nixamp 0.15.0 → 0.16.0

package/dist/live-events.js

@@ -0,0 +1,520 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+export const LIVE_EVENT_STATUSES = [
+    "draft",
+    "scheduled",
+    "starting",
+    "live",
+    "ended",
+    "cancelled",
+    "archived",
+];
+export const LIVE_EVENT_VISIBILITIES = ["public", "unlisted", "private"];
+export const INVITATION_ROLES = ["listener", "speaker", "moderator"];
+export const INVITATION_STATES = ["pending", "accepted", "declined", "revoked", "expired"];
+export class LiveEventError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+const EVENT_SCHEMA = `
+  CREATE TABLE IF NOT EXISTS live_events (
+    id                         TEXT PRIMARY KEY,
+    slug                       TEXT NOT NULL UNIQUE,
+    owner_id                   TEXT NOT NULL,
+    title                      TEXT NOT NULL,
+    description                TEXT NOT NULL DEFAULT '',
+    topic                      TEXT NOT NULL DEFAULT '',
+    starts_at                  TIMESTAMPTZ,
+    ends_at                    TIMESTAMPTZ,
+    timezone                   TEXT NOT NULL DEFAULT 'UTC',
+    expected_duration_minutes  INTEGER,
+    status                     TEXT NOT NULL,
+    visibility                 TEXT NOT NULL,
+    room_id                    TEXT NOT NULL UNIQUE,
+    chat_enabled               BOOLEAN NOT NULL DEFAULT TRUE,
+    hand_raise_enabled         BOOLEAN NOT NULL DEFAULT TRUE,
+    recording_enabled          BOOLEAN NOT NULL DEFAULT FALSE,
+    recording_id               TEXT,
+    layout_id                  TEXT,
+    version                    INTEGER NOT NULL DEFAULT 1,
+    created_at                 TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at                 TIMESTAMPTZ NOT NULL DEFAULT now(),
+    CHECK (status IN ('draft', 'scheduled', 'starting', 'live', 'ended', 'cancelled', 'archived')),
+    CHECK (visibility IN ('public', 'unlisted', 'private')),
+    CHECK (expected_duration_minutes IS NULL OR expected_duration_minutes BETWEEN 1 AND 1440),
+    CHECK (ends_at IS NULL OR starts_at IS NULL OR ends_at > starts_at)
+  );
+  CREATE INDEX IF NOT EXISTS live_events_discovery
+    ON live_events (visibility, status, starts_at, updated_at DESC);
+  CREATE INDEX IF NOT EXISTS live_events_owner
+    ON live_events (owner_id, updated_at DESC);
+
+  CREATE TABLE IF NOT EXISTS live_event_invitations (
+    id          TEXT PRIMARY KEY,
+    event_id    TEXT NOT NULL REFERENCES live_events(id) ON DELETE CASCADE,
+    inviter_id  TEXT NOT NULL,
+    invitee_id  TEXT,
+    email        TEXT,
+    role         TEXT NOT NULL,
+    state        TEXT NOT NULL DEFAULT 'pending',
+    token_hash   TEXT NOT NULL UNIQUE,
+    expires_at   TIMESTAMPTZ,
+    created_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
+    CHECK (role IN ('listener', 'speaker', 'moderator')),
+    CHECK (state IN ('pending', 'accepted', 'declined', 'revoked', 'expired')),
+    CHECK (invitee_id IS NOT NULL OR email IS NOT NULL)
+  );
+  CREATE INDEX IF NOT EXISTS live_event_invitations_event
+    ON live_event_invitations (event_id, state, created_at);
+  CREATE INDEX IF NOT EXISTS live_event_invitations_invitee
+    ON live_event_invitations (invitee_id, state);
+`;
+const SELECT_EVENT = `
+  SELECT e.*,
+    COALESCE((
+      SELECT array_agg(DISTINCT i.invitee_id) FILTER (WHERE i.invitee_id IS NOT NULL)
+      FROM live_event_invitations i
+      WHERE i.event_id = e.id AND i.state IN ('pending', 'accepted')
+    ), ARRAY[]::text[]) AS invitee_ids,
+    COALESCE((
+      SELECT array_agg(DISTINCT i.invitee_id) FILTER (WHERE i.invitee_id IS NOT NULL)
+      FROM live_event_invitations i
+      WHERE i.event_id = e.id AND i.state = 'accepted' AND i.role = 'speaker'
+    ), ARRAY[]::text[]) AS speaker_ids,
+    COALESCE((
+      SELECT array_agg(DISTINCT i.invitee_id) FILTER (WHERE i.invitee_id IS NOT NULL)
+      FROM live_event_invitations i
