nixamp 0.27.1 → 0.27.2

package/dist/live-events.js

@@ -1,3 +1,4 @@
+import { classroomBroadcast, publicWebUrl } from "./classroom.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 export const LIVE_EVENT_STATUSES = [
     "draft",
@@ -85,6 +86,7 @@ const EVENT_SCHEMA = `
   ALTER TABLE live_events ADD COLUMN IF NOT EXISTS ticket_currency    TEXT    NOT NULL DEFAULT 'USD';
   ALTER TABLE live_events ADD COLUMN IF NOT EXISTS ticket_minutes     INTEGER NOT NULL DEFAULT 1440;
   ALTER TABLE live_events ADD COLUMN IF NOT EXISTS pay_to             TEXT;
+  ALTER TABLE live_events ADD COLUMN IF NOT EXISTS classroom JSONB NOT NULL DEFAULT '{}'::jsonb;
   CREATE INDEX IF NOT EXISTS live_events_kind
     ON live_events (kind, status, starts_at);
 
@@ -101,7 +103,7 @@ const EVENT_SCHEMA = `
     END LOOP;
     FOR stale IN
       SELECT conname FROM pg_constraint
-      WHERE conrelid = 'live_event_invitations'::regclass AND contype = 'c'
+      WHERE conrelid = to_regclass('live_event_invitations') AND contype = 'c'
         AND conname <> 'live_event_invitations_role_allowed'
         AND pg_get_constraintdef(oid) LIKE '%moderator%'
     LOOP
@@ -190,6 +192,45 @@ function text(value, name, limit, required = false) {
         throw new LiveEventError(`${name} is too long`, 422);
     return cleaned;
 }
+function classroomSettings(input, current = {}) {
+    const settings = {};
+    for (const key of ["hostName", "homepageUrl", "avatarUrl", "broadcastUrl"]) {
+        const value = input[key] === undefined ? current[key] ?? "" : text(input[key], key, key === "hostName" ? 100 : 2048);
+        if (!value)
+            continue;
+        if (key === "hostName")
+            settings[key] = value;
+        else if (key === "broadcastUrl") {
+            const broadcast = classroomBroadcast(value);
+            if (!broadcast)
+                throw new LiveEventError("Use a Pairux live/join link or a Nixamp Share link with a stream selected. Admin links cannot be shared.", 422);
+            settings[key] = broadcast.url;
+        }
+        else {
+            const safe = publicWebUrl(value);
+            if (!safe)
+                throw new LiveEventError(`${key} must be an HTTPS link without credentials`, 422);
+            settings[key] = safe;
+        }
+    }
+    const recurrence = input.recurrence === undefined ? current.recurrence ?? "none" : input.recurrence;
+    if (recurrence !== "none" && recurrence !== "daily" && recurrence !== "weekly") {
+        throw new LiveEventError("recurrence must be none, daily, or weekly", 422);
+    }
+    if (recurrence !== "none")
+        settings.recurrence = recurrence;
+    return settings;
+}
+function classroomTimezone(value) {
+    const zone = text(value, "timezone", 100, true);
+    try {
+        new Intl.DateTimeFormat("en", { timeZone: zone }).format();
+    }
+    catch {
+        throw new LiveEventError("timezone must be a valid time zone", 422);
+    }
+    return zone;
+}
 function timestamp(value, name) {
     if (value === undefined || value === null || value === "")
         return null;
@@ -271,6 +312,7 @@ export function payToAddress(value, name = "payTo") {
 }
 function eventFrom(row) {
     return {
+        ...((row["classroom"] && typeof row["classroom"] === "object") ? row["classroom"] : {}),
         id: String(row["id"] ?? ""),
         slug: String(row["slug"] ?? ""),
         ownerId: String(row["owner_id"] ?? ""),
@@ -432,6 +474,9 @@ export class LiveEvents {
         if (ticketPriceCents > 0 && !payTo) {
             throw new LiveEventError("a ticketed event needs a payTo address", 422);
         }
+        const classroom = classroomSettings(input);
+        if (classroom.recurrence && !startsAt)
+            throw new LiveEventError("a recurring class needs a start time", 422);
         const baseSlug = eventSlug(title);
