nixamp 0.27.1 → 0.27.3

package/dist/password-reset.js

@@ -0,0 +1,121 @@
+import { createHash, randomBytes } from "node:crypto";
+import { mailSender } from "./mail-sender.js";
+export const RESET_MESSAGE = "If an account exists for that email, you’ll receive a password reset link shortly.";
+export const RESET_INVALID = "This reset link is invalid, expired, or already used. Request a new link.";
+const LIFETIME_MS = 30 * 60_000;
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS nixamp_password_resets (
+    user_id TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+    token_hash TEXT UNIQUE,
+    password_hash TEXT,
+    expires_at TIMESTAMPTZ,
+    reset_at TIMESTAMPTZ
+  );
+`;
+function digest(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+export class PasswordResets {
+    db;
+    tokens;
+    passwords;
+    ready = null;
+    constructor(db, tokens, passwords) {
+        this.db = db;
+        this.tokens = tokens;
+        this.passwords = passwords;
+    }
+    async ensure() {
+        this.ready ??= (async () => {
+            await this.db.initialize?.();
+            await this.tokens.initialize();
+            await this.db.query(SCHEMA);
+        })().catch((error) => { this.ready = null; throw error; });
+        await this.ready;
+    }
+    /** The public response is identical for registered and unknown addresses. */
+    async request(email, site, deliver) {
+        await this.ensure();
+        const token = randomBytes(32).toString("base64url");
+        const { rows } = await this.db.query(`INSERT INTO nixamp_password_resets (user_id, token_hash, password_hash, expires_at)
+       SELECT id, $2, password, now() + interval '30 minutes' FROM users WHERE lower(email) = $1
+       ON CONFLICT (user_id) DO UPDATE SET token_hash = EXCLUDED.token_hash,
+         password_hash = EXCLUDED.password_hash, expires_at = EXCLUDED.expires_at
+       RETURNING user_id`, [email.trim().toLowerCase(), digest(token)]);
+        if (!rows.length)
+            return;
+        // Fragments never reach HTTP logs or referrers. Email delivery also never
+        // changes the HTTP response (or its timing) according to account existence.
+        const link = `${site.replace(/\/+$/, "")}/reset-password#token=${token}`;
+        void Promise.resolve().then(() => deliver(email.trim().toLowerCase(), link)).then((sent) => {
+            if (!sent)
+                console.error("nixamp: password reset email delivery failed");
+        }).catch(() => console.error("nixamp: password reset email delivery failed"));
+    }
+    /** Claim the link, change the password, and revoke sessions in one statement. */
+    async confirm(token, password) {
+        if (typeof token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(token))
+            return RESET_INVALID;
+        if (typeof password !== "string" || password.length > 200)
+            return "Enter a password between 8 and 200 characters.";
+        const validation = this.passwords.validatePassword(password);
+        if (!validation.valid)
+            return validation.message;
+        await this.ensure();
+        const tokenHash = digest(token);
+        // Reject bad tokens before doing the deliberately expensive password hash.
+        const candidate = await this.db.query(`SELECT user_id FROM nixamp_password_resets WHERE token_hash = $1 AND expires_at > now()`, [tokenHash]);
+        if (!candidate.rows.length)
+            return RESET_INVALID;
+        const hashed = await this.passwords.hashPassword(password);
+        const { rows } = await this.db.query(`WITH consumed AS (
+         UPDATE nixamp_password_resets r SET token_hash = NULL, expires_at = NULL,
+           password_hash = NULL, reset_at = clock_timestamp()
+         FROM users u WHERE r.token_hash = $1 AND r.expires_at > now()
+           AND u.id = r.user_id AND r.password_hash IS NOT DISTINCT FROM u.password
+         RETURNING r.user_id
+       ), changed AS (
+         UPDATE users u SET password = $2, updated_at = now()
+         FROM consumed c WHERE u.id = c.user_id RETURNING u.id
+       ), revoked AS (
+         DELETE FROM nixamp_tokens t USING changed c WHERE t.user_id = c.id RETURNING t.id
+       ) SELECT id FROM changed`, [tokenHash, hashed]);
+        return rows.length ? null : RESET_INVALID;
+    }
+    /** Older JWT sessions also stop working after recovery, across restarts. */
+    async acceptsLegacyToken(userId, token) {
+        await this.ensure();
+        const { rows } = await this.db.query("SELECT reset_at FROM nixamp_password_resets WHERE user_id = $1", [userId]);
+        if (!rows[0]?.["reset_at"])
+            return true;
+        try {
+            // Called only after the auth library has verified the JWT signature.
+            const claims = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+            const issued = claims.iat;
+            const reset = rows[0]["reset_at"];
+            const resetAt = reset instanceof Date ? reset.getTime() : new Date(String(reset)).getTime();
+            return typeof issued === "number" && Number.isFinite(issued)
+                && issued * 1000 >= resetAt;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+/** Transactional recovery mail has no follower footer and never logs a token. */
+export function resendPasswordReset(options) {
+    return async (email, link) => {
+        const host = new URL(link).hostname;
+        const sender = mailSender(options, link);
+        const response = await (options.fetch ?? globalThis.fetch)("https://api.resend.com/emails", {
+            method: "POST",
+            headers: { authorization: `Bearer ${sender.apiKey}`, "content-type": "application/json" },
+            signal: AbortSignal.timeout(15_000),
+            body: JSON.stringify({
+                from: sender.from, to: [email], subject: `Reset your ${host} password`,
+                text: `Someone requested a password reset for your account on ${host}.\n\nChoose a new password using this link:\n${link}\n\nThis link expires in ${LIFETIME_MS / 60_000} minutes and works once. Resetting your password signs out existing sessions.\n\nIf you did not request this, you can ignore this email. Your password will stay the same.`,
+            }),
+        });
+        return response.ok;
+    };
+}

