nixamp 0.27.0 → 0.27.2

package/src/live-events.ts

@@ -1,3 +1,4 @@
+import { classroomBroadcast, publicWebUrl, type ClassroomSettings } from "./classroom.ts";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import type { Queryable } from "./follows.ts";
 
@@ -37,7 +38,7 @@ export type LiveEventKind = (typeof LIVE_EVENT_KINDS)[number];
 export type InvitationRole = (typeof INVITATION_ROLES)[number];
 export type InvitationState = (typeof INVITATION_STATES)[number];
 
-export interface LiveEvent {
+export interface LiveEvent extends ClassroomSettings {
   id: string;
   slug: string;
   ownerId: string;
@@ -94,6 +95,11 @@ export interface CreatedInvitation extends EventInvitation {
 
 export interface CreateLiveEventInput {
   title: unknown;
+  broadcastUrl?: unknown;
+  hostName?: unknown;
+  homepageUrl?: unknown;
+  avatarUrl?: unknown;
+  recurrence?: unknown;
   description?: unknown;
   topic?: unknown;
   kind?: unknown;
@@ -187,6 +193,7 @@ const EVENT_SCHEMA = `
   ALTER TABLE live_events ADD COLUMN IF NOT EXISTS ticket_currency    TEXT    NOT NULL DEFAULT 'USD';
   ALTER TABLE live_events ADD COLUMN IF NOT EXISTS ticket_minutes     INTEGER NOT NULL DEFAULT 1440;
   ALTER TABLE live_events ADD COLUMN IF NOT EXISTS pay_to             TEXT;
+  ALTER TABLE live_events ADD COLUMN IF NOT EXISTS classroom JSONB NOT NULL DEFAULT '{}'::jsonb;
   CREATE INDEX IF NOT EXISTS live_events_kind
     ON live_events (kind, status, starts_at);
 
@@ -203,7 +210,7 @@ const EVENT_SCHEMA = `
     END LOOP;
     FOR stale IN
       SELECT conname FROM pg_constraint
-      WHERE conrelid = 'live_event_invitations'::regclass AND contype = 'c'
+      WHERE conrelid = to_regclass('live_event_invitations') AND contype = 'c'
         AND conname <> 'live_event_invitations_role_allowed'
         AND pg_get_constraintdef(oid) LIKE '%moderator%'
     LOOP
@@ -292,6 +299,37 @@ function text(value: unknown, name: string, limit: number, required = false): st
   return cleaned;
 }
 
+function classroomSettings(input: CreateLiveEventInput | UpdateLiveEventInput, current: ClassroomSettings = {}): ClassroomSettings {
+  const settings: ClassroomSettings = {};
+  for (const key of ["hostName", "homepageUrl", "avatarUrl", "broadcastUrl"] as const) {
+    const value = input[key] === undefined ? current[key] ?? "" : text(input[key], key, key === "hostName" ? 100 : 2048);
+    if (!value) continue;
+    if (key === "hostName") settings[key] = value;
+    else if (key === "broadcastUrl") {
+      const broadcast = classroomBroadcast(value);
+      if (!broadcast) throw new LiveEventError("Use a Pairux live/join link or a Nixamp Share link with a stream selected. Admin links cannot be shared.", 422);
+      settings[key] = broadcast.url;
+    } else {
+      const safe = publicWebUrl(value);
+      if (!safe) throw new LiveEventError(`${key} must be an HTTPS link without credentials`, 422);
+      settings[key] = safe;
+    }
+  }
+  const recurrence = input.recurrence === undefined ? current.recurrence ?? "none" : input.recurrence;
+  if (recurrence !== "none" && recurrence !== "daily" && recurrence !== "weekly") {
+    throw new LiveEventError("recurrence must be none, daily, or weekly", 422);
+  }
+  if (recurrence !== "none") settings.recurrence = recurrence;
+  return settings;
+}
+
+function classroomTimezone(value: unknown): string {
+  const zone = text(value, "timezone", 100, true);
+  try { new Intl.DateTimeFormat("en", { timeZone: zone }).format(); }
+  catch { throw new LiveEventError("timezone must be a valid time zone", 422); }
+  return zone;
+}
+
 function timestamp(value: unknown, name: string): string | null {
   if (value === undefined || value === null || value === "") return null;
   if (typeof value !== "string") throw new LiveEventError(`${name} must be an ISO timestamp`, 422);
@@ -374,6 +412,7 @@ export function payToAddress(value: unknown, name = "payTo"): string {
 