+      WHERE i.event_id = e.id AND i.state = 'accepted' AND i.role = 'moderator'
+    ), ARRAY[]::text[]) AS moderator_ids
+  FROM live_events e
+`;
+const TRANSITIONS = {
+    draft: ["scheduled", "starting", "live", "cancelled"],
+    scheduled: ["draft", "starting", "live", "cancelled"],
+    starting: ["live", "cancelled"],
+    live: ["ended", "cancelled"],
+    ended: ["archived"],
+    cancelled: ["archived"],
+    archived: [],
+};
+function text(value, name, limit, required = false) {
+    if (value === undefined || value === null) {
+        if (required)
+            throw new LiveEventError(`${name} is required`, 422);
+        return "";
+    }
+    if (typeof value !== "string")
+        throw new LiveEventError(`${name} must be text`, 422);
+    const cleaned = value.replace(/[\u0000-\u001f\u007f]/g, " ").trim();
+    if (required && cleaned === "")
+        throw new LiveEventError(`${name} is required`, 422);
+    if (cleaned.length > limit)
+        throw new LiveEventError(`${name} is too long`, 422);
+    return cleaned;
+}
+function timestamp(value, name) {
+    if (value === undefined || value === null || value === "")
+        return null;
+    if (typeof value !== "string")
+        throw new LiveEventError(`${name} must be an ISO timestamp`, 422);
+    const date = new Date(value);
+    if (!Number.isFinite(date.getTime()))
+        throw new LiveEventError(`${name} must be an ISO timestamp`, 422);
+    return date.toISOString();
+}
+function boolean(value, fallback, name) {
+    if (value === undefined)
+        return fallback;
+    if (typeof value !== "boolean")
+        throw new LiveEventError(`${name} must be true or false`, 422);
+    return value;
+}
+function optionalInteger(value, name) {
+    if (value === undefined || value === null || value === "")
+        return null;
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 1440) {
+        throw new LiveEventError(`${name} must be between 1 and 1440`, 422);
+    }
+    return value;
+}
+function enumValue(value, allowed, fallback, name) {
+    if (value === undefined)
+        return fallback;
+    if (typeof value !== "string" || !allowed.includes(value)) {
+        throw new LiveEventError(`${name} must be one of ${allowed.join(", ")}`, 422);
+    }
+    return value;
+}
+function iso(value) {
+    if (value instanceof Date)
+        return value.toISOString();
+    if (typeof value !== "string" || value === "")
+        return undefined;
+    const parsed = new Date(value);
+    return Number.isFinite(parsed.getTime()) ? parsed.toISOString() : value;
+}
+function strings(value) {
+    if (Array.isArray(value))
+        return value.filter((item) => typeof item === "string");
+    if (typeof value === "string" && value.startsWith("{")) {
+        return value.slice(1, -1).split(",").filter(Boolean);
+    }
+    return [];
+}
+function eventFrom(row) {
+    return {
+        id: String(row["id"] ?? ""),
+        slug: String(row["slug"] ?? ""),
+        ownerId: String(row["owner_id"] ?? ""),
+        title: String(row["title"] ?? ""),
+        ...(row["description"] ? { description: String(row["description"]) } : {}),
+        ...(row["topic"] ? { topic: String(row["topic"]) } : {}),
+        ...(iso(row["starts_at"]) ? { startsAt: iso(row["starts_at"]) } : {}),
+        ...(iso(row["ends_at"]) ? { endsAt: iso(row["ends_at"]) } : {}),
+        timezone: String(row["timezone"] ?? "UTC"),
+        ...(row["expected_duration_minutes"] !== null && row["expected_duration_minutes"] !== undefined
+            ? { expectedDurationMinutes: Number(row["expected_duration_minutes"]) }
+            : {}),
+        status: String(row["status"] ?? "draft"),
+        visibility: String(row["visibility"] ?? "private"),
+        roomId: String(row["room_id"] ?? ""),
+        inviteeIds: strings(row["invitee_ids"]),
+        speakerIds: strings(row["speaker_ids"]),
+        moderatorIds: strings(row["moderator_ids"]),