         const values = [
             id,
@@ -448,7 +493,7 @@ export class LiveEvents {
             payTo,
             startsAt,
             endsAt,
-            text(input.timezone ?? "UTC", "timezone", 100, true),
+            classroomTimezone(input.timezone ?? "UTC"),
             optionalInteger(input.expectedDurationMinutes, "expectedDurationMinutes"),
             startsAt ? "scheduled" : "draft",
             enumValue(input.visibility, LIVE_EVENT_VISIBILITIES, "public", "visibility"),
@@ -457,6 +502,7 @@ export class LiveEvents {
             boolean(input.handRaiseEnabled, true, "handRaiseEnabled"),
             boolean(input.recordingEnabled, false, "recordingEnabled"),
             text(input.layoutId, "layoutId", 100),
+            JSON.stringify(classroom),
         ];
         await this.ensure();
         let rows;
@@ -466,10 +512,10 @@ export class LiveEvents {
           ticket_price_cents, ticket_currency, ticket_minutes, pay_to,
           starts_at, ends_at, timezone,
           expected_duration_minutes, status, visibility, room_id, chat_enabled,
-          hand_raise_enabled, recording_enabled, layout_id
+          hand_raise_enabled, recording_enabled, layout_id, classroom
         ) VALUES (
           $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, NULLIF($12, ''), $13, $14, $15,
-          $16, $17, $18, $19, $20, $21, $22, NULLIF($23, '')
+          $16, $17, $18, $19, $20, $21, $22, NULLIF($23, ''), $24::jsonb
         ) RETURNING *`, values));
         }
         catch (error) {
@@ -481,10 +527,10 @@ export class LiveEvents {
           ticket_price_cents, ticket_currency, ticket_minutes, pay_to,
           starts_at, ends_at, timezone,
           expected_duration_minutes, status, visibility, room_id, chat_enabled,
-          hand_raise_enabled, recording_enabled, layout_id
+          hand_raise_enabled, recording_enabled, layout_id, classroom
         ) VALUES (
           $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, NULLIF($12, ''), $13, $14, $15,
-          $16, $17, $18, $19, $20, $21, $22, NULLIF($23, '')
+          $16, $17, $18, $19, $20, $21, $22, NULLIF($23, ''), $24::jsonb
         ) RETURNING *`, values));
         }
         const row = rows[0];
@@ -595,9 +641,9 @@ export class LiveEvents {
             throw new LiveEventError("the event changed; reload it and try again", 409);
         }
         const title = input.title === undefined ? current.title : text(input.title, "title", 160, true);
-        const startsAt = input.startsAt === undefined ? current.startsAt ?? null : timestamp(input.startsAt, "startsAt");
-        const endsAt = input.endsAt === undefined ? current.endsAt ?? null : timestamp(input.endsAt, "endsAt");
-        const doorsOpenAt = input.doorsOpenAt === undefined
+        let startsAt = input.startsAt === undefined ? current.startsAt ?? null : timestamp(input.startsAt, "startsAt");
+        let endsAt = input.endsAt === undefined ? current.endsAt ?? null : timestamp(input.endsAt, "endsAt");
+        let doorsOpenAt = input.doorsOpenAt === undefined
             ? current.doorsOpenAt ?? null
             : timestamp(input.doorsOpenAt, "doorsOpenAt");
         if (startsAt && endsAt && endsAt <= startsAt) {
@@ -611,13 +657,41 @@ export class LiveEvents {
         if (ticketPriceCents > 0 && !payTo) {
             throw new LiveEventError("a ticketed event needs a payTo address", 422);
         }
-        const nextStatus = enumValue(input.status, LIVE_EVENT_STATUSES, current.status, "status");
+        let nextStatus = enumValue(input.status, LIVE_EVENT_STATUSES, current.status, "status");
         if (!canTransition(current.status, nextStatus)) {
             throw new LiveEventError(`an event cannot move from ${current.status} to ${nextStatus}`, 409);
         }
         if (nextStatus === "scheduled" && !startsAt) {