package/dist/server.d.ts

@@ -7,6 +7,7 @@ import { Broadcaster, type Destination, type EncoderSettings } from "./broadcast
 import { Ingest } from "./ingest.ts";
 import { Channels, type Channel, type ChannelInfo, type RememberedChannel } from "./channels.ts";
 import { Accounts } from "./accounts.ts";
+import { type ResetMail } from "./password-reset.ts";
 import { Handles } from "./handles.ts";
 import { OpenDirs } from "./opendirs.ts";
 import { Servers } from "./servers.ts";
@@ -28,6 +29,7 @@ import { Names } from "./names.ts";
 import { Certs } from "./certs.ts";
 import { type Throttle } from "@profullstack/throttle";
 import { type Notification } from "./notify.ts";
+import { EventWriter } from "./event-writer.ts";
 import { LiveEvents } from "./live-events.ts";
 import { Tickets } from "./tickets.ts";
 import { Layouts } from "./layouts.ts";
@@ -659,6 +661,8 @@ export interface HandlerOptions {
     }[];
     /** Accounts, on the instance that keeps them. Only nixamp.com passes this. */
     accounts?: Accounts;
+    /** Transactional password recovery mail, separate from follow notifications. */
+    resetMail?: ResetMail;
     /** Providers to sign in with, and the terminals waiting to be connected. */
     signIn?: SignIn;
     /** The servers each account runs, on the instance that keeps accounts. */
@@ -700,6 +704,7 @@ export interface HandlerOptions {
     settingsSync?: SettingsSync;
     /** Scheduled and live sessions, kept by NixAmp and shared by branded clients. */
     events?: LiveEvents;
+    eventWriter?: EventWriter;
     /** Versioned panel layouts, including event and user overrides. */
     layouts?: Layouts;
     /** Persistent participation state that must not be coupled to live audio. */