+        chatEnabled: Boolean(row["chat_enabled"]),
+        handRaiseEnabled: Boolean(row["hand_raise_enabled"]),
+        recordingEnabled: Boolean(row["recording_enabled"]),
+        ...(row["recording_id"] ? { recordingId: String(row["recording_id"]) } : {}),
+        ...(row["layout_id"] ? { layoutId: String(row["layout_id"]) } : {}),
+        version: Number(row["version"] ?? 1),
+        createdAt: iso(row["created_at"]) ?? new Date(0).toISOString(),
+        updatedAt: iso(row["updated_at"]) ?? new Date(0).toISOString(),
+    };
+}
+function invitationFrom(row) {
+    return {
+        id: String(row["id"] ?? ""),
+        eventId: String(row["event_id"] ?? ""),
+        inviterId: String(row["inviter_id"] ?? ""),
+        ...(row["invitee_id"] ? { inviteeId: String(row["invitee_id"]) } : {}),
+        ...(row["email"] ? { email: String(row["email"]) } : {}),
+        role: String(row["role"] ?? "listener"),
+        state: String(row["state"] ?? "pending"),
+        ...(iso(row["expires_at"]) ? { expiresAt: iso(row["expires_at"]) } : {}),
+        createdAt: iso(row["created_at"]) ?? new Date(0).toISOString(),
+        updatedAt: iso(row["updated_at"]) ?? new Date(0).toISOString(),
+    };
+}
+export function eventSlug(value) {
+    if (typeof value !== "string")
+        throw new LiveEventError("title must be text", 422);
+    return value
+        .replace(/[\u0000-\u001f\u007f]/g, " ")
+        .trim()
+        .normalize("NFKD")
+        .replace(/[\u0300-\u036f]/g, "")
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 72) || "live";
+}
+export function canTransition(from, to) {
+    return from === to || TRANSITIONS[from].includes(to);
+}
+export class LiveEvents {
+    db;
+    ready = null;
+    constructor(db) {
+        this.db = db;
+    }
+    async ensure() {
+        this.ready ??= this.db.query(EVENT_SCHEMA).then(() => undefined);
+        await this.ready;
+    }
+    async create(ownerId, input) {
+        if (!ownerId)
+            throw new LiveEventError("sign in to create an event", 401);
+        const id = randomUUID();
+        const title = text(input.title, "title", 160, true);
+        const startsAt = timestamp(input.startsAt, "startsAt");
+        const endsAt = timestamp(input.endsAt, "endsAt");
+        if (startsAt && endsAt && endsAt <= startsAt) {
+            throw new LiveEventError("endsAt must be after startsAt", 422);
+        }
+        const baseSlug = eventSlug(title);
+        const values = [
+            id,
+            baseSlug,
+            ownerId,
+            title,
+            text(input.description, "description", 5000),
+            text(input.topic, "topic", 100),
+            startsAt,
+            endsAt,
+            text(input.timezone ?? "UTC", "timezone", 100, true),
+            optionalInteger(input.expectedDurationMinutes, "expectedDurationMinutes"),
+            startsAt ? "scheduled" : "draft",
+            enumValue(input.visibility, LIVE_EVENT_VISIBILITIES, "public", "visibility"),
+            `event-${id.slice(0, 12)}`,
+            boolean(input.chatEnabled, true, "chatEnabled"),
+            boolean(input.handRaiseEnabled, true, "handRaiseEnabled"),
+            boolean(input.recordingEnabled, false, "recordingEnabled"),
+            text(input.layoutId, "layoutId", 100),
+        ];
+        await this.ensure();
+        let rows;
+        try {
+            ({ rows } = await this.db.query(`INSERT INTO live_events (
+          id, slug, owner_id, title, description, topic, starts_at, ends_at, timezone,
+          expected_duration_minutes, status, visibility, room_id, chat_enabled,
+          hand_raise_enabled, recording_enabled, layout_id
+        ) VALUES (
+          $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, NULLIF($17, '')
+        ) RETURNING *`, values));
+        }
+        catch (error) {
+            if (error.code !== "23505")
+                throw error;
