nixamp 0.27.1 → 0.27.2

package/dist/server.js

@@ -27,6 +27,8 @@ import { Ingest, normaliseFormat } from "./ingest.js";
 import { BACKLOG_SECONDS, Channels, cleanId, generatedId, rememberChannels, rememberedChannels, rememberedNow, } from "./channels.js";
 import { RtmpListeners } from "./rtmp-in.js";
 import { Accounts, clearedCookie, sessionCookie, tokenFrom } from "./accounts.js";
+import { RESET_INVALID, RESET_MESSAGE, resendPasswordReset } from "./password-reset.js";
+import { passwordResetPage } from "./password-reset-page.js";
 import { anonymousHandle, Handles } from "./handles.js";
 import { OpenDirs } from "./opendirs.js";
 import { Servers } from "./servers.js";
@@ -1360,6 +1362,7 @@ export function createHandler(engine, options) {
         const webSite = options.webSites?.get((request.headers.host ?? "").toLowerCase());
         const web = webSite?.web ?? options.web;
         const eventSite = webSite?.site ?? options.invites?.site;
+        const accountSite = eventSite ?? options.site ?? "https://nixamp.com";
         const key = options.key ?? null;
         const behindProxy = options.behindProxy ?? false;
         const listenKey = options.listenKey ?? null;
@@ -1947,6 +1950,20 @@ export function createHandler(engine, options) {
             json(response, 200, { name: "nixamp", version: options.version, media: options.media });
             return;
         }
+        if (path === "/reset-password" && options.accounts?.passwordResets) {
+            if (request.method !== "GET" && request.method !== "HEAD") {
+                json(response, 405, { error: "GET only" });
+                return;
+            }
+            const nonce = randomBytes(18).toString("base64");
+            response.writeHead(200, {
+                "content-type": "text/html; charset=utf-8", "cache-control": "no-store",
+                "referrer-policy": "no-referrer", "x-robots-tag": "noindex, nofollow",
+                "content-security-policy": `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'unsafe-inline'; connect-src 'self'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'`,
+            });
+            response.end(request.method === "HEAD" ? undefined : passwordResetPage(accountSite, nonce));
+            return;
+        }
         // --- accounts ---------------------------------------------------------
         //
         // Before the share-key check, because signing in is how somebody without a
@@ -1955,6 +1972,58 @@ export function createHandler(engine, options) {
         if (path.startsWith("/api/v1/auth/") && options.accounts) {
             const accounts = options.accounts;
             const secure = options.secureCookies ?? false;
+            if (path === "/api/v1/auth/password-reset/request" || path === "/api/v1/auth/password-reset/confirm") {
+                if (request.method !== "POST") {
+                    json(response, 405, { error: "POST only" });
+                    return;
+                }
+                const confirming = path.endsWith("/confirm");
+                if (!accounts.passwordResets || (!confirming && !options.resetMail)) {
+                    json(response, 503, { error: "Password reset email is temporarily unavailable. Please try again later." });
+                    return;
+                }
+                const who = callerOf(request.headers, request.socket.remoteAddress, behindProxy);
+                const limit = guard.check(`password-reset:${confirming ? "confirm" : "request"}:${who}`, { allowed: confirming ? 15 : 10, windowMs: 15 * 60_000 });
+                if (!limit.ok) {
+                    response.setHeader("retry-after", String(limit.retryAfter));
+                    json(response, 429, { error: "Too many attempts. Please try again in 15 minutes." });
+                    return;
+                }
+                try {
+                    const input = JSON.parse(await readBody(request, 4096));
+                    if (!input || typeof input !== "object" || Array.isArray(input)) {
+                        json(response, 400, { error: "Provide a JSON object." });
+                        return;
+                    }
+                    const body = input;
+                    if (confirming) {
+                        const error = await accounts.passwordResets.confirm(body["token"], body["password"]);
+                        if (error) {
+                            json(response, error === RESET_INVALID ? 400 : 422, { error });
+                            return;
+                        }
+                        response.setHeader("set-cookie", clearedCookie());
+                        json(response, 200, { message: "Your password has been changed. Sign in with your new password." });
