedule?.kind === "poll" ? task.schedule.every : 12;
   return { name: task.title, hours: String(every), drop: String(c.dropPercent ?? 10), baseline: c.baseline ?? "last" };
 }
+
+// plugins/tracker/src/web/editor.ts
+var READING = "I am still reading the page of your last new price tracker; try again when it is done.";
+var GONE = NO_LONGER_LISTED;
+var writer = (e) => ({ d: e.d, queue: e.queue, reading: e.reading, userId: e.v.user.id });
+function asUser(w, fn) {
+  return w.queue(async () => {
+    const user = await w.d.store.getUser(w.userId);
+    return user ? fn(user) : { ok: false, error: GONE };
+  });
+}
+async function makeTask(w, type, form) {
+  if (type === "reminder")
+    return asUser(w, (u) => createReminder(w.d, u, reminderInput(form)));
+  if (type === "renewal")
+    return asUser(w, (u) => createRenewal(w.d, u, renewalInput(form)));
+  const input = priceInput(form);
+  if (w.reading.has(w.userId))
+    return { ok: false, error: READING };
+  w.reading.add(w.userId);
+  try {
+    const started = await asUser(w, (u) => startPrice(w.d, u, input));
+    if (!started.ok)
+      return started;
+    const { pending } = started;
+    const seen = await previewPrice(w.d, pending);
+    return await asUser(w, (u) => finishPrice(w.d, u, pending, seen));
+  } finally {
+    w.reading.delete(w.userId);
+  }
+}
+async function editableTask(d, user, id) {
+  const task = await ownLiveTask(d, user, id);
+  return task && (task.type === "reminder" || task.type === "renewal" || task.type === "price") ? task : null;
+}
+function saveEdit(w, task, form) {
+  if (task.type === "reminder")
+    return asUser(w, (u) => editReminder(w.d, u, task.id, reminderEdit(form)));
+  if (task.type === "renewal")
+    return asUser(w, (u) => editRenewal(w.d, u, task.id, renewalEdit(form)));
+  return asUser(w, (u) => editPrice(w.d, u, task.id, priceEdit(form)));
+}
+function actOn(w, taskId, action) {
+  const act = action === "pause" ? pauseTask : action === "resume" ? resumeTask : deleteTask;
+  return asUser(w, (u) => act(w.d, u, taskId));
+}
+var DEFAULTS = {
+  reminder: { repeat: "none" },
+  renewal: { unit: "year", every: "1", lead: "7" },
+  price: { hours: "12", drop: "10", baseline: "last" }
+};
+function newGet(e, type) {
+  return htmlResponse(newTaskPage(e.v, type, type === "renewal" ? { ...DEFAULTS.renewal, currency: "USD" } : DEFAULTS[type]));
+}
+async function newPost(e, type, form) {
+  const made = await makeTask(writer(e), type, form);
+  if (!made.ok)
+    return htmlResponse(newTaskPage(e.v, type, typed(type, "new", form), made.error), 400);
+  return redirect(`${taskHref(e.v, made.task.id)}?done=created`);
+}
+async function taskPage(e, id, done, error) {
+  const view = await loadHistory(e.d, e.v.user, id);
+  if (!view)
+    return htmlResponse(notFoundPage(e.v.base, e.v), 404);
+  const own = view.task.ownerId === e.v.user.id;
+  const controls = own ? ownerControls(e.v, view.task) : null;
+  const owner = own ? null : (await e.d.store.getUser(view.task.ownerId))?.displayName ?? view.task.ownerId;
+  return htmlResponse(historyPage(e.v, view, { controls, flash: notice(done, error), owner }), error ? 400 : 200);
+}
 function editPage(e, task, values, error) {
   const now = task.schedule ? describeSchedule(task.schedule, e.v.user, e.v.user.timeZone, e.d.clock.now()) : "no schedule";
   const page = task.type === "price" ? String(task.config.url) : undefined;
   return editTaskPage(e.v, task, values, { now, ...page !== undefined ? { page } : {}, ...error !== undefined ? { error } : {} });
 }
-async function editableTask(e, id) {
-  const task = await ownLiveTask(e.d, e.v.user, id);
-  return task && (task.type === "reminder" || task.type === "renewal" || task.type === "price") ? task : null;
-}
 async function editGet(e, id) {
-  const task = await editableTask(e, id);
+  const task = await editableTask(e.d, e.v.user, id);
   if (!task)
     return htmlResponse(notFoundPage(e.v.base, e.v), 404);
   if (task.status !== "active" && task.status !== "paused")
     return redirect(taskHref(e.v, task.id));
-  return htmlResponse(editPage(e, task, current(e.d, e.v.user, task)));