+            values[1] = `${baseSlug}-${id.slice(0, 6)}`;
+            ({ rows } = await this.db.query(`INSERT INTO live_events (
+          id, slug, owner_id, title, description, topic, starts_at, ends_at, timezone,
+          expected_duration_minutes, status, visibility, room_id, chat_enabled,
+          hand_raise_enabled, recording_enabled, layout_id
+        ) VALUES (
+          $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, NULLIF($17, '')
+        ) RETURNING *`, values));
+        }
+        const row = rows[0];
+        if (!row)
+            throw new LiveEventError("could not create the event", 500);
+        return eventFrom({ ...row, invitee_ids: [], speaker_ids: [], moderator_ids: [] });
+    }
+    async list(query = {}) {
+        await this.ensure();
+        const values = [];
+        const where = [];
+        if (query.ownerId) {
+            values.push(query.ownerId);
+            where.push(`e.owner_id = $${values.length}`);
+        }
+        else {
+            where.push("e.visibility = 'public'");
+            where.push("e.status <> 'archived'");
+        }
+        if (query.status) {
+            values.push(query.status);
+            where.push(`e.status = $${values.length}`);
+        }
+        if (query.topic) {
+            values.push(query.topic);
+            where.push(`lower(e.topic) = lower($${values.length})`);
+        }
+        if (query.from) {
+            const from = timestamp(query.from, "from");
+            values.push(from);
+            where.push(`COALESCE(e.starts_at, e.updated_at) >= $${values.length}`);
+        }
+        const requestedLimit = Number.isFinite(query.limit) ? Math.floor(query.limit) : 30;
+        const limit = Math.min(100, Math.max(1, requestedLimit));
+        values.push(limit);
+        const { rows } = await this.db.query(`${SELECT_EVENT}
+       WHERE ${where.join(" AND ")}
+       ORDER BY
+         CASE e.status WHEN 'live' THEN 0 WHEN 'starting' THEN 1 WHEN 'scheduled' THEN 2 ELSE 3 END,
+         e.starts_at NULLS LAST, e.updated_at DESC
+       LIMIT $${values.length}`, values);
+        return rows.map(eventFrom);
+    }
+    async get(reference) {
+        if (!reference)
+            return null;
+        await this.ensure();
+        const { rows } = await this.db.query(`${SELECT_EVENT} WHERE e.id = $1 OR e.slug = $1 LIMIT 1`, [reference]);
+        return rows[0] ? eventFrom(rows[0]) : null;
+    }
+    async byRoom(roomId) {
+        if (!roomId)
+            return null;
+        await this.ensure();
+        const { rows } = await this.db.query(`${SELECT_EVENT} WHERE e.room_id = $1 LIMIT 1`, [roomId]);
+        return rows[0] ? eventFrom(rows[0]) : null;
+    }
+    async canAccess(event, accountId) {
+        if (event.visibility !== "private")
+            return true;
+        if (!accountId)
+            return false;
+        if (event.ownerId === accountId || event.moderatorIds.includes(accountId))
+            return true;
+        await this.ensure();
+        const { rows } = await this.db.query(`SELECT 1 FROM live_event_invitations
+       WHERE event_id = $1 AND invitee_id = $2 AND state = 'accepted' LIMIT 1`, [event.id, accountId]);
+        return rows.length > 0;
+    }
+    async invitationAllows(eventId, token) {
+        if (!eventId || !token)
+            return false;
+        await this.ensure();
+        const { rows } = await this.db.query(`SELECT 1 FROM live_event_invitations
+       WHERE event_id = $1 AND token_hash = $2
+         AND state IN ('pending', 'accepted')
+         AND (expires_at IS NULL OR expires_at > now())
+       LIMIT 1`, [eventId, hashToken(token)]);
+        return rows.length > 0;
+    }
+    canManage(event, accountId) {
+        return Boolean(accountId && (event.ownerId === accountId || event.moderatorIds.includes(accountId)));
+    }
+    async update(reference, ownerId, input) {
+        const current = await this.get(reference);
+        if (!current)