 function eventFrom(row: Record<string, unknown>): LiveEvent {
   return {
+    ...((row["classroom"] && typeof row["classroom"] === "object") ? row["classroom"] as ClassroomSettings : {}),
     id: String(row["id"] ?? ""),
     slug: String(row["slug"] ?? ""),
     ownerId: String(row["owner_id"] ?? ""),
@@ -544,6 +583,8 @@ export class LiveEvents {
     if (ticketPriceCents > 0 && !payTo) {
       throw new LiveEventError("a ticketed event needs a payTo address", 422);
     }
+    const classroom = classroomSettings(input);
+    if (classroom.recurrence && !startsAt) throw new LiveEventError("a recurring class needs a start time", 422);
     const baseSlug = eventSlug(title);
     const values = [
       id,
@@ -560,7 +601,7 @@ export class LiveEvents {
       payTo,
       startsAt,
       endsAt,
-      text(input.timezone ?? "UTC", "timezone", 100, true),
+      classroomTimezone(input.timezone ?? "UTC"),
       optionalInteger(input.expectedDurationMinutes, "expectedDurationMinutes"),
       startsAt ? "scheduled" : "draft",
       enumValue(input.visibility, LIVE_EVENT_VISIBILITIES, "public", "visibility"),
@@ -569,6 +610,7 @@ export class LiveEvents {
       boolean(input.handRaiseEnabled, true, "handRaiseEnabled"),
       boolean(input.recordingEnabled, false, "recordingEnabled"),
       text(input.layoutId, "layoutId", 100),
+      JSON.stringify(classroom),
     ];
     await this.ensure();
     let rows: Record<string, unknown>[];
@@ -579,10 +621,10 @@ export class LiveEvents {
           ticket_price_cents, ticket_currency, ticket_minutes, pay_to,
           starts_at, ends_at, timezone,
           expected_duration_minutes, status, visibility, room_id, chat_enabled,
-          hand_raise_enabled, recording_enabled, layout_id
+          hand_raise_enabled, recording_enabled, layout_id, classroom
         ) VALUES (
           $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, NULLIF($12, ''), $13, $14, $15,
-          $16, $17, $18, $19, $20, $21, $22, NULLIF($23, '')
+          $16, $17, $18, $19, $20, $21, $22, NULLIF($23, ''), $24::jsonb
         ) RETURNING *`,
         values,
       ));
@@ -595,10 +637,10 @@ export class LiveEvents {
           ticket_price_cents, ticket_currency, ticket_minutes, pay_to,
           starts_at, ends_at, timezone,
           expected_duration_minutes, status, visibility, room_id, chat_enabled,
-          hand_raise_enabled, recording_enabled, layout_id
+          hand_raise_enabled, recording_enabled, layout_id, classroom
         ) VALUES (
           $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, NULLIF($12, ''), $13, $14, $15,
-          $16, $17, $18, $19, $20, $21, $22, NULLIF($23, '')
+          $16, $17, $18, $19, $20, $21, $22, NULLIF($23, ''), $24::jsonb
         ) RETURNING *`,
         values,
       ));
@@ -722,9 +764,9 @@ export class LiveEvents {
     }
 
     const title = input.title === undefined ? current.title : text(input.title, "title", 160, true);
-    const startsAt = input.startsAt === undefined ? current.startsAt ?? null : timestamp(input.startsAt, "startsAt");
-    const endsAt = input.endsAt === undefined ? current.endsAt ?? null : timestamp(input.endsAt, "endsAt");
-    const doorsOpenAt = input.doorsOpenAt === undefined
+    let startsAt = input.startsAt === undefined ? current.startsAt ?? null : timestamp(input.startsAt, "startsAt");
+    let endsAt = input.endsAt === undefined ? current.endsAt ?? null : timestamp(input.endsAt, "endsAt");
+    let doorsOpenAt = input.doorsOpenAt === undefined
       ? current.doorsOpenAt ?? null
       : timestamp(input.doorsOpenAt, "doorsOpenAt");
     if (startsAt && endsAt && endsAt <= startsAt) {
@@ -738,7 +780,7 @@ export class LiveEvents {
     if (ticketPriceCents > 0 && !payTo) {
       throw new LiveEventError("a ticketed event needs a payTo address", 422);
     }
-    const nextStatus = enumValue(input.status, LIVE_EVENT_STATUSES, current.status, "status");
+    let nextStatus = enumValue(input.status, LIVE_EVENT_STATUSES, current.status, "status");
     if (!canTransition(current.status, nextStatus)) {
       throw new LiveEventError(`an event cannot move from ${current.status} to ${nextStatus}`, 409);
     }
@@ -746,6 +788,30 @@ export class LiveEvents {
       throw new LiveEventError("a scheduled event needs startsAt", 422);
     }
 