+  return htmlResponse(editPage(e, task, editValues(e.d, e.v.user, task)));
 }
 async function editPost(e, id, form) {
-  const task = await editableTask(e, id);
+  const task = await editableTask(e.d, e.v.user, id);
   if (!task)
     return htmlResponse(notFoundPage(e.v.base, e.v), 404);
-  const saved = task.type === "reminder" ? await asViewer(e, (u) => editReminder(e.d, u, task.id, reminderEdit(form))) : task.type === "renewal" ? await asViewer(e, (u) => editRenewal(e.d, u, task.id, renewalEdit(form))) : await asViewer(e, (u) => editPrice(e.d, u, task.id, priceEdit(form)));
+  const saved = await saveEdit(writer(e), task, form);
   if (saved.ok)
     return redirect(`${taskHref(e.v, task.id)}?done=saved`);
   if (saved.error === NO_SUCH_TASK)
@@ -6961,10 +7184,9 @@ async function actionPost(e, id, action, form) {
   const task = await ownLiveTask(e.d, e.v.user, id);
   if (!task)
     return htmlResponse(notFoundPage(e.v.base, e.v), 404);
-  if (action === "delete" && str2(form, "confirm") !== "yes")
+  if (action === "delete" && form.get("confirm") !== "yes")
     return htmlResponse(confirmDeletePage(e.v, task));
-  const act = action === "pause" ? pauseTask : action === "resume" ? resumeTask : deleteTask;
-  const done = await asViewer(e, (u) => act(e.d, u, task.id));
+  const done = await actOn(writer(e), task.id, action);
   if (!done.ok)
     return done.error === NO_SUCH_TASK ? htmlResponse(notFoundPage(e.v.base, e.v), 404) : taskPage(e, task.id, null, done.error);
   if (action === "delete")
@@ -6972,6 +7194,418 @@ async function actionPost(e, id, action, form) {
   return redirect(`${taskHref(e.v, task.id)}?done=${action === "pause" ? "paused" : "resumed"}`);
 }
 
+// plugins/tracker/src/web/api-tasks.ts
+function problem(status, code, message, headers) {
+  return { status, body: { error: { code, message } }, ...headers ? { headers } : {} };
+}
+var NOT_FOUND_MESSAGE = "No such task.";
+var notFound = () => problem(404, "not_found", NOT_FOUND_MESSAGE);
+function jsonKind(f) {
+  if (f.kind === "number")
+    return "integer";
+  return f.decimal ? "number" : "string";
+}
+function typesAnswer() {
+  const describe = (fields, mode) => fields.map((f) => ({
+    name: f.name,
+    type: jsonKind(f),
+    required: mode === "new" && f.required === true,
+    description: f.help ? `${f.label}. ${f.help}` : f.label,
+    ...f.maxlength !== undefined ? { maxLength: f.maxlength } : {},
+    ...f.min !== undefined ? { minimum: f.min } : {},
+    ...f.max !== undefined ? { maximum: f.max } : {},
+    ...f.options ? { enum: f.options.map(([value]) => value) } : {}
+  }));
+  return {
+    status: 200,
+    body: { types: EDITOR_TYPES.map((type) => ({ type, create: describe(fieldsFor(type, "new"), "new"), edit: describe(fieldsFor(type, "edit"), "edit") })) }
+  };
+}
+function asFields(body, type, mode) {
+  const fields = new Map(fieldsFor(type, mode).map((f) => [f.name, f]));
+  const form = new URLSearchParams;
+  for (const [key, value] of Object.entries(body)) {
+    if (mode === "new" && key === "type")
+      continue;
+    const f = fields.get(key);
+    if (!f)
+      return problem(400, "unknown_field", `\`${key.slice(0, 40)}\` is not a field of a ${type}${mode === "edit" ? " edit" : ""}. GET types lists them.`);
+    const kind = jsonKind(f);
+    if (kind === "string") {
+      if (typeof value !== "string")
+        return problem(400, "invalid", `\`${key}\` must be a string.`);
+      form.set(key, value);
+    } else {
+      if (typeof value !== "number" || !Number.isFinite(value))
+        return problem(400, "invalid", `\`${key}\` must be a number.`);
+      form.set(key, String(value));
+    }
+  }
+  return form;
+}
+function refusal(error) {
+  if (error === NO_SUCH_TASK)
+    return notFound();
+  if (error === NO_LONGER_LISTED)
+    return problem(401, "invalid_token", "The token's owner is no longer on this tracker's list.");
+  if (error === READING)
+    return problem(409, "busy", error);
+  if (error === FINISHED || /^That task is [a-z]+, not [a-z]+\.$/.test(error))
+    return problem(409, "conflict", error);