+            throw new LiveEventError("event not found", 404);
+        if (current.ownerId !== ownerId)
+            throw new LiveEventError("only the event owner can change it", 403);
+        if (!Number.isInteger(input.version) || Number(input.version) < 1) {
+            throw new LiveEventError("version is required", 428);
+        }
+        if (Number(input.version) !== current.version) {
+            throw new LiveEventError("the event changed; reload it and try again", 409);
+        }
+        const title = input.title === undefined ? current.title : text(input.title, "title", 160, true);
+        const startsAt = input.startsAt === undefined ? current.startsAt ?? null : timestamp(input.startsAt, "startsAt");
+        const endsAt = input.endsAt === undefined ? current.endsAt ?? null : timestamp(input.endsAt, "endsAt");
+        if (startsAt && endsAt && endsAt <= startsAt) {
+            throw new LiveEventError("endsAt must be after startsAt", 422);
+        }
+        const nextStatus = enumValue(input.status, LIVE_EVENT_STATUSES, current.status, "status");
+        if (!canTransition(current.status, nextStatus)) {
+            throw new LiveEventError(`an event cannot move from ${current.status} to ${nextStatus}`, 409);
+        }
+        if (nextStatus === "scheduled" && !startsAt) {
+            throw new LiveEventError("a scheduled event needs startsAt", 422);
+        }
+        const { rows } = await this.db.query(`UPDATE live_events SET
+        title = $4,
+        description = $5,
+        topic = $6,
+        starts_at = $7,
+        ends_at = $8,
+        timezone = $9,
+        expected_duration_minutes = $10,
+        status = $11,
+        visibility = $12,
+        chat_enabled = $13,
+        hand_raise_enabled = $14,
+        recording_enabled = $15,
+        recording_id = $16,
+        layout_id = $17,
+        version = version + 1,
+        updated_at = now()
+       WHERE (id = $1 OR slug = $1) AND owner_id = $2 AND version = $3
+       RETURNING *`, [
+            reference,
+            ownerId,
+            current.version,
+            title,
+            input.description === undefined ? current.description ?? "" : text(input.description, "description", 5000),
+            input.topic === undefined ? current.topic ?? "" : text(input.topic, "topic", 100),
+            startsAt,
+            endsAt,
+            input.timezone === undefined ? current.timezone : text(input.timezone, "timezone", 100, true),
+            input.expectedDurationMinutes === undefined
+                ? current.expectedDurationMinutes ?? null
+                : optionalInteger(input.expectedDurationMinutes, "expectedDurationMinutes"),
+            nextStatus,
+            enumValue(input.visibility, LIVE_EVENT_VISIBILITIES, current.visibility, "visibility"),
+            boolean(input.chatEnabled, current.chatEnabled, "chatEnabled"),
+            boolean(input.handRaiseEnabled, current.handRaiseEnabled, "handRaiseEnabled"),
+            boolean(input.recordingEnabled, current.recordingEnabled, "recordingEnabled"),
+            input.recordingId === undefined ? current.recordingId ?? null : text(input.recordingId, "recordingId", 160) || null,
+            input.layoutId === undefined ? current.layoutId ?? null : text(input.layoutId, "layoutId", 100) || null,
+        ]);
+        const row = rows[0];
+        if (!row)
+            throw new LiveEventError("the event changed; reload it and try again", 409);
+        return eventFrom({
+            ...row,
+            invitee_ids: current.inviteeIds,
+            speaker_ids: current.speakerIds,
+            moderator_ids: current.moderatorIds,
+        });
+    }
+    async transition(reference, ownerId, status, version) {
+        return this.update(reference, ownerId, { version, status });
+    }
+    async remove(reference, ownerId) {
+        await this.ensure();
