nixamp 0.27.1 → 0.27.3

package/dist/live-interpreter.js

@@ -1,3 +1,4 @@
+import { audioError, transientAudioError } from "./live-recovery.js";
 import { encodeWav } from "./pcm-wav.js";
 /** Match provider labels across overlapping timestamps. A speaker absent from
  * the rolling context gets a new label; pitch alone never identifies someone. */
@@ -67,6 +68,8 @@ export class Interpreter {
     controller = null;
     translating = null;
     translationController = null;
+    recognitionFailures = 0;
+    translationFailures = 0;
     translations = [];
     constructor(options) {
         this.options = options;
@@ -78,6 +81,7 @@ export class Interpreter {
         this.pending = null;
         this.running = null;
         this.translating = null;
+        this.recognitionFailures = this.translationFailures = 0;
         this.translations = [];
         this.committedUntil = null;
         this.tracker.reset();
@@ -92,7 +96,7 @@ export class Interpreter {
         const response = await (this.options.fetcher ?? fetch)(path, { ...init, signal });
         const body = await response.json();
         if (!response.ok)
-            throw new Error(body.error || "Audio translation is unavailable.");
+            throw audioError(body.error || "Audio translation is unavailable.", response.status);
         return body;
     }
     async run(generation) {
@@ -101,74 +105,85 @@ export class Interpreter {
             while (this.pending && generation === this.generation) {
                 const window = this.pending;
                 this.pending = null;
-                if (Date.now() - window.until > 12_000)
-                    continue;
-                const controller = new AbortController();
-                this.controller = controller;
-                const signal = AbortSignal.any([controller.signal, AbortSignal.timeout(12_000)]);
-                const speakers = this.options.speakers(), target = this.options.language();
-                const heard = await this.json(speakers ? "/api/v1/speech/speakers" : "/api/v1/speech/transcribe?live=1", {
-                    method: "POST", headers: { "content-type": "audio/wav" }, body: new Uint8Array(encodeWav(speakers ? window.samples : window.samples.slice(-80_000))),
-                }, signal);
-                if (generation !== this.generation)
-                    return;
-                const language = heard.language;
-                let lines = [];
-                if (speakers) {
-                    const links = this.tracker.reconcile(heard.turns ?? [], window.at, this.options.voices());
-                    // The watermark follows emitted words, not the newest capture
-                    // interval: an overlapping window can recover audio that arrived
-                    // while recognition/translation was busy. Keep unfinished phrases
-                    // in that overlap so short capture intervals do not split every
-                    // sentence (especially damaging when German changes word order).
-                    const cutoff = this.committedUntil ?? window.freshAt;
-                    const turns = heard.turns ?? [];
-                    for (const [index, turn] of turns.entries()) {
-                        const speaker = links.get(turn.speaker);
-                        const words = turn.words.filter(word => window.at + (word.start + word.end) * 500 >= cutoff &&
-                            (window.at + word.end * 1000 <= window.until - 100 || /[.!?。！？]$/.test(word.text)));
-                        let phrase = [];
-                        const emit = () => {
-                            if (!phrase.length)
-                                return;
-                            lines.push({ channel: this.options.channel(), at: window.at + phrase[0].start * 1000,
-                                until: window.at + phrase.at(-1).end * 1000, text: phrase.map(word => word.text).join(" ").trim(),
-                                language, speaker: speaker.id, voiceProfile: turn.profile });
-                            phrase = [];
-                        };
-                        for (const word of words) {
-                            if (phrase.length && word.start - phrase.at(-1).end >= 0.45)
-                                emit();
-                            phrase.push(word);
-                            if (/[.!?。！？]$/.test(word.text) || phrase.map(word => word.text).join(" ").length >= 400)
+                try {
+                    if (Date.now() - window.until > 12_000)
+                        continue;
+                    const controller = new AbortController();
+                    this.controller = controller;
+                    const signal = AbortSignal.any([controller.signal, AbortSignal.timeout(12_000)]);
+                    const speakers = this.options.speakers(), target = this.options.language();
+                    const heard = await this.json(speakers ? "/api/v1/speech/speakers" : "/api/v1/speech/transcribe?live=1", {
+                        method: "POST", headers: { "content-type": "audio/wav" }, body: new Uint8Array(encodeWav(speakers ? window.samples : window.samples.slice(-80_000))),
+                    }, signal);
+                    if (generation !== this.generation)
+                        return;