+    const classroom = classroomSettings(input, current);
+    const timezone = input.timezone === undefined ? current.timezone : classroomTimezone(input.timezone);
+    if (classroom.recurrence && !startsAt) throw new LiveEventError("a recurring class needs a start time", 422);
+    let recurringNext = false;
+    if (nextStatus === "ended" && classroom.recurrence && startsAt) {
+      // Calendar arithmetic in Postgres preserves the host's local time over DST.
+      // Consider only the next three candidates, even if many sessions were missed.
+      const days = classroom.recurrence === "daily" ? 1 : 7;
+      const next = await this.db.query(`WITH anchor AS (
+        SELECT $1::timestamptz AT TIME ZONE $2 AS local_start
+      ), candidates AS (
+        SELECT (local_start + n * $3::int * interval '1 day') AT TIME ZONE $2 AS starts_at
+        FROM anchor CROSS JOIN LATERAL generate_series(
+          GREATEST(1, ((now() AT TIME ZONE $2)::date - local_start::date) / $3::int),
+          GREATEST(1, ((now() AT TIME ZONE $2)::date - local_start::date) / $3::int) + 2
+        ) n
+      ) SELECT starts_at FROM candidates
+        WHERE starts_at > GREATEST(now(), $1::timestamptz) ORDER BY starts_at LIMIT 1`, [startsAt, timezone, days]);
+      const nextStart = iso(next.rows[0]?.["starts_at"]);
+      if (!nextStart) throw new LiveEventError("could not schedule the next class", 503);
+      startsAt = nextStart; endsAt = null; doorsOpenAt = null;
+      nextStatus = "scheduled"; recurringNext = true;
+    }
+
     const { rows } = await this.db.query(
       `UPDATE live_events SET
         title = $4,
@@ -768,6 +834,7 @@ export class LiveEvents {
         ticket_currency = $21,
         ticket_minutes = $22,
         pay_to = NULLIF($23, ''),
+        classroom = $24::jsonb,
         version = version + 1,
         updated_at = now()
        WHERE (id = $1 OR slug = $1) AND owner_id = $2 AND version = $3
@@ -781,7 +848,7 @@ export class LiveEvents {
         input.topic === undefined ? current.topic ?? "" : text(input.topic, "topic", 100),
         startsAt,
         endsAt,
-        input.timezone === undefined ? current.timezone : text(input.timezone, "timezone", 100, true),
+        timezone,
         input.expectedDurationMinutes === undefined
           ? current.expectedDurationMinutes ?? null
           : optionalInteger(input.expectedDurationMinutes, "expectedDurationMinutes"),
@@ -790,7 +857,7 @@ export class LiveEvents {
         boolean(input.chatEnabled, current.chatEnabled, "chatEnabled"),
         boolean(input.handRaiseEnabled, current.handRaiseEnabled, "handRaiseEnabled"),
         boolean(input.recordingEnabled, current.recordingEnabled, "recordingEnabled"),
-        input.recordingId === undefined ? current.recordingId ?? null : text(input.recordingId, "recordingId", 160) || null,
+        recurringNext ? null : input.recordingId === undefined ? current.recordingId ?? null : text(input.recordingId, "recordingId", 160) || null,
         input.layoutId === undefined ? current.layoutId ?? null : text(input.layoutId, "layoutId", 100) || null,
         enumValue(input.kind, LIVE_EVENT_KINDS, current.kind, "kind"),
         doorsOpenAt,
@@ -800,6 +867,7 @@ export class LiveEvents {
           : text(input.ticketCurrency, "ticketCurrency", 8, true).toUpperCase(),
         minutes(input.ticketMinutes, current.ticketMinutes, "ticketMinutes"),
         payTo,
+        JSON.stringify(classroom),
       ],
     );
     const row = rows[0];