+        const { rows } = await this.db.query(`DELETE FROM live_events WHERE (id = $1 OR slug = $1) AND owner_id = $2 RETURNING id`, [reference, ownerId]);
+        return rows.length > 0;
+    }
+    async invite(eventId, inviterId, input) {
+        const event = await this.get(eventId);
+        if (!event)
+            throw new LiveEventError("event not found", 404);
+        if (!this.canManage(event, inviterId))
+            throw new LiveEventError("only hosts and moderators can invite", 403);
+        const inviteeId = text(input.inviteeId, "inviteeId", 160);
+        const email = text(input.email, "email", 320).toLowerCase();
+        if (!inviteeId && !email)
+            throw new LiveEventError("give an inviteeId or email", 422);
+        if (email && !/^[^@\s]+@[^@\s.]+\.[^@\s]+$/.test(email)) {
+            throw new LiveEventError("that does not look like an email address", 422);
+        }
+        const role = enumValue(input.role, INVITATION_ROLES, "listener", "role");
+        const expiresAt = timestamp(input.expiresAt, "expiresAt");
+        const token = randomBytes(24).toString("base64url");
+        const id = randomUUID();
+        await this.ensure();
+        const { rows } = await this.db.query(`INSERT INTO live_event_invitations (
+        id, event_id, inviter_id, invitee_id, email, role, token_hash, expires_at
+       ) VALUES ($1, $2, $3, NULLIF($4, ''), NULLIF($5, ''), $6, $7, $8)
+       RETURNING *`, [id, event.id, inviterId, inviteeId, email, role, hashToken(token), expiresAt]);
+        const row = rows[0];
+        if (!row)
+            throw new LiveEventError("could not create the invitation", 500);
+        return { ...invitationFrom(row), token };
+    }
+    async invitations(eventId, accountId) {
+        const event = await this.get(eventId);
+        if (!event)
+            throw new LiveEventError("event not found", 404);
+        if (!this.canManage(event, accountId))
+            throw new LiveEventError("only hosts and moderators can see invitations", 403);
+        await this.ensure();
+        const { rows } = await this.db.query(`SELECT * FROM live_event_invitations WHERE event_id = $1 ORDER BY created_at DESC`, [event.id]);
+        return rows.map(invitationFrom);
+    }
+    async respond(token, accountId, state) {
+        if (!token)
+            throw new LiveEventError("invitation not found", 404);
+        await this.ensure();
+        const { rows } = await this.db.query(`UPDATE live_event_invitations SET
+         state = $3,
+         invitee_id = COALESCE(invitee_id, NULLIF($2, '')),
+         updated_at = now()
+       WHERE token_hash = $1 AND state = 'pending'
+         AND (expires_at IS NULL OR expires_at > now())
+       RETURNING *`, [hashToken(token), accountId, state]);
+        const row = rows[0];
+        if (!row)
+            throw new LiveEventError("that invitation is invalid or expired", 410);
+        return invitationFrom(row);
+    }
+    async revoke(eventId, invitationId, accountId) {
+        const event = await this.get(eventId);
+        if (!event)
+            throw new LiveEventError("event not found", 404);
+        if (!this.canManage(event, accountId))
+            throw new LiveEventError("only hosts and moderators can revoke invitations", 403);
+        await this.ensure();
+        const { rows } = await this.db.query(`UPDATE live_event_invitations SET state = 'revoked', updated_at = now()
+       WHERE id = $1 AND event_id = $2 AND state = 'pending' RETURNING id`, [invitationId, event.id]);
+        return rows.length > 0;
+    }
+}
+function hashToken(token) {
+    return createHash("sha256").update(token).digest("hex");
+}

package/dist/owner.d.ts

@@ -51,3 +51,15 @@ export declare class Owner {
 /** Paths only an administrator may reach. */
 export declare const ADMIN_PATHS: string[];
 export declare function needsAdmin(path: string, method?: string): boolean;
+/**
+ * The administering that a member may do too.