+                    this.recognitionFailures = 0;
+                    const language = heard.language;
+                    let lines = [];
+                    if (speakers) {
+                        const links = this.tracker.reconcile(heard.turns ?? [], window.at, this.options.voices());
+                        // The watermark follows emitted words, not the newest capture
+                        // interval: an overlapping window can recover audio that arrived
+                        // while recognition/translation was busy. Keep unfinished phrases
+                        // in that overlap so short capture intervals do not split every
+                        // sentence (especially damaging when German changes word order).
+                        const cutoff = this.committedUntil ?? window.freshAt;
+                        const turns = heard.turns ?? [];
+                        for (const [index, turn] of turns.entries()) {
+                            const speaker = links.get(turn.speaker);
+                            const words = turn.words.filter(word => window.at + (word.start + word.end) * 500 >= cutoff &&
+                                (window.at + word.end * 1000 <= window.until - 100 || /[.!?。！？]$/.test(word.text)));
+                            let phrase = [];
+                            const emit = () => {
+                                if (!phrase.length)
+                                    return;
+                                lines.push({ channel: this.options.channel(), at: window.at + phrase[0].start * 1000,
+                                    until: window.at + phrase.at(-1).end * 1000, text: phrase.map(word => word.text).join(" ").trim(),
+                                    language, speaker: speaker.id, voiceProfile: turn.profile });
+                                phrase = [];
+                            };
+                            for (const word of words) {
+                                if (phrase.length && word.start - phrase.at(-1).end >= 0.45)
+                                    emit();
+                                phrase.push(word);
+                                if (/[.!?。！？]$/.test(word.text) || phrase.map(word => word.text).join(" ").length >= 400)
+                                    emit();
+                            }
+                            if (phrase.length && (index < turns.length - 1 ||
+                                window.until - (window.at + phrase.at(-1).end * 1000) >= 350 ||
+                                window.until - (window.at + phrase[0].start * 1000) >= 3000))
                                 emit();
                         }
-                        if (phrase.length && (index < turns.length - 1 ||
-                            window.until - (window.at + phrase.at(-1).end * 1000) >= 350 ||
-                            window.until - (window.at + phrase[0].start * 1000) >= 3000))
-                            emit();
                     }
+                    else if (heard.text) {
+                        lines = [{ channel: this.options.channel(), at: window.freshAt, until: window.until, text: heard.text, language }];
+                    }
+                    if (!lines.length)
+                        continue;
+                    this.committedUntil = Math.max(this.committedUntil ?? window.freshAt, ...lines.map(line => line.until));
+                    // Drop expired work instead of turning off an otherwise healthy stream.
+                    this.translations = this.translations.filter(item => Date.now() - item.until <= 12_000).slice(-11);
+                    this.translations.push({ lines, language, target, until: window.until });
+                    // Recognition of the next audio window can proceed while the text
+                    // model translates this phrase. Voice synthesis is a third stage.
+                    if (this.translating === null)
+                        void this.translate(this.generation);
                 }
-                else if (heard.text) {
-                    lines = [{ channel: this.options.channel(), at: window.freshAt, until: window.until, text: heard.text, language }];
+                catch (error) {
+                    if (generation !== this.generation)
+                        return;
+                    if (!transientAudioError(error) || ++this.recognitionFailures >= 3)
+                        throw error;
+                    this.options.status("Speech recognition interrupted · listening for the next phrase…");
                 }
-                if (!lines.length)
-                    continue;
-                this.committedUntil = Math.max(this.committedUntil ?? window.freshAt, ...lines.map(line => line.until));
-                if (this.translations.length >= 12)
-                    throw new Error("Translation fell behind. Try again after the language model has warmed up.");
-                this.translations.push({ lines, language, target, until: window.until });
-                // Recognition of the next audio window can proceed while the text
-                // model translates this phrase. Voice synthesis is a third stage.
-                if (this.translating === null)
-                    void this.translate(this.generation);