+  if (/^You already (have|track) [0-9]+ /.test(error))
+    return problem(409, "limit_reached", error);
+  if (/ (is|are) not available on this bot\.$/.test(error))
+    return problem(503, "unavailable", error);
+  return problem(400, "invalid", error);
+}
+async function nextAt(d, task) {
+  if (task.status !== "active")
+    return null;
+  const queued = await d.store.listOccurrences({ taskId: task.id, status: "queued" });
+  return queued[0]?.dueAt ?? null;
+}
+async function taskJson(d, user, task) {
+  const type = EDITOR_TYPES.includes(task.type) ? task.type : null;
+  const values = editValues(d, user, task);
+  const settings = {};
+  if (type) {
+    for (const f of fieldsFor(type, "edit")) {
+      if (f.name === "when")
+        continue;
+      const raw = values[f.name];
+      if (raw === undefined)
+        continue;
+      settings[f.name] = jsonKind(f) === "string" ? raw : Number(raw);
+    }
+  }
+  return {
+    id: task.id,
+    type: task.type,
+    title: task.title,
+    status: task.status === "archived" ? "deleted" : task.status,
+    cadence: task.schedule ? describeSchedule(task.schedule, user, user.timeZone, d.clock.now()) : "no schedule",
+    nextAt: await nextAt(d, task),
+    createdAt: task.createdAt,
+    updatedAt: task.updatedAt,
+    settings,
+    ...task.type === "price" ? { url: String(task.config.url) } : {}
+  };
+}
+async function listAnswer(d, user) {
+  const tasks = (await d.store.listTasks({ ownerId: user.id })).filter((t) => t.status !== "archived");
+  const out = [];
+  for (const t of tasks)
+    out.push(await taskJson(d, user, t));
+  return { status: 200, body: { tasks: out } };
+}
+async function getAnswer(d, user, id) {
+  const task = await ownTask(d, user, id);
+  if (!task)
+    return notFound();
+  const view = await loadHistory(d, user, task.id);
+  if (!view)
+    return notFound();
+  return {
+    status: 200,
+    body: {
+      task: await taskJson(d, user, view.task),
+      history: { next: view.next, runs: view.runs, earlierRuns: view.earlierRuns, changes: view.changes, earlierChanges: view.earlierChanges }
+    }
+  };
+}
+async function written(w, user, result, status, base) {
+  if (!result.ok)
+    return refusal(result.error);
+  const task = await w.d.store.getTask(result.task.id) ?? result.task;
+  return {
+    status,
+    body: { task: await taskJson(w.d, user, task), message: result.text },
+    ...status === 201 ? { headers: { Location: `${base}/tasks/${encodeURIComponent(task.id)}` } } : {}
+  };
+}
+async function createAnswer(w, user, body, base) {
+  const type = body.type;
+  if (typeof type !== "string" || !EDITOR_TYPES.includes(type)) {
+    return problem(400, "invalid", `\`type\` is one of ${EDITOR_TYPES.join(", ")}.`);
+  }
+  const form = asFields(body, type, "new");
+  if (!(form instanceof URLSearchParams))
+    return form;
+  return written(w, user, await makeTask(w, type, form), 201, base);
+}
+async function editAnswer(w, user, id, body, base) {
+  const task = await editableTask(w.d, user, id);
+  if (!task)
+    return notFound();
+  const form = asFields(body, task.type, "edit");
+  if (!(form instanceof URLSearchParams))
+    return form;
+  return written(w, user, await saveEdit(w, task, form), 200, base);
+}
+async function actAnswer(w, user, id, action) {
+  const task = await ownTask(w.d, user, id);
+  if (!task || task.status === "archived")
+    return notFound();
+  const done = await actOn(w, task.id, action);
+  if (!done.ok)
+    return refusal(done.error);
+  const after = await w.d.store.getTask(task.id) ?? task;
+  return { status: 200, body: { task: await taskJson(w.d, user, after), message: done.text } };
+}
+
+// plugins/tracker/src/web/api.ts
+var API_PREFIX = "/api/v1";
+var MAX_API_BYTES = 16 * 1024;
+var RATE_BURST = 60;
+var RATE_PER_SECOND = 1;
+var FAILED_BURST = 30;
+var FAILED_PER_SECOND = 0.5;
+var FAILED_KEY = "failed";
+
+class RateLimiter {
+  burst;
+  perSecond;
+  buckets = new Map;
+  constructor(burst, perSecond) {
+    this.burst = burst;
+    this.perSecond = perSecond;
+  }
+  take(key, nowMs) {