package/dist/server.js

@@ -27,6 +27,8 @@ import { Ingest, normaliseFormat } from "./ingest.js";
 import { BACKLOG_SECONDS, Channels, cleanId, generatedId, rememberChannels, rememberedChannels, rememberedNow, } from "./channels.js";
 import { RtmpListeners } from "./rtmp-in.js";
 import { Accounts, clearedCookie, sessionCookie, tokenFrom } from "./accounts.js";
+import { RESET_INVALID, RESET_MESSAGE, resendPasswordReset } from "./password-reset.js";
+import { passwordResetPage } from "./password-reset-page.js";
 import { anonymousHandle, Handles } from "./handles.js";
 import { OpenDirs } from "./opendirs.js";
 import { Servers } from "./servers.js";
@@ -64,6 +66,7 @@ import { createThrottle, presentedCredential } from "@profullstack/throttle";
 import { Durable } from "./durable.js";
 import { notifyAll, resendEmail, webPush } from "./notify.js";
 import { inviteSubject, inviteText, isEmail, isPhone, watchLink } from "./invite.js";
+import { EventWriter } from "./event-writer.js";
 import { handleLiveApi } from "./live-api.js";
 import { LiveEvents, eventStructuredData, isTicketed } from "./live-events.js";
 import { Tickets, needsTicket, ticketFrom, ticketsFromEnv } from "./tickets.js";
@@ -1360,6 +1363,7 @@ export function createHandler(engine, options) {
         const webSite = options.webSites?.get((request.headers.host ?? "").toLowerCase());
         const web = webSite?.web ?? options.web;
         const eventSite = webSite?.site ?? options.invites?.site;
+        const accountSite = eventSite ?? options.site ?? "https://nixamp.com";
         const key = options.key ?? null;
         const behindProxy = options.behindProxy ?? false;
         const listenKey = options.listenKey ?? null;
@@ -1445,6 +1449,7 @@ export function createHandler(engine, options) {
             return;
         if (options.events && await handleLiveApi(request, response, url, {
             events: options.events,
+            ...(options.eventWriter ? { eventWriter: options.eventWriter } : {}),
             ...(options.accounts ? { accounts: options.accounts } : {}),
             ...(options.layouts ? { layouts: options.layouts } : {}),
             ...(options.rooms ? { rooms: options.rooms } : {}),
@@ -1947,6 +1952,20 @@ export function createHandler(engine, options) {
             json(response, 200, { name: "nixamp", version: options.version, media: options.media });
             return;
         }
+        if (path === "/reset-password" && options.accounts?.passwordResets) {
+            if (request.method !== "GET" && request.method !== "HEAD") {
+                json(response, 405, { error: "GET only" });
+                return;
+            }
+            const nonce = randomBytes(18).toString("base64");
+            response.writeHead(200, {
+                "content-type": "text/html; charset=utf-8", "cache-control": "no-store",
+                "referrer-policy": "no-referrer", "x-robots-tag": "noindex, nofollow",
+                "content-security-policy": `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'unsafe-inline'; connect-src 'self'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'`,
+            });
+            response.end(request.method === "HEAD" ? undefined : passwordResetPage(accountSite, nonce));
+            return;
+        }
         // --- accounts ---------------------------------------------------------
         //
         // Before the share-key check, because signing in is how somebody without a
@@ -1955,6 +1974,58 @@ export function createHandler(engine, options) {
         if (path.startsWith("/api/v1/auth/") && options.accounts) {
             const accounts = options.accounts;
             const secure = options.secureCookies ?? false;
+            if (path === "/api/v1/auth/password-reset/request" || path === "/api/v1/auth/password-reset/confirm") {
+                if (request.method !== "POST") {
+                    json(response, 405, { error: "POST only" });
+                    return;
+                }
+                const confirming = path.endsWith("/confirm");
+                if (!accounts.passwordResets || (!confirming && !options.resetMail)) {
+                    json(response, 503, { error: "Password reset email is temporarily unavailable. Please try again later." });