             throw new LiveEventError("a scheduled event needs startsAt", 422);
         }
+        const classroom = classroomSettings(input, current);
+        const timezone = input.timezone === undefined ? current.timezone : classroomTimezone(input.timezone);
+        if (classroom.recurrence && !startsAt)
+            throw new LiveEventError("a recurring class needs a start time", 422);
+        let recurringNext = false;
+        if (nextStatus === "ended" && classroom.recurrence && startsAt) {
+            // Calendar arithmetic in Postgres preserves the host's local time over DST.
+            // Consider only the next three candidates, even if many sessions were missed.
+            const days = classroom.recurrence === "daily" ? 1 : 7;
+            const next = await this.db.query(`WITH anchor AS (
+        SELECT $1::timestamptz AT TIME ZONE $2 AS local_start
+      ), candidates AS (
+        SELECT (local_start + n * $3::int * interval '1 day') AT TIME ZONE $2 AS starts_at
+        FROM anchor CROSS JOIN LATERAL generate_series(
+          GREATEST(1, ((now() AT TIME ZONE $2)::date - local_start::date) / $3::int),
+          GREATEST(1, ((now() AT TIME ZONE $2)::date - local_start::date) / $3::int) + 2
+        ) n
+      ) SELECT starts_at FROM candidates
+        WHERE starts_at > GREATEST(now(), $1::timestamptz) ORDER BY starts_at LIMIT 1`, [startsAt, timezone, days]);
+            const nextStart = iso(next.rows[0]?.["starts_at"]);
+            if (!nextStart)
+                throw new LiveEventError("could not schedule the next class", 503);
+            startsAt = nextStart;
+            endsAt = null;
+            doorsOpenAt = null;
+            nextStatus = "scheduled";
+            recurringNext = true;
+        }
         const { rows } = await this.db.query(`UPDATE live_events SET
         title = $4,
         description = $5,
@@ -639,6 +713,7 @@ export class LiveEvents {
         ticket_currency = $21,
         ticket_minutes = $22,
         pay_to = NULLIF($23, ''),
+        classroom = $24::jsonb,
         version = version + 1,
         updated_at = now()
        WHERE (id = $1 OR slug = $1) AND owner_id = $2 AND version = $3
@@ -651,7 +726,7 @@ export class LiveEvents {
             input.topic === undefined ? current.topic ?? "" : text(input.topic, "topic", 100),
             startsAt,
             endsAt,
-            input.timezone === undefined ? current.timezone : text(input.timezone, "timezone", 100, true),
+            timezone,
             input.expectedDurationMinutes === undefined
                 ? current.expectedDurationMinutes ?? null
                 : optionalInteger(input.expectedDurationMinutes, "expectedDurationMinutes"),
@@ -660,7 +735,7 @@ export class LiveEvents {
             boolean(input.chatEnabled, current.chatEnabled, "chatEnabled"),
             boolean(input.handRaiseEnabled, current.handRaiseEnabled, "handRaiseEnabled"),
             boolean(input.recordingEnabled, current.recordingEnabled, "recordingEnabled"),
-            input.recordingId === undefined ? current.recordingId ?? null : text(input.recordingId, "recordingId", 160) || null,
+            recurringNext ? null : input.recordingId === undefined ? current.recordingId ?? null : text(input.recordingId, "recordingId", 160) || null,
             input.layoutId === undefined ? current.layoutId ?? null : text(input.layoutId, "layoutId", 100) || null,
             enumValue(input.kind, LIVE_EVENT_KINDS, current.kind, "kind"),
             doorsOpenAt,
@@ -670,6 +745,7 @@ export class LiveEvents {
                 : text(input.ticketCurrency, "ticketCurrency", 8, true).toUpperCase(),
             minutes(input.ticketMinutes, current.ticketMinutes, "ticketMinutes"),
             payTo,
+            JSON.stringify(classroom),
         ]);
         const row = rows[0];
         if (!row)