+    const b = this.buckets.get(key);
+    const elapsed = b ? Math.max(0, nowMs - b.at) / 1000 : 0;
+    const tokens = b ? Math.min(this.burst, b.tokens + elapsed * this.perSecond) : this.burst;
+    if (tokens < 1) {
+      this.buckets.set(key, { tokens, at: nowMs });
+      return Math.max(1, Math.ceil((1 - tokens) / this.perSecond));
+    }
+    this.buckets.set(key, { tokens: tokens - 1, at: nowMs });
+    if (this.buckets.size > 1e4) {
+      for (const [k, v] of this.buckets)
+        if (v.tokens + (nowMs - v.at) / 1000 * this.perSecond >= this.burst)
+          this.buckets.delete(k);
+    }
+    return 0;
+  }
+}
+var HEADERS = {
+  "Content-Type": "application/json; charset=utf-8",
+  "Cache-Control": "no-store",
+  "X-Content-Type-Options": "nosniff",
+  "Content-Security-Policy": "default-src 'none'; frame-ancestors 'none'",
+  "Referrer-Policy": "no-referrer"
+};
+function json2(a) {
+  return new Response(JSON.stringify(a.body), { status: a.status, headers: { ...HEADERS, ...a.headers ?? {} } });
+}
+var CHALLENGE = 'Bearer realm="tracker"';
+function bearer(header) {
+  if (header === null)
+    return null;
+  const m = /^Bearer +([^\s]+) *$/i.exec(header);
+  return m?.[1] ?? null;
+}
+var ACT = /^\/tasks\/([^/]+)\/(pause|resume)$/;
+var ONE = /^\/tasks\/([^/]+)$/;
+function segment(raw) {
+  try {
+    return decodeURIComponent(raw ?? "");
+  } catch {
+    return "";
+  }
+}
+function route(rest) {
+  if (rest === "/me")
+    return { kind: "me" };
+  if (rest === "/types")
+    return { kind: "types" };
+  if (rest === "/tasks")
+    return { kind: "tasks" };
+  const act = ACT.exec(rest);
+  if (act)
+    return { kind: "act", id: segment(act[1]), action: act[2] };
+  const one = ONE.exec(rest);
+  return one ? { kind: "task", id: segment(one[1]) } : null;
+}
+function allowedMethods(r) {
+  if (r.kind === "tasks")
+    return "GET, POST";
+  if (r.kind === "task")
+    return "GET, PATCH, DELETE";
+  if (r.kind === "act")
+    return "POST";
+  return "GET";
+}
+async function readJson(request) {
+  const type = (request.headers.get("content-type") ?? "").trim();
+  const no = (answer) => ({ ok: false, answer });
+  if (!/^application\/json *(;.*)?$/i.test(type))
+    return no(problem(415, "unsupported_media_type", "Send the body as Content-Type: application/json."));
+  const text = await readBody(request, MAX_API_BYTES);
+  if (text === null)
+    return no(problem(413, "too_large", `The body is over ${MAX_API_BYTES} bytes.`));
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    return no(problem(400, "invalid_json", "The body is not JSON."));
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return no(problem(400, "invalid_json", "The body must be a JSON object."));
+  return { ok: true, body: value };
+}
+async function authenticate(w, request) {
+  const { d } = w;
+  const no = (answer) => ({ ok: false, answer });
+  const header = request.headers.get("authorization");
+  if (header === null)
+    return no(problem(401, "unauthorized", "Send Authorization: Bearer <token>. Make a token on the web area's API tokens page.", { "WWW-Authenticate": CHALLENGE }));
+  const invalid = problem(401, "invalid_token", "That token is unknown, revoked or expired.", { "WWW-Authenticate": `${CHALLENGE}, error="invalid_token"` });
+  const sent = bearer(header);
+  const now = d.clock.now();
+  const token = sent === null ? null : d.apiTokens.find(sent, now);
+  if (!token) {
+    const waitFailed = w.failed.take(FAILED_KEY, now.getTime());
+    if (waitFailed > 0)
+      return no(problem(429, "rate_limited", `Too many requests with bad tokens; try again in ${waitFailed} s.`, { "Retry-After": String(waitFailed) }));
+    return no(invalid);
+  }
+  const wait = w.limiter.take(token.id, now.getTime());
+  if (wait > 0)
+    return no(problem(429, "rate_limited", `Too many requests with this token; try again in ${wait} s.`, { "Retry-After": String(wait) }));
+  const user = await d.store.getUser(token.userId);
+  if (!user || !d.admissions.isRegistered(user.id)) {
+    d.apiTokens.deleteForUser(token.userId);
+    return no(invalid);