+                    return;
+                }
+                const who = callerOf(request.headers, request.socket.remoteAddress, behindProxy);
+                const limit = guard.check(`password-reset:${confirming ? "confirm" : "request"}:${who}`, { allowed: confirming ? 15 : 10, windowMs: 15 * 60_000 });
+                if (!limit.ok) {
+                    response.setHeader("retry-after", String(limit.retryAfter));
+                    json(response, 429, { error: "Too many attempts. Please try again in 15 minutes." });
+                    return;
+                }
+                try {
+                    const input = JSON.parse(await readBody(request, 4096));
+                    if (!input || typeof input !== "object" || Array.isArray(input)) {
+                        json(response, 400, { error: "Provide a JSON object." });
+                        return;
+                    }
+                    const body = input;
+                    if (confirming) {
+                        const error = await accounts.passwordResets.confirm(body["token"], body["password"]);
+                        if (error) {
+                            json(response, error === RESET_INVALID ? 400 : 422, { error });
+                            return;
+                        }
+                        response.setHeader("set-cookie", clearedCookie());
+                        json(response, 200, { message: "Your password has been changed. Sign in with your new password." });
+                    }
+                    else {
+                        const email = typeof body["email"] === "string" ? body["email"].trim().toLowerCase() : "";
+                        if (email.length > 320 || !/^[^@\s]+@[^@\s.]+\.[^@\s]+$/.test(email)) {
+                            json(response, 422, { error: "Enter a valid email address." });
+                            return;
+                        }
+                        // Count every address, including nonexistent ones, identically.
+                        const address = guard.check(`password-reset:email:${email}`, { allowed: 3, windowMs: 15 * 60_000 });
+                        if (address.ok)
+                            await accounts.passwordResets.request(email, accountSite, options.resetMail);
+                        json(response, 200, { message: RESET_MESSAGE });
+                    }
+                }
+                catch (error) {
+                    const malformed = error instanceof SyntaxError || error.message === "body too large";
+                    json(response, malformed ? 400 : 503, { error: malformed ? "Provide a valid JSON request." : "Password reset is temporarily unavailable. Please try again." });
+                }
+                return;
+            }
             if (path === "/api/v1/auth/me") {
                 const who = await accounts.whoIs(tokenFrom(request.headers));
                 if (who === null) {
@@ -2409,9 +2480,25 @@ export function createHandler(engine, options) {
                     return;
                 }
                 if (!who)
-                    throw new SpeechError("Sign in to buy translated audio.", 401);
+                    throw new SpeechError("Sign in to use translated audio.", 401);
                 if (!guard.check(`translation-pass-account:${who.id}`, { allowed: 30, windowMs: 60_000 }).ok)
                     throw new SpeechError("Too many purchase requests.", 429);
+                if (path === "/api/v1/translation-passes/session" && request.method === "POST") {
+                    if (!request.headers["content-type"]?.startsWith("application/json"))
+                        throw new SpeechError("Send a panel session as JSON.", 415);
+                    let body;
+                    try {
+                        body = JSON.parse(await readBody(request, 1024));
+                    }
+                    catch {
+                        throw new SpeechError("Choose a panel session.", 400);
+                    }
+                    if (typeof body?.resource !== "string")
+                        throw new SpeechError("Choose a panel session.", 400);
+                    await service.begin(who.id, body.resource);