package/dist/live-voice.d.ts

@@ -57,7 +57,7 @@ export declare class LiveVoice {
     /** Optional diarization, billed only while a signed-in listener requests it.
      * Rolling audio is bounded to 15 seconds, including overlap. Every second
      * submitted (also repeated context) consumes the persistent provider budget. */
-    hear(bytes: Uint8Array, by: string, signal?: AbortSignal, meter?: TranslationMeter | undefined): Promise<SpeakerTranscript>;
+    hear(bytes: Uint8Array, by: string, signal?: AbortSignal, meter?: TranslationMeter | undefined, resource?: string): Promise<SpeakerTranscript>;
     voices(): Promise<LiveVoiceChoice[]>;
     /** A 90-second capability for one channel, never the viewer's account credential. */
     grant(by: string, channel: string): Promise<{

package/dist/live-voice.js

@@ -47,10 +47,10 @@ export class LiveVoice {
     /** Optional diarization, billed only while a signed-in listener requests it.
      * Rolling audio is bounded to 15 seconds, including overlap. Every second
      * submitted (also repeated context) consumes the persistent provider budget. */
-    async hear(bytes, by, signal, meter = this.billing) {
+    async hear(bytes, by, signal, meter = this.billing, resource = "") {
         if (!this.available())
             throw new SpeechError("speaker voices are unavailable", 503);
-        await meter?.require(by);
+        await meter?.require(by, resource);
         const wav = decodeWav(bytes);
         const seconds = wav.samples.length / wav.rate;
         if (wav.rate !== 16000 || wav.channels !== 1 || seconds < 0.2 || seconds > 15.1)
@@ -82,7 +82,7 @@ export class LiveVoice {
             form.set("tag_audio_events", "false");
             form.set("timestamps_granularity", "word");
             // No language_code: preserve the source language, including Spanish.
-            reservation = await meter?.reserve(by, "transcription", wav.samples.length);
+            reservation = await meter?.reserve(by, "transcription", wav.samples.length, resource);
             const answer = await this.fetcher("https://api.elevenlabs.io/v1/speech-to-text", {
                 method: "POST", headers: { "xi-api-key": this.key }, body: form,
                 signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000),
@@ -127,7 +127,7 @@ export class LiveVoice {
             throw new SpeechError("choose a playback session or live channel", 400);
         if (!this.requests.check(`grant:${by}`, { allowed: 10, windowMs: 60_000 }).ok)
             throw new SpeechError("too many audio authorization requests", 429);
-        await this.billing?.require(by);
+        await this.billing?.require(by, channel);
         for (const [token, grant] of this.grants)
             if (grant.expires <= this.now())
                 this.grants.delete(token);
@@ -217,7 +217,7 @@ export class LiveVoice {
     /** Stream the first request immediately; concurrent listeners share its cached result. */
     async stream(ask, by, signal, meter = this.billing) {
         this.checkRequest(by);
-        await meter?.require(by);
+        await meter?.require(by, ask.channel);
         const text = typeof ask.text === "string" ? ask.text.trim() : "";
         if (!text || text.length > 600)
             throw new SpeechError("translated audio needs a caption of 1–600 characters", 400);
@@ -242,7 +242,7 @@ export class LiveVoice {
         if (cached || pending) {
             const bytes = cached?.bytes ?? await pending;
             signal?.throwIfAborted();
-            const paid = await meter?.reserve(by, "voice", text.length);
+            const paid = await meter?.reserve(by, "voice", text.length, ask.channel);
             if (paid)
                 await meter.commit(paid);
             return new Response(new Uint8Array(bytes), { headers: HEADERS });
@@ -265,7 +265,7 @@ export class LiveVoice {
         try {
             await this.charge(by, ask.channel ?? "direct", text.length);
             signal?.throwIfAborted();
-            reservation = await meter?.reserve(by, "voice", text.length);
+            reservation = await meter?.reserve(by, "voice", text.length, ask.channel);
             const response = await this.fetcher(`https://api.elevenlabs.io/v1/text-to-speech/${voice.id}/stream?output_format=pcm_16000`, {
                 method: "POST",
                 headers: { "xi-api-key": this.key, "content-type": "application/json" },