+  }
+  const found = await w.recheck(user, token.memberCheckedAt);
+  if (found === "not-member")
+    return no(problem(403, "not_member", "The token's owner is no longer a member of this tracker's server; their tokens are revoked."));
+  if (found === "unknown")
+    return no(problem(503, "membership_unknown", "I could not check that the token's owner is still a member of this tracker's server; try again later.", { "Retry-After": "60" }));
+  const current = d.apiTokens.find(sent, d.clock.now());
+  if (!current)
+    return no(invalid);
+  d.apiTokens.touch(current, d.clock.now());
+  return { ok: true, token: current, user };
+}
+async function handleApi(w, request, path) {
+  if (request.headers.get("origin") !== null)
+    return json2(problem(403, "origin_refused", "The task API is not for browsers: send no Origin header."));
+  const auth = await authenticate(w, request);
+  if (!auth.ok)
+    return json2(auth.answer);
+  const { user } = auth;
+  const r = path.startsWith(`${API_PREFIX}/`) ? route(path.slice(API_PREFIX.length)) : null;
+  if (r === null)
+    return json2(problem(404, "not_found", "No such endpoint."));
+  const allowed = allowedMethods(r);
+  const method = request.method;
+  if (!allowed.split(", ").includes(method))
+    return json2(problem(405, "method_not_allowed", `Use ${allowed}.`, { Allow: allowed }));
+  const writer = { d: w.d, queue: w.queue, reading: w.reading, userId: user.id };
+  const base = `${w.base}${API_PREFIX}`;
+  if (method === "POST" || method === "PATCH") {
+    const read = await readJson(request);
+    if (!read.ok)
+      return json2(read.answer);
+    const { body } = read;
+    if (r.kind === "tasks")
+      return json2(await createAnswer(writer, user, body, base));
+    if (r.kind === "task")
+      return json2(await editAnswer(writer, user, r.id, body, base));
+    if (r.kind === "act") {
+      if (Object.keys(body).length > 0)
+        return json2(problem(400, "unknown_field", `\`${r.action}\` takes no fields: send {}.`));
+      return json2(await actAnswer(writer, user, r.id, r.action));
+    }
+  }
+  if (method === "DELETE" && r.kind === "task")
+    return json2(await actAnswer(writer, user, r.id, "delete"));
+  if (r.kind === "types")
+    return json2(typesAnswer());
+  if (r.kind === "tasks")
+    return json2(await listAnswer(w.d, user));
+  if (r.kind === "task")
+    return json2(await getAnswer(w.d, user, r.id));
+  return json2({
+    status: 200,
+    body: {
+      user: { id: user.id, name: user.displayName, timeZone: user.timeZone, preferredHour: user.preferredHour },
+      token: { id: auth.token.id, name: auth.token.name, createdAt: auth.token.createdAt, expiresAt: auth.token.expiresAt }
+    }
+  });
+}
+
+// plugins/tracker/src/web/tokens.ts
+var MAX_CREATIONS_PER_HOUR = 10;
+var HOUR_MS = 60 * 60 * 1000;
+var TOO_MANY_CREATED = `You have made ${MAX_CREATIONS_PER_HOUR} tokens in the last hour, the most one person may. Try again later.`;
+
+class CreationLog {
+  made = new Map;
+  recent(userId, nowMs) {
+    const times = (this.made.get(userId) ?? []).filter((t) => t > nowMs - HOUR_MS && t <= nowMs);
+    if (times.length === 0)
+      this.made.delete(userId);
+    else
+      this.made.set(userId, times);
+    return times;
+  }
+  full(userId, nowMs) {
+    return this.recent(userId, nowMs).length >= MAX_CREATIONS_PER_HOUR;
+  }
+  record(userId, nowMs) {
+    this.made.set(userId, [...this.recent(userId, nowMs), nowMs]);
+  }
+}
+var TOKEN_SENT = "Your new token is in your Discord DMs from this bot. It is not shown here, and the tracker keeps only a hash of it.";
+var TOKEN_NOT_SENT = "I could not DM you the token, so none was made. Open your DMs from this server's members and try again.";
+function tokenMessage(name, token, expiresAt) {
+  return [
+    `Your tracker API token "${name}"${expiresAt ? `, expiring ${expiresAt.slice(0, 10)}` : ""}:`,
+    `\`${token}\``,
+    "Anyone holding it can use the tracker's task API as you: keep it secret, and revoke it on the web area's API tokens page when you no longer need it. If you did not make it, revoke it now."