package/src/live-voice.ts

@@ -57,9 +57,9 @@ export class LiveVoice {
   /** Optional diarization, billed only while a signed-in listener requests it.
    * Rolling audio is bounded to 15 seconds, including overlap. Every second
    * submitted (also repeated context) consumes the persistent provider budget. */
-  async hear(bytes: Uint8Array, by: string, signal?: AbortSignal, meter = this.billing): Promise<SpeakerTranscript> {
+  async hear(bytes: Uint8Array, by: string, signal?: AbortSignal, meter = this.billing, resource = ""): Promise<SpeakerTranscript> {
     if (!this.available()) throw new SpeechError("speaker voices are unavailable", 503);
-    await meter?.require(by);
+    await meter?.require(by, resource);
     const wav = decodeWav(bytes);
     const seconds = wav.samples.length / wav.rate;
     if (wav.rate !== 16000 || wav.channels !== 1 || seconds < 0.2 || seconds > 15.1) throw new SpeechError("send up to 15 seconds of mono 16 kHz WAV", 400);
@@ -86,7 +86,7 @@ export class LiveVoice {
       form.set("tag_audio_events", "false");
       form.set("timestamps_granularity", "word");
       // No language_code: preserve the source language, including Spanish.
-      reservation = await meter?.reserve(by, "transcription", wav.samples.length);
+      reservation = await meter?.reserve(by, "transcription", wav.samples.length, resource);
       const answer = await this.fetcher("https://api.elevenlabs.io/v1/speech-to-text", {
         method: "POST", headers: { "xi-api-key": this.key }, body: form,
         signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000),
@@ -122,7 +122,7 @@ export class LiveVoice {
   async grant(by: string, channel: string): Promise<{ token: string; expires: number }> {
     if (!/^[\w-]{1,80}$/.test(channel)) throw new SpeechError("choose a playback session or live channel", 400);
     if (!this.requests.check(`grant:${by}`, { allowed: 10, windowMs: 60_000 }).ok) throw new SpeechError("too many audio authorization requests", 429);
-    await this.billing?.require(by);
+    await this.billing?.require(by, channel);
     for (const [token, grant] of this.grants) if (grant.expires <= this.now()) this.grants.delete(token);
     if (this.grants.size >= 5000) throw new SpeechError("audio authorization is busy", 503);
     const token = `nxd_${randomBytes(32).toString("base64url")}`;
@@ -200,7 +200,7 @@ export class LiveVoice {
   /** Stream the first request immediately; concurrent listeners share its cached result. */
   async stream(ask: VoiceRequest, by: string, signal?: AbortSignal, meter = this.billing): Promise<Response> {
     this.checkRequest(by);
-    await meter?.require(by);
+    await meter?.require(by, ask.channel);
     const text = typeof ask.text === "string" ? ask.text.trim() : "";
     if (!text || text.length > 600) throw new SpeechError("translated audio needs a caption of 1–600 characters", 400);
     if (!LIVE_VOICE_LANGUAGES.has(ask.language)) throw new SpeechError("this language is not supported by Flash voices", 400);
@@ -220,7 +220,7 @@ export class LiveVoice {
     if (cached || pending) {
       const bytes = cached?.bytes ?? await pending!;
       signal?.throwIfAborted();
-      const paid = await meter?.reserve(by, "voice", text.length);
+      const paid = await meter?.reserve(by, "voice", text.length, ask.channel);
       if (paid) await meter!.commit(paid);
       return new Response(new Uint8Array(bytes), { headers: HEADERS });
     }
@@ -239,7 +239,7 @@ export class LiveVoice {
     try {
       await this.charge(by, ask.channel ?? "direct", text.length);
       signal?.throwIfAborted();
-      reservation = await meter?.reserve(by, "voice", text.length);
+      reservation = await meter?.reserve(by, "voice", text.length, ask.channel);
       const response = await this.fetcher(`https://api.elevenlabs.io/v1/text-to-speech/${voice.id}/stream?output_format=pcm_16000`, {
         method: "POST",
         headers: { "xi-api-key": this.key, "content-type": "application/json" },