+                    }
+                    else {
+                        const email = typeof body["email"] === "string" ? body["email"].trim().toLowerCase() : "";
+                        if (email.length > 320 || !/^[^@\s]+@[^@\s.]+\.[^@\s]+$/.test(email)) {
+                            json(response, 422, { error: "Enter a valid email address." });
+                            return;
+                        }
+                        // Count every address, including nonexistent ones, identically.
+                        const address = guard.check(`password-reset:email:${email}`, { allowed: 3, windowMs: 15 * 60_000 });
+                        if (address.ok)
+                            await accounts.passwordResets.request(email, accountSite, options.resetMail);
+                        json(response, 200, { message: RESET_MESSAGE });
+                    }
+                }
+                catch (error) {
+                    const malformed = error instanceof SyntaxError || error.message === "body too large";
+                    json(response, malformed ? 400 : 503, { error: malformed ? "Provide a valid JSON request." : "Password reset is temporarily unavailable. Please try again." });
+                }
+                return;
+            }
             if (path === "/api/v1/auth/me") {
                 const who = await accounts.whoIs(tokenFrom(request.headers));
                 if (who === null) {
@@ -2409,9 +2478,25 @@ export function createHandler(engine, options) {
                     return;
                 }
                 if (!who)
-                    throw new SpeechError("Sign in to buy translated audio.", 401);
+                    throw new SpeechError("Sign in to use translated audio.", 401);
                 if (!guard.check(`translation-pass-account:${who.id}`, { allowed: 30, windowMs: 60_000 }).ok)
                     throw new SpeechError("Too many purchase requests.", 429);
+                if (path === "/api/v1/translation-passes/session" && request.method === "POST") {
+                    if (!request.headers["content-type"]?.startsWith("application/json"))
+                        throw new SpeechError("Send a panel session as JSON.", 415);
+                    let body;
+                    try {
+                        body = JSON.parse(await readBody(request, 1024));
+                    }
+                    catch {
+                        throw new SpeechError("Choose a panel session.", 400);
+                    }
+                    if (typeof body?.resource !== "string")
+                        throw new SpeechError("Choose a panel session.", 400);
+                    await service.begin(who.id, body.resource);
+                    json(response, 200, await service.access(who.id));
+                    return;
+                }
                 if (path === "/api/v1/translation-passes/checkout" && request.method === "POST") {
                     if (!request.headers["content-type"]?.startsWith("application/json"))
                         throw new SpeechError("Send a purchase as JSON.", 415);
@@ -2492,7 +2577,10 @@ export function createHandler(engine, options) {
                             return;
                         }
                         const bytes = await readBytes(request, 484_000);
-                        json(response, 200, await service.hear(bytes, who.id, controller.signal));
+                        const resource = request.headers["x-nixamp-translation-session"];
+                        if (resource !== undefined && (typeof resource !== "string" || !/^[\w-]{1,80}$/.test(resource)))
+                            throw new SpeechError("Choose a panel session.", 400);
+                        json(response, 200, await service.hear(bytes, who.id, controller.signal, undefined, resource));
                     }
                     else if (path.endsWith("/grant") && request.method === "POST") {
                         if (!request.headers["content-type"]?.startsWith("application/json")) {
@@ -6043,6 +6131,12 @@ export async function serve(argv, version = "0.1.0") {
         ...(translations ? { translations } : {}),
         ...(records ? { records } : {}),
         site: nixampSite,
+        ...(accounts && process.env["RESEND_API_KEY"] ? {
+            resetMail: resendPasswordReset({
+                apiKey: process.env["RESEND_API_KEY"],
+                from: process.env["NIXAMP_MAIL_FROM"] ?? "nixamp <notifications@nixamp.com>",
+            }),
+        } : {}),
         // Other people's OpenProfiles, read for the voice a line is spoken in,
         // and the voices to speak in: ElevenLabs when the Telnyx account holds
         // the key for it (an integration secret named "elevenlabs"), Kokoro