             }
         }
         catch (error) {
             if (generation === this.generation) {
+                const message = error instanceof Error ? error.message : "Live translation stopped.";
                 this.reset();
-                this.options.failed();
-                this.options.status(error instanceof Error ? error.message : "Live translation stopped.");
+                this.options.failed(message);
+                this.options.status(message);
             }
         }
         finally {
@@ -181,36 +196,47 @@ export class Interpreter {
         try {
             while (this.translations.length && generation === this.generation) {
                 const item = this.translations.shift();
-                let { lines } = item;
-                const { language, target, until } = item;
-                if (Date.now() - until > 12_000)
-                    throw new Error("Translation fell behind. Try again after the language model has warmed up.");
-                const controller = new AbortController();
-                this.translationController = controller;
-                if (target && language !== target) {
-                    if (!language)
-                        throw new Error("The audio language could not be detected. Waiting for clearer speech.");
-                    const translated = await this.json("/api/v1/translate?live=1", {
-                        method: "POST", headers: { "content-type": "application/json" },
-                        body: JSON.stringify({ texts: lines.map(line => line.text), from: language, to: target }),
-                    }, AbortSignal.any([controller.signal, AbortSignal.timeout(12_000)]));
-                    if (translated.texts.length !== lines.length || translated.texts.some(text => !text.trim()))
-                        throw new Error("Translation omitted a phrase. Enable translated audio again to retry.");
-                    lines = lines.map((line, i) => ({ ...line, original: line.text, sourceLanguage: language, language: target, text: translated.texts[i] }));
+                try {
+                    let { lines } = item;
+                    const { language, target, until } = item;
+                    if (Date.now() - until > 12_000)
+                        continue;
+                    const controller = new AbortController();
+                    this.translationController = controller;
+                    if (target && language !== target) {
+                        if (!language)
+                            throw audioError("The audio language could not be detected. Waiting for clearer speech.", 502);
+                        const translated = await this.json("/api/v1/translate?live=1", {
+                            method: "POST", headers: { "content-type": "application/json" },
+                            body: JSON.stringify({ texts: lines.map(line => line.text), from: language, to: target }),
+                        }, AbortSignal.any([controller.signal, AbortSignal.timeout(12_000)]));
+                        if (translated.texts.length !== lines.length || translated.texts.some(text => !text.trim()))
+                            throw audioError("Translation omitted a phrase. Waiting for the next phrase.", 502);
+                        lines = lines.map((line, i) => ({ ...line, original: line.text, sourceLanguage: language, language: target, text: translated.texts[i] }));
+                    }
+                    if (generation !== this.generation)
+                        return;
+                    if (Date.now() - until > 12_000)
+                        continue;
+                    this.translationFailures = 0;
+                    this.options.lines(lines.flatMap(line => splitCaption(line)));
+                    this.options.status(target ? `${language} → ${target} · live translation` : `Original audio language: ${language || "detecting…"}`);
+                }
+                catch (error) {
+                    if (generation !== this.generation)
+                        return;
+                    if (!transientAudioError(error) || ++this.translationFailures >= 3)
+                        throw error;
+                    this.options.status("Translation interrupted · catching up with live speech…");
                 }
-                if (generation !== this.generation)
-                    return;
-                if (Date.now() - until > 12_000)
-                    throw new Error("Translation fell behind. Try again after the language model has warmed up.");
-                this.options.lines(lines.flatMap(line => splitCaption(line)));
-                this.options.status(target ? `${language} → ${target} · live translation` : `Original audio language: ${language || "detecting…"}`);
             }
         }
         catch (error) {
             if (generation === this.generation) {
+                const message = error instanceof Error ? error.message : "Live translation stopped.";
                 this.reset();
-                this.options.failed();
-                this.options.status(error instanceof Error ? error.message : "Live translation stopped.");
+                this.options.failed(message);
+                this.options.status(message);
             }
         }
         finally {