package/src/password-reset-page.ts

@@ -0,0 +1,108 @@
+function escape(value: string): string {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll('"', "&quot;");
+}
+
+/** A small recovery page shared by every branded client on this account server. */
+export function passwordResetPage(site: string, nonce: string): string {
+  const host = new URL(site).hostname;
+  const school = host === "backtoschool.help" || host === "www.backtoschool.help";
+  const name = school ? "BackToSchool.help" : host;
+  const home = school ? "/#live" : "/";
+  return `<!doctype html><html lang="en"><head>
+  <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="referrer" content="no-referrer"><meta name="robots" content="noindex, nofollow">
+  <title>Reset your password — ${escape(name)}</title>
+  <style>
+  :root{font-family:system-ui,sans-serif;color:#34246d;background:#f7f3e9;color-scheme:light}
+  *{box-sizing:border-box}body{margin:0}header{padding:1.25rem max(1rem,calc((100% - 960px)/2));border-bottom:1px solid #ddd5e6}
+  a{color:#34246d;text-underline-offset:3px}header a{font-weight:800;text-decoration:none}
+  main{max-width:480px;margin:clamp(2rem,8vh,5rem) auto;padding:0 1rem 3rem}
+  .card{background:#fffdf8;border:1px solid #ddd5e6;border-radius:20px;padding:clamp(1.25rem,5vw,2rem)}
+  h1{font-family:Georgia,serif;font-size:2.25rem;line-height:1.1;margin:0 0 1rem}p{line-height:1.55}
+  label{display:block;font-weight:650;margin:1.25rem 0 .5rem}input{width:100%;font:inherit;padding:.85rem;border:1px solid #8a829f;border-radius:10px;background:white;color:#211747}
+  button{width:100%;font:inherit;font-weight:700;border:0;border-radius:30px;background:#34246d;color:white;padding:.9rem 1.1rem;margin-top:1.25rem;cursor:pointer}
+  button[aria-disabled=true]{opacity:.65;cursor:wait}a:focus-visible,input:focus-visible,button:focus-visible{outline:3px solid #b14b29;outline-offset:3px}
+  .help{font-size:.9rem;color:#514961}.message:empty{display:none}.error{color:#9b202a}.success{color:#215d3d}
+  .back{display:inline-block;margin-top:1.5rem}[hidden]{display:none!important}
+  @media(forced-colors:active){.card,button{border:1px solid CanvasText}}
+  </style></head><body>
+  <header><a href="${home}">${escape(name)}</a></header>
+  <main><div class="card">
+    <h1 id="title">Forgot your password?</h1>
+    <p id="intro">Enter your account’s email address and we’ll send you a link to choose a new password.</p>
+    <form id="request-form">
+      <label for="email">Email</label><input id="email" name="email" type="email" autocomplete="email" maxlength="320" required>
+      <button type="submit">Send reset link</button>
+    </form>
+    <form id="reset-form" hidden>
+      <label for="password">New password</label><input id="password" name="password" type="password" autocomplete="new-password" minlength="8" maxlength="200" aria-describedby="password-help" required>
+      <p class="help" id="password-help">Use at least 8 characters, including a number.</p>
+      <label for="confirm">Confirm new password</label><input id="confirm" name="confirm" type="password" autocomplete="new-password" minlength="8" maxlength="200" required>
+      <button type="submit">Save new password</button>
+    </form>
+    <p id="status" class="message success" role="status" aria-live="polite"></p>
+    <p id="error" class="message error" role="alert"></p>
+    <p id="another" hidden><a href="/reset-password">Request a new reset link</a></p>
+    <a class="back" id="back" href="${home}">Back to sign in</a>