package/dist/password-reset-page.d.ts

@@ -0,0 +1,2 @@
+/** A small recovery page shared by every branded client on this account server. */
+export declare function passwordResetPage(site: string, nonce: string): string;

package/dist/password-reset-page.js

@@ -0,0 +1,106 @@
+function escape(value) {
+    return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll('"', "&quot;");
+}
+/** A small recovery page shared by every branded client on this account server. */
+export function passwordResetPage(site, nonce) {
+    const host = new URL(site).hostname;
+    const school = host === "backtoschool.help" || host === "www.backtoschool.help";
+    const name = school ? "BackToSchool.help" : host;
+    const home = school ? "/#live" : "/";
+    return `<!doctype html><html lang="en"><head>
+  <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="referrer" content="no-referrer"><meta name="robots" content="noindex, nofollow">
+  <title>Reset your password — ${escape(name)}</title>
+  <style>
+  :root{font-family:system-ui,sans-serif;color:#34246d;background:#f7f3e9;color-scheme:light}
+  *{box-sizing:border-box}body{margin:0}header{padding:1.25rem max(1rem,calc((100% - 960px)/2));border-bottom:1px solid #ddd5e6}
+  a{color:#34246d;text-underline-offset:3px}header a{font-weight:800;text-decoration:none}
+  main{max-width:480px;margin:clamp(2rem,8vh,5rem) auto;padding:0 1rem 3rem}
+  .card{background:#fffdf8;border:1px solid #ddd5e6;border-radius:20px;padding:clamp(1.25rem,5vw,2rem)}
+  h1{font-family:Georgia,serif;font-size:2.25rem;line-height:1.1;margin:0 0 1rem}p{line-height:1.55}
+  label{display:block;font-weight:650;margin:1.25rem 0 .5rem}input{width:100%;font:inherit;padding:.85rem;border:1px solid #8a829f;border-radius:10px;background:white;color:#211747}
+  button{width:100%;font:inherit;font-weight:700;border:0;border-radius:30px;background:#34246d;color:white;padding:.9rem 1.1rem;margin-top:1.25rem;cursor:pointer}
+  button[aria-disabled=true]{opacity:.65;cursor:wait}a:focus-visible,input:focus-visible,button:focus-visible{outline:3px solid #b14b29;outline-offset:3px}
+  .help{font-size:.9rem;color:#514961}.message:empty{display:none}.error{color:#9b202a}.success{color:#215d3d}
+  .back{display:inline-block;margin-top:1.5rem}[hidden]{display:none!important}
+  @media(forced-colors:active){.card,button{border:1px solid CanvasText}}
+  </style></head><body>
+  <header><a href="${home}">${escape(name)}</a></header>
+  <main><div class="card">
+    <h1 id="title">Forgot your password?</h1>
+    <p id="intro">Enter your account’s email address and we’ll send you a link to choose a new password.</p>
+    <form id="request-form">
+      <label for="email">Email</label><input id="email" name="email" type="email" autocomplete="email" maxlength="320" required>
+      <button type="submit">Send reset link</button>
+    </form>
+    <form id="reset-form" hidden>
+      <label for="password">New password</label><input id="password" name="password" type="password" autocomplete="new-password" minlength="8" maxlength="200" aria-describedby="password-help" required>
+      <p class="help" id="password-help">Use at least 8 characters, including a number.</p>
+      <label for="confirm">Confirm new password</label><input id="confirm" name="confirm" type="password" autocomplete="new-password" minlength="8" maxlength="200" required>
+      <button type="submit">Save new password</button>
+    </form>
+    <p id="status" class="message success" role="status" aria-live="polite"></p>
+    <p id="error" class="message error" role="alert"></p>