package/dist/shared-translation.js

@@ -93,23 +93,31 @@ export class SharedTranslations {
         const source = sharedSource(raw);
         if (!LIVE_VOICE_LANGUAGES.has(language))
             throw new SpeechError("Choose a supported audio language.", 400);
-        await this.options.billing?.require(by);
-        const connections = [...this.feeds.values()].reduce((total, feed) => total + [...feed.members].filter(member => member.by === by).length, 0);
-        if (connections >= 2)
-            throw new SpeechError("Translated audio is already open in two players for this account.", 429);
         const id = `dub-${createHash("sha256").update(`${source}|${language}`).digest("hex").slice(0, 40)}`;
+        const capacity = () => {
+            const connections = [...this.feeds.values()].reduce((total, feed) => total + [...feed.members].filter(member => member.by === by).length, 0);
+            if (connections >= 2)
+                throw new SpeechError("Translated audio is already open in two players for this account.", 429);
+            const feed = this.feeds.get(id);
+            if (!feed && this.feeds.size >= 4)
+                throw new SpeechError("Live translation is busy. Try again shortly.", 429);
+            if (feed && feed.members.size >= 1000)
+                throw new SpeechError("This translated stream is full. Try again shortly.", 429);
+        };
+        capacity();
+        if (this.options.billing?.begin)
+            await this.options.billing.begin(by, id);
+        else
+            await this.options.billing?.require(by, id);
+        capacity(); // Other joins can finish during the account/database check.
         let feed = this.feeds.get(id);
         if (!feed) {
-            if (this.feeds.size >= 4)
-                throw new SpeechError("Live translation is busy. Try again shortly.", 429);
             feed = this.make(id, source, language);
             this.feeds.set(id, feed);
             const current = feed;
             current.heartbeat = setInterval(() => void this.checkMembers(current), 10_000);
             current.heartbeat.unref?.();
         }
-        if (feed.members.size >= 1000)
-            throw new SpeechError("This translated stream is full. Try again shortly.", 429);
         const member = { by, send, close };
         feed.members.add(member);
         this.broadcast(feed, { type: "status", listeners: feed.members.size });
@@ -135,18 +143,18 @@ export class SharedTranslations {
     }
     async checkMembers(feed) {
         const accounts = [...new Set([...feed.members].map(member => member.by))];
-        let funded = new Set(accounts), message = "Your translation balance is used up or expired. Buy another pass to continue.";
+        let funded = new Set(accounts), message = "This free session ended and audio credit is used up. Start a remaining free session or buy a pass.";
         try {
             if (this.options.billing?.eligible)
-                funded = new Set(await this.options.billing.eligible(accounts));
+                funded = new Set(await this.options.billing.eligible(accounts, feed.id));
             else if (this.options.billing) {
-                const results = await Promise.allSettled(accounts.map(by => this.options.billing.require(by)));
+                const results = await Promise.allSettled(accounts.map(by => this.options.billing.require(by, feed.id)));
                 funded = new Set(accounts.filter((_by, index) => results[index]?.status === "fulfilled"));
             }
         }
         catch {
             funded.clear();
-            message = "Your translation balance could not be checked. Try again shortly.";
+            message = "Your translation access could not be checked. Try again shortly.";
         }
         for (const member of [...feed.members])
             if (accounts.includes(member.by) && !funded.has(member.by)) {
@@ -180,8 +188,8 @@ export class SharedTranslations {
     }
     make(id, source, language) {
         const feed = { id, source, language, members: new Set(), controller: new AbortController(), reservations: new Map(), queue: [], speaking: false, previous: Buffer.alloc(0), pending: Buffer.alloc(0), until: Date.now() };
-        // Every active account pays the same published access rate. API work is
-        // done once; additional listeners do not trigger recognition or synthesis.
+        // Each account uses free access first, then the same published credit rate.
+        // Additional listeners do not trigger recognition or synthesis.
         feed.meter = {
             require: async () => { if (!feed.members.size)
                 throw new SpeechError("No listeners.", 410); },
@@ -191,13 +199,13 @@ export class SharedTranslations {
                 const accepted = new Set();
                 const billing = this.options.billing;
                 if (billing?.reserveMany) {
-                    for (const charged of await billing.reserveMany(accounts, kind, units)) {
+                    for (const charged of await billing.reserveMany(accounts, kind, units, feed.id)) {
                         ids.push(charged.id);
                         accepted.add(charged.by);
                     }
                 }
                 else {
-                    const results = await Promise.allSettled(accounts.map(async (account) => ({ by: account, id: await billing?.reserve(account, kind, units) })));
+                    const results = await Promise.allSettled(accounts.map(async (account) => ({ by: account, id: await billing?.reserve(account, kind, units, feed.id) })));
                     let failure;
                     for (const result of results) {
                         if (result.status === "fulfilled") {
@@ -216,7 +224,7 @@ export class SharedTranslations {
                 for (const member of [...feed.members])
                     if (accounts.includes(member.by) && !accepted.has(member.by)) {
                         try {
-                            member.send({ type: "error", error: "Your translation balance is used up or expired. Buy another pass to continue." });
+                            member.send({ type: "error", error: "This free session ended and audio credit is used up. Start a remaining free session or buy a pass." });
                         }
                         catch { /* disconnected */ }
                         finally {