+  ].join(`
+`);
+}
+function tokensGet(d, v) {
+  return htmlResponse(tokensPage(v, d.apiTokens.listFor(v.user.id, d.clock.now()), d.clock.now()));
+}
+async function tokensPost(d, v, session, form, log) {
+  const now = d.clock.now();
+  const name = (form.get("name") ?? "").slice(0, 200);
+  const expiry = form.get("expiry") ?? String(DEFAULT_EXPIRY_DAYS);
+  const days = expiryChoice(expiry);
+  const refuse = (error) => htmlResponse(tokensPage(v, d.apiTokens.listFor(v.user.id, d.clock.now()), d.clock.now(), { error, name, expiry: days === undefined ? String(DEFAULT_EXPIRY_DAYS) : expiry }), 400);
+  if (days === undefined)
+    return refuse("Choose when the token expires.");
+  const discordId = v.user.discordId;
+  if (!d.dm || !discordId)
+    return refuse(TOKEN_NOT_SENT);
+  if (log.full(v.user.id, now.getTime()))
+    return refuse(TOO_MANY_CREATED);
+  const made = d.apiTokens.create(v.user.id, { name, days }, now, session.memberCheckedAt);
+  if (!made.ok)
+    return refuse(made.error);
+  log.record(v.user.id, now.getTime());
+  try {
+    await d.dm(discordId, { content: tokenMessage(made.row.name, made.token, made.row.expiresAt) });
+  } catch (err) {
+    d.apiTokens.revokeOwn(v.user.id, made.row.id);
+    d.log.warn(`${v.user.id}'s API token ${made.row.id} deleted: the DM carrying it failed (${err instanceof Error ? err.message : String(err)})`);
+    return refuse(TOKEN_NOT_SENT);
+  }
+  d.log.info(`${v.user.id} made API token ${made.row.id}`);
+  return htmlResponse(tokensPage(v, d.apiTokens.listFor(v.user.id, d.clock.now()), d.clock.now(), { result: `"${made.row.name}": ${TOKEN_SENT}` }));
+}
+function tokenRevokePost(d, v, id) {
+  if (!d.apiTokens.revokeOwn(v.user.id, id))
+    return htmlResponse(notFoundPage(v.base, v), 404);
+  d.log.info(`${v.user.id} revoked their API token ${id}`);
+  const now = d.clock.now();
+  return htmlResponse(tokensPage(v, d.apiTokens.listFor(v.user.id, now), now, { result: "Revoked: that token no longer works." }));
+}
+
 // plugins/tracker/src/web/routes.ts
 var TASK_PATH = /^\/tasks\/([^/]+)$/;
 var TASK_ACTION = /^\/tasks\/([^/]+)\/(edit|pause|resume|delete)$/;
@@ -6979,17 +7613,19 @@ var NEW_PATH = /^\/new\/([a-z]+)$/;
 var PERSON_PATH = /^\/admin\/people\/([^/]+)$/;
 var PERSON_ACTION = /^\/admin\/people\/([^/]+)\/(grant|revoke|resume-delivery|forget)$/;
 var BLOCK_LIFT = /^\/admin\/blocks\/([^/]+)\/lift$/;
+var TOKEN_REVOKE = /^\/tokens\/([^/]+)\/revoke$/;
+var ADMIN_TOKEN_REVOKE = /^\/admin\/tokens\/([^/]+)\/revoke$/;
 function isAdminRoute(r) {
   return r.kind.startsWith("admin");
 }
-function segment(raw) {
+function segment2(raw) {
   try {
     return decodeURIComponent(raw ?? "");
   } catch {
     return "";
   }
 }
-function route(path) {
+function route2(path) {
   if (path === "/")
     return { kind: "tasks" };
   if (path === "/settings")
@@ -6998,6 +7634,14 @@ function route(path) {
     return { kind: "logout" };
   if (path === "/forget")
     return { kind: "forget" };
+  if (path === "/tokens")
+    return { kind: "tokens" };
+  const revoke = TOKEN_REVOKE.exec(path);
+  if (revoke)
+    return { kind: "token-revoke", id: segment2(revoke[1]) };
+  const adminRevoke = ADMIN_TOKEN_REVOKE.exec(path);
+  if (adminRevoke)
+    return { kind: "admin-token-revoke", id: segment2(adminRevoke[1]) };
   if (path === "/admin")
     return { kind: "admin" };
   if (path === "/admin/tasks")
@@ -7006,13 +7650,13 @@ function route(path) {
     return { kind: "admin-allow" };
   const personAct = PERSON_ACTION.exec(path);
   if (personAct)
-    return { kind: "admin-act", id: segment(personAct[1]), action: personAct[2] };
+    return { kind: "admin-act", id: segment2(personAct[1]), action: personAct[2] };
   const onePerson = PERSON_PATH.exec(path);
   if (onePerson)
-    return { kind: "admin-person", id: segment(onePerson[1]) };
+    return { kind: "admin-person", id: segment2(onePerson[1]) };
   const lift = BLOCK_LIFT.exec(path);
   if (lift)
-    return { kind: "admin-lift", id: segment(lift[1]) };
+    return { kind: "admin-lift", id: segment2(lift[1]) };