+                    json(response, 200, await service.access(who.id));
+                    return;
+                }
                 if (path === "/api/v1/translation-passes/checkout" && request.method === "POST") {
                     if (!request.headers["content-type"]?.startsWith("application/json"))
                         throw new SpeechError("Send a purchase as JSON.", 415);
@@ -2492,7 +2579,10 @@ export function createHandler(engine, options) {
                             return;
                         }
                         const bytes = await readBytes(request, 484_000);
-                        json(response, 200, await service.hear(bytes, who.id, controller.signal));
+                        const resource = request.headers["x-nixamp-translation-session"];
+                        if (resource !== undefined && (typeof resource !== "string" || !/^[\w-]{1,80}$/.test(resource)))
+                            throw new SpeechError("Choose a panel session.", 400);
+                        json(response, 200, await service.hear(bytes, who.id, controller.signal, undefined, resource));
                     }
                     else if (path.endsWith("/grant") && request.method === "POST") {
                         if (!request.headers["content-type"]?.startsWith("application/json")) {
@@ -5511,6 +5601,10 @@ export async function serve(argv, version = "0.1.0") {
     const favorites = pool ? new Favorites(pool) : undefined;
     const settingsSync = pool ? new SettingsSync(pool) : undefined;
     const nixampSite = (process.env["NIXAMP_SITE"] ?? DEFAULT_DIRECTORY).replace(/\/+$/, "");
+    const schoolMailKey = process.env["BACKTOSCHOOL_RESEND_API_KEY"] ?? process.env["RESEND_API_KEY"];
+    const schoolMail = schoolMailKey && process.env["BACKTOSCHOOL_MAIL_FROM"] ? {
+        apiKey: schoolMailKey, from: process.env["BACKTOSCHOOL_MAIL_FROM"],
+    } : undefined;
     const events = pool ? new LiveEvents(pool) : undefined;
     const layouts = pool ? new Layouts(pool) : undefined;
     const rooms = pool ? new Rooms(pool) : undefined;
@@ -6030,7 +6124,10 @@ export async function serve(argv, version = "0.1.0") {
         ...(follows ? { follows, vapidPublicKey } : {}),
         ...(favorites ? { favorites } : {}),
         ...(settingsSync ? { settingsSync } : {}),
-        ...(events ? { events } : {}),
+        ...(events ? { events, eventWriter: new EventWriter({
+                openaiKey: process.env["OPENAI_API_KEY"], anthropicKey: process.env["ANTHROPIC_API_KEY"],
+                openaiModel: process.env["NIXAMP_WRITER_OPENAI_MODEL"], claudeModel: process.env["NIXAMP_WRITER_CLAUDE_MODEL"],
+            }) } : {}),
         ...(layouts ? { layouts } : {}),
         ...(rooms ? { rooms } : {}),
         ...(trollbox ? { trollbox } : {}),
@@ -6043,6 +6140,13 @@ export async function serve(argv, version = "0.1.0") {
         ...(translations ? { translations } : {}),
         ...(records ? { records } : {}),
         site: nixampSite,
+        ...(accounts && process.env["RESEND_API_KEY"] ? {
+            resetMail: resendPasswordReset({
+                apiKey: process.env["RESEND_API_KEY"],
+                from: process.env["NIXAMP_MAIL_FROM"] ?? "nixamp <notifications@nixamp.com>",
+                backtoschool: schoolMail,
+            }),
+        } : {}),
         // Other people's OpenProfiles, read for the voice a line is spoken in,
         // and the voices to speak in: ElevenLabs when the Telnyx account holds
         // the key for it (an integration secret named "elevenlabs"), Kokoro
@@ -6065,6 +6169,8 @@ export async function serve(argv, version = "0.1.0") {
                             email: resendEmail({
                                 apiKey: process.env["RESEND_API_KEY"],
                                 from: process.env["NIXAMP_MAIL_FROM"] ?? "nixamp <notifications@nixamp.com>",
+                                backtoschool: schoolMail,
+                                reason: "You received this email because a host invited you to join a live session.",
                                 onEvent: (message) => console.log(message),
                             }),
                         }