package/dist/tokens.d.ts

@@ -56,6 +56,8 @@ export declare class Tokens {
      * sign in is a setup step too many.
      */
     private ensure;
+    /** Recovery revokes this table in the same transaction as the password update. */
+    initialize(): Promise<void>;
     issue(options: IssueOptions): Promise<IssuedToken>;
     /** The account a token belongs to, or null for one this server will not accept. */
     verify(value: string): Promise<Account | null>;

package/dist/tokens.js

@@ -111,6 +111,8 @@ export class Tokens {
         this.ready ??= this.db.query(SCHEMA).then(() => undefined);
         await this.ready;
     }
+    /** Recovery revokes this table in the same transaction as the password update. */
+    async initialize() { await this.ensure(); }
     async issue(options) {
         await this.ensure();
         const { id, secret, token } = mintToken();

package/dist/translation-passes.d.ts

@@ -1,4 +1,5 @@
 import type { Queryable } from "./follows.ts";
+import { UpgradeAllowances, type UpgradeAllowance } from "./upgrade-allowance.ts";
 export declare const TRANSLATION_MULTIPLIER = 5;
 export declare const TRANSLATION_PLANS: readonly [{
     readonly id: "day";
@@ -19,10 +20,11 @@ export declare const TRANSLATION_PLANS: readonly [{
 export type TranslationPlan = typeof TRANSLATION_PLANS[number];
 export type TranslationUsage = "transcription" | "voice";
 export interface TranslationMeter {
-    require(by: string): Promise<void>;
-    eligible?(accounts: string[]): Promise<string[]>;
-    reserve(by: string, kind: TranslationUsage, units: number): Promise<string>;
-    reserveMany?(accounts: string[], kind: TranslationUsage, units: number): Promise<{
+    begin?(by: string, resource: string): Promise<void>;
+    require(by: string, resource?: string): Promise<void>;
+    eligible?(accounts: string[], resource?: string): Promise<string[]>;
+    reserve(by: string, kind: TranslationUsage, units: number, resource?: string): Promise<string>;
+    reserveMany?(accounts: string[], kind: TranslationUsage, units: number, resource?: string): Promise<{
         by: string;
         id: string;
     }[]>;
@@ -48,6 +50,7 @@ export interface TranslationAccess {
         voiceThousand: number;
         multiplier: number;
     };
+    free: UpgradeAllowance;
 }
 /** At the published rates: Scribe $0.22/submitted hour, Flash $0.05/1k chars.
  * Transcription units are 16 kHz samples; overlap is charged exactly as sent. */
@@ -63,6 +66,7 @@ export declare class TranslationPasses implements TranslationMeter {
     private merchantUntil;
     private readonly fetcher;
     private readonly now;
+    readonly free: UpgradeAllowances;
     constructor(options: {
         db: Queryable;
         key: string;
@@ -74,11 +78,12 @@ export declare class TranslationPasses implements TranslationMeter {
     private provider;
     private settings;
     access(by?: string): Promise<TranslationAccess>;
-    require(by: string): Promise<void>;
-    eligible(accounts: string[]): Promise<string[]>;
-    reserve(by: string, kind: TranslationUsage, units: number): Promise<string>;
+    begin(by: string, resource: string): Promise<void>;
+    require(by: string, resource?: string): Promise<void>;
+    eligible(accounts: string[], resource?: string): Promise<string[]>;
+    reserve(by: string, kind: TranslationUsage, units: number, resource?: string): Promise<string>;
     /** Batch a shared stream's access charges in one database round trip. */
-    reserveMany(accounts: string[], kind: TranslationUsage, units: number): Promise<{
+    reserveMany(accounts: string[], kind: TranslationUsage, units: number, resource?: string): Promise<{
         by: string;
         id: string;
     }[]>;