package/dist/live-recovery.d.ts

@@ -0,0 +1,6 @@
+/** Access, billing and throttling failures are terminal. Only transient service
+ * and transport failures may recover, with a bounded consecutive failure count. */
+export declare function transientAudioError(error: unknown): boolean;
+export declare function audioError(message: string, status: number): Error & {
+    status: number;
+};

package/dist/live-recovery.js

@@ -0,0 +1,11 @@
+/** Access, billing and throttling failures are terminal. Only transient service
+ * and transport failures may recover, with a bounded consecutive failure count. */
+export function transientAudioError(error) {
+    const status = error?.status;
+    if (typeof status === "number")
+        return [408, 502, 503, 504].includes(status);
+    return error instanceof TypeError || (error instanceof Error && ["AbortError", "TimeoutError"].includes(error.name));
+}
+export function audioError(message, status) {
+    return Object.assign(new Error(message), { status });
+}

package/dist/live-voice.d.ts

@@ -57,7 +57,7 @@ export declare class LiveVoice {
     /** Optional diarization, billed only while a signed-in listener requests it.
      * Rolling audio is bounded to 15 seconds, including overlap. Every second
      * submitted (also repeated context) consumes the persistent provider budget. */
-    hear(bytes: Uint8Array, by: string, signal?: AbortSignal, meter?: TranslationMeter | undefined): Promise<SpeakerTranscript>;
+    hear(bytes: Uint8Array, by: string, signal?: AbortSignal, meter?: TranslationMeter | undefined, resource?: string): Promise<SpeakerTranscript>;
     voices(): Promise<LiveVoiceChoice[]>;
     /** A 90-second capability for one channel, never the viewer's account credential. */
     grant(by: string, channel: string): Promise<{

package/dist/live-voice.js

@@ -47,10 +47,10 @@ export class LiveVoice {
     /** Optional diarization, billed only while a signed-in listener requests it.
      * Rolling audio is bounded to 15 seconds, including overlap. Every second
      * submitted (also repeated context) consumes the persistent provider budget. */
-    async hear(bytes, by, signal, meter = this.billing) {
+    async hear(bytes, by, signal, meter = this.billing, resource = "") {
         if (!this.available())
             throw new SpeechError("speaker voices are unavailable", 503);
-        await meter?.require(by);
+        await meter?.require(by, resource);
         const wav = decodeWav(bytes);
         const seconds = wav.samples.length / wav.rate;
         if (wav.rate !== 16000 || wav.channels !== 1 || seconds < 0.2 || seconds > 15.1)
@@ -82,7 +82,7 @@ export class LiveVoice {
             form.set("tag_audio_events", "false");
             form.set("timestamps_granularity", "word");
             // No language_code: preserve the source language, including Spanish.
-            reservation = await meter?.reserve(by, "transcription", wav.samples.length);
+            reservation = await meter?.reserve(by, "transcription", wav.samples.length, resource);
             const answer = await this.fetcher("https://api.elevenlabs.io/v1/speech-to-text", {
                 method: "POST", headers: { "xi-api-key": this.key }, body: form,
                 signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000),
@@ -127,7 +127,7 @@ export class LiveVoice {
             throw new SpeechError("choose a playback session or live channel", 400);
         if (!this.requests.check(`grant:${by}`, { allowed: 10, windowMs: 60_000 }).ok)
             throw new SpeechError("too many audio authorization requests", 429);
-        await this.billing?.require(by);
+        await this.billing?.require(by, channel);
         for (const [token, grant] of this.grants)
             if (grant.expires <= this.now())
                 this.grants.delete(token);
@@ -217,7 +217,7 @@ export class LiveVoice {
     /** Stream the first request immediately; concurrent listeners share its cached result. */
     async stream(ask, by, signal, meter = this.billing) {
         this.checkRequest(by);
-        await meter?.require(by);
+        await meter?.require(by, ask.channel);
         const text = typeof ask.text === "string" ? ask.text.trim() : "";
         if (!text || text.length > 600)
             throw new SpeechError("translated audio needs a caption of 1–600 characters", 400);
@@ -242,7 +242,7 @@ export class LiveVoice {
         if (cached || pending) {
             const bytes = cached?.bytes ?? await pending;
             signal?.throwIfAborted();
-            const paid = await meter?.reserve(by, "voice", text.length);
+            const paid = await meter?.reserve(by, "voice", text.length, ask.channel);
             if (paid)
                 await meter.commit(paid);
             return new Response(new Uint8Array(bytes), { headers: HEADERS });
@@ -265,7 +265,7 @@ export class LiveVoice {
         try {
             await this.charge(by, ask.channel ?? "direct", text.length);
             signal?.throwIfAborted();
-            reservation = await meter?.reserve(by, "voice", text.length);
+            reservation = await meter?.reserve(by, "voice", text.length, ask.channel);
             const response = await this.fetcher(`https://api.elevenlabs.io/v1/text-to-speech/${voice.id}/stream?output_format=pcm_16000`, {
                 method: "POST",
                 headers: { "xi-api-key": this.key, "content-type": "application/json" },