+    <noscript><p>Enable JavaScript to reset your password.</p></noscript>
+  </div></main>
+  <script nonce="${nonce}">${SCRIPT}</script></body></html>`;
+}
+
+const SCRIPT = String.raw`
+(() => {
+  const requestForm = document.querySelector('#request-form');
+  const resetForm = document.querySelector('#reset-form');
+  const status = document.querySelector('#status');
+  const error = document.querySelector('#error');
+  let token = ''; let pending = false; let done = false;
+  function readLink() {
+    const incoming = new URLSearchParams(location.hash.slice(1)).get('token');
+    if (location.hash) history.replaceState(null, '', location.pathname);
+    if (!incoming) return;
+    token = incoming; done = false;
+    status.textContent = ''; error.textContent = '';
+    document.querySelector('#another').hidden = true;
+    for (const field of resetForm.querySelectorAll('input')) {field.value = ''; field.readOnly = false;}
+    const button = resetForm.querySelector('button');
+    button.textContent = 'Save new password'; button.removeAttribute('aria-disabled');
+    requestForm.hidden = true; resetForm.hidden = false;
+    document.querySelector('#title').textContent = 'Choose a new password';
+    document.querySelector('#intro').textContent = 'Your new password works here and on NixAmp. Existing sessions will be signed out.';
+  }
+  readLink(); window.addEventListener('hashchange', readLink);
+  async function submit(form, path, input) {
+    if (pending || done) return;
+    pending = true; error.textContent = ''; status.textContent = '';
+    const button = form.querySelector('button');
+    button.setAttribute('aria-disabled', 'true'); form.setAttribute('aria-busy', 'true');
+    try {
+      const response = await fetch(path, {method:'POST', credentials:'same-origin', headers:{'content-type':'application/json'}, body:JSON.stringify(input)});
+      const result = await response.json();
+      if (!response.ok) {
+        if (form === resetForm && response.status === 400) document.querySelector('#another').hidden = false;
+        throw new Error(result.error || 'That did not work. Please try again.');
+      }
+      status.textContent = result.message;
+      if (form === resetForm) {
+        done = true; token = '';
+        for (const field of form.querySelectorAll('input')) {field.value = ''; field.readOnly = true;}
+        button.textContent = 'Password saved';
+        document.querySelector('#back').textContent = 'Sign in with your new password';
+      }
+    } catch (problem) {error.textContent = problem instanceof TypeError ? 'Could not connect. Please try again.' : problem.message;}
+    finally {pending = false; form.removeAttribute('aria-busy'); if (!done) button.removeAttribute('aria-disabled');}
+  }
+  requestForm.addEventListener('submit', event => {
+    event.preventDefault();
+    void submit(requestForm, '/api/v1/auth/password-reset/request', {email:requestForm.elements.email.value.trim()});
+  });
+  resetForm.addEventListener('submit', event => {
+    event.preventDefault();
+    if (pending || done) return;
+    const password = resetForm.elements.password.value;
+    if (password !== resetForm.elements.confirm.value) {error.textContent = 'The passwords do not match.'; return;}
+    if (!/[0-9]/.test(password)) {error.textContent = 'Include at least one number in your password.'; return;}
+    void submit(resetForm, '/api/v1/auth/password-reset/confirm', {token, password});
+  });
+})();`;