package/dist/translation-passes.js

@@ -2,6 +2,7 @@
  * each listening account reserves 5x base provider cost for paid access. */
 import { randomUUID } from "node:crypto";
 import { SpeechError } from "./speech.js";
+import { UpgradeAllowances } from "./upgrade-allowance.js";
 export const TRANSLATION_MULTIPLIER = 5;
 export const TRANSLATION_PLANS = [
     { id: "day", name: "Day", days: 1, priceCents: 500 },
@@ -40,13 +41,16 @@ export class TranslationPasses {
     merchantUntil = 0;
     fetcher;
     now;
+    free;
     constructor(options) {
         this.options = options;
         this.fetcher = options.fetcher ?? fetch;
         this.now = options.now ?? Date.now;
+        this.free = new UpgradeAllowances(options.db, this.now);
     }
     async ensure() {
         this.schema ??= (async () => {
+            await this.free.ensure();
             await this.options.db.query(`CREATE TABLE IF NOT EXISTS translation_wallets (
         by_account TEXT PRIMARY KEY, balance_micros BIGINT NOT NULL CHECK (balance_micros >= 0), expires_at TIMESTAMPTZ NOT NULL)`);
             await this.options.db.query(`CREATE TABLE IF NOT EXISTS translation_orders (
@@ -93,41 +97,48 @@ export class TranslationPasses {
         const row = by ? (await this.options.db.query("SELECT balance_micros, expires_at FROM translation_wallets WHERE by_account = $1 AND expires_at > $2", [by, new Date(this.now())])).rows[0] : null;
         const orders = by ? (await this.options.db.query("SELECT id, payment_id, plan FROM translation_orders WHERE by_account = $1 AND status = 'pending' AND payment_id IS NOT NULL ORDER BY created_at DESC LIMIT 5", [by])).rows.map(order => ({ id: String(order["id"]), plan: String(order["plan"]), url: `https://coinpayportal.com/pay/${order["payment_id"]}` })) : [];
         return { required: true, available: config.coins.length > 0, balanceMicros: Number(row?.["balance_micros"] ?? 0),
-            expires: row ? new Date(String(row["expires_at"])).toISOString() : null, plans: TRANSLATION_PLANS, coins: config.coins, orders,
+            expires: row ? new Date(String(row["expires_at"])).toISOString() : null, plans: TRANSLATION_PLANS, coins: config.coins, orders, free: await this.free.access(by),
             rates: { transcriptionHour: 0.22, voiceThousand: 0.05, multiplier: TRANSLATION_MULTIPLIER } };
     }
-    async require(by) {
+    async begin(by, resource) {
         await this.ensure();
+        if (await this.free.begin(by, "translation", resource))
+            return;
+        await this.require(by, resource);
+    }
+    async require(by, resource = "") {
+        await this.ensure();
+        if ((await this.free.active([by], "translation", resource, true)).length)
+            return;
         const found = await this.options.db.query("SELECT by_account FROM translation_wallets WHERE by_account = $1 AND expires_at > $2 AND balance_micros > 0", [by, new Date(this.now())]);
         if (!found.rows.length)
-            throw new SpeechError("Buy a translation pass to enable translated audio.", 402);
+            throw new SpeechError("Buy a pass or start a remaining free session: this session has no free time or audio credit.", 402);
     }
-    async eligible(accounts) {
+    async eligible(accounts, resource = "") {
         await this.ensure();