package/dist/shared-translation.d.ts

@@ -27,6 +27,7 @@ export type SharedEvent = {
 } | {
     type: "error";
     error: string;
+    retryable?: boolean;
 };
 type Member = {
     by: string;

package/dist/shared-translation.js

@@ -1,5 +1,6 @@
 /** One live source/language pipeline, paid access for every listening account.
  * Browsers receive the same PCM, never upload a replacement for a public feed. */
+import { transientAudioError } from "./live-recovery.js";
 import { createHash, randomUUID } from "node:crypto";
 import { lookup } from "node:dns/promises";
 import { BlockList, isIP } from "node:net";
@@ -93,23 +94,31 @@ export class SharedTranslations {
         const source = sharedSource(raw);
         if (!LIVE_VOICE_LANGUAGES.has(language))
             throw new SpeechError("Choose a supported audio language.", 400);
-        await this.options.billing?.require(by);
-        const connections = [...this.feeds.values()].reduce((total, feed) => total + [...feed.members].filter(member => member.by === by).length, 0);
-        if (connections >= 2)
-            throw new SpeechError("Translated audio is already open in two players for this account.", 429);
         const id = `dub-${createHash("sha256").update(`${source}|${language}`).digest("hex").slice(0, 40)}`;
+        const capacity = () => {
+            const connections = [...this.feeds.values()].reduce((total, feed) => total + [...feed.members].filter(member => member.by === by).length, 0);
+            if (connections >= 2)
+                throw new SpeechError("Translated audio is already open in two players for this account.", 429);
+            const feed = this.feeds.get(id);
+            if (!feed && this.feeds.size >= 4)
+                throw new SpeechError("Live translation is busy. Try again shortly.", 429);
+            if (feed && feed.members.size >= 1000)
+                throw new SpeechError("This translated stream is full. Try again shortly.", 429);
+        };
+        capacity();
+        if (this.options.billing?.begin)
+            await this.options.billing.begin(by, id);
+        else
+            await this.options.billing?.require(by, id);
+        capacity(); // Other joins can finish during the account/database check.
         let feed = this.feeds.get(id);
         if (!feed) {
-            if (this.feeds.size >= 4)
-                throw new SpeechError("Live translation is busy. Try again shortly.", 429);
             feed = this.make(id, source, language);
             this.feeds.set(id, feed);
             const current = feed;
             current.heartbeat = setInterval(() => void this.checkMembers(current), 10_000);
             current.heartbeat.unref?.();
         }
-        if (feed.members.size >= 1000)
-            throw new SpeechError("This translated stream is full. Try again shortly.", 429);
         const member = { by, send, close };
         feed.members.add(member);
         this.broadcast(feed, { type: "status", listeners: feed.members.size });
@@ -135,18 +144,18 @@ export class SharedTranslations {
     }
     async checkMembers(feed) {
         const accounts = [...new Set([...feed.members].map(member => member.by))];
-        let funded = new Set(accounts), message = "Your translation balance is used up or expired. Buy another pass to continue.";
+        let funded = new Set(accounts), message = "This free session ended and audio credit is used up. Start a remaining free session or buy a pass.";
         try {
             if (this.options.billing?.eligible)
-                funded = new Set(await this.options.billing.eligible(accounts));
+                funded = new Set(await this.options.billing.eligible(accounts, feed.id));
             else if (this.options.billing) {
-                const results = await Promise.allSettled(accounts.map(by => this.options.billing.require(by)));
+                const results = await Promise.allSettled(accounts.map(by => this.options.billing.require(by, feed.id)));
                 funded = new Set(accounts.filter((_by, index) => results[index]?.status === "fulfilled"));
             }
         }
         catch {
             funded.clear();
-            message = "Your translation balance could not be checked. Try again shortly.";
+            message = "Your translation access could not be checked. Try again shortly.";
         }
         for (const member of [...feed.members])
             if (accounts.includes(member.by) && !funded.has(member.by)) {
@@ -171,17 +180,17 @@ export class SharedTranslations {
             }
         }
     }
-    stop(feed, error) {
-        this.broadcast(feed, { type: "error", error });
+    stop(feed, error, retryable = false) {
+        this.broadcast(feed, { type: "error", error, retryable });
         for (const member of [...feed.members]) {
             this.leave(feed, member);
             member.close();
         }
     }
     make(id, source, language) {
-        const feed = { id, source, language, members: new Set(), controller: new AbortController(), reservations: new Map(), queue: [], speaking: false, previous: Buffer.alloc(0), pending: Buffer.alloc(0), until: Date.now() };
-        // Every active account pays the same published access rate. API work is
-        // done once; additional listeners do not trigger recognition or synthesis.
+        const feed = { id, source, language, members: new Set(), controller: new AbortController(), reservations: new Map(), queue: [], speaking: false, voiceFailures: 0, previous: Buffer.alloc(0), pending: Buffer.alloc(0), until: Date.now() };
+        // Each account uses free access first, then the same published credit rate.
+        // Additional listeners do not trigger recognition or synthesis.
         feed.meter = {
             require: async () => { if (!feed.members.size)
                 throw new SpeechError("No listeners.", 410); },
@@ -191,13 +200,13 @@ export class SharedTranslations {
                 const accepted = new Set();
                 const billing = this.options.billing;
                 if (billing?.reserveMany) {