+    <p id="another" hidden><a href="/reset-password">Request a new reset link</a></p>
+    <a class="back" id="back" href="${home}">Back to sign in</a>
+    <noscript><p>Enable JavaScript to reset your password.</p></noscript>
+  </div></main>
+  <script nonce="${nonce}">${SCRIPT}</script></body></html>`;
+}
+const SCRIPT = String.raw `
+(() => {
+  const requestForm = document.querySelector('#request-form');
+  const resetForm = document.querySelector('#reset-form');
+  const status = document.querySelector('#status');
+  const error = document.querySelector('#error');
+  let token = ''; let pending = false; let done = false;
+  function readLink() {
+    const incoming = new URLSearchParams(location.hash.slice(1)).get('token');
+    if (location.hash) history.replaceState(null, '', location.pathname);
+    if (!incoming) return;
+    token = incoming; done = false;
+    status.textContent = ''; error.textContent = '';
+    document.querySelector('#another').hidden = true;
+    for (const field of resetForm.querySelectorAll('input')) {field.value = ''; field.readOnly = false;}
+    const button = resetForm.querySelector('button');
+    button.textContent = 'Save new password'; button.removeAttribute('aria-disabled');
+    requestForm.hidden = true; resetForm.hidden = false;
+    document.querySelector('#title').textContent = 'Choose a new password';
+    document.querySelector('#intro').textContent = 'Your new password works here and on NixAmp. Existing sessions will be signed out.';
+  }
+  readLink(); window.addEventListener('hashchange', readLink);
+  async function submit(form, path, input) {
+    if (pending || done) return;
+    pending = true; error.textContent = ''; status.textContent = '';
+    const button = form.querySelector('button');
+    button.setAttribute('aria-disabled', 'true'); form.setAttribute('aria-busy', 'true');
+    try {
+      const response = await fetch(path, {method:'POST', credentials:'same-origin', headers:{'content-type':'application/json'}, body:JSON.stringify(input)});
+      const result = await response.json();
+      if (!response.ok) {
+        if (form === resetForm && response.status === 400) document.querySelector('#another').hidden = false;
+        throw new Error(result.error || 'That did not work. Please try again.');
+      }
+      status.textContent = result.message;
+      if (form === resetForm) {
+        done = true; token = '';
+        for (const field of form.querySelectorAll('input')) {field.value = ''; field.readOnly = true;}
+        button.textContent = 'Password saved';
+        document.querySelector('#back').textContent = 'Sign in with your new password';
+      }
+    } catch (problem) {error.textContent = problem instanceof TypeError ? 'Could not connect. Please try again.' : problem.message;}
+    finally {pending = false; form.removeAttribute('aria-busy'); if (!done) button.removeAttribute('aria-disabled');}
+  }
+  requestForm.addEventListener('submit', event => {
+    event.preventDefault();
+    void submit(requestForm, '/api/v1/auth/password-reset/request', {email:requestForm.elements.email.value.trim()});
+  });
+  resetForm.addEventListener('submit', event => {
+    event.preventDefault();
+    if (pending || done) return;
+    const password = resetForm.elements.password.value;
+    if (password !== resetForm.elements.confirm.value) {error.textContent = 'The passwords do not match.'; return;}
+    if (!/[0-9]/.test(password)) {error.textContent = 'Include at least one number in your password.'; return;}
+    void submit(resetForm, '/api/v1/auth/password-reset/confirm', {token, password});
+  });
+})();`;