   const created = NEW_PATH.exec(path);
   if (created) {
     const type = created[1];
@@ -7021,7 +7665,7 @@ function route(path) {
   const one = TASK_PATH.exec(path) ?? TASK_ACTION.exec(path);
   if (!one)
     return null;
-  const id = segment(one[1]);
+  const id = segment2(one[1]);
   const action = one[2];
   if (action === undefined)
     return { kind: "task", id };
@@ -7030,9 +7674,10 @@ function route(path) {
   return { kind: "act", id, action };
 }
 function methodsOf(r) {
-  if (r.kind === "logout" || r.kind === "act" || r.kind === "admin-allow" || r.kind === "admin-act" || r.kind === "admin-lift")
+  if (r.kind === "logout" || r.kind === "act" || r.kind === "admin-allow" || r.kind === "admin-act" || r.kind === "admin-lift" || r.kind === "token-revoke" || r.kind === "admin-token-revoke") {
     return "POST";
-  if (r.kind === "settings" || r.kind === "edit" || r.kind === "new" || r.kind === "forget")
+  }
+  if (r.kind === "settings" || r.kind === "edit" || r.kind === "new" || r.kind === "forget" || r.kind === "tokens")
     return "GET, POST";
   return "GET";
 }
@@ -7109,6 +7754,9 @@ function createWebHandler(w) {
   const inFlight = new Map;
   const failedAt = new Map;
   const reading = new Set;
+  const limiter = new RateLimiter(RATE_BURST, RATE_PER_SECOND);
+  const failed = new RateLimiter(FAILED_BURST, FAILED_PER_SECOND);
+  const created = new CreationLog;
   async function authenticate(d, request) {
     const id = readCookie(request, SESSION_COOKIE);
     if (!id)
@@ -7143,14 +7791,14 @@ function createWebHandler(w) {
     const shared = pending;
     return lookupWithin(() => shared, MEMBER_CHECK_TIMEOUT_MS);
   }
-  async function recheckMembership(d, session, user) {
-    if (w.guildId === null)
-      return null;
+  async function recheck(d, user, checkedAt) {
+    if (w.guildIds === null)
+      return "ok";
     const now = d.clock.now().getTime();
-    const age = session.memberCheckedAt ? now - Date.parse(session.memberCheckedAt) : Number.POSITIVE_INFINITY;
+    const age = checkedAt ? now - Date.parse(checkedAt) : Number.POSITIVE_INFINITY;
     const fresh = (limit) => age >= 0 && age < limit;
     if (fresh(MEMBER_RECHECK_MS))
-      return null;
+      return "ok";
     const lastFailed = failedAt.get(user.id);
     const backingOff = lastFailed !== undefined && now - lastFailed >= 0 && now - lastFailed < MEMBER_RETRY_MS;
     let found = "unknown";
@@ -7163,19 +7811,28 @@ function createWebHandler(w) {
     }
     if (found === "not-member") {
       d.sessions.deleteForUser(user.id);
-      return { kind: "signed-out", note: LEFT_SERVER };
+      d.apiTokens.deleteForUser(user.id);
+      return "not-member";
     }
     if (found === "member") {
-      d.sessions.confirmMember(user.id, d.clock.now().toISOString());
-      return null;
+      const at = d.clock.now().toISOString();
+      d.sessions.confirmMember(user.id, at);
+      d.apiTokens.confirmMember(user.id, at);
+      return "ok";
     }
-    if (fresh(MEMBER_GRACE_MS))
+    return fresh(MEMBER_GRACE_MS) ? "ok" : "unknown";
+  }
+  async function recheckMembership(d, session, user) {
+    const found = await recheck(d, user, session.memberCheckedAt);
+    if (found === "ok")
       return null;
+    if (found === "not-member")
+      return { kind: "signed-out", note: LEFT_SERVER };
     d.sessions.deleteForUser(user.id);
     return { kind: "signed-out", note: RECHECK_FAILED };
   }
   async function memberOf(discordId) {
-    if (w.guildId === null)
+    if (w.guildIds === null)
       return "not-checked";
     return await lookupWithin(() => w.membership(discordId), MEMBER_CHECK_TIMEOUT_MS) ?? "unknown";
   }
@@ -7235,6 +7892,14 @@ function createWebHandler(w) {
     return redirect(`${base}/settings?saved=1`);
   }
   return async (request, info) => {
+    if (info.path === "/api" || info.path.startsWith("/api/")) {
+      if (w.origin === null)
+        return plain(404, "Not found");
+      const d = w.deps();
+      if (!d)
+        return json2(problem(503, "starting", "The tracker is starting up; try again in a minute.", { "Retry-After": "60" }));