         const result = await this.options.db.query("SELECT by_account FROM translation_wallets WHERE by_account = ANY($1::text[]) AND expires_at > $2 AND balance_micros > 0", [accounts, new Date(this.now())]);
-        return result.rows.map(row => String(row["by_account"]));
+        return [...new Set([...result.rows.map(row => String(row["by_account"])), ...await this.free.active(accounts, "translation", resource, true)])];
     }
-    async reserve(by, kind, units) {
-        await this.ensure();
-        const { cost, charge } = translationCost(kind, units), id = randomUUID();
-        const result = await this.options.db.query(`WITH debit AS (
-      UPDATE translation_wallets SET balance_micros = balance_micros - $2
-      WHERE by_account = $1 AND expires_at > $3 AND balance_micros >= $2 RETURNING by_account)
-      INSERT INTO translation_usage (id, by_account, kind, units, cost_micros, charge_micros, created_at)
-      SELECT $4, by_account, $5, $6, $7, $2, $3 FROM debit RETURNING id`, [by, charge, new Date(this.now()), id, kind, units, cost]);
-        if (!result.rows.length)
-            throw new SpeechError("Your translation balance is used up or expired. Buy another pass to continue.", 402);
-        return id;
+    async reserve(by, kind, units, resource = "") {
+        const result = await this.reserveMany([by], kind, units, resource);
+        if (!result.length)
+            throw new SpeechError("This free session ended and audio credit is used up. Start a remaining free session or buy a pass.", 402);
+        return result[0].id;
     }
     /** Batch a shared stream's access charges in one database round trip. */
-    async reserveMany(accounts, kind, units) {
+    async reserveMany(accounts, kind, units, resource = "") {
         await this.ensure();
         const { cost, charge } = translationCost(kind, units);
-        const result = await this.options.db.query(`WITH debit AS (
+        const now = this.now(), key = resource ? this.free.key("translation", resource) : "";
+        const result = await this.options.db.query(`WITH free AS (
+      SELECT DISTINCT by_account FROM upgrade_daily_uses WHERE by_account = ANY($1::text[])
+        AND (sessions->>$7)::bigint > $8), debit AS (
       UPDATE translation_wallets SET balance_micros = balance_micros - $2
-      WHERE by_account = ANY($1::text[]) AND expires_at > $3 AND balance_micros >= $2 RETURNING by_account)
+      WHERE by_account = ANY($1::text[]) AND expires_at > $3 AND balance_micros >= $2
+        AND by_account NOT IN (SELECT by_account FROM free) RETURNING by_account), admitted AS (
+      SELECT by_account, 0::bigint AS charge FROM free UNION ALL SELECT by_account, $2::bigint FROM debit)
       INSERT INTO translation_usage (id, by_account, kind, units, cost_micros, charge_micros, created_at)
-      SELECT gen_random_uuid()::text, by_account, $4, $5, $6, $2, $3 FROM debit RETURNING id, by_account`, [[...new Set(accounts)], charge, new Date(this.now()), kind, units, cost]);
+      SELECT gen_random_uuid()::text, by_account, $4, $5, $6, charge, $3 FROM admitted RETURNING id, by_account`, [[...new Set(accounts)], charge, new Date(now), kind, units, cost, key, now]);
         return result.rows.map(row => ({ by: String(row["by_account"]), id: String(row["id"]) }));
     }
     async commit(id) {