package/dist/password-reset.d.ts

@@ -0,0 +1,35 @@
+import type { Queryable } from "./follows.ts";
+import type { Tokens } from "./tokens.ts";
+export declare const RESET_MESSAGE = "If an account exists for that email, you\u2019ll receive a password reset link shortly.";
+export declare const RESET_INVALID = "This reset link is invalid, expired, or already used. Request a new link.";
+interface Passwords {
+    hashPassword(password: string): Promise<string>;
+    validatePassword(password: string): {
+        valid: boolean;
+        message: string;
+    };
+}
+export type ResetMail = (email: string, link: string) => Promise<boolean>;
+export declare class PasswordResets {
+    private readonly db;
+    private readonly tokens;
+    private readonly passwords;
+    private ready;
+    constructor(db: Queryable & {
+        initialize?(): Promise<void>;
+    }, tokens: Tokens, passwords: Passwords);
+    private ensure;
+    /** The public response is identical for registered and unknown addresses. */
+    request(email: string, site: string, deliver: ResetMail): Promise<void>;
+    /** Claim the link, change the password, and revoke sessions in one statement. */
+    confirm(token: unknown, password: unknown): Promise<string | null>;
+    /** Older JWT sessions also stop working after recovery, across restarts. */
+    acceptsLegacyToken(userId: string, token: string): Promise<boolean>;
+}
+/** Transactional recovery mail has no follower footer and never logs a token. */
+export declare function resendPasswordReset(options: {
+    apiKey: string;
+    from: string;
+    fetch?: typeof globalThis.fetch;
+}): ResetMail;
+export {};