-                    for (const charged of await billing.reserveMany(accounts, kind, units)) {
+                    for (const charged of await billing.reserveMany(accounts, kind, units, feed.id)) {
                         ids.push(charged.id);
                         accepted.add(charged.by);
                     }
                 }
                 else {
-                    const results = await Promise.allSettled(accounts.map(async (account) => ({ by: account, id: await billing?.reserve(account, kind, units) })));
+                    const results = await Promise.allSettled(accounts.map(async (account) => ({ by: account, id: await billing?.reserve(account, kind, units, feed.id) })));
                     let failure;
                     for (const result of results) {
                         if (result.status === "fulfilled") {
@@ -216,7 +225,7 @@ export class SharedTranslations {
                 for (const member of [...feed.members])
                     if (accounts.includes(member.by) && !accepted.has(member.by)) {
                         try {
-                            member.send({ type: "error", error: "Your translation balance is used up or expired. Buy another pass to continue." });
+                            member.send({ type: "error", error: "This free session ended and audio credit is used up. Start a remaining free session or buy a pass." });
                         }
                         catch { /* disconnected */ }
                         finally {
@@ -246,13 +255,10 @@ export class SharedTranslations {
             language: () => language, speakers: () => true, voices: () => voices, channel: () => id,
             status: text => { if (!feed.controller.signal.aborted && !feed.members.size)
                 this.stop(feed, text); },
-            failed: () => this.stop(feed, "Live translation stopped. Enable it again to retry."),
+            failed: message => this.stop(feed, message),
             lines: lines => {
                 feed.queue.push(...lines);
-                if (feed.queue.length > 24) {
-                    this.stop(feed, "Live translation fell behind. Enable it again to retry.");
-                    return;
-                }
+                feed.queue = feed.queue.filter(line => Date.now() - line.until <= 12_000).slice(-24);
                 if (!feed.speaking)
                     void this.speak(feed);
             },
@@ -288,7 +294,7 @@ export class SharedTranslations {
                         samples[index] = pcm.readInt16LE(index * 2) / 32768;
                     feed.interpreter.push({ samples, at: feed.until - samples.length / 16, until: feed.until, freshAt: feed.until - 2000 });
                 }
-            }, () => this.stop(feed, "The live source stopped. Enable translated audio again when playback resumes."), feed.controller.signal);
+            }, () => this.stop(feed, "The live source disconnected.", true), feed.controller.signal);
             if (feed.controller.signal.aborted)
                 input.stop();
             else
@@ -304,24 +310,35 @@ export class SharedTranslations {
             while (feed.queue.length && !feed.controller.signal.aborted) {
                 const line = feed.queue.shift();
                 if (Date.now() - line.until > 12_000)
-                    throw new SpeechError("Live translation fell behind. Enable it again to retry.", 503);
-                const response = await this.options.voice.stream({ text: line.text, language: feed.language, channel: feed.id, speaker: line.speaker, voice: feed.interpreter.tracker.speakers.get(line.speaker ?? "")?.voice }, feed.id, feed.controller.signal, feed.meter);
-                const id = randomUUID();
-                this.broadcast(feed, { type: "line", id, line });
-                const reader = response.body.getReader();
+                    continue;
                 try {
-                    while (true) {
-                        const { done, value } = await reader.read();
-                        if (done)
-                            break;
-                        for (let at = 0; at < value.length; at += 16_384)
-                            this.broadcast(feed, { type: "audio", id, data: Buffer.from(value.subarray(at, at + 16_384)).toString("base64") });
+                    const response = await this.options.voice.stream({ text: line.text, language: feed.language, channel: feed.id, speaker: line.speaker, voice: feed.interpreter.tracker.speakers.get(line.speaker ?? "")?.voice }, feed.id, feed.controller.signal, feed.meter);
+                    const id = randomUUID();
+                    this.broadcast(feed, { type: "line", id, line });
+                    const reader = response.body.getReader();
+                    try {
+                        while (true) {
+                            const { done, value } = await reader.read();
+                            if (done)
+                                break;
+                            for (let at = 0; at < value.length; at += 16_384)
+                                this.broadcast(feed, { type: "audio", id, data: Buffer.from(value.subarray(at, at + 16_384)).toString("base64") });
+                        }
                     }
+                    finally {
+                        reader.releaseLock();
+                        this.broadcast(feed, { type: "end", id });
+                    }
+                    feed.voiceFailures = 0;
                 }
-                finally {
-                    reader.releaseLock();
+                catch (error) {
+                    if (feed.controller.signal.aborted)
+                        return;
+                    if (!transientAudioError(error) || ++feed.voiceFailures >= 3)
+                        throw error;
+                    // A provider failure skips this phrase; the source and other listeners
+                    // remain connected. Never replay partial speech or retry a charge.
                 }
-                this.broadcast(feed, { type: "end", id });
             }
         }
         catch (error) {