+ *
+ * A member is anybody signed in to nixamp.com: not the owner, not holding
+ * the control link, but a known account. Going live is theirs -- a file on
+ * this server, a catalog entry, keeping something that was started on
+ * demand, and taking off what they put on -- because a directory of servers
+ * nobody but their owners can go live on is a directory of empty rooms.
+ * Everything else that administers stays the owner's: the source, the
+ * connections, the catalogs, the links the server fetches.
+ */
+export declare function needsMember(path: string, method?: string): boolean;

package/dist/owner.js

@@ -112,5 +112,32 @@ export function needsAdmin(path, method = "GET") {
     // it liked. A link a viewer wants to watch plays in their own browser.
     if (path.startsWith("/api/links"))
         return true;
+    // Going live with a file on this server is the same act as going live
+    // with a catalog entry, and the same question.
+    if (/^\/api\/tracks\/\d+\/live$/.test(path))
+        return true;
+    return false;
+}
+/**
+ * The administering that a member may do too.
+ *
+ * A member is anybody signed in to nixamp.com: not the owner, not holding
+ * the control link, but a known account. Going live is theirs -- a file on
+ * this server, a catalog entry, keeping something that was started on
+ * demand, and taking off what they put on -- because a directory of servers
+ * nobody but their owners can go live on is a directory of empty rooms.
+ * Everything else that administers stays the owner's: the source, the
+ * connections, the catalogs, the links the server fetches.
+ */
+export function needsMember(path, method = "GET") {
+    if (method === "POST" && /^\/api\/tracks\/\d+\/live$/.test(path))
+        return true;
+    if (method === "POST" && /^\/api\/catalogs\/[^/]+\/entries\/[^/]+\/live$/.test(path))
+        return true;
+    if (method === "POST" && /^\/api\/channels\/[^/]+\/keep$/.test(path))
+        return true;
+    // Only their own; the handler checks whose it is.
+    if (method === "DELETE" && /^\/api\/channels\/[^/]+$/.test(path))
+        return true;
     return false;
 }

package/dist/rooms.d.ts

@@ -0,0 +1,38 @@
+import type { Queryable } from "./follows.ts";
+export declare const ROOM_ROLES: readonly ["listener", "speaker", "moderator", "host"];
+export declare const HAND_RAISE_STATES: readonly ["raised", "invited", "dismissed", "returned"];
+export type RoomRole = (typeof ROOM_ROLES)[number];
+export type HandRaiseState = (typeof HAND_RAISE_STATES)[number];
+export interface ChatMessage {
+    id: string;
+    eventId: string;
+    authorId: string;
+    authorName: string;
+    body: string;
+    createdAt: string;
+    deletedAt?: string;
+}
+export interface HandRaise {
+    eventId: string;
+    accountId: string;
+    displayName: string;
+    state: HandRaiseState;
+    raisedAt: string;
+    updatedAt: string;
+}
+export declare class RoomError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+export declare class Rooms {
+    private readonly db;
+    private ready;
+    constructor(db: Queryable);
+    private ensure;
+    chat(eventId: string, after?: string, limit?: number): Promise<ChatMessage[]>;
+    post(eventId: string, authorId: string, authorName: string, body: unknown): Promise<ChatMessage>;
+    removeMessage(eventId: string, messageId: string): Promise<boolean>;
+    raiseHand(eventId: string, accountId: string, displayName: string): Promise<HandRaise>;
+    handRaises(eventId: string): Promise<HandRaise[]>;
+    setHandRaise(eventId: string, accountId: string, state: unknown): Promise<HandRaise>;
+}