package/dist/upgrade-allowance.d.ts

@@ -0,0 +1,23 @@
+import type { Queryable } from "./follows.ts";
+export declare const FREE_UPGRADE_SESSIONS = 5;
+export declare const FREE_UPGRADE_RECONNECT_SECONDS = 90;
+export interface UpgradeAllowance {
+    limit: number;
+    remaining: number;
+    reconnectSeconds: number;
+    resets: string;
+    activeUntil: string | null;
+}
+export declare class UpgradeAllowances {
+    private readonly db;
+    private readonly now;
+    private schema;
+    constructor(db: Queryable, now?: () => number);
+    ensure(): Promise<void>;
+    key(product: string, resource: string): string;
+    access(by?: string): Promise<UpgradeAllowance>;
+    /** One atomic row serializes concurrent starts across tabs, products and replicas.
+     * Active use renews a short lease. Reconnecting reuses it; idle leases expire. */
+    begin(by: string, product: string, resource: string): Promise<boolean>;
+    active(accounts: string[], product: string, resource: string, renew?: boolean): Promise<string[]>;
+}

package/dist/upgrade-allowance.js

@@ -0,0 +1,70 @@
+/** Daily free access shared by Nixamp's paid panels and upgrades.
+ * Claim only on explicit use, never from balance polling or provider chunks. */
+import { createHash } from "node:crypto";
+import { SpeechError } from "./speech.js";
+export const FREE_UPGRADE_SESSIONS = 5;
+export const FREE_UPGRADE_RECONNECT_SECONDS = 90;
+const DAY = 86_400_000;
+export class UpgradeAllowances {
+    db;
+    now;
+    schema = null;
+    constructor(db, now = Date.now) {
+        this.db = db;
+        this.now = now;
+    }
+    async ensure() {
+        this.schema ??= this.db.query(`CREATE TABLE IF NOT EXISTS upgrade_daily_uses (
+      by_account TEXT NOT NULL, day BIGINT NOT NULL,
+      uses INTEGER NOT NULL CHECK (uses BETWEEN 1 AND 5),
+      sessions JSONB NOT NULL, PRIMARY KEY (by_account, day))`).then(() => undefined)
+            .catch(error => { this.schema = null; throw error; });
+        await this.schema;
+    }
+    key(product, resource) {
+        if (!/^[a-z][a-z0-9-]{0,63}$/.test(product) || !/^[\w-]{1,80}$/.test(resource))
+            throw new SpeechError("Choose a panel session.", 400);
+        return createHash("sha256").update(`${product}|${resource}`).digest("hex");
+    }
+    async access(by) {
+        await this.ensure();
+        const now = this.now(), day = Math.floor(now / DAY);
+        const rows = by ? (await this.db.query("SELECT uses, day, sessions FROM upgrade_daily_uses WHERE by_account = $1", [by])).rows : [];
+        const today = rows.find(row => Number(row["day"]) === day);
+        const active = Math.max(0, ...rows.flatMap(row => Object.values(row["sessions"]).map(Number)));
+        return { limit: FREE_UPGRADE_SESSIONS, remaining: Math.max(0, FREE_UPGRADE_SESSIONS - Number(today?.["uses"] ?? 0)),
+            reconnectSeconds: FREE_UPGRADE_RECONNECT_SECONDS, resets: new Date((day + 1) * DAY).toISOString(), activeUntil: active > now ? new Date(active).toISOString() : null };
+    }
+    /** One atomic row serializes concurrent starts across tabs, products and replicas.
+     * Active use renews a short lease. Reconnecting reuses it; idle leases expire. */
+    async begin(by, product, resource) {
+        if (!by)
+            throw new SpeechError("Sign in to use your free sessions.", 401);
+        const key = this.key(product, resource);
+        if ((await this.active([by], product, resource, true)).length)
+            return true;
+        await this.ensure();
+        const now = this.now(), day = Math.floor(now / DAY), until = now + FREE_UPGRADE_RECONNECT_SECONDS * 1000;
+        const result = await this.db.query(`INSERT INTO upgrade_daily_uses AS daily (by_account, day, uses, sessions)
+      VALUES ($1, $2, 1, jsonb_build_object($3::text, $5::bigint))
+      ON CONFLICT (by_account, day) DO UPDATE SET
+        uses = CASE WHEN COALESCE((daily.sessions->>$3)::bigint, 0) > $4 THEN daily.uses ELSE daily.uses + 1 END,
+        sessions = daily.sessions || EXCLUDED.sessions
+      WHERE COALESCE((daily.sessions->>$3)::bigint, 0) > $4 OR daily.uses < $6
+      RETURNING uses`, [by, day, key, now, until, FREE_UPGRADE_SESSIONS]);
+        return result.rows.length > 0;
+    }
+    async active(accounts, product, resource, renew = false) {
+        if (!resource || !accounts.length)
+            return [];
+        const key = this.key(product, resource);
+        await this.ensure();
+        const now = this.now();
+        const result = renew
+            ? await this.db.query(`UPDATE upgrade_daily_uses SET sessions = sessions || jsonb_build_object($2::text, $4::bigint)
+          WHERE by_account = ANY($1::text[]) AND (sessions->>$2)::bigint > $3 RETURNING by_account`, [accounts, key, now, now + FREE_UPGRADE_RECONNECT_SECONDS * 1000])
+            : await this.db.query(`SELECT by_account FROM upgrade_daily_uses
+          WHERE by_account = ANY($1::text[]) AND (sessions->>$2)::bigint > $3`, [accounts, key, now]);
+        return result.rows.map(row => String(row["by_account"]));
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.27.1",
+  "version": "0.27.2",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",