+      return handleApi({ d, queue: w.queue, reading, base, limiter, failed, recheck: (user, at) => recheck(d, user, at) }, request, info.path);
+    }
     const method = request.method;
     if (method !== "GET" && method !== "POST")
       return plain(405, "Method not allowed", { Allow: "GET, POST" });
@@ -7260,7 +7925,7 @@ function createWebHandler(w) {
       return only("GET") ?? htmlResponse(signInHelpPage(base, signInNote(url.searchParams)));
     if (path === "/login")
       return method === "GET" ? loginGet(d, url) : loginPost(d, request);
-    const r = route(path);
+    const r = route2(path);
     if (r === null)
       return htmlResponse(notFoundPage(base), 404);
     const allowed = methodsOf(r);
@@ -7299,9 +7964,14 @@ function createWebHandler(w) {
           return actionPost(e, r.id, r.action, form);
         case "forget":
           return forgetRoute(a, method, form);
+        case "tokens":
+          return tokensPost(d, v, auth.session, form, created);
+        case "token-revoke":
+          return tokenRevokePost(d, v, r.id);
         case "admin-allow":
         case "admin-act":
         case "admin-lift":
+        case "admin-token-revoke":
           return adminPost(a, r, form);
         default:
           return plain(405, "Method not allowed", { Allow: allowed });
@@ -7320,6 +7990,8 @@ function createWebHandler(w) {
         return newGet(e, r.type);
       case "forget":
         return forgetRoute(a, method, null);
+      case "tokens":
+        return tokensGet(d, v);
       case "admin":
       case "admin-tasks":
       case "admin-person":
@@ -7366,7 +8038,7 @@ var NO_DM = {
 };
 function createPlugin(host, options = {}) {
   const adminIds = parseAdminIds(host.env.TRACKER_ADMIN_DISCORD_IDS);
-  const guildId = parseGuildId(host.env.TRACKER_GUILD_ID);
+  const guildIds = parseGuildIds(host.env.TRACKER_GUILD_ID);
   const webOrigin = parseWebUrl(host.env.TRACKER_WEB_URL);
   const clock = options.clock ?? { now: () => new Date };
   const types = options.types ?? TRACKER_TYPES;
@@ -7382,10 +8054,10 @@ function createPlugin(host, options = {}) {
   const queue = serial();
   const surface = createSurface({
     deps: () => deps,
-    guildId,
+    guildIds,
     log: host.log,
     queue,
-    web: webOrigin ? { origin: webOrigin, name: host.name, gated: guildId !== null } : null,
+    web: webOrigin ? { origin: webOrigin, name: host.name, gated: guildIds !== null } : null,
     ...options.membership ? { membership: options.membership } : {}
   });
   async function tick(kind, signal) {
@@ -7447,14 +8119,14 @@ function createPlugin(host, options = {}) {
   const clientMembership = async (discordId) => {
     if (!discordClient)
       return null;
-    return lookupMembership({ guildId: null, user: { id: discordId }, client: discordClient }, guildId, discordId, host.log);
+    return lookupMembership({ guildId: null, user: { id: discordId }, client: discordClient }, guildIds, discordId, host.log);
   };
   const web = createWebHandler({
     name: host.name,
     origin: webOrigin,
     deps: () => deps,
     queue,
-    guildId,
+    guildIds,
     membership: options.webMembership ?? clientMembership
   });
   const interactions = surface.interactions;
@@ -7526,12 +8198,13 @@ function createPlugin(host, options = {}) {
         notifier: dm ? createDmNotifier({ store: openedStore, claims: openedClaims, dm, clock, log: host.log, health: delivery }) : NO_DM,
         logins: new LoginLinks(opened),
         sessions: new Sessions(opened),
+        apiTokens: new ApiTokens(opened),
         roster: new Roster(opened),
         configuredAdmins: new Set(adminIds),
         lanes,
         webEditor: webOrigin !== null
       };
-      if (guildId === null)
+      if (guildIds === null)
         host.log.warn("TRACKER_GUILD_ID is unset: no membership gate, only the admission list");
       health.blocked = typeof host.dm === "function" ? null : "this bot has no host.dm (it predates rackbops-discord-bot#736)";
       health.activatedAt = clock.now();