package/dist/password-reset.js

@@ -0,0 +1,119 @@
+import { createHash, randomBytes } from "node:crypto";
+export const RESET_MESSAGE = "If an account exists for that email, you’ll receive a password reset link shortly.";
+export const RESET_INVALID = "This reset link is invalid, expired, or already used. Request a new link.";
+const LIFETIME_MS = 30 * 60_000;
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS nixamp_password_resets (
+    user_id TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+    token_hash TEXT UNIQUE,
+    password_hash TEXT,
+    expires_at TIMESTAMPTZ,
+    reset_at TIMESTAMPTZ
+  );
+`;
+function digest(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+export class PasswordResets {
+    db;
+    tokens;
+    passwords;
+    ready = null;
+    constructor(db, tokens, passwords) {
+        this.db = db;
+        this.tokens = tokens;
+        this.passwords = passwords;
+    }
+    async ensure() {
+        this.ready ??= (async () => {
+            await this.db.initialize?.();
+            await this.tokens.initialize();
+            await this.db.query(SCHEMA);
+        })().catch((error) => { this.ready = null; throw error; });
+        await this.ready;
+    }
+    /** The public response is identical for registered and unknown addresses. */
+    async request(email, site, deliver) {
+        await this.ensure();
+        const token = randomBytes(32).toString("base64url");
+        const { rows } = await this.db.query(`INSERT INTO nixamp_password_resets (user_id, token_hash, password_hash, expires_at)
+       SELECT id, $2, password, now() + interval '30 minutes' FROM users WHERE lower(email) = $1
+       ON CONFLICT (user_id) DO UPDATE SET token_hash = EXCLUDED.token_hash,
+         password_hash = EXCLUDED.password_hash, expires_at = EXCLUDED.expires_at
+       RETURNING user_id`, [email.trim().toLowerCase(), digest(token)]);
+        if (!rows.length)
+            return;
+        // Fragments never reach HTTP logs or referrers. Email delivery also never
+        // changes the HTTP response (or its timing) according to account existence.
+        const link = `${site.replace(/\/+$/, "")}/reset-password#token=${token}`;
+        void Promise.resolve().then(() => deliver(email.trim().toLowerCase(), link)).then((sent) => {
+            if (!sent)
+                console.error("nixamp: password reset email delivery failed");
+        }).catch(() => console.error("nixamp: password reset email delivery failed"));
+    }
+    /** Claim the link, change the password, and revoke sessions in one statement. */
+    async confirm(token, password) {
+        if (typeof token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(token))
+            return RESET_INVALID;
+        if (typeof password !== "string" || password.length > 200)
+            return "Enter a password between 8 and 200 characters.";
+        const validation = this.passwords.validatePassword(password);
+        if (!validation.valid)
+            return validation.message;
+        await this.ensure();
+        const tokenHash = digest(token);
+        // Reject bad tokens before doing the deliberately expensive password hash.
+        const candidate = await this.db.query(`SELECT user_id FROM nixamp_password_resets WHERE token_hash = $1 AND expires_at > now()`, [tokenHash]);
+        if (!candidate.rows.length)
+            return RESET_INVALID;
+        const hashed = await this.passwords.hashPassword(password);
+        const { rows } = await this.db.query(`WITH consumed AS (
+         UPDATE nixamp_password_resets r SET token_hash = NULL, expires_at = NULL,
+           password_hash = NULL, reset_at = clock_timestamp()
+         FROM users u WHERE r.token_hash = $1 AND r.expires_at > now()
+           AND u.id = r.user_id AND r.password_hash IS NOT DISTINCT FROM u.password
+         RETURNING r.user_id
+       ), changed AS (
+         UPDATE users u SET password = $2, updated_at = now()
+         FROM consumed c WHERE u.id = c.user_id RETURNING u.id
+       ), revoked AS (
+         DELETE FROM nixamp_tokens t USING changed c WHERE t.user_id = c.id RETURNING t.id
+       ) SELECT id FROM changed`, [tokenHash, hashed]);
+        return rows.length ? null : RESET_INVALID;
+    }
+    /** Older JWT sessions also stop working after recovery, across restarts. */
+    async acceptsLegacyToken(userId, token) {
+        await this.ensure();
+        const { rows } = await this.db.query("SELECT reset_at FROM nixamp_password_resets WHERE user_id = $1", [userId]);
+        if (!rows[0]?.["reset_at"])
+            return true;
+        try {
+            // Called only after the auth library has verified the JWT signature.
+            const claims = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+            const issued = claims.iat;
+            const reset = rows[0]["reset_at"];
+            const resetAt = reset instanceof Date ? reset.getTime() : new Date(String(reset)).getTime();
+            return typeof issued === "number" && Number.isFinite(issued)
+                && issued * 1000 >= resetAt;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+/** Transactional recovery mail has no follower footer and never logs a token. */
+export function resendPasswordReset(options) {
+    return async (email, link) => {
+        const host = new URL(link).hostname;
+        const response = await (options.fetch ?? globalThis.fetch)("https://api.resend.com/emails", {
+            method: "POST",
+            headers: { authorization: `Bearer ${options.apiKey}`, "content-type": "application/json" },
+            signal: AbortSignal.timeout(15_000),
+            body: JSON.stringify({
+                from: options.from, to: [email], subject: `Reset your ${host} password`,
+                text: `Someone requested a password reset for your account on ${host}.\n\nChoose a new password using this link:\n${link}\n\nThis link expires in ${LIFETIME_MS / 60_000} minutes and works once. Resetting your password signs out existing sessions.\n\nIf you did not request this, you can ignore this email. Your password will stay the same.`,
+            }),
+        });
+        return response.ok;
+    };
+}

package/dist/server.d.ts

@@ -7,6 +7,7 @@ import { Broadcaster, type Destination, type EncoderSettings } from "./broadcast
 import { Ingest } from "./ingest.ts";
 import { Channels, type Channel, type ChannelInfo, type RememberedChannel } from "./channels.ts";
 import { Accounts } from "./accounts.ts";
+import { type ResetMail } from "./password-reset.ts";
 import { Handles } from "./handles.ts";
 import { OpenDirs } from "./opendirs.ts";
 import { Servers } from "./servers.ts";
@@ -659,6 +660,8 @@ export interface HandlerOptions {
     }[];
     /** Accounts, on the instance that keeps them. Only nixamp.com passes this. */
     accounts?: Accounts;
+    /** Transactional password recovery mail, separate from follow notifications. */
+    resetMail?: ResetMail;
     /** Providers to sign in with, and the terminals waiting to be connected. */
     signIn?: SignIn;
     /** The servers each account runs, on the instance that keeps accounts. */