package/dist/tokens.d.ts

@@ -56,6 +56,8 @@ export declare class Tokens {
      * sign in is a setup step too many.
      */
     private ensure;
+    /** Recovery revokes this table in the same transaction as the password update. */
+    initialize(): Promise<void>;
     issue(options: IssueOptions): Promise<IssuedToken>;
     /** The account a token belongs to, or null for one this server will not accept. */
     verify(value: string): Promise<Account | null>;

package/dist/tokens.js

@@ -111,6 +111,8 @@ export class Tokens {
         this.ready ??= this.db.query(SCHEMA).then(() => undefined);
         await this.ready;
     }
+    /** Recovery revokes this table in the same transaction as the password update. */
+    async initialize() { await this.ensure(); }
     async issue(options) {
         await this.ensure();
         const { id, secret, token } = mintToken();

package/dist/translation-passes.d.ts

@@ -1,4 +1,5 @@
 import type { Queryable } from "./follows.ts";
+import { UpgradeAllowances, type UpgradeAllowance } from "./upgrade-allowance.ts";
 export declare const TRANSLATION_MULTIPLIER = 5;
 export declare const TRANSLATION_PLANS: readonly [{
     readonly id: "day";
@@ -19,10 +20,11 @@ export declare const TRANSLATION_PLANS: readonly [{
 export type TranslationPlan = typeof TRANSLATION_PLANS[number];
 export type TranslationUsage = "transcription" | "voice";
 export interface TranslationMeter {
-    require(by: string): Promise<void>;
-    eligible?(accounts: string[]): Promise<string[]>;
-    reserve(by: string, kind: TranslationUsage, units: number): Promise<string>;
-    reserveMany?(accounts: string[], kind: TranslationUsage, units: number): Promise<{
+    begin?(by: string, resource: string): Promise<void>;
+    require(by: string, resource?: string): Promise<void>;
+    eligible?(accounts: string[], resource?: string): Promise<string[]>;
+    reserve(by: string, kind: TranslationUsage, units: number, resource?: string): Promise<string>;
+    reserveMany?(accounts: string[], kind: TranslationUsage, units: number, resource?: string): Promise<{
         by: string;
         id: string;
     }[]>;
@@ -48,6 +50,7 @@ export interface TranslationAccess {
         voiceThousand: number;
         multiplier: number;
     };
+    free: UpgradeAllowance;
 }
 /** At the published rates: Scribe $0.22/submitted hour, Flash $0.05/1k chars.
  * Transcription units are 16 kHz samples; overlap is charged exactly as sent. */
@@ -63,6 +66,7 @@ export declare class TranslationPasses implements TranslationMeter {
     private merchantUntil;
     private readonly fetcher;
     private readonly now;
+    readonly free: UpgradeAllowances;
     constructor(options: {
         db: Queryable;
         key: string;
@@ -74,11 +78,12 @@ export declare class TranslationPasses implements TranslationMeter {
     private provider;
     private settings;
     access(by?: string): Promise<TranslationAccess>;
-    require(by: string): Promise<void>;
-    eligible(accounts: string[]): Promise<string[]>;
-    reserve(by: string, kind: TranslationUsage, units: number): Promise<string>;
+    begin(by: string, resource: string): Promise<void>;
+    require(by: string, resource?: string): Promise<void>;
+    eligible(accounts: string[], resource?: string): Promise<string[]>;
+    reserve(by: string, kind: TranslationUsage, units: number, resource?: string): Promise<string>;
     /** Batch a shared stream's access charges in one database round trip. */
-    reserveMany(accounts: string[], kind: TranslationUsage, units: number): Promise<{
+    reserveMany(accounts: string[], kind: TranslationUsage, units: number, resource?: string): Promise<{
         by: string;
         id: string;
     }[]>;