package/dist/mail-sender.d.ts

@@ -0,0 +1,9 @@
+export interface MailSender {
+    apiKey: string;
+    from: string;
+}
+export interface BrandedMailSender extends MailSender {
+    backtoschool?: MailSender;
+}
+/** Only the exact school origins select its verified sender and credentials. */
+export declare function mailSender(options: BrandedMailSender, link: string): MailSender;

package/dist/mail-sender.js

@@ -0,0 +1,11 @@
+/** Only the exact school origins select its verified sender and credentials. */
+export function mailSender(options, link) {
+    try {
+        const url = new URL(link);
+        if (options.backtoschool && url.protocol === "https:" &&
+            ["backtoschool.help", "www.backtoschool.help"].includes(url.hostname))
+            return options.backtoschool;
+    }
+    catch { /* A malformed link never changes the sender. */ }
+    return options;
+}

package/dist/notify.d.ts

@@ -1,3 +1,4 @@
+import { type BrandedMailSender } from "./mail-sender.ts";
 /**
  * Telling followers a broadcaster went live, wherever they are.
  *
@@ -58,9 +59,8 @@ export declare function notifyAll(audience: readonly Reachable[], note: Notifica
  * HTTP rather than SMTP so there is no connection to hold, no port to be
  * blocked, and no dependency: a fetch is the whole client.
  */
-export declare function resendEmail({ apiKey, from, fetch, onEvent }: {
-    apiKey: string;
-    from: string;
+export declare function resendEmail({ apiKey, from, backtoschool, reason, fetch, onEvent }: BrandedMailSender & {
+    reason?: string;
     fetch?: typeof globalThis.fetch;
     onEvent?: (message: string) => void;
 }): (to: string, note: Notification) => Promise<boolean>;

package/dist/notify.js

@@ -1,3 +1,4 @@
+import { mailSender } from "./mail-sender.js";
 /**
  * Tell an audience, on every channel each of them wants.
  *
@@ -52,20 +53,22 @@ export async function notifyAll(audience, note, channels) {
  * HTTP rather than SMTP so there is no connection to hold, no port to be
  * blocked, and no dependency: a fetch is the whole client.
  */
-export function resendEmail({ apiKey, from, fetch = globalThis.fetch, onEvent }) {
+export function resendEmail({ apiKey, from, backtoschool, reason = "You are getting this because you follow them on nixamp.", fetch = globalThis.fetch, onEvent }) {
     return async (to, note) => {
         try {
+            const sender = mailSender({ apiKey, from, backtoschool }, note.url);
             const response = await fetch("https://api.resend.com/emails", {
                 method: "POST",
-                headers: { authorization: `Bearer ${apiKey}`, "content-type": "application/json" },
+                headers: { authorization: `Bearer ${sender.apiKey}`, "content-type": "application/json" },
+                signal: AbortSignal.timeout(15_000),
                 body: JSON.stringify({
-                    from,
+                    from: sender.from,
                     to: [to],
                     subject: note.title,
-                    text: `${note.body}\n\n${note.url}\n\nYou are getting this because you follow them on nixamp.`,
+                    text: `${note.body}\n\n${note.url}\n\n${reason}`,
                     html: `<p>${escapeHtml(note.body)}</p>` +
                         `<p><a href="${escapeHtml(note.url)}">${escapeHtml(note.url)}</a></p>` +
-                        `<p style="color:#666;font-size:12px">You are getting this because you follow them on nixamp.</p>`,
+                        `<p style="color:#666;font-size:12px">${escapeHtml(reason)}</p>`,
                 }),
             });
             if (!response.ok) {

package/dist/password-reset-page.d.ts

@@ -0,0 +1,2 @@
+/** A small recovery page shared by every branded client on this account server. */
+export declare function passwordResetPage(site: string, nonce: string): string;