package/src/accounts.ts

@@ -19,7 +19,8 @@
  * terminal better than either -- OAuth 2.0 reached through the device grant in
  * device.ts -- and what it ends with is a token from tokens.ts.
  */
-import { createAuthSystem, PostgresAdapter } from "@profullstack/auth-system";
+import { createAuthSystem, createPasswordUtils, PostgresAdapter } from "@profullstack/auth-system";
+import { PasswordResets } from "./password-reset.ts";
 import { Identities, type Identity, type Users } from "./oauth.ts";
 import type { Queryable } from "./follows.ts";
 import { type IssuedToken, looksLikeToken, type TokenKind, type TokenRecord, Tokens } from "./tokens.ts";
@@ -129,6 +130,7 @@ export class Accounts {
   private readonly system: AuthLike;
   /** Null only where a test injected an auth system and no storage. */
   readonly tokens: Tokens | null;
+  readonly passwordResets: PasswordResets | null;
   private readonly identities: Identities | null;
 
   constructor(options: AccountsOptions) {
@@ -151,6 +153,8 @@ export class Accounts {
         passwordOptions: { ...PASSWORD_RULES },
       }) as AuthLike);
     this.tokens = adapter ? new Tokens(adapter) : null;
+    this.passwordResets = adapter && this.tokens
+      ? new PasswordResets(adapter, this.tokens, createPasswordUtils({ ...PASSWORD_RULES })) : null;
     this.identities = adapter ? new Identities(adapter, adapter) : null;
   }
 
@@ -216,7 +220,9 @@ export class Accounts {
       }
     }
     try {
-      return readClaims(await this.system.validateToken(token));
+      const account = readClaims(await this.system.validateToken(token));
+      if (account && this.passwordResets && !(await this.passwordResets.acceptsLegacyToken(account.id, token))) return null;
+      return account;
     } catch {
       return null;
     }

package/src/classroom.ts

@@ -0,0 +1,52 @@
+/** Public classroom metadata, shared by the API and the small school client. */
+export interface ClassroomSettings {
+  broadcastUrl?: string;
+  hostName?: string;
+  homepageUrl?: string;
+  avatarUrl?: string;
+  recurrence?: "daily" | "weekly";
+}
+
+export function publicWebUrl(value: unknown): string | null {
+  if (typeof value !== "string" || value.length > 2048) return null;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:" || url.username || url.password) return null;
+    return url.href;
+  } catch { return null; }
+}
+
+export function classroomBroadcast(value: unknown): { provider: "pairux" | "nixamp"; url: string; embed: string; join: string } | null {
+  const safe = publicWebUrl(value);
+  if (!safe) return null;
+  const url = new URL(safe);
+  if (!url.port && (url.hostname === "pairux.com" || url.hostname === "www.pairux.com")) {
+    const code = /^\/(?:l|join|embed)\/([A-Za-z0-9_-]{1,64})\/?$/.exec(url.pathname)?.[1];
+    if (!code) return null;
+    return { provider: "pairux", url: `https://pairux.com/l/${code}`, embed: `https://pairux.com/embed/${code}`, join: `https://pairux.com/join/${code}` };
+  }
+  if (!url.port && (url.hostname === "nixamp.com" || url.hostname === "www.nixamp.com")) {
+    if (url.pathname !== "/") return null;
+    // Never publish an admin credential in a classroom share link.
+    const server = url.searchParams.get("url") || "";
+    // The server's Share panel supplies a viewer URL without a track selection.
+    const play = url.searchParams.get("play") || (server ? "live" : "");
+    if (/\/admin\//i.test(server) || /\/admin\//i.test(play) || url.searchParams.has("key")) return null;
+    if (server && !publicWebUrl(server)) return null;
+    if (!/^(?:live|channel:[^\s]+|track:\d+)$/.test(play) && !publicWebUrl(play)) return null;
+    const clean = new URL("https://nixamp.com/");
+    if (server) clean.searchParams.set("url", server);
+    clean.searchParams.set("play", play);
+    const original = clean.href;
+    clean.searchParams.set("embed", "1");
+    return { provider: "nixamp", url: original, embed: clean.href, join: original };
+  }
+  // A self-hosted Nixamp viewer link can be played through the shared client.
+  if (url.hostname.endsWith(".nixamp.com") && /^\/view\/[A-Za-z0-9_-]+\/?$/.test(url.pathname) && !url.search) {
+    const player = new URL("https://nixamp.com/");
+    player.searchParams.set("url", url.href);
+    player.searchParams.set("play", "live");
+    return classroomBroadcast(player.href);
+  }
+  return null;
+}