package/src/password-reset.ts

@@ -0,0 +1,134 @@
+import { createHash, randomBytes } from "node:crypto";
+import type { Queryable } from "./follows.ts";
+import type { Tokens } from "./tokens.ts";
+
+export const RESET_MESSAGE = "If an account exists for that email, you’ll receive a password reset link shortly.";
+export const RESET_INVALID = "This reset link is invalid, expired, or already used. Request a new link.";
+const LIFETIME_MS = 30 * 60_000;
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS nixamp_password_resets (
+    user_id TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+    token_hash TEXT UNIQUE,
+    password_hash TEXT,
+    expires_at TIMESTAMPTZ,
+    reset_at TIMESTAMPTZ
+  );
+`;
+
+interface Passwords {
+  hashPassword(password: string): Promise<string>;
+  validatePassword(password: string): { valid: boolean; message: string };
+}
+
+export type ResetMail = (email: string, link: string) => Promise<boolean>;
+
+function digest(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+export class PasswordResets {
+  private ready: Promise<void> | null = null;
+
+  constructor(
+    private readonly db: Queryable & { initialize?(): Promise<void> },
+    private readonly tokens: Tokens,
+    private readonly passwords: Passwords,
+  ) {}
+
+  private async ensure(): Promise<void> {
+    this.ready ??= (async () => {
+      await this.db.initialize?.();
+      await this.tokens.initialize();
+      await this.db.query(SCHEMA);
+    })().catch((error) => { this.ready = null; throw error; });
+    await this.ready;
+  }
+
+  /** The public response is identical for registered and unknown addresses. */
+  async request(email: string, site: string, deliver: ResetMail): Promise<void> {
+    await this.ensure();
+    const token = randomBytes(32).toString("base64url");
+    const { rows } = await this.db.query(
+      `INSERT INTO nixamp_password_resets (user_id, token_hash, password_hash, expires_at)
+       SELECT id, $2, password, now() + interval '30 minutes' FROM users WHERE lower(email) = $1
+       ON CONFLICT (user_id) DO UPDATE SET token_hash = EXCLUDED.token_hash,
+         password_hash = EXCLUDED.password_hash, expires_at = EXCLUDED.expires_at
+       RETURNING user_id`,
+      [email.trim().toLowerCase(), digest(token)],
+    );
+    if (!rows.length) return;
+    // Fragments never reach HTTP logs or referrers. Email delivery also never
+    // changes the HTTP response (or its timing) according to account existence.
+    const link = `${site.replace(/\/+$/, "")}/reset-password#token=${token}`;
+    void Promise.resolve().then(() => deliver(email.trim().toLowerCase(), link)).then((sent) => {
+      if (!sent) console.error("nixamp: password reset email delivery failed");
+    }).catch(() => console.error("nixamp: password reset email delivery failed"));
+  }
+
+  /** Claim the link, change the password, and revoke sessions in one statement. */
+  async confirm(token: unknown, password: unknown): Promise<string | null> {
+    if (typeof token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(token)) return RESET_INVALID;
+    if (typeof password !== "string" || password.length > 200) return "Enter a password between 8 and 200 characters.";
+    const validation = this.passwords.validatePassword(password);
+    if (!validation.valid) return validation.message;
+    await this.ensure();
+    const tokenHash = digest(token);
+    // Reject bad tokens before doing the deliberately expensive password hash.
+    const candidate = await this.db.query(
+      `SELECT user_id FROM nixamp_password_resets WHERE token_hash = $1 AND expires_at > now()`, [tokenHash],
+    );
+    if (!candidate.rows.length) return RESET_INVALID;
+    const hashed = await this.passwords.hashPassword(password);
+    const { rows } = await this.db.query(
+      `WITH consumed AS (
+         UPDATE nixamp_password_resets r SET token_hash = NULL, expires_at = NULL,
+           password_hash = NULL, reset_at = clock_timestamp()
+         FROM users u WHERE r.token_hash = $1 AND r.expires_at > now()
+           AND u.id = r.user_id AND r.password_hash IS NOT DISTINCT FROM u.password
+         RETURNING r.user_id
+       ), changed AS (
+         UPDATE users u SET password = $2, updated_at = now()
+         FROM consumed c WHERE u.id = c.user_id RETURNING u.id
+       ), revoked AS (
+         DELETE FROM nixamp_tokens t USING changed c WHERE t.user_id = c.id RETURNING t.id
+       ) SELECT id FROM changed`,
+      [tokenHash, hashed],
+    );
+    return rows.length ? null : RESET_INVALID;
+  }
+
+  /** Older JWT sessions also stop working after recovery, across restarts. */
+  async acceptsLegacyToken(userId: string, token: string): Promise<boolean> {
+    await this.ensure();
+    const { rows } = await this.db.query("SELECT reset_at FROM nixamp_password_resets WHERE user_id = $1", [userId]);
+    if (!rows[0]?.["reset_at"]) return true;
+    try {
+      // Called only after the auth library has verified the JWT signature.
+      const claims = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+      const issued = claims.iat;
+      const reset = rows[0]["reset_at"];
+      const resetAt = reset instanceof Date ? reset.getTime() : new Date(String(reset)).getTime();
+      return typeof issued === "number" && Number.isFinite(issued)
+        && issued * 1000 >= resetAt;
+    } catch { return false; }
+  }
+}
+
+/** Transactional recovery mail has no follower footer and never logs a token. */
+export function resendPasswordReset(options: {
+  apiKey: string; from: string; fetch?: typeof globalThis.fetch;
+}): ResetMail {
+  return async (email, link) => {
+    const host = new URL(link).hostname;
+    const response = await (options.fetch ?? globalThis.fetch)("https://api.resend.com/emails", {
+      method: "POST",
+      headers: { authorization: `Bearer ${options.apiKey}`, "content-type": "application/json" },
+      signal: AbortSignal.timeout(15_000),
+      body: JSON.stringify({
+        from: options.from, to: [email], subject: `Reset your ${host} password`,
+        text: `Someone requested a password reset for your account on ${host}.\n\nChoose a new password using this link:\n${link}\n\nThis link expires in ${LIFETIME_MS / 60_000} minutes and works once. Resetting your password signs out existing sessions.\n\nIf you did not request this, you can ignore this email. Your password will stay the same.`,
+      }),
+    });
+    return response.ok;
+  };
+}