package/dist/password-reset-page.js

@@ -0,0 +1,106 @@
+function escape(value) {
+    return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll('"', "&quot;");
+}
+/** A small recovery page shared by every branded client on this account server. */
+export function passwordResetPage(site, nonce) {
+    const host = new URL(site).hostname;
+    const school = host === "backtoschool.help" || host === "www.backtoschool.help";
+    const name = school ? "BackToSchool.help" : host;
+    const home = school ? "/#live" : "/";
+    return `<!doctype html><html lang="en"><head>
+  <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="referrer" content="no-referrer"><meta name="robots" content="noindex, nofollow">
+  <title>Reset your password — ${escape(name)}</title>
+  <style>
+  :root{font-family:system-ui,sans-serif;color:#34246d;background:#f7f3e9;color-scheme:light}
+  *{box-sizing:border-box}body{margin:0}header{padding:1.25rem max(1rem,calc((100% - 960px)/2));border-bottom:1px solid #ddd5e6}
+  a{color:#34246d;text-underline-offset:3px}header a{font-weight:800;text-decoration:none}
+  main{max-width:480px;margin:clamp(2rem,8vh,5rem) auto;padding:0 1rem 3rem}
+  .card{background:#fffdf8;border:1px solid #ddd5e6;border-radius:20px;padding:clamp(1.25rem,5vw,2rem)}
+  h1{font-family:Georgia,serif;font-size:2.25rem;line-height:1.1;margin:0 0 1rem}p{line-height:1.55}
+  label{display:block;font-weight:650;margin:1.25rem 0 .5rem}input{width:100%;font:inherit;padding:.85rem;border:1px solid #8a829f;border-radius:10px;background:white;color:#211747}
+  button{width:100%;font:inherit;font-weight:700;border:0;border-radius:30px;background:#34246d;color:white;padding:.9rem 1.1rem;margin-top:1.25rem;cursor:pointer}
+  button[aria-disabled=true]{opacity:.65;cursor:wait}a:focus-visible,input:focus-visible,button:focus-visible{outline:3px solid #b14b29;outline-offset:3px}
+  .help{font-size:.9rem;color:#514961}.message:empty{display:none}.error{color:#9b202a}.success{color:#215d3d}
+  .back{display:inline-block;margin-top:1.5rem}[hidden]{display:none!important}
+  @media(forced-colors:active){.card,button{border:1px solid CanvasText}}
+  </style></head><body>
+  <header><a href="${home}">${escape(name)}</a></header>
+  <main><div class="card">
+    <h1 id="title">Forgot your password?</h1>
+    <p id="intro">Enter your account’s email address and we’ll send you a link to choose a new password.</p>
+    <form id="request-form">
+      <label for="email">Email</label><input id="email" name="email" type="email" autocomplete="email" maxlength="320" required>
+      <button type="submit">Send reset link</button>
+    </form>
+    <form id="reset-form" hidden>
+      <label for="password">New password</label><input id="password" name="password" type="password" autocomplete="new-password" minlength="8" maxlength="200" aria-describedby="password-help" required>
+      <p class="help" id="password-help">Use at least 8 characters, including a number.</p>
+      <label for="confirm">Confirm new password</label><input id="confirm" name="confirm" type="password" autocomplete="new-password" minlength="8" maxlength="200" required>
+      <button type="submit">Save new password</button>
+    </form>
+    <p id="status" class="message success" role="status" aria-live="polite"></p>
+    <p id="error" class="message error" role="alert"></p>
+    <p id="another" hidden><a href="/reset-password">Request a new reset link</a></p>
+    <a class="back" id="back" href="${home}">Back to sign in</a>
+    <noscript><p>Enable JavaScript to reset your password.</p></noscript>
+  </div></main>
+  <script nonce="${nonce}">${SCRIPT}</script></body></html>`;
+}
+const SCRIPT = String.raw `
+(() => {
+  const requestForm = document.querySelector('#request-form');
+  const resetForm = document.querySelector('#reset-form');
+  const status = document.querySelector('#status');
+  const error = document.querySelector('#error');
+  let token = ''; let pending = false; let done = false;
+  function readLink() {
+    const incoming = new URLSearchParams(location.hash.slice(1)).get('token');
+    if (location.hash) history.replaceState(null, '', location.pathname);
+    if (!incoming) return;
+    token = incoming; done = false;
+    status.textContent = ''; error.textContent = '';
+    document.querySelector('#another').hidden = true;
+    for (const field of resetForm.querySelectorAll('input')) {field.value = ''; field.readOnly = false;}
+    const button = resetForm.querySelector('button');
+    button.textContent = 'Save new password'; button.removeAttribute('aria-disabled');
+    requestForm.hidden = true; resetForm.hidden = false;
+    document.querySelector('#title').textContent = 'Choose a new password';
+    document.querySelector('#intro').textContent = 'Your new password works here and on NixAmp. Existing sessions will be signed out.';
+  }
+  readLink(); window.addEventListener('hashchange', readLink);
+  async function submit(form, path, input) {
+    if (pending || done) return;
+    pending = true; error.textContent = ''; status.textContent = '';
+    const button = form.querySelector('button');
+    button.setAttribute('aria-disabled', 'true'); form.setAttribute('aria-busy', 'true');
+    try {
+      const response = await fetch(path, {method:'POST', credentials:'same-origin', headers:{'content-type':'application/json'}, body:JSON.stringify(input)});
+      const result = await response.json();
+      if (!response.ok) {
+        if (form === resetForm && response.status === 400) document.querySelector('#another').hidden = false;
+        throw new Error(result.error || 'That did not work. Please try again.');
+      }
+      status.textContent = result.message;
+      if (form === resetForm) {
+        done = true; token = '';
+        for (const field of form.querySelectorAll('input')) {field.value = ''; field.readOnly = true;}
+        button.textContent = 'Password saved';
+        document.querySelector('#back').textContent = 'Sign in with your new password';
+      }
+    } catch (problem) {error.textContent = problem instanceof TypeError ? 'Could not connect. Please try again.' : problem.message;}
+    finally {pending = false; form.removeAttribute('aria-busy'); if (!done) button.removeAttribute('aria-disabled');}
+  }
+  requestForm.addEventListener('submit', event => {
+    event.preventDefault();
+    void submit(requestForm, '/api/v1/auth/password-reset/request', {email:requestForm.elements.email.value.trim()});
+  });
+  resetForm.addEventListener('submit', event => {
+    event.preventDefault();
+    if (pending || done) return;
+    const password = resetForm.elements.password.value;
+    if (password !== resetForm.elements.confirm.value) {error.textContent = 'The passwords do not match.'; return;}
+    if (!/[0-9]/.test(password)) {error.textContent = 'Include at least one number in your password.'; return;}
+    void submit(resetForm, '/api/v1/auth/password-reset/confirm', {token, password});
+  });
+})();`;

package/dist/password-reset.d.ts

@@ -0,0 +1,34 @@
+import type { Queryable } from "./follows.ts";
+import type { Tokens } from "./tokens.ts";
+import { type BrandedMailSender } from "./mail-sender.ts";
+export declare const RESET_MESSAGE = "If an account exists for that email, you\u2019ll receive a password reset link shortly.";
+export declare const RESET_INVALID = "This reset link is invalid, expired, or already used. Request a new link.";
+interface Passwords {
+    hashPassword(password: string): Promise<string>;
+    validatePassword(password: string): {
+        valid: boolean;
+        message: string;
+    };
+}
+export type ResetMail = (email: string, link: string) => Promise<boolean>;
+export declare class PasswordResets {
+    private readonly db;
+    private readonly tokens;
+    private readonly passwords;
+    private ready;
+    constructor(db: Queryable & {
+        initialize?(): Promise<void>;
+    }, tokens: Tokens, passwords: Passwords);
+    private ensure;
+    /** The public response is identical for registered and unknown addresses. */
+    request(email: string, site: string, deliver: ResetMail): Promise<void>;
+    /** Claim the link, change the password, and revoke sessions in one statement. */
+    confirm(token: unknown, password: unknown): Promise<string | null>;
+    /** Older JWT sessions also stop working after recovery, across restarts. */
+    acceptsLegacyToken(userId: string, token: string): Promise<boolean>;
+}
+/** Transactional recovery mail has no follower footer and never logs a token. */
+export declare function resendPasswordReset(options: BrandedMailSender & {
+    fetch?: typeof globalThis.fetch;
+}): ResetMail;
+export {};